Don't think we need to refer to these anymore :)
This commit is contained in:
parent
9960e20e42
commit
a9fe69b27b
2 changed files with 0 additions and 566 deletions
|
|
@ -1,553 +0,0 @@
|
|||
# -*- coding: utf-8 -*-
|
||||
#
|
||||
# Copyright © 2007 Red Hat, Inc. All rights reserved.
|
||||
#
|
||||
# This copyrighted material is made available to anyone wishing to use, modify,
|
||||
# copy, or redistribute it subject to the terms and conditions of the GNU
|
||||
# General Public License v.2. This program is distributed in the hope that it
|
||||
# will be useful, but WITHOUT ANY WARRANTY expressed or implied, including the
|
||||
# implied warranties of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|
||||
# See the GNU General Public License for more details. You should have
|
||||
# received a copy of the GNU General Public License along with this program;
|
||||
# if not, write to the Free Software Foundation, Inc., 51 Franklin Street,
|
||||
# Fifth Floor, Boston, MA 02110-1301, USA. Any Red Hat trademarks that are
|
||||
# incorporated in the source code or documentation are not subject to the GNU
|
||||
# General Public License and may only be used or replicated with the express
|
||||
# permission of Red Hat, Inc.
|
||||
#
|
||||
# Author(s): Mike McGrath <mmcgrath@redhat.com>
|
||||
# Toshio Kuratomi <tkuratom@redhat.com>
|
||||
# Ricky Zhou <ricky@fedoraproject.org>
|
||||
#
|
||||
|
||||
'''
|
||||
python-fedora, python module to interact with Fedora Infrastructure Services
|
||||
'''
|
||||
|
||||
import ldap
|
||||
from ldap import modlist
|
||||
import time
|
||||
from random import Random
|
||||
import sha
|
||||
from base64 import b64encode
|
||||
import sys
|
||||
import os
|
||||
|
||||
dbName = 'fastest'
|
||||
|
||||
class AuthError(Exception):
|
||||
pass
|
||||
|
||||
def retrieve_db_info(dbKey):
|
||||
'''Retrieve information to connect to the db from the filesystem.
|
||||
|
||||
Arguments:
|
||||
:dbKey: The string identifying the database entry in the config file.
|
||||
|
||||
Returns: A dictionary containing the values to use in connecting to the
|
||||
database.
|
||||
|
||||
Exceptions:
|
||||
:IOError: Returned if the config file is not on the system.
|
||||
:AuthError: Returned if there is no record found for dbKey in the
|
||||
config file.
|
||||
'''
|
||||
# Open a filehandle to the config file
|
||||
if os.environ.has_key('HOME') and os.path.isfile(
|
||||
os.path.join(os.environ.get('HOME'), '.fedora-db-access')):
|
||||
fh = file(os.path.join(
|
||||
os.environ.get('HOME'), '.fedora-db-access'), 'r')
|
||||
elif os.path.isfile('/etc/sysconfig/fedora-db-access'):
|
||||
fh = file('/etc/sysconfig/fedora-db-access', 'r')
|
||||
else:
|
||||
raise IOError, 'fedora-db-access file does not exist.'
|
||||
|
||||
# Read the file until we get the information for the requested db
|
||||
dbInfo = None
|
||||
for line in fh.readlines():
|
||||
if not line:
|
||||
break
|
||||
line = line.strip()
|
||||
if not line or line[0] == '#':
|
||||
continue
|
||||
pieces = line.split(None, 1)
|
||||
if len(pieces) < 2:
|
||||
continue
|
||||
if pieces[0] == dbKey:
|
||||
dbInfo = eval(pieces[1])
|
||||
break
|
||||
|
||||
if fh:
|
||||
fh.close()
|
||||
if not dbInfo:
|
||||
raise AuthError, 'Authentication source "%s" not configured' % (dbKey,)
|
||||
return dbInfo
|
||||
|
||||
class Server(object):
|
||||
def __init__(self, server=None, who=None, password=None):
|
||||
pass
|
||||
#try:
|
||||
#dbInfo = retrieve_db_info(dbName)
|
||||
#except IOError:
|
||||
#raise AuthError, 'Authentication config file fedora-db-access is' \
|
||||
#' not available'
|
||||
#server = server or dbInfo['host'] or 'localhost'
|
||||
#who = 'cn=%s' % (who or dbInfo['user'])
|
||||
## Some db connections have no password
|
||||
#password = password or dbInfo.get('password')
|
||||
|
||||
#self.ldapConn = ldap.open(server)
|
||||
#self.ldapConn.simple_bind_s(who, password)
|
||||
|
||||
def add(self, base, attributes):
|
||||
''' Add a new group record to LDAP instance '''
|
||||
self.ldapConn.add_s(base, attributes.items())
|
||||
|
||||
def delete(self, base):
|
||||
''' Delete target base '''
|
||||
self.ldapConn.delete_s(base)
|
||||
|
||||
def modify(self, base, attribute, new, old=None):
|
||||
''' Modify an attribute, requires write access '''
|
||||
if new is None:
|
||||
return None
|
||||
new = unicode(new).encode('utf-8')
|
||||
if new == old:
|
||||
return None
|
||||
|
||||
#o = { attribute : old }
|
||||
#n = { attribute : new }
|
||||
|
||||
ldif = []
|
||||
ldif.append((ldap.MOD_DELETE,attribute,None))
|
||||
ldif.append((ldap.MOD_ADD,attribute,new))
|
||||
|
||||
#ldif = ldap.modlist.modifyModlist(o, n, ignore_oldexistent=1)
|
||||
# commit
|
||||
self.ldapConn.modify_s(base, ldif)
|
||||
|
||||
def search(self, base, ldapFilter, attributes=None):
|
||||
''' Basic search function '''
|
||||
scope = ldap.SCOPE_SUBTREE
|
||||
count = 0
|
||||
timeout = 2
|
||||
result_set = []
|
||||
try:
|
||||
result_id = self.ldapConn.search(base, scope, ldapFilter, attributes)
|
||||
while True:
|
||||
result_type, result_data = self.ldapConn.result(result_id, timeout)
|
||||
if (result_data == []):
|
||||
break
|
||||
else:
|
||||
if result_type == ldap.RES_SEARCH_ENTRY:
|
||||
result_set.append(result_data)
|
||||
if len(result_set) == 0:
|
||||
return
|
||||
except ldap.LDAPError, e:
|
||||
raise
|
||||
|
||||
return result_set
|
||||
|
||||
###############################################################################
|
||||
# Group - Contains information about a specific group, 'sysadmin' would be
|
||||
# an example of a Group
|
||||
###############################################################################
|
||||
|
||||
class Group(object):
|
||||
''' Group abstraction class '''
|
||||
|
||||
__server = Server()
|
||||
__base = 'ou=FedoraGroups,dc=fedoraproject,dc=org'
|
||||
|
||||
def __init__(self, cn, fedoraGroupDesc, fedoraGroupOwner, fedoraGroupType, fedoraGroupNeedsSponsor, fedoraGroupUserCanRemove, fedoraGroupRequires, fedoraGroupJoinMsg):
|
||||
self.cn = cn
|
||||
self.fedoraGroupDesc = fedoraGroupDesc
|
||||
self.fedoraGroupOwner = fedoraGroupOwner
|
||||
self.fedoraGroupType = fedoraGroupType
|
||||
self.fedoraGroupNeedsSponsor = fedoraGroupNeedsSponsor
|
||||
self.fedoraGroupUserCanRemove = fedoraGroupUserCanRemove
|
||||
self.fedoraGroupRequires = fedoraGroupRequires
|
||||
self.fedoraGroupJoinMsg = fedoraGroupJoinMsg
|
||||
|
||||
def __json__(self):
|
||||
return {'cn': self.cn,
|
||||
'fedoraGroupDesc': self.fedoraGroupDesc,
|
||||
'fedoraGroupOwner': self.fedoraGroupOwner,
|
||||
'fedoraGroupType': self.fedoraGroupType,
|
||||
'fedoraGroupNeedsSponsor': self.fedoraGroupNeedsSponsor,
|
||||
'fedoraGroupUserCanRemove': self.fedoraGroupUserCanRemove,
|
||||
'fedoraGroupRequires': self.fedoraGroupRequires,
|
||||
'fedoraGroupJoinMsg': self.fedoraGroupJoinMsg
|
||||
}
|
||||
|
||||
@classmethod
|
||||
def newGroup(self, cn, fedoraGroupDesc, fedoraGroupOwner, fedoraGroupType, fedoraGroupNeedsSponsor, fedoraGroupUserCanRemove, fedoraGroupRequires, fedoraGroupJoinMsg):
|
||||
''' Create a new group '''
|
||||
attributes = { 'cn' : cn.encode('utf-8'),
|
||||
'objectClass' : ('fedoraGroup'),
|
||||
'fedoraGroupDesc' : fedoraGroupDesc.encode('utf-8'),
|
||||
'fedoraGroupOwner' : fedoraGroupOwner.encode('utf-8'),
|
||||
'fedoraGroupType' : fedoraGroupType.encode('utf-8'),
|
||||
'fedoraGroupNeedsSponsor' : fedoraGroupNeedsSponsor.encode('utf-8'),
|
||||
'fedoraGroupUserCanRemove' : fedoraGroupUserCanRemove.encode('utf-8'),
|
||||
'fedoraGroupRequires' : fedoraGroupRequires.encode('utf-8'),
|
||||
'fedoraGroupJoinMsg' : fedoraGroupJoinMsg.encode('utf-8'),
|
||||
}
|
||||
|
||||
self.__server.add('cn=%s,%s' % (cn, self.__base), attributes)
|
||||
# attributes = {
|
||||
# 'objectClass' : ('organizationalUnit', 'top'),
|
||||
# 'ou' : 'FedoraGroups'
|
||||
# }
|
||||
# self.__server.add('ou=FedoraGroups,cn=%s,%s' % (cn, self.__base), attributes)
|
||||
return 0
|
||||
|
||||
|
||||
###############################################################################
|
||||
# UserGroup - Determines information about a user in a group, when they joined
|
||||
# who their sponsor is and their approval status are examples of
|
||||
# things found in this group
|
||||
###############################################################################
|
||||
class UserGroup(object):
|
||||
''' Individual User->Group abstraction class '''
|
||||
def __init__(self, fedoraRoleApprovalDate=None, fedoraRoleSponsor=None, cn=None, fedoraRoleCreationDate=None, objectClass=None, fedoraRoleType=None, fedoraRoleStatus='Not a Member', fedoraRoleDomain=None):
|
||||
self.fedoraRoleApprovalDate = fedoraRoleApprovalDate
|
||||
self.fedoraRoleSponsor = fedoraRoleSponsor
|
||||
self.cn = cn
|
||||
self.fedoraRoleCreationDate = fedoraRoleCreationDate
|
||||
self.objectClass = objectClass
|
||||
self.fedoraRoleType = fedoraRoleType
|
||||
self.fedoraRoleStatus = fedoraRoleStatus
|
||||
self.fedoraRoleDomain = fedoraRoleDomain
|
||||
|
||||
|
||||
###############################################################################
|
||||
# Groups - Returns actual information in a group. This class actual queries
|
||||
# the LDAP database.
|
||||
###############################################################################
|
||||
class Groups(object):
|
||||
''' Class contains group information '''
|
||||
__server = Server()
|
||||
|
||||
def __init__(self):
|
||||
### FIXME: I don't think the username should be used this way.
|
||||
self.__userName = None
|
||||
|
||||
@classmethod
|
||||
def byUserName(self, cn, includeUnapproved=None, unapprovedOnly=None):
|
||||
''' Return list of groups a certain user is in. Default excludes all non-approved groups'''
|
||||
groups = {}
|
||||
if includeUnapproved:
|
||||
ldapFilter = 'objectClass=FedoraRole'
|
||||
elif unapprovedOnly:
|
||||
ldapFilter = '(&(!(fedoraRoleStatus=approved)) (objectClass=fedoraRole))'
|
||||
else:
|
||||
ldapFilter = '(&(fedoraRoleStatus=approved)(objectClass=FedoraRole))'
|
||||
|
||||
base = 'ou=Roles,cn=%s,ou=People,dc=fedoraproject,dc=org' % cn
|
||||
try:
|
||||
groupsDict = self.__server.search(base, ldapFilter)
|
||||
except ldap.NO_SUCH_OBJECT:
|
||||
return dict()
|
||||
if not groupsDict:
|
||||
groupsDict = []
|
||||
for group in groupsDict:
|
||||
cn = group[0][1]['cn'][0]
|
||||
groups[cn] = UserGroup(
|
||||
fedoraRoleApprovalDate = group[0][1]['fedoraRoleApprovalDate'][0].decode('utf8'),
|
||||
fedoraRoleSponsor = group[0][1]['fedoraRoleSponsor'][0].decode('utf8'),
|
||||
cn = group[0][1]['cn'][0].decode('utf8'),
|
||||
fedoraRoleCreationDate = group[0][1]['fedoraRoleCreationDate'][0].decode('utf8'),
|
||||
objectClass = group[0][1]['objectClass'][0].decode('utf8'),
|
||||
fedoraRoleType = group[0][1]['fedoraRoleType'][0].decode('utf8'),
|
||||
fedoraRoleStatus = group[0][1]['fedoraRoleStatus'][0].decode('utf8'),
|
||||
fedoraRoleDomain = group[0][1]['fedoraRoleDomain'][0].decode('utf8'),
|
||||
)
|
||||
### FIXME: userName shouldn't be shared this way
|
||||
self.__userName = cn
|
||||
return groups
|
||||
|
||||
@classmethod
|
||||
def groups(self, searchExpression='*', attributes=[]):
|
||||
''' Return a list of available groups '''
|
||||
groups = {}
|
||||
ldapFilter = 'cn=%s' % (searchExpression)
|
||||
base = 'ou=FedoraGroups,dc=fedoraproject,dc=org'
|
||||
groupsDict = self.__server.search(base, ldapFilter, attributes)
|
||||
if groupsDict:
|
||||
for group in groupsDict:
|
||||
name = group[0][1]['cn'][0].decode('utf8')
|
||||
groups[name] = Group(
|
||||
cn = group[0][1]['cn'][0].decode('utf8'),
|
||||
fedoraGroupDesc = group[0][1]['fedoraGroupDesc'][0].decode('utf8'),
|
||||
fedoraGroupOwner = group[0][1]['fedoraGroupOwner'][0].decode('utf8'),
|
||||
fedoraGroupType = group[0][1]['fedoraGroupType'][0].decode('utf8'),
|
||||
fedoraGroupNeedsSponsor = group[0][1]['fedoraGroupNeedsSponsor'][0].decode('utf8'),
|
||||
fedoraGroupUserCanRemove = group[0][1]['fedoraGroupUserCanRemove'][0].decode('utf8'),
|
||||
fedoraGroupRequires = group[0][1]['fedoraGroupRequires'][0].decode('utf8'),
|
||||
fedoraGroupJoinMsg = group[0][1]['fedoraGroupJoinMsg'][0].decode('utf8'))
|
||||
else:
|
||||
return None
|
||||
return groups
|
||||
|
||||
@classmethod
|
||||
def remove(self, groupName, userName=None):
|
||||
''' Remove user from a group '''
|
||||
### FIXME: Should require the userName instead of sharing it this way
|
||||
if not userName:
|
||||
userName = self.__userName
|
||||
try:
|
||||
g = self.byUserName(userName, includeUnapproved=True)[groupName]
|
||||
except:
|
||||
raise TypeError, 'User not in group %s' % groupName
|
||||
try:
|
||||
self.__server.delete('cn=%s+fedoraRoleType=%s,ou=Roles,cn=%s,ou=People,dc=fedoraproject,dc=org' % (g.cn, g.fedoraRoleType, userName))
|
||||
except ldap.NO_SUCH_OBJECT:
|
||||
self.__server.delete('cn=%s,ou=Roles,cn=%s,ou=People,dc=fedoraproject,dc=org' % (g.cn, userName))
|
||||
except:
|
||||
raise TypeError, 'Could Not delete %s from %s' % (userName, g.cn)
|
||||
|
||||
@classmethod
|
||||
def apply(self, groupName, userName=None):
|
||||
''' Apply for a group '''
|
||||
|
||||
if not userName:
|
||||
userName = self.__userName
|
||||
|
||||
if groupName in self.byUserName(userName):
|
||||
# Probably shouldn't be 'TypeError'
|
||||
raise TypeError, 'Already in that group'
|
||||
try:
|
||||
self.byGroupName(groupName)
|
||||
except TypeError:
|
||||
raise TypeError, 'Group "%s" does not exist' % groupName
|
||||
|
||||
now = time.time()
|
||||
|
||||
attributes = { 'cn' : groupName.encode('utf-8'),
|
||||
'fedoraRoleApprovaldate' : 'None',
|
||||
'fedoraRoleCreationDate' : str(now),
|
||||
'fedoraRoleDomain' : 'None',
|
||||
'fedoraRoleSponsor' : 'None',
|
||||
'fedoraRoleStatus' : 'unapproved',
|
||||
'fedoraRoleType' : 'user',
|
||||
'objectClass' : ('fedoraRole')}
|
||||
self.__server.add('cn=%s,ou=Roles,cn=%s,ou=People,dc=fedoraproject,dc=org' % (groupName, userName), attributes)
|
||||
|
||||
|
||||
@classmethod
|
||||
def byGroupName(cls, cn, includeUnapproved=None, unapprovedOnly=None):
|
||||
''' List users in a group. Default does not show unapproved '''
|
||||
self = cls()
|
||||
users = {}
|
||||
if includeUnapproved:
|
||||
ldapFilter = 'cn=%s' % cn
|
||||
elif unapprovedOnly:
|
||||
ldapFilter = '(&(cn=%s) (objectClass=fedoraRole) (!(fedoraRoleStatus=approved)))' % cn
|
||||
else:
|
||||
ldapFilter = '(&(cn=%s) (objectClass=fedoraRole) (fedoraRoleStatus=approved))' % cn
|
||||
base = 'ou=People,dc=fedoraproject,dc=org'
|
||||
attributes = ['cn']
|
||||
usersDict = self.__server.search(base, ldapFilter)
|
||||
try:
|
||||
for user in usersDict:
|
||||
userName = user[0][0].split(',')[2].split('=')[1]
|
||||
|
||||
users[userName] = UserGroup(
|
||||
fedoraRoleApprovalDate = user[0][1]['fedoraRoleApprovalDate'][0].decode('utf8'),
|
||||
fedoraRoleSponsor = user[0][1]['fedoraRoleSponsor'][0].decode('utf8'),
|
||||
cn = user[0][1]['cn'][0].decode('utf8'),
|
||||
fedoraRoleCreationDate = user[0][1]['fedoraRoleCreationDate'][0].decode('utf8'),
|
||||
objectClass = user[0][1]['objectClass'][0].decode('utf8'),
|
||||
fedoraRoleType = user[0][1]['fedoraRoleType'][0].decode('utf8'),
|
||||
fedoraRoleStatus = user[0][1]['fedoraRoleStatus'][0].decode('utf8'),
|
||||
fedoraRoleDomain = user[0][1]['fedoraRoleDomain'][0].decode('utf8'),
|
||||
)
|
||||
except TypeError:
|
||||
users = {}
|
||||
return users
|
||||
|
||||
class Person(object):
|
||||
'''Information and attributes about users '''
|
||||
__base = 'ou=People,dc=fedoraproject,dc=org'
|
||||
__server = Server()
|
||||
def __init__(self):
|
||||
### FIXME: Not sure what this is used for. It might be able to go
|
||||
# away. It might need to be made a public attribute.
|
||||
self.__filter = ''
|
||||
|
||||
@classmethod
|
||||
def newPerson(self, cn, givenName, mail, telephoneNumber, postalAddress):
|
||||
''' Create a new user '''
|
||||
now = time.time()
|
||||
attributes = { 'cn' : cn.encode('utf-8'),
|
||||
'objectClass' : ('fedoraPerson', 'inetOrgPerson', 'organizationalPerson', 'person', 'top'),
|
||||
'displayName' : cn.encode('utf-8'),
|
||||
'sn' : cn.encode('utf-8'),
|
||||
'cn' : cn.encode('utf-8'),
|
||||
'fedoraPersonSshKey' : '',
|
||||
'facsimileTelephoneNumber' : '',
|
||||
'fedoraPersonApprovalStatus' : 'approved',
|
||||
'givenName' : givenName.encode('utf-8'),
|
||||
'mail' : mail.encode('utf-8'),
|
||||
'fedoraPersonKeyId' : '',
|
||||
'fedoraPersonCertSerial' : '-1',
|
||||
'description' : '',
|
||||
'fedoraPersonCreationDate' : str(now),
|
||||
'telephoneNumber' : telephoneNumber.encode('utf-8'),
|
||||
'fedoraPersonBugzillaMail' : mail.encode('utf-8'),
|
||||
'postalAddress' : postalAddress.encode('utf-8'),
|
||||
'fedoraPersonIrcNick' : '',
|
||||
'userPassword' : 'Disabled',
|
||||
'fedoraPersonTimeZone' : 'UTC',
|
||||
}
|
||||
self.__server.add('cn=%s,%s' % (cn, self.__base), attributes)
|
||||
attributes = {
|
||||
'objectClass' : ('organizationalUnit', 'top'),
|
||||
'ou' : 'Roles'
|
||||
}
|
||||
self.__server.add('ou=Roles,cn=%s,%s' % (cn, self.__base), attributes)
|
||||
return 0
|
||||
|
||||
### FIXME: Overriding __getattr__ and __setattr__ can be tricky and have
|
||||
# performance penalties. If that's okay, you may also want to consider
|
||||
# inheriting from dict as that might be a better access method.
|
||||
def __getattr__(self, attr):
|
||||
if attr == '__filter':
|
||||
return self.__filter
|
||||
if attr == 'userName':
|
||||
attr = 'cn'
|
||||
try:
|
||||
attributes = []
|
||||
attributes.append(attr)
|
||||
return self.__server.search(self.__base, self.__filter, attributes)[0][0][1][attr][0].decode('utf8')
|
||||
except:
|
||||
# Should probably raise here.
|
||||
return None
|
||||
|
||||
def __setattr__(self, attr, value):
|
||||
if attr.startswith('_'):
|
||||
#return setattr(self.__class__, attr, value)
|
||||
self.__dict__[attr] = value
|
||||
return
|
||||
base = 'cn=%s,ou=People,dc=fedoraproject,dc=org' % self.__getattr__('cn')
|
||||
|
||||
if self.__getattr__(attr):
|
||||
self.__server.modify(base, attr, value, self.__getattr__(attr))
|
||||
else:
|
||||
try:
|
||||
self.__server.modify(base, attr, value)
|
||||
except:
|
||||
self.__server.modify(base, attr, value, self.__getattr__(attr))
|
||||
|
||||
@classmethod
|
||||
def users(self, searchExpression='*', findAttr='cn'):
|
||||
''' Returns a list of users '''
|
||||
users = []
|
||||
ldapFilter = '(&(objectClass=top)(%s=%s))' % (findAttr, searchExpression)
|
||||
attributes = ['cn']
|
||||
usersDict = self.__server.search(self.__base, ldapFilter, attributes)
|
||||
if usersDict:
|
||||
for user in usersDict:
|
||||
users.append(user[0][1]['cn'][0].decode('utf8'))
|
||||
else:
|
||||
return None
|
||||
return users
|
||||
|
||||
@classmethod
|
||||
def byFilter(cls, ldapFilter):
|
||||
''' Returns only the first result in the search '''
|
||||
self = cls()
|
||||
self.__filter = ldapFilter
|
||||
return self
|
||||
|
||||
@classmethod
|
||||
def byUserName(self, cn):
|
||||
'''Wrapper for byFilter - search by cn'''
|
||||
return self.byFilter('cn=%s' % cn)
|
||||
|
||||
@classmethod
|
||||
def auth(self, who, password, ldapServer=None):
|
||||
''' Basic Authentication Module '''
|
||||
if not password:
|
||||
raise AuthError
|
||||
if not ldapServer:
|
||||
s = Server()
|
||||
ldapServer = s.ldapConn
|
||||
who = 'cn=%s,ou=People,dc=fedoraproject,dc=org' % who
|
||||
try:
|
||||
ldapServer.simple_bind_s(who, password)
|
||||
except:
|
||||
raise AuthError
|
||||
|
||||
def upgrade(self, group):
|
||||
''' Upgrade user in group '''
|
||||
base = 'cn=%s,ou=Roles,cn=%s,ou=People,dc=fedoraproject,dc=org' % (group, self.cn)
|
||||
g = Groups.byGroupName(group, includeUnapproved=True)[self.cn]
|
||||
if not g.fedoraRoleStatus.lower() == 'approved':
|
||||
'''User not approved or sponsored'''
|
||||
raise TypeError, 'User is not approved'
|
||||
if g.fedoraRoleType.lower() == 'administrator':
|
||||
raise TypeError, 'User cannot be upgraded beyond administrator'
|
||||
elif g.fedoraRoleType.lower() == 'sponsor':
|
||||
self.__server.modify(base, 'fedoraRoleType', 'administrator', g.fedoraRoleType)
|
||||
elif g.fedoraRoleType.lower() == 'user':
|
||||
self.__server.modify(base, 'fedoraRoleType', 'sponsor', g.fedoraRoleType)
|
||||
|
||||
def downgrade(self, group):
|
||||
''' Downgrade user in group '''
|
||||
base = 'cn=%s,ou=Roles,cn=%s,ou=People,dc=fedoraproject,dc=org' % (group, self.cn)
|
||||
g = Groups.byGroupName(group, includeUnapproved=True)[self.cn]
|
||||
if not g.fedoraRoleStatus.lower() == 'approved':
|
||||
'''User not approved or sponsored'''
|
||||
raise TypeError, 'User is not approved'
|
||||
if g.fedoraRoleType.lower() == 'user':
|
||||
raise TypeError, 'User cannot be downgraded below user, did you mean remove?'
|
||||
elif g.fedoraRoleType.lower() == 'sponsor':
|
||||
self.__server.modify(base, 'fedoraRoleType', 'user', g.fedoraRoleType)
|
||||
elif g.fedoraRoleType.lower() == 'administrator':
|
||||
self.__server.modify(base, 'fedoraRoleType', 'sponsor', g.fedoraRoleType)
|
||||
|
||||
def sponsor(self, groupName, sponsor):
|
||||
''' Sponsor current user '''
|
||||
base = 'cn=%s,ou=Roles,cn=%s,ou=People,dc=fedoraproject,dc=org' % (groupName, self.cn)
|
||||
g = Groups.byGroupName(groupName, includeUnapproved=True)[self.cn]
|
||||
group = Groups.groups(groupName)[groupName]
|
||||
now = time.time()
|
||||
self.__server.modify(base, 'fedoraRoleApprovalDate', now)
|
||||
if group.fedoraGroupNeedsSponsor.lower() == 'true':
|
||||
self.__server.modify(base, 'fedoraRoleSponsor', sponsor)
|
||||
else:
|
||||
self.__server.modify(base, 'fedoraRoleSponsor', 'None')
|
||||
self.__server.modify(base, 'fedoraRoleStatus', 'approved')
|
||||
|
||||
def generatePassword(self,password=None,length=14,salt=''):
|
||||
''' Generate Password '''
|
||||
secret = {} # contains both hash and password
|
||||
|
||||
if not password:
|
||||
rand = Random()
|
||||
password = ''
|
||||
# Exclude 0,O and l,1
|
||||
righthand = '23456qwertasdfgzxcvbQWERTASDFGZXCVB'
|
||||
lefthand = '789yuiophjknmYUIPHJKLNM'
|
||||
for i in range(length):
|
||||
if i%2:
|
||||
password = password + rand.choice(lefthand)
|
||||
else:
|
||||
password = password + rand.choice(righthand)
|
||||
|
||||
ctx = sha.new(password)
|
||||
ctx.update(salt)
|
||||
secret['hash'] = "{SSHA}%s" % b64encode(ctx.digest() + salt)
|
||||
secret['pass'] = password
|
||||
|
||||
return secret
|
||||
|
||||
|
||||
class UserAccount:
|
||||
def __init__(self):
|
||||
self.realName = ''
|
||||
self.userName = ''
|
||||
self.primaryEmail = ''
|
||||
self.groups = []
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
from fasLDAP import add, Groups, delete
|
||||
|
||||
attributes = { 'cn' : 'infrastructureTest',
|
||||
'fedoraRoleApprovaldate' : 'None',
|
||||
'fedoraRoleCreationDate' : 'None',
|
||||
'fedoraRoleDomain' : 'None',
|
||||
'fedoraRoleSponsor' : 'None',
|
||||
'fedoraRoleStatus' : 'unapproved',
|
||||
'fedoraRoleType' : 'user',
|
||||
'objectClass' : ('fedoraRole')}
|
||||
print "add('cn=infrastructureTest,ou=Roles,cn=mmcgrath,ou=People,dc=fedoraproject,dc=org', attributes)"
|
||||
print "delete('cn=infrastructureTest,ou=Roles,cn=mmcgrath,ou=People,dc=fedoraproject,dc=org')"
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue