security-and-privacy/ldapcherry
security-and-privacy/ldapcherry
1
0
Fork 0
mirror of https://github.com/kakwa/ldapcherry synced 2024-11-22 09:24:21 +01:00
Code Releases Activity

simplify roles configuration (backend groups)

Browse Source
This commit is contained in:
kakwa 2015-06-04 23:34:31 +02:00
parent 2b52e121d1
commit 1735f5da20
9 changed files with 171 additions and 194 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
conf/roles.yml
View File

@ -1,14 +1,12 @@
admin-lv3:
display_name: Administrators Level 3
backends:
backends_groups:
ldap:
groups:
- cn=dns admins,ou=group,dc=example,dc=com
- cn=nagios admins,ou=group,dc=example,dc=com
- cn=puppet admins,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
- Administrators
- Domain Controllers
@ -16,32 +14,26 @@ admin-lv3:
admin-lv2:
display_name: Administrators Level 2
LC_admins: True
backends:
backends_groups:
ldap:
groups:
- cn=nagios admins,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
developpers:
display_name: Developpers
backends:
backends_groups:
ldap:
groups:
- cn=developpers,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
users:
display_name: Simple Users
backends:
backends_groups:
ldap:
groups:
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users

57
ldapcherry/roles.py
View File

@ -34,10 +34,35 @@ class Roles:
except DumplicatedKey as e:
raise DumplicateRoleKey(e.key)
stream.close()
self.graph = {}
self.roles = {}
self.flatten = {}
self.admin_roles = []
self._nest()
def _merge_groups(self, backends_list):
ret = {}
for backends in backends_list:
for b in backends:
if not b in ret:
ret[b] = Set([])
for group in backends[b]:
ret[b].add(group)
return ret
def _flatten(self, roles=None, groups=[]):
if roles is None:
roles = copy(self.roles_raw)
for roleid in role:
role = self.roles_raw[roleid]
if 'subroles' in role:
self._flatten(role['subroles'], role)
del role['subroles']
self.flatten[roleid] = role
pass
def _set_admin(self, role):
for r in role['subroles']:
self.admin_roles.append(r)
@ -54,19 +79,19 @@ class Roles:
return False
# Check if role1 is contained by role2
for b1 in role1['backends']:
if not b1 in role2['backends']:
for b1 in role1['backends_groups']:
if not b1 in role2['backends_groups']:
return False
for group in role1['backends'][b1]['groups']:
if not group in role2['backends'][b1]['groups']:
for group in role1['backends_groups'][b1]:
if not group in role2['backends_groups'][b1]:
return False
# If role2 is inside role1, roles are equal, throw exception
for b2 in role2['backends']:
if not b2 in role1['backends']:
for b2 in role2['backends_groups']:
if not b2 in role1['backends_groups']:
return True
for group in role2['backends'][b2]['groups']:
if not group in role1['backends'][b2]['groups']:
for group in role2['backends_groups'][b2]:
if not group in role1['backends_groups'][b2]:
return True
raise DumplicateRoleContent(roleid1, roleid2)
@ -81,11 +106,11 @@ class Roles:
raise MissingKey('display_name', role, self.role_file)
# Backend is mandatory
if not 'backends' in role:
raise MissingKey('backends', role, self.role_file)
if not 'backends_groups' in role:
raise MissingKey('backends_groups', role, self.role_file)
# Create the list of backends
for backend in role['backends']:
for backend in role['backends_groups']:
self.backends.add(backend)
# Create the nested groups
@ -145,8 +170,8 @@ class Roles:
# (parentroles is a list of roles that the user is member of by
# being member of one of their subroles)
if not (role in parentroles or role in roles):
for b in self.roles[role]['backends']:
for g in self.roles[role]['backends'][b]['groups']:
for b in self.roles[role]['backends_groups']:
for g in self.roles[role]['backends_groups'][b]:
if b not in groups:
notroles.add(role)
return False
@ -155,10 +180,10 @@ class Roles:
return False
# add groups of the role to usedgroups
for b in self.roles[role]['backends']:
for b in self.roles[role]['backends_groups']:
if not b in usedgroups:
usedgroups[b] = Set([])
for g in self.roles[role]['backends'][b]['groups']:
for g in self.roles[role]['backends_groups'][b]:
usedgroups[b].add(g)
flag = True
@ -212,7 +237,7 @@ class Roles:
"""get the list of groups from role"""
if not role in self.roles_raw:
raise MissingRole(role)
return self.roles_raw[role]['backends']
return self.roles_raw[role]['backends_groups']
def is_admin(self, roles):
"""determine from a list of roles if is ldapcherry administrator"""

22
tests/cfg/attributes_missing_mandatory.yml
View File

@ -7,21 +7,21 @@ cn:
args:
- $first-name
- $name
bakends:
backends:
ldap: cn
ad: CN
first-name:
description: "First name of the user"
display_name: "First Name"
type: string
bakends:
backends:
ldap: givenName
ad: givenName
name:
description: "Family name of the user"
display_name: "Name"
type: string
bakends:
backends:
ldap: sn
ad: sn
email:
@ -34,7 +34,7 @@ email:
- $first-name
- $last-name
- '@example.com'
bakends:
backends:
ldap: email
ad: EMAIL
uid:
@ -46,7 +46,7 @@ uid:
args:
- $first-name
- $last-name
bakends:
backends:
ldap: uid
ad: UID
uidNumber:
@ -58,7 +58,7 @@ uidNumber:
args:
- $first-name
- $last-name
bakends:
backends:
ldap: uidNumber
ad: UIDNumber
gidNumber:
@ -66,7 +66,7 @@ gidNumber:
display_name: "GID Number"
type: int
default: 10000
bakends:
backends:
ldap: gidNumber
ad: GIDNumber
shell:
@ -78,7 +78,7 @@ shell:
- /bin/bash
- /bin/zsh
- /bin/sh
bakends:
backends:
ldap: shell
ad: SHELL
home:
@ -91,7 +91,7 @@ home:
- $first-name
- $last-name
- /home/
bakends:
backends:
ldap: home
ad: Home
@ -100,7 +100,7 @@ password:
display_name: "Password"
self: True
type: password
bakends:
backends:
ldap: userPassword
ad: userPassword
logscript:
@ -108,5 +108,5 @@ logscript:
display_name: "Login script"
type: fix
value: login1.bat
bakends:
backends:
ad: logonScript

16
tests/cfg/roles.yml
View File

@ -1,14 +1,12 @@
admin-lv3:
display_name: Administrators Level 3
backends:
backends_groups:
ldap:
groups:
- cn=dns admins,ou=group,dc=example,dc=com
- cn=nagios admins,ou=group,dc=example,dc=com
- cn=puppet admins,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
- Administrators
- Domain Controllers
@ -16,32 +14,26 @@ admin-lv3:
admin-lv2:
display_name: Administrators Level 2
LC_admins: True
backends:
backends_groups:
ldap:
groups:
- cn=nagios admins,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
developpers:
display_name: Developpers
backends:
backends_groups:
ldap:
groups:
- cn=developpers,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
users:
display_name: Simple Users
backends:
backends_groups:
ldap:
groups:
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users

20
tests/cfg/roles_content_dup.yml
View File

@ -1,57 +1,47 @@
admin -lv3:
display_name: Administrators Level 3
LC_admins: True
backends:
backends_groups:
ldap:
groups:
- cn=dns admins,ou=group,dc=example,dc=com
- cn=nagios admins,ou=group,dc=example,dc=com
- cn=puppet admins,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
- Administrators
- Domain Controllers
admin -lv2:
display_name: Administrators Level 2
backends:
backends_groups:
ldap:
groups:
- cn=nagios admins,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
developpers:
display_name: Developpers
backends:
backends_groups:
ldap:
groups:
- cn=developpers,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
users:
display_name: Simple Users
backends:
backends_groups:
ldap:
groups:
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
users2:
display_name: Simple Users 2
backends:
backends_groups:
ldap:
groups:
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users

16
tests/cfg/roles_key_dup.yml
View File

@ -1,47 +1,39 @@
admin -lv3:
display_name: Administrators Level 3
LC_admins: True
backends:
backends_groups:
ldap:
groups:
- cn=dns admins,ou=group,dc=example,dc=com
- cn=nagios admins,ou=group,dc=example,dc=com
- cn=puppet admins,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
- Administrators
- Domain Controllers
admin -lv3:
display_name: Administrators Level 2
backends:
backends_groups:
ldap:
groups:
- cn=nagios admins,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
developpers:
display_name: Developpers
backends:
backends_groups:
ldap:
groups:
- cn=developpers,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
users:
display_name: Simple Users
backends:
backends_groups:
ldap:
groups:
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users

12
tests/cfg/roles_missing_backends.yml
View File

@ -1,15 +1,13 @@
admin-lv3:
display_name: Administrators Level 3
LC_admins: True
backends:
backends_groups:
ldap:
groups:
- cn=dns admins,ou=group,dc=example,dc=com
- cn=nagios admins,ou=group,dc=example,dc=com
- cn=puppet admins,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
- Administrators
- Domain Controllers
@ -19,21 +17,17 @@ admin-lv2:
developpers:
display_name: Developpers
backends:
backends_groups:
ldap:
groups:
- cn=developpers,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
users:
display_name: Simple Users
backends:
backends_groups:
ldap:
groups:
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users

16
tests/cfg/roles_missing_diplay_name.yml
View File

@ -1,46 +1,38 @@
admin-lv3:
display_name: Administrators Level 3
LC_admins: True
backends:
backends_groups:
ldap:
groups:
- cn=dns admins,ou=group,dc=example,dc=com
- cn=nagios admins,ou=group,dc=example,dc=com
- cn=puppet admins,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
- Administrators
- Domain Controllers
admin-lv2:
backends:
backends_groups:
ldap:
groups:
- cn=nagios admins,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
developpers:
display_name: Developpers
backends:
backends_groups:
ldap:
groups:
- cn=developpers,ou=group,dc=example,dc=com
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users
users:
display_name: Simple Users
backends:
backends_groups:
ldap:
groups:
- cn=users,ou=group,dc=example,dc=com
ad:
groups:
- Domain Users

4
tests/test_Roles.py
View File

@ -62,8 +62,8 @@ class TestError(object):
inv = Roles('./tests/cfg/roles.yml')
res = inv.get_groups('users')
expected = {
'ad': {'groups': ['Domain Users']},
'ldap': {'groups': ['cn=users,ou=group,dc=example,dc=com']}
'ad': ['Domain Users'],
'ldap': ['cn=users,ou=group,dc=example,dc=com']
}
assert res == expected