Active Directory - Get User's Password Expiration Date

password_check.sh

#!/bin/bash

#   MIT License
#
#   Copyright (c) 2020 Andrew Paglusch
#
#   Permission is hereby granted, free of charge, to any person obtaining a copy
#   of this software and associated documentation files (the "Software"), to deal
#   in the Software without restriction, including without limitation the rights
#   to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
#   copies of the Software, and to permit persons to whom the Software is
#   furnished to do so, subject to the following conditions:
#
#   The above copyright notice and this permission notice shall be included in all
#   copies or substantial portions of the Software.
#
#   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
#   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
#   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
#   AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
#   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
#   OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
#   SOFTWARE.

if [ $# -ne 1 ]; then
    echo "Username not specified!"
    echo -e "\tUSAGE: ./$(basename "$0") jsmith"
    exit 1
fi

LDAPAuthUsername='svc-passwordexpcheck@domain.com'
LDAPAuthPass='CHANGEME'
LDAPServer='ldaps://dc01.domain.com'
LDAPDomainBase='DC=domain,DC=com'
LDAPUserBase='OU=Users,DC=domain,DC=com'
LDAPUserToLookup="$1"

#Check to see if we're looking up a local user. If so, exit.
if grep -q "$LDAPUserToLookup" /etc/passwd; then exit 2; fi

pwdLastSetLDAP=$(LDAPTLS_REQCERT=never ldapsearch -x -LLL -D "${LDAPAuthUsername}" -w "${LDAPAuthPass}" -H "${LDAPServer}" -b "${LDAPUserBase}" "(&(objectclass=user)(samaccountname=${LDAPUserToLookup}))" pwdLastSet | grep ^pwdLast | awk '{print $2}')

#verify we got an integer back from ldapsearch
if ! [ "$pwdLastSetLDAP" -eq "$pwdLastSetLDAP" 2>/dev/null ]; then
        echo "ERROR! Got bad data from LDAP. Exiting.."
        exit 3
fi

pwdMaxAgeLDAP=$(LDAPTLS_REQCERT=never ldapsearch -x -LLL -D "${LDAPAuthUsername}" -s base -w "${LDAPAuthPass}" -H "${LDAPServer}" -b "${LDAPDomainBase}" maxPwdAge | grep ^maxPwdAge | awk '{print $2}' | cut -c2-)

#verify we got an integer back from ldapsearch
if ! [ "$pwdMaxAgeLDAP" -eq "$pwdMaxAgeLDAP" 2>/dev/null ]; then
        echo "ERROR! Got bad data from LDAP. Exiting.."
        exit 4
fi

pwdExpLDAP=$(( $pwdLastSetLDAP + $pwdMaxAgeLDAP ))
pwdExpUNIX=$(( ($pwdExpLDAP - 116444736000000000) / 10000000 ))
pwdExpDays=$(( ($pwdExpUNIX - $(date +%s)) / (3600*24) ))
pwdExpHuman=$(date -d @${pwdExpUNIX})

RED='\e[1m\e[38;5;196m'
YELLOW='\e[1m\e[38;5;226m'
GREEN='\e[1m\e[38;5;46m'
RESET='\e[97m\e[0m'

if [ $pwdExpDays -le 0 ]; then
    echo -e "${RED}!!! Your password HAS EXPIRED !!!${RESET}"
elif [ $pwdExpDays -le 5 ]; then
    echo -e "${RED}!!! Your password will expire in ${pwdExpDays} days !!!${RESET}"
elif [ $pwdExpDays -le 10 ]; then
    echo -e "${YELLOW}Your password will expire in ${pwdExpDays} days${RESET}"
else
    echo -e "${GREEN}Your password will expire in ${pwdExpDays} days${RESET}"
fi