summaryrefslogtreecommitdiffstats
path: root/ipaserver/plugins/ldapapi.py
diff options
context:
space:
mode:
Diffstat (limited to 'ipaserver/plugins/ldapapi.py')
-rw-r--r--ipaserver/plugins/ldapapi.py445
1 files changed, 0 insertions, 445 deletions
diff --git a/ipaserver/plugins/ldapapi.py b/ipaserver/plugins/ldapapi.py
deleted file mode 100644
index 1ef84579c..000000000
--- a/ipaserver/plugins/ldapapi.py
+++ /dev/null
@@ -1,445 +0,0 @@
-# Authors:
-# Rob Crittenden <rcritten@redhat.com>
-# Jason Gerard DeRose <jderose@redhat.com>
-#
-# Copyright (C) 2008 Red Hat
-# see file 'COPYING' for use and warranty information
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program. If not, see <http://www.gnu.org/licenses/>.
-
-"""
-Backend plugin for LDAP.
-
-This wraps the python-ldap bindings.
-"""
-
-import ldap as _ldap
-from ipalib import api
-from ipalib import errors
-from ipalib.crud import CrudBackend
-from ipaserver import servercore, ipaldap
-import krbV
-
-
-class ldap(CrudBackend):
- """
- LDAP backend plugin.
- """
-
- def __init__(self):
- self.dn = _ldap.dn
- super(ldap, self).__init__()
-
- def create_connection(self, ccache):
- if ccache is None:
- raise errors.CCacheError()
- conn = ipaldap.IPAdmin(self.env.ldap_host, self.env.ldap_port)
- principal = krbV.CCache(
- name=ccache, context=krbV.default_context()
- ).principal().name
- conn.set_krbccache(ccache, principal)
- return conn
-
- def destroy_connection(self):
- self.conn.unbind_s()
-
- def make_user_dn(self, uid):
- """
- Construct user dn from uid.
- """
- return 'uid=%s,%s,%s' % (
- self.dn.escape_dn_chars(uid),
- self.api.env.container_user,
- self.api.env.basedn,
- )
-
- def make_group_dn(self, cn):
- """
- Construct group dn from cn.
- """
- return 'cn=%s,%s,%s' % (
- self.dn.escape_dn_chars(cn),
- self.api.env.container_group,
- self.api.env.basedn,
- )
-
- def make_hostgroup_dn(self, cn):
- """
- Construct group of hosts dn from cn.
- """
- return 'cn=%s,%s,%s' % (
- self.dn.escape_dn_chars(cn),
- self.api.env.container_hostgroup,
- self.api.env.basedn,
- )
-
- def make_taskgroup_dn(self, cn):
- """
- Construct group of tasks dn from cn.
- """
- return 'cn=%s,%s,%s' % (
- self.dn.escape_dn_chars(cn),
- self.api.env.container_taskgroup,
- self.api.env.basedn,
- )
-
- def make_service_dn(self, principal):
- """
- Construct service principal dn from principal name
- """
- return 'krbprincipalname=%s,%s,%s' % (
- self.dn.escape_dn_chars(principal),
- self.api.env.container_service,
- self.api.env.basedn,
- )
-
- def make_host_dn(self, hostname):
- """
- Construct host dn from hostname
- """
- return 'fqdn=%s,%s,%s' % (
- self.dn.escape_dn_chars(hostname),
- self.api.env.container_host,
- self.api.env.basedn,
- )
-
- def make_application_dn(self, appname):
- """
- Construct application dn from cn.
- """
- return 'cn=%s,%s,%s' % (
- self.dn.escape_dn_chars(appname),
- self.api.env.container_applications,
- self.api.env.basedn,
- )
-
- def make_policytemplate_dn(self, appname, uuid):
- """
- Construct policytemplate dn from appname
- """
- return 'ipaUniqueID=%s,%s' % (
- self.dn.escape_dn_chars(uuid),
- self.make_application_dn(appname),
- )
-
- def make_role_application_dn(self, appname):
- """
- Construct application role container from appname
- """
- return 'cn=%s,%s,%s' % (
- self.dn.escape_dn_chars(appname),
- self.api.env.container_roles,
- self.api.env.basedn,
- )
-
- def make_role_policytemplate_dn(self, appname, uuid):
- """
- Construct policytemplate dn from uuid and appname
- """
- return 'ipaUniqueID=%s,cn=templates,%s' % (
- self.dn.escape_dn_chars(uuid),
- self.make_role_application_dn(appname),
- )
-
- def make_policygroup_dn(self, uuid):
- """
- Construct policygroup dn from uuid
- """
- return 'ipaUniqueID=%s,%s,%s' % (
- self.dn.escape_dn_chars(uuid),
- self.api.env.container_policygroups,
- self.api.env.basedn,
- )
-
- def make_policy_dn(self, uuid, polgroup_uuid):
- """
- Construct policy dn from uuid of policy and its policygroup
- """
- return 'ipaUniqueID=%s,%s' % (
- self.dn.escape_dn_chars(uuid),
- self.make_policygroup_dn(polgroup_uuid),
- )
-
- def make_policy_blob_dn(self, blob_uuid, policy_uuid, polgroup_uuid):
- """
- Construct policy blob dn from uuids of its policy and policygroup
- objects
- """
- return 'ipaUniqueID=%s,%s' % (
- self.dn.escape_dn_chars(blob_uuid),
- self.make_policy_dn(policy_uuid, polgroup_uuid),
- )
-
- def make_policylink_dn(self, uuid):
- """
- Construct policy link dn from uuid
- """
- return 'ipaUniqueID=%s,%s,%s' % (
- self.dn.escape_dn_chars(uuid),
- self.api.env.container_policylinks,
- self.api.env.basedn,
- )
-
- def get_object_type(self, attribute):
- """
- Based on attribute, make an educated guess as to the type of
- object we're looking for.
- """
- attribute = attribute.lower()
- object_type = None
- if attribute == "uid": # User
- object_type = "posixAccount"
- elif attribute == "cn": # Group
- object_type = "ipaUserGroup"
- elif attribute == "krbprincipalname": # Service
- object_type = "krbPrincipal"
-
- return object_type
-
- def find_entry_dn(self, key_attribute, primary_key, object_type=None, base=None):
- """
- Find an existing entry's dn from an attribute
- """
- key_attribute = key_attribute.lower()
- if not object_type:
- object_type = self.get_object_type(key_attribute)
- if not object_type:
- return None
-
- search_filter = "(&(objectclass=%s)(%s=%s))" % (
- object_type,
- key_attribute,
- self.dn.escape_dn_chars(primary_key)
- )
-
- if not base:
- base = self.api.env.container_accounts
-
- search_base = "%s, %s" % (base, self.api.env.basedn)
-
- entry = servercore.get_sub_entry(search_base, search_filter, ['dn', 'objectclass'])
-
- return entry.get('dn')
-
- def get_base_entry(self, searchbase, searchfilter, attrs):
- return servercore.get_base_entry(searchbase, searchfilter, attrs)
-
- def get_sub_entry(self, searchbase, searchfilter, attrs):
- return servercore.get_sub_entry(searchbase, searchfilter, attrs)
-
- def get_one_entry(self, searchbase, searchfilter, attrs):
- return servercore.get_one_entry(searchbase, searchfilter, attrs)
-
- def get_ipa_config(self):
- """Return a dictionary of the IPA configuration"""
- return servercore.get_ipa_config()
-
- def mark_entry_active(self, dn):
- return servercore.mark_entry_active(dn)
-
- def mark_entry_inactive(self, dn):
- return servercore.mark_entry_inactive(dn)
-
- def _generate_search_filters(self, **kw):
- """Generates a search filter based on a list of words and a list
- of fields to search against.
-
- Returns a tuple of two filters: (exact_match, partial_match)
- """
-
- # construct search pattern for a single word
- # (|(f1=word)(f2=word)...)
- exact_pattern = "(|"
- for field in kw.keys():
- exact_pattern += "(%s=%s)" % (field, kw[field])
- exact_pattern += ")"
-
- sub_pattern = "(|"
- for field in kw.keys():
- sub_pattern += "(%s=*%s*)" % (field, kw[field])
- sub_pattern += ")"
-
- # construct the giant match for all words
- exact_match_filter = "(&" + exact_pattern + ")"
- partial_match_filter = "(|" + sub_pattern + ")"
-
- return (exact_match_filter, partial_match_filter)
-
- def _get_scope(self, scope_str):
- scope_dict = {'one' : _ldap.SCOPE_ONELEVEL,
- 'subtree' : _ldap.SCOPE_SUBTREE,
- 'base' : _ldap.SCOPE_BASE }
- return scope_dict.get(scope_str, _ldap.SCOPE_SUBTREE)
-
- def modify_password(self, dn, **kw):
- return servercore.modify_password(dn, kw.get('oldpass', ''), kw.get('newpass'))
-
- def add_member_to_group(self, memberdn, groupdn, memberattr='member'):
- """
- Add a new member to a group.
-
- :param memberdn: the DN of the member to add
- :param groupdn: the DN of the group to add a member to
- """
- return servercore.add_member_to_group(memberdn, groupdn, memberattr)
-
- def remove_member_from_group(self, memberdn, groupdn, memberattr='member'):
- """
- Remove a new member from a group.
-
- :param memberdn: the DN of the member to remove
- :param groupdn: the DN of the group to remove a member from
- """
- return servercore.remove_member_from_group(memberdn, groupdn, memberattr)
-
- # The CRUD operations
-
- def strip_none(self, kw):
- """
- Remove any None values present in the LDAP attribute dict.
- """
- for (key, value) in kw.iteritems():
- if value is None:
- continue
- if type(value) in (list, tuple):
- value = filter(
- lambda v: type(v) in (str, unicode, bool, int, float),
- value
- )
- if len(value) > 0:
- yield (key, value)
- else:
- assert type(value) in (str, unicode, bool, int, float)
- yield (key, value)
-
- def create(self, **kw):
- if servercore.entry_exists(kw['dn']):
- raise errors.DuplicateEntry
- kw = dict(self.strip_none(kw))
-
- entry = ipaldap.Entry(kw['dn'])
-
- # dn isn't allowed to be in the entry itself
- del kw['dn']
-
- # Fill in our new entry
- for k in kw:
- entry.setValues(k, kw[k])
-
- servercore.add_entry(entry)
- return self.retrieve(entry.dn)
-
- def retrieve(self, dn, attributes=None):
- return servercore.get_entry_by_dn(dn, attributes)
-
- def update(self, dn, **kw):
- result = self.retrieve(dn, ["*"] + kw.keys())
-
- entry = ipaldap.Entry((dn, servercore.convert_scalar_values(result)))
- start_keys = kw.keys()
- kw = dict(self.strip_none(kw))
- end_keys = kw.keys()
- removed_keys = list(set(start_keys) - set(end_keys))
- for k in kw:
- entry.setValues(k, kw[k])
-
- for k in removed_keys:
- entry.delAttr(k)
-
- servercore.update_entry(entry.toDict(), removed_keys)
-
- return self.retrieve(dn)
-
- def delete(self, dn):
- return servercore.delete_entry(dn)
-
- def search(self, **kw):
- objectclass = kw.get('objectclass')
- sfilter = kw.get('filter')
- attributes = kw.get('attributes')
- base = kw.get('base')
- scope = kw.get('scope')
- exactonly = kw.get('exactonly', None)
- if attributes:
- del kw['attributes']
- else:
- attributes = ['*']
- if objectclass:
- del kw['objectclass']
- if base:
- del kw['base']
- if sfilter:
- del kw['filter']
- if scope:
- del kw['scope']
- if exactonly is not None:
- del kw['exactonly']
- if kw:
- (exact_match_filter, partial_match_filter) = self._generate_search_filters(**kw)
- else:
- (exact_match_filter, partial_match_filter) = ('', '')
- if objectclass:
- exact_match_filter = '(&(objectClass=%s)%s)' % (objectclass, exact_match_filter)
- partial_match_filter = '(&(objectClass=%s)%s)' % (objectclass, partial_match_filter)
- else:
- exact_match_filter = '(&(objectClass=*)%s)' % exact_match_filter
- partial_match_filter = '(&(objectClass=*)%s)' % partial_match_filter
- if sfilter:
- exact_match_filter = '(%s%s)' % (sfilter, exact_match_filter)
- partial_match_filter = '(%s%s)' % (sfilter, partial_match_filter)
-
- search_scope = self._get_scope(scope)
-
- if not base:
- base = self.api.env.container_accounts
-
- search_base = '%s,%s' % (base, self.api.env.basedn)
- try:
- exact_results = servercore.search(search_base,
- exact_match_filter, attributes, scope=search_scope)
- except errors.NotFound:
- exact_results = [0]
-
- if not exactonly:
- try:
- partial_results = servercore.search(search_base,
- partial_match_filter, attributes, scope=search_scope)
- except errors.NotFound:
- partial_results = [0]
- else:
- partial_results = [0]
-
- exact_counter = exact_results[0]
- partial_counter = partial_results[0]
-
- exact_results = exact_results[1:]
- partial_results = partial_results[1:]
-
- # Remove exact matches from the partial_match list
- exact_dns = set(map(lambda e: e.get('dn'), exact_results))
- partial_results = filter(lambda e: e.get('dn') not in exact_dns,
- partial_results)
-
- if (exact_counter == -1) or (partial_counter == -1):
- counter = -1
- else:
- counter = len(exact_results) + len(partial_results)
-
- results = [counter]
- for r in exact_results + partial_results:
- results.append(r)
-
- return results
-
-api.register(ldap)
generated by cgit (git 2.34.1) at 2024-05-03 00:25:32 +0000