set SELinux boolean httpd_can_connect_ldap when install infolap and authldap

[cascardo/ipsilon.git] / ipsilon / info / infoldap.py

diff --git a/ipsilon/info/infoldap.py b/ipsilon/info/infoldap.py
old mode 100755 (executable)
new mode 100644 (file)
index 70d36d5..3edd0dd
--- a/ipsilon/info/infoldap.py
+++ b/ipsilon/info/infoldap.py
@@ -1,69 +1,62 @@
-#!/usr/bin/python
-#
 # Copyright (C) 2014 Ipsilon Project Contributors
 #
 # See the file named COPYING for the project license
 
 from ipsilon.info.common import InfoProviderBase
 from ipsilon.info.common import InfoProviderInstaller
-from ipsilon.info.common import InfoMapping
 from ipsilon.util.plugin import PluginObject
-from ipsilon.util.log import Log
+from ipsilon.util.policy import Policy
+from ipsilon.util import config as pconfig
 import ldap
+import subprocess
 
 
 # TODO: fetch mapping from configuration
-ldap_mapping = {
-    'cn': 'fullname',
-    'commonname': 'fullname',
-    'sn': 'surname',
-    'mail': 'email',
-    'destinationindicator': 'country',
-    'postalcode': 'postcode',
-    'st': 'state',
-    'statetorprovincename': 'state',
-    'streetaddress': 'street',
-    'telephonenumber': 'phone',
-}
-
-
-class InfoProvider(InfoProviderBase, Log):
-
-    def __init__(self):
-        super(InfoProvider, self).__init__()
-        self.mapper = InfoMapping()
-        self.mapper.set_mapping(ldap_mapping)
+ldap_mapping = [
+    ['cn', 'fullname'],
+    ['commonname', 'fullname'],
+    ['sn', 'surname'],
+    ['mail', 'email'],
+    ['destinationindicator', 'country'],
+    ['postalcode', 'postcode'],
+    ['st', 'state'],
+    ['statetorprovincename', 'state'],
+    ['streetaddress', 'street'],
+    ['telephonenumber', 'phone'],
+]
+
+
+class InfoProvider(InfoProviderBase):
+
+    def __init__(self, *pargs):
+        super(InfoProvider, self).__init__(*pargs)
+        self.mapper = Policy(ldap_mapping)
         self.name = 'ldap'
         self.description = """
 Info plugin that uses LDAP to retrieve user data. """
-        self._options = {
-            'server url': [
-                """ The LDAP server url """,
-                'string',
-                'ldap://example.com'
-            ],
-            'tls': [
-                " What TLS level show be required " +
-                "(Demand, Allow, Try, Never, NoTLS) ",
-                'string',
-                'Demand'
-            ],
-            'bind dn': [
-                """ User DN to bind as, if empty uses anonymous bind. """,
-                'string',
-                'uid=ipsilon,ou=People,dc=example,dc=com'
-            ],
-            'bind password': [
-                """ Password to use for bind operation """,
-                'string',
-                'Password'
-            ],
-            'user dn template': [
-                """ Template to turn username into DN. """,
-                'string',
-                'uid=%(username)s,ou=People,dc=example,dc=com'
-            ],
-        }
+        self.new_config(
+            self.name,
+            pconfig.String(
+                'server url',
+                'The LDAP server url.',
+                'ldap://example.com'),
+            pconfig.Template(
+                'user dn template',
+                'Template to turn username into DN.',
+                'uid=%(username)s,ou=People,dc=example,dc=com'),
+            pconfig.Pick(
+                'tls',
+                'What TLS level show be required',
+                ['Demand', 'Allow', 'Try', 'Never', 'NoTLS'],
+                'Demand'),
+            pconfig.String(
+                'bind dn',
+                'DN to bind as, if empty uses anonymous bind.',
+                'uid=ipsilon,ou=People,dc=example,dc=com'),
+            pconfig.String(
+                'bind password',
+                'Password to use for bind operation'),
+        )
 
     @property
     def server_url(self):
@@ -134,11 +127,11 @@ Info plugin that uses LDAP to retrieve user data. """
         reply = dict()
         try:
             ldapattrs = self._get_user_data(conn, dn)
-            userattrs, extras = self.mapper.map_attrs(ldapattrs)
+            userattrs, extras = self.mapper.map_attributes(ldapattrs)
             groups = self._get_user_groups(conn, dn, ldapattrs)
-            reply['userdata'] = userattrs
-            reply['groups'] = groups
-            reply['extras'] = {'ldap': extras}
+            reply = userattrs
+            reply['_groups'] = groups
+            reply['_extras'] = {'ldap': extras}
         except Exception, e:  # pylint: disable=broad-except
             self.error(e)
 
@@ -156,9 +149,10 @@ Info plugin that uses LDAP to retrieve user data. """
 
 class Installer(InfoProviderInstaller):
 
-    def __init__(self):
+    def __init__(self, *pargs):
         super(Installer, self).__init__()
         self.name = 'ldap'
+        self.pargs = pargs
 
     def install_args(self, group):
         group.add_argument('--info-ldap', choices=['yes', 'no'], default='no',
@@ -177,10 +171,10 @@ class Installer(InfoProviderInstaller):
             return
 
         # Add configuration data to database
-        po = PluginObject()
+        po = PluginObject(*self.pargs)
         po.name = 'ldap'
         po.wipe_data()
-        po.wipe_config_values(self.facility)
+        po.wipe_config_values()
         config = dict()
         if 'info_ldap_server_url' in opts:
             config['server url'] = opts['info_ldap_server_url']
@@ -198,15 +192,16 @@ class Installer(InfoProviderInstaller):
         elif 'ldap_bind_dn_template' in opts:
             config['user dn template'] = opts['ldap_bind_dn_template']
         config['tls'] = 'Demand'
-        po.save_plugin_config(self.facility, config)
+        po.save_plugin_config(config)
 
-        # Replace global config, only one plugin info can be used
-        po.name = 'global'
-        globalconf = po.get_plugin_config(self.facility)
-        if 'order' in globalconf:
-            order = globalconf['order'].split(',')
-        else:
-            order = []
-        order.append('ldap')
-        globalconf['order'] = ','.join(order)
-        po.save_plugin_config(self.facility, globalconf)
+        # Update global config to add info plugin
+        po.is_enabled = True
+        po.save_enabled_state()
+
+        # For selinux enabled platforms permit httpd to connect to ldap,
+        # ignore if it fails
+        try:
+            subprocess.call(['/usr/sbin/setsebool', '-P',
+                             'httpd_can_connect_ldap=on'])
+        except Exception:  # pylint: disable=broad-except
+            pass