1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
# Authors: Tomas Babej <tbabej@redhat.com>
#
# Copyright (C) 2015 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
#
import krbV
import sys
from ipalib import api
from ipalib import errors
from ipapython import admintool
from ipapython.dn import DN
from ipapython.ipa_log_manager import log_mgr
from ipaserver.plugins.ldap2 import ldap2
DEFAULT_TRUST_VIEW_NAME = u'Default Trust View'
class MigrateWinsync(admintool.AdminTool):
"""
Tool to migrate winsync users.
"""
command_name = 'ipa-migrate-winsync'
usage = "ipa-migrate-winsync"
description = (
"This tool creates user ID overrides for all the users "
"that were previously synced from AD domain using the "
"winsync replication agreement. It requires that trust "
"with the AD forest has already been established and "
"the users in question are resolvable using SSSD. "
"For more information, see `man ipa-migrate-winsync`."
)
def create_id_user_override(self, entry):
"""
Creates ID override corresponding to this user entry.
"""
user_identifier = u"%s@%s" % (entry['uid'][0], self.options.realm)
kwargs = {
'uid': entry['uid'][0],
'uidnumber': entry['uidnumber'][0],
'gidnumber': entry['gidnumber'][0],
'gecos': entry['gecos'][0],
'loginshell': entry['loginshell'][0]
}
try:
result = api.Command['idoverrideuser_add'](
DEFAULT_TRUST_VIEW_NAME,
user_identifier,
**kwargs
)
except Exception as e:
self.log.warning("Migration failed: %s (%s)"
% (user_identifier, str(e)))
else:
self.log.debug("Migrated: %s" % user_identifier)
def find_winsync_users(self):
"""
Finds all users that were mirrored from AD using winsync.
"""
user_filter = "(&(objectclass=ntuser)(ntUserDomainId=*))"
user_base = DN(api.env.container_user, api.env.basedn)
entries, _ = self.ldap.find_entries(
filter=user_filter,
base_dn=user_base,
paged_search=True)
for entry in entries:
self.log.debug("Discovered entry: %s" % entry)
return entries
def run(self):
super(MigrateWinsync, self).run()
# Finalize API
api.bootstrap(in_server=True, context='server')
api.finalize()
# Setup LDAP connection
try:
ctx = krbV.default_context()
ccache = ctx.default_ccache()
api.Backend.ldap2.connect(ccache)
self.ldap = api.Backend.ldap2
except krbV.Krb5Error, e:
sys.exit("Must have Kerberos credentials to migrate Winsync users.")
except errors.ACIError, e:
sys.exit("Outdated Kerberos credentials. Use kdestroy and kinit to update your ticket.")
except errors.DatabaseError, e:
sys.exit("Cannot connect to the LDAP database. Please check if IPA is running.")
# Create ID overrides replacing the user winsync entries
entries = self.find_winsync_users()
for entry in entries:
self.create_id_user_override(entry)
|
