From 5a036c141e820c42654b6d490fa4fa79ca50daa9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=B1=88=E8=BD=A9?= <qu_xuan@icloud.com>
Date: Tue, 4 Jun 2024 00:47:43 +0800
Subject: [PATCH] fix(keystone): avoid sync remove disabled ldap user (#20436)

---
 pkg/keystone/driver/ldap/info.go | 4 +++-
 pkg/keystone/driver/ldap/sync.go | 6 +++++-
 pkg/keystone/options/options.go  | 3 ++-
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/pkg/keystone/driver/ldap/info.go b/pkg/keystone/driver/ldap/info.go
index a8c2f31e1a..236de4b932 100644
--- a/pkg/keystone/driver/ldap/info.go
+++ b/pkg/keystone/driver/ldap/info.go
@@ -16,6 +16,8 @@ package ldap
 
 import (
 	"yunion.io/x/pkg/errors"
+
+	"yunion.io/x/onecloud/pkg/keystone/options"
 )
 
 const (
@@ -61,7 +63,7 @@ func (info SUserInfo) isValid() error {
 		return err
 	}
 	// regarding disabled LDAP user as invalid
-	if !info.Enabled {
+	if !options.Options.LdapSyncDisabledUsers && !info.Enabled {
 		return ErrDisabledUser
 	}
 	return nil
diff --git a/pkg/keystone/driver/ldap/sync.go b/pkg/keystone/driver/ldap/sync.go
index 58317c2104..0dff636d14 100644
--- a/pkg/keystone/driver/ldap/sync.go
+++ b/pkg/keystone/driver/ldap/sync.go
@@ -248,7 +248,11 @@ func (drv *SLDAPDriver) syncUserDB(ctx context.Context, ui SUserInfo, domainId s
 	if err != nil {
 		return "", errors.Wrap(err, "models.IdentityProviderManager.FetchIdentityProviderById")
 	}
-	usr, err := idp.SyncOrCreateUser(ctx, ui.Id, ui.Name, domainId, !drv.ldapConfig.DisableUserOnImport, func(user *models.SUser) {
+	enableDefault := !drv.ldapConfig.DisableUserOnImport
+	if !ui.Enabled {
+		enableDefault = false
+	}
+	usr, err := idp.SyncOrCreateUser(ctx, ui.Id, ui.Name, domainId, enableDefault, func(user *models.SUser) {
 		// LDAP user is always enabled
 		// if ui.Enabled {
 		// 	user.Enabled = tristate.True
diff --git a/pkg/keystone/options/options.go b/pkg/keystone/options/options.go
index ae3abe20c3..897a36f98b 100644
--- a/pkg/keystone/options/options.go
+++ b/pkg/keystone/options/options.go
@@ -71,7 +71,8 @@ type SKeystoneOptions struct {
 	SystemThreeAdminRoleNames []string `help:"Name of system three-admin roles" default:"sys_secadmin,sys_opsadmin,sys_adtadmin"`
 	DomainThreeAdminRoleNames []string `help:"Name of system three-admin roles" default:"domain_secadmin,domain_opsadmin,domain_adtadmin"`
 
-	LdapSearchPageSize uint32 `help:"pagination size for LDAP search" default:"100"`
+	LdapSearchPageSize    uint32 `help:"pagination size for LDAP search" default:"100"`
+	LdapSyncDisabledUsers bool   `help:"auto sync ldap disabled users"`
 
 	ProjectAdminRole     string `help:"name of role to be saved as admin user of project" default:"project_owner"`
 	PwdExpiredNotifyDays []int  `help:"The notify for password will expire " default:"1,7"`