fix(keystone): avoid sync remove disabled ldap user (#20436)

pkg/keystone/driver/ldap/info.go

@@ -16,6 +16,8 @@ package ldap
 
 import (
 	"yunion.io/x/pkg/errors"
+
+	"yunion.io/x/onecloud/pkg/keystone/options"
 )
 
 const (
@@ -61,7 +63,7 @@ func (info SUserInfo) isValid() error {
 		return err
 	}
 	// regarding disabled LDAP user as invalid
-	if !info.Enabled {
+	if !options.Options.LdapSyncDisabledUsers && !info.Enabled {
 		return ErrDisabledUser
 	}
 	return nil

pkg/keystone/driver/ldap/sync.go

@@ -248,7 +248,11 @@ func (drv *SLDAPDriver) syncUserDB(ctx context.Context, ui SUserInfo, domainId s
 	if err != nil {
 		return "", errors.Wrap(err, "models.IdentityProviderManager.FetchIdentityProviderById")
 	}
-	usr, err := idp.SyncOrCreateUser(ctx, ui.Id, ui.Name, domainId, !drv.ldapConfig.DisableUserOnImport, func(user *models.SUser) {
+	enableDefault := !drv.ldapConfig.DisableUserOnImport
+	if !ui.Enabled {
+		enableDefault = false
+	}
+	usr, err := idp.SyncOrCreateUser(ctx, ui.Id, ui.Name, domainId, enableDefault, func(user *models.SUser) {
 		// LDAP user is always enabled
 		// if ui.Enabled {
 		// 	user.Enabled = tristate.True

pkg/keystone/options/options.go

@@ -71,7 +71,8 @@ type SKeystoneOptions struct {
 	SystemThreeAdminRoleNames []string `help:"Name of system three-admin roles" default:"sys_secadmin,sys_opsadmin,sys_adtadmin"`
 	DomainThreeAdminRoleNames []string `help:"Name of system three-admin roles" default:"domain_secadmin,domain_opsadmin,domain_adtadmin"`
 
-	LdapSearchPageSize uint32 `help:"pagination size for LDAP search" default:"100"`
+	LdapSearchPageSize    uint32 `help:"pagination size for LDAP search" default:"100"`
+	LdapSyncDisabledUsers bool   `help:"auto sync ldap disabled users"`
 
 	ProjectAdminRole     string `help:"name of role to be saved as admin user of project" default:"project_owner"`
 	PwdExpiredNotifyDays []int  `help:"The notify for password will expire " default:"1,7"`