x/gantt
Code Issues Proposed changes

Format fixes and modification of Vish's email address.

Browse Source
This commit is contained in:
Ryan Lane
2010-12-10 18:49:54 +00:00
parent c6bb2f3bdb
commit c0d30a6cd3
3 changed files with 24 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
nova/auth/ldapdriver.py
View File

@@ -125,7 +125,7 @@ class LdapDriver(object):
def get_users(self): def get_users(self):
"""Retrieve list of users""" """Retrieve list of users"""
attrs = self.__find_objects(FLAGS.ldap_user_subtree, attrs = self.__find_objects(FLAGS.ldap_user_subtree,
'(objectclass=novaUser)') '(objectclass=novaUser)')
users = [] users = []
for attr in attrs: for attr in attrs:
user = self.__to_user(attr) user = self.__to_user(attr)
@@ -155,22 +155,24 @@ class LdapDriver(object):
attr = [] attr = []
if 'secretKey' in user.keys(): if 'secretKey' in user.keys():
attr.append((self.ldap.MOD_REPLACE, 'secretKey', attr.append((self.ldap.MOD_REPLACE, 'secretKey',
[secret_key])) [secret_key]))
else: else:
attr.append((self.ldap.MOD_ADD, 'secretKey', attr.append((self.ldap.MOD_ADD, 'secretKey',
[secret_key])) [secret_key]))
if 'accessKey' in user.keys(): if 'accessKey' in user.keys():
attr.append((self.ldap.MOD_REPLACE, 'accessKey', attr.append((self.ldap.MOD_REPLACE, 'accessKey',
[access_key])) [access_key]))
else: else:
attr.append((self.ldap.MOD_ADD, 'accessKey', attr.append((self.ldap.MOD_ADD, 'accessKey',
[access_key])) [access_key]))
if LdapDriver.isadmin_attribute in user.keys(): if LdapDriver.isadmin_attribute in user.keys():
attr.append((self.ldap.MOD_REPLACE, attr.append((self.ldap.MOD_REPLACE,
LdapDriver.isadmin_attribute, [str(is_admin).upper()])) LdapDriver.isadmin_attribute,
[str(is_admin).upper()]))
else: else:
attr.append((self.ldap.MOD_ADD, attr.append((self.ldap.MOD_ADD,
LdapDriver.isadmin_attribute, [str(is_admin).upper()])) LdapDriver.isadmin_attribute,
[str(is_admin).upper()]))
self.conn.modify_s(self.__uid_to_dn(name), attr) self.conn.modify_s(self.__uid_to_dn(name), attr)
return self.get_user(name) return self.get_user(name)
else: else:
@@ -299,7 +301,7 @@ class LdapDriver(object):
else: else:
project_dn = 'cn=%s,%s' % (project_id, FLAGS.ldap_project_subtree) project_dn = 'cn=%s,%s' % (project_id, FLAGS.ldap_project_subtree)
query = ('(&(&(objectclass=groupOfNames)(!%s))(member=%s))' % query = ('(&(&(objectclass=groupOfNames)(!%s))(member=%s))' %
(LdapDriver.project_pattern, self.__uid_to_dn(uid))) (LdapDriver.project_pattern, self.__uid_to_dn(uid)))
roles = self.__find_objects(project_dn, query) roles = self.__find_objects(project_dn, query)
return [role['cn'][0] for role in roles] return [role['cn'][0] for role in roles]
@@ -363,7 +365,7 @@ class LdapDriver(object):
def __get_ldap_user(self, uid): def __get_ldap_user(self, uid):
"""Retrieve LDAP user entry by id""" """Retrieve LDAP user entry by id"""
attr = self.__find_object(self.__uid_to_dn(uid), attr = self.__find_object(self.__uid_to_dn(uid),
'(objectclass=novaUser)') '(objectclass=novaUser)')
return attr return attr
def __find_object(self, dn, query=None, scope=None): def __find_object(self, dn, query=None, scope=None):
@@ -406,7 +408,7 @@ class LdapDriver(object):
def __find_group_dns_with_member(self, tree, uid): def __find_group_dns_with_member(self, tree, uid):
"""Find dns of group objects in a given tree that contain member""" """Find dns of group objects in a given tree that contain member"""
query = ('(&(objectclass=groupOfNames)(member=%s))' % query = ('(&(objectclass=groupOfNames)(member=%s))' %
self.__uid_to_dn(uid)) self.__uid_to_dn(uid))
dns = self.__find_dns(tree, query) dns = self.__find_dns(tree, query)
return dns return dns
@@ -436,7 +438,8 @@ class LdapDriver(object):
for member_uid in member_uids: for member_uid in member_uids:
if not self.__user_exists(member_uid): if not self.__user_exists(member_uid):
raise exception.NotFound("Group can't be created " raise exception.NotFound("Group can't be created "
"because user %s doesn't exist" % member_uid) "because user %s doesn't exist" %
member_uid)
members.append(self.__uid_to_dn(member_uid)) members.append(self.__uid_to_dn(member_uid))
dn = self.__uid_to_dn(uid) dn = self.__uid_to_dn(uid)
if not dn in members: if not dn in members:
@@ -452,7 +455,7 @@ class LdapDriver(object):
"""Check if user is in group""" """Check if user is in group"""
if not self.__user_exists(uid): if not self.__user_exists(uid):
raise exception.NotFound("User %s can't be searched in group " raise exception.NotFound("User %s can't be searched in group "
"because the user doesn't exist" % uid) "because the user doesn't exist" % uid)
if not self.__group_exists(group_dn): if not self.__group_exists(group_dn):
return False return False
res = self.__find_object(group_dn, res = self.__find_object(group_dn,
@@ -464,7 +467,7 @@ class LdapDriver(object):
"""Add user to group""" """Add user to group"""
if not self.__user_exists(uid): if not self.__user_exists(uid):
raise exception.NotFound("User %s can't be added to the group " raise exception.NotFound("User %s can't be added to the group "
"because the user doesn't exist" % uid) "because the user doesn't exist" % uid)
if not self.__group_exists(group_dn): if not self.__group_exists(group_dn):
raise exception.NotFound("The group at dn %s doesn't exist" % raise exception.NotFound("The group at dn %s doesn't exist" %
group_dn) group_dn)
@@ -481,13 +484,13 @@ class LdapDriver(object):
group_dn) group_dn)
if not self.__user_exists(uid): if not self.__user_exists(uid):
raise exception.NotFound("User %s can't be removed from the " raise exception.NotFound("User %s can't be removed from the "
"group because the user doesn't exist" % uid) "group because the user doesn't exist" %
uid)
if not self.__is_in_group(uid, group_dn): if not self.__is_in_group(uid, group_dn):
raise exception.NotFound("User %s is not a member of the group" % raise exception.NotFound("User %s is not a member of the group" %
uid) uid)
# NOTE(vish): remove user from group and any sub_groups # NOTE(vish): remove user from group and any sub_groups
sub_dns = self.__find_group_dns_with_member( sub_dns = self.__find_group_dns_with_member(group_dn, uid)
group_dn, uid)
for sub_dn in sub_dns: for sub_dn in sub_dns:
self.__safe_remove_from_group(uid, sub_dn) self.__safe_remove_from_group(uid, sub_dn)
@@ -506,7 +509,7 @@ class LdapDriver(object):
"""Remove user from all roles and projects""" """Remove user from all roles and projects"""
if not self.__user_exists(uid): if not self.__user_exists(uid):
raise exception.NotFound("User %s can't be removed from all " raise exception.NotFound("User %s can't be removed from all "
"because the user doesn't exist" % uid) "because the user doesn't exist" % uid)
role_dns = self.__find_group_dns_with_member( role_dns = self.__find_group_dns_with_member(
FLAGS.role_project_subtree, uid) FLAGS.role_project_subtree, uid)
for role_dn in role_dns: for role_dn in role_dns:
@@ -564,8 +567,8 @@ class LdapDriver(object):
@staticmethod @staticmethod
def __uid_to_dn(uid): def __uid_to_dn(uid):
"""Convert uid to dn""" """Convert uid to dn"""
return FLAGS.ldap_user_id_attribute + '=%s,%s' \ return (FLAGS.ldap_user_id_attribute + '=%s,%s'
% (uid, FLAGS.ldap_user_subtree) % (uid, FLAGS.ldap_user_subtree))
class FakeLdapDriver(LdapDriver): class FakeLdapDriver(LdapDriver):

2
nova/auth/nova_openldap.schema
View File

@@ -2,7 +2,7 @@
# Person object for Nova # Person object for Nova
# inetorgperson with extra attributes # inetorgperson with extra attributes
# Schema version: 2 # Schema version: 2
# Authors: Vishvananda Ishaya <vishvananda@yahoo.com> # Authors: Vishvananda Ishaya <vishvananda@gmail.com>
# Ryan Lane <rlane@wikimedia.org> # Ryan Lane <rlane@wikimedia.org>
# #
# #

2
nova/auth/nova_sun.schema
View File

@@ -2,7 +2,7 @@
# Person object for Nova # Person object for Nova
# inetorgperson with extra attributes # inetorgperson with extra attributes
# Schema version: 2 # Schema version: 2
# Authors: Vishvananda Ishaya <vishvananda@yahoo.com> # Authors: Vishvananda Ishaya <vishvananda@gmail.com>
# Ryan Lane <rlane@wikimedia.org> # Ryan Lane <rlane@wikimedia.org>
# #
# using internet experimental oid arc as per BP64 3.1 # using internet experimental oid arc as per BP64 3.1