diff options
Diffstat (limited to 'keystone-moon/keystone/common/ldap/core.py')
| -rw-r--r-- | keystone-moon/keystone/common/ldap/core.py | 1910 |
1 files changed, 1910 insertions, 0 deletions
diff --git a/keystone-moon/keystone/common/ldap/core.py b/keystone-moon/keystone/common/ldap/core.py new file mode 100644 index 00000000..144c0cfd --- /dev/null +++ b/keystone-moon/keystone/common/ldap/core.py @@ -0,0 +1,1910 @@ +# Copyright 2012 OpenStack Foundation +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the +# License for the specific language governing permissions and limitations +# under the License. + +import abc +import codecs +import functools +import os.path +import re +import sys +import weakref + +import ldap.filter +import ldappool +from oslo_log import log +import six + +from keystone import exception +from keystone.i18n import _ +from keystone.i18n import _LW + +LOG = log.getLogger(__name__) + +LDAP_VALUES = {'TRUE': True, 'FALSE': False} +CONTROL_TREEDELETE = '1.2.840.113556.1.4.805' +LDAP_SCOPES = {'one': ldap.SCOPE_ONELEVEL, + 'sub': ldap.SCOPE_SUBTREE} +LDAP_DEREF = {'always': ldap.DEREF_ALWAYS, + 'default': None, + 'finding': ldap.DEREF_FINDING, + 'never': ldap.DEREF_NEVER, + 'searching': ldap.DEREF_SEARCHING} +LDAP_TLS_CERTS = {'never': ldap.OPT_X_TLS_NEVER, + 'demand': ldap.OPT_X_TLS_DEMAND, + 'allow': ldap.OPT_X_TLS_ALLOW} + + +# RFC 4511 (The LDAP Protocol) defines a list containing only the OID '1.1' to +# indicate that no attributes should be returned besides the DN. +DN_ONLY = ['1.1'] + +_utf8_encoder = codecs.getencoder('utf-8') + + +def utf8_encode(value): + """Encode a basestring to UTF-8. + + If the string is unicode encode it to UTF-8, if the string is + str then assume it's already encoded. Otherwise raise a TypeError. + + :param value: A basestring + :returns: UTF-8 encoded version of value + :raises: TypeError if value is not basestring + """ + if isinstance(value, six.text_type): + return _utf8_encoder(value)[0] + elif isinstance(value, six.binary_type): + return value + else: + raise TypeError("value must be basestring, " + "not %s" % value.__class__.__name__) + +_utf8_decoder = codecs.getdecoder('utf-8') + + +def utf8_decode(value): + """Decode a from UTF-8 into unicode. + + If the value is a binary string assume it's UTF-8 encoded and decode + it into a unicode string. Otherwise convert the value from its + type into a unicode string. + + :param value: value to be returned as unicode + :returns: value as unicode + :raises: UnicodeDecodeError for invalid UTF-8 encoding + """ + if isinstance(value, six.binary_type): + return _utf8_decoder(value)[0] + return six.text_type(value) + + +def py2ldap(val): + """Type convert a Python value to a type accepted by LDAP (unicode). + + The LDAP API only accepts strings for values therefore convert + the value's type to a unicode string. A subsequent type conversion + will encode the unicode as UTF-8 as required by the python-ldap API, + but for now we just want a string representation of the value. + + :param val: The value to convert to a LDAP string representation + :returns: unicode string representation of value. + """ + if isinstance(val, bool): + return u'TRUE' if val else u'FALSE' + else: + return six.text_type(val) + + +def enabled2py(val): + """Similar to ldap2py, only useful for the enabled attribute.""" + + try: + return LDAP_VALUES[val] + except KeyError: + pass + try: + return int(val) + except ValueError: + pass + return utf8_decode(val) + + +def ldap2py(val): + """Convert an LDAP formatted value to Python type used by OpenStack. + + Virtually all LDAP values are stored as UTF-8 encoded strings. + OpenStack prefers values which are unicode friendly. + + :param val: LDAP formatted value + :returns: val converted to preferred Python type + """ + return utf8_decode(val) + + +def convert_ldap_result(ldap_result): + """Convert LDAP search result to Python types used by OpenStack. + + Each result tuple is of the form (dn, attrs), where dn is a string + containing the DN (distinguished name) of the entry, and attrs is + a dictionary containing the attributes associated with the + entry. The keys of attrs are strings, and the associated values + are lists of strings. + + OpenStack wants to use Python types of its choosing. Strings will + be unicode, truth values boolean, whole numbers int's, etc. DN's will + also be decoded from UTF-8 to unicode. + + :param ldap_result: LDAP search result + :returns: list of 2-tuples containing (dn, attrs) where dn is unicode + and attrs is a dict whose values are type converted to + OpenStack preferred types. + """ + py_result = [] + at_least_one_referral = False + for dn, attrs in ldap_result: + ldap_attrs = {} + if dn is None: + # this is a Referral object, rather than an Entry object + at_least_one_referral = True + continue + + for kind, values in six.iteritems(attrs): + try: + val2py = enabled2py if kind == 'enabled' else ldap2py + ldap_attrs[kind] = [val2py(x) for x in values] + except UnicodeDecodeError: + LOG.debug('Unable to decode value for attribute %s', kind) + + py_result.append((utf8_decode(dn), ldap_attrs)) + if at_least_one_referral: + LOG.debug(('Referrals were returned and ignored. Enable referral ' + 'chasing in keystone.conf via [ldap] chase_referrals')) + + return py_result + + +def safe_iter(attrs): + if attrs is None: + return + elif isinstance(attrs, list): + for e in attrs: + yield e + else: + yield attrs + + +def parse_deref(opt): + try: + return LDAP_DEREF[opt] + except KeyError: + raise ValueError(_('Invalid LDAP deref option: %(option)s. ' + 'Choose one of: %(options)s') % + {'option': opt, + 'options': ', '.join(LDAP_DEREF.keys()), }) + + +def parse_tls_cert(opt): + try: + return LDAP_TLS_CERTS[opt] + except KeyError: + raise ValueError(_( + 'Invalid LDAP TLS certs option: %(option)s. ' + 'Choose one of: %(options)s') % { + 'option': opt, + 'options': ', '.join(LDAP_TLS_CERTS.keys())}) + + +def ldap_scope(scope): + try: + return LDAP_SCOPES[scope] + except KeyError: + raise ValueError( + _('Invalid LDAP scope: %(scope)s. Choose one of: %(options)s') % { + 'scope': scope, + 'options': ', '.join(LDAP_SCOPES.keys())}) + + +def prep_case_insensitive(value): + """Prepare a string for case-insensitive comparison. + + This is defined in RFC4518. For simplicity, all this function does is + lowercase all the characters, strip leading and trailing whitespace, + and compress sequences of spaces to a single space. + """ + value = re.sub(r'\s+', ' ', value.strip().lower()) + return value + + +def is_ava_value_equal(attribute_type, val1, val2): + """Returns True if and only if the AVAs are equal. + + When comparing AVAs, the equality matching rule for the attribute type + should be taken into consideration. For simplicity, this implementation + does a case-insensitive comparison. + + Note that this function uses prep_case_insenstive so the limitations of + that function apply here. + + """ + + return prep_case_insensitive(val1) == prep_case_insensitive(val2) + + +def is_rdn_equal(rdn1, rdn2): + """Returns True if and only if the RDNs are equal. + + * RDNs must have the same number of AVAs. + * Each AVA of the RDNs must be the equal for the same attribute type. The + order isn't significant. Note that an attribute type will only be in one + AVA in an RDN, otherwise the DN wouldn't be valid. + * Attribute types aren't case sensitive. Note that attribute type + comparison is more complicated than implemented. This function only + compares case-insentive. The code should handle multiple names for an + attribute type (e.g., cn, commonName, and 2.5.4.3 are the same). + + Note that this function uses is_ava_value_equal to compare AVAs so the + limitations of that function apply here. + + """ + + if len(rdn1) != len(rdn2): + return False + + for attr_type_1, val1, dummy in rdn1: + found = False + for attr_type_2, val2, dummy in rdn2: + if attr_type_1.lower() != attr_type_2.lower(): + continue + + found = True + if not is_ava_value_equal(attr_type_1, val1, val2): + return False + break + if not found: + return False + + return True + + +def is_dn_equal(dn1, dn2): + """Returns True if and only if the DNs are equal. + + Two DNs are equal if they've got the same number of RDNs and if the RDNs + are the same at each position. See RFC4517. + + Note that this function uses is_rdn_equal to compare RDNs so the + limitations of that function apply here. + + :param dn1: Either a string DN or a DN parsed by ldap.dn.str2dn. + :param dn2: Either a string DN or a DN parsed by ldap.dn.str2dn. + + """ + + if not isinstance(dn1, list): + dn1 = ldap.dn.str2dn(utf8_encode(dn1)) + if not isinstance(dn2, list): + dn2 = ldap.dn.str2dn(utf8_encode(dn2)) + + if len(dn1) != len(dn2): + return False + + for rdn1, rdn2 in zip(dn1, dn2): + if not is_rdn_equal(rdn1, rdn2): + return False + return True + + +def dn_startswith(descendant_dn, dn): + """Returns True if and only if the descendant_dn is under the dn. + + :param descendant_dn: Either a string DN or a DN parsed by ldap.dn.str2dn. + :param dn: Either a string DN or a DN parsed by ldap.dn.str2dn. + + """ + + if not isinstance(descendant_dn, list): + descendant_dn = ldap.dn.str2dn(utf8_encode(descendant_dn)) + if not isinstance(dn, list): + dn = ldap.dn.str2dn(utf8_encode(dn)) + + if len(descendant_dn) <= len(dn): + return False + + # Use the last len(dn) RDNs. + return is_dn_equal(descendant_dn[-len(dn):], dn) + + +@six.add_metaclass(abc.ABCMeta) +class LDAPHandler(object): + '''Abstract class which defines methods for a LDAP API provider. + + Native Keystone values cannot be passed directly into and from the + python-ldap API. Type conversion must occur at the LDAP API + boudary, examples of type conversions are: + + * booleans map to the strings 'TRUE' and 'FALSE' + + * integer values map to their string representation. + + * unicode strings are encoded in UTF-8 + + In addition to handling type conversions at the API boundary we + have the requirement to support more than one LDAP API + provider. Currently we have: + + * python-ldap, this is the standard LDAP API for Python, it + requires access to a live LDAP server. + + * Fake LDAP which emulates python-ldap. This is used for + testing without requiring a live LDAP server. + + To support these requirements we need a layer that performs type + conversions and then calls another LDAP API which is configurable + (e.g. either python-ldap or the fake emulation). + + We have an additional constraint at the time of this writing due to + limitations in the logging module. The logging module is not + capable of accepting UTF-8 encoded strings, it will throw an + encoding exception. Therefore all logging MUST be performed prior + to UTF-8 conversion. This means no logging can be performed in the + ldap APIs that implement the python-ldap API because those APIs + are defined to accept only UTF-8 strings. Thus the layer which + performs type conversions must also do the logging. We do the type + conversions in two steps, once to convert all Python types to + unicode strings, then log, then convert the unicode strings to + UTF-8. + + There are a variety of ways one could accomplish this, we elect to + use a chaining technique whereby instances of this class simply + call the next member in the chain via the "conn" attribute. The + chain is constructed by passing in an existing instance of this + class as the conn attribute when the class is instantiated. + + Here is a brief explanation of why other possible approaches were + not used: + + subclassing + + To perform the wrapping operations in the correct order + the type convesion class would have to subclass each of + the API providers. This is awkward, doubles the number of + classes, and does not scale well. It requires the type + conversion class to be aware of all possible API + providers. + + decorators + + Decorators provide an elegant solution to wrap methods and + would be an ideal way to perform type conversions before + calling the wrapped function and then converting the + values returned from the wrapped function. However + decorators need to be aware of the method signature, it + has to know what input parameters need conversion and how + to convert the result. For an API like python-ldap which + has a large number of different method signatures it would + require a large number of specialized + decorators. Experience has shown it's very easy to apply + the wrong decorator due to the inherent complexity and + tendency to cut-n-paste code. Another option is to + parameterize the decorator to make it "smart". Experience + has shown such decorators become insanely complicated and + difficult to understand and debug. Also decorators tend to + hide what's really going on when a method is called, the + operations being performed are not visible when looking at + the implemation of a decorated method, this too experience + has shown leads to mistakes. + + Chaining simplifies both wrapping to perform type conversion as + well as the substitution of alternative API providers. One simply + creates a new instance of the API interface and insert it at the + front of the chain. Type conversions are explicit and obvious. + + If a new method needs to be added to the API interface one adds it + to the abstract class definition. Should one miss adding the new + method to any derivations of the abstract class the code will fail + to load and run making it impossible to forget updating all the + derived classes. + ''' + @abc.abstractmethod + def __init__(self, conn=None): + self.conn = conn + + @abc.abstractmethod + def connect(self, url, page_size=0, alias_dereferencing=None, + use_tls=False, tls_cacertfile=None, tls_cacertdir=None, + tls_req_cert='demand', chase_referrals=None, debug_level=None, + use_pool=None, pool_size=None, pool_retry_max=None, + pool_retry_delay=None, pool_conn_timeout=None, + pool_conn_lifetime=None): + raise exception.NotImplemented() # pragma: no cover + + @abc.abstractmethod + def set_option(self, option, invalue): + raise exception.NotImplemented() # pragma: no cover + + @abc.abstractmethod + def get_option(self, option): + raise exception.NotImplemented() # pragma: no cover + + @abc.abstractmethod + def simple_bind_s(self, who='', cred='', + serverctrls=None, clientctrls=None): + raise exception.NotImplemented() # pragma: no cover + + @abc.abstractmethod + def unbind_s(self): + raise exception.NotImplemented() # pragma: no cover + + @abc.abstractmethod + def add_s(self, dn, modlist): + raise exception.NotImplemented() # pragma: no cover + + @abc.abstractmethod + def search_s(self, base, scope, + filterstr='(objectClass=*)', attrlist=None, attrsonly=0): + raise exception.NotImplemented() # pragma: no cover + + @abc.abstractmethod + def search_ext(self, base, scope, + filterstr='(objectClass=*)', attrlist=None, attrsonly=0, + serverctrls=None, clientctrls=None, + timeout=-1, sizelimit=0): + raise exception.NotImplemented() # pragma: no cover + + @abc.abstractmethod + def result3(self, msgid=ldap.RES_ANY, all=1, timeout=None, + resp_ctrl_classes=None): + raise exception.NotImplemented() # pragma: no cover + + @abc.abstractmethod + def modify_s(self, dn, modlist): + raise exception.NotImplemented() # pragma: no cover + + @abc.abstractmethod + def delete_s(self, dn): + raise exception.NotImplemented() # pragma: no cover + + @abc.abstractmethod + def delete_ext_s(self, dn, serverctrls=None, clientctrls=None): + raise exception.NotImplemented() # pragma: no cover + + +class PythonLDAPHandler(LDAPHandler): + '''Implementation of the LDAPHandler interface which calls the + python-ldap API. + + Note, the python-ldap API requires all string values to be UTF-8 + encoded. The KeystoneLDAPHandler enforces this prior to invoking + the methods in this class. + ''' + + def __init__(self, conn=None): + super(PythonLDAPHandler, self).__init__(conn=conn) + + def connect(self, url, page_size=0, alias_dereferencing=None, + use_tls=False, tls_cacertfile=None, tls_cacertdir=None, + tls_req_cert='demand', chase_referrals=None, debug_level=None, + use_pool=None, pool_size=None, pool_retry_max=None, + pool_retry_delay=None, pool_conn_timeout=None, + pool_conn_lifetime=None): + + _common_ldap_initialization(url=url, + use_tls=use_tls, + tls_cacertfile=tls_cacertfile, + tls_cacertdir=tls_cacertdir, + tls_req_cert=tls_req_cert, + debug_level=debug_level) + + self.conn = ldap.initialize(url) + self.conn.protocol_version = ldap.VERSION3 + + if alias_dereferencing is not None: + self.conn.set_option(ldap.OPT_DEREF, alias_dereferencing) + self.page_size = page_size + + if use_tls: + self.conn.start_tls_s() + + if chase_referrals is not None: + self.conn.set_option(ldap.OPT_REFERRALS, int(chase_referrals)) + + def set_option(self, option, invalue): + return self.conn.set_option(option, invalue) + + def get_option(self, option): + return self.conn.get_option(option) + + def simple_bind_s(self, who='', cred='', + serverctrls=None, clientctrls=None): + return self.conn.simple_bind_s(who, cred, serverctrls, clientctrls) + + def unbind_s(self): + return self.conn.unbind_s() + + def add_s(self, dn, modlist): + return self.conn.add_s(dn, modlist) + + def search_s(self, base, scope, + filterstr='(objectClass=*)', attrlist=None, attrsonly=0): + return self.conn.search_s(base, scope, filterstr, + attrlist, attrsonly) + + def search_ext(self, base, scope, + filterstr='(objectClass=*)', attrlist=None, attrsonly=0, + serverctrls=None, clientctrls=None, + timeout=-1, sizelimit=0): + return self.conn.search_ext(base, scope, + filterstr, attrlist, attrsonly, + serverctrls, clientctrls, + timeout, sizelimit) + + def result3(self, msgid=ldap.RES_ANY, all=1, timeout=None, + resp_ctrl_classes=None): + # The resp_ctrl_classes parameter is a recent addition to the + # API. It defaults to None. We do not anticipate using it. + # To run with older versions of python-ldap we do not pass it. + return self.conn.result3(msgid, all, timeout) + + def modify_s(self, dn, modlist): + return self.conn.modify_s(dn, modlist) + + def delete_s(self, dn): + return self.conn.delete_s(dn) + + def delete_ext_s(self, dn, serverctrls=None, clientctrls=None): + return self.conn.delete_ext_s(dn, serverctrls, clientctrls) + + +def _common_ldap_initialization(url, use_tls=False, tls_cacertfile=None, + tls_cacertdir=None, tls_req_cert=None, + debug_level=None): + '''Method for common ldap initialization between PythonLDAPHandler and + PooledLDAPHandler. + ''' + + LOG.debug("LDAP init: url=%s", url) + LOG.debug('LDAP init: use_tls=%s tls_cacertfile=%s tls_cacertdir=%s ' + 'tls_req_cert=%s tls_avail=%s', + use_tls, tls_cacertfile, tls_cacertdir, + tls_req_cert, ldap.TLS_AVAIL) + + if debug_level is not None: + ldap.set_option(ldap.OPT_DEBUG_LEVEL, debug_level) + + using_ldaps = url.lower().startswith("ldaps") + + if use_tls and using_ldaps: + raise AssertionError(_('Invalid TLS / LDAPS combination')) + + # The certificate trust options apply for both LDAPS and TLS. + if use_tls or using_ldaps: + if not ldap.TLS_AVAIL: + raise ValueError(_('Invalid LDAP TLS_AVAIL option: %s. TLS ' + 'not available') % ldap.TLS_AVAIL) + if tls_cacertfile: + # NOTE(topol) + # python ldap TLS does not verify CACERTFILE or CACERTDIR + # so we add some extra simple sanity check verification + # Also, setting these values globally (i.e. on the ldap object) + # works but these values are ignored when setting them on the + # connection + if not os.path.isfile(tls_cacertfile): + raise IOError(_("tls_cacertfile %s not found " + "or is not a file") % + tls_cacertfile) + ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, tls_cacertfile) + elif tls_cacertdir: + # NOTE(topol) + # python ldap TLS does not verify CACERTFILE or CACERTDIR + # so we add some extra simple sanity check verification + # Also, setting these values globally (i.e. on the ldap object) + # works but these values are ignored when setting them on the + # connection + if not os.path.isdir(tls_cacertdir): + raise IOError(_("tls_cacertdir %s not found " + "or is not a directory") % + tls_cacertdir) + ldap.set_option(ldap.OPT_X_TLS_CACERTDIR, tls_cacertdir) + if tls_req_cert in LDAP_TLS_CERTS.values(): + ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, tls_req_cert) + else: + LOG.debug("LDAP TLS: invalid TLS_REQUIRE_CERT Option=%s", + tls_req_cert) + + +class MsgId(list): + '''Wrapper class to hold connection and msgid.''' + pass + + +def use_conn_pool(func): + '''Use this only for connection pool specific ldap API. + + This adds connection object to decorated API as next argument after self. + ''' + def wrapper(self, *args, **kwargs): + # assert isinstance(self, PooledLDAPHandler) + with self._get_pool_connection() as conn: + self._apply_options(conn) + return func(self, conn, *args, **kwargs) + return wrapper + + +class PooledLDAPHandler(LDAPHandler): + '''Implementation of the LDAPHandler interface which uses pooled + connection manager. + + Pool specific configuration is defined in [ldap] section. + All other LDAP configuration is still used from [ldap] section + + Keystone LDAP authentication logic authenticates an end user using its DN + and password via LDAP bind to establish supplied password is correct. + This can fill up the pool quickly (as pool re-uses existing connection + based on its bind data) and would not leave space in pool for connection + re-use for other LDAP operations. + Now a separate pool can be established for those requests when related flag + 'use_auth_pool' is enabled. That pool can have its own size and + connection lifetime. Other pool attributes are shared between those pools. + If 'use_pool' is disabled, then 'use_auth_pool' does not matter. + If 'use_auth_pool' is not enabled, then connection pooling is not used for + those LDAP operations. + + Note, the python-ldap API requires all string values to be UTF-8 + encoded. The KeystoneLDAPHandler enforces this prior to invoking + the methods in this class. + ''' + + # Added here to allow override for testing + Connector = ldappool.StateConnector + auth_pool_prefix = 'auth_pool_' + + connection_pools = {} # static connector pool dict + + def __init__(self, conn=None, use_auth_pool=False): + super(PooledLDAPHandler, self).__init__(conn=conn) + self.who = '' + self.cred = '' + self.conn_options = {} # connection specific options + self.page_size = None + self.use_auth_pool = use_auth_pool + self.conn_pool = None + + def connect(self, url, page_size=0, alias_dereferencing=None, + use_tls=False, tls_cacertfile=None, tls_cacertdir=None, + tls_req_cert='demand', chase_referrals=None, debug_level=None, + use_pool=None, pool_size=None, pool_retry_max=None, + pool_retry_delay=None, pool_conn_timeout=None, + pool_conn_lifetime=None): + + _common_ldap_initialization(url=url, + use_tls=use_tls, + tls_cacertfile=tls_cacertfile, + tls_cacertdir=tls_cacertdir, + tls_req_cert=tls_req_cert, + debug_level=debug_level) + + self.page_size = page_size + + # Following two options are not added in common initialization as they + # need to follow a sequence in PythonLDAPHandler code. + if alias_dereferencing is not None: + self.set_option(ldap.OPT_DEREF, alias_dereferencing) + if chase_referrals is not None: + self.set_option(ldap.OPT_REFERRALS, int(chase_referrals)) + + if self.use_auth_pool: # separate pool when use_auth_pool enabled + pool_url = self.auth_pool_prefix + url + else: + pool_url = url + try: + self.conn_pool = self.connection_pools[pool_url] + except KeyError: + self.conn_pool = ldappool.ConnectionManager( + url, + size=pool_size, + retry_max=pool_retry_max, + retry_delay=pool_retry_delay, + timeout=pool_conn_timeout, + connector_cls=self.Connector, + use_tls=use_tls, + max_lifetime=pool_conn_lifetime) + self.connection_pools[pool_url] = self.conn_pool + + def set_option(self, option, invalue): + self.conn_options[option] = invalue + + def get_option(self, option): + value = self.conn_options.get(option) + # if option was not specified explicitly, then use connection default + # value for that option if there. + if value is None: + with self._get_pool_connection() as conn: + value = conn.get_option(option) + return value + + def _apply_options(self, conn): + # if connection has a lifetime, then it already has options specified + if conn.get_lifetime() > 30: + return + for option, invalue in six.iteritems(self.conn_options): + conn.set_option(option, invalue) + + def _get_pool_connection(self): + return self.conn_pool.connection(self.who, self.cred) + + def simple_bind_s(self, who='', cred='', + serverctrls=None, clientctrls=None): + '''Not using use_conn_pool decorator here as this API takes cred as + input. + ''' + self.who = who + self.cred = cred + with self._get_pool_connection() as conn: + self._apply_options(conn) + + def unbind_s(self): + # After connection generator is done `with` statement execution block + # connection is always released via finally block in ldappool. + # So this unbind is a no op. + pass + + @use_conn_pool + def add_s(self, conn, dn, modlist): + return conn.add_s(dn, modlist) + + @use_conn_pool + def search_s(self, conn, base, scope, + filterstr='(objectClass=*)', attrlist=None, attrsonly=0): + return conn.search_s(base, scope, filterstr, attrlist, + attrsonly) + + def search_ext(self, base, scope, + filterstr='(objectClass=*)', attrlist=None, attrsonly=0, + serverctrls=None, clientctrls=None, + timeout=-1, sizelimit=0): + '''This API is asynchoronus API which returns MsgId instance to be used + in result3 call. + + To work with result3 API in predicatable manner, same LDAP connection + is needed which provided msgid. So wrapping used connection and msgid + in MsgId class. The connection associated with search_ext is released + once last hard reference to MsgId object is freed. This will happen + when the method is done with returned MsgId usage. + ''' + + conn_ctxt = self._get_pool_connection() + conn = conn_ctxt.__enter__() + try: + msgid = conn.search_ext(base, scope, + filterstr, attrlist, attrsonly, + serverctrls, clientctrls, + timeout, sizelimit) + except Exception: + conn_ctxt.__exit__(*sys.exc_info()) + raise + res = MsgId((conn, msgid)) + weakref.ref(res, functools.partial(conn_ctxt.__exit__, + None, None, None)) + return res + + def result3(self, msgid, all=1, timeout=None, + resp_ctrl_classes=None): + '''This method is used to wait for and return the result of an + operation previously initiated by one of the LDAP asynchronous + operation routines (eg search_ext()) It returned an invocation + identifier (a message id) upon successful initiation of their + operation. + + Input msgid is expected to be instance of class MsgId which has LDAP + session/connection used to execute search_ext and message idenfier. + + The connection associated with search_ext is released once last hard + reference to MsgId object is freed. This will happen when function + which requested msgId and used it in result3 exits. + ''' + + conn, msg_id = msgid + return conn.result3(msg_id, all, timeout) + + @use_conn_pool + def modify_s(self, conn, dn, modlist): + return conn.modify_s(dn, modlist) + + @use_conn_pool + def delete_s(self, conn, dn): + return conn.delete_s(dn) + + @use_conn_pool + def delete_ext_s(self, conn, dn, serverctrls=None, clientctrls=None): + return conn.delete_ext_s(dn, serverctrls, clientctrls) + + +class KeystoneLDAPHandler(LDAPHandler): + '''Convert data types and perform logging. + + This LDAP inteface wraps the python-ldap based interfaces. The + python-ldap interfaces require string values encoded in UTF-8. The + OpenStack logging framework at the time of this writing is not + capable of accepting strings encoded in UTF-8, the log functions + will throw decoding errors if a non-ascii character appears in a + string. + + Prior to the call Python data types are converted to a string + representation as required by the LDAP APIs. + + Then logging is performed so we can track what is being + sent/received from LDAP. Also the logging filters security + sensitive items (i.e. passwords). + + Then the string values are encoded into UTF-8. + + Then the LDAP API entry point is invoked. + + Data returned from the LDAP call is converted back from UTF-8 + encoded strings into the Python data type used internally in + OpenStack. + ''' + + def __init__(self, conn=None): + super(KeystoneLDAPHandler, self).__init__(conn=conn) + self.page_size = 0 + + def __enter__(self): + return self + + def _disable_paging(self): + # Disable the pagination from now on + self.page_size = 0 + + def connect(self, url, page_size=0, alias_dereferencing=None, + use_tls=False, tls_cacertfile=None, tls_cacertdir=None, + tls_req_cert='demand', chase_referrals=None, debug_level=None, + use_pool=None, pool_size=None, + pool_retry_max=None, pool_retry_delay=None, + pool_conn_timeout=None, pool_conn_lifetime=None): + self.page_size = page_size + return self.conn.connect(url, page_size, alias_dereferencing, + use_tls, tls_cacertfile, tls_cacertdir, + tls_req_cert, chase_referrals, + debug_level=debug_level, + use_pool=use_pool, + pool_size=pool_size, + pool_retry_max=pool_retry_max, + pool_retry_delay=pool_retry_delay, + pool_conn_timeout=pool_conn_timeout, + pool_conn_lifetime=pool_conn_lifetime) + + def set_option(self, option, invalue): + return self.conn.set_option(option, invalue) + + def get_option(self, option): + return self.conn.get_option(option) + + def simple_bind_s(self, who='', cred='', + serverctrls=None, clientctrls=None): + LOG.debug("LDAP bind: who=%s", who) + who_utf8 = utf8_encode(who) + cred_utf8 = utf8_encode(cred) + return self.conn.simple_bind_s(who_utf8, cred_utf8, + serverctrls=serverctrls, + clientctrls=clientctrls) + + def unbind_s(self): + LOG.debug("LDAP unbind") + return self.conn.unbind_s() + + def add_s(self, dn, modlist): + ldap_attrs = [(kind, [py2ldap(x) for x in safe_iter(values)]) + for kind, values in modlist] + logging_attrs = [(kind, values + if kind != 'userPassword' + else ['****']) + for kind, values in ldap_attrs] + LOG.debug('LDAP add: dn=%s attrs=%s', + dn, logging_attrs) + dn_utf8 = utf8_encode(dn) + ldap_attrs_utf8 = [(kind, [utf8_encode(x) for x in safe_iter(values)]) + for kind, values in ldap_attrs] + return self.conn.add_s(dn_utf8, ldap_attrs_utf8) + + def search_s(self, base, scope, + filterstr='(objectClass=*)', attrlist=None, attrsonly=0): + # NOTE(morganfainberg): Remove "None" singletons from this list, which + # allows us to set mapped attributes to "None" as defaults in config. + # Without this filtering, the ldap query would raise a TypeError since + # attrlist is expected to be an iterable of strings. + if attrlist is not None: + attrlist = [attr for attr in attrlist if attr is not None] + LOG.debug('LDAP search: base=%s scope=%s filterstr=%s ' + 'attrs=%s attrsonly=%s', + base, scope, filterstr, attrlist, attrsonly) + if self.page_size: + ldap_result = self._paged_search_s(base, scope, + filterstr, attrlist) + else: + base_utf8 = utf8_encode(base) + filterstr_utf8 = utf8_encode(filterstr) + if attrlist is None: + attrlist_utf8 = None + else: + attrlist_utf8 = map(utf8_encode, attrlist) + ldap_result = self.conn.search_s(base_utf8, scope, + filterstr_utf8, + attrlist_utf8, attrsonly) + + py_result = convert_ldap_result(ldap_result) + + return py_result + + def search_ext(self, base, scope, + filterstr='(objectClass=*)', attrlist=None, attrsonly=0, + serverctrls=None, clientctrls=None, + timeout=-1, sizelimit=0): + if attrlist is not None: + attrlist = [attr for attr in attrlist if attr is not None] + LOG.debug('LDAP search_ext: base=%s scope=%s filterstr=%s ' + 'attrs=%s attrsonly=%s' + 'serverctrls=%s clientctrls=%s timeout=%s sizelimit=%s', + base, scope, filterstr, attrlist, attrsonly, + serverctrls, clientctrls, timeout, sizelimit) + return self.conn.search_ext(base, scope, + filterstr, attrlist, attrsonly, + serverctrls, clientctrls, + timeout, sizelimit) + + def _paged_search_s(self, base, scope, filterstr, attrlist=None): + res = [] + use_old_paging_api = False + # The API for the simple paged results control changed between + # python-ldap 2.3 and 2.4. We need to detect the capabilities + # of the python-ldap version we are using. + if hasattr(ldap, 'LDAP_CONTROL_PAGE_OID'): + use_old_paging_api = True + lc = ldap.controls.SimplePagedResultsControl( + controlType=ldap.LDAP_CONTROL_PAGE_OID, + criticality=True, + controlValue=(self.page_size, '')) + page_ctrl_oid = ldap.LDAP_CONTROL_PAGE_OID + else: + lc = ldap.controls.libldap.SimplePagedResultsControl( + criticality=True, + size=self.page_size, + cookie='') + page_ctrl_oid = ldap.controls.SimplePagedResultsControl.controlType + + base_utf8 = utf8_encode(base) + filterstr_utf8 = utf8_encode(filterstr) + if attrlist is None: + attrlist_utf8 = None + else: + attrlist = [attr for attr in attrlist if attr is not None] + attrlist_utf8 = map(utf8_encode, attrlist) + msgid = self.conn.search_ext(base_utf8, + scope, + filterstr_utf8, + attrlist_utf8, + serverctrls=[lc]) + # Endless loop request pages on ldap server until it has no data + while True: + # Request to the ldap server a page with 'page_size' entries + rtype, rdata, rmsgid, serverctrls = self.conn.result3(msgid) + # Receive the data + res.extend(rdata) + pctrls = [c for c in serverctrls + if c.controlType == page_ctrl_oid] + if pctrls: + # LDAP server supports pagination + if use_old_paging_api: + est, cookie = pctrls[0].controlValue + lc.controlValue = (self.page_size, cookie) + else: + cookie = lc.cookie = pctrls[0].cookie + + if cookie: + # There is more data still on the server + # so we request another page + msgid = self.conn.search_ext(base_utf8, + scope, + filterstr_utf8, + attrlist_utf8, + serverctrls=[lc]) + else: + # Exit condition no more data on server + break + else: + LOG.warning(_LW('LDAP Server does not support paging. ' + 'Disable paging in keystone.conf to ' + 'avoid this message.')) + self._disable_paging() + break + return res + + def result3(self, msgid=ldap.RES_ANY, all=1, timeout=None, + resp_ctrl_classes=None): + ldap_result = self.conn.result3(msgid, all, timeout, resp_ctrl_classes) + + LOG.debug('LDAP result3: msgid=%s all=%s timeout=%s ' + 'resp_ctrl_classes=%s ldap_result=%s', + msgid, all, timeout, resp_ctrl_classes, ldap_result) + + py_result = convert_ldap_result(ldap_result) + return py_result + + def modify_s(self, dn, modlist): + ldap_modlist = [ + (op, kind, (None if values is None + else [py2ldap(x) for x in safe_iter(values)])) + for op, kind, values in modlist] + + logging_modlist = [(op, kind, (values if kind != 'userPassword' + else ['****'])) + for op, kind, values in ldap_modlist] + LOG.debug('LDAP modify: dn=%s modlist=%s', + dn, logging_modlist) + + dn_utf8 = utf8_encode(dn) + ldap_modlist_utf8 = [ + (op, kind, (None if values is None + else [utf8_encode(x) for x in safe_iter(values)])) + for op, kind, values in ldap_modlist] + return self.conn.modify_s(dn_utf8, ldap_modlist_utf8) + + def delete_s(self, dn): + LOG.debug("LDAP delete: dn=%s", dn) + dn_utf8 = utf8_encode(dn) + return self.conn.delete_s(dn_utf8) + + def delete_ext_s(self, dn, serverctrls=None, clientctrls=None): + LOG.debug('LDAP delete_ext: dn=%s serverctrls=%s clientctrls=%s', + dn, serverctrls, clientctrls) + dn_utf8 = utf8_encode(dn) + return self.conn.delete_ext_s(dn_utf8, serverctrls, clientctrls) + + def __exit__(self, exc_type, exc_val, exc_tb): + self.unbind_s() + + +_HANDLERS = {} + + +def register_handler(prefix, handler): + _HANDLERS[prefix] = handler + + +def _get_connection(conn_url, use_pool=False, use_auth_pool=False): + for prefix, handler in six.iteritems(_HANDLERS): + if conn_url.startswith(prefix): + return handler() + + if use_pool: + return PooledLDAPHandler(use_auth_pool=use_auth_pool) + else: + return PythonLDAPHandler() + + +def filter_entity(entity_ref): + """Filter out private items in an entity dict. + + :param entity_ref: the entity dictionary. The 'dn' field will be removed. + 'dn' is used in LDAP, but should not be returned to the user. This + value may be modified. + + :returns: entity_ref + + """ + if entity_ref: + entity_ref.pop('dn', None) + return entity_ref + + +class BaseLdap(object): + DEFAULT_SUFFIX = "dc=example,dc=com" + DEFAULT_OU = None + DEFAULT_STRUCTURAL_CLASSES = None + DEFAULT_ID_ATTR = 'cn' + DEFAULT_OBJECTCLASS = None + DEFAULT_FILTER = None + DEFAULT_EXTRA_ATTR_MAPPING = [] + DUMB_MEMBER_DN = 'cn=dumb,dc=nonexistent' + NotFound = None + notfound_arg = None + options_name = None + model = None + attribute_options_names = {} + immutable_attrs = [] + attribute_ignore = [] + tree_dn = None + + def __init__(self, conf): + self.LDAP_URL = conf.ldap.url + self.LDAP_USER = conf.ldap.user + self.LDAP_PASSWORD = conf.ldap.password + self.LDAP_SCOPE = ldap_scope(conf.ldap.query_scope) + self.alias_dereferencing = parse_deref(conf.ldap.alias_dereferencing) + self.page_size = conf.ldap.page_size + self.use_tls = conf.ldap.use_tls + self.tls_cacertfile = conf.ldap.tls_cacertfile + self.tls_cacertdir = conf.ldap.tls_cacertdir + self.tls_req_cert = parse_tls_cert(conf.ldap.tls_req_cert) + self.attribute_mapping = {} + self.chase_referrals = conf.ldap.chase_referrals + self.debug_level = conf.ldap.debug_level + + # LDAP Pool specific attribute + self.use_pool = conf.ldap.use_pool + self.pool_size = conf.ldap.pool_size + self.pool_retry_max = conf.ldap.pool_retry_max + self.pool_retry_delay = conf.ldap.pool_retry_delay + self.pool_conn_timeout = conf.ldap.pool_connection_timeout + self.pool_conn_lifetime = conf.ldap.pool_connection_lifetime + + # End user authentication pool specific config attributes + self.use_auth_pool = self.use_pool and conf.ldap.use_auth_pool + self.auth_pool_size = conf.ldap.auth_pool_size + self.auth_pool_conn_lifetime = conf.ldap.auth_pool_connection_lifetime + + if self.options_name is not None: + self.suffix = conf.ldap.suffix + if self.suffix is None: + self.suffix = self.DEFAULT_SUFFIX + dn = '%s_tree_dn' % self.options_name + self.tree_dn = (getattr(conf.ldap, dn) + or '%s,%s' % (self.DEFAULT_OU, self.suffix)) + + idatt = '%s_id_attribute' % self.options_name + self.id_attr = getattr(conf.ldap, idatt) or self.DEFAULT_ID_ATTR + + objclass = '%s_objectclass' % self.options_name + self.object_class = (getattr(conf.ldap, objclass) + or self.DEFAULT_OBJECTCLASS) + + for k, v in six.iteritems(self.attribute_options_names): + v = '%s_%s_attribute' % (self.options_name, v) + self.attribute_mapping[k] = getattr(conf.ldap, v) + + attr_mapping_opt = ('%s_additional_attribute_mapping' % + self.options_name) + attr_mapping = (getattr(conf.ldap, attr_mapping_opt) + or self.DEFAULT_EXTRA_ATTR_MAPPING) + self.extra_attr_mapping = self._parse_extra_attrs(attr_mapping) + + ldap_filter = '%s_filter' % self.options_name + self.ldap_filter = getattr(conf.ldap, + ldap_filter) or self.DEFAULT_FILTER + + allow_create = '%s_allow_create' % self.options_name + self.allow_create = getattr(conf.ldap, allow_create) + + allow_update = '%s_allow_update' % self.options_name + self.allow_update = getattr(conf.ldap, allow_update) + + allow_delete = '%s_allow_delete' % self.options_name + self.allow_delete = getattr(conf.ldap, allow_delete) + + member_attribute = '%s_member_attribute' % self.options_name + self.member_attribute = getattr(conf.ldap, member_attribute, None) + + self.structural_classes = self.DEFAULT_STRUCTURAL_CLASSES + + if self.notfound_arg is None: + self.notfound_arg = self.options_name + '_id' + + attribute_ignore = '%s_attribute_ignore' % self.options_name + self.attribute_ignore = getattr(conf.ldap, attribute_ignore) + + self.use_dumb_member = conf.ldap.use_dumb_member + self.dumb_member = (conf.ldap.dumb_member or + self.DUMB_MEMBER_DN) + + self.subtree_delete_enabled = conf.ldap.allow_subtree_delete + + def _not_found(self, object_id): + if self.NotFound is None: + return exception.NotFound(target=object_id) + else: + return self.NotFound(**{self.notfound_arg: object_id}) + + def _parse_extra_attrs(self, option_list): + mapping = {} + for item in option_list: + try: + ldap_attr, attr_map = item.split(':') + except Exception: + LOG.warn(_LW( + 'Invalid additional attribute mapping: "%s". ' + 'Format must be <ldap_attribute>:<keystone_attribute>'), + item) + continue + mapping[ldap_attr] = attr_map + return mapping + + def _is_dumb_member(self, member_dn): + """Checks that member is a dumb member. + + :param member_dn: DN of member to be checked. + """ + return (self.use_dumb_member + and is_dn_equal(member_dn, self.dumb_member)) + + def get_connection(self, user=None, password=None, end_user_auth=False): + use_pool = self.use_pool + pool_size = self.pool_size + pool_conn_lifetime = self.pool_conn_lifetime + + if end_user_auth: + if not self.use_auth_pool: + use_pool = False + else: + pool_size = self.auth_pool_size + pool_conn_lifetime = self.auth_pool_conn_lifetime + + conn = _get_connection(self.LDAP_URL, use_pool, + use_auth_pool=end_user_auth) + + conn = KeystoneLDAPHandler(conn=conn) + + conn.connect(self.LDAP_URL, + page_size=self.page_size, + alias_dereferencing=self.alias_dereferencing, + use_tls=self.use_tls, + tls_cacertfile=self.tls_cacertfile, + tls_cacertdir=self.tls_cacertdir, + tls_req_cert=self.tls_req_cert, + chase_referrals=self.chase_referrals, + debug_level=self.debug_level, + use_pool=use_pool, + pool_size=pool_size, + pool_retry_max=self.pool_retry_max, + pool_retry_delay=self.pool_retry_delay, + pool_conn_timeout=self.pool_conn_timeout, + pool_conn_lifetime=pool_conn_lifetime + ) + + if user is None: + user = self.LDAP_USER + + if password is None: + password = self.LDAP_PASSWORD + + # not all LDAP servers require authentication, so we don't bind + # if we don't have any user/pass + if user and password: + conn.simple_bind_s(user, password) + + return conn + + def _id_to_dn_string(self, object_id): + return u'%s=%s,%s' % (self.id_attr, + ldap.dn.escape_dn_chars( + six.text_type(object_id)), + self.tree_dn) + + def _id_to_dn(self, object_id): + if self.LDAP_SCOPE == ldap.SCOPE_ONELEVEL: + return self._id_to_dn_string(object_id) + with self.get_connection() as conn: + search_result = conn.search_s( + self.tree_dn, self.LDAP_SCOPE, + u'(&(%(id_attr)s=%(id)s)(objectclass=%(objclass)s))' % + {'id_attr': self.id_attr, + 'id': ldap.filter.escape_filter_chars( + six.text_type(object_id)), + 'objclass': self.object_class}, + attrlist=DN_ONLY) + if search_result: + dn, attrs = search_result[0] + return dn + else: + return self._id_to_dn_string(object_id) + + @staticmethod + def _dn_to_id(dn): + return utf8_decode(ldap.dn.str2dn(utf8_encode(dn))[0][0][1]) + + def _ldap_res_to_model(self, res): + # LDAP attribute names may be returned in a different case than + # they are defined in the mapping, so we need to check for keys + # in a case-insensitive way. We use the case specified in the + # mapping for the model to ensure we have a predictable way of + # retrieving values later. + lower_res = {k.lower(): v for k, v in six.iteritems(res[1])} + + id_attrs = lower_res.get(self.id_attr.lower()) + if not id_attrs: + message = _('ID attribute %(id_attr)s not found in LDAP ' + 'object %(dn)s') % ({'id_attr': self.id_attr, + 'dn': res[0]}) + raise exception.NotFound(message=message) + if len(id_attrs) > 1: + # FIXME(gyee): if this is a multi-value attribute and it has + # multiple values, we can't use it as ID. Retain the dn_to_id + # logic here so it does not potentially break existing + # deployments. We need to fix our read-write LDAP logic so + # it does not get the ID from DN. + message = _LW('ID attribute %(id_attr)s for LDAP object %(dn)s ' + 'has multiple values and therefore cannot be used ' + 'as an ID. Will get the ID from DN instead') % ( + {'id_attr': self.id_attr, + 'dn': res[0]}) + LOG.warn(message) + id_val = self._dn_to_id(res[0]) + else: + id_val = id_attrs[0] + obj = self.model(id=id_val) + + for k in obj.known_keys: + if k in self.attribute_ignore: + continue + + try: + map_attr = self.attribute_mapping.get(k, k) + if map_attr is None: + # Ignore attributes that are mapped to None. + continue + + v = lower_res[map_attr.lower()] + except KeyError: + pass + else: + try: + obj[k] = v[0] + except IndexError: + obj[k] = None + + return obj + + def check_allow_create(self): + if not self.allow_create: + action = _('LDAP %s create') % self.options_name + raise exception.ForbiddenAction(action=action) + + def check_allow_update(self): + if not self.allow_update: + action = _('LDAP %s update') % self.options_name + raise exception.ForbiddenAction(action=action) + + def check_allow_delete(self): + if not self.allow_delete: + action = _('LDAP %s delete') % self.options_name + raise exception.ForbiddenAction(action=action) + + def affirm_unique(self, values): + if values.get('name') is not None: + try: + self.get_by_name(values['name']) + except exception.NotFound: + pass + else: + raise exception.Conflict(type=self.options_name, + details=_('Duplicate name, %s.') % + values['name']) + + if values.get('id') is not None: + try: + self.get(values['id']) + except exception.NotFound: + pass + else: + raise exception.Conflict(type=self.options_name, + details=_('Duplicate ID, %s.') % + values['id']) + + def create(self, values): + self.affirm_unique(values) + object_classes = self.structural_classes + [self.object_class] + attrs = [('objectClass', object_classes)] + for k, v in six.iteritems(values): + if k in self.attribute_ignore: + continue + if k == 'id': + # no need to check if v is None as 'id' will always have + # a value + attrs.append((self.id_attr, [v])) + elif v is not None: + attr_type = self.attribute_mapping.get(k, k) + if attr_type is not None: + attrs.append((attr_type, [v])) + extra_attrs = [attr for attr, name + in six.iteritems(self.extra_attr_mapping) + if name == k] + for attr in extra_attrs: + attrs.append((attr, [v])) + + if 'groupOfNames' in object_classes and self.use_dumb_member: + attrs.append(('member', [self.dumb_member])) + with self.get_connection() as conn: + conn.add_s(self._id_to_dn(values['id']), attrs) + return values + + def _ldap_get(self, object_id, ldap_filter=None): + query = (u'(&(%(id_attr)s=%(id)s)' + u'%(filter)s' + u'(objectClass=%(object_class)s))' + % {'id_attr': self.id_attr, + 'id': ldap.filter.escape_filter_chars( + six.text_type(object_id)), + 'filter': (ldap_filter or self.ldap_filter or ''), + 'object_class': self.object_class}) + with self.get_connection() as conn: + try: + attrs = list(set(([self.id_attr] + + self.attribute_mapping.values() + + self.extra_attr_mapping.keys()))) + res = conn.search_s(self.tree_dn, + self.LDAP_SCOPE, + query, + attrs) + except ldap.NO_SUCH_OBJECT: + return None + try: + return res[0] + except IndexError: + return None + + def _ldap_get_all(self, ldap_filter=None): + query = u'(&%s(objectClass=%s))' % (ldap_filter or + self.ldap_filter or + '', self.object_class) + with self.get_connection() as conn: + try: + attrs = list(set(([self.id_attr] + + self.attribute_mapping.values() + + self.extra_attr_mapping.keys()))) + return conn.search_s(self.tree_dn, + self.LDAP_SCOPE, + query, + attrs) + except ldap.NO_SUCH_OBJECT: + return [] + + def _ldap_get_list(self, search_base, scope, query_params=None, + attrlist=None): + query = u'(objectClass=%s)' % self.object_class + if query_params: + + def calc_filter(attrname, value): + val_esc = ldap.filter.escape_filter_chars(value) + return '(%s=%s)' % (attrname, val_esc) + + query = (u'(&%s%s)' % + (query, ''.join([calc_filter(k, v) for k, v in + six.iteritems(query_params)]))) + with self.get_connection() as conn: + return conn.search_s(search_base, scope, query, attrlist) + + def get(self, object_id, ldap_filter=None): + res = self._ldap_get(object_id, ldap_filter) + if res is None: + raise self._not_found(object_id) + else: + return self._ldap_res_to_model(res) + + def get_by_name(self, name, ldap_filter=None): + query = (u'(%s=%s)' % (self.attribute_mapping['name'], + ldap.filter.escape_filter_chars( + six.text_type(name)))) + res = self.get_all(query) + try: + return res[0] + except IndexError: + raise self._not_found(name) + + def get_all(self, ldap_filter=None): + return [self._ldap_res_to_model(x) + for x in self._ldap_get_all(ldap_filter)] + + def update(self, object_id, values, old_obj=None): + if old_obj is None: + old_obj = self.get(object_id) + + modlist = [] + for k, v in six.iteritems(values): + if k == 'id': + # id can't be modified. + continue + + if k in self.attribute_ignore: + + # Handle 'enabled' specially since can't disable if ignored. + if k == 'enabled' and (not v): + action = _("Disabling an entity where the 'enable' " + "attribute is ignored by configuration.") + raise exception.ForbiddenAction(action=action) + + continue + + # attribute value has not changed + if k in old_obj and old_obj[k] == v: + continue + + if k in self.immutable_attrs: + msg = (_("Cannot change %(option_name)s %(attr)s") % + {'option_name': self.options_name, 'attr': k}) + raise exception.ValidationError(msg) + + if v is None: + if old_obj.get(k) is not None: + modlist.append((ldap.MOD_DELETE, + self.attribute_mapping.get(k, k), + None)) + continue + + current_value = old_obj.get(k) + if current_value is None: + op = ldap.MOD_ADD + modlist.append((op, self.attribute_mapping.get(k, k), [v])) + elif current_value != v: + op = ldap.MOD_REPLACE + modlist.append((op, self.attribute_mapping.get(k, k), [v])) + + if modlist: + with self.get_connection() as conn: + try: + conn.modify_s(self._id_to_dn(object_id), modlist) + except ldap.NO_SUCH_OBJECT: + raise self._not_found(object_id) + + return self.get(object_id) + + def delete(self, object_id): + with self.get_connection() as conn: + try: + conn.delete_s(self._id_to_dn(object_id)) + except ldap.NO_SUCH_OBJECT: + raise self._not_found(object_id) + + def deleteTree(self, object_id): + tree_delete_control = ldap.controls.LDAPControl(CONTROL_TREEDELETE, + 0, + None) + with self.get_connection() as conn: + try: + conn.delete_ext_s(self._id_to_dn(object_id), + serverctrls=[tree_delete_control]) + except ldap.NO_SUCH_OBJECT: + raise self._not_found(object_id) + except ldap.NOT_ALLOWED_ON_NONLEAF: + # Most LDAP servers do not support the tree_delete_control. + # In these servers, the usual idiom is to first perform a + # search to get the entries to delete, then delete them in + # in order of child to parent, since LDAP forbids the + # deletion of a parent entry before deleting the children + # of that parent. The simplest way to do that is to delete + # the entries in order of the length of the DN, from longest + # to shortest DN. + dn = self._id_to_dn(object_id) + scope = ldap.SCOPE_SUBTREE + # With some directory servers, an entry with objectclass + # ldapsubentry will not be returned unless it is explicitly + # requested, by specifying the objectclass in the search + # filter. We must specify this, with objectclass=*, in an + # LDAP filter OR clause, in order to return all entries + filt = '(|(objectclass=*)(objectclass=ldapsubentry))' + # We only need the DNs of the entries. Since no attributes + # will be returned, we do not have to specify attrsonly=1. + entries = conn.search_s(dn, scope, filt, attrlist=DN_ONLY) + if entries: + for dn in sorted((e[0] for e in entries), + key=len, reverse=True): + conn.delete_s(dn) + else: + LOG.debug('No entries in LDAP subtree %s', dn) + + def add_member(self, member_dn, member_list_dn): + """Add member to the member list. + + :param member_dn: DN of member to be added. + :param member_list_dn: DN of group to which the + member will be added. + + :raises: exception.Conflict: If the user was already a member. + self.NotFound: If the group entry didn't exist. + """ + with self.get_connection() as conn: + try: + mod = (ldap.MOD_ADD, self.member_attribute, member_dn) + conn.modify_s(member_list_dn, [mod]) + except ldap.TYPE_OR_VALUE_EXISTS: + raise exception.Conflict(_('Member %(member)s ' + 'is already a member' + ' of group %(group)s') % { + 'member': member_dn, + 'group': member_list_dn}) + except ldap.NO_SUCH_OBJECT: + raise self._not_found(member_list_dn) + + def remove_member(self, member_dn, member_list_dn): + """Remove member from the member list. + + :param member_dn: DN of member to be removed. + :param member_list_dn: DN of group from which the + member will be removed. + + :raises: self.NotFound: If the group entry didn't exist. + ldap.NO_SUCH_ATTRIBUTE: If the user wasn't a member. + """ + with self.get_connection() as conn: + try: + mod = (ldap.MOD_DELETE, self.member_attribute, member_dn) + conn.modify_s(member_list_dn, [mod]) + except ldap.NO_SUCH_OBJECT: + raise self._not_found(member_list_dn) + + def _delete_tree_nodes(self, search_base, scope, query_params=None): + query = u'(objectClass=%s)' % self.object_class + if query_params: + query = (u'(&%s%s)' % + (query, ''.join(['(%s=%s)' + % (k, ldap.filter.escape_filter_chars(v)) + for k, v in + six.iteritems(query_params)]))) + not_deleted_nodes = [] + with self.get_connection() as conn: + try: + nodes = conn.search_s(search_base, scope, query, + attrlist=DN_ONLY) + except ldap.NO_SUCH_OBJECT: + LOG.debug('Could not find entry with dn=%s', search_base) + raise self._not_found(self._dn_to_id(search_base)) + else: + for node_dn, _t in nodes: + try: + conn.delete_s(node_dn) + except ldap.NO_SUCH_OBJECT: + not_deleted_nodes.append(node_dn) + + if not_deleted_nodes: + LOG.warn(_LW("When deleting entries for %(search_base)s, could not" + " delete nonexistent entries %(entries)s%(dots)s"), + {'search_base': search_base, + 'entries': not_deleted_nodes[:3], + 'dots': '...' if len(not_deleted_nodes) > 3 else ''}) + + def filter_query(self, hints, query=None): + """Applies filtering to a query. + + :param hints: contains the list of filters, which may be None, + indicating that there are no filters to be applied. + If it's not None, then any filters satisfied here will be + removed so that the caller will know if any filters + remain to be applied. + :param query: LDAP query into which to include filters + + :returns query: LDAP query, updated with any filters satisfied + + """ + def build_filter(filter_, hints): + """Build a filter for the query. + + :param filter_: the dict that describes this filter + :param hints: contains the list of filters yet to be satisfied. + + :returns query: LDAP query term to be added + + """ + ldap_attr = self.attribute_mapping[filter_['name']] + val_esc = ldap.filter.escape_filter_chars(filter_['value']) + + if filter_['case_sensitive']: + # NOTE(henry-nash): Although dependent on the schema being + # used, most LDAP attributes are configured with case + # insensitive matching rules, so we'll leave this to the + # controller to filter. + return + + if filter_['name'] == 'enabled': + # NOTE(henry-nash): Due to the different options for storing + # the enabled attribute (e,g, emulated or not), for now we + # don't try and filter this at the driver level - we simply + # leave the filter to be handled by the controller. It seems + # unlikley that this will cause a signifcant performance + # issue. + return + + # TODO(henry-nash): Currently there are no booleans (other than + # 'enabled' that is handled above) on which you can filter. If + # there were, we would need to add special handling here to + # convert the booleans values to 'TRUE' and 'FALSE'. To do that + # we would also need to know which filter keys were actually + # booleans (this is related to bug #1411478). + + if filter_['comparator'] == 'equals': + query_term = (u'(%(attr)s=%(val)s)' + % {'attr': ldap_attr, 'val': val_esc}) + elif filter_['comparator'] == 'contains': + query_term = (u'(%(attr)s=*%(val)s*)' + % {'attr': ldap_attr, 'val': val_esc}) + elif filter_['comparator'] == 'startswith': + query_term = (u'(%(attr)s=%(val)s*)' + % {'attr': ldap_attr, 'val': val_esc}) + elif filter_['comparator'] == 'endswith': + query_term = (u'(%(attr)s=*%(val)s)' + % {'attr': ldap_attr, 'val': val_esc}) + else: + # It's a filter we don't understand, so let the caller + # work out if they need to do something with it. + return + + return query_term + + if hints is None: + return query + + filter_list = [] + satisfied_filters = [] + + for filter_ in hints.filters: + if filter_['name'] not in self.attribute_mapping: + continue + new_filter = build_filter(filter_, hints) + if new_filter is not None: + filter_list.append(new_filter) + satisfied_filters.append(filter_) + + if filter_list: + query = u'(&%s%s)' % (query, ''.join(filter_list)) + + # Remove satisfied filters, then the caller will know remaining filters + for filter_ in satisfied_filters: + hints.filters.remove(filter_) + + return query + + +class EnabledEmuMixIn(BaseLdap): + """Emulates boolean 'enabled' attribute if turned on. + + Creates groupOfNames holding all enabled objects of this class, all missing + objects are considered disabled. + + Options: + + * $name_enabled_emulation - boolean, on/off + * $name_enabled_emulation_dn - DN of that groupOfNames, default is + cn=enabled_${name}s,${tree_dn} + + Where ${name}s is the plural of self.options_name ('users' or 'tenants'), + ${tree_dn} is self.tree_dn. + """ + + def __init__(self, conf): + super(EnabledEmuMixIn, self).__init__(conf) + enabled_emulation = '%s_enabled_emulation' % self.options_name + self.enabled_emulation = getattr(conf.ldap, enabled_emulation) + + enabled_emulation_dn = '%s_enabled_emulation_dn' % self.options_name + self.enabled_emulation_dn = getattr(conf.ldap, enabled_emulation_dn) + if not self.enabled_emulation_dn: + naming_attr_name = 'cn' + naming_attr_value = 'enabled_%ss' % self.options_name + sub_vals = (naming_attr_name, naming_attr_value, self.tree_dn) + self.enabled_emulation_dn = '%s=%s,%s' % sub_vals + naming_attr = (naming_attr_name, [naming_attr_value]) + else: + # Extract the attribute name and value from the configured DN. + naming_dn = ldap.dn.str2dn(utf8_encode(self.enabled_emulation_dn)) + naming_rdn = naming_dn[0][0] + naming_attr = (utf8_decode(naming_rdn[0]), + utf8_decode(naming_rdn[1])) + self.enabled_emulation_naming_attr = naming_attr + + def _get_enabled(self, object_id): + dn = self._id_to_dn(object_id) + query = '(member=%s)' % dn + with self.get_connection() as conn: + try: + enabled_value = conn.search_s(self.enabled_emulation_dn, + ldap.SCOPE_BASE, + query, ['cn']) + except ldap.NO_SUCH_OBJECT: + return False + else: + return bool(enabled_value) + + def _add_enabled(self, object_id): + if not self._get_enabled(object_id): + modlist = [(ldap.MOD_ADD, + 'member', + [self._id_to_dn(object_id)])] + with self.get_connection() as conn: + try: + conn.modify_s(self.enabled_emulation_dn, modlist) + except ldap.NO_SUCH_OBJECT: + attr_list = [('objectClass', ['groupOfNames']), + ('member', [self._id_to_dn(object_id)]), + self.enabled_emulation_naming_attr] + if self.use_dumb_member: + attr_list[1][1].append(self.dumb_member) + conn.add_s(self.enabled_emulation_dn, attr_list) + + def _remove_enabled(self, object_id): + modlist = [(ldap.MOD_DELETE, + 'member', + [self._id_to_dn(object_id)])] + with self.get_connection() as conn: + try: + conn.modify_s(self.enabled_emulation_dn, modlist) + except (ldap.NO_SUCH_OBJECT, ldap.NO_SUCH_ATTRIBUTE): + pass + + def create(self, values): + if self.enabled_emulation: + enabled_value = values.pop('enabled', True) + ref = super(EnabledEmuMixIn, self).create(values) + if 'enabled' not in self.attribute_ignore: + if enabled_value: + self._add_enabled(ref['id']) + ref['enabled'] = enabled_value + return ref + else: + return super(EnabledEmuMixIn, self).create(values) + + def get(self, object_id, ldap_filter=None): + ref = super(EnabledEmuMixIn, self).get(object_id, ldap_filter) + if 'enabled' not in self.attribute_ignore and self.enabled_emulation: + ref['enabled'] = self._get_enabled(object_id) + return ref + + def get_all(self, ldap_filter=None): + if 'enabled' not in self.attribute_ignore and self.enabled_emulation: + # had to copy BaseLdap.get_all here to ldap_filter by DN + tenant_list = [self._ldap_res_to_model(x) + for x in self._ldap_get_all(ldap_filter) + if x[0] != self.enabled_emulation_dn] + for tenant_ref in tenant_list: + tenant_ref['enabled'] = self._get_enabled(tenant_ref['id']) + return tenant_list + else: + return super(EnabledEmuMixIn, self).get_all(ldap_filter) + + def update(self, object_id, values, old_obj=None): + if 'enabled' not in self.attribute_ignore and self.enabled_emulation: + data = values.copy() + enabled_value = data.pop('enabled', None) + ref = super(EnabledEmuMixIn, self).update(object_id, data, old_obj) + if enabled_value is not None: + if enabled_value: + self._add_enabled(object_id) + else: + self._remove_enabled(object_id) + ref['enabled'] = enabled_value + return ref + else: + return super(EnabledEmuMixIn, self).update( + object_id, values, old_obj) + + def delete(self, object_id): + if self.enabled_emulation: + self._remove_enabled(object_id) + super(EnabledEmuMixIn, self).delete(object_id) + + +class ProjectLdapStructureMixin(object): + """Project LDAP Structure shared between LDAP backends. + + This is shared between the resource and assignment LDAP backends. + + """ + DEFAULT_OU = 'ou=Groups' + DEFAULT_STRUCTURAL_CLASSES = [] + DEFAULT_OBJECTCLASS = 'groupOfNames' + DEFAULT_ID_ATTR = 'cn' + NotFound = exception.ProjectNotFound + notfound_arg = 'project_id' # NOTE(yorik-sar): while options_name = tenant + options_name = 'project' + attribute_options_names = {'name': 'name', + 'description': 'desc', + 'enabled': 'enabled', + 'domain_id': 'domain_id'} + immutable_attrs = ['name'] |