DuckCorp » LdapShadows

conf/ldap_shadows/global_private.conf

config.load_global_config([File.join(ENV['HOME'], ".shadowwalker")])

default_shadow: MilkyPond

password_hash: ssha

---

mapping:

classes: ['fsUser']

associated_relations: ['primaryGroup', 'secondaryGroups']

relations:

primaryGroup:

type: belongs_to

object: group

foreign_key: gidNumber

primary_key: gidNumber

secondaryGroups:

type: belongs_to

object: group

many: uniqueMember

primary_key: dn

plugin:

min_uid: 10000

max_uid: 65535

step_uid: 100

default_group: dc-users

default_home_base: '/home'

---

mapping:

classes: ['ftpUser']

depend_aspects: ['primary_account', 'fs']

---

mapping:

classes: ['jabberUser']

---

mapping:

classes: ['emailUser']

---

mapping:

classes: ['primaryAccount']

associated_attributes: ['uid', 'allowedServices']

---

mapping:

classes: ['shellUser']

depend_aspects: ['primary_account', 'fs']

associated_attributes: ['loginShell']

---

mapping:

classes: ['webUser']

depend_aspects: ['primary_account']

---

mapping:

dn_attribute: uid

prefix: ''

classes: ['bot']

sort_by: uid

possible_aspects: ['primary_account', 'mail', 'fs', 'shell', 'ftp', 'web', 'jabber']

default_parent: "unit/SpecialAccounts"

presentation:

hidden_attributes: ['uid']

expert_attributes: ['uidNumber', 'gidNumber', 'gecos']

---

mapping:

dn_attribute: cn

prefix: ''

classes: ['genericDomain']

sort_by: cn

parent_handle_restrictions: "^(unit/Domains|(individual|bot)/.+)$"

default_parent: "unit/Domains"

---

mapping:

dn_attribute: o

prefix: ''

classes: ['entity']

excluded_classes: ['dcObject']

sort_by: o

associated_relations: ['foundersIndividuals', 'foundersEntities']

parent_handle_restrictions: "^unit/Entities$"

default_parent: "unit/Entities"

presentation:

name_attribute: o

hidden_attributes: ['founder']

relations:

foundersIndividuals:

type: has_many

object: individual

foreign_key: founder

primary_key: dn

foundersEntities:

type: has_many

object: entity

foreign_key: founder

primary_key: dn

---

mapping:

dn_attribute: cn

prefix: ''

classes: ['posixGroup', 'groupOfMembers']

sort_by: cn

associated_relations: ['individualsPrimaryMembers', 'botsPrimaryMembers', 'individualsSecondaryMembers', 'botsSecondaryMembers']

presentation:

hidden_attributes: ['uniqueMember']

expert_attributes: ['gidNumber']

relations:

individualsPrimaryMembers:

type: belongs_to

object: individual

many: gidNumber

primary_key: gidNumber

botsPrimaryMembers:

type: belongs_to

object: bot

many: gidNumber

primary_key: gidNumber

individualsSecondaryMembers:

type: has_many

object: individual

foreign_key: uniqueMember

primary_key: dn

botsSecondaryMembers:

type: has_many

object: bot

foreign_key: uniqueMember

primary_key: dn

---

mapping:

dn_attribute: uid

prefix: ''

classes: ['individual']

sort_by: uid

possible_aspects: ['primary_account', 'mail', 'fs', 'shell', 'ftp', 'web', 'jabber']

parent_handle_restrictions: "^unit/People$"

default_parent: "unit/People"

presentation:

hidden_attributes: ['uid']

expert_attributes: ['uidNumber', 'gidNumber', 'gecos']

---

mapping:

dn_attribute: uid

prefix: ''

classes: ['secondaryAccount']

sort_by: uid

possible_aspects: ['mail', 'fs', 'shell', 'ftp', 'web', 'jabber']

parent_handle_restrictions: "^(unit/SpecialAccounts|(individual|bot|domain)/.+)$"

default_parent: "unit/SpecialAccounts"

associated_attributes: ['uid', 'allowedServices']

---

mapping:

dn_attribute: uid

prefix: ''

classes: ['systemAccount']

sort_by: uid

possible_aspects: ['mail', 'fs', 'shell', 'ftp', 'web', 'jabber']

default_parent: "unit/SpecialAccounts"

associated_attributes: ['uid', 'allowedServices']

---

mapping:

dn_attribute: dc

prefix: ''

classes: ['entity', 'dcObject']

sort_by: o

parent_handle_restrictions: "^$"

presentation:

name_attribute: o

---

mapping:

dn_attribute: ou

prefix: ''

classes: ['organizationalUnit']

# no sort_by means sort by DN

presentation:

name_attribute: dn

---

mapping:

dn_attribute: cn

prefix: ''

classes: ['userService']

sort_by: cn

possible_aspects: []

parent_handle_restrictions: "^unit/ProvidedServices$"

def self.hook_before_create(item)

hook_common(item)

end

def self.hook_before_modify(item)

hook_common(item)

end

def self.hook_common(item)

pconfig_default = {

:default_group => 'users',

:min_uid => 1000,

:max_uid => 65535,

:step_uid => 100,

:default_home_base => "/home"

}

pconfig = pconfig_default.merge(self.parameters[:plugin])

unless item.attribute_present?('gidNumber')

item.primaryGroup = item.class.shadow.get_object(:group).find(:first, pconfig[:default_group])

end

if item.attribute_present?('uidNumber')

user = ActiveLdap::Base.find(:first, :scope => :sub, :filter => "(&(objectClass=posixAccount)(uidNumber=#{item.uidNumber}))", :attributes => ['uidNumber'])

unless user.nil? or user.dn == item.dn

raise_error "UID already used by another item"

end

else

users = ActiveLdap::Base.find(:all, :scope => :sub, :filter => "(&(objectClass=posixAccount)(uidNumber=*))", :attributes => ['uidNumber'])

uidnumbers = users.collect {|user| user.uidNumber }

avail_uidnumber = nil

min_uidn = pconfig[:min_uid]

max_uidn = [min_uidn + pconfig[:step_uid], pconfig[:max_uid]].min

while avail_uidnumber.nil?

avail = (min_uidn..max_uidn).to_a - uidnumbers

unless avail.empty?

avail_uidnumber = avail.first

break

end

min_uidn = max_uidn

max_uidn = [min_uidn + pconfig[:step_uid], pconfig[:max_uid]].min

end

if avail_uidnumber.nil?

raise_error "Available UID range is depleted."

else

item.uidNumber = avail_uidnumber

end

end

unless item.attribute_present?('homeDirectory')

item.homeDirectory = File.join(pconfig[:default_home_base], item.uid)

end

end

require 'shared_attributes'

def self.hook_before_create(item)

hook_common(item)

end

def self.hook_before_modify(item)

hook_common(item)

end

def self.hook_common(item)

SharedAttr.check_common_attributes(item)

end

module SharedAttr

module_function

def check_common_attributes(item)

if item.attribute_present?('allowedServices')

user_services = ActiveLdap::Base.find(:all, :scope => :sub, :filter => "(objectClass=userService)", :attributes => ['cn'])

srv_names = user_services.collect {|srv| srv.cn }

invalid_srv_names = item.allowedServices(true) - (item.allowedServices(true) & srv_names)

unless invalid_srv_names.empty?

raise PreProcessingError, "Invalid User Service(s) name(s): " + invalid_srv_names.join(", ")

end

end

end

end

def self.hook_before_create(item)

unless item.attribute_present?('cn')

cn = item.surname || ""

cn = item.givenName + " " + cn if item.givenName

item.cn = cn

end

end

require 'shared_attributes'

def self.hook_before_create(item)

hook_common(item)

end

def self.hook_before_modify(item)

hook_common(item)

end

def self.hook_common(item)

SharedAttr.check_common_attributes(item)

end

require 'shared_attributes'

def self.hook_before_create(item)

hook_common(item)

end

def self.hook_before_modify(item)

hook_common(item)

end

def self.hook_common(item)

SharedAttr.check_common_attributes(item)

end

---

presentation:

hidden_attributes: ['objectClass', 'userPassword', 'hasSubordinates', 'entryUUID', 'entryDN', 'structuralObjectClass', 'subschemaSubentry']

tree_objects: ['unit', 'entity']

---

en:

objects:

bot: "Bot"

domain: "Domain"

entity: "Entity"

group: "Group"

individual: "Individual"

secondary_account: "Secondary Account"

system_account: "System Account"

unit: "Unit"

user_service: "User Service"

attribute_types:

allowGlobalDirectory: "Disclose Own Contact Information in GLobal Directory"

cn: "Full Name"

createTimestamp: "Item creation time"

creatorsName: "Item Creator"

birthday: "Birthday"

birthlocation: "Birth Location"

description: "Description"

entryUUID: "Item UUID"

foundingDate: "Founding Date"

ftpHost: "FTP Allowed Hosts"

gecos: "GECOS"

gidNumber: "Primary Group (numeric)"

givenName: "FirstName"

homeDirectory: "Home Directory"

homePostalAddress: "Home Postal Address"

host: "Shell Allowed Hosts"

ipServiceName: "Service Name"

ipServiceHost: "Service Host"

ipServicePort: "Service Port"

ipServiceProtocol: "Service Protocol"

jid: "Jabber ID"

jpegPhoto: "Photo"

keyFingerPrint: "GPG/PGP Key Fingerprint"

labeledURI: "Web Site"

loginShell: "Shell Interpreter"

mail: "eMail address(es)"

mailForward: "eMail Forward Adress(es)"

mailQuota: "Maximum Mailbox Size"

manager: "Manager(s)"

mobile: "Mobile Phone"

modifiersName: "Item Last Modifier"

modifyTimestamp: "Item Last Modification Time"

occupation: "Job / Studies"

o: "Organization(s)"

structuralObjectClass: "Item Structural Classes"

owner: "Owner(s)"

preferredLanguage: "Language Preference"

sn: "Surname"

sshAuthKey: "SSH Public Key(s)"

uid: "Identifier (Login)"

uidNumber: "Identifier (numeric)"

uniqueAbbreviation: "Unique Abbreviation"

uniqueMember: "Group member"

userPassword: "Password"

webVirtualHost: "Hosted Web Sites"

allowedServices: "Authorized services"

relations:

primaryGroup: "Primary Group"

secondaryGroups: "Secondary Groups"

individualsPrimaryMembers: "Primary Member(s) Individual(s)"

botsPrimaryMembers: "Primary Member(s) Bot(s)"

individualsSecondaryMembers: "Secondary Member(s) Individual(s)"

botsSecondaryMembers: "Secondary Member(s) Bot(s)"

foundersIndividuals: "Founder(s) Individual(s)"

foundersEntities: "Founder(s) Entity(ies)"

aspects:

fs: "FileSystem Account"

ftp: "FTP Account"

jabber: "Jabber Account"

mail: "eMail Account"

primary_account: "Primary Account"

shell: "Shell Account"

web: "Web Account"

default_shadow:

password_hash:

ldap: {}

"default_shadow": {type: str}

"ldap":

type: map

required: true

name: LdapMapping

mapping:

=:

type: any

"password_hash": {type: str, enum: [crypt, md5, smd5, sha, ssha]}

def load_global_config(extra_private_config_list = [])

File.join(CFG_DIR, "global_private.conf")

g_def_partial.merge!(YAML.load_file(file) || {})

g_def = parse('config', 'global', YAML.dump(g_def_partial))

g_config = g_default_config.recursive_merge(g_def)

ActiveLdap::Base.setup_connection(g_config[:ldap])

@global_config = g_config

shadow_name = self.global_config[:default_shadow] if shadow_name.nil?

shadow_config_path = File.join(CFG_DIR, "shadows", shadow_name)

when 'global'

GlobalValidator

class GlobalValidator < LdapShadowsValidator