Password expiry notification script

I'm just going to comment on these three lines:

SendMail = "echo '" + MsgBody % (uid,ExpireIn,d2) + "' \
          mail -s " + '"' + Subject + '"' + ' ' + \
          uid + '@' + EmailDomain 
#os.system(SendMail)
print SendMail

1. This doesn't work! You've commented out the line that sends the e-mail. Now, I understand that you did this so that you can test the script without spamming your users with these messages, and that you intend to uncomment the line when you deploy the script. But this isn't the best approach.

   The first problem is that the need to test the script will come up again after you deploy it — you'll need to revise the text of the messages or change some other aspect the way it works, and then you'll want to test it again. So it would be worth your while to build in a permanent testing mechanism that's better than commenting out a line.

   The second problem is that just printing the mail command doesn't actually constitute a test. You have to read the output in order to check that it's correct, and you could easily miss a problem.

   What I suggest is that you have a setting that can be turned on and off to indicate whether the script is in testing or deployment:

   deployed = False           # Is script deployed?
   test_uid = 'rahul.patil'   # Send e-mail to this user if not deployed.
   

   and that you send the e-mail to the test user when testing:

   if not deployed:
       uid = test_uid
   SendMail = "echo '" + MsgBody % (uid,ExpireIn,d2) + "' \
             mail -s " + '"' + Subject + '"' + ' ' + \
             uid + '@' + EmailDomain 
   os.system(SendMail)
   

   Ideally you would provide a way to set the deployed flag (and the test_uid) through the script's command-line interface — see the argparse module for one approach to doing this.

2. When you run a command using os.system, the command gets interpreted by the shell. This is risky, because the shell has complicated quoting and evaluation rules that you may not understand. For example, suppose that you edited MsgBody like this:

   MsgBody = """
   Dear %s,
        Your password will expire in %s day(s). We're sorry for the
   inconvenience, but we need you to change your password by %s.
   """
   

   Looks good, right? But if you actually try this, you'll find that the call to os.system fails with an error like this:

   sh: line 3: inconvenience,: command not found
   sh: -c: line 4: unexpected EOF while looking for matching `''
   sh: -c: line 5: syntax error: unexpected end of file
   

   That's because the single quote in We're was interpreted by the shell as terminating the argument to echo.

   In order to avoid problems like this (where data gets wrongly interpreted as code by the shell), you should avoid passing the arguments to the shell. Instead of os.system, you should use the functions in the subprocess module. For example, like this:

   import subprocess
   
   p = subprocess.Popen(['mail', '-s', Subject, uid + '@' + EmailDomain],
                        stdin=subprocess.PIPE)
   p.communicate(MsgBody % (uid, ExpireIn, d2))
   

You should read through the Python Style Guide. You code does not follow the naming conventions most Python code uses.

Single letter variables should be used sparingly because they might not be as intuitive as you think. A more descriptive name is better.

Imports should generally be done at the top of the file.

string.format() would likely me more readable than the string concatenation you are doing at the end of CheckExpiry().

Your docstrings start with "This Function Will". This is unnecessary since documentation will always be describing what the function does.

At the beginning of your script, you define constants that set the date boundaries. This is good. However, you then repeatably use the value in comments. This is bad because if the policy changes to warn at 21 days, the comments need to be updated in addition to the constant's value.

You don't need a comment for every operation. In general, comments are better at saying why you are doing something, not saying what you are doing.

# if password not changed before 14 days 
if ExpireIn <= PwdWarnDays:

You have good variable names, so this line of code explains itself, the comment doesn't add anything. If you have a line of code that is complicated enough that you feel you need to document what it is doing, this is an indication that there might be a better way to do it.

I would add "bind_s" to connect to ldap with a user

user_dn = 'someuser'
user_pwd = 'somepassword'
l = ldap.initialize(ConnectDC)
l.bind_s(user_dn, user_pwd) #LDAP admin would not allow to query pwdChangedTime as anonymous

and change some code to make it more beautiful when sending mail:

return l.search_s(bind_dn, ldap.SCOPE_SUBTREE, '(uid=*)', ['displayName', 'pwdChangedTime', 'uid'])

for k, v in Users:
    uid = ''.join(v['uid'])
    if 'displayName' in v:
        displayname = ''.join(v['displayName'])
    else:
        displayname = uid
...
if 'pwdChangedTime' in v:
...
else:
    d2 = '[You have not changed your password since account created]'
...
print mail_body % (displayname, pwd_expire_in_days, d2)

I would separate the function definitions from the script functionality with if __name__ == '__main__': as is customary for Python. Also I would have CheckExpiry() take "Users" as an argument and return a list of expired users (or a tuple of name and e-mail address for each). So that would read more like:

#!python
# ....
if __name__ == '__main__':
    userdata = GetUserDetails()
    expired = CheckExpiry(userdata)
# ...

From there I'd create a template (perhaps as simple as one using string.Template from the Python standard libraries, or possibly using something like Jinja2 ... and use it to generate the messages to each user.

If you really want to get fancy you could track the number of warnings you've sent to each user, perhaps in a very simple local flat file database using SQLite3 (also from the standard library).