[Freeipa-users] Re: FreeIPA AD locked account vs public key authentication

[John Petrini]

As far as implementing it yourself you could write your own ssh authorized
keys script to lookup the status of the user in LDAP before retrieving
their key. If they are locked just exit and don't return their key.

The script is defined in /etc/ssh/sshd_conf as AuthorizedKeysCommand and
typically points to /usr/bin/sss_ssh_authorizedkeys. sshd calls this script
on login and passes it the username at the first argument.

/usr/bin/sss_ssh_authorizedkeys <username>

So you could wrap this script inside your own with an added ldap search to
first check if the user is locked.