Current File : //usr/lib/python2.7/site-packages/salt/auth/ldap.pyc
�
���^c @@ s� d Z d d l m Z m Z m Z d d l Z d d l Z d d l m Z d d l m
Z
m Z d d l Z
d d l Z
e j e � Z d d l m Z y. d d l Z d d l Z d d l Z e Z Wn e k
r� e Z n Xi d d 6d d 6d
d 6d d
6e d 6e d 6e d 6e d 6d d 6d d 6d d 6d d 6d d 6d d 6e d 6e d 6g d 6Z e d d! � Z d" � Z d# e f d$ � � YZ e d d% � Z! e d d& � Z" d' � Z# d( � Z$ d d) � Z% d d* � Z& d S(+ uR
Provide authentication using simple LDAP binds
:depends: - ldap Python module
i ( t absolute_importt print_functiont unicode_literalsN( t six( t CommandExecutionErrort SaltInvocationError( t Environmentu u auth.ldap.basednu
auth.ldap.uriu localhostu auth.ldap.serveru 389u auth.ldap.portu auth.ldap.starttlsu
auth.ldap.tlsu auth.ldap.no_verifyu auth.ldap.anonymousi u auth.ldap.scopeu Groupsu auth.ldap.groupouu memberUidu auth.ldap.accountattributenameu memberOfu auth.ldap.groupattributeu personu auth.ldap.persontypeu
posixGroupu auth.ldap.groupclassu auth.ldap.activedirectoryu auth.ldap.freeipau auth.ldap.minion_stripdomainsc C@ s� y3 | r | d j | � } n t d j | � } Wna t k
r� y t d j | � } Wq� t k
r� | r� d j | � } t | � � n t SXn X| S( uP
Return a value for 'name' from master config file options or defaults.
u
auth.ldap.{0}u& missing auth.ldap.{0} in master config( t formatt __opts__t KeyErrort __defopts__R t False( t keyt mandatoryt optst valuet msg( ( s2 /usr/lib/python2.7/site-packages/salt/auth/ldap.pyt _config3 s
c C@ s2 t � } | j | � } i | d 6} | j | � S( uD
Render config template, substituting username where found.
u username( R t from_stringt render( t paramt usernamet envt templatet variables( ( s2 /usr/lib/python2.7/site-packages/salt/auth/ldap.pyt _render_templateG s
t _LDAPConnectionc B@ s e Z d Z e d � Z RS( u#
Setup an LDAP connection.
c C@ s� | | _ | | _ | | _ | | _ | | _ | | _ | | _ t sT t d � � n | j ru | j ru t d � � n | r� d n d } | j d k r� d j | | j | j � | _ n y� | r� t
j t
j t
j
� n t
j d j | j � � | _
d | j
_ | j
j t
j d � | s�| j d
k sCt | j � d
k rRt d � � n | j rk| j
j � n | j
j | j | j � n Wn4 t k
r�}
t d j | j | j |
� � � n Xd
S( uE
Bind to an LDAP directory using passed credentials.
uz LDAP connection could not be made, the python-ldap module is not installed. Install python-ldap to use LDAP external auth.uV Cannot bind with both starttls and tls enabled.Please enable only one of the protocolsu ldapsu ldapu u
{0}://{1}:{2}u {0}i i i uW LDAP bind password is not set: password cannot be empty if auth.ldap.anonymous is Falseu- Failed to bind to LDAP server {0} as {1}: {2}N( t urit servert portt starttlst tlst binddnt bindpwt HAS_LDAPR R t ldapt
set_optiont OPT_X_TLS_REQUIRE_CERTt OPT_X_TLS_NEVERt
initializet protocol_versiont
OPT_REFERRALSt Nonet lent start_tls_st
simple_bind_st Exception( t selfR R R R R t no_verifyR R! t anonymoust accountattributenamet activedirectoryt schemat
ldap_error( ( s2 /usr/lib/python2.7/site-packages/salt/auth/ldap.pyt __init__V sD !
$ ( t __name__t
__module__t __doc__R R6 ( ( ( s2 /usr/lib/python2.7/site-packages/salt/auth/ldap.pyR Q s c
C@ s> i } i d d d d d d d d d g d
6d d d
d d g d 6} i } x( | d
D] } t | d | �| | <qU Wx. | d D]" } t | d t d | �| | <q� W| | d <| d r� | d | d <| d r� | d
j d � q� n x | d
D] } | | | | <q� W| d s:| d r:| d r:t | � j Sn d S( u�
Bind with binddn and bindpw only for searching LDAP
:param anonymous: Try binding anonymously
:param opts: Pass in when __opts__ is not available
:return: LDAPConnection object
u uriu serveru portu starttlsu tlsu no_verifyu anonymousu accountattributenameu activedirectoryu mandatoryu binddnu bindpwu filteru
groupclassu auth_by_group_membership_onlyu
additionalR R
N( R R t appendR R# ( R1 R t connargst paramst paramvaluesR t name( ( s2 /usr/lib/python2.7/site-packages/salt/auth/ldap.pyt _bind_for_search� s,
c
C@ s� t d d | �} t d d | �} i } i d d d d d d d
d d g d
6d d d d d g d 6} i } x( | d
D] } t | d | �| | <qy Wx. | d D]" } t | d t d | �| | <q� W| | d
<| d rt | d | � | d <t j j | d � | d <n | d rHt j j | � }
t | d |
� | d <n | d r�| d | d <| d r�| d
j d � q�n x | d
D] } | | | | <q�W| d
s�| d r�| d r�t | � j } t j d | d | | � | j
| t | � | d � }
t |
� d k r0t j
d | � t St |
� d k r�g |
D] } | d ^ qI} t d � | D� � } | d k r�t j d | � t S| d k r�t j d | � t Sn |
d d | d <n | d r | d r | d | d <q n& | d r | d r | d | d <n | | d <| d
r@t j d � n t j d | d � y t | � j } WnE t k
r�| j d d" � t j d | � t j d d t �t SXt j d! | d � | S(# u'
Authenticate via an LDAP bind
u basednR u scopeu uriu serveru portu starttlsu tlsu no_verifyu anonymousu accountattributenameu activedirectoryu mandatoryu binddnu bindpwu filteru
groupclassu auth_by_group_membership_onlyu
additionalR
u; Running LDAP user dn search with filter:%s, dn:%s, scope:%si u Unable to find user %si c s@ s! | ] } | d k r d Vq d S( i N( R* ( t .0t c( ( s2 /usr/lib/python2.7/site-packages/salt/auth/ldap.pys <genexpr> s u. LDAP lookup found multiple results for user %su/ LDAP lookup--unable to find CN matching user %su Attempting anonymous LDAP bindu% Attempting LDAP bind with user dn: %su+ Failed to authenticate user dn via LDAP: %su& Error authenticating user dn via LDAP:t exc_infou/ Successfully authenticated user dn via LDAP: %sN( R R R R# t filtert escape_filter_charsR: R t logt debugt search_st intR+ t warningt sumt errorR. t popR* t True( R t passwordR1 R t basednt scopeR; R< R= R t escaped_usernameR> t _ldapt resultt tupt cnst total_not_nonet ldap_conn( ( s2 /usr/lib/python2.7/site-packages/salt/auth/ldap.pyt _bind� s�
c C@ s t s t j d � t Sd
} t d d t �r� t d d t �r� t d t d d t �� } | r� | r� | r� t | | d t d d t �o� t d d t ��} q� n3 t | | d t d d t �o� t d d t ��} | r� t j d � | St j d � t S( u
Simple LDAP auth
u/ LDAP authentication requires python-ldap moduleu binddnR
u bindpwR1 u anonymousu auth_by_group_membership_onlyu LDAP authentication successfulu LDAP _bind authentication FAILEDN( R" RE RK R R* R R? RX RF ( R RN t bindt search_bind( ( s2 /usr/lib/python2.7/site-packages/salt/auth/ldap.pyt auth% s$
$
c K@ s g } t d d t �rH t d d t �rH t d t d d t �� } n? t | | j d d � d t d d t �o� t d d t ��} | rt j d � t d
� rEyO d j t d � | t d
� � } | j t d � t j
| t d � g � } Wn$ t k
r} t j
d | � | SX| s6t j
d | � | St j j | d d � } d j | t d � � } t j d | � yF | j t d � t j
| t j j j t d � � t d � g � } Wn$ t k
r�} t j
d | � | SXxG | D]? \ }
} d | k r�| j t j j j | d d � � q�q�Wt j d | | � qt d � r�t j j | � } t d � }
t t d � | � } | j |
t j
| t j j j t d � � t j j j t d � � t d � g � } x� | D]� \ } } x� t j | j t d � g � | j t d � g � � D]e } | t j j j | � j d � d j d � d k r"| j | j d � d j d � d � q"q"Wq�Wt j d | | � t | | d � s�t j
d � g Sqt d! � r�d" j t d! � t d � � }
n d# j t d � � }
d j t d � | t d � � } | j |
t j
| t j j j t d � � t d � t j j j t d � � g � } x` | D]X \ }
} | t j j j | t d � � k r�| j t j j j | d d � � q�q�Wx� | D]� \ } } | t j j j | � j d � d j d � d k r�x` t j j j | t d � � D]< } | j t j j j | � j d � d j d � d � qKWq�q�Wt j d | | � d$ | k rt | | j d � d t d d t �o�t d d t �� rt j
d � g Sn
t j
d% � | S(& u�
Authenticate against an LDAP group
Behavior is highly dependent on if Active Directory is in use.
AD handles group membership very differently than OpenLDAP.
See the :ref:`External Authentication <acl-eauth>` documentation for a thorough
discussion of available parameters for customizing the search.
OpenLDAP allows you to search for all groups in the directory
and returns members of those groups. Then we check against
the username entered.
u binddnR
u bindpwR1 u anonymousu passwordu u auth_by_group_membership_onlyu2 ldap bind to determine group membership succeeded!u activedirectoryu (&({0}={1})(objectClass={2}))u accountattributenameu
persontypeu basednu distinguishedNameu3 Exception thrown while looking up user DN in AD: %su, Could not get distinguished name for user %si u (&(member={0})(objectClass={1}))u
groupclassu( Running LDAP group membership search: %su cnu< Exception thrown while retrieving group membership in AD: %su! User %s is a member of groups: %su freeipau group_basednu group_filteru groupattributeu ,u =i����u' LDAP username and password do not matchu groupouu
ou={0},{1}u {0}u show_jidu/ ldap bind to determine group membership FAILED!( R R R? RX t getRE RF R RG R# t
SCOPE_SUBTREEt strR. RK RC RD t saltt utilst stringutilst to_strR: t
to_unicodeR t itertoolst chaint splitR[ t datat decode( R t kwargst
group_listRY t get_user_dn_searcht user_dn_resultst et dnt ldap_search_stringt search_resultst _t entryRQ t search_baset
search_stringRS t usert group( ( s2 /usr/lib/python2.7/site-packages/salt/auth/ldap.pyt groupsE s� $
. + B 52
! !%+5&A!
c C@ s� t d | � } g } x�| D]�} t | t � sD | j | � q n x}t j | � D]l\ } } | } g } | j d � r�| j d � j d � } d }
y� | j | t
j |
t d � g � } x� | D]� } yw | d d d j
� }
| j d d � r6x9 | d D]* } |
j | � r|
t | � }
PqqWn | j |
� Wq� t k
rWq� Xq� Wx" | D] }
| j i | |
6� qcWt j d | � Wq�t
j k
r�q�XqT | j i | | 6� qT Wq Wt j d
| � | S( u�
:param entries: ldap subtree in external_auth config option
:param opts: Opts to use when __opts__ not defined
:return: Dictionary with all allowed operations
Takes the ldap subtree in the external_auth config option and expands it
with actual minion names
webadmins%: <all users in the AD 'webadmins' group>
- server1
- .*
- ldap(OU=webservers,dc=int,dc=bigcompany,dc=com)
- test.ping
- service.restart
- ldap(OU=Domain Controllers,dc=int,dc=bigcompany,dc=com)
- allowed_fn_list_attribute^
This function only gets called if auth.ldap.activedirectory = True
R u ldap(u )u (objectClass=computer)u cni i u auth.ldap.minion_stripdomainsu Expanded acl_tree is: %su __expand_ldap_entries: %sN( R? t
isinstancet dictR: R t iteritemst
startswitht lstript rstripRG R# R] R^ t lowerR\ R* t endswithR+ t TypeErrorRE t tracet NO_SUCH_OBJECT( t entriesR RY t acl_treet user_or_group_dictt minion_or_out matcherst permissionst retrieved_minion_idsRs Rt Rp t
ldap_matcht minion_idt domain( ( s2 /usr/lib/python2.7/site-packages/salt/auth/ldap.pyt __expand_ldap_entries� sH
c C@ s� g } x[ | D]S } t | t j � r+ q
n | j g | j � D] } | j d � r> | ^ q> � q
W| r| t | | � } n | S( u+
Query LDAP, retrieve list of minion_ids from an OU or other search.
For each minion_id returned from the LDAP search, copy the perms
matchers into the auth dictionary
:param auth_list:
:param opts: __opts__ for when __opts__ is not injected
:return: Modified auth list.
u ldap(( Rx R t string_typest extendt keysR{ R� ( t auth_listR t ou_namest itemt potential_ou( ( s2 /usr/lib/python2.7/site-packages/salt/auth/ldap.pyt process_acl� s
9(' R9 t
__future__R R R t loggingRd t salt.extR t salt.exceptionsR R t salt.utils.stringutilsR_ t salt.utils.datat getLoggerR7 RE t jinja2R R# t ldap.modlistt ldap.filterRM R" t ImportErrorR R
R* R R t objectR R? RX R[ Rw R� R� ( ( ( s2 /usr/lib/python2.7/site-packages/salt/auth/ldap.pyt <module> sT
;.k r F
Mini Shell