o

�N�g��@s�dZd
dl
Z
d
dlZd
dlZd
dlmZ
zd
dlZd
dlZdZ	Wne
y+


dZ	Yn
we
�e�
Z
dZdd�Zdd	d
�
Zdd�Z			dd
d�
ZGdd�d�ZdS)at
Salt interface to LDAP commands

:depends:   - ldap Python module
:configuration: In order to connect to LDAP, certain configuration is required
    in the minion config on the LDAP server. The minimum configuration items
    that must be set are:

    .. code-block:: yaml

        ldap.basedn: dc=acme,dc=com (example values, adjust to suit)

    If your LDAP server requires authentication then you must also set:

    .. code-block:: yaml

        ldap.anonymous: False
        ldap.binddn: admin
        ldap.bindpw: password

    In addition, the following optional values may be set:

    .. code-block:: yaml

        ldap.server: localhost (default=localhost, see warning below)
        ldap.port: 389 (default=389, standard port)
        ldap.tls: False (default=False, no TLS)
        ldap.no_verify: False (default=False, verify TLS)
        ldap.anonymous: True (default=True, bind anonymous)
        ldap.scope: 2 (default=2, ldap.SCOPE_SUBTREE)
        ldap.attrs: [saltAttr] (default=None, return all attributes)

.. warning::

    At the moment this module only recommends connection to LDAP services
    listening on ``localhost``. This is deliberate to avoid the potentially
    dangerous situation of multiple minions sending identical update commands
    to the same LDAP server. It's easy enough to override this behavior, but
    badness may ensue - you have been warned.
�N)
�CommandExecutionErrorTF�ldapc
Cstrt
Sd
S)z9
    Only load this module if the ldap config is set
    )FzGThe ldapmod execution module cannot be loaded: ldap config not present.)�HAS_LDAP�__virtualname__�rr�H/opt/saltstack/salt/lib/python3.10/site-packages/salt/modules/ldapmod.py�__virtual__>s

rcKsB|
d
ur|}
||vr||}n	tdd|
���
}t
jjj|dd�S)z�
    Return a value for 'name' from command line args then config file options.
    Specify 'key' if the config file option is not the same as 'name'.
    Nz
config.optionzldap.T)
Zto_str)Z__salt__�salt�utils�data�decode)�name�key�kwargs�valuerrr�_configKs




rcKs2i}
d
D]}t|f
i|�
�
|
|<qt
di|
�
�
jS)zP
    Instantiate LDAP Connection class and return an LDAP connection object
    )�uri�server�port�tls�	no_verify�binddn�bindpw�	anonymousNr)r�_LDAPConnectionr)rZconnargsr
rrr�_connectYs

rcKs�|
std
d�}
|s
td�
}|dkrd}n|durtd�
}t
di|�
�
}t��}t�d||
||�
|�|
t|�
||�}t��|}|dkrPtt|d	d
��
d}	n	tt|d��
d
}	|t	|�
|	tt|d��
d�d�}
|
S)az
    Run an arbitrary LDAP query and return the results.

    CLI Example:

    .. code-block:: bash

        salt 'ldaphost' ldap.search "filter=cn=myhost"

    Return data:

    .. code-block:: python

        {'myhost': {'count': 1,
                    'results': [['cn=myhost,ou=hosts,o=acme,c=gb',
                                 {'saltKeyValue': ['ntpserver=ntp.acme.local',
                                                   'foo=myfoo'],
                                  'saltState': ['foo', 'bar']}]],
                    'time': {'human': '1.2ms', 'raw': '0.00123'}}}

    Search and connection options can be overridden by specifying the relevant
    option as key=value pairs, for example:

    .. code-block:: bash

        salt 'ldaphost' ldap.search filter=cn=myhost dn=ou=hosts,o=acme,c=gb
        scope=1 attrs='' server='localhost' port='7393' tls=True bindpw='ssh'
    �dnZbasedn�scope�N�attrsz=Running LDAP search with filter:%s, dn:%s, scope:%s, attrs:%sg�������?i��
�ms��
s�)Zhuman�raw)�results�count�timer)
rrr(�log�debugZsearch_s�int�str�round�len)�filterrrrrZ_ldap�startr&�elapsedZ	elapsed_h�retrrr�searchms6#















�




�r3c@seZ
dZd
Zdd�ZdS)rz#
    Setup an LDAP connection.
    c	

Cs�|
|_||_
||_||_||_||_|jd
kr"d|j
�d|j��|_z7|r-t�tjtj	�
t�
|j��
|_d|j_|j�tjd�
|jrI|j�
�
|sW|j�|j|j�
WdSWdStyp
}	
ztd�|j|j|	��
�
d}	~	w
w)zE
        Bind to an LDAP directory using passed credentials.
        rzldap://�
:�r
z*Failed to bind to LDAP server {} as {}: {}N)rrrrrrrZ
set_optionZOPT_X_TLS_REQUIRE_CERTZOPT_X_TLS_NEVERZ
initializeZprotocol_versionZ
OPT_REFERRALSZstart_tls_sZ
simple_bind_s�	Exceptionr�format)
�selfrrrrrrrrZ
ldap_errorrrr�__init__�s6













�



����z_LDAPConnection.__init__N)�__name__�
__module__�__qualname__�__doc__r9rrrrr�s
r)
N)NNN)r=�loggingr(Zsalt.utils.datar	Zsalt.exceptionsrrZldap.modlistr�ImportError�	getLoggerr:r)rrrrr3rrrrr�<module>
s,)





�





�C