epita-std/ACU
Archived
1
0
Fork 0
Code Releases Activity

Some fixes in LDAP

Browse Source
This commit is contained in:
Mercier Pierre-Olivier 2013-09-03 07:20:58 +02:00
parent 65f11b676b
commit 9c27bf131e
2 changed files with 116 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
ACU/LDAP.pm
View File

@ -11,6 +11,7 @@ use Net::LDAP::Util qw(ldap_error_text);
use ACU::Password; use ACU::Password;
use ACU::Right; use ACU::Right;
use ACU::Log;
## Connection functions ## Connection functions
@ -27,15 +28,17 @@ our $secret_search = \&ldap_get_password;
sub ldap_connect() sub ldap_connect()
{ {
if ($bindsecret eq "") { if (!$bindsecret) {
$bindsecret = $secret_search->(); $bindsecret = $secret_search->();
} }
my $ldap = Net::LDAPS->new($ldaphost) or die ("$@"); my $ldap = Net::LDAPS->new($ldaphost) or die ("$@");
my $mesg = $ldap->bind($binddn, password => $bindsecret) or die ("$@"); my $mesg = $ldap->bind($binddn, password => $bindsecret) or die ("$@");
ACU::Log::do_debug("Connect to LDAP with $binddn");
if ($mesg->code) { if ($mesg->code) {
die "An error occurred: " .ldap_error_text($mesg->code)."\n"; ACU::Log::do_err("An error occurred: " .ldap_error_text($mesg->code));
} }
return $ldap; return $ldap;
@ -46,8 +49,10 @@ sub ldap_connect_anon()
my $ldap = Net::LDAPS->new($ldaphost) or die ("$@"); my $ldap = Net::LDAPS->new($ldaphost) or die ("$@");
my $mesg = $ldap->bind or die ("$@"); my $mesg = $ldap->bind or die ("$@");
ACU::Log::do_debug("Connect to LDAP anonymously");
if ($mesg->code) { if ($mesg->code) {
die "An error occurred: " .ldap_error_text($mesg->code)."\n"; ACU::Log::do_err("An error occurred: " .ldap_error_text($mesg->code));
} }
return $ldap; return $ldap;
@ -65,13 +70,15 @@ sub add_group($$$;$)
my $dn = "cn=$cn,ou=$year,ou=$ou,ou=groups,dc=acu,dc=epita,dc=fr"; my $dn = "cn=$cn,ou=$year,ou=$ou,ou=groups,dc=acu,dc=epita,dc=fr";
ACU::Log::do_debug("Add group $dn");
my $mesg = $ldap->add( $dn, my $mesg = $ldap->add( $dn,
attrs => [ attrs => [
objectclass => "intraGroup", objectclass => "intraGroup",
cn => $cn, cn => $cn,
] ]
); );
if ($mesg->code != 0) { die $mesg->error; } if ($mesg->code != 0) { ACU::Log::do_warn($mesg->error); return 0; }
return $dn; return $dn;
} }
@ -84,17 +91,19 @@ sub delete_group($$;$)
my $ldap = ldap_connect(); my $ldap = ldap_connect();
ACU::Log::do_debug("Delete group ou=groups,dc=acu,dc=epita,dc=fr");
my $mesg = $ldap->search( # search my $mesg = $ldap->search( # search
base => "ou=groups,dc=acu,dc=epita,dc=fr", base => "ou=groups,dc=acu,dc=epita,dc=fr",
filter => "cn=$cn", filter => "cn=$cn",
scope => "sub" scope => "sub"
); );
if ($mesg->code != 0) { die $mesg->error; } if ($mesg->code != 0) { ACU::Log::do_warn($mesg->error); return 0; }
if ($mesg->count != 1) { die "$cn not found or multiple entries match"; } if ($mesg->count != 1) { ACU::Log::do_warn("$cn not found or multiple entries match"); return 0; }
$ldap->delete( $mesg->entry(0)->dn ); $ldap->delete( $mesg->entry(0)->dn );
$ldap->unbind or die ("couldn't disconnect correctly"); $ldap->unbind or ACU::Log::do_warn ("couldn't disconnect correctly");
} }
sub get_year(;$) sub get_year(;$)
@ -118,8 +127,8 @@ sub get_dn($$@)
attrs => @_, attrs => @_,
scope => "base" scope => "base"
); );
if ($mesg->code != 0) { print $mesg->error; return undef; } if ($mesg->code != 0) { ACU::Log::do_warn($mesg->error); return undef; }
if ($mesg->count != 1) { return undef; } if ($mesg->count != 1) { ACU::Log::do_warn("$cn not found or multiple entries match"); return undef; }
return $mesg->entry(0); return $mesg->entry(0);
} }
@ -138,6 +147,9 @@ sub add_attribute($$$@)
{ {
if (! grep(/^$value$/, @data)) { if (! grep(/^$value$/, @data)) {
$mod = 1; $mod = 1;
ACU::Log::do_debug("Add attribute $value to $dn");
push @data, $value; push @data, $value;
} }
} }
@ -145,7 +157,11 @@ sub add_attribute($$$@)
if ($mod) if ($mod)
{ {
$entry->replace($what => \@data) or die $!; $entry->replace($what => \@data) or die $!;
$entry->update($ldap) or die $!; my $mesg = $entry->update($ldap) or die $!;
if ($mesg->code != 0) { ACU::Log::do_warn($mesg->error); return 0; }
if ($mesg->count != 1) { ACU::Log::do_warn("$cn not found or multiple entries match"); return 0; }
return 1; return 1;
} }
else { else {
@ -166,6 +182,8 @@ sub delete_attribute($$$@)
for my $value (@_) for my $value (@_)
{ {
if (grep(/^$value$/, @data)) { if (grep(/^$value$/, @data)) {
ACU::Log::do_debug("Remove attribute $what ($value) from $dn");
@data = grep(!/$value$/, @data); @data = grep(!/$value$/, @data);
$mod = 1; $mod = 1;
} }
@ -174,7 +192,8 @@ sub delete_attribute($$$@)
if ($mod) if ($mod)
{ {
$entry->replace($what => \@data) or die $!; $entry->replace($what => \@data) or die $!;
$entry->update($ldap) or die $!; my $mesg = $entry->update($ldap) or die $!;
if ($mesg->code != 0) { ACU::Log::do_warn($mesg->error); return 0; }
return 1; return 1;
} }
else { else {
@ -186,9 +205,11 @@ sub delete_entry($$)
{ {
my $ldap = shift // ldap_connect(); my $ldap = shift // ldap_connect();
$ldap->delete( shift ); my $mesg = $ldap->delete( shift );
$ldap->unbind or die ("couldn't disconnect correctly"); if ($mesg->code != 0) { ACU::Log::do_warn($mesg->error); return 0; }
return 1;
} }
sub flush_attribute($$@) sub flush_attribute($$@)
@ -196,7 +217,11 @@ sub flush_attribute($$@)
my $ldap = shift // ldap_connect(); my $ldap = shift // ldap_connect();
my $dn = shift; my $dn = shift;
return !($ldap->modify($dn, delete => \@_)->code); $ldap->modify($dn, delete => \@_)->code;
if ($mesg->code != 0) { ACU::Log::do_warn($mesg->error); return 0; }
return 1;
} }
sub get_attribute($$$) sub get_attribute($$$)
@ -224,8 +249,8 @@ sub search_dn($$@)
attrs => [ ], attrs => [ ],
scope => "sub" scope => "sub"
); );
if ($mesg->code != 0) { print $mesg->error; return undef; } if ($mesg->code != 0) { ACU::Log::do_warn($mesg->error); return undef; }
if ($mesg->count != 1) { return undef; } if ($mesg->count != 1) { ACU::Log::do_warn("$cn not found or multiple entries match"); return undef; }
return $mesg->entry(0)->dn; return $mesg->entry(0)->dn;
} }
@ -237,8 +262,14 @@ sub update_attribute($$$@)
my $what = shift; my $what = shift;
my $entry = get_dn($ldap, $dn, $what); my $entry = get_dn($ldap, $dn, $what);
$entry->replace($what => \@_) or die $!; $entry->replace($what => \@_);
$entry->update($ldap) or die $!; my $mesg = $entry->update($ldap);
if ($mesg->code != 0) {
ACU::Log::do_warn($mesg->error);
return 0;
}
return 1; return 1;
} }

78
process/ldap/update_group.pl
View File

@ -9,6 +9,7 @@ BEGIN {
push @INC, "../../"; push @INC, "../../";
} }
use ACU::Log;
use ACU::LDAP; use ACU::LDAP;
use ACU::Process; use ACU::Process;
@ -32,6 +33,8 @@ my %user_actions =
"update" => \&_update, "update" => \&_update,
); );
my $_get_type;
sub _new($$$) sub _new($$$)
{ {
my $ldap = shift; my $ldap = shift;
@ -53,7 +56,7 @@ sub _add($$$)
my $dn = shift; my $dn = shift;
my $args = shift; my $args = shift;
my $cnt_type = group_get_type $args->{param}; my $cnt_type = $_get_type->($args->{param});
# Add content if any # Add content if any
for (my $i = $args->{unamed}; $i > 0; $i--) { for (my $i = $args->{unamed}; $i > 0; $i--) {
@ -72,7 +75,7 @@ sub _flush($$)
my $dn = shift; my $dn = shift;
my $args = shift; my $args = shift;
my $cnt_type = group_get_type $args->{param}; my $cnt_type = $_get_type->($args->{param});
return LDAP::flush_attribute($ldap, $dn, $cnt_type); return LDAP::flush_attribute($ldap, $dn, $cnt_type);
} }
@ -83,7 +86,7 @@ sub _remove($$)
my $dn = shift; my $dn = shift;
my $args = shift; my $args = shift;
my $cnt_type = group_get_type $args->{param}; my $cnt_type = $_get_type->($args->{param});
my @data; my @data;
for (my $i = $args->{unamed}; $i > 0; $i--) { for (my $i = $args->{unamed}; $i > 0; $i--) {
@ -99,7 +102,9 @@ sub _update($$)
my $dn = shift; my $dn = shift;
my $args = shift; my $args = shift;
my $cnt_type = group_get_type $args->{param}; my $cnt_type = $_get_type->($args->{param});
return user_update($ldap, $dn, $args) if ($cnt_type eq "userInfos");
my @data; my @data;
for (my $i = $args->{unamed}; $i > 0; $i--) { for (my $i = $args->{unamed}; $i > 0; $i--) {
@ -109,20 +114,66 @@ sub _update($$)
return LDAP::update_attribute($ldap, $dn, $cnt_type, @data); return LDAP::update_attribute($ldap, $dn, $cnt_type, @data);
} }
sub user_update($$)
{
my $ldap = shift;
my $dn = shift;
my $args = shift;
sub _get_type($) LDAP::update_attribute($ldap, $dn, "cn", $args->{param}{cn}) if ($args->{param}{cn});
LDAP::update_attribute($ldap, $dn, "cn", $args->{param}{firstname}." ".$args->{param}{lastname}) if ($args->{param}{firstname} && $args->{param}{lastname});
LDAP::update_attribute($ldap, $dn, "l", $args->{param}{l}) if ($args->{param}{l});
LDAP::update_attribute($ldap, $dn, "mail", $args->{param}{mail}) if ($args->{param}{mail});
LDAP::update_attribute($ldap, $dn, "postalAddress", $args->{param}{postalAddress}) if ($args->{param}{postalAddress});
LDAP::update_attribute($ldap, $dn, "postalCode", $args->{param}{postalCode}) if ($args->{param}{postalCode});
LDAP::update_attribute($ldap, $dn, "sn", $args->{param}{sn}) if ($args->{param}{sn});
LDAP::update_attribute($ldap, $dn, "telephoneNumber", $args->{param}{telephoneNumber}) if ($args->{param}{telephoneNumber});
LDAP::update_attribute($ldap, $dn, "sshPublicKey", $args->{param}{sshPublicKey}) if ($args->{param}{sshPublicKey});
LDAP::update_attribute($ldap, $dn, "strongAuthKey", $args->{param}{strongAuthKey}) if ($args->{param}{strongAuthKey});
LDAP::update_attribute($ldap, $dn, "c", $args->{param}{c}) if ($args->{param}{c});
LDAP::update_attribute($ldap, $dn, "title", $args->{param}{title}) if ($args->{param}{title});
LDAP::update_attribute($ldap, $dn, "intraRight", $args->{param}{intraRight}) if ($args->{param}{intraRight});
LDAP::update_attribute($ldap, $dn, "intraTheme", $args->{param}{intraTheme}) if ($args->{param}{intraTheme});
LDAP::update_attribute($ldap, $dn, "birthdate", $args->{param}{birthdate}) if ($args->{param}{birthdate});
}
sub group_get_type($)
{ {
my $param = shift; my $param = shift;
my $type = $param->{type} // "members";
# Extract data type # Extract data type
if ($param->{type} eq "members") { if ($type eq "members") {
return "memberUid"; return "memberUid";
} }
elsif ($param->{type} eq "rights") { elsif ($type eq "rights") {
return "intraRights" ; return "intraRights" ;
} }
else { else {
die ("Unknown type to add: ".$param->{type}); die ("Unknown type to add: ".$type);
}
}
sub user_get_type($)
{
my $param = shift;
my $type = $param->{type} // "userInfos";
# Extract data type
if ($type eq "rights") {
return "intraRights" ;
}
elsif ($type eq "sshkeys") {
return "sshPublicKey" ;
}
elsif ($type eq "userInfos") {
return "userInfos" ;
}
else {
die ("Unknown type to add: ".$type);
} }
} }
@ -133,7 +184,7 @@ sub process_group
my $year = $args->{param}{year} // LDAP::get_year; my $year = $args->{param}{year} // LDAP::get_year;
my $dn = "cn=".$args->{param}{cn}."ou=$year,ou=$ou,ou=groups,dc=acu,dc=epita,dc=fr"; my $dn = "cn=".$args->{param}{cn}."ou=$year,ou=$ou,ou=groups,dc=acu,dc=epita,dc=fr";
my $action = $args->{param}{type} // "update"; my $action = $args->{param}{action} // "update";
# Read action # Read action
if (! exists $group_actions{$action}) { if (! exists $group_actions{$action}) {
@ -145,13 +196,15 @@ sub process_group
$group_actions{$action}($ldap, $dn, $args); $group_actions{$action}($ldap, $dn, $args);
$ldap->unbind or warn "couldn't disconnect correctly"; $ldap->unbind or warn "couldn't disconnect correctly";
return "Ok";
} }
sub process_user sub process_user
{ {
my ($given_args, $args) = @_; my ($given_args, $args) = @_;
my $action = $args->{param}{type} // "update"; my $action = $args->{param}{action} // "update";
# Read action # Read action
if (! exists $user_actions{$action}) { if (! exists $user_actions{$action}) {
@ -165,13 +218,16 @@ sub process_user
$user_actions{$action}($ldap, $dn, $args); $user_actions{$action}($ldap, $dn, $args);
$ldap->unbind or warn "couldn't disconnect correctly"; $ldap->unbind or warn "couldn't disconnect correctly";
return "Ok";
} }
if ($0 =~ /^update_group/) { if ($0 =~ /^update_group/) {
$_get_type = \&group_get_type;
Process::register("update_group", \&process_group); Process::register("update_group", \&process_group);
} }
elsif ($0 =~ /^update_user/) { elsif ($0 =~ /^update_user/) {
$_get_type = \&user_get_type;
Process::register("update_user", \&process_user); Process::register("update_user", \&process_user);
} }
else { else {