# copyright 2003-2011 LOGILAB S.A. (Paris, FRANCE), all rights reserved.

# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr

#

# This file is part of CubicWeb.

#

# CubicWeb is free software: you can redistribute it and/or modify it under the

# terms of the GNU Lesser General Public License as published by the Free

# Software Foundation, either version 2.1 of the License, or (at your option)

# any later version.

#

# CubicWeb is distributed in the hope that it will be useful, but WITHOUT

# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS

# FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more

# details.

#

# You should have received a copy of the GNU Lesser General Public License along

# with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.

"""cubicweb ldap user source

this source is for now limited to a read-only CWUser source

Part of the code is coming form Zope's LDAPUserFolder

Copyright (c) 2004 Jens Vagelpohl.

All Rights Reserved.

This software is subject to the provisions of the Zope Public License,

Version 2.1 (ZPL).  A copy of the ZPL should accompany this distribution.

THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED

WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS

FOR A PARTICULAR PURPOSE.

"""

from __future__ import division

from base64 import b64decode

import ldap

from ldap.ldapobject import ReconnectLDAPObject

from ldap.filter import filter_format, escape_filter_chars

from ldapurl import LDAPUrl

from rql.nodes import Relation, VariableRef, Constant, Function

from cubicweb import AuthenticationError, UnknownEid, RepositoryError

from cubicweb.server.utils import cartesian_product

from cubicweb.server.sources import (AbstractSource, TrFunc, GlobTrFunc,

                                     ConnectionWrapper, TimedCache)

# search scopes

BASE = ldap.SCOPE_BASE

ONELEVEL = ldap.SCOPE_ONELEVEL

SUBTREE = ldap.SCOPE_SUBTREE

# map ldap protocol to their standard port

PROTO_PORT = {'ldap': 389,

              'ldaps': 636,

              'ldapi': None,

              }

class LDAPUserSource(AbstractSource):

    """LDAP read-only CWUser source"""

    support_entities = {'CWUser': False}

    options = (

        ('host',

         {'type' : 'string',

          'default': 'ldap',

          'help': 'ldap host. It may contains port information using \

<host>:<port> notation.',

          'group': 'ldap-source', 'level': 1,

          }),

        ('protocol',

         {'type' : 'choice',

          'default': 'ldap',

          'choices': ('ldap', 'ldaps', 'ldapi'),

          'help': 'ldap protocol (allowed values: ldap, ldaps, ldapi)',

          'group': 'ldap-source', 'level': 1,

          }),

        ('auth-mode',

         {'type' : 'choice',

          'default': 'simple',

          'choices': ('simple', 'cram_md5', 'digest_md5', 'gssapi'),

          'help': 'authentication mode used to authenticate user to the ldap.',

          'group': 'ldap-source', 'level': 3,

          }),

        ('auth-realm',

         {'type' : 'string',

          'default': None,

          'help': 'realm to use when using gssapi/kerberos authentication.',

          'group': 'ldap-source', 'level': 3,

          }),

        ('data-cnx-dn',

         {'type' : 'string',

          'default': '',

          'help': 'user dn to use to open data connection to the ldap (eg used \

to respond to rql queries). Leave empty for anonymous bind',

          'group': 'ldap-source', 'level': 1,

          }),

        ('data-cnx-password',

         {'type' : 'string',

          'default': '',

          'help': 'password to use to open data connection to the ldap (eg used to respond to rql queries). Leave empty for anonymous bind.',

          'group': 'ldap-source', 'level': 1,

          }),

        ('user-base-dn',

         {'type' : 'string',

          'default': 'ou=People,dc=logilab,dc=fr',

          'help': 'base DN to lookup for users',

          'group': 'ldap-source', 'level': 1,

          }),

        ('user-scope',

         {'type' : 'choice',

          'default': 'ONELEVEL',

          'choices': ('BASE', 'ONELEVEL', 'SUBTREE'),

          'help': 'user search scope (valid values: "BASE", "ONELEVEL", "SUBTREE")',

          'group': 'ldap-source', 'level': 1,

          }),

        ('user-classes',

         {'type' : 'csv',

          'default': ('top', 'posixAccount'),

          'help': 'classes of user (with Active Directory, you want to say "user" here)',

          'group': 'ldap-source', 'level': 1,

          }),

        ('user-filter',

         {'type': 'string',

          'default': '',

          'help': 'additional filters to be set in the ldap query to find valid users',

          'group': 'ldap-source', 'level': 2,

          }),

        ('user-login-attr',

         {'type' : 'string',

          'default': 'uid',

          'help': 'attribute used as login on authentication (with Active Directory, you want to use "sAMAccountName" here)',

          'group': 'ldap-source', 'level': 1,

          }),

        ('user-default-group',

         {'type' : 'csv',

          'default': ('users',),

          'help': 'name of a group in which ldap users will be by default. \

You can set multiple groups by separating them by a comma.',

          'group': 'ldap-source', 'level': 1,

          }),

        ('user-attrs-map',

         {'type' : 'named',

          'default': {'uid': 'login', 'gecos': 'email'},

          'help': 'map from ldap user attributes to cubicweb attributes (with Active Directory, you want to use sAMAccountName:login,mail:email,givenName:firstname,sn:surname)',

          'group': 'ldap-source', 'level': 1,

          }),

        ('synchronization-interval',

         {'type' : 'time',

          'default': '1d',

          'help': 'interval between synchronization with the ldap \

directory (default to once a day).',

          'group': 'ldap-source', 'level': 3,

          }),

        ('cache-life-time',

         {'type' : 'time',

          'default': '2h',

          'help': 'life time of query cache (default to two hours).',

          'group': 'ldap-source', 'level': 3,

          }),

    )

    def __init__(self, repo, source_config, eid=None):

        AbstractSource.__init__(self, repo, source_config, eid)

        self.update_config(None, self.check_conf_dict(eid, source_config))

        self._conn = None

    def update_config(self, source_entity, typedconfig):

        """update configuration from source entity. `typedconfig` is config

        properly typed with defaults set

        """

        self.host = typedconfig['host']

        self.protocol = typedconfig['protocol']

        self.authmode = typedconfig['auth-mode']

        self._authenticate = getattr(self, '_auth_%s' % self.authmode)

        self.cnx_dn = typedconfig['data-cnx-dn']

        self.cnx_pwd = typedconfig['data-cnx-password']

        self.user_base_dn = str(typedconfig['user-base-dn'])

        self.user_base_scope = globals()[typedconfig['user-scope']]

        self.user_login_attr = typedconfig['user-login-attr']

        self.user_default_groups = typedconfig['user-default-group']

        self.user_attrs = typedconfig['user-attrs-map']

        self.user_rev_attrs = {'eid': 'dn'}

        for ldapattr, cwattr in self.user_attrs.items():

            self.user_rev_attrs[cwattr] = ldapattr

        self.base_filters = [filter_format('(%s=%s)', ('objectClass', o))

                             for o in typedconfig['user-classes']]

        if typedconfig['user-filter']:

            self.base_filters.append(typedconfig['user-filter'])

        self._interval = typedconfig['synchronization-interval']

        self._cache_ttl = max(71, typedconfig['cache-life-time'])

        self.reset_caches()

        self._conn = None

    def reset_caches(self):

        """method called during test to reset potential source caches"""

        self._cache = {}

        self._query_cache = TimedCache(self._cache_ttl)

    def init(self, activated, source_entity):

        """method called by the repository once ready to handle request"""

        if activated:

            self.info('ldap init')

            # set minimum period of 5min 1s (the additional second is to

            # minimize resonnance effet)

            self.repo.looping_task(max(301, self._interval), self.synchronize)

            self.repo.looping_task(self._cache_ttl // 10,

                                   self._query_cache.clear_expired)

    def synchronize(self):

        """synchronize content known by this repository with content in the

        external repository

        """

        self.info('synchronizing ldap source %s', self.uri)

        try:

            ldap_emailattr = self.user_rev_attrs['email']

        except KeyError:

            return # no email in ldap, we're done

        session = self.repo.internal_session()

        execute = session.execute

        try:

            cursor = session.system_sql("SELECT eid, extid FROM entities WHERE "

                                        "source='%s'" % self.uri)

            for eid, b64extid in cursor.fetchall():

                extid = b64decode(b64extid)

                self.debug('ldap eid %s', eid)

                # if no result found, _search automatically delete entity information

                res = self._search(session, extid, BASE)

                self.debug('ldap search %s', res)

                if res:

                    ldapemailaddr = res[0].get(ldap_emailattr)

                    if ldapemailaddr:

                        if isinstance(ldapemailaddr, list):

                            ldapemailaddr = ldapemailaddr[0] # XXX consider only the first email in the list

                        rset = execute('Any X,A WHERE '

                                       'X address A, U use_email X, U eid %(u)s',

                                       {'u': eid})

                        ldapemailaddr = unicode(ldapemailaddr)

                        for emaileid, emailaddr, in rset:

                            if emailaddr == ldapemailaddr:

                                break

                        else:

                            self.debug('updating email address of user %s to %s',

                                      extid, ldapemailaddr)

                            emailrset = execute('EmailAddress A WHERE A address %(addr)s',

                                                {'addr': ldapemailaddr})

                            if emailrset:

                                execute('SET U use_email X WHERE '

                                        'X eid %(x)s, U eid %(u)s',

                                        {'x': emailrset[0][0], 'u': eid})

                            elif rset:

                                if not execute('SET X address %(addr)s WHERE '

                                               'U primary_email X, U eid %(u)s',

                                               {'addr': ldapemailaddr, 'u': eid}):

                                    execute('SET X address %(addr)s WHERE '

                                            'X eid %(x)s',

                                            {'addr': ldapemailaddr, 'x': rset[0][0]})

                            else:

                                # no email found, create it

                                _insert_email(session, ldapemailaddr, eid)

        finally:

            session.commit()

            session.close()

    def get_connection(self):

        """open and return a connection to the source"""

        if self._conn is None:

            try:

                self._connect()

            except Exception:

                self.exception('unable to connect to ldap:')

        return ConnectionWrapper(self._conn)

    def authenticate(self, session, login, password=None, **kwargs):

        """return CWUser eid for the given login/password if this account is

        defined in this source, else raise `AuthenticationError`

        two queries are needed since passwords are stored crypted, so we have

        to fetch the salt first

        """

        self.info('ldap authenticate %s', login)

        if not password:

            # On Windows + ADAM this would have succeeded (!!!)

            # You get Authenticated as: 'NT AUTHORITY\ANONYMOUS LOGON'.

            # we really really don't want that

            raise AuthenticationError()

        searchfilter = [filter_format('(%s=%s)', (self.user_login_attr, login))]

        searchfilter.extend(self.base_filters)

        searchstr = '(&%s)' % ''.join(searchfilter)

        # first search the user

        try:

            user = self._search(session, self.user_base_dn,

                                self.user_base_scope, searchstr)[0]

        except IndexError:

            # no such user

            raise AuthenticationError()

        # check password by establishing a (unused) connection

        try:

            self._connect(user, password)

        except ldap.LDAPError, ex:

            # Something went wrong, most likely bad credentials

            self.info('while trying to authenticate %s: %s', user, ex)

            raise AuthenticationError()

        except Exception:

            self.error('while trying to authenticate %s', user, exc_info=True)

            raise AuthenticationError()

        eid = self.repo.extid2eid(self, user['dn'], 'CWUser', session)

        if eid < 0:

            # user has been moved away from this source

            raise AuthenticationError()

        return eid

    def ldap_name(self, var):

        if var.stinfo['relations']:

            relname = iter(var.stinfo['relations']).next().r_type

            return self.user_rev_attrs.get(relname)

        return None

    def prepare_columns(self, mainvars, rqlst):

        """return two list describing how to build the final results

        from the result of an ldap search (ie a list of dictionnary)

        """

        columns = []

        global_transforms = []

        for i, term in enumerate(rqlst.selection):

            if isinstance(term, Constant):

                columns.append(term)

                continue

            if isinstance(term, Function): # LOWER, UPPER, COUNT...

                var = term.get_nodes(VariableRef)[0]

                var = var.variable

                try:

                    mainvar = var.stinfo['attrvar'].name

                except AttributeError: # no attrvar set

                    mainvar = var.name

                assert mainvar in mainvars

                trname = term.name

                ldapname = self.ldap_name(var)

                if trname in ('COUNT', 'MIN', 'MAX', 'SUM'):

                    global_transforms.append(GlobTrFunc(trname, i, ldapname))

                    columns.append((mainvar, ldapname))

                    continue

                if trname in ('LOWER', 'UPPER'):

                    columns.append((mainvar, TrFunc(trname, i, ldapname)))

                    continue

                raise NotImplementedError('no support for %s function' % trname)

            if term.name in mainvars:

                columns.append((term.name, 'dn'))

                continue

            var = term.variable

            mainvar = var.stinfo['attrvar'].name

            columns.append((mainvar, self.ldap_name(var)))

            #else:

            #    # probably a bug in rql splitting if we arrive here

            #    raise NotImplementedError

        return columns, global_transforms

    def syntax_tree_search(self, session, union,

                           args=None, cachekey=None, varmap=None, debug=0):

        """return result from this source for a rql query (actually from a rql

        syntax tree and a solution dictionary mapping each used variable to a

        possible type). If cachekey is given, the query necessary to fetch the

        results (but not the results themselves) may be cached using this key.

        """

        self.debug('ldap syntax tree search')

        # XXX not handled : transform/aggregat function, join on multiple users...

        assert len(union.children) == 1, 'union not supported'

        rqlst = union.children[0]

        assert not rqlst.with_, 'subquery not supported'

        rqlkey = rqlst.as_string(kwargs=args)

        try:

            results = self._query_cache[rqlkey]

        except KeyError:

            try:

                results = self.rqlst_search(session, rqlst, args)

                self._query_cache[rqlkey] = results

            except ldap.SERVER_DOWN:

                # cant connect to server