Don't login deleted users

ldap/user.go

@@ -33,6 +33,10 @@ type User struct {
 
 // ValidateUser in the ldap
 func (l Ldap) ValidateUser(user string, pass string) (User, error) {
+	if err := l.deletedUser(user); err != nil {
+		return User{}, err
+	}
+
 	conn, err := l.login(user, pass)
 	if err != nil {
 		return User{}, err
@@ -52,6 +56,15 @@ func (l Ldap) ValidateUser(user string, pass string) (User, error) {
 	return newUser(entry), nil
 }
 
+func (l Ldap) deletedUser(user string) error {
+	u, err := l.GetUser(user)
+	if err == nil && u.Locked == Deleted {
+		err = fmt.Errorf("Deleted user %s", user)
+	}
+	return err
+
+}
+
 // IsUserPassUptodate will be true if the password for that user in ldap is using the latest crypto
 func (l Ldap) IsUserPassUptodate(user string) bool {
 	conn, err := l.connect()