#!/bin/sh

# skript posiela e-mail uzivatelom ktorym konci platnost hesla 
# Autor: zz_indigo (Jan. 2012)
# License: GPL3

# konfiguracne premenne
# Pocet dni do skoncenia platnosti hesla odkedy sa generuju emaily.
DAYS=8

# Ldap URI
URI="ldaps://ad.test.com"

# MS DOMENA
DOMAIN="TEST"

# Ldap BASE
BASE="dc=test,dc=com"

# User LDAP OU
UOU="CN=Users"

# Ldap konto pod ktorym sa hlada
BIND_DN="CN=spamer,CN=Users,dc=slsp,dc=sk"

# Heslo 
BIND_PWD="Tajne Heslo"

# Filter na email domeny (Egrep format)
MAILS="@test.sk\|@test.com"

# subject spravy Je mozno doplnit login alebo UPN. napisanim do textu MUSER pripadne MUPN
SUBJ="Platnost Vasho hesla pre konto \"$DOMAIN\"\\MUSER skonci za menej ako $DAYS dni"

# Telo spravy Je mozno doplnit login alebo UPN. napisanim do textu MUSER pripadne MUPN
DATA="Dobry den.\n\nPlatnost Vasho konta \"$DOMAIN\"\\MUSER (upn: MUPN) skonci za menej ako $DAYS dni.\n\nTato sprava je automaticky generovana, prosim neodpovedajte na nu."


# Kolko sekund pred koncom treba varovat (ldap to maulozene v sekundach)
SEC=$(expr $DAYS \* 86400)

# Zistime si aka je maximalna platnost hesla pre domenu
MAXAGE=$(ldapsearch -LLL -s base -H "$URI" -b "$BASE" -D "$BIND_DN" -w "$BIND_PWD"  maxPwdAge | awk -F- '/maxPwdAge/ {print $2/10000000}')
# Prevedieme aktualny datum do ldap timestampu
AGE=$(expr $(date +%s) + 11644473600 - $MAXAGE + $SEC )0000000

# najdeme ludi ktorym konci platonost hesla v pozadovanom rozsahu a vypiseme si UPN/MAIL/samacountname a prevedieme do formatu kde budu tieto udaje pekne za sebou (ten AWK)
ldapsearch -LLL -H "$URI" -b "$UOU,$BASE" -D "$BIND_DN" -w "$BIND_PWD" "(&(objectCategory=person)(objectclass=user)(userAccountControl=512)(pwdLastSet<=$AGE)(!(pwdLastSet=0))(mail=*))" samaccountname mail userPrincipalName |  awk -F': ' '/mail/ {ORS="\n";print $2} /sAMAccountName/  {ORS=" ";split ($2,fields,"-"); print fields[1]} /userPrincipalName/ {ORS=" ";split ($2,fields,"-"); print fields[1]}' | while read LINE
do 
        # z riadku si zistime mail
        MMAIL=$(echo $LINE | cut -f 3 -d " ")
        # zistime ci dany email je z tych ktore mame upozornovat
        if [ "$(echo $MMAIL | grep -e $MAILS)" != "" ]  
                then
                # z riadku si zistime login a upn
                MUPN=$(echo $LINE | cut -f 2 -d " ")
                MUSER=$(echo $LINE | cut -f 1 -d " ")
                SUBJB=$(echo $SUBJ | awk "{ gsub(/MUPN/,\"$MUPN\"); gsub(/MUSER/,\"$MUSER\"); print }")
                echo $DATA | awk "{ gsub(/MUPN/,\"$MUPN\"); gsub(/MUSER/,\"$MUSER\"); print }" | mail -s "$SUBJB" -r no-reply@test.com $MMAIL
        fi
done