1913 lines
75 KiB
Python
1913 lines
75 KiB
Python
# Copyright 2012 OpenStack Foundation
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
import abc
|
|
import codecs
|
|
import functools
|
|
import os.path
|
|
import re
|
|
import sys
|
|
import weakref
|
|
|
|
import ldap.filter
|
|
import ldappool
|
|
from oslo_log import log
|
|
import six
|
|
from six.moves import map, zip
|
|
|
|
from keystone import exception
|
|
from keystone.i18n import _
|
|
from keystone.i18n import _LW
|
|
|
|
|
|
LOG = log.getLogger(__name__)
|
|
|
|
LDAP_VALUES = {'TRUE': True, 'FALSE': False}
|
|
CONTROL_TREEDELETE = '1.2.840.113556.1.4.805'
|
|
LDAP_SCOPES = {'one': ldap.SCOPE_ONELEVEL,
|
|
'sub': ldap.SCOPE_SUBTREE}
|
|
LDAP_DEREF = {'always': ldap.DEREF_ALWAYS,
|
|
'default': None,
|
|
'finding': ldap.DEREF_FINDING,
|
|
'never': ldap.DEREF_NEVER,
|
|
'searching': ldap.DEREF_SEARCHING}
|
|
LDAP_TLS_CERTS = {'never': ldap.OPT_X_TLS_NEVER,
|
|
'demand': ldap.OPT_X_TLS_DEMAND,
|
|
'allow': ldap.OPT_X_TLS_ALLOW}
|
|
|
|
|
|
# RFC 4511 (The LDAP Protocol) defines a list containing only the OID '1.1' to
|
|
# indicate that no attributes should be returned besides the DN.
|
|
DN_ONLY = ['1.1']
|
|
|
|
_utf8_encoder = codecs.getencoder('utf-8')
|
|
|
|
|
|
def utf8_encode(value):
|
|
"""Encode a basestring to UTF-8.
|
|
|
|
If the string is unicode encode it to UTF-8, if the string is
|
|
str then assume it's already encoded. Otherwise raise a TypeError.
|
|
|
|
:param value: A basestring
|
|
:returns: UTF-8 encoded version of value
|
|
:raises: TypeError if value is not basestring
|
|
"""
|
|
if isinstance(value, six.text_type):
|
|
return _utf8_encoder(value)[0]
|
|
elif isinstance(value, six.binary_type):
|
|
return value
|
|
else:
|
|
raise TypeError("value must be basestring, "
|
|
"not %s" % value.__class__.__name__)
|
|
|
|
_utf8_decoder = codecs.getdecoder('utf-8')
|
|
|
|
|
|
def utf8_decode(value):
|
|
"""Decode a from UTF-8 into unicode.
|
|
|
|
If the value is a binary string assume it's UTF-8 encoded and decode
|
|
it into a unicode string. Otherwise convert the value from its
|
|
type into a unicode string.
|
|
|
|
:param value: value to be returned as unicode
|
|
:returns: value as unicode
|
|
:raises: UnicodeDecodeError for invalid UTF-8 encoding
|
|
"""
|
|
if isinstance(value, six.binary_type):
|
|
return _utf8_decoder(value)[0]
|
|
return six.text_type(value)
|
|
|
|
|
|
def py2ldap(val):
|
|
"""Type convert a Python value to a type accepted by LDAP (unicode).
|
|
|
|
The LDAP API only accepts strings for values therefore convert
|
|
the value's type to a unicode string. A subsequent type conversion
|
|
will encode the unicode as UTF-8 as required by the python-ldap API,
|
|
but for now we just want a string representation of the value.
|
|
|
|
:param val: The value to convert to a LDAP string representation
|
|
:returns: unicode string representation of value.
|
|
"""
|
|
if isinstance(val, bool):
|
|
return u'TRUE' if val else u'FALSE'
|
|
else:
|
|
return six.text_type(val)
|
|
|
|
|
|
def enabled2py(val):
|
|
"""Similar to ldap2py, only useful for the enabled attribute."""
|
|
|
|
try:
|
|
return LDAP_VALUES[val]
|
|
except KeyError:
|
|
pass
|
|
try:
|
|
return int(val)
|
|
except ValueError:
|
|
pass
|
|
return utf8_decode(val)
|
|
|
|
|
|
def ldap2py(val):
|
|
"""Convert an LDAP formatted value to Python type used by OpenStack.
|
|
|
|
Virtually all LDAP values are stored as UTF-8 encoded strings.
|
|
OpenStack prefers values which are unicode friendly.
|
|
|
|
:param val: LDAP formatted value
|
|
:returns: val converted to preferred Python type
|
|
"""
|
|
return utf8_decode(val)
|
|
|
|
|
|
def convert_ldap_result(ldap_result):
|
|
"""Convert LDAP search result to Python types used by OpenStack.
|
|
|
|
Each result tuple is of the form (dn, attrs), where dn is a string
|
|
containing the DN (distinguished name) of the entry, and attrs is
|
|
a dictionary containing the attributes associated with the
|
|
entry. The keys of attrs are strings, and the associated values
|
|
are lists of strings.
|
|
|
|
OpenStack wants to use Python types of its choosing. Strings will
|
|
be unicode, truth values boolean, whole numbers int's, etc. DN's will
|
|
also be decoded from UTF-8 to unicode.
|
|
|
|
:param ldap_result: LDAP search result
|
|
:returns: list of 2-tuples containing (dn, attrs) where dn is unicode
|
|
and attrs is a dict whose values are type converted to
|
|
OpenStack preferred types.
|
|
"""
|
|
py_result = []
|
|
at_least_one_referral = False
|
|
for dn, attrs in ldap_result:
|
|
ldap_attrs = {}
|
|
if dn is None:
|
|
# this is a Referral object, rather than an Entry object
|
|
at_least_one_referral = True
|
|
continue
|
|
|
|
for kind, values in six.iteritems(attrs):
|
|
try:
|
|
val2py = enabled2py if kind == 'enabled' else ldap2py
|
|
ldap_attrs[kind] = [val2py(x) for x in values]
|
|
except UnicodeDecodeError:
|
|
LOG.debug('Unable to decode value for attribute %s', kind)
|
|
|
|
py_result.append((utf8_decode(dn), ldap_attrs))
|
|
if at_least_one_referral:
|
|
LOG.debug(('Referrals were returned and ignored. Enable referral '
|
|
'chasing in keystone.conf via [ldap] chase_referrals'))
|
|
|
|
return py_result
|
|
|
|
|
|
def safe_iter(attrs):
|
|
if attrs is None:
|
|
return
|
|
elif isinstance(attrs, list):
|
|
for e in attrs:
|
|
yield e
|
|
else:
|
|
yield attrs
|
|
|
|
|
|
def parse_deref(opt):
|
|
try:
|
|
return LDAP_DEREF[opt]
|
|
except KeyError:
|
|
raise ValueError(_('Invalid LDAP deref option: %(option)s. '
|
|
'Choose one of: %(options)s') %
|
|
{'option': opt,
|
|
'options': ', '.join(LDAP_DEREF.keys()), })
|
|
|
|
|
|
def parse_tls_cert(opt):
|
|
try:
|
|
return LDAP_TLS_CERTS[opt]
|
|
except KeyError:
|
|
raise ValueError(_(
|
|
'Invalid LDAP TLS certs option: %(option)s. '
|
|
'Choose one of: %(options)s') % {
|
|
'option': opt,
|
|
'options': ', '.join(LDAP_TLS_CERTS.keys())})
|
|
|
|
|
|
def ldap_scope(scope):
|
|
try:
|
|
return LDAP_SCOPES[scope]
|
|
except KeyError:
|
|
raise ValueError(
|
|
_('Invalid LDAP scope: %(scope)s. Choose one of: %(options)s') % {
|
|
'scope': scope,
|
|
'options': ', '.join(LDAP_SCOPES.keys())})
|
|
|
|
|
|
def prep_case_insensitive(value):
|
|
"""Prepare a string for case-insensitive comparison.
|
|
|
|
This is defined in RFC4518. For simplicity, all this function does is
|
|
lowercase all the characters, strip leading and trailing whitespace,
|
|
and compress sequences of spaces to a single space.
|
|
"""
|
|
value = re.sub(r'\s+', ' ', value.strip().lower())
|
|
return value
|
|
|
|
|
|
def is_ava_value_equal(attribute_type, val1, val2):
|
|
"""Returns True if and only if the AVAs are equal.
|
|
|
|
When comparing AVAs, the equality matching rule for the attribute type
|
|
should be taken into consideration. For simplicity, this implementation
|
|
does a case-insensitive comparison.
|
|
|
|
Note that this function uses prep_case_insenstive so the limitations of
|
|
that function apply here.
|
|
|
|
"""
|
|
|
|
return prep_case_insensitive(val1) == prep_case_insensitive(val2)
|
|
|
|
|
|
def is_rdn_equal(rdn1, rdn2):
|
|
"""Returns True if and only if the RDNs are equal.
|
|
|
|
* RDNs must have the same number of AVAs.
|
|
* Each AVA of the RDNs must be the equal for the same attribute type. The
|
|
order isn't significant. Note that an attribute type will only be in one
|
|
AVA in an RDN, otherwise the DN wouldn't be valid.
|
|
* Attribute types aren't case sensitive. Note that attribute type
|
|
comparison is more complicated than implemented. This function only
|
|
compares case-insentive. The code should handle multiple names for an
|
|
attribute type (e.g., cn, commonName, and 2.5.4.3 are the same).
|
|
|
|
Note that this function uses is_ava_value_equal to compare AVAs so the
|
|
limitations of that function apply here.
|
|
|
|
"""
|
|
|
|
if len(rdn1) != len(rdn2):
|
|
return False
|
|
|
|
for attr_type_1, val1, dummy in rdn1:
|
|
found = False
|
|
for attr_type_2, val2, dummy in rdn2:
|
|
if attr_type_1.lower() != attr_type_2.lower():
|
|
continue
|
|
|
|
found = True
|
|
if not is_ava_value_equal(attr_type_1, val1, val2):
|
|
return False
|
|
break
|
|
if not found:
|
|
return False
|
|
|
|
return True
|
|
|
|
|
|
def is_dn_equal(dn1, dn2):
|
|
"""Returns True if and only if the DNs are equal.
|
|
|
|
Two DNs are equal if they've got the same number of RDNs and if the RDNs
|
|
are the same at each position. See RFC4517.
|
|
|
|
Note that this function uses is_rdn_equal to compare RDNs so the
|
|
limitations of that function apply here.
|
|
|
|
:param dn1: Either a string DN or a DN parsed by ldap.dn.str2dn.
|
|
:param dn2: Either a string DN or a DN parsed by ldap.dn.str2dn.
|
|
|
|
"""
|
|
|
|
if not isinstance(dn1, list):
|
|
dn1 = ldap.dn.str2dn(utf8_encode(dn1))
|
|
if not isinstance(dn2, list):
|
|
dn2 = ldap.dn.str2dn(utf8_encode(dn2))
|
|
|
|
if len(dn1) != len(dn2):
|
|
return False
|
|
|
|
for rdn1, rdn2 in zip(dn1, dn2):
|
|
if not is_rdn_equal(rdn1, rdn2):
|
|
return False
|
|
return True
|
|
|
|
|
|
def dn_startswith(descendant_dn, dn):
|
|
"""Returns True if and only if the descendant_dn is under the dn.
|
|
|
|
:param descendant_dn: Either a string DN or a DN parsed by ldap.dn.str2dn.
|
|
:param dn: Either a string DN or a DN parsed by ldap.dn.str2dn.
|
|
|
|
"""
|
|
|
|
if not isinstance(descendant_dn, list):
|
|
descendant_dn = ldap.dn.str2dn(utf8_encode(descendant_dn))
|
|
if not isinstance(dn, list):
|
|
dn = ldap.dn.str2dn(utf8_encode(dn))
|
|
|
|
if len(descendant_dn) <= len(dn):
|
|
return False
|
|
|
|
# Use the last len(dn) RDNs.
|
|
return is_dn_equal(descendant_dn[-len(dn):], dn)
|
|
|
|
|
|
@six.add_metaclass(abc.ABCMeta)
|
|
class LDAPHandler(object):
|
|
'''Abstract class which defines methods for a LDAP API provider.
|
|
|
|
Native Keystone values cannot be passed directly into and from the
|
|
python-ldap API. Type conversion must occur at the LDAP API
|
|
boudary, examples of type conversions are:
|
|
|
|
* booleans map to the strings 'TRUE' and 'FALSE'
|
|
|
|
* integer values map to their string representation.
|
|
|
|
* unicode strings are encoded in UTF-8
|
|
|
|
In addition to handling type conversions at the API boundary we
|
|
have the requirement to support more than one LDAP API
|
|
provider. Currently we have:
|
|
|
|
* python-ldap, this is the standard LDAP API for Python, it
|
|
requires access to a live LDAP server.
|
|
|
|
* Fake LDAP which emulates python-ldap. This is used for
|
|
testing without requiring a live LDAP server.
|
|
|
|
To support these requirements we need a layer that performs type
|
|
conversions and then calls another LDAP API which is configurable
|
|
(e.g. either python-ldap or the fake emulation).
|
|
|
|
We have an additional constraint at the time of this writing due to
|
|
limitations in the logging module. The logging module is not
|
|
capable of accepting UTF-8 encoded strings, it will throw an
|
|
encoding exception. Therefore all logging MUST be performed prior
|
|
to UTF-8 conversion. This means no logging can be performed in the
|
|
ldap APIs that implement the python-ldap API because those APIs
|
|
are defined to accept only UTF-8 strings. Thus the layer which
|
|
performs type conversions must also do the logging. We do the type
|
|
conversions in two steps, once to convert all Python types to
|
|
unicode strings, then log, then convert the unicode strings to
|
|
UTF-8.
|
|
|
|
There are a variety of ways one could accomplish this, we elect to
|
|
use a chaining technique whereby instances of this class simply
|
|
call the next member in the chain via the "conn" attribute. The
|
|
chain is constructed by passing in an existing instance of this
|
|
class as the conn attribute when the class is instantiated.
|
|
|
|
Here is a brief explanation of why other possible approaches were
|
|
not used:
|
|
|
|
subclassing
|
|
|
|
To perform the wrapping operations in the correct order
|
|
the type convesion class would have to subclass each of
|
|
the API providers. This is awkward, doubles the number of
|
|
classes, and does not scale well. It requires the type
|
|
conversion class to be aware of all possible API
|
|
providers.
|
|
|
|
decorators
|
|
|
|
Decorators provide an elegant solution to wrap methods and
|
|
would be an ideal way to perform type conversions before
|
|
calling the wrapped function and then converting the
|
|
values returned from the wrapped function. However
|
|
decorators need to be aware of the method signature, it
|
|
has to know what input parameters need conversion and how
|
|
to convert the result. For an API like python-ldap which
|
|
has a large number of different method signatures it would
|
|
require a large number of specialized
|
|
decorators. Experience has shown it's very easy to apply
|
|
the wrong decorator due to the inherent complexity and
|
|
tendency to cut-n-paste code. Another option is to
|
|
parameterize the decorator to make it "smart". Experience
|
|
has shown such decorators become insanely complicated and
|
|
difficult to understand and debug. Also decorators tend to
|
|
hide what's really going on when a method is called, the
|
|
operations being performed are not visible when looking at
|
|
the implemation of a decorated method, this too experience
|
|
has shown leads to mistakes.
|
|
|
|
Chaining simplifies both wrapping to perform type conversion as
|
|
well as the substitution of alternative API providers. One simply
|
|
creates a new instance of the API interface and insert it at the
|
|
front of the chain. Type conversions are explicit and obvious.
|
|
|
|
If a new method needs to be added to the API interface one adds it
|
|
to the abstract class definition. Should one miss adding the new
|
|
method to any derivations of the abstract class the code will fail
|
|
to load and run making it impossible to forget updating all the
|
|
derived classes.
|
|
'''
|
|
@abc.abstractmethod
|
|
def __init__(self, conn=None):
|
|
self.conn = conn
|
|
|
|
@abc.abstractmethod
|
|
def connect(self, url, page_size=0, alias_dereferencing=None,
|
|
use_tls=False, tls_cacertfile=None, tls_cacertdir=None,
|
|
tls_req_cert='demand', chase_referrals=None, debug_level=None,
|
|
use_pool=None, pool_size=None, pool_retry_max=None,
|
|
pool_retry_delay=None, pool_conn_timeout=None,
|
|
pool_conn_lifetime=None):
|
|
raise exception.NotImplemented() # pragma: no cover
|
|
|
|
@abc.abstractmethod
|
|
def set_option(self, option, invalue):
|
|
raise exception.NotImplemented() # pragma: no cover
|
|
|
|
@abc.abstractmethod
|
|
def get_option(self, option):
|
|
raise exception.NotImplemented() # pragma: no cover
|
|
|
|
@abc.abstractmethod
|
|
def simple_bind_s(self, who='', cred='',
|
|
serverctrls=None, clientctrls=None):
|
|
raise exception.NotImplemented() # pragma: no cover
|
|
|
|
@abc.abstractmethod
|
|
def unbind_s(self):
|
|
raise exception.NotImplemented() # pragma: no cover
|
|
|
|
@abc.abstractmethod
|
|
def add_s(self, dn, modlist):
|
|
raise exception.NotImplemented() # pragma: no cover
|
|
|
|
@abc.abstractmethod
|
|
def search_s(self, base, scope,
|
|
filterstr='(objectClass=*)', attrlist=None, attrsonly=0):
|
|
raise exception.NotImplemented() # pragma: no cover
|
|
|
|
@abc.abstractmethod
|
|
def search_ext(self, base, scope,
|
|
filterstr='(objectClass=*)', attrlist=None, attrsonly=0,
|
|
serverctrls=None, clientctrls=None,
|
|
timeout=-1, sizelimit=0):
|
|
raise exception.NotImplemented() # pragma: no cover
|
|
|
|
@abc.abstractmethod
|
|
def result3(self, msgid=ldap.RES_ANY, all=1, timeout=None,
|
|
resp_ctrl_classes=None):
|
|
raise exception.NotImplemented() # pragma: no cover
|
|
|
|
@abc.abstractmethod
|
|
def modify_s(self, dn, modlist):
|
|
raise exception.NotImplemented() # pragma: no cover
|
|
|
|
@abc.abstractmethod
|
|
def delete_s(self, dn):
|
|
raise exception.NotImplemented() # pragma: no cover
|
|
|
|
@abc.abstractmethod
|
|
def delete_ext_s(self, dn, serverctrls=None, clientctrls=None):
|
|
raise exception.NotImplemented() # pragma: no cover
|
|
|
|
|
|
class PythonLDAPHandler(LDAPHandler):
|
|
'''Implementation of the LDAPHandler interface which calls the
|
|
python-ldap API.
|
|
|
|
Note, the python-ldap API requires all string values to be UTF-8
|
|
encoded. The KeystoneLDAPHandler enforces this prior to invoking
|
|
the methods in this class.
|
|
'''
|
|
|
|
def __init__(self, conn=None):
|
|
super(PythonLDAPHandler, self).__init__(conn=conn)
|
|
|
|
def connect(self, url, page_size=0, alias_dereferencing=None,
|
|
use_tls=False, tls_cacertfile=None, tls_cacertdir=None,
|
|
tls_req_cert='demand', chase_referrals=None, debug_level=None,
|
|
use_pool=None, pool_size=None, pool_retry_max=None,
|
|
pool_retry_delay=None, pool_conn_timeout=None,
|
|
pool_conn_lifetime=None):
|
|
|
|
_common_ldap_initialization(url=url,
|
|
use_tls=use_tls,
|
|
tls_cacertfile=tls_cacertfile,
|
|
tls_cacertdir=tls_cacertdir,
|
|
tls_req_cert=tls_req_cert,
|
|
debug_level=debug_level)
|
|
|
|
self.conn = ldap.initialize(url)
|
|
self.conn.protocol_version = ldap.VERSION3
|
|
|
|
if alias_dereferencing is not None:
|
|
self.conn.set_option(ldap.OPT_DEREF, alias_dereferencing)
|
|
self.page_size = page_size
|
|
|
|
if use_tls:
|
|
self.conn.start_tls_s()
|
|
|
|
if chase_referrals is not None:
|
|
self.conn.set_option(ldap.OPT_REFERRALS, int(chase_referrals))
|
|
|
|
def set_option(self, option, invalue):
|
|
return self.conn.set_option(option, invalue)
|
|
|
|
def get_option(self, option):
|
|
return self.conn.get_option(option)
|
|
|
|
def simple_bind_s(self, who='', cred='',
|
|
serverctrls=None, clientctrls=None):
|
|
return self.conn.simple_bind_s(who, cred, serverctrls, clientctrls)
|
|
|
|
def unbind_s(self):
|
|
return self.conn.unbind_s()
|
|
|
|
def add_s(self, dn, modlist):
|
|
return self.conn.add_s(dn, modlist)
|
|
|
|
def search_s(self, base, scope,
|
|
filterstr='(objectClass=*)', attrlist=None, attrsonly=0):
|
|
return self.conn.search_s(base, scope, filterstr,
|
|
attrlist, attrsonly)
|
|
|
|
def search_ext(self, base, scope,
|
|
filterstr='(objectClass=*)', attrlist=None, attrsonly=0,
|
|
serverctrls=None, clientctrls=None,
|
|
timeout=-1, sizelimit=0):
|
|
return self.conn.search_ext(base, scope,
|
|
filterstr, attrlist, attrsonly,
|
|
serverctrls, clientctrls,
|
|
timeout, sizelimit)
|
|
|
|
def result3(self, msgid=ldap.RES_ANY, all=1, timeout=None,
|
|
resp_ctrl_classes=None):
|
|
# The resp_ctrl_classes parameter is a recent addition to the
|
|
# API. It defaults to None. We do not anticipate using it.
|
|
# To run with older versions of python-ldap we do not pass it.
|
|
return self.conn.result3(msgid, all, timeout)
|
|
|
|
def modify_s(self, dn, modlist):
|
|
return self.conn.modify_s(dn, modlist)
|
|
|
|
def delete_s(self, dn):
|
|
return self.conn.delete_s(dn)
|
|
|
|
def delete_ext_s(self, dn, serverctrls=None, clientctrls=None):
|
|
return self.conn.delete_ext_s(dn, serverctrls, clientctrls)
|
|
|
|
|
|
def _common_ldap_initialization(url, use_tls=False, tls_cacertfile=None,
|
|
tls_cacertdir=None, tls_req_cert=None,
|
|
debug_level=None):
|
|
'''Method for common ldap initialization between PythonLDAPHandler and
|
|
PooledLDAPHandler.
|
|
'''
|
|
|
|
LOG.debug("LDAP init: url=%s", url)
|
|
LOG.debug('LDAP init: use_tls=%s tls_cacertfile=%s tls_cacertdir=%s '
|
|
'tls_req_cert=%s tls_avail=%s',
|
|
use_tls, tls_cacertfile, tls_cacertdir,
|
|
tls_req_cert, ldap.TLS_AVAIL)
|
|
|
|
if debug_level is not None:
|
|
ldap.set_option(ldap.OPT_DEBUG_LEVEL, debug_level)
|
|
|
|
using_ldaps = url.lower().startswith("ldaps")
|
|
|
|
if use_tls and using_ldaps:
|
|
raise AssertionError(_('Invalid TLS / LDAPS combination'))
|
|
|
|
# The certificate trust options apply for both LDAPS and TLS.
|
|
if use_tls or using_ldaps:
|
|
if not ldap.TLS_AVAIL:
|
|
raise ValueError(_('Invalid LDAP TLS_AVAIL option: %s. TLS '
|
|
'not available') % ldap.TLS_AVAIL)
|
|
if tls_cacertfile:
|
|
# NOTE(topol)
|
|
# python ldap TLS does not verify CACERTFILE or CACERTDIR
|
|
# so we add some extra simple sanity check verification
|
|
# Also, setting these values globally (i.e. on the ldap object)
|
|
# works but these values are ignored when setting them on the
|
|
# connection
|
|
if not os.path.isfile(tls_cacertfile):
|
|
raise IOError(_("tls_cacertfile %s not found "
|
|
"or is not a file") %
|
|
tls_cacertfile)
|
|
ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, tls_cacertfile)
|
|
elif tls_cacertdir:
|
|
# NOTE(topol)
|
|
# python ldap TLS does not verify CACERTFILE or CACERTDIR
|
|
# so we add some extra simple sanity check verification
|
|
# Also, setting these values globally (i.e. on the ldap object)
|
|
# works but these values are ignored when setting them on the
|
|
# connection
|
|
if not os.path.isdir(tls_cacertdir):
|
|
raise IOError(_("tls_cacertdir %s not found "
|
|
"or is not a directory") %
|
|
tls_cacertdir)
|
|
ldap.set_option(ldap.OPT_X_TLS_CACERTDIR, tls_cacertdir)
|
|
if tls_req_cert in list(LDAP_TLS_CERTS.values()):
|
|
ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, tls_req_cert)
|
|
else:
|
|
LOG.debug("LDAP TLS: invalid TLS_REQUIRE_CERT Option=%s",
|
|
tls_req_cert)
|
|
|
|
|
|
class MsgId(list):
|
|
'''Wrapper class to hold connection and msgid.'''
|
|
pass
|
|
|
|
|
|
def use_conn_pool(func):
|
|
'''Use this only for connection pool specific ldap API.
|
|
|
|
This adds connection object to decorated API as next argument after self.
|
|
'''
|
|
def wrapper(self, *args, **kwargs):
|
|
# assert isinstance(self, PooledLDAPHandler)
|
|
with self._get_pool_connection() as conn:
|
|
self._apply_options(conn)
|
|
return func(self, conn, *args, **kwargs)
|
|
return wrapper
|
|
|
|
|
|
class PooledLDAPHandler(LDAPHandler):
|
|
'''Implementation of the LDAPHandler interface which uses pooled
|
|
connection manager.
|
|
|
|
Pool specific configuration is defined in [ldap] section.
|
|
All other LDAP configuration is still used from [ldap] section
|
|
|
|
Keystone LDAP authentication logic authenticates an end user using its DN
|
|
and password via LDAP bind to establish supplied password is correct.
|
|
This can fill up the pool quickly (as pool re-uses existing connection
|
|
based on its bind data) and would not leave space in pool for connection
|
|
re-use for other LDAP operations.
|
|
Now a separate pool can be established for those requests when related flag
|
|
'use_auth_pool' is enabled. That pool can have its own size and
|
|
connection lifetime. Other pool attributes are shared between those pools.
|
|
If 'use_pool' is disabled, then 'use_auth_pool' does not matter.
|
|
If 'use_auth_pool' is not enabled, then connection pooling is not used for
|
|
those LDAP operations.
|
|
|
|
Note, the python-ldap API requires all string values to be UTF-8
|
|
encoded. The KeystoneLDAPHandler enforces this prior to invoking
|
|
the methods in this class.
|
|
'''
|
|
|
|
# Added here to allow override for testing
|
|
Connector = ldappool.StateConnector
|
|
auth_pool_prefix = 'auth_pool_'
|
|
|
|
connection_pools = {} # static connector pool dict
|
|
|
|
def __init__(self, conn=None, use_auth_pool=False):
|
|
super(PooledLDAPHandler, self).__init__(conn=conn)
|
|
self.who = ''
|
|
self.cred = ''
|
|
self.conn_options = {} # connection specific options
|
|
self.page_size = None
|
|
self.use_auth_pool = use_auth_pool
|
|
self.conn_pool = None
|
|
|
|
def connect(self, url, page_size=0, alias_dereferencing=None,
|
|
use_tls=False, tls_cacertfile=None, tls_cacertdir=None,
|
|
tls_req_cert='demand', chase_referrals=None, debug_level=None,
|
|
use_pool=None, pool_size=None, pool_retry_max=None,
|
|
pool_retry_delay=None, pool_conn_timeout=None,
|
|
pool_conn_lifetime=None):
|
|
|
|
_common_ldap_initialization(url=url,
|
|
use_tls=use_tls,
|
|
tls_cacertfile=tls_cacertfile,
|
|
tls_cacertdir=tls_cacertdir,
|
|
tls_req_cert=tls_req_cert,
|
|
debug_level=debug_level)
|
|
|
|
self.page_size = page_size
|
|
|
|
# Following two options are not added in common initialization as they
|
|
# need to follow a sequence in PythonLDAPHandler code.
|
|
if alias_dereferencing is not None:
|
|
self.set_option(ldap.OPT_DEREF, alias_dereferencing)
|
|
if chase_referrals is not None:
|
|
self.set_option(ldap.OPT_REFERRALS, int(chase_referrals))
|
|
|
|
if self.use_auth_pool: # separate pool when use_auth_pool enabled
|
|
pool_url = self.auth_pool_prefix + url
|
|
else:
|
|
pool_url = url
|
|
try:
|
|
self.conn_pool = self.connection_pools[pool_url]
|
|
except KeyError:
|
|
self.conn_pool = ldappool.ConnectionManager(
|
|
url,
|
|
size=pool_size,
|
|
retry_max=pool_retry_max,
|
|
retry_delay=pool_retry_delay,
|
|
timeout=pool_conn_timeout,
|
|
connector_cls=self.Connector,
|
|
use_tls=use_tls,
|
|
max_lifetime=pool_conn_lifetime)
|
|
self.connection_pools[pool_url] = self.conn_pool
|
|
|
|
def set_option(self, option, invalue):
|
|
self.conn_options[option] = invalue
|
|
|
|
def get_option(self, option):
|
|
value = self.conn_options.get(option)
|
|
# if option was not specified explicitly, then use connection default
|
|
# value for that option if there.
|
|
if value is None:
|
|
with self._get_pool_connection() as conn:
|
|
value = conn.get_option(option)
|
|
return value
|
|
|
|
def _apply_options(self, conn):
|
|
# if connection has a lifetime, then it already has options specified
|
|
if conn.get_lifetime() > 30:
|
|
return
|
|
for option, invalue in six.iteritems(self.conn_options):
|
|
conn.set_option(option, invalue)
|
|
|
|
def _get_pool_connection(self):
|
|
return self.conn_pool.connection(self.who, self.cred)
|
|
|
|
def simple_bind_s(self, who='', cred='',
|
|
serverctrls=None, clientctrls=None):
|
|
'''Not using use_conn_pool decorator here as this API takes cred as
|
|
input.
|
|
'''
|
|
self.who = who
|
|
self.cred = cred
|
|
with self._get_pool_connection() as conn:
|
|
self._apply_options(conn)
|
|
|
|
def unbind_s(self):
|
|
# After connection generator is done `with` statement execution block
|
|
# connection is always released via finally block in ldappool.
|
|
# So this unbind is a no op.
|
|
pass
|
|
|
|
@use_conn_pool
|
|
def add_s(self, conn, dn, modlist):
|
|
return conn.add_s(dn, modlist)
|
|
|
|
@use_conn_pool
|
|
def search_s(self, conn, base, scope,
|
|
filterstr='(objectClass=*)', attrlist=None, attrsonly=0):
|
|
return conn.search_s(base, scope, filterstr, attrlist,
|
|
attrsonly)
|
|
|
|
def search_ext(self, base, scope,
|
|
filterstr='(objectClass=*)', attrlist=None, attrsonly=0,
|
|
serverctrls=None, clientctrls=None,
|
|
timeout=-1, sizelimit=0):
|
|
'''This API is asynchoronus API which returns MsgId instance to be used
|
|
in result3 call.
|
|
|
|
To work with result3 API in predicatable manner, same LDAP connection
|
|
is needed which provided msgid. So wrapping used connection and msgid
|
|
in MsgId class. The connection associated with search_ext is released
|
|
once last hard reference to MsgId object is freed. This will happen
|
|
when the method is done with returned MsgId usage.
|
|
'''
|
|
|
|
conn_ctxt = self._get_pool_connection()
|
|
conn = conn_ctxt.__enter__()
|
|
try:
|
|
msgid = conn.search_ext(base, scope,
|
|
filterstr, attrlist, attrsonly,
|
|
serverctrls, clientctrls,
|
|
timeout, sizelimit)
|
|
except Exception:
|
|
conn_ctxt.__exit__(*sys.exc_info())
|
|
raise
|
|
res = MsgId((conn, msgid))
|
|
weakref.ref(res, functools.partial(conn_ctxt.__exit__,
|
|
None, None, None))
|
|
return res
|
|
|
|
def result3(self, msgid, all=1, timeout=None,
|
|
resp_ctrl_classes=None):
|
|
'''This method is used to wait for and return the result of an
|
|
operation previously initiated by one of the LDAP asynchronous
|
|
operation routines (eg search_ext()) It returned an invocation
|
|
identifier (a message id) upon successful initiation of their
|
|
operation.
|
|
|
|
Input msgid is expected to be instance of class MsgId which has LDAP
|
|
session/connection used to execute search_ext and message idenfier.
|
|
|
|
The connection associated with search_ext is released once last hard
|
|
reference to MsgId object is freed. This will happen when function
|
|
which requested msgId and used it in result3 exits.
|
|
'''
|
|
|
|
conn, msg_id = msgid
|
|
return conn.result3(msg_id, all, timeout)
|
|
|
|
@use_conn_pool
|
|
def modify_s(self, conn, dn, modlist):
|
|
return conn.modify_s(dn, modlist)
|
|
|
|
@use_conn_pool
|
|
def delete_s(self, conn, dn):
|
|
return conn.delete_s(dn)
|
|
|
|
@use_conn_pool
|
|
def delete_ext_s(self, conn, dn, serverctrls=None, clientctrls=None):
|
|
return conn.delete_ext_s(dn, serverctrls, clientctrls)
|
|
|
|
|
|
class KeystoneLDAPHandler(LDAPHandler):
|
|
'''Convert data types and perform logging.
|
|
|
|
This LDAP inteface wraps the python-ldap based interfaces. The
|
|
python-ldap interfaces require string values encoded in UTF-8. The
|
|
OpenStack logging framework at the time of this writing is not
|
|
capable of accepting strings encoded in UTF-8, the log functions
|
|
will throw decoding errors if a non-ascii character appears in a
|
|
string.
|
|
|
|
Prior to the call Python data types are converted to a string
|
|
representation as required by the LDAP APIs.
|
|
|
|
Then logging is performed so we can track what is being
|
|
sent/received from LDAP. Also the logging filters security
|
|
sensitive items (i.e. passwords).
|
|
|
|
Then the string values are encoded into UTF-8.
|
|
|
|
Then the LDAP API entry point is invoked.
|
|
|
|
Data returned from the LDAP call is converted back from UTF-8
|
|
encoded strings into the Python data type used internally in
|
|
OpenStack.
|
|
'''
|
|
|
|
def __init__(self, conn=None):
|
|
super(KeystoneLDAPHandler, self).__init__(conn=conn)
|
|
self.page_size = 0
|
|
|
|
def __enter__(self):
|
|
return self
|
|
|
|
def _disable_paging(self):
|
|
# Disable the pagination from now on
|
|
self.page_size = 0
|
|
|
|
def connect(self, url, page_size=0, alias_dereferencing=None,
|
|
use_tls=False, tls_cacertfile=None, tls_cacertdir=None,
|
|
tls_req_cert='demand', chase_referrals=None, debug_level=None,
|
|
use_pool=None, pool_size=None,
|
|
pool_retry_max=None, pool_retry_delay=None,
|
|
pool_conn_timeout=None, pool_conn_lifetime=None):
|
|
self.page_size = page_size
|
|
return self.conn.connect(url, page_size, alias_dereferencing,
|
|
use_tls, tls_cacertfile, tls_cacertdir,
|
|
tls_req_cert, chase_referrals,
|
|
debug_level=debug_level,
|
|
use_pool=use_pool,
|
|
pool_size=pool_size,
|
|
pool_retry_max=pool_retry_max,
|
|
pool_retry_delay=pool_retry_delay,
|
|
pool_conn_timeout=pool_conn_timeout,
|
|
pool_conn_lifetime=pool_conn_lifetime)
|
|
|
|
def set_option(self, option, invalue):
|
|
return self.conn.set_option(option, invalue)
|
|
|
|
def get_option(self, option):
|
|
return self.conn.get_option(option)
|
|
|
|
def simple_bind_s(self, who='', cred='',
|
|
serverctrls=None, clientctrls=None):
|
|
LOG.debug("LDAP bind: who=%s", who)
|
|
who_utf8 = utf8_encode(who)
|
|
cred_utf8 = utf8_encode(cred)
|
|
return self.conn.simple_bind_s(who_utf8, cred_utf8,
|
|
serverctrls=serverctrls,
|
|
clientctrls=clientctrls)
|
|
|
|
def unbind_s(self):
|
|
LOG.debug("LDAP unbind")
|
|
return self.conn.unbind_s()
|
|
|
|
def add_s(self, dn, modlist):
|
|
ldap_attrs = [(kind, [py2ldap(x) for x in safe_iter(values)])
|
|
for kind, values in modlist]
|
|
logging_attrs = [(kind, values
|
|
if kind != 'userPassword'
|
|
else ['****'])
|
|
for kind, values in ldap_attrs]
|
|
LOG.debug('LDAP add: dn=%s attrs=%s',
|
|
dn, logging_attrs)
|
|
dn_utf8 = utf8_encode(dn)
|
|
ldap_attrs_utf8 = [(kind, [utf8_encode(x) for x in safe_iter(values)])
|
|
for kind, values in ldap_attrs]
|
|
return self.conn.add_s(dn_utf8, ldap_attrs_utf8)
|
|
|
|
def search_s(self, base, scope,
|
|
filterstr='(objectClass=*)', attrlist=None, attrsonly=0):
|
|
# NOTE(morganfainberg): Remove "None" singletons from this list, which
|
|
# allows us to set mapped attributes to "None" as defaults in config.
|
|
# Without this filtering, the ldap query would raise a TypeError since
|
|
# attrlist is expected to be an iterable of strings.
|
|
if attrlist is not None:
|
|
attrlist = [attr for attr in attrlist if attr is not None]
|
|
LOG.debug('LDAP search: base=%s scope=%s filterstr=%s '
|
|
'attrs=%s attrsonly=%s',
|
|
base, scope, filterstr, attrlist, attrsonly)
|
|
if self.page_size:
|
|
ldap_result = self._paged_search_s(base, scope,
|
|
filterstr, attrlist)
|
|
else:
|
|
base_utf8 = utf8_encode(base)
|
|
filterstr_utf8 = utf8_encode(filterstr)
|
|
if attrlist is None:
|
|
attrlist_utf8 = None
|
|
else:
|
|
attrlist_utf8 = list(map(utf8_encode, attrlist))
|
|
ldap_result = self.conn.search_s(base_utf8, scope,
|
|
filterstr_utf8,
|
|
attrlist_utf8, attrsonly)
|
|
|
|
py_result = convert_ldap_result(ldap_result)
|
|
|
|
return py_result
|
|
|
|
def search_ext(self, base, scope,
|
|
filterstr='(objectClass=*)', attrlist=None, attrsonly=0,
|
|
serverctrls=None, clientctrls=None,
|
|
timeout=-1, sizelimit=0):
|
|
if attrlist is not None:
|
|
attrlist = [attr for attr in attrlist if attr is not None]
|
|
LOG.debug('LDAP search_ext: base=%s scope=%s filterstr=%s '
|
|
'attrs=%s attrsonly=%s'
|
|
'serverctrls=%s clientctrls=%s timeout=%s sizelimit=%s',
|
|
base, scope, filterstr, attrlist, attrsonly,
|
|
serverctrls, clientctrls, timeout, sizelimit)
|
|
return self.conn.search_ext(base, scope,
|
|
filterstr, attrlist, attrsonly,
|
|
serverctrls, clientctrls,
|
|
timeout, sizelimit)
|
|
|
|
def _paged_search_s(self, base, scope, filterstr, attrlist=None):
|
|
res = []
|
|
use_old_paging_api = False
|
|
# The API for the simple paged results control changed between
|
|
# python-ldap 2.3 and 2.4. We need to detect the capabilities
|
|
# of the python-ldap version we are using.
|
|
if hasattr(ldap, 'LDAP_CONTROL_PAGE_OID'):
|
|
use_old_paging_api = True
|
|
lc = ldap.controls.SimplePagedResultsControl(
|
|
controlType=ldap.LDAP_CONTROL_PAGE_OID,
|
|
criticality=True,
|
|
controlValue=(self.page_size, ''))
|
|
page_ctrl_oid = ldap.LDAP_CONTROL_PAGE_OID
|
|
else:
|
|
lc = ldap.controls.libldap.SimplePagedResultsControl(
|
|
criticality=True,
|
|
size=self.page_size,
|
|
cookie='')
|
|
page_ctrl_oid = ldap.controls.SimplePagedResultsControl.controlType
|
|
|
|
base_utf8 = utf8_encode(base)
|
|
filterstr_utf8 = utf8_encode(filterstr)
|
|
if attrlist is None:
|
|
attrlist_utf8 = None
|
|
else:
|
|
attrlist = [attr for attr in attrlist if attr is not None]
|
|
attrlist_utf8 = list(map(utf8_encode, attrlist))
|
|
msgid = self.conn.search_ext(base_utf8,
|
|
scope,
|
|
filterstr_utf8,
|
|
attrlist_utf8,
|
|
serverctrls=[lc])
|
|
# Endless loop request pages on ldap server until it has no data
|
|
while True:
|
|
# Request to the ldap server a page with 'page_size' entries
|
|
rtype, rdata, rmsgid, serverctrls = self.conn.result3(msgid)
|
|
# Receive the data
|
|
res.extend(rdata)
|
|
pctrls = [c for c in serverctrls
|
|
if c.controlType == page_ctrl_oid]
|
|
if pctrls:
|
|
# LDAP server supports pagination
|
|
if use_old_paging_api:
|
|
est, cookie = pctrls[0].controlValue
|
|
lc.controlValue = (self.page_size, cookie)
|
|
else:
|
|
cookie = lc.cookie = pctrls[0].cookie
|
|
|
|
if cookie:
|
|
# There is more data still on the server
|
|
# so we request another page
|
|
msgid = self.conn.search_ext(base_utf8,
|
|
scope,
|
|
filterstr_utf8,
|
|
attrlist_utf8,
|
|
serverctrls=[lc])
|
|
else:
|
|
# Exit condition no more data on server
|
|
break
|
|
else:
|
|
LOG.warning(_LW('LDAP Server does not support paging. '
|
|
'Disable paging in keystone.conf to '
|
|
'avoid this message.'))
|
|
self._disable_paging()
|
|
break
|
|
return res
|
|
|
|
def result3(self, msgid=ldap.RES_ANY, all=1, timeout=None,
|
|
resp_ctrl_classes=None):
|
|
ldap_result = self.conn.result3(msgid, all, timeout, resp_ctrl_classes)
|
|
|
|
LOG.debug('LDAP result3: msgid=%s all=%s timeout=%s '
|
|
'resp_ctrl_classes=%s ldap_result=%s',
|
|
msgid, all, timeout, resp_ctrl_classes, ldap_result)
|
|
|
|
py_result = convert_ldap_result(ldap_result)
|
|
return py_result
|
|
|
|
def modify_s(self, dn, modlist):
|
|
ldap_modlist = [
|
|
(op, kind, (None if values is None
|
|
else [py2ldap(x) for x in safe_iter(values)]))
|
|
for op, kind, values in modlist]
|
|
|
|
logging_modlist = [(op, kind, (values if kind != 'userPassword'
|
|
else ['****']))
|
|
for op, kind, values in ldap_modlist]
|
|
LOG.debug('LDAP modify: dn=%s modlist=%s',
|
|
dn, logging_modlist)
|
|
|
|
dn_utf8 = utf8_encode(dn)
|
|
ldap_modlist_utf8 = [
|
|
(op, kind, (None if values is None
|
|
else [utf8_encode(x) for x in safe_iter(values)]))
|
|
for op, kind, values in ldap_modlist]
|
|
return self.conn.modify_s(dn_utf8, ldap_modlist_utf8)
|
|
|
|
def delete_s(self, dn):
|
|
LOG.debug("LDAP delete: dn=%s", dn)
|
|
dn_utf8 = utf8_encode(dn)
|
|
return self.conn.delete_s(dn_utf8)
|
|
|
|
def delete_ext_s(self, dn, serverctrls=None, clientctrls=None):
|
|
LOG.debug('LDAP delete_ext: dn=%s serverctrls=%s clientctrls=%s',
|
|
dn, serverctrls, clientctrls)
|
|
dn_utf8 = utf8_encode(dn)
|
|
return self.conn.delete_ext_s(dn_utf8, serverctrls, clientctrls)
|
|
|
|
def __exit__(self, exc_type, exc_val, exc_tb):
|
|
self.unbind_s()
|
|
|
|
|
|
_HANDLERS = {}
|
|
|
|
|
|
def register_handler(prefix, handler):
|
|
_HANDLERS[prefix] = handler
|
|
|
|
|
|
def _get_connection(conn_url, use_pool=False, use_auth_pool=False):
|
|
for prefix, handler in six.iteritems(_HANDLERS):
|
|
if conn_url.startswith(prefix):
|
|
return handler()
|
|
|
|
if use_pool:
|
|
return PooledLDAPHandler(use_auth_pool=use_auth_pool)
|
|
else:
|
|
return PythonLDAPHandler()
|
|
|
|
|
|
def filter_entity(entity_ref):
|
|
"""Filter out private items in an entity dict.
|
|
|
|
:param entity_ref: the entity dictionary. The 'dn' field will be removed.
|
|
'dn' is used in LDAP, but should not be returned to the user. This
|
|
value may be modified.
|
|
|
|
:returns: entity_ref
|
|
|
|
"""
|
|
if entity_ref:
|
|
entity_ref.pop('dn', None)
|
|
return entity_ref
|
|
|
|
|
|
class BaseLdap(object):
|
|
DEFAULT_SUFFIX = "dc=example,dc=com"
|
|
DEFAULT_OU = None
|
|
DEFAULT_STRUCTURAL_CLASSES = None
|
|
DEFAULT_ID_ATTR = 'cn'
|
|
DEFAULT_OBJECTCLASS = None
|
|
DEFAULT_FILTER = None
|
|
DEFAULT_EXTRA_ATTR_MAPPING = []
|
|
DUMB_MEMBER_DN = 'cn=dumb,dc=nonexistent'
|
|
NotFound = None
|
|
notfound_arg = None
|
|
options_name = None
|
|
model = None
|
|
attribute_options_names = {}
|
|
immutable_attrs = []
|
|
attribute_ignore = []
|
|
tree_dn = None
|
|
|
|
def __init__(self, conf):
|
|
self.LDAP_URL = conf.ldap.url
|
|
self.LDAP_USER = conf.ldap.user
|
|
self.LDAP_PASSWORD = conf.ldap.password
|
|
self.LDAP_SCOPE = ldap_scope(conf.ldap.query_scope)
|
|
self.alias_dereferencing = parse_deref(conf.ldap.alias_dereferencing)
|
|
self.page_size = conf.ldap.page_size
|
|
self.use_tls = conf.ldap.use_tls
|
|
self.tls_cacertfile = conf.ldap.tls_cacertfile
|
|
self.tls_cacertdir = conf.ldap.tls_cacertdir
|
|
self.tls_req_cert = parse_tls_cert(conf.ldap.tls_req_cert)
|
|
self.attribute_mapping = {}
|
|
self.chase_referrals = conf.ldap.chase_referrals
|
|
self.debug_level = conf.ldap.debug_level
|
|
|
|
# LDAP Pool specific attribute
|
|
self.use_pool = conf.ldap.use_pool
|
|
self.pool_size = conf.ldap.pool_size
|
|
self.pool_retry_max = conf.ldap.pool_retry_max
|
|
self.pool_retry_delay = conf.ldap.pool_retry_delay
|
|
self.pool_conn_timeout = conf.ldap.pool_connection_timeout
|
|
self.pool_conn_lifetime = conf.ldap.pool_connection_lifetime
|
|
|
|
# End user authentication pool specific config attributes
|
|
self.use_auth_pool = self.use_pool and conf.ldap.use_auth_pool
|
|
self.auth_pool_size = conf.ldap.auth_pool_size
|
|
self.auth_pool_conn_lifetime = conf.ldap.auth_pool_connection_lifetime
|
|
|
|
if self.options_name is not None:
|
|
self.suffix = conf.ldap.suffix
|
|
if self.suffix is None:
|
|
self.suffix = self.DEFAULT_SUFFIX
|
|
dn = '%s_tree_dn' % self.options_name
|
|
self.tree_dn = (getattr(conf.ldap, dn)
|
|
or '%s,%s' % (self.DEFAULT_OU, self.suffix))
|
|
|
|
idatt = '%s_id_attribute' % self.options_name
|
|
self.id_attr = getattr(conf.ldap, idatt) or self.DEFAULT_ID_ATTR
|
|
|
|
objclass = '%s_objectclass' % self.options_name
|
|
self.object_class = (getattr(conf.ldap, objclass)
|
|
or self.DEFAULT_OBJECTCLASS)
|
|
|
|
for k, v in six.iteritems(self.attribute_options_names):
|
|
v = '%s_%s_attribute' % (self.options_name, v)
|
|
self.attribute_mapping[k] = getattr(conf.ldap, v)
|
|
|
|
attr_mapping_opt = ('%s_additional_attribute_mapping' %
|
|
self.options_name)
|
|
attr_mapping = (getattr(conf.ldap, attr_mapping_opt)
|
|
or self.DEFAULT_EXTRA_ATTR_MAPPING)
|
|
self.extra_attr_mapping = self._parse_extra_attrs(attr_mapping)
|
|
|
|
ldap_filter = '%s_filter' % self.options_name
|
|
self.ldap_filter = getattr(conf.ldap,
|
|
ldap_filter) or self.DEFAULT_FILTER
|
|
|
|
allow_create = '%s_allow_create' % self.options_name
|
|
self.allow_create = getattr(conf.ldap, allow_create)
|
|
|
|
allow_update = '%s_allow_update' % self.options_name
|
|
self.allow_update = getattr(conf.ldap, allow_update)
|
|
|
|
allow_delete = '%s_allow_delete' % self.options_name
|
|
self.allow_delete = getattr(conf.ldap, allow_delete)
|
|
|
|
member_attribute = '%s_member_attribute' % self.options_name
|
|
self.member_attribute = getattr(conf.ldap, member_attribute, None)
|
|
|
|
self.structural_classes = self.DEFAULT_STRUCTURAL_CLASSES
|
|
|
|
if self.notfound_arg is None:
|
|
self.notfound_arg = self.options_name + '_id'
|
|
|
|
attribute_ignore = '%s_attribute_ignore' % self.options_name
|
|
self.attribute_ignore = getattr(conf.ldap, attribute_ignore)
|
|
|
|
self.use_dumb_member = conf.ldap.use_dumb_member
|
|
self.dumb_member = (conf.ldap.dumb_member or
|
|
self.DUMB_MEMBER_DN)
|
|
|
|
self.subtree_delete_enabled = conf.ldap.allow_subtree_delete
|
|
|
|
def _not_found(self, object_id):
|
|
if self.NotFound is None:
|
|
return exception.NotFound(target=object_id)
|
|
else:
|
|
return self.NotFound(**{self.notfound_arg: object_id})
|
|
|
|
def _parse_extra_attrs(self, option_list):
|
|
mapping = {}
|
|
for item in option_list:
|
|
try:
|
|
ldap_attr, attr_map = item.split(':')
|
|
except Exception:
|
|
LOG.warn(_LW(
|
|
'Invalid additional attribute mapping: "%s". '
|
|
'Format must be <ldap_attribute>:<keystone_attribute>'),
|
|
item)
|
|
continue
|
|
mapping[ldap_attr] = attr_map
|
|
return mapping
|
|
|
|
def _is_dumb_member(self, member_dn):
|
|
"""Checks that member is a dumb member.
|
|
|
|
:param member_dn: DN of member to be checked.
|
|
"""
|
|
return (self.use_dumb_member
|
|
and is_dn_equal(member_dn, self.dumb_member))
|
|
|
|
def get_connection(self, user=None, password=None, end_user_auth=False):
|
|
use_pool = self.use_pool
|
|
pool_size = self.pool_size
|
|
pool_conn_lifetime = self.pool_conn_lifetime
|
|
|
|
if end_user_auth:
|
|
if not self.use_auth_pool:
|
|
use_pool = False
|
|
else:
|
|
pool_size = self.auth_pool_size
|
|
pool_conn_lifetime = self.auth_pool_conn_lifetime
|
|
|
|
conn = _get_connection(self.LDAP_URL, use_pool,
|
|
use_auth_pool=end_user_auth)
|
|
|
|
conn = KeystoneLDAPHandler(conn=conn)
|
|
|
|
conn.connect(self.LDAP_URL,
|
|
page_size=self.page_size,
|
|
alias_dereferencing=self.alias_dereferencing,
|
|
use_tls=self.use_tls,
|
|
tls_cacertfile=self.tls_cacertfile,
|
|
tls_cacertdir=self.tls_cacertdir,
|
|
tls_req_cert=self.tls_req_cert,
|
|
chase_referrals=self.chase_referrals,
|
|
debug_level=self.debug_level,
|
|
use_pool=use_pool,
|
|
pool_size=pool_size,
|
|
pool_retry_max=self.pool_retry_max,
|
|
pool_retry_delay=self.pool_retry_delay,
|
|
pool_conn_timeout=self.pool_conn_timeout,
|
|
pool_conn_lifetime=pool_conn_lifetime
|
|
)
|
|
|
|
if user is None:
|
|
user = self.LDAP_USER
|
|
|
|
if password is None:
|
|
password = self.LDAP_PASSWORD
|
|
|
|
# not all LDAP servers require authentication, so we don't bind
|
|
# if we don't have any user/pass
|
|
if user and password:
|
|
conn.simple_bind_s(user, password)
|
|
|
|
return conn
|
|
|
|
def _id_to_dn_string(self, object_id):
|
|
return u'%s=%s,%s' % (self.id_attr,
|
|
ldap.dn.escape_dn_chars(
|
|
six.text_type(object_id)),
|
|
self.tree_dn)
|
|
|
|
def _id_to_dn(self, object_id):
|
|
if self.LDAP_SCOPE == ldap.SCOPE_ONELEVEL:
|
|
return self._id_to_dn_string(object_id)
|
|
with self.get_connection() as conn:
|
|
search_result = conn.search_s(
|
|
self.tree_dn, self.LDAP_SCOPE,
|
|
u'(&(%(id_attr)s=%(id)s)(objectclass=%(objclass)s))' %
|
|
{'id_attr': self.id_attr,
|
|
'id': ldap.filter.escape_filter_chars(
|
|
six.text_type(object_id)),
|
|
'objclass': self.object_class},
|
|
attrlist=DN_ONLY)
|
|
if search_result:
|
|
dn, attrs = search_result[0]
|
|
return dn
|
|
else:
|
|
return self._id_to_dn_string(object_id)
|
|
|
|
@staticmethod
|
|
def _dn_to_id(dn):
|
|
return utf8_decode(ldap.dn.str2dn(utf8_encode(dn))[0][0][1])
|
|
|
|
def _ldap_res_to_model(self, res):
|
|
# LDAP attribute names may be returned in a different case than
|
|
# they are defined in the mapping, so we need to check for keys
|
|
# in a case-insensitive way. We use the case specified in the
|
|
# mapping for the model to ensure we have a predictable way of
|
|
# retrieving values later.
|
|
lower_res = {k.lower(): v for k, v in six.iteritems(res[1])}
|
|
|
|
id_attrs = lower_res.get(self.id_attr.lower())
|
|
if not id_attrs:
|
|
message = _('ID attribute %(id_attr)s not found in LDAP '
|
|
'object %(dn)s') % ({'id_attr': self.id_attr,
|
|
'dn': res[0]})
|
|
raise exception.NotFound(message=message)
|
|
if len(id_attrs) > 1:
|
|
# FIXME(gyee): if this is a multi-value attribute and it has
|
|
# multiple values, we can't use it as ID. Retain the dn_to_id
|
|
# logic here so it does not potentially break existing
|
|
# deployments. We need to fix our read-write LDAP logic so
|
|
# it does not get the ID from DN.
|
|
message = _LW('ID attribute %(id_attr)s for LDAP object %(dn)s '
|
|
'has multiple values and therefore cannot be used '
|
|
'as an ID. Will get the ID from DN instead') % (
|
|
{'id_attr': self.id_attr,
|
|
'dn': res[0]})
|
|
LOG.warn(message)
|
|
id_val = self._dn_to_id(res[0])
|
|
else:
|
|
id_val = id_attrs[0]
|
|
obj = self.model(id=id_val)
|
|
|
|
for k in obj.known_keys:
|
|
if k in self.attribute_ignore:
|
|
continue
|
|
|
|
try:
|
|
map_attr = self.attribute_mapping.get(k, k)
|
|
if map_attr is None:
|
|
# Ignore attributes that are mapped to None.
|
|
continue
|
|
|
|
v = lower_res[map_attr.lower()]
|
|
except KeyError:
|
|
pass
|
|
else:
|
|
try:
|
|
obj[k] = v[0]
|
|
except IndexError:
|
|
obj[k] = None
|
|
|
|
return obj
|
|
|
|
def check_allow_create(self):
|
|
if not self.allow_create:
|
|
action = _('LDAP %s create') % self.options_name
|
|
raise exception.ForbiddenAction(action=action)
|
|
|
|
def check_allow_update(self):
|
|
if not self.allow_update:
|
|
action = _('LDAP %s update') % self.options_name
|
|
raise exception.ForbiddenAction(action=action)
|
|
|
|
def check_allow_delete(self):
|
|
if not self.allow_delete:
|
|
action = _('LDAP %s delete') % self.options_name
|
|
raise exception.ForbiddenAction(action=action)
|
|
|
|
def affirm_unique(self, values):
|
|
if values.get('name') is not None:
|
|
try:
|
|
self.get_by_name(values['name'])
|
|
except exception.NotFound:
|
|
pass
|
|
else:
|
|
raise exception.Conflict(type=self.options_name,
|
|
details=_('Duplicate name, %s.') %
|
|
values['name'])
|
|
|
|
if values.get('id') is not None:
|
|
try:
|
|
self.get(values['id'])
|
|
except exception.NotFound:
|
|
pass
|
|
else:
|
|
raise exception.Conflict(type=self.options_name,
|
|
details=_('Duplicate ID, %s.') %
|
|
values['id'])
|
|
|
|
def create(self, values):
|
|
self.affirm_unique(values)
|
|
object_classes = self.structural_classes + [self.object_class]
|
|
attrs = [('objectClass', object_classes)]
|
|
for k, v in six.iteritems(values):
|
|
if k in self.attribute_ignore:
|
|
continue
|
|
if k == 'id':
|
|
# no need to check if v is None as 'id' will always have
|
|
# a value
|
|
attrs.append((self.id_attr, [v]))
|
|
elif v is not None:
|
|
attr_type = self.attribute_mapping.get(k, k)
|
|
if attr_type is not None:
|
|
attrs.append((attr_type, [v]))
|
|
extra_attrs = [attr for attr, name
|
|
in six.iteritems(self.extra_attr_mapping)
|
|
if name == k]
|
|
for attr in extra_attrs:
|
|
attrs.append((attr, [v]))
|
|
|
|
if 'groupOfNames' in object_classes and self.use_dumb_member:
|
|
attrs.append(('member', [self.dumb_member]))
|
|
with self.get_connection() as conn:
|
|
conn.add_s(self._id_to_dn(values['id']), attrs)
|
|
return values
|
|
|
|
def _ldap_get(self, object_id, ldap_filter=None):
|
|
query = (u'(&(%(id_attr)s=%(id)s)'
|
|
u'%(filter)s'
|
|
u'(objectClass=%(object_class)s))'
|
|
% {'id_attr': self.id_attr,
|
|
'id': ldap.filter.escape_filter_chars(
|
|
six.text_type(object_id)),
|
|
'filter': (ldap_filter or self.ldap_filter or ''),
|
|
'object_class': self.object_class})
|
|
with self.get_connection() as conn:
|
|
try:
|
|
attrs = list(set(([self.id_attr] +
|
|
list(self.attribute_mapping.values()) +
|
|
list(self.extra_attr_mapping.keys()))))
|
|
res = conn.search_s(self.tree_dn,
|
|
self.LDAP_SCOPE,
|
|
query,
|
|
attrs)
|
|
except ldap.NO_SUCH_OBJECT:
|
|
return None
|
|
try:
|
|
return res[0]
|
|
except IndexError:
|
|
return None
|
|
|
|
def _ldap_get_all(self, ldap_filter=None):
|
|
query = u'(&%s(objectClass=%s))' % (ldap_filter or
|
|
self.ldap_filter or
|
|
'', self.object_class)
|
|
with self.get_connection() as conn:
|
|
try:
|
|
attrs = list(set(([self.id_attr] +
|
|
list(self.attribute_mapping.values()) +
|
|
list(self.extra_attr_mapping.keys()))))
|
|
return conn.search_s(self.tree_dn,
|
|
self.LDAP_SCOPE,
|
|
query,
|
|
attrs)
|
|
except ldap.NO_SUCH_OBJECT:
|
|
return []
|
|
|
|
def _ldap_get_list(self, search_base, scope, query_params=None,
|
|
attrlist=None):
|
|
query = u'(objectClass=%s)' % self.object_class
|
|
if query_params:
|
|
|
|
def calc_filter(attrname, value):
|
|
val_esc = ldap.filter.escape_filter_chars(value)
|
|
return '(%s=%s)' % (attrname, val_esc)
|
|
|
|
query = (u'(&%s%s)' %
|
|
(query, ''.join([calc_filter(k, v) for k, v in
|
|
six.iteritems(query_params)])))
|
|
with self.get_connection() as conn:
|
|
return conn.search_s(search_base, scope, query, attrlist)
|
|
|
|
def get(self, object_id, ldap_filter=None):
|
|
res = self._ldap_get(object_id, ldap_filter)
|
|
if res is None:
|
|
raise self._not_found(object_id)
|
|
else:
|
|
return self._ldap_res_to_model(res)
|
|
|
|
def get_by_name(self, name, ldap_filter=None):
|
|
query = (u'(%s=%s)' % (self.attribute_mapping['name'],
|
|
ldap.filter.escape_filter_chars(
|
|
six.text_type(name))))
|
|
res = self.get_all(query)
|
|
try:
|
|
return res[0]
|
|
except IndexError:
|
|
raise self._not_found(name)
|
|
|
|
def get_all(self, ldap_filter=None):
|
|
return [self._ldap_res_to_model(x)
|
|
for x in self._ldap_get_all(ldap_filter)]
|
|
|
|
def update(self, object_id, values, old_obj=None):
|
|
if old_obj is None:
|
|
old_obj = self.get(object_id)
|
|
|
|
modlist = []
|
|
for k, v in six.iteritems(values):
|
|
if k == 'id':
|
|
# id can't be modified.
|
|
continue
|
|
|
|
if k in self.attribute_ignore:
|
|
|
|
# Handle 'enabled' specially since can't disable if ignored.
|
|
if k == 'enabled' and (not v):
|
|
action = _("Disabling an entity where the 'enable' "
|
|
"attribute is ignored by configuration.")
|
|
raise exception.ForbiddenAction(action=action)
|
|
|
|
continue
|
|
|
|
# attribute value has not changed
|
|
if k in old_obj and old_obj[k] == v:
|
|
continue
|
|
|
|
if k in self.immutable_attrs:
|
|
msg = (_("Cannot change %(option_name)s %(attr)s") %
|
|
{'option_name': self.options_name, 'attr': k})
|
|
raise exception.ValidationError(msg)
|
|
|
|
if v is None:
|
|
if old_obj.get(k) is not None:
|
|
modlist.append((ldap.MOD_DELETE,
|
|
self.attribute_mapping.get(k, k),
|
|
None))
|
|
continue
|
|
|
|
current_value = old_obj.get(k)
|
|
if current_value is None:
|
|
op = ldap.MOD_ADD
|
|
modlist.append((op, self.attribute_mapping.get(k, k), [v]))
|
|
elif current_value != v:
|
|
op = ldap.MOD_REPLACE
|
|
modlist.append((op, self.attribute_mapping.get(k, k), [v]))
|
|
|
|
if modlist:
|
|
with self.get_connection() as conn:
|
|
try:
|
|
conn.modify_s(self._id_to_dn(object_id), modlist)
|
|
except ldap.NO_SUCH_OBJECT:
|
|
raise self._not_found(object_id)
|
|
|
|
return self.get(object_id)
|
|
|
|
def delete(self, object_id):
|
|
with self.get_connection() as conn:
|
|
try:
|
|
conn.delete_s(self._id_to_dn(object_id))
|
|
except ldap.NO_SUCH_OBJECT:
|
|
raise self._not_found(object_id)
|
|
|
|
def deleteTree(self, object_id):
|
|
tree_delete_control = ldap.controls.LDAPControl(CONTROL_TREEDELETE,
|
|
0,
|
|
None)
|
|
with self.get_connection() as conn:
|
|
try:
|
|
conn.delete_ext_s(self._id_to_dn(object_id),
|
|
serverctrls=[tree_delete_control])
|
|
except ldap.NO_SUCH_OBJECT:
|
|
raise self._not_found(object_id)
|
|
except ldap.NOT_ALLOWED_ON_NONLEAF:
|
|
# Most LDAP servers do not support the tree_delete_control.
|
|
# In these servers, the usual idiom is to first perform a
|
|
# search to get the entries to delete, then delete them in
|
|
# in order of child to parent, since LDAP forbids the
|
|
# deletion of a parent entry before deleting the children
|
|
# of that parent. The simplest way to do that is to delete
|
|
# the entries in order of the length of the DN, from longest
|
|
# to shortest DN.
|
|
dn = self._id_to_dn(object_id)
|
|
scope = ldap.SCOPE_SUBTREE
|
|
# With some directory servers, an entry with objectclass
|
|
# ldapsubentry will not be returned unless it is explicitly
|
|
# requested, by specifying the objectclass in the search
|
|
# filter. We must specify this, with objectclass=*, in an
|
|
# LDAP filter OR clause, in order to return all entries
|
|
filt = '(|(objectclass=*)(objectclass=ldapsubentry))'
|
|
# We only need the DNs of the entries. Since no attributes
|
|
# will be returned, we do not have to specify attrsonly=1.
|
|
entries = conn.search_s(dn, scope, filt, attrlist=DN_ONLY)
|
|
if entries:
|
|
for dn in sorted((e[0] for e in entries),
|
|
key=len, reverse=True):
|
|
conn.delete_s(dn)
|
|
else:
|
|
LOG.debug('No entries in LDAP subtree %s', dn)
|
|
|
|
def add_member(self, member_dn, member_list_dn):
|
|
"""Add member to the member list.
|
|
|
|
:param member_dn: DN of member to be added.
|
|
:param member_list_dn: DN of group to which the
|
|
member will be added.
|
|
|
|
:raises: exception.Conflict: If the user was already a member.
|
|
self.NotFound: If the group entry didn't exist.
|
|
"""
|
|
with self.get_connection() as conn:
|
|
try:
|
|
mod = (ldap.MOD_ADD, self.member_attribute, member_dn)
|
|
conn.modify_s(member_list_dn, [mod])
|
|
except ldap.TYPE_OR_VALUE_EXISTS:
|
|
raise exception.Conflict(_('Member %(member)s '
|
|
'is already a member'
|
|
' of group %(group)s') % {
|
|
'member': member_dn,
|
|
'group': member_list_dn})
|
|
except ldap.NO_SUCH_OBJECT:
|
|
raise self._not_found(member_list_dn)
|
|
|
|
def remove_member(self, member_dn, member_list_dn):
|
|
"""Remove member from the member list.
|
|
|
|
:param member_dn: DN of member to be removed.
|
|
:param member_list_dn: DN of group from which the
|
|
member will be removed.
|
|
|
|
:raises: self.NotFound: If the group entry didn't exist.
|
|
ldap.NO_SUCH_ATTRIBUTE: If the user wasn't a member.
|
|
"""
|
|
with self.get_connection() as conn:
|
|
try:
|
|
mod = (ldap.MOD_DELETE, self.member_attribute, member_dn)
|
|
conn.modify_s(member_list_dn, [mod])
|
|
except ldap.NO_SUCH_OBJECT:
|
|
raise self._not_found(member_list_dn)
|
|
|
|
def _delete_tree_nodes(self, search_base, scope, query_params=None):
|
|
query = u'(objectClass=%s)' % self.object_class
|
|
if query_params:
|
|
query = (u'(&%s%s)' %
|
|
(query, ''.join(['(%s=%s)'
|
|
% (k, ldap.filter.escape_filter_chars(v))
|
|
for k, v in
|
|
six.iteritems(query_params)])))
|
|
not_deleted_nodes = []
|
|
with self.get_connection() as conn:
|
|
try:
|
|
nodes = conn.search_s(search_base, scope, query,
|
|
attrlist=DN_ONLY)
|
|
except ldap.NO_SUCH_OBJECT:
|
|
LOG.debug('Could not find entry with dn=%s', search_base)
|
|
raise self._not_found(self._dn_to_id(search_base))
|
|
else:
|
|
for node_dn, _t in nodes:
|
|
try:
|
|
conn.delete_s(node_dn)
|
|
except ldap.NO_SUCH_OBJECT:
|
|
not_deleted_nodes.append(node_dn)
|
|
|
|
if not_deleted_nodes:
|
|
LOG.warn(_LW("When deleting entries for %(search_base)s, could not"
|
|
" delete nonexistent entries %(entries)s%(dots)s"),
|
|
{'search_base': search_base,
|
|
'entries': not_deleted_nodes[:3],
|
|
'dots': '...' if len(not_deleted_nodes) > 3 else ''})
|
|
|
|
def filter_query(self, hints, query=None):
|
|
"""Applies filtering to a query.
|
|
|
|
:param hints: contains the list of filters, which may be None,
|
|
indicating that there are no filters to be applied.
|
|
If it's not None, then any filters satisfied here will be
|
|
removed so that the caller will know if any filters
|
|
remain to be applied.
|
|
:param query: LDAP query into which to include filters
|
|
|
|
:returns query: LDAP query, updated with any filters satisfied
|
|
|
|
"""
|
|
def build_filter(filter_, hints):
|
|
"""Build a filter for the query.
|
|
|
|
:param filter_: the dict that describes this filter
|
|
:param hints: contains the list of filters yet to be satisfied.
|
|
|
|
:returns query: LDAP query term to be added
|
|
|
|
"""
|
|
ldap_attr = self.attribute_mapping[filter_['name']]
|
|
val_esc = ldap.filter.escape_filter_chars(filter_['value'])
|
|
|
|
if filter_['case_sensitive']:
|
|
# NOTE(henry-nash): Although dependent on the schema being
|
|
# used, most LDAP attributes are configured with case
|
|
# insensitive matching rules, so we'll leave this to the
|
|
# controller to filter.
|
|
return
|
|
|
|
if filter_['name'] == 'enabled':
|
|
# NOTE(henry-nash): Due to the different options for storing
|
|
# the enabled attribute (e,g, emulated or not), for now we
|
|
# don't try and filter this at the driver level - we simply
|
|
# leave the filter to be handled by the controller. It seems
|
|
# unlikley that this will cause a signifcant performance
|
|
# issue.
|
|
return
|
|
|
|
# TODO(henry-nash): Currently there are no booleans (other than
|
|
# 'enabled' that is handled above) on which you can filter. If
|
|
# there were, we would need to add special handling here to
|
|
# convert the booleans values to 'TRUE' and 'FALSE'. To do that
|
|
# we would also need to know which filter keys were actually
|
|
# booleans (this is related to bug #1411478).
|
|
|
|
if filter_['comparator'] == 'equals':
|
|
query_term = (u'(%(attr)s=%(val)s)'
|
|
% {'attr': ldap_attr, 'val': val_esc})
|
|
elif filter_['comparator'] == 'contains':
|
|
query_term = (u'(%(attr)s=*%(val)s*)'
|
|
% {'attr': ldap_attr, 'val': val_esc})
|
|
elif filter_['comparator'] == 'startswith':
|
|
query_term = (u'(%(attr)s=%(val)s*)'
|
|
% {'attr': ldap_attr, 'val': val_esc})
|
|
elif filter_['comparator'] == 'endswith':
|
|
query_term = (u'(%(attr)s=*%(val)s)'
|
|
% {'attr': ldap_attr, 'val': val_esc})
|
|
else:
|
|
# It's a filter we don't understand, so let the caller
|
|
# work out if they need to do something with it.
|
|
return
|
|
|
|
return query_term
|
|
|
|
if hints is None:
|
|
return query
|
|
|
|
filter_list = []
|
|
satisfied_filters = []
|
|
|
|
for filter_ in hints.filters:
|
|
if filter_['name'] not in self.attribute_mapping:
|
|
continue
|
|
new_filter = build_filter(filter_, hints)
|
|
if new_filter is not None:
|
|
filter_list.append(new_filter)
|
|
satisfied_filters.append(filter_)
|
|
|
|
if filter_list:
|
|
query = u'(&%s%s)' % (query, ''.join(filter_list))
|
|
|
|
# Remove satisfied filters, then the caller will know remaining filters
|
|
for filter_ in satisfied_filters:
|
|
hints.filters.remove(filter_)
|
|
|
|
return query
|
|
|
|
|
|
class EnabledEmuMixIn(BaseLdap):
|
|
"""Emulates boolean 'enabled' attribute if turned on.
|
|
|
|
Creates groupOfNames holding all enabled objects of this class, all missing
|
|
objects are considered disabled.
|
|
|
|
Options:
|
|
|
|
* $name_enabled_emulation - boolean, on/off
|
|
* $name_enabled_emulation_dn - DN of that groupOfNames, default is
|
|
cn=enabled_${name}s,${tree_dn}
|
|
|
|
Where ${name}s is the plural of self.options_name ('users' or 'tenants'),
|
|
${tree_dn} is self.tree_dn.
|
|
"""
|
|
|
|
def __init__(self, conf):
|
|
super(EnabledEmuMixIn, self).__init__(conf)
|
|
enabled_emulation = '%s_enabled_emulation' % self.options_name
|
|
self.enabled_emulation = getattr(conf.ldap, enabled_emulation)
|
|
|
|
enabled_emulation_dn = '%s_enabled_emulation_dn' % self.options_name
|
|
self.enabled_emulation_dn = getattr(conf.ldap, enabled_emulation_dn)
|
|
if not self.enabled_emulation_dn:
|
|
naming_attr_name = 'cn'
|
|
naming_attr_value = 'enabled_%ss' % self.options_name
|
|
sub_vals = (naming_attr_name, naming_attr_value, self.tree_dn)
|
|
self.enabled_emulation_dn = '%s=%s,%s' % sub_vals
|
|
naming_attr = (naming_attr_name, [naming_attr_value])
|
|
else:
|
|
# Extract the attribute name and value from the configured DN.
|
|
naming_dn = ldap.dn.str2dn(utf8_encode(self.enabled_emulation_dn))
|
|
naming_rdn = naming_dn[0][0]
|
|
naming_attr = (utf8_decode(naming_rdn[0]),
|
|
utf8_decode(naming_rdn[1]))
|
|
self.enabled_emulation_naming_attr = naming_attr
|
|
|
|
def _get_enabled(self, object_id):
|
|
dn = self._id_to_dn(object_id)
|
|
query = '(member=%s)' % dn
|
|
with self.get_connection() as conn:
|
|
try:
|
|
enabled_value = conn.search_s(self.enabled_emulation_dn,
|
|
ldap.SCOPE_BASE,
|
|
query, ['cn'])
|
|
except ldap.NO_SUCH_OBJECT:
|
|
return False
|
|
else:
|
|
return bool(enabled_value)
|
|
|
|
def _add_enabled(self, object_id):
|
|
if not self._get_enabled(object_id):
|
|
modlist = [(ldap.MOD_ADD,
|
|
'member',
|
|
[self._id_to_dn(object_id)])]
|
|
with self.get_connection() as conn:
|
|
try:
|
|
conn.modify_s(self.enabled_emulation_dn, modlist)
|
|
except ldap.NO_SUCH_OBJECT:
|
|
attr_list = [('objectClass', ['groupOfNames']),
|
|
('member', [self._id_to_dn(object_id)]),
|
|
self.enabled_emulation_naming_attr]
|
|
if self.use_dumb_member:
|
|
attr_list[1][1].append(self.dumb_member)
|
|
conn.add_s(self.enabled_emulation_dn, attr_list)
|
|
|
|
def _remove_enabled(self, object_id):
|
|
modlist = [(ldap.MOD_DELETE,
|
|
'member',
|
|
[self._id_to_dn(object_id)])]
|
|
with self.get_connection() as conn:
|
|
try:
|
|
conn.modify_s(self.enabled_emulation_dn, modlist)
|
|
except (ldap.NO_SUCH_OBJECT, ldap.NO_SUCH_ATTRIBUTE):
|
|
pass
|
|
|
|
def create(self, values):
|
|
if self.enabled_emulation:
|
|
enabled_value = values.pop('enabled', True)
|
|
ref = super(EnabledEmuMixIn, self).create(values)
|
|
if 'enabled' not in self.attribute_ignore:
|
|
if enabled_value:
|
|
self._add_enabled(ref['id'])
|
|
ref['enabled'] = enabled_value
|
|
return ref
|
|
else:
|
|
return super(EnabledEmuMixIn, self).create(values)
|
|
|
|
def get(self, object_id, ldap_filter=None):
|
|
ref = super(EnabledEmuMixIn, self).get(object_id, ldap_filter)
|
|
if 'enabled' not in self.attribute_ignore and self.enabled_emulation:
|
|
ref['enabled'] = self._get_enabled(object_id)
|
|
return ref
|
|
|
|
def get_all(self, ldap_filter=None):
|
|
if 'enabled' not in self.attribute_ignore and self.enabled_emulation:
|
|
# had to copy BaseLdap.get_all here to ldap_filter by DN
|
|
tenant_list = [self._ldap_res_to_model(x)
|
|
for x in self._ldap_get_all(ldap_filter)
|
|
if x[0] != self.enabled_emulation_dn]
|
|
for tenant_ref in tenant_list:
|
|
tenant_ref['enabled'] = self._get_enabled(tenant_ref['id'])
|
|
return tenant_list
|
|
else:
|
|
return super(EnabledEmuMixIn, self).get_all(ldap_filter)
|
|
|
|
def update(self, object_id, values, old_obj=None):
|
|
if 'enabled' not in self.attribute_ignore and self.enabled_emulation:
|
|
data = values.copy()
|
|
enabled_value = data.pop('enabled', None)
|
|
ref = super(EnabledEmuMixIn, self).update(object_id, data, old_obj)
|
|
if enabled_value is not None:
|
|
if enabled_value:
|
|
self._add_enabled(object_id)
|
|
else:
|
|
self._remove_enabled(object_id)
|
|
ref['enabled'] = enabled_value
|
|
return ref
|
|
else:
|
|
return super(EnabledEmuMixIn, self).update(
|
|
object_id, values, old_obj)
|
|
|
|
def delete(self, object_id):
|
|
if self.enabled_emulation:
|
|
self._remove_enabled(object_id)
|
|
super(EnabledEmuMixIn, self).delete(object_id)
|
|
|
|
|
|
class ProjectLdapStructureMixin(object):
|
|
"""Project LDAP Structure shared between LDAP backends.
|
|
|
|
This is shared between the resource and assignment LDAP backends.
|
|
|
|
"""
|
|
DEFAULT_OU = 'ou=Groups'
|
|
DEFAULT_STRUCTURAL_CLASSES = []
|
|
DEFAULT_OBJECTCLASS = 'groupOfNames'
|
|
DEFAULT_ID_ATTR = 'cn'
|
|
NotFound = exception.ProjectNotFound
|
|
notfound_arg = 'project_id' # NOTE(yorik-sar): while options_name = tenant
|
|
options_name = 'project'
|
|
attribute_options_names = {'name': 'name',
|
|
'description': 'desc',
|
|
'enabled': 'enabled',
|
|
'domain_id': 'domain_id'}
|
|
immutable_attrs = ['name']
|