LDAP User Sync to automatically remove users from SnipeIT when users are disabled in AD

[ksgrg]

Hi Community,

Currently the LDAP Sync works perfectly. It's synchronized all the users but when a user is disabled in AD, I would want the user to be deleted in Snipe-IT as well. If anyone has done similar changes and able to make it work, can you please advise me.

Thank you

[ksgrg]

I am using Version v6.3.2
There isn't an option on the Snipe IT settings to set an automatic schedule, one will have to do it through crontab jobs
I have set to run this every six hours. I have snipeIT installed on Ubuntu 22.0.4 and LAMP. The php path is /usr/bin/php and the artisan path is /var/www/html/snipeit

0 */6 * * * /usr/bin/php /var/www/html/snipeit/artisan snipeit:ldap-sync >> /dev/null 2>&1

It still doesn't delete the users deleted or disabled on the AD automatically after a sync. Still looking for answers.

[ksgrg]

Hi I am still looking for a solution to automatically disable users in Snipe-IT when their corresponding Active Directory (AD) accounts are disabled or deleted.

[ShaunNeighbourSwale]

I do all my user management via a powershell script using the Snipe-IT API - It's not to bad to use, but you will need to stick within the API limits if you're managing a large number of users.

For auto deletion, I'm first checking whether the user has any assets assigned, (and then creating a helpdesk ticket for that company's team to handle) and only deleting users without assets - That avoids having to find assets later.

To grab a list of users from the api;

##Report on Users
$APILimit = 999
$Offset = 0
$UserCSV = $Data + "CurrentUsers.csv"
$UserArray = $null
$UserArray = @()
$Header = 'ID,Name,Username,Email,Location_ID,Location,Company_ID,Company,EmployeeNo,Assets,Licenses,Accessories,Consumables'
$UserArray += $Header
$Counter = 0
Write-Host "Downloading report of current users in Snipe-IT" -ForegroundColor Green
##Grab initial batch of users
$Uri = $SnipeITURL + '/api/v1/users?limit=' + $APILimit + '&offset=' + $Offset + '&sort=created_at&order=desc'
$Response = Invoke-WebRequest -Uri $Uri -Method GET -Headers $headers
$CurrentUsers = $Response.Content | ConvertFrom-Json
$TotalUsers = $CurrentUsers.total ##Determine Asset count
while ($Counter -lt $TotalUsers) {
foreach ($User in $CurrentUsers.rows) {
$Counter = $Counter + 1
$ID = $User.id
$Name = $User.name
$Username = $User.username
$Email = $User.email
$LocationID = $User.location.id
$Location = $User.location.name
$CompanyID = $User.company.id
$Company = $User.company.name
$EmployeeNo = $User.employee_num
$Assets = $User.assets_count
$Licenses = $User.licenses_count
$Accessories = $User.accessories_count
$Consumables = $User.consumables_count
Write-Host "$Counter / $TotalUsers - $Name - $Company" -ForegroundColor Cyan
$OutputData = '"' + $ID + '","' + $Name + '","' + $Username + '","' + $Email + '","' + $LocationID + '","' + $Location + '","' + $CompanyID + '","' + $Company + '","' + $EmployeeNo + '","' + $Assets + '","' + $Licenses + '","' + $Accessories + '","' + $Consumables + '"'
$UserArray += $OutputData
}
Sleep 5
$Offset = $Offset + $APILimit
##Grab next batch of assets
$Uri = $SnipeITURL + '/api/v1/users?limit=' + $APILimit + '&offset=' + $Offset + '&sort=created_at&order=desc'
$Response = Invoke-WebRequest -Uri $Uri -Method GET -Headers $headers
$CurrentUsers = $Response.Content | ConvertFrom-Json
}
##Output array to file
`$UserArray | out-file $UserCSV``

Once you've figured out which of those should be deleted, you can run the following;

$Uri = $SnipeITURL + '/api/v1/users/' + $SnipeITUserID
$response = Invoke-WebRequest -Uri $Uri -Method DELETE -Headers $headers -ContentType 'application/json'

The $SnipeITURL will be your instance URL, and the $headers will contain the auth key you've generated for API access. That's all found in the API documentation.

Good luck!