ldap-lint: possibly check callinkOid xor calnetUid

[abizer]

accounts probably should not have both of these specified for long periods of time. It may make sense for us to periodically confirm that no associations have been left by accident.

[daradib]

+1 perhaps something like:

ldapsearch -x -b ou=people,dc=ocf,dc=berkeley,dc=edu '(&(calnetuid=*)(callinkoid=*)(!(callinkoid=0)))'

Ideally, when callinkoid is zero, we'd always have a non-zero calnetuid (of the departmental sponsor, not someone who graduates!) to allow online password resets, but there are 209 such non-sorried group accounts without calnetuids:

ldapsearch -x -b ou=people,dc=ocf,dc=berkeley,dc=edu '(&(|(!(calnetuid=*))(calnetuid=0))(callinkoid=0)(!(loginshell=/opt/share/utils/bin/sorried)))'