#9729 `user-stage` does not work
Opened by abbra. Modified

Create a staging user, activate it and then stage it again:

$ ipa stageuser-add some-user1 --first Some --last User1 --password
Password: 
Enter Password again to verify: 
-----------------------------
Added stage user "some-user1"
-----------------------------
  User login: some-user1
  First name: Some
  Last name: User1
  Full name: Some User1
  Display name: Some User1
  Initials: SU
  Home directory: /home/some-user1
  GECOS: Some User1
  Login shell: /bin/sh
  Principal name: some-user1@IPA1DEMO.TEST
  Principal alias: some-user1@IPA1DEMO.TEST
  User password expiration: 20250111141538Z
  Email address: some-user1@ipa1demo.test
  Password: some value
  UID: -1
  GID: -1
  Password: True
  Kerberos keys available: True
$ ipa stageuser-activate some-user1
-------------------------------
Stage user some-user1 activated
-------------------------------
  User login: some-user1
  First name: Some
  Last name: User1
  Home directory: /home/some-user1
  Login shell: /bin/sh
  Principal name: some-user1@IPA1DEMO.TEST
  Principal alias: some-user1@IPA1DEMO.TEST
  Email address: some-user1@ipa1demo.test
  UID: 61014
  GID: 61014
  Password: True
  Member of groups: ipausers
  Kerberos keys available: True
$ ipa user-stage some-user1
ipa: ERROR: attribute "mepManagedEntry" not allowed

The user is not moved to stage area because stage area does not allow mepManagedEntry objectclass. As a result, the user entry continues to be active.

Expected behavior:
- user entry is moved to staging area and becomes disabled
- mepManagedEntry associated with the user entry (user private group) gets removed.


We don't have a test for this behavior. We only have a test where a user first deleted with ipa user-del --preserve.

From the diagram in https://docs.redhat.com/en/documentation/Red_Hat_Enterprise_Linux/9/html/managing_idm_users_groups_hosts_and_access_control_rules/managing-user-accounts-using-the-command-line_managing-users-groups-hosts#user-life-cycle_managing-idm-users-using-the-command-line, the life-cycle allows to move a user to the staging area only if it has been deleted with --preserve.
We either need to:
- allow the move from active to staged and remove ht memManagedEntry
or
- prevent moving from active to staged and display a message like "Operation not permitted on an active user. You need first to delete the user with --preserve flag"

I'm fine either way. The issue here is that a commend is accessible for active users and does not really work.

Metadata