Managing a User's Account Information

You can use the manage-account command to display information about the user's account and any password policy that is applied to the user. You can also use this command to enable and disable a user's account. The manage-account command accesses the server over SSL via the administration port. For more information, see Managing Administration Traffic to the Server.

To View a User's Account Information

The manage-account command returns the DN of the password policy in effect on a user account, as well as the account status, and password and login related information

1. To display all available information on a user account, use the manage-account command with the get-all subcommand, as shown in the following example:

   $ manage-account -D "cn=directory manager" -w password get-all \
     --targetDN uid=kvaughan,ou=People,dc=example,dc=com
   Password Policy DN:  cn=Default Password Policy,cn=Password Policies,cn=config
   Account Is Disabled:  false
   Account Expiration Time:
   Seconds Until Account Expiration:
   Password Changed Time:  19700101000000.000Z
   Password Expiration Warned Time:
   Seconds Until Password Expiration:  432000
   Seconds Until Password Expiration Warning:  0
   Authentication Failure Times:
   Seconds Until Authentication Failure Unlock:
   Remaining Authentication Failure Count:
   Last Login Time:
   Seconds Until Idle Account Lockout:
   Password Is Reset:  false
   Seconds Until Password Reset Lockout:
   Grace Login Use Times:
   Remaining Grace Login Count:  4
   Password Changed by Required Time:
   Seconds Until Required Change Time:
   Password History:

2. To display just a single property of the account, substitute the get-all subcommand with the subcommand corresponding to the property you want to view.

   For example, to view just the password history, run the following command:

   $ manage-account -D "cn=directory manager" -w password get-password-history \
     --targetDN "uid=kvaughan,ou=People,dc=example,dc=com"

   For a complete list of subcommands, run the following command:

   $ manage-account --help

To View Account Status Information

You can use the manage-account command to assess whether an account is enabled or disabled.

• Use the manage-account command with the get-account-is-disabled subcommand, as shown in the following example:

  $ manage-account -D "cn=directory manager" -w password get-account-is-disabled \
    --targetDN "uid=kvaughan,ou=People,dc=example,dc=com"
  Account Is Disabled:  false

To Disable an Account

• Use the manage-account command with the set-account-is-disabled subcommand, as shown in the following example:

  $ manage-account -h localhost -p 4444 -D "cn=directory manager" -w password -X \
  set-account-is-disabled --operationValue true \
  --targetDN "uid=kvaughan,ou=People,dc=example,dc=com"
  Account Is Disabled:  true

To Enable an Account

• Use the manage-account command with the clear-account-is-disabled subcommand, as shown in the following example:

  $ manage-account -D "cn=directory manager" -w password clear-account-is-disabled \
    --targetDN "uid=kvaughan,ou=People,dc=example,dc=com"
  Account Is Disabled:  false