Current File : //usr/lib/python2.7/site-packages/salt/pillar/pillar_ldap.pyc
�
���^c @@ s� d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l m
Z
d d l Z y d d l Z e
Z Wn e k
r� e Z n Xe j e � Z d � Z d � Z d d � Z d � Z d � Z d
� Z d S( uP
Use LDAP data as a Pillar source
This pillar module executes a series of LDAP searches.
Data returned by these searches are aggregated, whereby data returned by later
searches override data by previous searches with the same key.
The final result is merged with existing pillar data.
The configuration of this external pillar module is done via an external
file which provides the actual configuration for the LDAP searches.
===============================
Configuring the LDAP ext_pillar
===============================
The basic configuration is part of the `master configuration
<master-configuration-ext-pillar>`_.
.. code-block:: yaml
ext_pillar:
- pillar_ldap: /etc/salt/master.d/pillar_ldap.yaml
.. note::
When placing the file in the ``master.d`` directory, make sure its name
doesn't end in ``.conf``, otherwise the salt-master process will attempt
to parse its content.
.. warning::
Make sure this file has very restrictive permissions, as it will contain
possibly sensitive LDAP credentials!
The only required key in the master configuration is ``pillar_ldap`` pointing
to a file containing the actual configuration.
Configuring the LDAP searches
=============================
The file is processed using `Salt's Renderers <renderers>` which makes it
possible to reference grains within the configuration.
.. warning::
When using Jinja in this file, make sure to do it in a way which prevents
leaking sensitive information. A rogue minion could send arbitrary grains
to trick the master into returning secret data.
Use only the 'id' grain which is verified through the minion's key/cert.
Map Mode
--------
The ``it-admins`` configuration below returns the Pillar ``it-admins`` by:
- filtering for:
- members of the group ``it-admins``
- objects with ``objectclass=user``
- returning the data of users, where each user is a dictionary containing the
configured string or list attributes.
Configuration
*************
.. code-block:: yaml
salt-users:
server: ldap.company.tld
port: 389
tls: true
dn: 'dc=company,dc=tld'
binddn: 'cn=salt-pillars,ou=users,dc=company,dc=tld'
bindpw: bi7ieBai5Ano
referrals: false
anonymous: false
mode: map
dn: 'ou=users,dc=company,dc=tld'
filter: '(&(memberof=cn=it-admins,ou=groups,dc=company,dc=tld)(objectclass=user))'
attrs:
- cn
- displayName
- givenName
- sn
lists:
- memberOf
search_order:
- salt-users
Result
******
.. code-block:: python
{
'salt-users': [
{
'cn': 'cn=johndoe,ou=users,dc=company,dc=tld',
'displayName': 'John Doe'
'givenName': 'John'
'sn': 'Doe'
'memberOf': [
'cn=it-admins,ou=groups,dc=company,dc=tld',
'cn=team01,ou=groups,dc=company'
]
},
{
'cn': 'cn=janedoe,ou=users,dc=company,dc=tld',
'displayName': 'Jane Doe',
'givenName': 'Jane',
'sn': 'Doe',
'memberOf': [
'cn=it-admins,ou=groups,dc=company,dc=tld',
'cn=team02,ou=groups,dc=company'
]
}
]
}
i ( t absolute_importt print_functiont unicode_literalsN( t SaltInvocationErrorc C@ s t r
d St Sd S( u1
Only return if ldap module is installed
u pillar_ldapN( t HAS_LDAPt False( ( ( s; /usr/lib/python2.7/site-packages/salt/pillar/pillar_ldap.pyt __virtual__� s c C@ sO t j j | � \ } } t j d t j | � � } | j | � } | j t � S( uB
Render config template, substituting grains where found.
t loader( t ost patht splitt jinja2t Environmentt FileSystemLoadert get_templatet rendert
__grains__( t config_filet dirnamet filenamet envt template( ( s; /usr/lib/python2.7/site-packages/salt/pillar/pillar_ldap.pyt _render_template� s c C@ sA y | | } Wn t k
r' | } n Xt j j j | d t �S( u�
Return a value for 'name' from the config file options. If the 'name' is
not in the config, the 'default' value is returned. This method converts
unicode values to str type under python 2.
t to_str( t KeyErrort saltt utilst datat decodet True( t namet conft defaultt value( ( s; /usr/lib/python2.7/site-packages/salt/pillar/pillar_ldap.pyt _config� s
c C@ s� t d | � p g } t d | � p' g } t d | � p< d } t d | � pQ d } | d k rRg | | <x8| D]� } i } d | k s� d | k r� t j d | d
� | d
| d <n | d } t j d | � xc | D][ }
|
| k rx$ | j |
� D] } | | |
<q� Wn |
| k r� | j |
� | |
<q� q� W| | j | � qq WnS| d
k r�i | | <x:| D]?} i } | d
} t j d | � d | k s�d | k r�| | d <n | d } t j d | � xc | D][ }
|
| k rx$ | j |
� D] } | | |
<q�Wn |
| k r�| j |
� | |
<q�q�W| d k rO| }
n! d j t | j | g � � � }
y | | |
j | � Wqot k
r�| g | | |
<qoXqoWn� | d k r�x� | d
d D]� }
|
| k r!x� | j |
� D]( } | j d d � \ } } | | | <q�Wq�|
| k r�xn | j |
� D]Z } d | k r=| j d d � \ } } | | k r�| g | | <q�| | j | � q=q=Wq�q�Wn | S( u�
Aggregates LDAP search result based on rules, returns a dictionary.
Rules:
Attributes tagged in the pillar config as 'attrs' or 'lists' are
scanned for a 'key=value' format (non matching entries are ignored.
Entries matching the 'attrs' tag overwrite previous values where
the key matches a previous result.
Entries matching the 'lists' tag are appended to list of values where
the key matches a previous result.
All Matching entries are then written directly to the pillar data
dictionary as data[key] = value.
For example, search result:
{ saltKeyValue': ['ntpserver=ntp.acme.local', 'foo=myfoo'],
'saltList': ['vhost=www.acme.net', 'vhost=www.acme.local'] }
is written to the pillar data dictionary as:
{ 'ntpserver': 'ntp.acme.local', 'foo': 'myfoo',
'vhost': ['www.acme.net', 'www.acme.local'] }
u attrsu listsu
dict_key_attru dnu modeu splitu mapu distinguishedNameu dn: %si i u
record: %su dictu ,u =( u dnu distinguishedName( R" t logt debugt gett appendt joint sortedR R
( R t resultR t sourcet attrst listst
dict_key_attrt modet recordt rett keyt itemt distinguished_namet dict_keyt skeyt sval( ( s; /usr/lib/python2.7/site-packages/salt/pillar/pillar_ldap.pyt _result_to_dict� sr
!
"c C@ s{ i } x3 d d d d d d g D] } t | | � | | <q W| d r] | d r] t | d <n y | d } Wn t k
r� t d � � n Xt d | � } t d
| � } t d | � p� g } t d | � p� g } t d
| d � } | | | g } | sd } n y$ t d | | | | | � d }
WnK t k
rRt j d | � i }
n% t k
rvt j
d d t �i SX|
S( u�
Builds connection and search arguments, performs the LDAP search and
formats the results as a dictionary appropriate for pillar use.
u serveru portu tlsu binddnu bindpwu anonymousu filteru missing filteru dnu scopeu listsu attrsu
dict_key_attru ldap.searchu resultsu- LDAP search returned no results for filter %su* Failed to retrieve pillar data from LDAP:
t exc_infoN( R" R R R t Nonet __salt__t
IndexErrorR# R$ t Exceptiont criticalR ( R t connargsR t _filtert _dnt scopet _listst _attrst _dict_key_attrR+ R) ( ( s; /usr/lib/python2.7/site-packages/salt/pillar/pillar_ldap.pyt
_do_search s8
c C@ s� d } y t | � } WnM t j j k
r? t j d | � n' t k
re t j d | d t �n X| sp i Sd d l } y) | j
j j | � p� i } | | d <Wng t k
r} d d l
} d } | j j � r� t j | j | | � � n t | j | | � � i SXt | t � s2t j d | � i Sd | k rOt j d
� i Si } xY | d D]M } | | }
t |
� } t j d | | � | r`t | | |
| � } q`q`W| S( u>
Execute LDAP searches and return the aggregated data
u* pillar_ldap: missing configuration file %su- pillar_ldap: failed to render template for %sR8 i Nu conf_fileu8 pillar_ldap: error parsing configuration file: {0} - {1}un pillar_ldap: %s is invalidly formatted, must be a YAML dictionary. See the documentation for more information.u search_orderua pillar_ldap: search_order missing from configuration. See the documentation for more information.u source %s got result %s( R9 R R t
exceptionst TemplateNotFoundR# R$ R< R t salt.utils.yamlR t yamlt safe_loadt salt.logt is_console_configuredt warningt formatt printt
isinstancet dictRE R7 ( t minion_idt pillarR t config_templateR t optst errt msgR R* t configR) ( ( s; /usr/lib/python2.7/site-packages/salt/pillar/pillar_ldap.pyt
ext_pillar5 sL
( t __doc__t
__future__R R R R t loggingt salt.utils.dataR t salt.exceptionsR R t ldapR R t ImportErrorR t getLoggert __name__R# R R R9 R" R7 RE RY ( ( ( s; /usr/lib/python2.7/site-packages/salt/pillar/pillar_ldap.pyt <module>{ s$
[ '
Mini Shell