remove non existent users form roles

clean_ghost_ldap_users.py

from ldap3 import Connection, SUBTREE, MODIFY_DELETE
from ldap3.core.exceptions import LDAPException

LDAP_URI = 'ldap://localhost:3899'
BIND_WITH_CREDENTIALS = True
LDAP_BINDDN = 'cn=admin,dc=georchestra,dc=org'
LDAP_PASSWD = 'secret'
USERS_DN = 'ou=users,dc=georchestra,dc=org'
ROLES_DN = 'ou=roles,dc=georchestra,dc=org'


ROLE_OBJECT_CLASS = 'groupOfMembers'

USER_OBJECT_CLASS = 'inetOrgPerson'



if BIND_WITH_CREDENTIALS:
    conn = Connection(LDAP_URI, LDAP_BINDDN, LDAP_PASSWD, auto_bind=True)
else:
    conn = Connection(LDAP_URI, auto_bind=True)


conn.search(search_base=USERS_DN,
            search_filter='(objectClass=%s)' % USER_OBJECT_CLASS,
            search_scope=SUBTREE)

users = []

for entry in conn.entries:
    users.append(entry.entry_dn)

conn.search(search_base=ROLES_DN,
            search_filter='(objectClass=%s)' % ROLE_OBJECT_CLASS,
            search_scope=SUBTREE,
            attributes=['cn', 'member'])

for entry in conn.entries:
    for user in entry.member:
        if (user not in users) :
            conn.modify(entry.entry_dn, {'member': (MODIFY_DELETE, [user])})