|
1 # copyright 2011-2015 LOGILAB S.A. (Paris, FRANCE), all rights reserved. |
|
2 # contact http://www.logilab.fr/ -- mailto:contact@logilab.fr |
|
3 # |
|
4 # This file is part of CubicWeb. |
|
5 # |
|
6 # CubicWeb is free software: you can redistribute it and/or modify it under the |
|
7 # terms of the GNU Lesser General Public License as published by the Free |
|
8 # Software Foundation, either version 2.1 of the License, or (at your option) |
|
9 # any later version. |
|
10 # |
|
11 # CubicWeb is distributed in the hope that it will be useful, but WITHOUT |
|
12 # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS |
|
13 # FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more |
|
14 # details. |
|
15 # |
|
16 # You should have received a copy of the GNU Lesser General Public License along |
|
17 # with CubicWeb. If not, see <http://www.gnu.org/licenses/>. |
|
18 """cubicweb ldap feed source |
|
19 |
|
20 unlike ldapuser source, this source is copy based and will import ldap content |
|
21 (beside passwords for authentication) into the system source. |
|
22 """ |
|
23 from six.moves import map, filter |
|
24 |
|
25 from logilab.common.decorators import cached, cachedproperty |
|
26 from logilab.common.shellutils import generate_password |
|
27 |
|
28 from cubicweb import Binary, ConfigurationError |
|
29 from cubicweb.server.utils import crypt_password |
|
30 from cubicweb.server.sources import datafeed |
|
31 from cubicweb.dataimport import stores, importer |
|
32 |
|
33 |
|
34 class UserMetaGenerator(stores.MetaGenerator): |
|
35 """Specific metadata generator, used to see newly created user into their initial state. |
|
36 """ |
|
37 @cached |
|
38 def base_etype_dicts(self, entity): |
|
39 entity, rels = super(UserMetaGenerator, self).base_etype_dicts(entity) |
|
40 if entity.cw_etype == 'CWUser': |
|
41 wf_state = self._cnx.execute('Any S WHERE ET default_workflow WF, ET name %(etype)s, ' |
|
42 'WF initial_state S', {'etype': entity.cw_etype}).one() |
|
43 rels['in_state'] = wf_state.eid |
|
44 return entity, rels |
|
45 |
|
46 |
|
47 class DataFeedLDAPAdapter(datafeed.DataFeedParser): |
|
48 __regid__ = 'ldapfeed' |
|
49 # attributes that may appears in source user_attrs dict which are not |
|
50 # attributes of the cw user |
|
51 non_attribute_keys = set(('email', 'eid', 'member', 'modification_date')) |
|
52 |
|
53 @cachedproperty |
|
54 def searchfilterstr(self): |
|
55 """ ldap search string, including user-filter """ |
|
56 return '(&%s)' % ''.join(self.source.base_filters) |
|
57 |
|
58 @cachedproperty |
|
59 def searchgroupfilterstr(self): |
|
60 """ ldap search string, including user-filter """ |
|
61 return '(&%s)' % ''.join(self.source.group_base_filters) |
|
62 |
|
63 @cachedproperty |
|
64 def user_source_entities_by_extid(self): |
|
65 source = self.source |
|
66 if source.user_base_dn.strip(): |
|
67 attrs = list(map(str, source.user_attrs.keys())) |
|
68 return dict((userdict['dn'].encode('ascii'), userdict) |
|
69 for userdict in source._search(self._cw, |
|
70 source.user_base_dn, |
|
71 source.user_base_scope, |
|
72 self.searchfilterstr, |
|
73 attrs)) |
|
74 return {} |
|
75 |
|
76 @cachedproperty |
|
77 def group_source_entities_by_extid(self): |
|
78 source = self.source |
|
79 if source.group_base_dn.strip(): |
|
80 attrs = list(map(str, ['modifyTimestamp'] + list(source.group_attrs.keys()))) |
|
81 return dict((groupdict['dn'].encode('ascii'), groupdict) |
|
82 for groupdict in source._search(self._cw, |
|
83 source.group_base_dn, |
|
84 source.group_base_scope, |
|
85 self.searchgroupfilterstr, |
|
86 attrs)) |
|
87 return {} |
|
88 |
|
89 def process(self, url, raise_on_error=False): |
|
90 """IDataFeedParser main entry point""" |
|
91 self.debug('processing ldapfeed source %s %s', self.source, self.searchfilterstr) |
|
92 self._group_members = {} |
|
93 eeimporter = self.build_importer(raise_on_error) |
|
94 for name in self.source.user_default_groups: |
|
95 geid = self._get_group(name) |
|
96 eeimporter.extid2eid[geid] = geid |
|
97 entities = self.extentities_generator() |
|
98 set_cwuri = importer.use_extid_as_cwuri(eeimporter.extid2eid) |
|
99 eeimporter.import_entities(set_cwuri(entities)) |
|
100 self.stats['created'] = eeimporter.created |
|
101 self.stats['updated'] = eeimporter.updated |
|
102 # handle in_group relation |
|
103 for group, members in self._group_members.items(): |
|
104 self._cw.execute('DELETE U in_group G WHERE G name %(g)s', {'g': group}) |
|
105 if members: |
|
106 members = ["'%s'" % e for e in members] |
|
107 rql = 'SET U in_group G WHERE G name %%(g)s, U login IN (%s)' % ','.join(members) |
|
108 self._cw.execute(rql, {'g': group}) |
|
109 # ensure updated users are activated |
|
110 for eid in eeimporter.updated: |
|
111 entity = self._cw.entity_from_eid(eid) |
|
112 if entity.cw_etype == 'CWUser': |
|
113 self.ensure_activated(entity) |
|
114 # manually set primary email if necessary, it's not handled automatically since hooks are |
|
115 # deactivated |
|
116 self._cw.execute('SET X primary_email E WHERE NOT X primary_email E, X use_email E, ' |
|
117 'X cw_source S, S eid %(s)s, X in_state ST, TS name "activated"', |
|
118 {'s': self.source.eid}) |
|
119 |
|
120 def build_importer(self, raise_on_error): |
|
121 """Instantiate and configure an importer""" |
|
122 etypes = ('CWUser', 'EmailAddress', 'CWGroup') |
|
123 extid2eid = dict((self.source.decode_extid(x), y) for x, y in |
|
124 self._cw.system_sql('select extid, eid from entities where asource = %(s)s', {'s': self.source.uri})) |
|
125 existing_relations = {} |
|
126 for rtype in ('in_group', 'use_email', 'owned_by'): |
|
127 rql = 'Any S,O WHERE S {} O, S cw_source SO, SO eid %(s)s'.format(rtype) |
|
128 rset = self._cw.execute(rql, {'s': self.source.eid}) |
|
129 existing_relations[rtype] = set(tuple(x) for x in rset) |
|
130 return importer.ExtEntitiesImporter(self._cw.vreg.schema, self.build_store(), |
|
131 extid2eid=extid2eid, |
|
132 existing_relations=existing_relations, |
|
133 etypes_order_hint=etypes, |
|
134 import_log=self.import_log, |
|
135 raise_on_error=raise_on_error) |
|
136 |
|
137 def build_store(self): |
|
138 """Instantiate and configure a store""" |
|
139 metagenerator = UserMetaGenerator(self._cw, source=self.source) |
|
140 return stores.NoHookRQLObjectStore(self._cw, metagenerator) |
|
141 |
|
142 def extentities_generator(self): |
|
143 self.debug('processing ldapfeed source %s %s', self.source, self.searchgroupfilterstr) |
|
144 # generate users and email addresses |
|
145 for userdict in self.user_source_entities_by_extid.values(): |
|
146 attrs = self.ldap2cwattrs(userdict, 'CWUser') |
|
147 pwd = attrs.get('upassword') |
|
148 if not pwd: |
|
149 # generate a dumb password if not fetched from ldap (see |
|
150 # userPassword) |
|
151 pwd = crypt_password(generate_password()) |
|
152 attrs['upassword'] = set([Binary(pwd)]) |
|
153 extuser = importer.ExtEntity('CWUser', userdict['dn'].encode('ascii'), attrs) |
|
154 extuser.values['owned_by'] = set([extuser.extid]) |
|
155 for extemail in self._process_email(extuser, userdict): |
|
156 yield extemail |
|
157 groups = list(filter(None, [self._get_group(name) |
|
158 for name in self.source.user_default_groups])) |
|
159 if groups: |
|
160 extuser.values['in_group'] = groups |
|
161 yield extuser |
|
162 # generate groups |
|
163 for groupdict in self.group_source_entities_by_extid.values(): |
|
164 attrs = self.ldap2cwattrs(groupdict, 'CWGroup') |
|
165 extgroup = importer.ExtEntity('CWGroup', groupdict['dn'].encode('ascii'), attrs) |
|
166 yield extgroup |
|
167 # record group membership for later insertion |
|
168 members = groupdict.get(self.source.group_rev_attrs['member'], ()) |
|
169 self._group_members[attrs['name']] = members |
|
170 |
|
171 def _process_email(self, extuser, userdict): |
|
172 try: |
|
173 emailaddrs = userdict.pop(self.source.user_rev_attrs['email']) |
|
174 except KeyError: |
|
175 return # no email for that user, nothing to do |
|
176 if not isinstance(emailaddrs, list): |
|
177 emailaddrs = [emailaddrs] |
|
178 for emailaddr in emailaddrs: |
|
179 # search for existing email first, may be coming from another source |
|
180 rset = self._cw.execute('EmailAddress X WHERE X address %(addr)s', |
|
181 {'addr': emailaddr}) |
|
182 emailextid = (userdict['dn'] + '@@' + emailaddr).encode('ascii') |
|
183 if not rset: |
|
184 # not found, create it. first forge an external id |
|
185 extuser.values.setdefault('use_email', []).append(emailextid) |
|
186 yield importer.ExtEntity('EmailAddress', emailextid, dict(address=[emailaddr])) |
|
187 elif self.sourceuris: |
|
188 # pop from sourceuris anyway, else email may be removed by the |
|
189 # source once import is finished |
|
190 self.sourceuris.pop(emailextid, None) |
|
191 # XXX else check use_email relation? |
|
192 |
|
193 def handle_deletion(self, config, cnx, myuris): |
|
194 if config['delete-entities']: |
|
195 super(DataFeedLDAPAdapter, self).handle_deletion(config, cnx, myuris) |
|
196 return |
|
197 if myuris: |
|
198 for extid, (eid, etype) in myuris.items(): |
|
199 if etype != 'CWUser' or not self.is_deleted(extid, etype, eid): |
|
200 continue |
|
201 self.info('deactivate user %s', eid) |
|
202 wf = cnx.entity_from_eid(eid).cw_adapt_to('IWorkflowable') |
|
203 wf.fire_transition_if_possible('deactivate') |
|
204 cnx.commit() |
|
205 |
|
206 def ensure_activated(self, entity): |
|
207 if entity.cw_etype == 'CWUser': |
|
208 wf = entity.cw_adapt_to('IWorkflowable') |
|
209 if wf.state == 'deactivated': |
|
210 wf.fire_transition('activate') |
|
211 self.info('user %s reactivated', entity.login) |
|
212 |
|
213 def ldap2cwattrs(self, sdict, etype): |
|
214 """Transform dictionary of LDAP attributes to CW. |
|
215 |
|
216 etype must be CWUser or CWGroup |
|
217 """ |
|
218 assert etype in ('CWUser', 'CWGroup'), etype |
|
219 tdict = {} |
|
220 if etype == 'CWUser': |
|
221 items = self.source.user_attrs.items() |
|
222 elif etype == 'CWGroup': |
|
223 items = self.source.group_attrs.items() |
|
224 for sattr, tattr in items: |
|
225 if tattr not in self.non_attribute_keys: |
|
226 try: |
|
227 value = sdict[sattr] |
|
228 except KeyError: |
|
229 raise ConfigurationError( |
|
230 'source attribute %s has not been found in the source, ' |
|
231 'please check the %s-attrs-map field and the permissions of ' |
|
232 'the LDAP binding user' % (sattr, etype[2:].lower())) |
|
233 if not isinstance(value, list): |
|
234 value = [value] |
|
235 tdict[tattr] = value |
|
236 return tdict |
|
237 |
|
238 def is_deleted(self, extidplus, etype, eid): |
|
239 try: |
|
240 extid = extidplus.rsplit(b'@@', 1)[0] |
|
241 except ValueError: |
|
242 # for some reason extids here tend to come in both forms, e.g: |
|
243 # dn, dn@@Babar |
|
244 extid = extidplus |
|
245 return extid not in self.user_source_entities_by_extid |
|
246 |
|
247 @cached |
|
248 def _get_group(self, name): |
|
249 try: |
|
250 return self._cw.execute('Any X WHERE X is CWGroup, X name %(name)s', |
|
251 {'name': name})[0][0] |
|
252 except IndexError: |
|
253 self.error('group %r referenced by source configuration %r does not exist', |
|
254 name, self.source.uri) |
|
255 return None |