| 480 |
480 |
transaction.savepoint_rollback(sid)
|
| 481 |
481 |
username = u'{0}{1}@{2}'.format(left, i, right)
|
| 482 |
482 |
|
| 483 |
|
def populate_user_attributes(self, user, uri, dn, conn, block, attributes):
|
| 484 |
|
for legacy_attribute, legacy_field in (('email', 'email_field'),
|
|
483 |
def populate_user_attributes(self, user, block, attributes):
|
|
484 |
for legacy_attribute, legacy_field in (('email', 'email_field'),
|
| 485 |
485 |
('first_name', 'fname_field'), ('last_name', 'lname_field')):
|
| 486 |
486 |
ldap_attribute = block[legacy_field]
|
| 487 |
487 |
if not ldap_attribute:
|
| ... | ... | |
| 511 |
511 |
return True
|
| 512 |
512 |
return False
|
| 513 |
513 |
|
| 514 |
|
def populate_admin_flags_by_group(self, user, uri, dn, conn, block, group_dns):
|
|
514 |
def populate_admin_flags_by_group(self, user, block, group_dns):
|
| 515 |
515 |
'''Attribute admin flags based on groups.
|
| 516 |
516 |
|
| 517 |
517 |
It supersedes is_staff, is_superuser and is_active.'''
|
| ... | ... | |
| 526 |
526 |
else:
|
| 527 |
527 |
setattr(user, attr, False)
|
| 528 |
528 |
|
| 529 |
|
def populate_groups_by_mapping(self, user, uri, dn, conn, block, group_dns):
|
|
529 |
def populate_groups_by_mapping(self, user, dn, conn, block, group_dns):
|
| 530 |
530 |
'''Assign group to user based on a mapping from group DNs'''
|
| 531 |
531 |
group_mapping = block['group_mapping']
|
| 532 |
532 |
if not group_mapping:
|
| ... | ... | |
| 541 |
541 |
except KeyError:
|
| 542 |
542 |
pass
|
| 543 |
543 |
|
| 544 |
|
def get_ldap_group_dns(self, user, uri, dn, conn, block):
|
|
544 |
def get_ldap_group_dns(self, user, dn, conn, block):
|
| 545 |
545 |
'''Retrieve group DNs from the LDAP by attributes (memberOf) or by
|
| 546 |
546 |
filter.
|
| 547 |
547 |
'''
|
| ... | ... | |
| 565 |
565 |
group_dns.update(dn for dn, attributes in results)
|
| 566 |
566 |
return group_dns
|
| 567 |
567 |
|
| 568 |
|
def populate_user_groups(self, user, uri, dn, conn, block):
|
| 569 |
|
group_dns = self.get_ldap_group_dns(user, uri, dn, conn, block)
|
|
568 |
def populate_user_groups(self, user, dn, conn, block):
|
|
569 |
group_dns = self.get_ldap_group_dns(user, dn, conn, block)
|
| 570 |
570 |
log.debug('groups for dn %r: %r', dn, group_dns)
|
| 571 |
|
self.populate_admin_flags_by_group(user, uri, dn, conn, block, group_dns)
|
| 572 |
|
self.populate_groups_by_mapping(user, uri, dn, conn, block, group_dns)
|
|
571 |
self.populate_admin_flags_by_group(user, block, group_dns)
|
|
572 |
self.populate_groups_by_mapping(user, dn, conn, block, group_dns)
|
| 573 |
573 |
|
| 574 |
574 |
|
| 575 |
575 |
def get_group_by_name(self, block, group_name, create=None):
|
| ... | ... | |
| 585 |
585 |
except Group.DoesNotExist:
|
| 586 |
586 |
return None
|
| 587 |
587 |
|
| 588 |
|
def populate_mandatory_groups(self, user, uri, dn, conn, block):
|
|
588 |
def populate_mandatory_groups(self, user, block):
|
| 589 |
589 |
mandatory_groups = block.get('set_mandatory_groups')
|
| 590 |
590 |
if not mandatory_groups:
|
| 591 |
591 |
return
|
| ... | ... | |
| 594 |
594 |
if group:
|
| 595 |
595 |
user.groups.add(group)
|
| 596 |
596 |
|
| 597 |
|
def populate_admin_fields(self, user, uri, dn, conn, block):
|
|
597 |
def populate_admin_fields(self, user, block):
|
| 598 |
598 |
if block['is_staff'] is not None:
|
| 599 |
599 |
user.is_staff = block['is_staff']
|
| 600 |
600 |
if block['is_superuser'] is not None:
|
| 601 |
601 |
user.is_superuser = block['is_superuser']
|
| 602 |
602 |
|
| 603 |
|
def populate_user(self, user, uri, dn, username, conn, block, attributes):
|
| 604 |
|
self.update_user_identifiers(user, uri, dn, username, conn, block,
|
| 605 |
|
attributes)
|
| 606 |
|
self.populate_user_attributes(user, uri, dn, conn, block, attributes)
|
| 607 |
|
self.populate_admin_fields(user, uri, dn, conn, block)
|
| 608 |
|
self.populate_mandatory_groups(user, uri, dn, conn, block)
|
| 609 |
|
self.populate_user_groups(user, uri, dn, conn, block)
|
|
603 |
def populate_user(self, user, dn, username, conn, block, attributes):
|
|
604 |
self.update_user_identifiers(user, username, block, attributes)
|
|
605 |
self.populate_user_attributes(user, block, attributes)
|
|
606 |
self.populate_admin_fields(user, block)
|
|
607 |
self.populate_mandatory_groups(user, block)
|
|
608 |
self.populate_user_groups(user, dn, conn, block)
|
| 610 |
609 |
|
| 611 |
610 |
@classmethod
|
| 612 |
611 |
def attribute_name_from_external_id_tuple(cls, external_id_tuple):
|
| ... | ... | |
| 723 |
722 |
except User.DoesNotExist:
|
| 724 |
723 |
pass
|
| 725 |
724 |
|
| 726 |
|
def lookup_existing_user(self, uri, dn, username, password, conn, block, attributes):
|
|
725 |
def lookup_existing_user(self, username, block, attributes):
|
| 727 |
726 |
for lookup_type in block['lookups']:
|
| 728 |
727 |
if lookup_type == 'username':
|
| 729 |
728 |
return self.lookup_by_username(username)
|
| 730 |
729 |
elif lookup_type == 'external_id':
|
| 731 |
730 |
return self.lookup_by_external_id(block, attributes)
|
| 732 |
731 |
|
| 733 |
|
def update_user_identifiers(self, user, uri, dn, username, conn,
|
| 734 |
|
block, attributes):
|
|
732 |
def update_user_identifiers(self, user, username, block, attributes):
|
| 735 |
733 |
if block['transient']:
|
| 736 |
734 |
return
|
| 737 |
735 |
# if username has changed and we propagate those changes, update it
|
| ... | ... | |
| 779 |
777 |
def _return_transient_user(self, uri, dn, username, password, conn, block, attributes):
|
| 780 |
778 |
user = LDAPUser(username=username)
|
| 781 |
779 |
user.ldap_init(block, dn, password, transient=True)
|
| 782 |
|
self.populate_user(user, uri, dn, username, conn, block, attributes)
|
|
780 |
self.populate_user(user, dn, username, conn, block, attributes)
|
| 783 |
781 |
user.pk = 'transient!{0}'.format(base64.b64encode(pickle.dumps(user)))
|
| 784 |
782 |
return user
|
| 785 |
783 |
|
| 786 |
784 |
def _return_django_user(self, uri, dn, username, password, conn, block, attributes):
|
| 787 |
|
user = self.lookup_existing_user(uri, dn, username, password, conn, block, attributes)
|
|
785 |
user = self.lookup_existing_user(username, block, attributes)
|
| 788 |
786 |
if user:
|
| 789 |
787 |
created = False
|
| 790 |
788 |
log.debug('found existing user %r', user)
|
| ... | ... | |
| 792 |
790 |
created = True
|
| 793 |
791 |
user = LDAPUser()
|
| 794 |
792 |
user.ldap_init(block, dn, password)
|
| 795 |
|
self.populate_user(user, uri, dn, username, conn, block, attributes)
|
|
793 |
self.populate_user(user, dn, username, conn, block, attributes)
|
| 796 |
794 |
if block['keep_password']:
|
| 797 |
795 |
if created:
|
| 798 |
796 |
user.set_password(password)
|
| ... | ... | |
| 816 |
814 |
names.update(cls.get_ldap_attributes_names(block))
|
| 817 |
815 |
names.update(block['mandatory_attributes_values'].keys())
|
| 818 |
816 |
return [(a, '%s (LDAP)' % a) for a in sorted(names)]
|
|
817 |
|
|
818 |
@classmethod
|
|
819 |
def get_users(cls):
|
|
820 |
for block in cls.get_config():
|
|
821 |
conn = get_connection(block)
|
|
822 |
user_basedn = block.get('user_basedn', block['basedn'])
|
|
823 |
user_filter = block['user_filter'].replace('%s', '*')
|
|
824 |
attrs = block['attributes']
|
|
825 |
users = conn.search_s(user_basedn, ldap.SCOPE_SUBTREE, user_filter, attrs)
|
|
826 |
backend = cls()
|
|
827 |
for user_dn, data in users:
|
|
828 |
attrs = cls.get_ldap_attributes(block, conn, user_dn)
|
|
829 |
username = backend.create_username(block, attrs)
|
|
830 |
user = backend.lookup_existing_user(username, block, attrs)
|
|
831 |
if not user:
|
|
832 |
user = LDAPUser(username=username)
|
|
833 |
user.transient = False
|
|
834 |
backend.populate_user(user, user_dn, username, conn, block, attrs)
|
|
835 |
for name, value in user.attributes.iteritems():
|
|
836 |
setattr(user, name, value)
|
|
837 |
yield user
|