File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/states/__pycache__/ldap.cpython-310.pyc
o
�N�g=O � @ sp d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z e�
e �Z ddd�Z
dd � Zd
d � Zd d
� ZdS )z�
Manage entries in an LDAP database
==================================
.. versionadded:: 2016.3.0
The ``states.ldap`` state module allows you to manage LDAP entries and
their attributes.
� N)� OrderedDict)�
OrderedSet)�to_bytesc sP |du ri }z|� d| � W n ty Y nw td }t�|�}||���8}t||�\}}t� }|�|� |�|� t� } |D ]9}
|� |
i ��|� |
i �� �� fD ] } t� } | �
� D ] \}
}|sf| � |
� q[| D ]}
| |
= qiqR�� kry| � |
� q@| D ]}
||fD ]} | � |
d� q�||
= q|| i ddd�}||kr�d|d< d|d < |W d � S t
d
r�d |d< |}|}|}n�t� }t� }d|d < d |d< g }t� }|D ]r}
|� |
i ��|� |
i �� d}z>��r� r�d
}�� ks�J �td ||
�� � nd}td ||
� nd}� �sJ �td ||
� � �||
< � ||
< d||
< W q� |j�yA } zt�d||
|� |�||
|f� W Y d}~q�d}~ww |�rWd|d < dd�dd� |D �� |d< W d � n 1 �sbw Y |D ]<}
|� |
i ��|� |
i �� i }||d |
< �df� dffD ] \} }| �s�d||< �q�� �fd d �| �
� D �||< �q��qi|S ) a# Ensure the existence (or not) of LDAP entries and their attributes
Example:
.. code-block:: yaml
ldapi:///:
ldap.managed:
- connect_spec:
bind:
method: sasl
- entries:
# make sure the entry doesn't exist
- cn=foo,ou=users,dc=example,dc=com:
- delete_others: True
# make sure the entry exists with only the specified
# attribute values
- cn=admin,dc=example,dc=com:
- delete_others: True
- replace:
cn:
- admin
description:
- LDAP administrator
objectClass:
- simpleSecurityObject
- organizationalRole
userPassword:
- {{pillar.ldap_admin_password}}
# make sure the entry exists, its olcRootDN attribute
# has only the specified value, the olcRootDN attribute
# doesn't exist, and all other attributes are ignored
- 'olcDatabase={1}hdb,cn=config':
- replace:
olcRootDN:
- cn=admin,dc=example,dc=com
# the admin entry has its own password attribute
olcRootPW: []
# note the use of 'default'. also note how you don't
# have to use list syntax if there is only one attribute
# value
- cn=foo,ou=users,dc=example,dc=com:
- delete_others: True
- default:
userPassword: changeme
shadowLastChange: 0
# keep sshPublicKey if present, but don't create
# the attribute if it is missing
sshPublicKey: []
- replace:
cn: foo
uid: foo
uidNumber: 1000
gidNumber: 1000
gecos: Foo Bar
givenName: Foo
sn: Bar
homeDirectory: /home/foo
loginShell: /bin/bash
objectClass:
- inetOrgPerson
- posixAccount
- top
- ldapPublicKey
- shadowAccount
:param name:
The URL of the LDAP server. This is ignored if
``connect_spec`` is either a connection object or a dict with
a ``'url'`` entry.
:param entries:
A description of the desired state of zero or more LDAP
entries.
``entries`` is an iterable of dicts. Each of these dict's
keys are the distinguished names (DNs) of LDAP entries to
manage. Each of these dicts is processed in order. A later
dict can reference an LDAP entry that was already mentioned in
an earlier dict, which makes it possible for later dicts to
enhance or alter the desired state of an LDAP entry.
The DNs are mapped to a description of the LDAP entry's
desired state. These LDAP entry descriptions are themselves
iterables of dicts. Each dict in the iterable is processed in
order. They contain directives controlling the entry's state.
The key names the directive type and the value is state
information for the directive. The specific structure of the
state information depends on the directive type.
The structure of ``entries`` looks like this::
[{dn1: [{directive1: directive1_state,
directive2: directive2_state},
{directive3: directive3_state}],
dn2: [{directive4: directive4_state,
directive5: directive5_state}]},
{dn3: [{directive6: directive6_state}]}]
These are the directives:
* ``'delete_others'``
Boolean indicating whether to delete attributes not
mentioned in this dict or any of the other directive
dicts for this DN. Defaults to ``False``.
If you don't want to delete an attribute if present, but
you also don't want to add it if it is missing or modify
it if it is present, you can use either the ``'default'``
directive or the ``'add'`` directive with an empty value
list.
* ``'default'``
A dict mapping an attribute name to an iterable of default
values for that attribute. If the attribute already
exists, it is left alone. If not, it is created using the
given list of values.
An empty value list is useful when you don't want to
create an attribute if it is missing but you do want to
preserve it if the ``'delete_others'`` key is ``True``.
* ``'add'``
Attribute values to add to the entry. This is a dict
mapping an attribute name to an iterable of values to add.
An empty value list is useful when you don't want to
create an attribute if it is missing but you do want to
preserve it if the ``'delete_others'`` key is ``True``.
* ``'delete'``
Attribute values to remove from the entry. This is a dict
mapping an attribute name to an iterable of values to
delete from the attribute. If the iterable is empty, all
of the attribute's values are deleted.
* ``'replace'``
Attributes to replace. This is a dict mapping an
attribute name to an iterable of values. Any existing
values for the attribute are deleted, then the given
values are added. The iterable may be empty.
In the above directives, the iterables of attribute values may
instead be ``None``, in which case an empty list is used, or a
scalar such as a string or number, in which case a new list
containing the scalar is used.
Note that if all attribute values are removed from an entry,
the entire entry is deleted.
:param connect_spec:
See the description of the ``connect_spec`` parameter of the
:py:func:`ldap3.connect <salt.modules.ldap3.connect>` function
in the :py:mod:`ldap3 <salt.modules.ldap3>` execution module.
If this is a dict and the ``'url'`` entry is not specified,
the ``'url'`` entry is set to the value of the ``name``
parameter.
:returns:
A dict with the following keys:
* ``'name'``
This is the same object passed to the ``name`` parameter.
* ``'changes'``
This is a dict describing the changes made (or, in test
mode, the changes that would have been attempted). If no
changes were made (or no changes would have been
attempted), then this dict is empty. Only successful
changes are included.
Each key is a DN of an entry that was changed (or would
have been changed). Entries that were not changed (or
would not have been changed) are not included. The value
is a dict with two keys:
* ``'old'``
The state of the entry before modification. If the
entry did not previously exist, this key maps to
``None``. Otherwise, the value is a dict mapping each
of the old entry's attributes to a list of its values
before any modifications were made. Unchanged
attributes are excluded from this dict.
* ``'new'``
The state of the entry after modification. If the
entry was deleted, this key maps to ``None``.
Otherwise, the value is a dict mapping each of the
entry's attributes to a list of its values after the
modifications were made. Unchanged attributes are
excluded from this dict.
Example ``'changes'`` dict where a new entry was created
with a single attribute containing two values::
{'dn1': {'old': None,
'new': {'attr1': ['val1', 'val2']}}}
Example ``'changes'`` dict where a new attribute was added
to an existing entry::
{'dn1': {'old': {},
'new': {'attr2': ['val3']}}}
* ``'result'``
One of the following values:
* ``True`` if no changes were necessary or if all changes
were applied successfully.
* ``False`` if at least one change was unable to be applied.
* ``None`` if changes would be applied but it is in test
mode.
N�urlz
ldap3.connect� )�name�changes�result�commentzLDAP entries already setr
Tr �testzWould change LDAP entriesz!Successfully updated LDAP entries�modifyz ldap3.change�deletez ldap3.delete�addz ldap3.addzfailed to %s entry %s (%s)Fz
failed to z, c s s2 � | ]\}}}|d | d t |� d V qdS )z entry �(�)N)�str)�.0�op�dn�err� r �D/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/ldap.py� <genexpr>Z s �0 zmanaged.<locals>.<genexpr>r �old�newc s2 i | ]\}}�� |d �� � |d �kr|t|��qS )r )�get�sorted)r �attr�vals��n�or r �
<dictcomp>i s
�zmanaged.<locals>.<dictcomp>)�
setdefault�AttributeError�__salt__�inspectZ getmodule�_process_entriesr �update�setr �itemsr �popZ__opts__Z LDAPError�log� exception�append�join)r �entriesZ connect_spec�connectZldap3�lr r Zdn_setZ dn_to_deleter �x� to_deleter r �retZ changed_oldZ changed_newZsuccess_dn_setZerrsr r r Zxnr r r �managed s� \ �
��
� ��,
��
�� �a ��
r6 c s
t � }t � }|D ]x}|�� D ]q\}}|�|d�}|du rFtd | |d�}t|�dkr8|| � � fdd�� D �}n
t|�dks@J �i }|||< t�|�} | ||< dt� d �}
|D ]} t| |
| � qW|
d
rt� } | D ]
}
|
|
d vrv| � |
� qi| D ]}
| |
= qyqq||fS ) aT Helper for managed() to process entries and return before/after views
Collect the current database state and update it according to the
data in :py:func:`managed`'s ``entries`` parameter. Return the
current database state and what it will look like after
modification.
:param l:
the LDAP connection object
:param entries:
the same object passed to the ``entries`` parameter of
:py:func:`manage`
:return:
an ``(old, new)`` tuple that describes the current state of
the entries and what they will look like after modification.
Each item in the tuple is an OrderedDict that maps an entry DN
to another dict that maps an attribute name to a set of its
values (it's a set because according to the LDAP spec,
attribute value ordering is unspecified and there can't be
duplicates). The structure looks like this:
{dn1: {attr1: set([val1])},
dn2: {attr1: set([val2]), attr2: set([val3, val4])}}
All of an entry's attributes and values will be included, even
if they will not be modified. If an entry mentioned in the
entries variable doesn't yet exist in the database, the DN in
``old`` will be mapped to an empty dict. If an entry in the
database will be deleted, the DN in ``new`` will be mapped to
an empty dict. All value sets are non-empty: An attribute
that will be added to an entry is not included in ``old``, and
an attribute that will be deleted frm an entry is not included
in ``new``.
These are OrderedDicts to ensure that the user-supplied
entries are processed in the user-specified order (in case
there are dependencies, such as ACL rules specified in an
early entry that make it possible to modify a later entry).
Nz ldap3.search�base� c s& i | ]}t � | �r|t� | ��qS r )�lenr )r r �Zattrsr r r" � s
� �z$_process_entries.<locals>.<dictcomp>r F)�
delete_others�mentioned_attributesr; r< )
r r* r r% r9 �copy�deepcopyr) �
_update_entryr )r2 r0 r r Z entries_dictr Zdirectives_seqZolde�resultsZneweZ entry_status�
directivesr4 r r r: r r' r sB +
�
�
���'r' c C s� |� � D ]w\}}|dkr||d< q|� � D ]e\}}|d �|� t|�}|dkr7|r6|| vs2| | s6|| |< q|dkrL|�| �|t� �� |rK|| |< q|dkrd| �|t� �}|rc||8 }|rc|| |< q|dkru| �|d� |rt|| |< qtd| ��qdS ) a� Update an entry's attributes using the provided directives
:param entry:
A dict mapping each attribute name to a set of its values
:param status:
A dict holding cross-invocation status (whether delete_others
is True or not, and the set of mentioned attributes)
:param directives:
A dict mapping directive types to directive-specific state
r; r< �defaultr r
�replaceNzunknown directive: )r* r �_tosetr( r r r+ �
ValueError)�entry�statusrA Z directive�stater r Z
existing_valsr r r r? � s> ��� � ��r? c C sv | du rt � S t| t�rt t| �f�S t| t�r!t tt| ��f�S z
t dd� | D ��W S ty: t t| �� Y S w )a| helper to convert various things to a set
This enables flexibility in what users provide as the list of LDAP
entry attribute values. Note that the LDAP spec prohibits
duplicate values in an attribute.
RFC 2251 states that:
"The order of attribute values within the vals set is undefined and
implementation-dependent, and MUST NOT be relied upon."
However, OpenLDAP have an X-ORDERED that is used in the config schema.
Using sets would mean we can't pass ordered values and therefore can't
manage parts of the OpenLDAP configuration, hence the use of OrderedSet.
Sets are also good for automatically removing duplicates.
None becomes an empty set. Iterables except for strings have
their elements added to a new set. Non-None scalars (strings,
numbers, non-iterable objects, etc.) are added as the only member
of a new set.
Nc s s. � | ]}t |t�rtt|��nt|�V qd S �N)�
isinstance�intr r )r r3 r r r r s �
�z_toset.<locals>.<genexpr>)r rJ r r rK � TypeError)�thingr r r rD � s
� ��rD rI )�__doc__r= r& �loggingZsalt.utils.odictr Zsalt.utils.osetr Zsalt.utils.stringutilsr � getLogger�__name__r, r6 r' r? rD r r r r �<module> s
^Y '