File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/states/__pycache__/ldap.cpython-310.pyc
Back
o ;j�P � @ sp d Z ddlZddlZddlZddlmZ ddlmZ ddlm Z e� e �Z ddd�Z dd � Zd d � Zd d � ZdS )z� Manage entries in an LDAP database ================================== .. versionadded:: 2016.3.0 The ``states.ldap`` state module allows you to manage LDAP entries and their attributes. � N)� OrderedDict)� OrderedSet)�to_bytesc sR |du ri }z|� d| � W n ty Y nw td }t�|�}||���9}t|||�\}}t� } | �|� | �|� t� } | D ]9} |� | i ��|� | i �� �� fD ] } t� } | � � D ] \}}|sg| � |� q\| D ]}| |= qjqS�� krz| � | � qA| D ]} ||fD ]} | � | d� q�| | = q}| i ddd�}||kr�d|d< d|d < |W d � S t d r�d |d< |}|}| }n�t� }t� }d|d < d |d< g }t� }| D ]r} |� | i ��|� | i �� d}z>��r� r�d }�� ks�J �td || �� � nd}td || � nd}� �s J �td || � � �|| < � || < d|| < W q� |j�yB } zt�d|| |� |�|| |f� W Y d}~q�d}~ww |�rXd|d < dd�dd� |D �� |d< W d � n 1 �scw Y |D ]<} |� | i ��|� | i �� i }||d | < �df� dffD ] \} }| �s�d||< �q�� �fd d �| � � D �||< �q��qj|S ) aX$ Ensure the existence (or not) of LDAP entries and their attributes Example: .. code-block:: yaml ldapi:///: ldap.managed: - connect_spec: bind: method: sasl - entries: # make sure the entry doesn't exist - cn=foo,ou=users,dc=example,dc=com: - delete_others: True # make sure the entry exists with only the specified # attribute values - cn=admin,dc=example,dc=com: - delete_others: True - replace: cn: - admin description: - LDAP administrator objectClass: - simpleSecurityObject - organizationalRole userPassword: - {{pillar.ldap_admin_password}} # make sure the entry exists, its olcRootDN attribute # has only the specified value, the olcRootDN attribute # doesn't exist, and all other attributes are ignored - 'olcDatabase={1}hdb,cn=config': - replace: olcRootDN: - cn=admin,dc=example,dc=com # the admin entry has its own password attribute olcRootPW: [] # note the use of 'default'. also note how you don't # have to use list syntax if there is only one attribute # value - cn=foo,ou=users,dc=example,dc=com: - delete_others: True - default: userPassword: changeme shadowLastChange: 0 # keep sshPublicKey if present, but don't create # the attribute if it is missing sshPublicKey: [] - replace: cn: foo uid: foo uidNumber: 1000 gidNumber: 1000 gecos: Foo Bar givenName: Foo sn: Bar homeDirectory: /home/foo loginShell: /bin/bash objectClass: - inetOrgPerson - posixAccount - top - ldapPublicKey - shadowAccount :param name: The URL of the LDAP server. This is ignored if ``connect_spec`` is either a connection object or a dict with a ``'url'`` entry. :param entries: A description of the desired state of zero or more LDAP entries. ``entries`` is an iterable of dicts. Each of these dict's keys are the distinguished names (DNs) of LDAP entries to manage. Each of these dicts is processed in order. A later dict can reference an LDAP entry that was already mentioned in an earlier dict, which makes it possible for later dicts to enhance or alter the desired state of an LDAP entry. The DNs are mapped to a description of the LDAP entry's desired state. These LDAP entry descriptions are themselves iterables of dicts. Each dict in the iterable is processed in order. They contain directives controlling the entry's state. The key names the directive type and the value is state information for the directive. The specific structure of the state information depends on the directive type. The structure of ``entries`` looks like this:: [{dn1: [{directive1: directive1_state, directive2: directive2_state}, {directive3: directive3_state}], dn2: [{directive4: directive4_state, directive5: directive5_state}]}, {dn3: [{directive6: directive6_state}]}] These are the directives: * ``'delete_others'`` Boolean indicating whether to delete attributes not mentioned in this dict or any of the other directive dicts for this DN. Defaults to ``False``. If you don't want to delete an attribute if present, but you also don't want to add it if it is missing or modify it if it is present, you can use either the ``'default'`` directive or the ``'add'`` directive with an empty value list. * ``'default'`` A dict mapping an attribute name to an iterable of default values for that attribute. If the attribute already exists, it is left alone. If not, it is created using the given list of values. An empty value list is useful when you don't want to create an attribute if it is missing but you do want to preserve it if the ``'delete_others'`` key is ``True``. * ``'add'`` Attribute values to add to the entry. This is a dict mapping an attribute name to an iterable of values to add. An empty value list is useful when you don't want to create an attribute if it is missing but you do want to preserve it if the ``'delete_others'`` key is ``True``. * ``'delete'`` Attribute values to remove from the entry. This is a dict mapping an attribute name to an iterable of values to delete from the attribute. If the iterable is empty, all of the attribute's values are deleted. * ``'replace'`` Attributes to replace. This is a dict mapping an attribute name to an iterable of values. Any existing values for the attribute are deleted, then the given values are added. The iterable may be empty. In the above directives, the iterables of attribute values may instead be ``None``, in which case an empty list is used, or a scalar such as a string or number, in which case a new list containing the scalar is used. Note that if all attribute values are removed from an entry, the entire entry is deleted. :param connect_spec: See the description of the ``connect_spec`` parameter of the :py:func:`ldap3.connect <salt.modules.ldap3.connect>` function in the :py:mod:`ldap3 <salt.modules.ldap3>` execution module. If this is a dict and the ``'url'`` entry is not specified, the ``'url'`` entry is set to the value of the ``name`` parameter. :param attrlist: Passed directly to :py:func:`ldap3.connect <salt.modules.ldap3.search>` to filter the attributes returned by the LDAP server. By default, all user attributes will be requested, and this should only need to be modified if management of operational attributes is desired. :returns: A dict with the following keys: * ``'name'`` This is the same object passed to the ``name`` parameter. * ``'changes'`` This is a dict describing the changes made (or, in test mode, the changes that would have been attempted). If no changes were made (or no changes would have been attempted), then this dict is empty. Only successful changes are included. Each key is a DN of an entry that was changed (or would have been changed). Entries that were not changed (or would not have been changed) are not included. The value is a dict with two keys: * ``'old'`` The state of the entry before modification. If the entry did not previously exist, this key maps to ``None``. Otherwise, the value is a dict mapping each of the old entry's attributes to a list of its values before any modifications were made. Unchanged attributes are excluded from this dict. * ``'new'`` The state of the entry after modification. If the entry was deleted, this key maps to ``None``. Otherwise, the value is a dict mapping each of the entry's attributes to a list of its values after the modifications were made. Unchanged attributes are excluded from this dict. Example ``'changes'`` dict where a new entry was created with a single attribute containing two values:: {'dn1': {'old': None, 'new': {'attr1': ['val1', 'val2']}}} Example ``'changes'`` dict where a new attribute was added to an existing entry:: {'dn1': {'old': {}, 'new': {'attr2': ['val3']}}} * ``'result'`` One of the following values: * ``True`` if no changes were necessary or if all changes were applied successfully. * ``False`` if at least one change was unable to be applied. * ``None`` if changes would be applied but it is in test mode. N�urlz ldap3.connect� )�name�changes�result�commentzLDAP entries already setr Tr �testzWould change LDAP entriesz!Successfully updated LDAP entries�modifyz ldap3.change�deletez ldap3.delete�addz ldap3.addzfailed to %s entry %s (%s)Fz failed to z, c s s2 � | ]\}}}|d | d t |� d V qdS )z entry �(�)N)�str)�.0�op�dn�err� r �D/opt/saltstack/salt/lib/python3.10/site-packages/salt/states/ldap.py� <genexpr>` s �0 zmanaged.<locals>.<genexpr>r �old�newc s2 i | ]\}}�� |d �� � |d �kr|t|��qS )r )�get�sorted)r �attr�vals��n�or r � <dictcomp>o s �zmanaged.<locals>.<dictcomp>)� setdefault�AttributeError�__salt__�inspectZ getmodule�_process_entriesr �update�setr �itemsr �popZ__opts__Z LDAPError�log� exception�append�join)r �entriesZ connect_spec�attrlist�connectZldap3�lr r Zdn_setZ dn_to_deleter �x� to_deleter r �retZ changed_oldZ changed_newZsuccess_dn_setZerrsr r r Zxnr r r �managed s� b � �� � ��, �� �� �a �� r7 c s t � }t � }|D ]z}|�� D ]s\}}|�|d�}|du rHtd | |d|d�} t| �dkr:| | � � fdd�� D �}n t| �dksBJ �i }|||< t�|�} | ||< d t� d �} |D ]} t| | | � qY| d r�t� } | D ] }|| d vrx| � |� qk| D ]}| |= q{qq||fS ) aT Helper for managed() to process entries and return before/after views Collect the current database state and update it according to the data in :py:func:`managed`'s ``entries`` parameter. Return the current database state and what it will look like after modification. :param l: the LDAP connection object :param entries: the same object passed to the ``entries`` parameter of :py:func:`manage` :return: an ``(old, new)`` tuple that describes the current state of the entries and what they will look like after modification. Each item in the tuple is an OrderedDict that maps an entry DN to another dict that maps an attribute name to a set of its values (it's a set because according to the LDAP spec, attribute value ordering is unspecified and there can't be duplicates). The structure looks like this: {dn1: {attr1: set([val1])}, dn2: {attr1: set([val2]), attr2: set([val3, val4])}} All of an entry's attributes and values will be included, even if they will not be modified. If an entry mentioned in the entries variable doesn't yet exist in the database, the DN in ``old`` will be mapped to an empty dict. If an entry in the database will be deleted, the DN in ``new`` will be mapped to an empty dict. All value sets are non-empty: An attribute that will be added to an entry is not included in ``old``, and an attribute that will be deleted frm an entry is not included in ``new``. These are OrderedDicts to ensure that the user-supplied entries are processed in the user-specified order (in case there are dependencies, such as ACL rules specified in an early entry that make it possible to modify a later entry). Nz ldap3.search�base)r1 � c s& i | ]}t � | �r|t� | ��qS r )�lenr )r r ��attrsr r r" � s � �z$_process_entries.<locals>.<dictcomp>r F)� delete_others�mentioned_attributesr= r> ) r r* r r% r: �copy�deepcopyr) � _update_entryr )r3 r1 r0 r r Z entries_dictr Zdirectives_seqZolde�resultsZneweZ entry_status� directivesr5 r r r; r r' x sB + � � ���'r' c C s� |� � D ]w\}}|dkr||d< q|� � D ]e\}}|d �|� t|�}|dkr7|r6|| vs2| | s6|| |< q|dkrL|�| �|t� �� |rK|| |< q|dkrd| �|t� �}|rc||8 }|rc|| |< q|dkru| �|d� |rt|| |< qtd| ��qdS ) a� Update an entry's attributes using the provided directives :param entry: A dict mapping each attribute name to a set of its values :param status: A dict holding cross-invocation status (whether delete_others is True or not, and the set of mentioned attributes) :param directives: A dict mapping directive types to directive-specific state r= r> �defaultr r �replaceNzunknown directive: )r* r �_tosetr( r r r+ � ValueError)�entry�statusrC Z directive�stater r Z existing_valsr r r rA � s> ��� � ��rA c C sv | du rt � S t| t�rt t| �f�S t| t�r!t tt| ��f�S z t dd� | D ��W S ty: t t| �� Y S w )a| helper to convert various things to a set This enables flexibility in what users provide as the list of LDAP entry attribute values. Note that the LDAP spec prohibits duplicate values in an attribute. RFC 2251 states that: "The order of attribute values within the vals set is undefined and implementation-dependent, and MUST NOT be relied upon." However, OpenLDAP have an X-ORDERED that is used in the config schema. Using sets would mean we can't pass ordered values and therefore can't manage parts of the OpenLDAP configuration, hence the use of OrderedSet. Sets are also good for automatically removing duplicates. None becomes an empty set. Iterables except for strings have their elements added to a new set. Non-None scalars (strings, numbers, non-iterable objects, etc.) are added as the only member of a new set. Nc s s. � | ]}t |t�rtt|��nt|�V qd S )N)� isinstance�intr r )r r4 r r r r s � �z_toset.<locals>.<genexpr>)r rK r r rL � TypeError)�thingr r r rF � s � ��rF )NN)�__doc__r? r& �logging� collectionsr Zsalt.utils.osetr Zsalt.utils.stringutilsr � getLogger�__name__r, r7 r' rA rF r r r r �<module> s dY '
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings