Current File : //lib/python2.7/site-packages/salt/modules/ldap3.pyc
�
���^c @@ s_ d Z d d l m Z m Z m Z d d l Z d d l Z e � Z yA d d l Z d d l
Z d d l Z d d l Z e j
d � Wn e k
r� n Xd d l Z d d l m Z e j e � Z d � Z d e f d � � YZ d � Z d d
� Z d � Z d e f d
� � YZ d d � Z d d d d d � Z d � Z
d � Z! d � Z" d � Z# d S( u2
Query and modify an LDAP database (alternative interface)
=========================================================
.. versionadded:: 2016.3.0
This is an alternative to the ``ldap`` interface provided by the
:py:mod:`ldapmod <salt.modules.ldapmod>` execution module.
:depends: - ``ldap`` Python module
i ( t absolute_importt print_functiont unicode_literalsNu ldap( t sixc C@ s t t t � � S( u: Only load this module if the Python ldap module is present( t boolt lent available_backends( ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyt __virtual__" s t LDAPErrorc B@ s e Z d Z d d � Z RS( u Base class of all LDAP exceptions raised by backends.
This is only used for errors encountered while interacting with
the LDAP server; usage errors (e.g., invalid backend name) will
have a different type.
:ivar cause: backend exception object, if applicable
c C@ s# t t | � j | � | | _ d S( N( t superR t __init__t cause( t selft messageR ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyR
0 s N( t __name__t
__module__t __doc__t NoneR
( ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyR ' s c C@ s^ d j t | � � | f } t j rD t j t | t j � d � n t j t | � | � d S( u? Convert an ldap backend exception to an LDAPError and raise it.u exception in ldap backend: {0}i N( t formatt reprR t PY2t reraiseR t syst exc_infot
raise_from( t et args( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyt _convert_exception5 s c C@ s | d k r d S| j d d � } | d k r2 d S| d k ri | j | j d d � | j d d � � n� | d k rt t j | j d d � j � � } | j d
d � } | d k r� i } n | | j d g � | j d i � � } | j | j d d � | � n t d
| d � � d S( u Bind helper.Nu methodu simpleu dnu u passwordu saslu mechanismu EXTERNALu credentialsu argsu kwargsu unsupported bind method "u& "; supported bind methods: simple sasl( R t gett
simple_bind_st getattrt ldapt saslt lowert sasl_interactive_bind_st
ValueError( t lt bindt methodt
sasl_classt credst auth( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyt _bind> s" + ' c C@ s d j | � j d � S( u% Formats a string per Microsoft AD password specifications.
The string must be enclosed in double quotes and UTF-16 encoded.
See: https://msdn.microsoft.com/en-us/library/cc223248.aspx
:param pwd:
The desired password as a string
:returns:
A unicode string
u "{0}"u utf-16-le( R t encode( t pwd( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyt _format_unicode_passwordT s t _connect_ctxc B@ s# e Z d � Z d � Z d � Z RS( c C@ s
| | _ d S( N( t c( R R/ ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyR
c s c C@ s | S( N( ( R ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyt __enter__f s c G@ s d S( N( ( R t exc( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyt __exit__i s ( R R R
R0 R2 ( ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyR. b s c C@ sq t | t � r | S| d k r( i } n | j d d � } | t k rb t d d j | � � � n | j d d � } y�t j | � } t j | _
| j d d � } | d k r� i } n i } x� t j | � D]� \ } } | d k r� t
| | <q� | d k r9| j t t d | j � � t t d | j � � � q� | j t t d | j � � | � q� W| j d t � r| j � n | j d t � r�| j t j d
� n | j t j d
� | j d d � } | d k r�i } n xF t j | � D]5 \ } } t t d | j � � } | j | | � q�Wt | | j d d � � Wn t j k
rf}
t |
� n Xt | � S( u� Connect and optionally bind to an LDAP server.
:param connect_spec:
This can be an LDAP connection object returned by a previous
call to :py:func:`connect` (in which case the argument is
simply returned), ``None`` (in which case an empty dict is
used), or a dict with the following keys:
* ``'backend'``
Optional; default depends on which Python LDAP modules are
installed. Name of the Python LDAP module to use. Only
``'ldap'`` is supported at the moment.
* ``'url'``
Optional; defaults to ``'ldapi:///'``. URL to the LDAP
server.
* ``'bind'``
Optional; defaults to ``None``. Describes how to bind an
identity to the LDAP connection. If ``None``, an
anonymous connection is made. Valid keys:
* ``'method'``
Optional; defaults to ``None``. The authentication
method to use. Valid values include but are not
necessarily limited to ``'simple'``, ``'sasl'``, and
``None``. If ``None``, an anonymous connection is
made. Available methods depend on the chosen backend.
* ``'mechanism'``
Optional; defaults to ``'EXTERNAL'``. The SASL
mechanism to use. Ignored unless the method is
``'sasl'``. Available methods depend on the chosen
backend and the server's capabilities.
* ``'credentials'``
Optional; defaults to ``None``. An object specific to
the chosen SASL mechanism and backend that represents
the authentication credentials. Ignored unless the
method is ``'sasl'``.
For the ``'ldap'`` backend, this is a dictionary. If
``None``, an empty dict is used. Keys:
* ``'args'``
Optional; defaults to an empty list. A list of
arguments to pass to the SASL mechanism
constructor. See the SASL mechanism constructor
documentation in the ``ldap.sasl`` Python module.
* ``'kwargs'``
Optional; defaults to an empty dict. A dict of
keyword arguments to pass to the SASL mechanism
constructor. See the SASL mechanism constructor
documentation in the ``ldap.sasl`` Python module.
* ``'dn'``
Optional; defaults to an empty string. The
distinguished name to bind.
* ``'password'``
Optional; defaults to an empty string. Password for
binding. Ignored if the method is ``'sasl'``.
* ``'tls'``
Optional; defaults to ``None``. A backend-specific object
containing settings to override default TLS behavior.
For the ``'ldap'`` backend, this is a dictionary. Not all
settings in this dictionary are supported by all versions
of ``python-ldap`` or the underlying TLS library. If
``None``, an empty dict is used. Possible keys:
* ``'starttls'``
If present, initiate a TLS connection using StartTLS.
(The value associated with this key is ignored.)
* ``'cacertdir'``
Set the path of the directory containing CA
certificates.
* ``'cacertfile'``
Set the pathname of the CA certificate file.
* ``'certfile'``
Set the pathname of the certificate file.
* ``'cipher_suite'``
Set the allowed cipher suite.
* ``'crlcheck'``
Set the CRL evaluation strategy. Valid values are
``'none'``, ``'peer'``, and ``'all'``.
* ``'crlfile'``
Set the pathname of the CRL file.
* ``'dhfile'``
Set the pathname of the file containing the parameters
for Diffie-Hellman ephemeral key exchange.
* ``'keyfile'``
Set the pathname of the certificate key file.
* ``'newctx'``
If present, instruct the underlying TLS library to
create a new TLS context. (The value associated with
this key is ignored.)
* ``'protocol_min'``
Set the minimum protocol version.
* ``'random_file'``
Set the pathname of the random file when
``/dev/random`` and ``/dev/urandom`` are not
available.
* ``'require_cert'``
Set the certificate validation policy. Valid values
are ``'never'``, ``'hard'``, ``'demand'``,
``'allow'``, and ``'try'``.
* ``'opts'``
Optional; defaults to ``None``. A backend-specific object
containing options for the backend.
For the ``'ldap'`` backend, this is a dictionary of
OpenLDAP options to set. If ``None``, an empty dict is
used. Each key is a the name of an OpenLDAP option
constant without the ``'LDAP_OPT_'`` prefix, then
converted to lower case.
:returns:
an object representing an LDAP connection that can be used as
the ``connect_spec`` argument to any of the functions in this
module (to avoid the overhead of making and terminating
multiple connections).
This object should be used as a context manager. It is safe
to nest ``with`` statements.
CLI example:
.. code-block:: bash
salt '*' ldap3.connect "{
'url': 'ldaps://ldap.example.com/',
'bind': {
'method': 'simple',
'dn': 'cn=admin,dc=example,dc=com',
'password': 'secret'}
}"
u backendu ldapu- unsupported backend or required Python moduleu unavailable: {0}u urlu ldapi:///u tlsu starttlsu newctxu crlchecku require_certu
OPT_X_TLS_i u optsu OPT_u bindN( u starttlsu newctx( u crlchecku require_cert( t
isinstanceR. R R R R# R R t
initializet VERSION3t protocol_versionR t iteritemst Truet
set_optionR t uppert Falset start_tls_st OPT_X_TLS_NEWCTXt
OPT_REFERRALSR* R R ( t connect_spect backend_namet urlR$ t tlst varst kt vt optst optR ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyt connectm sL �
'
u subtreeu (objectClass=*)c C@ s� t | � } t t d | j � � } y" | j j | | | | | � } Wn9 t j k
rc g } n t j k
r� } t | � n Xt | � S( u� Search an LDAP database.
:param connect_spec:
See the documentation for the ``connect_spec`` parameter for
:py:func:`connect`.
:param base:
Distinguished name of the entry at which to start the search.
:param scope:
One of the following:
* ``'subtree'``
Search the base and all of its descendants.
* ``'base'``
Search only the base itself.
* ``'onelevel'``
Search only the base's immediate children.
:param filterstr:
String representation of the filter to apply in the search.
:param attrlist:
Limit the returned attributes to those in the specified list.
If ``None``, all attributes of each entry are returned.
:param attrsonly:
If non-zero, don't return any attribute values.
:returns:
a dict of results. The dict is empty if there are no results.
The dict maps each returned entry's distinguished name to a
dict that maps each of the matching attribute names to a list
of its values.
CLI example:
.. code-block:: bash
salt '*' ldap3.search "{
'url': 'ldaps://ldap.example.com/',
'bind': {
'method': 'simple',
'dn': 'cn=admin,dc=example,dc=com',
'password': 'secret',
},
}" "base='dc=example,dc=com'"
u SCOPE_(
RH R R R: R/ t search_st NO_SUCH_OBJECTR R t dict( R? t baset scopet filterstrt attrlistt attrsonlyR$ t resultsR ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyt search5 s 4 " c C@ s� t | � } t d � t j | � D� � } t j d t | � t | � � d | k r� g | d D] } t | � ^ qa | d <n t j j
| � f } y | j j | | � Wn t j
k
r� } t | � n Xt S( u� Add an entry to an LDAP database.
:param connect_spec:
See the documentation for the ``connect_spec`` parameter for
:py:func:`connect`.
:param dn:
Distinguished name of the entry.
:param attributes:
Non-empty dict mapping each of the new entry's attributes to a
non-empty iterable of values.
:returns:
``True`` if successful, raises an exception otherwise.
CLI example:
.. code-block:: bash
salt '*' ldap3.add "{
'url': 'ldaps://ldap.example.com/',
'bind': {
'method': 'simple',
'password': 'secret',
},
}" "dn='dc=example,dc=com'" "attributes={'example': 'values'}"
c s@ s6 | ], \ } } | t j j j t | � � f Vq d S( N( t saltt utilst dataR+ t list( t .0t attrt vals( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pys <genexpr>� s u# adding entry: dn: %s attributes: %su
unicodePwd( RH RK R R7 t logt infoR R- R t modlistt
addModlistR/ t add_sR R R8 ( R? t dnt
attributesR$ t xR\ R ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyt addt s *c C@ s] t | � } t j d t | � � y | j j | � Wn t j k
rX } t | � n Xt S( u6 Delete an entry from an LDAP database.
:param connect_spec:
See the documentation for the ``connect_spec`` parameter for
:py:func:`connect`.
:param dn:
Distinguished name of the entry.
:returns:
``True`` if successful, raises an exception otherwise.
CLI example:
.. code-block:: bash
salt '*' ldap3.delete "{
'url': 'ldaps://ldap.example.com/',
'bind': {
'method': 'simple',
'password': 'secret'}
}" dn='cn=admin,dc=example,dc=com'
u deleting entry: dn: %s(
RH RZ R[ R R/ t delete_sR R R R8 ( R? R_ R$ R ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyt delete� s c C@ s t | � } g | D]7 \ } } } t t d | j � � | t | � f ^ q } xe t | � D]W \ } } | d d k r] | d | d g | d D] }
t |
� ^ q� f | | <q] q] Wt j j j
| d t d t �} y | j j
| | � Wn t j k
r} t | � n Xt S( u� Modify an entry in an LDAP database.
:param connect_spec:
See the documentation for the ``connect_spec`` parameter for
:py:func:`connect`.
:param dn:
Distinguished name of the entry.
:param directives:
Iterable of directives that indicate how to modify the entry.
Each directive is a tuple of the form ``(op, attr, vals)``,
where:
* ``op`` identifies the modification operation to perform.
One of:
* ``'add'`` to add one or more values to the attribute
* ``'delete'`` to delete some or all of the values from the
attribute. If no values are specified with this
operation, all of the attribute's values are deleted.
Otherwise, only the named values are deleted.
* ``'replace'`` to replace all of the attribute's values
with zero or more new values
* ``attr`` names the attribute to modify
* ``vals`` is an iterable of values to add or delete
:returns:
``True`` if successful, raises an exception otherwise.
CLI example:
.. code-block:: bash
salt '*' ldap3.modify "{
'url': 'ldaps://ldap.example.com/',
'bind': {
'method': 'simple',
'password': 'secret'}
}" dn='cn=admin,dc=example,dc=com'
directives="('add', 'example', ['example_val'])"
u MOD_i u
unicodePwdi i t to_strt preserve_tuples( RH R R R: RV t enumerateR- RS RT RU t decodeR8 R/ t modify_sR R ( R? R_ t
directivesR$ t opRX RY R\ t idxt modRa R ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyt modify� s / A1!c C@ s� t | � } t d � t j | � D� � } t d � t j | � D� � } d | k r� g | d D] } t | � ^ qa | d <n t j j | | � } y | j j | | � Wn t j
k
r� } t | � n Xt S( u� Modify an entry in an LDAP database.
This does the same thing as :py:func:`modify`, but with a simpler
interface. Instead of taking a list of directives, it takes a
before and after view of an entry, determines the differences
between the two, computes the directives, and executes them.
Any attribute value present in ``before`` but missing in ``after``
is deleted. Any attribute value present in ``after`` but missing
in ``before`` is added. Any attribute value in the database that
is not mentioned in either ``before`` or ``after`` is not altered.
Any attribute value that is present in both ``before`` and
``after`` is ignored, regardless of whether that attribute value
exists in the database.
:param connect_spec:
See the documentation for the ``connect_spec`` parameter for
:py:func:`connect`.
:param dn:
Distinguished name of the entry.
:param before:
The expected state of the entry before modification. This is
a dict mapping each attribute name to an iterable of values.
:param after:
The desired state of the entry after modification. This is a
dict mapping each attribute name to an iterable of values.
:returns:
``True`` if successful, raises an exception otherwise.
CLI example:
.. code-block:: bash
salt '*' ldap3.change "{
'url': 'ldaps://ldap.example.com/',
'bind': {
'method': 'simple',
'password': 'secret'}
}" dn='cn=admin,dc=example,dc=com'
before="{'example_value': 'before_val'}"
after="{'example_value': 'after_val'}"
c s@ s6 | ], \ } } | t j j j t | � � f Vq d S( N( RS RT RU R+ RV ( RW RX RY ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pys <genexpr>; s c s@ s6 | ], \ } } | t j j j t | � � f Vq d S( N( RS RT RU R+ RV ( RW RX RY ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pys <genexpr>= s u
unicodePwd(
RH RK R R7 R- R R\ t
modifyModlistR/ Ri R R R8 ( R? R_ t beforet afterR$ Ra R\ R ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyt change s / *($ R t
__future__R R R t loggingR t setR R t ldap.ldapobjectt ldap.modlistt ldap.saslRb t ImportErrort salt.utils.dataRS t salt.extR t getLoggerR RZ R t ExceptionR R R R* R- t objectR. RH RR Rd Rn Rr ( ( ( s6 /usr/lib/python2.7/site-packages/salt/modules/ldap3.pyt <module> s8
�> 0 ! C
Mini Shell