Create a staging user, activate it and then stage it again:
$ ipa stageuser-add some-user1 --first Some --last User1 --password Password: Enter Password again to verify: ----------------------------- Added stage user "some-user1" ----------------------------- User login: some-user1 First name: Some Last name: User1 Full name: Some User1 Display name: Some User1 Initials: SU Home directory: /home/some-user1 GECOS: Some User1 Login shell: /bin/sh Principal name: some-user1@IPA1DEMO.TEST Principal alias: some-user1@IPA1DEMO.TEST User password expiration: 20250111141538Z Email address: some-user1@ipa1demo.test Password: some value UID: -1 GID: -1 Password: True Kerberos keys available: True $ ipa stageuser-activate some-user1 ------------------------------- Stage user some-user1 activated ------------------------------- User login: some-user1 First name: Some Last name: User1 Home directory: /home/some-user1 Login shell: /bin/sh Principal name: some-user1@IPA1DEMO.TEST Principal alias: some-user1@IPA1DEMO.TEST Email address: some-user1@ipa1demo.test UID: 61014 GID: 61014 Password: True Member of groups: ipausers Kerberos keys available: True $ ipa user-stage some-user1 ipa: ERROR: attribute "mepManagedEntry" not allowed
The user is not moved to stage area because stage area does not allow mepManagedEntry objectclass. As a result, the user entry continues to be active.
mepManagedEntry
Expected behavior: - user entry is moved to staging area and becomes disabled - mepManagedEntry associated with the user entry (user private group) gets removed.
We don't have a test for this behavior. We only have a test where a user first deleted with ipa user-del --preserve.
ipa user-del --preserve
From the diagram in https://docs.redhat.com/en/documentation/Red_Hat_Enterprise_Linux/9/html/managing_idm_users_groups_hosts_and_access_control_rules/managing-user-accounts-using-the-command-line_managing-users-groups-hosts#user-life-cycle_managing-idm-users-using-the-command-line, the life-cycle allows to move a user to the staging area only if it has been deleted with --preserve. We either need to: - allow the move from active to staged and remove ht memManagedEntry or - prevent moving from active to staged and display a message like "Operation not permitted on an active user. You need first to delete the user with --preserve flag"
I'm fine either way. The issue here is that a commend is accessible for active users and does not really work.