/[smeserver]/rpms/smeserver-samba/sme9/smeserver-samba-0.1.0-062616-update.patch
ViewVC logotype

Contents of /rpms/smeserver-samba/sme9/smeserver-samba-0.1.0-062616-update.patch

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph


Revision 1.1 - (show annotations) (download)
Sat Jul 30 18:36:41 2016 UTC (8 years, 3 months ago) by gzartman
Branch: MAIN
CVS Tags: HEAD
* Sun Jun 26 2016 Greg Zartman <gzartman@koozali.org> 0.1-0-4
- Add dnscache and tinydns config per bug [SME: 8638]
- Add iptables preroute rule for DNS per bug [SME: 8638]
- Fix issues with domain admins assignment during provisioning
- Nearly full re-write of user-create-AD action to utilize
  esmith::AD class
- Add Legacy Mode to user-create-AD action to allow this
  action to work with AccountsDB
- Add user-create-AD to user-create event
- Add user-AD-disable action to disable AD user
- Continued development and enhancement to esmith::AD
  including POD documentation
- Continued development and enhancement to esmith::AD::User
  including POD documentation
- Add esmith::AD::OU to manage Organizational Units in the
  Active Directory
- Fix realm definition in provision action

1 diff -urbN smeserver-samba-0.1.0/createlinks smeserver-samba-0.1.0-062616-update/createlinks
2 --- smeserver-samba-0.1.0/createlinks 2016-07-24 10:25:57.946060238 -0700
3 +++ smeserver-samba-0.1.0-062616-update/createlinks 2016-06-26 21:04:56.892472467 -0700
4 @@ -19,7 +19,6 @@
5 provision-domain-controller
6 bootstrap-initialize-samba));
7
8 -
9 ##Links for provision-domain-controller event
10 $event = "provision-domain-controller";
11 event_link("adjust-samba-down", $event, "01");
12 @@ -29,6 +28,10 @@
13 event_link("samba-create-domain-admins", $event,"03");
14 event_link("adjust-samba-up", $event, "50");
15
16 +##Links for user-create
17 +$event = "user-create";
18 +event_link("user-create-AD", $event, "04");
19 +
20 ##Links for adjust-samba event
21 $event = "adjust-samba";
22 event_link("adjust-samba-down", $event, "20");
23 diff -urbN smeserver-samba-0.1.0/root/etc/e-smith/db/configuration/migrate/dnscache_set_ListenIP_AD smeserver-samba-0.1.0-062616-update/root/etc/e-smith/db/configuration/migrate/dnscache_set_ListenIP_AD
24 --- smeserver-samba-0.1.0/root/etc/e-smith/db/configuration/migrate/dnscache_set_ListenIP_AD 1969-12-31 16:00:00.000000000 -0800
25 +++ smeserver-samba-0.1.0-062616-update/root/etc/e-smith/db/configuration/migrate/dnscache_set_ListenIP_AD 2016-06-27 18:15:13.000000000 -0700
26 @@ -0,0 +1,9 @@
27 +{
28 + my $serverRole = $DB->get_prop('smb','ServerRole') || '';
29 + # Set dnscache listen IP for Samba DNS Loopback routing
30 + if ($serverRole eq 'DC') {
31 +
32 + $DB->set_prop ('dnscache','ListenIP', '127.0.0.3');
33 +
34 + }
35 +}
36 diff -urbN smeserver-samba-0.1.0/root/etc/e-smith/db/configuration/migrate/tinydns_set_ListenIP_AD smeserver-samba-0.1.0-062616-update/root/etc/e-smith/db/configuration/migrate/tinydns_set_ListenIP_AD
37 --- smeserver-samba-0.1.0/root/etc/e-smith/db/configuration/migrate/tinydns_set_ListenIP_AD 1969-12-31 16:00:00.000000000 -0800
38 +++ smeserver-samba-0.1.0-062616-update/root/etc/e-smith/db/configuration/migrate/tinydns_set_ListenIP_AD 2016-06-27 18:13:29.000000000 -0700
39 @@ -0,0 +1,10 @@
40 +{
41 +
42 + my $serverRole = $DB->get_prop('smb','ServerRole') || '';
43 + # Set tinydns listen IP for Samba DNS Loopback routing
44 + if ($serverRole eq 'DC') {
45 +
46 + $DB->set_prop ('tinydns','ListenIP', '127.0.0.4');
47 +
48 + }
49 +}
50 diff -urbN smeserver-samba-0.1.0/root/etc/e-smith/events/actions/provision-domain-controller smeserver-samba-0.1.0-062616-update/root/etc/e-smith/events/actions/provision-domain-controller
51 --- smeserver-samba-0.1.0/root/etc/e-smith/events/actions/provision-domain-controller 2016-07-24 10:25:57.946060238 -0700
52 +++ smeserver-samba-0.1.0-062616-update/root/etc/e-smith/events/actions/provision-domain-controller 2016-06-20 23:26:45.000000000 -0700
53 @@ -17,18 +17,17 @@
54
55 ##Pull arguments
56 my $event = $ARGV [0];
57 -my $AdminPass = $ARGV [1];
58 +my $adminPass = $ARGV [1];
59
60 -die 'Samba provisioning error: Missing admin password' unless ($AdminPass);
61 +die 'Samba provisioning error: Missing admin password' unless ($adminPass);
62
63 -##Pull config parameters for DC provision
64 +##Pull domain name from config dbase. This is the samba realm
65 my $cdb = esmith::ConfigDB->open;
66 -my $SystemName = $cdb->get('SystemName')->value ||
67 - die 'Samba provisioning error: SystemName not defined';
68 -my $DomainName = $cdb->get('DomainName')->value ||
69 +my $domainName = $cdb->get('DomainName')->value ||
70 die 'Samba provisioning error: Primary Domain Name not defined';
71 -my $WorkGroup = $cdb->get_prop ('smb', 'Workgroup') ||
72 +my $workGroup = $cdb->get_prop ('smb', 'Workgroup') ||
73 die 'Samba provisioning error: Workgroup not defined';
74 +my $realm = $workGroup . "." . $domainName;
75
76 ##Bail if Samba has already been initialized
77 if ($event eq 'bootstrap-initialize-samba' &&
78 @@ -61,8 +60,8 @@
79 ##Initialize Samba Domain
80 warn "Samba domain: Provisining Active Directory.";
81 my $provision = "/usr/bin/samba-tool domain provision --server-role=dc " .
82 - "--domain=$WorkGroup " .
83 - "--realm=$DomainName " .
84 + "--domain=$workGroup " .
85 + "--realm=$realm " .
86 "--adminpass=$provisionPass " .
87 "--dns-backend=SAMBA_INTERNAL " .
88 "--use-rfc2307 " .
89 @@ -86,7 +85,7 @@
90 ##Change administrator password from the stashed password to the admin password
91 warn "Samba domain: Setting Admin Password\n";
92 my $set_admin_pass = "/usr/bin/samba-tool user setpassword Administrator " .
93 - "--newpassword=" . $AdminPass . " " .
94 + "--newpassword=" . $adminPass . " " .
95 "-U Administrator\%" . $provisionPass;
96
97 system ($set_admin_pass);
98 diff -urbN smeserver-samba-0.1.0/root/etc/e-smith/events/actions/samba-create-domain-admins smeserver-samba-0.1.0-062616-update/root/etc/e-smith/events/actions/samba-create-domain-admins
99 --- smeserver-samba-0.1.0/root/etc/e-smith/events/actions/samba-create-domain-admins 2016-07-24 10:25:57.946060238 -0700
100 +++ smeserver-samba-0.1.0-062616-update/root/etc/e-smith/events/actions/samba-create-domain-admins 2016-06-25 15:31:09.000000000 -0700
101 @@ -43,14 +43,6 @@
102 system ($add_root);
103 warn "Unable to create root Samba user\n" if ($? == -1);
104
105 -my $add_members = "/usr/bin/samba-tool group addmembers " .
106 - "\'Domain Admins\' ".
107 - "root,admin " .
108 - "-U Administrator\%$AdminPass";
109 -system ($add_members);
110 -warn "Unable to add admin and root users to Domain Admins group\n" if ($? == -1);
111 -
112 -
113 ##Create ad_admin account and add it to domain admins for runtime access to acive directory
114 my $add_ad_admin = "/usr/bin/samba-tool user create " .
115 "ad_admin " . esmith::AD::getADPass() . " " .
116 @@ -58,11 +50,11 @@
117 system ($add_ad_admin);
118 die "Samba provisioning error: Unable to create ad_admin user in Active Directory.\n" if ($? == -1);
119
120 -$add_members = "/usr/bin/samba-tool group addmembers " .
121 +my $add_members = "/usr/bin/samba-tool group addmembers " .
122 "\'Domain Admins\' ".
123 - "ad_admin " .
124 + "root,admin,ad_admin " .
125 "-U Administrator\%$AdminPass";
126 -#system ($add_members);
127 -die "Samba provisioning error: Unable to add ad_admin user to the Domain Admins group.\n" if ($? == -1);
128 +system ($add_members);
129 +warn "Unable to add admin and root users to Domain Admins group\n" if ($? == -1);
130
131 1;
132 diff -urbN smeserver-samba-0.1.0/root/etc/e-smith/events/actions/user-AD-disable smeserver-samba-0.1.0-062616-update/root/etc/e-smith/events/actions/user-AD-disable
133 --- smeserver-samba-0.1.0/root/etc/e-smith/events/actions/user-AD-disable 1969-12-31 16:00:00.000000000 -0800
134 +++ smeserver-samba-0.1.0-062616-update/root/etc/e-smith/events/actions/user-AD-disable 2016-06-26 19:21:09.000000000 -0700
135 @@ -0,0 +1,38 @@
136 +#!/usr/bin/perl -w
137 +
138 +#------------------------------------------------------------
139 +#This action disables an Active Directory user
140 +#
141 +#Command format:
142 +#
143 +# user-AD-disable event username
144 +#
145 +# event : calling event name
146 +# username : username to disable
147 +#
148 +#Copyright 2016 Koozali Foundation, Inc.
149 +#06/26/2016: G.Zartman <gzartman@koozali.org>
150 +#
151 +#The code contained herein can be distributed under the same
152 +#license as Perl
153 +#
154 +#------------------------------------------------------------
155 +package esmith::thisaction;
156 +
157 +use strict;
158 +use warnings;
159 +no warnings ('qw');
160 +
161 +##Pull arguments
162 +my $event = $ARGV [0] || '';
163 +my $userName = $ARGV [1] || '';
164 +
165 +die "user-AD-disable error: username not found in action arguments\n"
166 + unless ($userName);
167 +
168 +my $disableUser = '/usr/bin/samba-tool user disable ' . $userName;
169 +system ($disableUser);
170 +die "create-AD-disable error: Unable to disable user:"
171 + if ($? == -1);
172 +
173 +1;
174 diff -urbN smeserver-samba-0.1.0/root/etc/e-smith/events/actions/user-create-AD smeserver-samba-0.1.0-062616-update/root/etc/e-smith/events/actions/user-create-AD
175 --- smeserver-samba-0.1.0/root/etc/e-smith/events/actions/user-create-AD 2015-02-12 21:17:53.000000000 -0800
176 +++ smeserver-samba-0.1.0-062616-update/root/etc/e-smith/events/actions/user-create-AD 2016-06-26 19:09:07.000000000 -0700
177 @@ -1,39 +1,36 @@
178 #!/usr/bin/perl -w
179
180 #------------------------------------------------------------
181 -#This action creates a user in the active directory given
182 -#a unique username and a hash reference of specific user data.
183 -#The hash reference must use the following keys or they will be
184 -#ignored:
185 -#
186 -#\%user_data_hash (
187 -#
188 -# 'description' => Some Description
189 -# 'given-name' => First Name
190 -# 'surname' => Last Name
191 -# 'initials' => User Initials
192 -# 'job-title' => Job Title
193 -# 'company' => Company
194 -# 'department' => Department
195 -# 'mail-address' => Mailing Address
196 -# 'physical-delivery-office' => Physical Address
197 -# 'telephone-number' => Telephone Number
198 -# 'internet-address' => Internet/Web Address
199 -# }
200 +#This action creates an Active Directory user given a username
201 +#from the accountsDB.
202 #
203 -#Copyright 2014 Koozali Foundation, Inc.
204 -#11/25/2014: G.Zartman <gzartman@koozali.org>
205 +#Command format:
206 +#
207 +# user-account-AD event username data:
208 +#
209 +# event : calling event name
210 +# username : unique username
211 +# data : Hash reference to user data to populate the AD
212 +# with. See the note below for
213 +#
214 +#Copyright 2015 Koozali Foundation, Inc.
215 +#06/23/2016: G.Zartman <gzartman@koozali.org>
216 #
217 #The code contained herein can be distributed under the same
218 #license as Perl
219 #
220 #TODO
221 -#- May need ot do a bit of datachecking on the values, unless
222 -# we assume the data comes to this action clean. Initials,
223 -# for example, will error out if more than 3 characters are
224 -# used for the value
225 +#
226 +#- We need to look at some kind of interm solution to use
227 +# acccountsDB in the short term until we figure out where we are
228 +# storing user data long term on SME. For now, we'll build a
229 +# hash of data from the accounts dbase, but also provide a means
230 +# to pass the data to this action with a hashref, which is the
231 +# preferred method for AD.
232 +#- For the hash reference, let's scrub it with the
233 +# esmith::AD::User::ValidData method
234 #- Consider setting the displayName attribute as well, otherwise
235 -# Active directory does it automatically to
236 +# Active Directory does it automatically to
237 # given-name initials surname. In some cases, this looks goofy.
238 #
239 #------------------------------------------------------------
240 @@ -42,89 +39,109 @@
241 use strict;
242 use warnings;
243 use esmith::AccountsDB;
244 -use esmith::AD;
245 +use esmith::ConfigDB;
246 +use esmith::AD::User;
247 no warnings ('qw');
248
249 +use Data::Dumper; #For debugging
250
251 ##Pull arguments
252 my $event = $ARGV [0] || '';
253 my $userName = $ARGV [1] || '';
254 -my $refUserData = $ARGV [2] || ''; #hash reference
255 -my $verbose = $ARGV [3] || ''; #flag to display user create output
256 +my $data = $ARGV [2] || ''; #Hash ref
257
258 die "user-create-AD error: username not found in action arguments\n"
259 unless ($userName);
260
261 -##Check AccountsDB to see if username existsi
262 -my $adb = esmith::AccountsDB->open_ro;
263 -if ($adb->get($userName)){
264 - die "Error in $event: User exists in esmith::accounts\n";
265 +##Check AD to see if username exists. If usernae already exists, then
266 +##bail out.
267 +my $ad = esmith::AD::User->new;
268 +die "user-create-AD error: User already exists in Active Directory.\n"
269 + if ($ad->doesUserExist($userName));
270 +
271 +##---------------------LEGACY MODE--------------------------------------
272 +##The following block of code will pull data from the
273 +##AccountsDB and copy it into the active directory. Using legacy mode
274 +##will ##ignore user data passed via the $data argument. Once we drop
275 +##support for the AccountsDB, this code can be removed
276 +
277 +my $cdb = esmith::ConfigDB->open_ro;
278 +my $legacy = $cdb->get_prop('smb','legacy');
279 +$cdb->close;
280 +
281 +if ($legacy eq 'enabled') {
282 + warn "Legacy Mode Enabled.\n";
283 +
284 + my $adb = esmith::AccountsDB->open_ro;
285 + my $acct = $adb->get($userName);
286 + die "user-create-AD error: $userName not found in accounts database.\n"
287 + unless (defined $acct and $acct->prop('type') eq "user");
288 +
289 + #build a hashref of AD data from accountdb data
290 + $data= {
291 + 'company' => $acct->prop('Company'),
292 + 'department' => $acct->prop('Dept'),
293 + 'givenName' => $acct->prop('FirstName'),
294 + 'mail' => $acct->prop('ForwardAddress'),
295 + 'physicalDeliveryOfficeName' => $acct->prop('Street'),
296 + 'sn' => $acct->prop('LastName'),
297 + 'telephoneNumber' => $acct->prop('Phone')
298 + };
299 +
300 + $adb->close;
301 }
302 +##----------------END LEGACY MODE----------------------------------------
303 +
304
305 -##Check AD to see if username exists
306 -my $ad = esmith::AD->new;
307 -if ($ad->doesUserExist($userName)){
308 - die "Error in $event: User exists in Active Directory\n";
309 +##Validate the user data
310 +if (ref($data) eq 'HASH') {
311 + foreach my $key (keys %$data) {
312 + unless ($ad->validData->{$key}) {
313 + warn "Ignoring $key attribute for update -- Not supported.\n";
314 + delete $data->{$key};
315 + }
316 + }
317 }
318
319 -##Create user in active directory.
320 +##Build Active Directory user create command
321 my $homeDirectory = '/home/e-smith/files/users/' . $userName . '/home/';
322 -my %userData = ();
323 -if (ref($refUserData) eq 'HASH') {%userData = %$refUserData;}
324 +my $shell = '/usr/bin/rssh';
325 +if ($data->{'loginShell'}) {
326 + $shell = $data->{'loginShell'};
327 + delete $data->{'loginShell'};
328 +}
329 +
330
331 +##Create AD User
332 +my $adPassword = $ad->getADPass();
333 my $addUser = "/usr/bin/samba-tool user create $userName " .
334 "--home-directory=$homeDirectory " .
335 - '--login-shell=/usr/bin/rssh ' .
336 + "--login-shell=$shell " .
337 '--random-password ' .
338 - '--description="Koozali User:" ';
339 -
340 -$addUser .= "$userData{'description'} "
341 - if (defined $userData{'description'});
342 -$addUser .= "--given-name=$userData{'given-name'} "
343 - if (defined $userData{'given-name'});
344 -$addUser .= "--surname=$userData{'surname'} "
345 - if (defined $userData{'surname'});
346 -$addUser .= "--initials=$userData{'initials'} "
347 - if (defined $userData{'initials'});
348 -$addUser .= "--job-title=$userData{'job-title'} "
349 - if (defined $userData{'job-title'});
350 -$addUser .= "--company=$userData{'company'} "
351 - if (defined $userData{'company'});
352 -$addUser .= "--department=$userData{'department'} "
353 - if (defined $userData{'department'});
354 -$addUser .= "--mail-address=$userData{'mail-address'} "
355 - if (defined $userData{'mail-address'});
356 -$addUser .= "--physical-delivery-office=$userData{'physical-delivery-office'} "
357 - if (defined $userData{'physical-delivery-office'});
358 -$addUser .= "--telephone-number=$userData{'telephone-number'} "
359 - if (defined $userData{'telephone-number'});
360 -$addUser .= "--internet-address=$userData{'internet-address'} "
361 - if (defined $userData{'internet-address'});
362 -
363 -#Run user create command silently so passwords dont show up in log files
364 -my $output = `$addUser 2>&1`;
365 -if ($output =~ /ERROR/) {
366 - die "Error creating $userName account" . ($verbose ? ': ' . $output : ".\n");
367 -}
368 -else {
369 - warn("Successfully created user $userName in the Active Directory.\n");
370 + '--description="Koozali User:" ' .
371 + "-U ad_admin\%$adPassword";
372 +system ($addUser);
373 +die ("Unable to add user #userName to Active Directory\n") if ($? == -1);
374 +
375 +##Make user a Posix User
376 +unless ($ad->setPosixUser($userName)) {
377 + warn ("Unable to set posix objectClass in AD for $userName.\n");
378 }
379
380 -##Set Posix settings for user
381 -$ad = esmith::AD->new();
382 +##Build Unix Attributes
383 my $UID = $ad->createUID($userName) || '';
384 my %posix = ('uidNumber' => $UID,
385 - 'gidNumber' => $UID,
386 + 'gidNumber' => '513',
387 'unixHomeDirectory' => $homeDirectory);
388 -unless ($ad->setAttr('user',$userName,\%posix)) {
389 - warn("Unable to set Posix attributes for $userName.\n");
390 +
391 +##Merge Unix Attributes with any Extended Attributes and save to AD
392 +my $mergedData = \%posix;
393 +if (ref($data) eq 'HASH') {
394 + $mergedData = {%posix,%$data};
395 }
396
397 +$ad->setManyAttr($userName,\%posix) ||
398 + warn("Unable update user attributes for $userName.\n");
399
400 -##Disable user until we enable in server-manager by setting password
401 -my $disableUser = '/usr/bin/samba-tool user disable ' . $userName;
402 -system ($disableUser);
403 -die "create-user-AD error: Unable to disable user after create:"
404 - if ($? == -1);
405
406 1;
407 diff -urbN smeserver-samba-0.1.0/root/etc/e-smith/templates/etc/rc.d/init.d/masq/90PreroutingDNScache smeserver-samba-0.1.0-062616-update/root/etc/e-smith/templates/etc/rc.d/init.d/masq/90PreroutingDNScache
408 --- smeserver-samba-0.1.0/root/etc/e-smith/templates/etc/rc.d/init.d/masq/90PreroutingDNScache 1969-12-31 16:00:00.000000000 -0800
409 +++ smeserver-samba-0.1.0-062616-update/root/etc/e-smith/templates/etc/rc.d/init.d/masq/90PreroutingDNScache 2016-06-21 01:52:10.000000000 -0700
410 @@ -0,0 +1,9 @@
411 +{
412 + my $dnscache_ip = $dnscache{ListenIP} || '127.0.0.3';
413 +
414 + ##Preroute to redirect DNS from local IP to dnscache on localhost 127.0.0.x
415 + $OUT .= " /sbin/iptables -t nat -I PREROUTING --in-interface eth0\\\n";
416 + $OUT .= "\t-p tcp -d $LocalIP --destination-port 53 -j DNAT\\\n";
417 + $OUT .= "\t--to-destination $dnscache_ip";
418 +}
419 +
420 diff -urbN smeserver-samba-0.1.0/root/etc/e-smith/templates/etc/smb.conf/12realm smeserver-samba-0.1.0-062616-update/root/etc/e-smith/templates/etc/smb.conf/12realm
421 --- smeserver-samba-0.1.0/root/etc/e-smith/templates/etc/smb.conf/12realm 2014-11-19 23:32:12.000000000 -0800
422 +++ smeserver-samba-0.1.0-062616-update/root/etc/e-smith/templates/etc/smb.conf/12realm 2016-06-20 23:38:53.000000000 -0700
423 @@ -1,5 +1,6 @@
424 {
425 - my $realm = $smb{realm} || $DomainName;
426 + my $workgroup = $smb{Workgroup} || 'sme-server';
427 + my $realm = $smb{realm} || $workgroup . "." . $DomainName;
428
429 "realm = $realm";
430 }
431 diff -urbN smeserver-samba-0.1.0/root/usr/share/perl5/vendor_perl/esmith/AD/OU.pm smeserver-samba-0.1.0-062616-update/root/usr/share/perl5/vendor_perl/esmith/AD/OU.pm
432 --- smeserver-samba-0.1.0/root/usr/share/perl5/vendor_perl/esmith/AD/OU.pm 1969-12-31 16:00:00.000000000 -0800
433 +++ smeserver-samba-0.1.0-062616-update/root/usr/share/perl5/vendor_perl/esmith/AD/OU.pm 2016-06-26 20:31:35.000000000 -0700
434 @@ -0,0 +1,84 @@
435 +package esmith::AD::OU;
436 +
437 +use strict;
438 +use base 'esmith::AD';
439 +no warnings ('qw');
440 +
441 +=head1 NAME
442 +
443 +esmith::AD::OU - Sub-Class to the Koozali esmith::AD API
444 +
445 +=head1 SYNOPSIS
446 +
447 + use esmith::AD::OU;
448 +
449 + my $ad = esmith::AD::OU->new();
450 + my @organizational_units = $ad->OUs;
451 +
452 +=head1 DESCRIPTION
453 +
454 +This module provide esmith::AD::OU methods for management of organizational
455 +units stored in the Koozali SME Server Active Directory. These methods are
456 +the preferred methods to interact with user objects in the Active Directory.
457 +Many methods in this class inherit functionality from the esmith::AD parent
458 +class and provide run-time binding of LDAP query elements to these parent
459 +methods. Methods provided in this module abstract Net::LDAP so that knowledge
460 +of this module is not required.
461 +=cut
462 +
463 +sub new {
464 + my ($class, %params) = @_;
465 +
466 + #Define runtime LDAP query parameters
467 + my $base = {
468 + 'default' => '&(objectClass=ou)(!(objectClass=computer))'
469 + };
470 + my $set = {
471 + 'all' => '',
472 + 'builtin' => '(!(objectClass=posixAccount))',
473 + 'koozali' => '(objectClass=posixAccount)',
474 + 'single' => ''
475 + };
476 + my $type = {
477 + 'posix' => ['top','ou','posixAccount']
478 + };
479 +
480 + my $attribute = {
481 + 'default' => 'sAMAccountName'
482 + };
483 + my $self = {
484 + 'base' => $base,
485 + 'set' => $set,
486 + 'attribute' => $attribute,
487 + 'type' => $type
488 + };
489 +
490 +
491 + #bless paramters into the class
492 + bless ($self, $class);
493 +
494 + return ($self);
495 +}
496 +
497 +
498 +=head2 Methods
499 +
500 +Methods here
501 +
502 +=head1 COPYRIGHT
503 +
504 +Copyright (c) 2016 Koozali Foundation, Inc.
505 +This program is free software; you can redistribute it and/or modify it
506 +under the same terms as Perl itself.
507 +
508 +=head1 AUTHOR
509 +
510 +Greg Zartman, Koozali Foundation <gzartman@koozali.org>
511 +
512 +=head1 SEE ALSO
513 +
514 +Net::LDAP
515 +
516 +=cut
517 +
518 +1;
519 diff -urbN smeserver-samba-0.1.0/root/usr/share/perl5/vendor_perl/esmith/AD/User.pm smeserver-samba-0.1.0-062616-update/root/usr/share/perl5/vendor_perl/esmith/AD/User.pm
520 --- smeserver-samba-0.1.0/root/usr/share/perl5/vendor_perl/esmith/AD/User.pm 2015-02-12 21:15:51.000000000 -0800
521 +++ smeserver-samba-0.1.0-062616-update/root/usr/share/perl5/vendor_perl/esmith/AD/User.pm 2016-06-25 23:12:35.000000000 -0700
522 @@ -18,34 +18,46 @@
523 =head1 DESCRIPTION
524
525 This module provide esmith::AD::User methods for management of users stored
526 -in the Koozali Active Directory. These methods are the preferred methods to
527 -interact with user objects in the Active Directory. Many methods in this
528 -class inherit functionality from the esmith::AD parent class and provide
529 -run-time binding of user objects to these parent methods. Methods provided
530 -in this module abstract Net::LDAP so that knowledge of this module is not
531 -required.
532 -
533 +in the Koozali SME Server Active Directory. These methods are the preferred
534 +methods to interact with user objects in the Active Directory. Many methods
535 +in this class inherit functionality from the esmith::AD parent class and
536 +provide run-time binding of LDAP query elements to these parent methods.
537 +Methods provided in this module abstract Net::LDAP so that knowledge of
538 +this module is not required.
539 =cut
540
541 sub new {
542 my ($class, %params) = @_;
543 - my $queryElements = {
544 +
545 + #Define runtime LDAP query parameters
546 + my $base = {
547 + 'default' => '&(objectClass=user)(!(objectClass=computer))'
548 + };
549 + my $set = {
550 'all' => '',
551 - 'builtin' => "(!(objectClass=posixAccount))",
552 - 'koozali' => "(objectClass=posixAccount)",
553 - 'member' => '',
554 - 'noMachine' => "(!(objectClass=computer))",
555 - 'object' => "&(objectClass=user)",
556 + 'builtin' => '(!(objectClass=posixAccount))',
557 + 'koozali' => '(objectClass=posixAccount)',
558 'single' => ''
559 };
560 - my $objectClass = ['top','person','organizationalPerson','user',
561 - 'posixAccount'];
562 + my $type = {
563 + 'posix' => ['top','person','organizationalPerson',
564 + 'user','posixAccount']
565 + };
566 +
567 + my $attribute = {
568 + 'default' => 'sAMAccountName'
569 + };
570 my $self = {
571 - 'query' => $queryElements,
572 - 'objectClass' => $objectClass
573 + 'base' => $base,
574 + 'set' => $set,
575 + 'attribute' => $attribute,
576 + 'type' => $type
577 };
578
579 +
580 + #bless paramters into the class
581 bless ($self, $class);
582 +
583 return ($self);
584 }
585
586 @@ -69,7 +81,7 @@
587 }
588
589
590 -=head3 createUID($name)
591 +=head3 createUID($name)*
592
593 This method calculates a unix UID for an Active Directory user
594 based upon the SID for the Active Directory object.
595 @@ -85,30 +97,30 @@
596 unless $name;
597
598 #Pull SID from the AD
599 - return (0) unless (my $SID = $self->getSID('user',$name));
600 + return (0) unless (my $SID = $self->getSID($name));
601
602 #Return UID = RID + 2000
603 my $RID = (split(/-/,$SID))[7];
604 return($RID+2000);
605 }
606
607 -=head3 doesUserExist($username)
608 +=head3 doesUserExist($username)*
609
610 This method checks the Active Directory for the existance of a username passed
611 as a parameter to the method. The method returns 1 if the username exists in
612 the Active Directory and 0 if it does not.
613
614 -Usage: $user_check = $ad->doesUserExist('group_name');
615 +Usage: $user_check = $ad->doesUserExist('user_name');
616
617 =cut
618
619 sub doesUserExist {
620 my ($self,$user) = @_;
621
622 - my @users = $self->listUsers('all');
623 + my ($userRecord) = $self->queryObjects($user);
624
625 - if (grep { $user eq $_ } @users) { return(1); }
626 - else{return(0);}
627 + if (defined $userRecord) {return(1);}
628 + else {return(0);}
629 }
630
631 =head3 getUID($username)
632 @@ -132,7 +144,7 @@
633 This method returns the value of the specified attribute for a user
634 listed in the Active Directory.
635
636 -Usage: $value = $ad->getUserAttr('uername','attribute');
637 +Usage: $value = $ad->getUserAttr('username','attribute');
638
639 =cut
640
641 @@ -173,7 +185,7 @@
642 return (map {(split(/[=,]/,$_))[1]} @results);
643 }
644
645 -=head3 getUserStatus($username)
646 +=head3 getUserStatus($username)*
647
648 This method returns user account status, enabled or disabled, for a
649 specified username.
650 @@ -188,23 +200,22 @@
651 return ($self->getStatus($user));
652 }
653
654 -=head3 listUsers($set)
655 +=head3 listUsers($set)*
656
657 -This method is an alias method to the esmith::AD::listObjects method.
658 -It returns a list of usernames from the Active Directory, and also
659 -subsets of users:
660 +This method returns a list of usernames in the active directory
661 +depending upon the search set sent to the method. Valid search
662 +sets include:
663
664 - - builtin: Users defined during the Active Directory
665 + - builtin : Users defined during the Active Directory
666 provisioning (e.g., Administrator);
667 - - koozali: Users defined in the Koozali API.
668 - - all: All users (default).
669 + - koozali : Users defined in the Koozali API.
670 + - all : All users (default).
671
672 Usage:
673 use esmith::AD::User;
674
675 my $ad = esmith::AD::User->new();
676 my @users = $ad->listUsers('koozali');
677 -
678 =cut
679
680 sub listUsers {
681 @@ -213,61 +224,15 @@
682 return($self->listObjects($set));
683 }
684
685 -=head3 queryMembers($set,$value)
686 -
687 -###FIX ME: Need to rewire
688 -This method is an alias method to the esmith::AD::listObjects method.
689 -It returns a list of usernames from the Active Directory, and also
690 -subsets of users:
691 -
692 -=cut
693 -
694 -sub queryMembers {
695 - my ($self,$set,$value)=@_;
696 -
697 - my $queryFilter = $self->buildQuery('member',$set,$value) || '';
698 -
699 - return ($self->runQuery($queryFilter));
700 -}
701 -
702 -=head3 queryObjects($set,$value)
703 -
704 -###FIX ME: Need to rewire
705 -This method is an alias method to the esmith::AD::listObjects method.
706 -It returns a list of usernames from the Active Directory, and also
707 -subsets of users:
708 -
709 - - builtin: Users defined during the Active Directory
710 - provisioning (e.g., Administrator);
711 - - koozali: Users defined in the Koozali API.
712 - - all: All users (default).
713 -
714 -Usage:
715 - use esmith::AD::User;
716 -
717 - my $ad = esmith::AD::User->new();
718 - my @users = $ad->listUsers('koozali');
719 -
720 -=cut
721 -
722 -sub queryObjects {
723 - my ($self,$set,$value)=@_;
724 -
725 - my $class = 'object';
726 - if (defined $value) {$class = 'single'};
727 -
728 - my $queryFilter = $self->buildQuery($class,$set,$value) || '';
729 -
730 - return ($self->runQuery($queryFilter));
731 -}
732 -
733 -=head3 setPostixUser ($user)
734 +=head3 setPosixUser($user) *
735
736 This method designates a user as a Posix User. The Posix user type
737 -represents the users managed by Koozali and are those groups that are
738 -displayed in the server-manager
739 +represents the users managed by Koozali and displayed in the
740 +server-manager. This method returns 1 if successful and 0 if something
741 +went wrong.
742
743 -Usage: $ad->setPosixUser('username')
744 +Usage: $ad = esmith::AD::User;
745 + $ad->setPosixUser('username')
746
747 =cut
748
749 @@ -278,22 +243,6 @@
750 }
751
752
753 -=head3 setUserAttr($user,$attr,$value)
754 -
755 -This method sets or modifies an attribute value for the specified
756 -username.
757 -
758 -Usage: $ad->setUserAttr('username','attribute','value')
759 -
760 -=cut
761 -
762 -sub setUserAttr {
763 - my ($self,$user,$attr,$value) = @_;
764 -
765 - if ($self->setAttr($user,{$attr=>$value})) { return(1); }
766 - else { die->error("Unable to modify \"$attr\" for user \"$user\".\n");}
767 -}
768 -
769 =head3 setUserGroups($username,$groupRef)
770
771 This mthod sets the groups that a user is a member of give the username
772 @@ -379,7 +328,7 @@
773
774 =head1 COPYRIGHT
775
776 -Copyright (c) 2014 Koozali Foundation, Inc.
777 +Copyright (c) 2016 Koozali Foundation, Inc.
778 This program is free software; you can redistribute it and/or modify it
779 under the same terms as Perl itself.
780
781 diff -urbN smeserver-samba-0.1.0/root/usr/share/perl5/vendor_perl/esmith/AD.pm smeserver-samba-0.1.0-062616-update/root/usr/share/perl5/vendor_perl/esmith/AD.pm
782 --- smeserver-samba-0.1.0/root/usr/share/perl5/vendor_perl/esmith/AD.pm 2015-02-12 21:14:42.000000000 -0800
783 +++ smeserver-samba-0.1.0-062616-update/root/usr/share/perl5/vendor_perl/esmith/AD.pm 2016-06-26 18:54:06.000000000 -0700
784 @@ -6,11 +6,15 @@
785 use esmith::ConfigDB;
786 use esmith::AccountsDB;
787
788 +#This package is to aid in debugging. Can remove
789 +use Data::Dumper;
790 +
791 no warnings ('qw');
792
793 =head1 NAME
794
795 -esmith::AD - Interface to Samba 4 Active Directory for Koozali
796 +esmith::AD - Interface to Samba 4 Active Directory for
797 + Koozali SME Server
798
799 =head1 SYNOPSIS
800
801 @@ -33,7 +37,7 @@
802 This module provides an abstracted interface to Samba 4 Active Directory
803 for the Koozali SME Server.
804
805 -Methods provided by this interface interacts with Samba 4 Active Directory
806 +Methods provided by this interface interact with Samba 4 Active Directory
807 using the Net::LDAP perl module. Understanding of Net::LDAP syntax is
808 not required to utilize the primary functionality provided by this interface,
809 but the full suite of Net::LDAP methods is provided by this module should
810 @@ -51,15 +55,15 @@
811
812 =head2 Fully Abstraced Methods
813
814 -For all intents and purposes, this interface is the preferred approach to
815 -interact with the Koozali Active Directory. Included in this API are child
816 -classes for managing the different object types in the Active Directory
817 +For all intents and purposes, fully abstracted methods are the the preferred
818 +approach to interact with the Koozali Active Directory. Included in this API
819 +are child classes for managing the different object types in the Active Directory
820 including users, groups, and DNS entries. Methods provided in this parent
821 class should generally not be called directly (unless noted in the method
822 -specific documentation), but from one of these child classies. This is because
823 +specific documentation), but from one of these child classes. This is because
824 this API provides run-time binding of many of these parent methods to the
825 object types they are presented with. See esmith::AD::User, esmith::AD::Group,
826 -and esmith::AD::DNS for more details.
827 +esmith::AD:OU, and esmith::AD::DNS for more details.
828
829 Usage example:
830 use esmith::AD::User;
831 @@ -69,10 +73,10 @@
832
833 =head3 getADRecord {$name)
834
835 -This method returns a hash reference of attribute / value pairs
836 +This method returns a hash reference of attribute/value pairs
837 from the Active Directory for attributes supported by this method,
838 -given an object name. This method should not be called from this
839 -class, but one of the esmith::AD child classes.
840 +given an object name. This method must be called from a child
841 +method or this code will return a runtime error.
842
843 Usage: $hashref = $ad->getADRecord($name);
844
845 @@ -102,9 +106,8 @@
846 =head3 SID($name)
847
848 This method retrieves the SID for a specified Active Directory
849 -object name, decrypts it, and then returns it. This method
850 -must be called from a esmith::AD child and not directly
851 -from this class.
852 +object name, decrypts it, and then returns it. This method must be
853 +called from a child method or this code will return a runtime error.
854
855 Usage: my $sid = $ad->getSID('username');
856
857 @@ -118,7 +121,7 @@
858 if (ref($self) eq 'esmith::AD');
859 die $self->error("Object name not specified.\n") unless $name;
860
861 - my ($record) = $self->queryObjects('single',$name);
862 + my ($record) = $self->queryObjects($name);
863
864 die $self->error("Unable to find \"$name\" in the Active Directory.\n")
865 unless ($record);
866 @@ -128,11 +131,12 @@
867 return($self->sidToString($encryptedSID));
868 }
869
870 +
871 =head3 getStatus($name)
872
873 This method returns the status, enabled or disabled, for various entries
874 -in the Active Directory. This method must be called from a esmith::AD
875 -child and not directly from this class.
876 +in the Active Directory. This method must be called from a child
877 +method or this code will return a runtime error.
878
879 Usage: my $status=$ad->getStatus('username');
880
881 @@ -147,7 +151,7 @@
882 die $self->error("Object name not specified.\n") unless $name;
883
884 #Lookup entry in the active directory
885 - my ($record) = $self->queryObjects('single',$name);
886 + my ($record) = $self->queryObjects($name);
887
888 die $self->error("Unable to find \"$name\" in the Active Directory.\n")
889 unless ($record);
890 @@ -161,19 +165,26 @@
891
892 =head3 listObjects($set)
893
894 -This method returns a list of object names (cn) from the Active Directory.
895 -The method is meant to be called from an esmith::AD child and not directly
896 -from the parent class, esmith::AD. This method also queriesi subsets of
897 -objects:
898 +This method returns a list of object names (sAMAccountName) from the Active
899 +Directory. It will return one of the following subsets of AD objects:
900
901 - - all: All objects within the search objectClass;
902 + - all: All searchable objects;
903 - builtin: Objects defined during the AD provisioning;
904 - - koozali: Objects defined by this API.
905 + - koozali: Objects defined by this API;
906
907 -Usage: use esmith::AD::User;
908 +Usage example 1: Get a list of koozali users
909
910 + use esmith::AD::User;
911 my $ad = esmith::AD;User->new();
912 - my @objects = $ad->listObjects('koozali');
913 + my @kooazli_users = $ad->listObjects('koozali');
914 +
915 +Usage example 2: Get list of buildin groups
916 +
917 + usee esmith::AD:Group;
918 + my $ad = esmith::AD:Group->new();
919 + my @builtin_groups = $ad->listObjects('builtin');
920 +
921 +This method must be called from a child method or this code will return a runtime error.
922
923 =cut
924
925 @@ -192,50 +203,172 @@
926 die $self->error("Unable to query objects from Active Directory.\n")
927 unless (@records);
928
929 - my @objects = map { $_->get_value('cn') } @records;
930 + my @objects = map { $_->get_value('sAMAccountName') } @records;
931
932 return(@objects);
933 }
934
935 -=head3 setAttr($type,$name,$hashRef)
936
937 -This method sets or modifies attribute / value pairs for an Active Directory
938 -object given object type, object name, and a hash reference to the values
939 -to set or modify. It should be noted that this method will only update
940 -attribute / value pairs as defined the validData method.
941 -
942 -NOTE: This method dies is data fails validation check. This may need
943 - to be changed to provide better feedback to server-panels and
944 - what not.
945 -
946 -FIXME: 1)NEED TO FIX THE CODE THAT VALIDATES DAT APRIOR TO UPDATING
947 - 2)The name attribute is actually givenName + sn (surname) attribute
948 - with a space between. We should consider forcing this instead of
949 - letting it be changed free form as we are now.
950 +
951 +
952 +=head3 queryMembers($set,$value)
953 +
954 +###FIX ME: Need to rewite POD
955 +This method is an alias method to the esmith::AD::listObjects method.
956 +It returns a list of usernames from the Active Directory, and also
957 +subsets of users:
958 +
959 +=cut
960 +
961 +sub queryMembers {
962 + my ($self,$set,$value)=@_;
963 +
964 + ##Need to rewrite this to use the queryObjectsmethod
965 + my $queryFilter = $self->BuildQuery('member',$set,$value) || '';
966 +
967 + return ($self->runQuery($queryFilter));
968 +}
969 +
970 +
971 +=head3 queryObjects($self,$value,$attribute,$base)
972 +
973 +This is the primary query method for this API and returns Net::LDAP record
974 +objects from the Active Directory in list context. Many of the query elements
975 +for an AD query are set via runtime parameters in the child class calling
976 +this method. If nothing is passed to this method, then this method returns
977 +a list of all user records in the Active Directory.
978 +
979 +$value defines what records this method will search for, given default query
980 +elements set in the child class. Setting $value to the following will search
981 +for specific groups of user records in the AD:
982 +
983 + - all: All user account records in the active directory
984 + - buildin: Builtin user account records. Example: Administrator
985 + - koozali: All user accoun records defined in this UI. These are the typical
986 + user accounts setup in the server-manager for via the commandline.
987 +
988 +To search for a single user record, set $value to the Active Directory attribute
989 +value for the record you'd like to search for. The default search attribute is
990 +the username (e.g., sAMAccountName).
991 +
992 +This method can also search for single records given other AD attributes,
993 +but other search attributes must be defined in child classes. See child
994 +class perldoc for details on support AD attributes.
995 +
996 +
997 + #Search for a user record by username
998 + use esmith::AD::User;
999 + my $ad = esmith::AD->new;
1000 + my ($userRecord) = $ad->QueryObjects('username');
1001 +
1002 + #Search all Koozali users
1003 + user esmith::AD::User;
1004 + my @koozaliUser = $ad-QueryObjects('koozali');
1005 +
1006 +=cut
1007 +
1008 +sub queryObjects {
1009 + my ($self,$setValue,$attribute,$base)=@_;
1010 +
1011 + ##Error out if this method called from this class and not a child
1012 + die $self->error("Must call this method on a esmith::AD child object.\n")
1013 + if (ref($self) eq 'esmith::AD');
1014 +
1015 + ##Check for changes to the runtime query parameters.
1016 + $attribute = 'default'
1017 + unless ($attribute && defined($self->{'attribute'}->{$attribute}));
1018 + $base = 'default'
1019 + unless ($base && defined($self->{'base'}->{$base}));
1020 +
1021 + ##Assume we are searching for all user accounts unless the $value tells us
1022 + ##otherwise
1023 + my $set = 'all';
1024 + my $searchValue = '';
1025 +
1026 + ##Look at $setValue and determine query set
1027 + if (grep {$setValue eq $_} qw(all builtin koozali)) {
1028 + $set = $setValue;
1029 + }
1030 + else {
1031 + $set = 'single';
1032 + $searchValue = $setValue;
1033 + };
1034 +
1035 +
1036 + ##Build Query Filter
1037 + my $queryFilter = $self->{'base'}->{"$base"} .
1038 + $self->{'set'}->{"$set"};
1039 + if ($set eq 'single') {
1040 + $queryFilter .= "(" .
1041 + $self->{'attribute'}->{$attribute} .
1042 + "=" .
1043 + $searchValue .
1044 + ")";
1045 + }
1046 +
1047 + return ($self->runQuery($queryFilter));
1048 +}
1049 +
1050 +
1051 +=head3 setAttr($name,$attr,$value)
1052 +
1053 +This method sets or modifies a single attribute/value pair for a
1054 +specified object given the object sAMAccount Name and a attribute
1055 +value pair. See setManyAttr for more details about updating object
1056 +attributes.
1057 +
1058 +Usage: $ad->setAttr('name','attribute','value')
1059 +
1060 =cut
1061
1062 sub setAttr {
1063 + my ($self,$name,$attr,$value) = @_;
1064 +
1065 + if ($self->setManyAttr($name,{$attr=>$value})) { return(1); }
1066 + else { die->error("Unable to modify \"$attr\" for \"$name\".\n");}
1067 +}
1068 +
1069 +
1070 +=head3 setManyAttr($name,$hashRef)
1071 +
1072 +This method sets or modifies multiple attribute / value pairs for
1073 +an Active Directory object sAMAccount. The method uses
1074 +runtime binding to determine which type of object is being updated.
1075 +Update attribute pairs need to be passed to the method as a hash
1076 +reference. It should be noted that this method will only update
1077 +attribute / value pairs supported by this class. All other pairs will
1078 +be ignored. Supported attribute/value paris are defined in the
1079 +validData method. This method returns 1 if successful and will typically
1080 +die with appropriate error information if unsucessful.
1081 +
1082 +NOTE: This method currently dies if data fails validation check.
1083 + This may need to be changed to provide better feedback to
1084 + server-panels in the future.
1085 +=cut
1086 +
1087 +sub setManyAttr {
1088 my ($self,$name,$attrRef) = @_;
1089
1090 #Don't allow this method from this class
1091 die $self->error("Must call this method on a esmith::AD child object.\n")
1092 if (ref($self) eq 'esmith::AD');
1093 +
1094 + #Check to make sure we have enough data to perform an update
1095 die $self->error("Entity to modify not specified.\n") unless ($name);
1096 die $self->error("No attributes set to modify for $name\n")
1097 unless (ref($attrRef) eq 'HASH');
1098
1099 -
1100 - ##Validate attributes and values to update
1101 + #Validate that we support the attributes for update
1102 foreach my $key (keys %$attrRef) {
1103 - die $self->error("Unsupported attribute \"$key\".\n")
1104 - unless ($self->validData->{$key});
1105 -
1106 - ###FIX ME: Add regex check for actual values
1107 + unless ($self->validData->{$key}) {
1108 + warn "Ignoring $key attribute for update -- Not supported.\n";
1109 + delete $attrRef->{$key};
1110 + }
1111 }
1112
1113 #Query Record to update from AD
1114 - my ($record) = $self->queryObject($name);
1115 - die $self->error("Unable to query \"$name\" from Active Directory\n.")
1116 + my ($record) = $self->queryObjects($name);
1117 + die $self->error("Unable to query \"$name\" from Active Directory.\n.")
1118 unless ($record);
1119
1120 my $result = $self->updateAD($record,$attrRef);
1121 @@ -244,11 +377,10 @@
1122 return (1);
1123 }
1124
1125 -=head3 setPosix($type,$name)
1126 +=head3 setPosix($type,$name) *
1127
1128 This method designates an Active Directory object as a Posix object given
1129 -object type and name. Currently, this method support the types user and
1130 -group.
1131 +and object sAMAccount name (e.g., username).
1132
1133 =cut
1134
1135 @@ -260,13 +392,15 @@
1136 if (ref($self) eq 'esmith::AD');
1137
1138 #Pull record from AD
1139 - my ($record) = $self->queryObject($name);
1140 + my ($record) = $self->queryObjects($name);
1141 die $self->error("Unable to find \"$name\" in the Active Directory.\n")
1142 unless ($record);
1143
1144 + ##Localize posix type array reference to shorten LDAP update syntax
1145 + my $typeRef = {'objectClass' => $self->{'type'}->{'posix'}};
1146 +
1147 #Set the Posix objectClass
1148 - my $result = $self->updateAD($record,
1149 - {'objectClass'=>$self->{'objectClass'}});
1150 + my $result = $self->updateAD($record,$typeRef);
1151 die $self->error("Unable to update \"$name\" record.\n") unless ($result);
1152
1153 return(1);
1154 @@ -278,11 +412,11 @@
1155 Methods providing a thin abstracted connection to Koozali Active Directory
1156 using Net::LDAP. These methods are designed to connect directly to the
1157 Koozali Active Directory and return Net::LDAP objects. The developer should
1158 -generally not need to call these Partiall Abstracted Methods directly, as
1159 -this class includes Fully Abstracted Methods that provide Active Directory
1160 -functionality needed to manage the Koozali SME Server. However, the
1161 -developer may utilize these Partially Abstracted Methods for more fine
1162 -grained interacting with the Active Directory using Net::LDAP.
1163 +generally not need to call these Partially Abstracted Methods directly, as
1164 +this class includes Fully Abstracted Methods to more directly and specifically
1165 +access data in the Active Directly. However, the developer may utilize these
1166 +Partially Abstracted Methods for more fine grained interacting with the
1167 +Active Directory using Net::LDAP.
1168
1169 =head3 connect()
1170
1171 @@ -308,6 +442,7 @@
1172 my $domain = $self->domain;
1173 my $sme_ad_host=$self->hostIP;
1174
1175 +
1176 #Pull AD password from local storage
1177 my $ad_password = $self->getADPass;
1178
1179 @@ -316,6 +451,7 @@
1180
1181 #Bind to the AD and return the connection object
1182 my $bind = $ad->bind($domain . "\\ad_admin", password=>$ad_password);
1183 +
1184 if($bind->code) {
1185 die $self->error($bind->server_error);
1186 }
1187 @@ -341,17 +477,21 @@
1188 sub runQuery {
1189 my ($self,$filter) = @_;
1190
1191 - die $self->error('Query filter no specified.') unless $filter;
1192 + die $self->error('Query filter not specified.') unless $filter;
1193
1194 - ##Connect to AD
1195 + ##Bind to AD
1196 my $ad = $self->connect;
1197
1198 - ##Send query to the Active Directory
1199 + ##Get LDAP base DN for AD query -- we need to build it.
1200 + my $base = $self->baseDN;
1201 +
1202 + ##Query the Active Directory
1203 my $query=$ad->search(
1204 - base => 'DC=domain,DC=com',
1205 + base => "$base",
1206 filter => "$filter"
1207 );
1208 $ad->unbind;
1209 +
1210 if($query->code) { die $self->error($query->server_error);}
1211
1212 return ($query->entries);
1213 @@ -362,7 +502,7 @@
1214 This method updates an Active Directory record, given a Net::LDAP::Entry
1215 object and a hash reference of data to update. This method does not check
1216 the contents of the record to update nor the hash reference prior to trying
1217 -to upate the Active Directory other than schema checks done by the LDAP
1218 +to update the Active Directory, other than schema checks done by the LDAP
1219 server. The method will return 1 if the update was successful and will die
1220 with a LDAP server error is there was a problem.
1221
1222 @@ -375,7 +515,7 @@
1223
1224 die $self->error("Record object to update not specified.\n")
1225 unless ($record =~ /Net::LDAP::Entry/);
1226 - die $self->error("Update hash reference no specified.\n")
1227 + die $self->error("Update hash reference not specified.\n")
1228 unless (ref($attrRef) eq "HASH");
1229
1230 #Bind to AD and update
1231 @@ -397,27 +537,27 @@
1232 ##other than the note comments contained in this code, as they
1233 ##are meant to support other methods contained in this class.
1234 ##The developer may use these methods, but should examine the
1235 -##code closely to achieved desired results.
1236 +##code closely to achieve desired results.
1237 ##-----------------------------------------------------------
1238
1239 #------------------------------------------------------------
1240 -#Method: buildFilter($set,$value)
1241 -# This method builds a query filter by run-time binding
1242 -# to esmith::AD child query elements
1243 +#Method: baseDN()
1244 +# This method builds the Base DN for LDAP query of the
1245 +# Active Directory. The Base DN is build from the
1246 +# primary machine domain name, which is considered the
1247 +# realm by Samba.
1248 +#
1249 #-----------------------------------------------------------
1250 -sub buildQuery {
1251 - my ($self,$class,$set,$value)=@_;
1252 -
1253 - #Set dynamic LDAP query elements
1254 - $self->{'query'}->{'single'} = "&(cn=$value)(objectClass=group)";
1255 - $self->{'query'}->{'member'} = "&(objectClass=group)(memberOf=$value)";
1256 +sub baseDN {
1257 + my ($self)=@_;
1258
1259 - $set = 'all' unless (grep {$set eq $_} qw(all builtin koozali));
1260 + my $realm = $self->realm;
1261 + my @elements = split (/\./, $realm);
1262
1263 - my $filter = $self->{'query'}->{$class} . $self->{'query'}->{$set};
1264 - $filter .= $self->{'query'}->{'noMachine'};
1265 + my $base = '';
1266 + foreach (@elements) {$base .= "DC=" . $_ . ","};
1267
1268 - return($filter)
1269 + return(substr ($base,0,-1));
1270 }
1271
1272 #------------------------------------------------------------
1273 @@ -426,24 +566,48 @@
1274 sub error {
1275 my ($self,$error)=@_;
1276
1277 + $error = '' unless $error;
1278 +
1279 return ((caller(1))[3] . " error: " . $error);
1280 }
1281
1282 #------------------------------------------------------------
1283 #Method: domain()
1284 -# This method returns the Samba domain from the smb
1285 -# configuration dbase. This method is not meant to be
1286 -# used external to this class.
1287 +# This method returns the Samba domain, which is stored
1288 +# in the configuration dbase as Workgroup
1289 #------------------------------------------------------------
1290 sub domain {
1291 my $self = shift;
1292
1293 my $cdb = esmith::ConfigDB->open_ro;
1294 my $domain = $cdb->get_prop('smb','Workgroup') ||
1295 - die $self->error("Unable to determine AD domain name from ConfigDB\n");
1296 + die $self->error("Unable to determine the Workgroup from ConfigDB\n");
1297 + $cdb->close;
1298 +
1299 + return ($domain);
1300 +}
1301 +
1302 +#------------------------------------------------------------
1303 +#Method: realm()
1304 +# This method returns the realm which is the SME
1305 +# domain name stored in the configuration dbase
1306 +# This method is not meant to be used external
1307 +# to this class.
1308 +#------------------------------------------------------------
1309 +sub realm {
1310 + my $self = shift;
1311 +
1312 + my $cdb = esmith::ConfigDB->open_ro;
1313 + my $realm = $cdb->get_prop('smb','realm');
1314 + return ($realm) if defined $realm;
1315 +
1316 + my $domainName = $cdb->get_value('DomainName') ||
1317 + die $self->error("Unable to determine Domain Name from ConfigDB\n");
1318 $cdb->close;
1319
1320 - return($domain);
1321 + my $ad_domain = $self->domain();
1322 +
1323 + return($ad_domain . '.' . $domainName);
1324 }
1325
1326 #------------------------------------------------------------
1327 @@ -512,6 +676,12 @@
1328 return $sid_str;
1329 }
1330
1331 +=head1 COPYRIGHT
1332 +
1333 +Copyright (c) 2016 Koozali Foundation, Inc.
1334 +This program is free software; you can redistribute it and/or modify it
1335 +under the same terms as Perl itself.
1336 +
1337 =head1 AUTHOR
1338
1339 Greg Zartman, Koozali Foundation <gzartman@koozali.org>

admin@koozali.org
ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed