majic-ansible-roles Changeset

Changeset - 6b57aabf9556

Parent rev.

Child rev.

[Not reviewed]

0 1 0

Branko Majic (branko) - 11 years ago 2015-03-08 11:22:24
branko@majic.rs

MAR-1: Fixed the handling of state addattributes in ldap_entry module to be more optimal (which also fixes some issues with cn=config additions related to inability to remove some attribute values).

1 file changed with 11 insertions and 6 deletions:

roles/ldap_server/library/ldap_entry.py

0 comments (0 inline, 0 general)

roles/ldap_server/library/ldap_entry.py

➞

Show inline comments

 #!/usr/bin/env python
 DOCUMENTATION = """
 ---
 module: ldap_entry
 short_description: Creates, updates, or removes an LDAP entry.
 description:
   - Creates, updates, or removes an LDAP entry in an LDAP directory.
 version_added: 1.8.2
 author: Branko Majic
 notes:
   - Requires the python-ldap Python package on remote host. For Debian and
     derivatives, this is as easy as apt-get install python-ldap.
 requirements:
   - python-ldap
 options:
   dn:
     description:
       - Distinguished name of the entry.
     required: true
     default: ""
   state:
     description:
       - LDAP entry state. State C(present) requires that all entry attributes
         are listed. If you wish to add some attributes, with specific values, to
         existing entry, use state C(addattributes). If you wish to replace
         existing values for an attribute, use C(replaceattributes).
     required: true
     default: "present"
     choices: [ "present", "absent", "addattributes", "replaceattributes" ]
   server_uri:
     description:
       - LDAP connection URI specifying what server to connect to.
     required: false
     default: "ldapi:///"
   bind_dn:
     description:
       - DN for binding to the LDAP server using simple bind. If not set,
         EXTERNAL SASL binding method will be used.
     required: false
     default: ""
   bind_password:
     description:
       - Password for binding to the LDAP server using simple bind.
     required: false
     default: ""
   ATTRIBUTES:
     description:
       - All remaining attributes are considered to be attributes for an LDAP
         entry. LDAP schema constraints should be kept in mind (i.e. one
         structural objectClass etc). Attributes can be passed in as a simple
         string (for one value of an attribute), for storing multiple values for
         same attribute. If providing a base64-encoded value, prefix it with
         C(base64:) (this is useful for I(usercertificate;binary) or
         I(displayName) attributes). In order to remove an attribute, set its
         value to an empty string (C("")), and set the state to
         C(replaceattributes).
     required: false
     default: ""
 """
 EXAMPLES = """
 # Create sub-trees for storing user and group information.
 ldap_entry: dn=ou=people,dc=example,dc=com objectClass=organizationalUnit ou=people
 ldap_entry: dn=ou=groups,dc=example,dc=com objectClass=organizationalUnit ou=groups
 # Remove old entries, using simple bind authentication.
 ldap_entry: dn=ou=accounting,dc=example,dc=com state=absent bind_dn=cn=admin,dc=example,dc=com bind_password=foo123
 # Create a complex entry that has multiple values for single attribute.
 ldap_entry:
   dn: uid=john,ou=people,dc=example,dc=com
   objectClass:
     - inetOrgPerson
     - simpleSecurityObject
   uid: john
   cn: John Doe
   sn: Doe
   givenName: John
   displayName: base64:Sm9obiBEb2U=
   initials: JD
   mail: john.doe@example.com
   mobile: +1 11 111 111 11
   usercertificate;binary: base64:MIIC...lotsofcharacters...+/A==
 # Add attribute to an entry.
 ldap_entry:
   dn: uid=john,ou=people,dc=example,dc=com
   state: addattributes
   mail: john.doe@example.com
 # Make sure the configuration database has specific logging level enabled.
 ldap_entry:
   dn: cn=config
   state: replaceattributes
   olcLogLevel: 256
 # Remove attribute from an entry.
 ldap_entry:
   dn: uid=john,ou=people,dc=example,dc=com
   state: replaceattributes
   uid: ""
 """
 # Try to load the Python LDAP module.
 try:
     import ldap
     import ldap.sasl
     import ldap.modlist
 except ImportError:
     ldap_found = False
 else:
     ldap_found = True
 from copy import deepcopy
 def get_ldap_connection(uri, bind_dn=None, bind_password=""):
     """
     Connects and binds to an LDAP server.
     Arguments:
     uri
       LDAP connection URI specifying what server to connect to, including the
       protocol.
     bind_dn
       Distinguished name to be used for simple bind. If not set, SASL EXTERNAL
       mechanism will be used for log-in. Default is None.
     bind_password
       Password to be used for simple bind. Needs to be set only if bind_dn is
       set as well. Default is "".
     Returns:
     LDAP connection object.
     """
     connection = ldap.initialize(uri)
     if bind_dn:
         connection.simple_bind_s(bind_dn, bind_password)
     else:
         connection.sasl_interactive_bind_s("", ldap.sasl.external())
     return connection
 class LDAPEntry(object):
     """
     Implements a convenience wrapper for managing an LDAP entry.
     """
     def __init__(self, dn, attributes, connection):
         """
         Initialises class instance, setting-up the necessary properties.
         Arguments:
         dn
           Distinguished name (DN) of an entry.
         attributes
           Attributes that should be set for an entry.
         connection
           An instance of LDAPObject class that will be used for running queries
           against an LDAP server.
         """
         self.connection = connection
         self.dn = dn
         self.attributes = attributes
     def add(self):
         """
         Adds entry to the LDAP directory.
         Returns:
         True, if entry was added, or had to be updated to match with requested
         attributes. False, if no change was necessary.
         """
         # If entry already exists with set attributes, only update it.
         if self.exists():
             return self._update()
         # Otherwise we need to add a new entry.
         self.connection.add_s(self.dn, ldap.modlist.addModlist(self.attributes))
         return True
     def delete(self):
         """
         Removes entry from an LDAP directory.
         Returns:
         True, if entry was removed. False if no change was necessary (entry is
         already not present).
         """
         if self.exists():
             self.connection.delete_s(self.dn)
             return True
         return False
     def addattributes(self):
         """
         Adds attributes to an existing entry.
         Returns:
         True, if entry was updated with new attribute values. False if no change
         was necessary (values are already present).
         """
         if not self.exists():
             raise Exception("Module error: Can't add attributes for an entry. Entry does not exist.")
         attribute_list = self.attributes.keys()
         current_attributes = self.connection.search_s(self.dn, ldap.SCOPE_BASE, attrlist=attribute_list)[0][1]
         new_attributes = deepcopy(self.attributes)
         # This dictionary will contain all new attributes (or attribute values)
         # that should be added to the entry. We can't rely on modifyModlist
         # unfortunately, since if the values already exists, it will try to
         # remove and re-add them.
         new_attributes = {}
         # If attribute is already present, only add the difference between
         # requested and current values.
         for attribute, values in current_attributes.iteritems():
             if attribute in new_attributes:
                 new_attributes[attribute].extend(values)
                 new_attributes[attribute] = list(set(new_attributes[attribute]))
             if attribute in self.attributes:
                 new_attributes[attribute] = [ item for item in self.attributes[attribute] if item not in values ]
             else:
                 new_attributes[attribute] = values
         modification_list = ldap.modlist.modifyModlist(current_attributes,
                                                        new_attributes)
         modification_list = ldap.modlist.modifyModlist({}, new_attributes)
         if not modification_list:
             return False
         self.connection.modify_s(self.dn, modification_list)
         return True
     def replaceattributes(self):
         """
         Replace attributes of an existing entry.
         Returns:
         True, if entry was updated with new attribute values. False if no change
         was necessary (values are already present).
         """
         if not self.exists():
             raise Exception("Module error: Can't replace attributes for an entry. Entry does not exist.")
         attribute_list = self.attributes.keys()
         current_attributes = self.connection.search_s(self.dn, ldap.SCOPE_BASE, attrlist=attribute_list)[0][1]
         modification_list = ldap.modlist.modifyModlist(current_attributes,
                                                        self.attributes, ignore_oldexistent=1)
         if not modification_list:
             return False
         self.connection.modify_s(self.dn, modification_list)
         return True
     def _update(self):
         """
         Updates an LDAP entry to have the requested attributes.
         Returns:
         True, if LDAP entry was updated. False if no change was necessary (entry
         already has the correct attributes).
         """
         self.current_attributes = self.connection.search_s(self.dn, ldap.SCOPE_BASE)[0][1]
         modification_list = ldap.modlist.modifyModlist(self.current_attributes,
                                                        self.attributes)
         if not modification_list:
             return False
         self.connection.modify_s(self.dn, modification_list)
         return True
     def exists(self):
         """
         Checks if the entry already exists in LDAP directory or not.
         Returns:
         True, if entry exists. False otherwise.
         """
         try:
             self.connection.search_s(self.dn, ldap.SCOPE_BASE, attrlist=["dn"])
         except ldap.NO_SUCH_OBJECT:
             return False
         return True
 def main():
     """
     Runs the module.
     """
     # Construct the module helper for parsing the arguments.
     module = AnsibleModule(
         argument_spec=dict(
             dn=dict(required=True),
             state=dict(required=False, choices=["present", "absent", "addattributes", "replaceattributes"], default="present"),
             server_uri=dict(required=False, default="ldapi:///"),
             bind_dn=dict(required=False, default=None),
             bind_password=dict(required=False)
             ),
         check_invalid_arguments=False
+        )
     if not ldap_found:
         module.fail_json(msg="The Python LDAP module is required")
     # Extract the attributes.
     attributes = {}
     for name, value in module.params.iteritems():
         if name not in module.argument_spec:
             if value == "":
                 pass
             elif isinstance(value, basestring):
                 value = [ value.encode("utf-8") ]
             elif isinstance(value, list):
                 value = [ i.encode("utf-8") for i in value ]
             attributes[name] = value
     try:
         connection = get_ldap_connection(module.params["server_uri"],
                                          module.params["bind_dn"],
                                          module.params["bind_password"])
     except ldap.LDAPError as e:
         module.fail_json(msg="LDAP error: %s" % str(e))
     state = module.params["state"]
     entry = LDAPEntry(module.params["dn"],
                       attributes,
                       connection)
     # Add/remove entry as requested.
     try:
         if state == "present":
             changed = entry.add()
         elif state == "addattributes":
             changed = entry.addattributes()
         elif state == "replaceattributes":
             changed = entry.replaceattributes()
         else:
             changed = entry.remove()
     except ldap.LDAPError as e:
         module.fail_json(msg="LDAP error: %s" % str(e))
     module.exit_json(changed=changed)
 # Import module snippets.
 from ansible.module_utils.basic import *
 main()

0 comments (0 inline, 0 general)