#!/bin/sh -e

##########################################################################
#   Function description:
#       Pause until user presses return
##########################################################################

pause()
{
    local junk
    
    printf "Press return to continue..."
    read junk
}

# FIXME: Support LDAP, like cluster-adduser
this_host=`hostname`
this_domain=`hostname | awk -F . '{ printf("%s.%s", $(NF-1), $NF) }'`
default_server=ad.${this_domain}:3268
printf "KRB (or AD) server:port for ldapsearch? [$default_server] "
read server
: ${server:=$default_server}
#if [ 0$server = 0 ]; then
#    server=$default_server
#fi

default_ad_user=$USER
printf "YOUR AD Username for user query? [$default_ad_user] "
read ad_user_name
if [ 0$ad_user_name = 0 ]; then
    ad_user_name=$default_ad_user
fi

printf "AD password? "
stty -echo
read ad_pw
stty echo

printf "\n\nChecking for expired users...\n"
for user_name in $(cluster-users); do
    ldap_verified_uid=`ldapsearch -H ldap://$server -x -w $ad_pw -D "AD\\\\$ad_user_name" cn=$user_name | awk '$1 == "cn:" { print $2 }'`
    uwm_member="`ldapsearch -H ldap://$server -x -w $ad_pw -D "AD\\\\$ad_user_name" cn=$user_name | grep -i uwm-member`" || true
    # Debug: printf "uwm_member='%s'\n" "$uwm_member"
    if [ 0$ldap_verified_uid != 0$user_name ] || [ 0"$uwm_member" = 0 ]; then
	done=0
	while [ $done != 1 ]; do
	    printf "\n======================================================\n"
	    printf "$user_name is not active in AD.\n"

	    printf "\n=== Password entry:\n\n"
	    fgrep $user_name /etc/passwd
	    
	    printf "\n=== Group entries:\n\n"
	    fgrep $user_name /etc/group || true
	    
	    printf "\nUsers with this primary group:\n\n"
	    gid=$(awk -F : -v u=$user_name '$1 == u { print $4 }' /etc/passwd)
	    awk -F : -v gid=$gid '$4 == gid { print $0 }' /etc/passwd
	    
	    printf "\n=== Password status:\n\n"
	    auto-password-status $user_name
	    
	    printf "\n=== Recent logins:\n"
	    last $user_name | head -5
	    
	    cat << EOM

1.. Lock account
2.. Remove account
3.. Do nothing

EOM
	    read selection
	    case $selection in
	    1)
		# pw lock $user_name
		cluster-lock-user $user_name
		done=1
		;;
	    2)
		env USER=$ad_user_name cluster-remove-user $user_name || true
		done=1
		;;
	    3)
		done=1
		;;
	    esac
	done
    else
	printf "$user_name is a member of UWM-Member in AD.\n"
    fi
done
