calculate-utils-2.2-lib/pym/cl_ldap.py

#-*- coding: utf-8 -*-

# Copyright 2008-2010 Calculate Ltd. http://www.calculate-linux.org
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.

import ldap
from cl_utils import _error

class ldapFun(_error):
    '''Объект для работы с LDAP сервером

        подключение к серверу и поиск данных
    '''
    def __init__(self, dnUser, password, host="localhost"):
        self.conLdap = False
        # Получаем соединение с LDAP
        try:
            self.conLdap = self.__ldapConnect(dnUser, password, host)
        except ldap.LDAPError, e:
            self.setError(e[0]['desc'])

    def __ldapConnect(self, dnUser, password, host):
        """Соединение с LDAP сервером"""
        conLdap = ldap.initialize('ldap://%s'%host)
        conLdap.simple_bind_s(dnUser, password)
        return conLdap

    def ldapSearch(self,baseDN, searchScope, searchFilter, retrieveAttributes):
        try:
            ldap_result_id = self.conLdap.search(baseDN, searchScope,
                                                searchFilter,
                                                retrieveAttributes)
            result_set = []
            while 1:
                result_type, result_data = self.conLdap.result(ldap_result_id,
                                                               0)
                if (result_data == []):
                    break
                else:
                    if result_type == ldap.RES_SEARCH_ENTRY:
                        result_set.append(result_data)
        except ldap.NO_SUCH_OBJECT:
            return []
        except:
            return False
        return result_set

class ldapUser(_error):
    """Получение данных для пользователя из LDAP"""
    # Данные из /etc/ldap.conf
    _dictData = {}
    # Объект LDAP
    ldapObj = False
    # Подключение к LDAP
    conLdap = False

    def getDataInLdapConf(self, bindData=True, cache=True):
        """Получение данных из /etc/ldap.conf"""
        data = [("host",'host'),
                ("usersDN",'nss_base_passwd'),
                ("groupsDN",'nss_base_group')]
        if bindData:
            data += [("bindDn",'binddn'), ("bindPw",'bindpw')]
        namesData = map(lambda x: x[0], data)
        # Данные из кеша, если он есть
        if cache and self._dictData and\
            set(namesData)<=set(self._dictData.keys()):
            return self._dictData
        fileName = "/etc/ldap.conf"
        getStrList = lambda x: reduce(lambda x,y: [x,y.upper()],([x]*2))
        workData = map(lambda x: (x[0],getStrList(x[1]),len(x[1])), data)
        dictData = {}
        splList = (" ", "\t")
        try:
            for line in open(fileName):
                for name, keys, lenKey in workData:
                    if not name in dictData.keys() and\
                        filter(lambda x: line.startswith(x), keys) and\
                        len(line)>lenKey:
                        spl = line[lenKey]
                        if spl in splList:
                            if not name in dictData:
                                dictData[name] = []
                            if name in  ("usersDN", "groupsDN"):
                                dictData[name].append(line.rpartition(spl)[2].\
                                                      partition('?')[0].strip())
                            else:
                                dictData[name].append(line.rpartition(spl)[2].\
                                                      strip())
        except:
            self.setError(_("Can not open %s")%fileName)
            return False
        if set(dictData.keys()) == set(namesData):
            # Кеширование данных
            if cache:
                self._dictData.clear()
                self._dictData.update(dictData)
            return dictData
        else:
            return {}

    def getBindConnectData(self):
        """Получение данных для соединения с LDAP bind пользователем"""
        configdata = self.getDataInLdapConf()
        if configdata:
            bindDn = configdata["bindDn"][0]
            bindPw = configdata["bindPw"][0]
            host = configdata["host"][0]
            return bindDn, bindPw, host
        return False

    def getUsersDN(self):
        """Получение DN пользователей"""
        configdata = self.getDataInLdapConf(bindData=False)
        if configdata:
            usersDN = self._dictData["usersDN"][0]
            return usersDN
        return False

    def getHost(self):
        """Получение LDAP хоста"""
        configdata = self.getDataInLdapConf(bindData=False)
        if configdata:
            host = configdata["host"][0]
            return host
        return False

    def getGroupsDN(self):
        """Получение списка DN групп"""
        configdata = self.getDataInLdapConf(bindData=False)
        if configdata:
            groupsDNs = self._dictData["groupsDN"]
            return groupsDNs
        return False

    def getUserLdapInfo(self, userName, shadowAttr=False):
        """Выдаем информацию о пользователе из LDAP"""
        connectData = self.getBindConnectData()
        if not connectData:
            return {}
        bindDn, bindPw, host = connectData
        usersDN = self.getUsersDN()
        groupsDNs = self.getGroupsDN()
        # Соединяемся с LDAP
        if not self.ldapConnect(bindDn, bindPw, host):
            return False
        searchUser = self.ldapObj.ldapSearch(usersDN, ldap.SCOPE_ONELEVEL,
                                             "uid=%s" %userName, None)
        if not searchUser:
            return False
        convertDict = {'uid':('user','uidNumber'),
                       'gid':('user','gidNumber'),
                       'fullName':('user','cn'),
                       'mail':('user','mail'),
                       'jid':('user','registeredAddress'),
                       'home':('user','homeDirectory'),
                       'group':('group','cn')}
        if shadowAttr:
            convertDict.update({'loginShell':('user','loginShell'),
                                'shadowLastChange':('user','shadowLastChange'),
                                'shadowMin':('user','shadowMin'),
                                'shadowMax':('user','shadowMax'),
                                'shadowWarning':('user','shadowWarning'),
                                'shadowExpire':('user','shadowExpire'),
                                'shadowFlag':('user','shadowFlag'),
                                'groups':('group','memberUid')})
        listUserAttr = map(lambda x: x[0],
                           filter(lambda x: x[1][0]=="user",
                                  convertDict.items()))
        listGroupAttr = map(lambda x: x[0],
                           filter(lambda x: x[1][0]=="group",
                                  convertDict.items()))
        uid = ""
        gid = ""
        dictOut = {}
        for dictAttr in listUserAttr:
            ldapAttr = convertDict[dictAttr][1]
            if ldapAttr in searchUser[0][0][1]:
                dictOut[dictAttr] = searchUser[0][0][1][ldapAttr][0]
            else:
                dictOut[dictAttr] = ""
            if dictAttr == 'uid':
                uid = dictOut[dictAttr]
            if dictAttr == 'gid':
                gid = dictOut[dictAttr]
        if gid:
            for dictAttr in listGroupAttr:
                searchGroup = []
                ldapAttr = convertDict[dictAttr][1]
                if dictAttr == "group":
                    for groupDN in groupsDNs:
                        searchGroup = self.ldapObj.ldapSearch(groupDN,
                                                    ldap.SCOPE_ONELEVEL,
                                                    "gidNumber=%s" %gid, None)
                        if searchGroup:
                            break
                    if searchGroup:
                        if ldapAttr in searchGroup[0][0][1]:
                            dictOut[dictAttr]=searchGroup[0][0][1][ldapAttr][0]
                        else:
                            dictOut[dictAttr] = ""
                    else:
                        dictOut[dictAttr] = ""
                elif dictAttr == "groups":
                    userGroupsData = []
                    for groupDN in groupsDNs:
                        searchGroup = self.ldapObj.ldapSearch(groupDN,
                                                   ldap.SCOPE_ONELEVEL,
                                                   "%s=%s" %(ldapAttr,userName),
                                                   ["cn","gidNumber"])
                        if searchGroup:
                            userGroupsData += map(lambda x: (x[0][1]["cn"][0],
                                                       x[0][1]["gidNumber"][0]),
                                              searchGroup)
                    dictOut[dictAttr] = userGroupsData
        if uid and gid:
            return dictOut
        else:
            return {}

    def ldapConnect(self, bindDn, bindPw, host):
        """Подключение к LDAP"""
        if not self.ldapObj:
            ldapObj = ldapFun(bindDn, bindPw, host)
            if ldapObj.getError():
                return False
            # Устанавливаем у объекта соединение и объект LDAP функций
            self.ldapObj = ldapObj
            self.conLdap = ldapObj.conLdap
        return True