path: root/lib/puppet/util/ldap/manager.rb

require 'puppet/util/ldap'
require 'puppet/util/ldap/connection'
require 'puppet/util/ldap/generator'

# The configuration class for LDAP providers, plus
# connection handling for actually interacting with ldap.
class Puppet::Util::Ldap::Manager
  attr_reader :objectclasses, :puppet2ldap, :location, :rdn

  # A null-op that just returns the config.
  def and
    self
  end

  # Set the offset from the search base and return the config.
  def at(location)
    @location = location
    self
  end

  # The basic search base.
  def base
    [location, Puppet[:ldapbase]].join(",")
  end

  # Convert the name to a dn, then pass the args along to
  # our connection.
  def create(name, attributes)
    attributes = attributes.dup

    # Add the objectclasses
    attributes["objectClass"] = objectclasses.collect { |o| o.to_s }
    attributes["objectClass"] << "top" unless attributes["objectClass"].include?("top")

    attributes[rdn.to_s] = [name]

    # Generate any new values we might need.
    generate(attributes)

    # And create our resource.
    connect { |conn| conn.add dn(name), attributes }
  end

  # Open, yield, and close the connection.  Cannot be left
  # open, at this point.
  def connect
    raise ArgumentError, "You must pass a block to #connect" unless block_given?

    unless @connection
      if Puppet[:ldaptls]
        ssl = :tls
      elsif Puppet[:ldapssl]
        ssl = true
      else
        ssl = false
      end
      options = {:ssl => ssl}
      if user = Puppet[:ldapuser] and user != ""
        options[:user] = user
      end
      if password = Puppet[:ldappassword] and password != ""
        options[:password] = password
      end
      @connection = Puppet::Util::Ldap::Connection.new(Puppet[:ldapserver], Puppet[:ldapport], options)
    end
    @connection.start
    begin
      yield @connection.connection
    ensure
      @connection.close
    end
    nil
  end

  # Convert the name to a dn, then pass the args along to
  # our connection.
  def delete(name)
    connect { |connection| connection.delete dn(name) }
  end

  # Calculate the dn for a given resource.
  def dn(name)
    ["#{rdn}=#{name}", base].join(",")
  end

  # Convert an ldap-style entry hash to a provider-style hash.
  def entry2provider(entry)
    raise ArgumentError, "Could not get dn from ldap entry" unless entry["dn"]

    # DN is always a single-entry array.  Strip off the bits before the
    # first comma, then the bits after the remaining equal sign.  This is the
    # name.
    name = entry["dn"].dup.pop.split(",").shift.split("=").pop

    result = {:name => name}

    @ldap2puppet.each do |ldap, puppet|
      result[puppet] = entry[ldap.to_s] || :absent
    end

    result
  end

  # Create our normal search filter.
  def filter
    return(objectclasses.length == 1 ? "objectclass=#{objectclasses[0]}" : "(&(objectclass=" + objectclasses.join(")(objectclass=") + "))")
  end

  # Find the associated entry for a resource.  Returns a hash, minus
  # 'dn', or nil if the entry cannot be found.
  def find(name)
    result = nil
    connect do |conn|
      begin
        conn.search2(dn(name), 0, "objectclass=*") do |result|
          # Convert to puppet-appropriate attributes
          return entry2provider(result)
        end
      rescue => detail
        return nil
      end
    end
  end

  # Declare a new attribute generator.
  def generates(parameter)
    @generators << Puppet::Util::Ldap::Generator.new(parameter)
    @generators[-1]
  end

  # Generate any extra values we need to make the ldap entry work.
  def generate(values)
    return unless @generators.length > 0

    @generators.each do |generator|
      # Don't override any values that might exist.
      next if values[generator.name]

      if generator.source
        unless value = values[generator.source]
          raise ArgumentError, "#{generator.source} must be defined to generate #{generator.name}"
        end
        result = generator.generate(value)
      else
        result = generator.generate
      end

      result = [result] unless result.is_a?(Array)
      result = result.collect { |r| r.to_s }

      values[generator.name] = result
    end
  end

  def initialize
    @rdn = :cn
    @generators = []
  end

  # Specify what classes this provider models.
  def manages(*classes)
    @objectclasses = classes
    self
  end

  # Specify the attribute map.  Assumes the keys are the puppet
  # attributes, and the values are the ldap attributes, and creates a map
  # for each direction.
  def maps(attributes)
    # The map with the puppet attributes as the keys
    @puppet2ldap = attributes

    # and the ldap attributes as the keys.
    @ldap2puppet = attributes.inject({}) { |map, ary| map[ary[1]] = ary[0]; map }

    self
  end

  # Return the ldap name for a puppet attribute.
  def ldap_name(attribute)
    @puppet2ldap[attribute].to_s
  end

  # Convert the name to a dn, then pass the args along to
  # our connection.
  def modify(name, mods)
    connect { |connection| connection.modify dn(name), mods }
  end

  # Specify the rdn that we use to build up our dn.
  def named_by(attribute)
    @rdn = attribute
    self
  end

  # Return the puppet name for an ldap attribute.
  def puppet_name(attribute)
    @ldap2puppet[attribute]
  end

  # Search for all entries at our base.  A potentially expensive search.
  def search(sfilter = nil)
    sfilter ||= filter

    result = []
    connect do |conn|
      conn.search2(base, 1, sfilter) do |entry|
        result << entry2provider(entry)
      end
    end
    return(result.empty? ? nil : result)
  end

  # Update the ldap entry with the desired state.
  def update(name, is, should)
    if should[:ensure] == :absent
      Puppet.info "Removing #{dn(name)} from ldap"
      delete(name)
      return
    end

    # We're creating a new entry
    if is.empty? or is[:ensure] == :absent
      Puppet.info "Creating #{dn(name)} in ldap"
      # Remove any :absent params and :ensure, then convert the names to ldap names.
      attrs = ldap_convert(should)
      create(name, attrs)
      return
    end

    # We're modifying an existing entry.  Yuck.

    mods = []
    # For each attribute we're deleting that is present, create a
    # modify instance for deletion.
    [is.keys, should.keys].flatten.uniq.each do |property|
      # They're equal, so do nothing.
      next if is[property] == should[property]

      attributes = ldap_convert(should)

      prop_name = ldap_name(property).to_s

      # We're creating it.
      if is[property] == :absent or is[property].nil?
        mods << LDAP::Mod.new(LDAP::LDAP_MOD_ADD, prop_name, attributes[prop_name])
        next
      end

      # We're deleting it
      if should[property] == :absent or should[property].nil?
        mods << LDAP::Mod.new(LDAP::LDAP_MOD_DELETE, prop_name, [])
        next
      end

      # We're replacing an existing value
      mods << LDAP::Mod.new(LDAP::LDAP_MOD_REPLACE, prop_name, attributes[prop_name])
    end

    modify(name, mods)
  end

  # Is this a complete ldap configuration?
  def valid?
    location and objectclasses and ! objectclasses.empty? and puppet2ldap
  end

  private

  # Convert a hash of attributes to ldap-like forms.  This mostly means
  # getting rid of :ensure and making sure everything's an array of strings.
  def ldap_convert(attributes)
    attributes.reject { |param, value| value == :absent or param == :ensure }.inject({}) do |result, ary|
      value = (ary[1].is_a?(Array) ? ary[1] : [ary[1]]).collect { |v| v.to_s }
      result[ldap_name(ary[0])] = value
      result
    end
  end
end