+++ /dev/null
-# -*- coding: utf-8 -*-
-## GroupUserFolder
-## Copyright (C)2006 Ingeniweb
-
-## This program is free software; you can redistribute it and/or modify
-## it under the terms of the GNU General Public License as published by
-## the Free Software Foundation; either version 2 of the License, or
-## (at your option) any later version.
-
-## This program is distributed in the hope that it will be useful,
-## but WITHOUT ANY WARRANTY; without even the implied warranty of
-## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-## GNU General Public License for more details.
-
-## You should have received a copy of the GNU General Public License
-## along with this program; see the file COPYING. If not, write to the
-## Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-"""
-
-"""
-__version__ = "$Revision: $"
-# $Source: $
-# $Id: LDAPUserFolderAdapter.py 587 2008-07-31 09:20:06Z pin $
-__docformat__ = 'restructuredtext'
-
-
-from global_symbols import *
-from Products.GroupUserFolder import postonly
-
-
-# These mandatory attributes are required by LDAP schema.
-# They will be filled with user name as a default value.
-# You have to provide a gruf_ldap_required_fields python script
-# in your Plone's skins if you want to override this.
-MANDATORY_ATTRIBUTES = ("sn", "cn", )
-
-
-def _doAddUser(self, name, password, roles, domains, **kw):
- """
- Special user adding method for use with LDAPUserFolder.
- This will ensure parameters are correct for LDAP management
- """
- kwargs = {} # We will pass this dict
- attrs = {}
-
- # Get gruf_ldap_required_fields result and fill in mandatory stuff
- if hasattr(self, "gruf_ldap_required_fields"):
- attrs = self.gruf_ldap_required_fields(login = name)
- else:
- for attr in MANDATORY_ATTRIBUTES:
- attrs[attr] = name
- kwargs.update(attrs)
-
- # We assume that name is rdn attribute
- rdn_attr = self._rdnattr
- kwargs[rdn_attr] = name
-
- # Manage password(s)
- kwargs['user_pw'] = password
- kwargs['confirm_pw'] = password
-
- # Mangle roles
- kwargs['user_roles'] = self._mangleRoles(name, roles)
-
- # Delegate to LDAPUF default method
- msg = self.manage_addUser(kwargs = kwargs)
- if msg:
- raise RuntimeError, msg
-
-
-def _doDelUsers(self, names):
- """
- Remove a bunch of users from LDAP.
- We have to call manage_deleteUsers but, before, we need to find their dn.
- """
- dns = []
- for name in names:
- dns.append(self._find_user_dn(name))
-
- self.manage_deleteUsers(dns)
-
-
-def _find_user_dn(self, name):
- """
- Convert a name to an LDAP dn
- """
- # Search records matching name
- login_attr = self._login_attr
- v = self.findUser(search_param = login_attr, search_term = name)
-
- # Filter to keep exact matches only
- v = filter(lambda x: x[login_attr] == name, v)
-
- # Now, decide what to do
- l = len(v)
- if not l:
- # Invalid name
- raise "Invalid user name: '%s'" % (name, )
- elif l > 1:
- # Several records... don't know how to handle
- raise "Duplicate user name for '%s'" % (name, )
- return v[0]['dn']
-
-
-def _mangleRoles(self, name, roles):
- """
- Return role_dns for this user
- """
- # Local groups => the easiest part
- if self._local_groups:
- return roles
-
- # We have to transform roles into group dns: transform them as a dict
- role_dns = []
- all_groups = self.getGroups()
- all_roles = self.valid_roles()
- groups = {}
- for g in all_groups:
- groups[g[0]] = g[1]
-
- # LDAPUF does the mistake of adding possibly invalid roles to the user roles
- # (for example, adding the cn of a group additionnaly to the mapped zope role).
- # So we must remove from our 'roles' list all roles which are prefixed by group prefix
- # but are not actually groups.
- # See http://www.dataflake.org/tracker/issue_00376 for more information on that
- # particular issue.
- # If a group has the same name as a role, we assume that it should be a _role_.
- # We should check against group/role mapping here, but... well... XXX TODO !
- # See "HERE IT IS" comment below.
-
- # Scan roles we are asking for to manage groups correctly
- for role in roles:
- if not role in all_roles:
- continue # Do not allow propagation of invalid roles
- if role.startswith(GROUP_PREFIX):
- role = role[GROUP_PREFIX_LEN:] # Remove group prefix : groups are stored WITHOUT prefix in LDAP
- if role in all_roles:
- continue # HERE IT IS
- r = groups.get(role, None)
- if not r:
- Log(LOG_WARNING, "LDAP Server doesn't provide a '%s' group (required for user '%s')." % (role, name, ))
- else:
- role_dns.append(r)
-
- return role_dns
-
-
-def _doChangeUser(self, name, password, roles, domains, **kw):
- """
- Update a user
- """
- # Find the dn at first
- dn = self._find_user_dn(name)
-
- # Change password
- if password is not None:
- if password == '':
- raise ValueError, "Password must not be empty for LDAP users."
- self.manage_editUserPassword(dn, password)
-
- # Perform role change
- self.manage_editUserRoles(dn, self._mangleRoles(name, roles))
-
- # (No domain management with LDAP.)
-
-
-def manage_editGroupRoles(self, user_dn, role_dns=[], REQUEST=None):
- """ Edit the roles (groups) of a group """
- from Products.LDAPUserFolder.utils import GROUP_MEMBER_MAP
- try:
- from Products.LDAPUserFolder.LDAPDelegate import ADD, DELETE
- except ImportError:
- # Support for LDAPUserFolder >= 2.6
- ADD = self._delegate.ADD
- DELETE = self._delegate.DELETE
-
- msg = ""
-
-## Log(LOG_DEBUG, "assigning", role_dns, "to", user_dn)
- all_groups = self.getGroups(attr='dn')
- cur_groups = self.getGroups(dn=user_dn, attr='dn')
- group_dns = []
- for group in role_dns:
- if group.find('=') == -1:
- group_dns.append('cn=%s,%s' % (group, self.groups_base))
- else:
- group_dns.append(group)
-
- if self._local_groups:
- if len(role_dns) == 0:
- del self._groups_store[user_dn]
- else:
- self._groups_store[user_dn] = role_dns
-
- else:
- for group in all_groups:
- member_attr = GROUP_MEMBER_MAP.get(self.getGroupType(group))
-
- if group in cur_groups and group not in group_dns:
- action = DELETE
- elif group in group_dns and group not in cur_groups:
- action = ADD
- else:
- action = None
- if action is not None:
- msg = self._delegate.modify(
- group
- , action
- , {member_attr : [user_dn]}
- )
-## Log(LOG_DEBUG, "group", group, "subgroup", user_dn, "result", msg)
-
- if msg:
- raise RuntimeError, msg
-manage_editGroupRoles = postonly(manage_editGroupRoles)
projects / GroupUserFolder.git / blobdiff