Merge Master in geni-v3 conflict resolution

[sfa.git] / sfa / senslab / LDAPapi.py

diff --git a/sfa/senslab/LDAPapi.py b/sfa/senslab/LDAPapi.py
index e6a6253..de02404 100644 (file)
--- a/sfa/senslab/LDAPapi.py
+++ b/sfa/senslab/LDAPapi.py
@@ -3,7 +3,7 @@ from passlib.hash import ldap_salted_sha1 as lssha
 from sfa.util.xrn import get_authority 
 import ldap
 from sfa.util.config import Config
 from sfa.util.xrn import get_authority 
 import ldap
 from sfa.util.config import Config

-from sfa.trust.hierarchy import Hierarchy
+

 
 import ldap.modlist as modlist
 from sfa.util.sfalogging import logger
 
 import ldap.modlist as modlist
 from sfa.util.sfalogging import logger


@@ -93,7 +93,7 @@ class LDAPapi :
     def __init__(self):
         logger.setLevelDebug() 
         #SFA related config
     def __init__(self):
         logger.setLevelDebug() 
         #SFA related config

-        self.senslabauth = Hierarchy()
+

         config = Config()
         
         self.authname = config.SFA_REGISTRY_ROOT_AUTH
         config = Config()
         
         self.authname = config.SFA_REGISTRY_ROOT_AUTH


@@ -106,17 +106,18 @@ class LDAPapi :
         
         self.lengthPassword = 8
         self.baseDN = self.conn.ldapPeopleDN
         
         self.lengthPassword = 8
         self.baseDN = self.conn.ldapPeopleDN

-        #authinfo=self.senslabauth.get_auth_info(self.authname)
+

         
         
         
         

-        self.charsPassword = [ '!','$','(',')','*','+',',','-','.', \
-                                '0','1','2','3','4','5','6','7','8','9', \
-                                'A','B','C','D','E','F','G','H','I','J', \
-                                'K','L','M','N','O','P','Q','R','S','T', \
-                                'U','V','W','X','Y','Z','_','a','b','c', \
-                                'd','e','f','g','h','i','j','k','l','m', \
-                                'n','o','p','q','r','s','t','u','v','w', \
-                                'x','y','z','\'']
+        self.charsPassword = [ '!', '$', '(',')', '*', '+', ',', '-', '.', \
+                                '0', '1', '2', '3', '4', '5', '6', '7', '8', \
+                                '9', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', \
+                                'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', \
+                                'R', 'S', 'T',  'U', 'V', 'W', 'X', 'Y', 'Z', \
+                                '_', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', \
+                                'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p' ,'q', \
+                                'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', \
+                                '\'']

         
         self.ldapShell = '/bin/bash'
 
         
         self.ldapShell = '/bin/bash'
 


@@ -151,7 +152,7 @@ class LDAPapi :
             lower_last_name = None
             #Assume there is first name and last name in email
             #if there is a  separator
             lower_last_name = None
             #Assume there is first name and last name in email
             #if there is a  separator

-            separator_list = ['.','_','-']
+            separator_list = ['.', '_', '-']

             for sep in separator_list:
                 if sep in email:
                     mail = email.split(sep)
             for sep in separator_list:
                 if sep in email:
                     mail = email.split(sep)


@@ -161,8 +162,8 @@ class LDAPapi :
             #Otherwise just take the part before the @ as the 
             #lower_first_name  and lower_last_name
             if lower_first_name is None:
             #Otherwise just take the part before the @ as the 
             #lower_first_name  and lower_last_name
             if lower_first_name is None:

-               lower_first_name = email
-               lower_last_name = email
+                lower_first_name = email
+                lower_last_name = email

                
         length_last_name = len(lower_last_name)  
         login_max_length = 8
                
         length_last_name = len(lower_last_name)  
         login_max_length = 8


@@ -237,14 +238,15 @@ class LDAPapi :
             password += self.charsPassword[char_index]
 
         return password
             password += self.charsPassword[char_index]
 
         return password

-
-    def encrypt_password(self, password):
+    
+    @staticmethod
+    def encrypt_password( password):

         """ Use passlib library to make a RFC2307 LDAP encrypted password
         salt size = 8, use sha-1 algorithm. Returns encrypted password.
         
         """
         #Keep consistency with Java Senslab's LDAP API 
         """ Use passlib library to make a RFC2307 LDAP encrypted password
         salt size = 8, use sha-1 algorithm. Returns encrypted password.
         
         """
         #Keep consistency with Java Senslab's LDAP API 

-        #RFC2307SSHAPasswordEncryptor so set the salt size to 8 bytres
+        #RFC2307SSHAPasswordEncryptor so set the salt size to 8 bytes

         return lssha.encrypt(password, salt_size = 8)
     
 
         return lssha.encrypt(password, salt_size = 8)
     
 


@@ -281,8 +283,9 @@ class LDAPapi :
         
         """
         return 'A REMPLIR '
         
         """
         return 'A REMPLIR '

-
-    def make_ldap_filters_from_record(self, record=None):
+    
+    @staticmethod
+    def make_ldap_filters_from_record( record=None):

         """TODO Handle OR filtering in the ldap query when 
         dealing with a list of records instead of doing a for loop in GetPersons   
         Helper function to make LDAP filter requests out of SFA records.
         """TODO Handle OR filtering in the ldap query when 
         dealing with a list of records instead of doing a for loop in GetPersons   
         Helper function to make LDAP filter requests out of SFA records.


@@ -346,7 +349,7 @@ class LDAPapi :
             attrs['cn'] = attrs['givenName'] + ' ' + attrs['sn']
             attrs['gecos'] = attrs['givenName'] + ' ' + attrs['sn']
             
             attrs['cn'] = attrs['givenName'] + ' ' + attrs['sn']
             attrs['gecos'] = attrs['givenName'] + ' ' + attrs['sn']
             

-        except: 
+        except KeyError: 

             attrs['givenName'] = attrs['uid']
             attrs['sn'] = attrs['uid']
             attrs['cn'] = attrs['uid']
             attrs['givenName'] = attrs['uid']
             attrs['sn'] = attrs['uid']
             attrs['cn'] = attrs['uid']


@@ -392,7 +395,7 @@ class LDAPapi :
 
     def LdapAddUser(self, record) :
         """Add SFA user to LDAP if it is not in LDAP  yet. """
 
     def LdapAddUser(self, record) :
         """Add SFA user to LDAP if it is not in LDAP  yet. """

-        
+        logger.debug(" \r\n \t LDAP LdapAddUser \r\n\r\n =====================================================\r\n ")

         user_ldap_attrs = self.make_ldap_attributes_from_record(record)
 
         
         user_ldap_attrs = self.make_ldap_attributes_from_record(record)
 
         


@@ -420,11 +423,11 @@ class LDAPapi :
             try:
                 ldif = modlist.addModlist(user_ldap_attrs)
                 logger.debug("LDAPapi.py add attrs %s \r\n  ldif %s"\
             try:
                 ldif = modlist.addModlist(user_ldap_attrs)
                 logger.debug("LDAPapi.py add attrs %s \r\n  ldif %s"\

-                                %(user_ldap_attrs,ldif) )
-                self.conn.ldapserv.add_s(dn,ldif)
+                                %(user_ldap_attrs, ldif) )
+                self.conn.ldapserv.add_s(dn, ldif)

                 
                 logger.info("Adding user %s login %s in LDAP" \
                 
                 logger.info("Adding user %s login %s in LDAP" \

-                        %(user_ldap_attrs['cn'] ,user_ldap_attrs['uid']))
+                        %(user_ldap_attrs['cn'] , user_ldap_attrs['uid']))

                         
                         
             except ldap.LDAPError, error:
                         
                         
             except ldap.LDAPError, error:


@@ -432,7 +435,7 @@ class LDAPapi :
                 return {'bool' : False, 'message' : error }
         
             self.conn.close()
                 return {'bool' : False, 'message' : error }
         
             self.conn.close()

-            return {'bool': True, 'uid':filter_by['uid']}  
+            return {'bool': True, 'uid':user_ldap_attrs['uid']}  

         else: 
             return result
 
         else: 
             return result
 


@@ -459,12 +462,12 @@ class LDAPapi :
         Deletes a SFA person in LDAP, based on the user's hrn.
         """
         #Find uid of the  person 
         Deletes a SFA person in LDAP, based on the user's hrn.
         """
         #Find uid of the  person 

-        person = self.LdapFindUser(record_filter,[])
+        person = self.LdapFindUser(record_filter, [])

         logger.debug("LDAPapi.py \t LdapDeleteUser record %s person %s" \
         %(record_filter, person))
 
         if person:
         logger.debug("LDAPapi.py \t LdapDeleteUser record %s person %s" \
         %(record_filter, person))
 
         if person:

-            dn = 'uid=' + person['uid'] + "," +self.baseDN 
+            dn = 'uid=' + person['uid'] + "," + self.baseDN 

         else:
             return {'bool': False}
         
         else:
             return {'bool': False}
         


@@ -475,12 +478,12 @@ class LDAPapi :
     def LdapModify(self, dn, old_attributes_dict, new_attributes_dict): 
         """ Modifies a LDAP entry """
          
     def LdapModify(self, dn, old_attributes_dict, new_attributes_dict): 
         """ Modifies a LDAP entry """
          

-        ldif = modlist.modifyModlist(old_attributes_dict,new_attributes_dict)
+        ldif = modlist.modifyModlist(old_attributes_dict, new_attributes_dict)

         # Connect and bind/authenticate    
         result = self.conn.connect() 
         if (result['bool']): 
             try:
         # Connect and bind/authenticate    
         result = self.conn.connect() 
         if (result['bool']): 
             try:

-                self.conn.ldapserv.modify_s(dn,ldif)
+                self.conn.ldapserv.modify_s(dn, ldif)

                 self.conn.close()
                 return {'bool' : True }
             except ldap.LDAPError, error:
                 self.conn.close()
                 return {'bool' : True }
             except ldap.LDAPError, error:


@@ -502,7 +505,7 @@ class LDAPapi :
         #Get all the attributes of the user_uid_login 
         #person = self.LdapFindUser(record_filter,[])
         req_ldap = self.make_ldap_filters_from_record(user_record)
         #Get all the attributes of the user_uid_login 
         #person = self.LdapFindUser(record_filter,[])
         req_ldap = self.make_ldap_filters_from_record(user_record)

-        person_list = self.LdapSearch(req_ldap,[])
+        person_list = self.LdapSearch(req_ldap, [])

         logger.debug("LDAPapi.py \t LdapModifyUser person_list : %s" \
                                                         %(person_list))
         if person_list and len(person_list) > 1 :
         logger.debug("LDAPapi.py \t LdapModifyUser person_list : %s" \
                                                         %(person_list))
         if person_list and len(person_list) > 1 :


@@ -516,7 +519,7 @@ class LDAPapi :
         # The dn of our existing entry/object
         #One result only from ldapSearch
         person = person_list[0][1]
         # The dn of our existing entry/object
         #One result only from ldapSearch
         person = person_list[0][1]

-        dn  = 'uid=' + person['uid'][0] + "," +self.baseDN  
+        dn  = 'uid=' + person['uid'][0] + "," + self.baseDN  

        
         if new_attributes_dict:
             old = {}
        
         if new_attributes_dict:
             old = {}


@@ -527,7 +530,7 @@ class LDAPapi :
                     old[k] = person[k]
             logger.debug(" LDAPapi.py \t LdapModifyUser  new_attributes %s"\
                                 %( new_attributes_dict))  
                     old[k] = person[k]
             logger.debug(" LDAPapi.py \t LdapModifyUser  new_attributes %s"\
                                 %( new_attributes_dict))  

-            result = self.LdapModify(dn, old,new_attributes_dict)
+            result = self.LdapModify(dn, old, new_attributes_dict)

             return result
         else:
             logger.error("LDAP \t LdapModifyUser  No new attributes given. ")
             return result
         else:
             logger.error("LDAP \t LdapModifyUser  No new attributes given. ")


@@ -547,7 +550,7 @@ class LDAPapi :
         return ret
 
             
         return ret
 
             

-    def LdapResetPassword(self,record):
+    def LdapResetPassword(self, record):

         """
         Resets password for the user whose record is the parameter and changes
         the corresponding entry in the LDAP.
         """
         Resets password for the user whose record is the parameter and changes
         the corresponding entry in the LDAP.


@@ -574,7 +577,7 @@ class LDAPapi :
             
             return_fields_list = []
             if expected_fields == None : 
             
             return_fields_list = []
             if expected_fields == None : 

-                return_fields_list = ['mail','givenName', 'sn', 'uid', \
+                return_fields_list = ['mail', 'givenName', 'sn', 'uid', \

                                         'sshPublicKey', 'shadowExpire']
             else : 
                 return_fields_list = expected_fields
                                         'sshPublicKey', 'shadowExpire']
             else : 
                 return_fields_list = expected_fields


@@ -593,7 +596,7 @@ class LDAPapi :
                 #Get all the results matching the search from ldap in one 
                 #shot (1 value)
                 result_type, result_data = \
                 #Get all the results matching the search from ldap in one 
                 #shot (1 value)
                 result_type, result_data = \

-                                        self.conn.ldapserv.result(msg_id,1)
+                                        self.conn.ldapserv.result(msg_id, 1)

 
                 self.conn.close()
 
 
                 self.conn.close()
 


@@ -602,7 +605,7 @@ class LDAPapi :
 
                 return result_data
             
 
                 return result_data
             

-            except  ldap.LDAPError,error :
+            except  ldap.LDAPError, error :

                 logger.log_exc("LDAP LdapSearch Error %s" %error)
                 return []
             
                 logger.log_exc("LDAP LdapSearch Error %s" %error)
                 return []
             


@@ -628,7 +631,7 @@ class LDAPapi :
         req_ldap = self.make_ldap_filters_from_record(custom_record)     
         return_fields_list = []
         if expected_fields == None : 
         req_ldap = self.make_ldap_filters_from_record(custom_record)     
         return_fields_list = []
         if expected_fields == None : 

-            return_fields_list = ['mail','givenName', 'sn', 'uid', \
+            return_fields_list = ['mail', 'givenName', 'sn', 'uid', \

                                     'sshPublicKey']
         else : 
             return_fields_list = expected_fields
                                     'sshPublicKey']
         else : 
             return_fields_list = expected_fields


@@ -649,38 +652,44 @@ class LDAPapi :
             if ldapentry['mail'][0] == "unknown":
                 tmpemail = None
                     
             if ldapentry['mail'][0] == "unknown":
                 tmpemail = None
                     

-            #except IndexError: 
-                #logger.error("LDAP ldapFindHRn : no entry for record %s found"\
-                            #%(record))
-                #return None
-                
-            try:
+            parent_hrn = None
+            peer_authority = None    
+            if 'hrn' in record:

                 hrn = record['hrn']
                 parent_hrn = get_authority(hrn)
                 hrn = record['hrn']
                 parent_hrn = get_authority(hrn)

-                peer_authority = None
-                if parent_hrn is not self.authname:
+                if parent_hrn != self.authname:

                     peer_authority = parent_hrn
                     peer_authority = parent_hrn

-
-                results =  {   
-                            'type': 'user',
-                            'pkey': ldapentry['sshPublicKey'][0],
-                            #'uid': ldapentry[1]['uid'][0],
-                            'uid': tmpname ,
-                            'email':tmpemail,
-                            #'email': ldapentry[1]['mail'][0],
-                            'first_name': ldapentry['givenName'][0],
-                            'last_name': ldapentry['sn'][0],
-                            #'phone': 'none',
-                            'serial': 'none',
-                            'authority': parent_hrn,
-                            'peer_authority': peer_authority,
-                            'pointer' : -1,
-                            'hrn': hrn,
-                            }
-            except KeyError,error:
-                logger.log_exc("LDAPapi \t LdaFindUser KEyError %s" \
-                                %error )
-                return
+                #In case the user was not imported from Senslab LDAP
+                #but from another federated site, has an account in 
+                #senslab but currently using his hrn from federated site
+                #then the login is different from the one found in its hrn    
+                if tmpname != hrn.split('.')[1]:
+                    hrn = None
+            else:
+                hrn = None
+                
+               
+                
+            results =  {       
+                        'type': 'user',
+                        'pkey': ldapentry['sshPublicKey'][0],
+                        #'uid': ldapentry[1]['uid'][0],
+                        'uid': tmpname ,
+                        'email':tmpemail,
+                        #'email': ldapentry[1]['mail'][0],
+                        'first_name': ldapentry['givenName'][0],
+                        'last_name': ldapentry['sn'][0],
+                        #'phone': 'none',
+                        'serial': 'none',
+                        'authority': parent_hrn,
+                        'peer_authority': peer_authority,
+                        'pointer' : -1,
+                        'hrn': hrn,
+                        }
+            #except KeyError,error:
+                #logger.log_exc("LDAPapi \t LdaFindUser KEyError %s" \
+                                #%error )
+                #return

         else:
         #Asked for all users in ldap
             results = []
         else:
         #Asked for all users in ldap
             results = []


@@ -688,7 +697,7 @@ class LDAPapi :
                 logger.debug(" LDAP.py LdapFindUser ldapentry name : %s " \
                                 %(ldapentry[1]['uid'][0]))
                 tmpname = ldapentry[1]['uid'][0]
                 logger.debug(" LDAP.py LdapFindUser ldapentry name : %s " \
                                 %(ldapentry[1]['uid'][0]))
                 tmpname = ldapentry[1]['uid'][0]

-                hrn=self.authname+"."+ tmpname
+                hrn = self.authname + "." + tmpname

                 
                 tmpemail = ldapentry[1]['mail'][0]
                 if ldapentry[1]['mail'][0] == "unknown":
                 
                 tmpemail = ldapentry[1]['mail'][0]
                 if ldapentry[1]['mail'][0] == "unknown":


@@ -696,7 +705,7 @@ class LDAPapi :
 
         
                 parent_hrn = get_authority(hrn)
 
         
                 parent_hrn = get_authority(hrn)

-                parent_auth_info = self.senslabauth.get_auth_info(parent_hrn)
+

                 try:
                     results.append(  { 
                             'type': 'user',
                 try:
                     results.append(  { 
                             'type': 'user',


@@ -714,7 +723,7 @@ class LDAPapi :
                             'pointer' : -1,
                             'hrn': hrn,
                             } ) 
                             'pointer' : -1,
                             'hrn': hrn,
                             } ) 

-                except KeyError,error:
+                except KeyError, error:

                     logger.log_exc("LDAPapi.PY \t LdapFindUser EXCEPTION %s" \
                                                 %(error))
                     return
                     logger.log_exc("LDAPapi.PY \t LdapFindUser EXCEPTION %s" \
                                                 %(error))
                     return