Automatically expire LDAP users for clubs #110

New Issue

merenber · 2023-10-26T03:53:53-04:00

merenber commented

2023-10-26 03:53:53 -04:00

The LDAP user entries for clubs (which do not have corresponding Kerberos principals) should have shadowExpire=1 set when they no longer have any active club reps. This way, PAM will prevent their cron jobs from running. Resources such as cloud VMs and vhost configs (on caffeine) should automatically get removed/disabled, and an notification email should get sent. A warning email should be sent at least one week in advance.

We will need to add a new API endpoint, e.g. /api/groups/expire.

The LDAP user entries for clubs (which do not have corresponding Kerberos principals) should have `shadowExpire=1` set when they no longer have any active club reps. This way, PAM will prevent their cron jobs from running. Resources such as cloud VMs and vhost configs (on caffeine) should automatically get removed/disabled, and an notification email should get sent. A warning email should be sent at least one week in advance. We will need to add a new API endpoint, e.g. `/api/groups/expire`.

merenber added the

priority

medium

label 2023-10-26 03:53:58 -04:00

merenber added

and removed

labels 2024-03-01 17:55:07 -05:00

merenber commented

2024-03-01 17:55:29 -05:00

Bumping to high because there are some clubs which use lingering systemd services for their club accounts.

merenber referenced this issue

2024-03-01 18:01:15 -05:00

Disallow clubs from using CSC email #111

n4chung commented

2024-03-05 17:57:52 -05:00

Question is how often to check for "non-active" club reps? is there a grace period or something?

merenber commented

2024-03-11 14:59:28 -04:00

Question is how often to check for "non-active" club reps? is there a grace period or something?

If a club has had no active club reps for an entire term or longer, then we should consider it to be inactive.

> Question is how often to check for "non-active" club reps? is there a grace period or something? > If a club has had no active club reps for an entire term or longer, then we should consider it to be inactive.

Sign in to join this conversation.