[Freeipa-devel] [PATCH] Make the migration plugin more configurable
Jakub Hrozek
jhrozek at redhat.com
Mon Nov 15 11:56:58 UTC 2010
This patch adds new options to the migration plugin:
* the option to fine-tune the objectclass of users or groups being
* imported
* the option to select the LDAP schema (RFC2307 or RFC2307bis)
https://fedorahosted.org/freeipa/ticket/429
-------------- next part --------------
>From 88165ff6ea2d889150e8bdc882a7b6bec1ab0519 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Tue, 26 Oct 2010 16:10:42 -0400
Subject: [PATCH] Make the migration plugin more configurable
This patch adds new options to the migration plugin:
* the option to fine-tune the objectclass of users or groups being imported
* the option to select the LDAP schema (RFC2307 or RFC2307bis)
https://fedorahosted.org/freeipa/ticket/429
---
ipalib/plugins/migration.py | 86 ++++++++++++++++++++++++++++++++++---------
1 files changed, 68 insertions(+), 18 deletions(-)
diff --git a/ipalib/plugins/migration.py b/ipalib/plugins/migration.py
index 6dc9934..81e35e2 100644
--- a/ipalib/plugins/migration.py
+++ b/ipalib/plugins/migration.py
@@ -28,7 +28,7 @@ import logging
import re
from ipalib import api, errors, output
-from ipalib import Command, List, Password, Str, Flag
+from ipalib import Command, List, Password, Str, Flag, StrEnum
from ipalib.cli import to_cli
if api.env.in_server and api.env.context in ['lite', 'server']:
try:
@@ -44,8 +44,10 @@ from ipalib.text import Gettext # FIXME: remove once the other Gettext FIXME is
_krb_err_msg = _('Kerberos principal %s already exists. Use \'ipa user-mod\' to set it manually.')
_grp_err_msg = _('Failed to add user to the default group. Use \'ipa group-add-member\' to add manually.')
+_supported_schemas = (u'RFC2307bis', u'RFC2307')
-def _pre_migrate_user(ldap, pkey, dn, entry_attrs, failed, config, ctx):
+
+def _pre_migrate_user(ldap, pkey, dn, entry_attrs, failed, config, ctx, **kwargs):
# get default primary group for new users
if 'def_group_dn' not in ctx:
def_group = config.get('ipadefaultprimarygroup')
@@ -90,8 +92,8 @@ def _post_migrate_user(ldap, pkey, dn, entry_attrs, failed, config, ctx):
# GROUP MIGRATION CALLBACKS AND VARS
-def _pre_migrate_group(ldap, pkey, dn, entry_attrs, failed, config, ctx):
- def convert_members(member_attr, overwrite=False):
+def _pre_migrate_group(ldap, pkey, dn, entry_attrs, failed, config, ctx, **kwargs):
+ def convert_members_rfc2307bis(member_attr, overwrite=False):
"""
Convert DNs in member attributes to work in IPA.
"""
@@ -112,15 +114,36 @@ def _pre_migrate_group(ldap, pkey, dn, entry_attrs, failed, config, ctx):
entry_attrs['member'] = []
entry_attrs['member'] += new_members
+ def convert_members_rfc2307(member_attr):
+ """
+ Convert usernames in member attributes to work in IPA.
+ """
+ new_members = []
+ entry_attrs.setdefault(member_attr, [])
+ for m in entry_attrs[member_attr]:
+ memberdn = 'uid=%s,%s' % (m, api.env.container_user)
+ new_members.append(ldap.normalize_dn(memberdn))
+ entry_attrs['member'] = new_members
+
+ schema = kwargs.get('schema', None)
entry_attrs['ipauniqueid'] = 'autogenerate'
- convert_members('member', overwrite=True)
- convert_members('uniquemember')
+ if schema == 'RFC2307bis':
+ convert_members_rfc2307bis('member', overwrite=True)
+ convert_members_rfc2307bis('uniquemember')
+ elif schema == 'RFC2307':
+ convert_members_rfc2307('memberuid')
+ else:
+ raise ValueError('Schema %s not supported' % schema)
return dn
# DS MIGRATION PLUGIN
+def construct_filter(template, oc_list):
+ oc_subfilter = ''.join([ '(objectclass=%s)' % oc for oc in oc_list])
+ return template % oc_subfilter
+
def validate_ldapuri(ugettext, ldapuri):
m = re.match('^ldaps?://[-\w\.]+(:\d+)?$', ldapuri)
if not m:
@@ -152,14 +175,18 @@ class migrate_ds(Command):
#
# If pre_callback return value evaluates to False, migration
# of the current object is aborted.
- 'user': (
- '(&(objectClass=person)(uid=*))',
- _pre_migrate_user, _post_migrate_user
- ),
- 'group': (
- '(&(|(objectClass=groupOfUniqueNames)(objectClass=groupOfNames))(cn=*))',
- _pre_migrate_group, None
- ),
+ 'user': {
+ 'filter_template' : '(&(|%s)(uid=*))',
+ 'oc_option' : 'userobjectclass',
+ 'pre_callback' : _pre_migrate_user,
+ 'post_callback' : _post_migrate_user
+ },
+ 'group': {
+ 'filter_template' : '(&(|%s)(cn=*))',
+ 'oc_option' : 'groupobjectclass',
+ 'pre_callback' : _pre_migrate_group,
+ 'post_callback' : None
+ },
}
migrate_order = ('user', 'group')
@@ -196,6 +223,28 @@ class migrate_ds(Command):
default=u'ou=groups',
autofill=True,
),
+ List('userobjectclass?',
+ cli_name='user_objectclass',
+ label=_('User object class'),
+ doc=_('Comma-separated list of objectclasses used to search for user entries in DS'),
+ default=(u'person',),
+ autofill=True,
+ ),
+ List('groupobjectclass?',
+ cli_name='group_objectclass',
+ label=_('Group object class'),
+ doc=_('Comma-separated list of objectclasses used to search for group entries in DS'),
+ default=(u'groupOfUniqueNames', u'groupOfNames'),
+ autofill=True,
+ ),
+ StrEnum('schema?',
+ cli_name='schema',
+ label=_('LDAP schema'),
+ doc=_('The schema used on the LDAP server. Supported values are RFC2307 and RFC2307bis. The default is RFC2307bis'),
+ values=_supported_schemas,
+ default=_supported_schemas[0],
+ autofill=True,
+ ),
Flag('continue?',
doc=_('Continous operation mode. Errors are reported but the process continues'),
default=False,
@@ -276,7 +325,8 @@ can use their Kerberos accounts.''')
for ldap_obj_name in self.migrate_order:
ldap_obj = self.api.Object[ldap_obj_name]
- search_filter = self.migrate_objects[ldap_obj_name][0]
+ search_filter = construct_filter(self.migrate_objects[ldap_obj_name]['filter_template'],
+ options[to_cli(self.migrate_objects[ldap_obj_name]['oc_option'])])
search_base = '%s,%s' % (
options['%scontainer' % to_cli(ldap_obj_name)], ds_base_dn
)
@@ -319,11 +369,11 @@ can use their Kerberos accounts.''')
)
)
- callback = self.migrate_objects[ldap_obj_name][1]
+ callback = self.migrate_objects[ldap_obj_name]['pre_callback']
if callable(callback):
dn = callback(
ldap, pkey, dn, entry_attrs, failed[ldap_obj_name],
- config, context
+ config, context, schema = options['schema']
)
if not dn:
continue
@@ -335,7 +385,7 @@ can use their Kerberos accounts.''')
else:
migrated[ldap_obj_name].append(pkey)
- callback = self.migrate_objects[ldap_obj_name][2]
+ callback = self.migrate_objects[ldap_obj_name]['post_callback']
if callable(callback):
callback(
ldap, pkey, dn, entry_attrs, failed[ldap_obj_name],
--
1.7.3.2
More information about the Freeipa-devel
mailing list