Attachment 4053 Details for Bug 22653

[patch] univention-ad-connector-password-read.patch

univention-ad-connector-password-read.patch (text/plain), 31.68 KB, created by Stefan Gohmann on 2012-01-03 07:33 CET

(hide)

Description:

Filename:

MIME Type:

Creator: Stefan Gohmann

Created: 2012-01-03 07:33 CET

Size: 31.68 KB

patch

obsolete

>diff -Nur univention-ad-connector-password-read.orig/connectorpwdread.init.sh univention-ad-connector-password-read/connectorpwdread.init.sh
>--- univention-ad-connector-password-read.orig/connectorpwdread.init.sh	1970-01-01 01:00:00.000000000 +0100
>+++ univention-ad-connector-password-read/connectorpwdread.init.sh	2011-06-08 10:21:53.000000000 +0200
>@@ -0,0 +1,34 @@
>+#!/bin/sh
>+
>+eval "$(univention-config-registry shell)"
>+
>+CONFIGBASENAME="connectorpwdread"
>+
>+univention-config-registry set  "$CONFIGBASENAME"/ad/autostart?"$connector_ad_autostart" \
>+                                "$CONFIGBASENAME"/ad/ldap/base?"$connector_ad_ldap_base" \
>+                                "$CONFIGBASENAME"/ad/ldap/binddn?"$connector_ad_ldap_binddn" \
>+                                "$CONFIGBASENAME"/ad/ldap/bindpw?"$connector_ad_ldap_bindpw" \
>+                                "$CONFIGBASENAME"/ad/ldap/certificate?"$connector_ad_ldap_certificate" \
>+                                "$CONFIGBASENAME"/ad/ldap/host?"$connector_ad_ldap_host" \
>+                                "$CONFIGBASENAME"/ad/mapping/kerberosdomain?"$connector_ad_mapping_kerberosdomain" \
>+                                "$CONFIGBASENAME"/ad/mapping/language?"$connector_ad_mapping_language" \
>+                                "$CONFIGBASENAME"/ad/ldap/port?"$connector_ad_ldap_port" \
>+                                "$CONFIGBASENAME"/ad/ldap/ssl?"$connector_ad_ldap_ssl" \
>+                                "$CONFIGBASENAME"/ad/listener/dir?"/var/lib/univention-$CONFIGBASENAME/ad" \
>+                                "$CONFIGBASENAME"/ad/mapping/group/language?"$connector_ad_mapping_group_language" \
>+                                "$CONFIGBASENAME"/ad/mapping/group/primarymail?"$connector_ad_mapping_group_primarymail" \
>+                                "$CONFIGBASENAME"/ad/mapping/group/win2000/description?false \
>+                                "$CONFIGBASENAME"/ad/mapping/syncmode?read \
>+                                "$CONFIGBASENAME"/ad/mapping/user/primarymail?false \
>+                                "$CONFIGBASENAME"/ad/mapping/user/win2000/description?false \
>+                                "$CONFIGBASENAME"/ad/poll/sleep?5 \
>+                                "$CONFIGBASENAME"/ad/retryrejected?10 \
>+                                "$CONFIGBASENAME"/debug/function?0 \
>+                                "$CONFIGBASENAME"/debug/level?1 \
>+                                "$CONFIGBASENAME"/password/service/encoding?iso8859-15
>+
>+mkdir -p /etc/univention/"$CONFIGBASENAME"/ad
>+cp -a /etc/univention/connector/ad/mapping /etc/univention/"$CONFIGBASENAME"/ad/
>+sed -i "s|@%@connector/ad/|@%@$CONFIGBASENAME/ad/|g;s|'connector/ad/|'$CONFIGBASENAME/ad/|g" /etc/univention/"$CONFIGBASENAME"/ad/mapping
>+
>+exit 0
>diff -Nur univention-ad-connector-password-read.orig/debian/changelog univention-ad-connector-password-read/debian/changelog
>--- univention-ad-connector-password-read.orig/debian/changelog	1970-01-01 01:00:00.000000000 +0100
>+++ univention-ad-connector-password-read/debian/changelog	2011-04-01 16:19:10.000000000 +0200
>@@ -0,0 +1,52 @@
>+univention-ad-connector-password-read (1.0.5-2) unstable; urgency=low
>+
>+  * Fixed typo (Ticket #2011032410000222)
>+
>+ -- Stefan Gohmann <gohmann@univention.de>  Fri, 01 Apr 2011 16:19:10 +0200
>+
>+univention-ad-connector-password-read (1.0.5-1) unstable; urgency=low
>+
>+  * Re-initialize the ldap connection to UCS because in some customer
>+    environments (write mode) the AD connector is modified to connect
>+    against the ldap/server/name instead of ldap/master
>+    (Ticket #2011032410000222)
>+
>+ -- Stefan Gohmann <gohmann@univention.de>  Fri, 01 Apr 2011 16:04:32 +0200
>+
>+univention-ad-connector-password-read (1.0.4-1) unstable; urgency=low
>+
>+  * Replace all ucr variables in the new mapping file
>+    (Ticket #2011032410000222)
>+
>+ -- Stefan Gohmann <gohmann@univention.de>  Thu, 31 Mar 2011 14:45:47 +0200
>+
>+univention-ad-connector-password-read (1.0.3-1) unstable; urgency=low
>+
>+  * Fixed typo in postinst for connector_ad_mapping_group_language
>+    (Ticket #2011032410000222)
>+
>+ -- Stefan Gohmann <gohmann@univention.de>  Wed, 30 Mar 2011 19:58:17 +0200
>+
>+univention-ad-connector-password-read (1.0.2-1) unstable; urgency=low
>+
>+  * Fixed excepetion error (Ticket #2011032410000222)
>+  * Sleep for poll_sleep interval if the AD server is not available
>+    (Ticket #2011032410000222)
>+
>+ -- Stefan Gohmann <gohmann@univention.de>  Wed, 30 Mar 2011 11:08:12 +0200
>+
>+univention-ad-connector-password-read (1.0.1-1) unstable; urgency=low
>+
>+  * Removed unused debug code
>+  * Added an exception handling if the user does not exist in UCS, this
>+    is possible because the AD connector is normally in write mode
>+  (Ticket #2011032410000222)
>+
>+ -- Stefan Gohmann <gohmann@univention.de>  Wed, 30 Mar 2011 07:46:43 +0200
>+
>+univention-ad-connector-password-read (1.0.0-1) unstable; urgency=low
>+
>+  * Initial Release (Ticket #2011032410000222)
>+
>+ -- Stefan Gohmann <gohmann@univention.de>  Tue, 29 Mar 2011 06:43:39 +0200
>+
>diff -Nur univention-ad-connector-password-read.orig/debian/compat univention-ad-connector-password-read/debian/compat
>--- univention-ad-connector-password-read.orig/debian/compat	1970-01-01 01:00:00.000000000 +0100
>+++ univention-ad-connector-password-read/debian/compat	2011-03-29 06:43:15.000000000 +0200
>@@ -0,0 +1 @@
>+7
>diff -Nur univention-ad-connector-password-read.orig/debian/control univention-ad-connector-password-read/debian/control
>--- univention-ad-connector-password-read.orig/debian/control	1970-01-01 01:00:00.000000000 +0100
>+++ univention-ad-connector-password-read/debian/control	2011-03-29 07:09:55.000000000 +0200
>@@ -0,0 +1,22 @@
>+Source: univention-ad-connector-password-read
>+Section: univention
>+Priority: optional
>+Maintainer: Univention GmbH <packages@univention.de>
>+Standards-Version: 3.5.5
>+Build-Depends: debhelper (>> 7), univention-config-dev
>+
>+Package: univention-ad-connector-password-read
>+Architecture: all
>+Depends: univention-directory-manager-tools,
>+ univention-ad-connector,
>+ ${misc:Depends}
>+Description: Synchronize password only from AD to UCS
>+ This package contains a daemon wich synchronize the password from AD to
>+ UCS. This is useful if the ad connector is configured in write mode (UCS
>+ -> AD) and only the password must be synchronized back from AD to UCS.
>+ This package requires a configured AD connector.
>+ This package is part of Univention Corporate Server (UCS), an
>+ integrated, directory driven solution for managing corporate
>+ environments. For more information about UCS, refer to:
>+ http://www.univention.de/
>+
>diff -Nur univention-ad-connector-password-read.orig/debian/copyright univention-ad-connector-password-read/debian/copyright
>--- univention-ad-connector-password-read.orig/debian/copyright	1970-01-01 01:00:00.000000000 +0100
>+++ univention-ad-connector-password-read/debian/copyright	2011-03-29 06:43:15.000000000 +0200
>@@ -0,0 +1,28 @@
>+Copyright 2010-2011 Univention GmbH
>+
>+http://www.univention.de/
>+
>+All rights reserved.
>+
>+The source code of the software contained in this package
>+as well as the source package itself are made available
>+under the terms of the GNU Affero General Public License version 3
>+(GNU AGPL V3) as published by the Free Software Foundation.
>+
>+Binary versions of this package provided by Univention to you as
>+well as other copyrighted, protected or trademarked materials like
>+Logos, graphics, fonts, specific documentations and configurations,
>+cryptographic keys etc. are subject to a license agreement between
>+you and Univention and not subject to the GNU AGPL V3.
>+
>+In the case you use the software under the terms of the GNU AGPL V3,
>+the program is provided in the hope that it will be useful,
>+but WITHOUT ANY WARRANTY; without even the implied warranty of
>+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>+GNU Affero General Public License for more details.
>+
>+You should have received a copy of the GNU Affero General Public
>+License with the Debian GNU/Linux or Univention distribution in file
>+/usr/share/common-licenses/AGPL-3; if not, see
>+<http://www.gnu.org/licenses/>.
>+
>diff -Nur univention-ad-connector-password-read.orig/debian/rules univention-ad-connector-password-read/debian/rules
>--- univention-ad-connector-password-read.orig/debian/rules	1970-01-01 01:00:00.000000000 +0100
>+++ univention-ad-connector-password-read/debian/rules	2011-03-30 07:37:10.000000000 +0200
>@@ -0,0 +1,42 @@
>+#!/usr/bin/make -f
>+#
>+# univention-ad-connector-password-read
>+#  debhelper script for the debian package
>+#
>+# Copyright 2010-2011 Univention GmbH
>+#
>+# http://www.univention.de/
>+#
>+# All rights reserved.
>+#
>+# The source code of this program is made available
>+# under the terms of the GNU Affero General Public License version 3
>+# (GNU AGPL V3) as published by the Free Software Foundation.
>+#
>+# Binary versions of this program provided by Univention to you as
>+# well as other copyrighted, protected or trademarked materials like
>+# Logos, graphics, fonts, specific documentations and configurations,
>+# cryptographic keys etc. are subject to a license agreement between
>+# you and Univention and not subject to the GNU AGPL V3.
>+#
>+# In the case you use this program under the terms of the GNU AGPL V3,
>+# the program is provided in the hope that it will be useful,
>+# but WITHOUT ANY WARRANTY; without even the implied warranty of
>+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>+# GNU Affero General Public License for more details.
>+#
>+# You should have received a copy of the GNU Affero General Public
>+# License with the Debian GNU/Linux or Univention distribution in file
>+# /usr/share/common-licenses/AGPL-3; if not, see
>+# <http://www.gnu.org/licenses/>.
>+
>+override_dh_auto_install:
>+	univention-install-config-registry
>+	dh_auto_install
>+
>+override_dh_auto_build:
>+	dh_auto_build
>+%:
>+	dh $@
>+
>+
>diff -Nur univention-ad-connector-password-read.orig/debian/univention-ad-connector-password-read.init univention-ad-connector-password-read/debian/univention-ad-connector-password-read.init
>--- univention-ad-connector-password-read.orig/debian/univention-ad-connector-password-read.init	1970-01-01 01:00:00.000000000 +0100
>+++ univention-ad-connector-password-read/debian/univention-ad-connector-password-read.init	2011-03-30 07:35:14.000000000 +0200
>@@ -0,0 +1,73 @@
>+#!/bin/sh
>+#
>+# Univention AD Connector
>+#  init script of ad connector password read
>+#
>+# Copyright 2004-2011 Univention GmbH
>+#
>+# http://www.univention.de/
>+#
>+# All rights reserved.
>+#
>+# The source code of this program is made available
>+# under the terms of the GNU Affero General Public License version 3
>+# (GNU AGPL V3) as published by the Free Software Foundation.
>+#
>+# Binary versions of this program provided by Univention to you as
>+# well as other copyrighted, protected or trademarked materials like
>+# Logos, graphics, fonts, specific documentations and configurations,
>+# cryptographic keys etc. are subject to a license agreement between
>+# you and Univention and not subject to the GNU AGPL V3.
>+#
>+# In the case you use this program under the terms of the GNU AGPL V3,
>+# the program is provided in the hope that it will be useful,
>+# but WITHOUT ANY WARRANTY; without even the implied warranty of
>+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>+# GNU Affero General Public License for more details.
>+#
>+# You should have received a copy of the GNU Affero General Public
>+# License with the Debian GNU/Linux or Univention distribution in file
>+# /usr/share/common-licenses/AGPL-3; if not, see
>+# <http://www.gnu.org/licenses/>.
>+
>+CONFIGBASENAME="connectorpwdread"
>+ADCONNECTORPID="/var/run/univention-ad-$CONFIGBASENAME"
>+
>+. /lib/lsb/init-functions
>+
>+case "$1" in
>+	start)
>+		# check ucr autostart setting
>+		if [ -f "/usr/share/univention-config-registry/init-autostart.lib" ]; then
>+			source "/usr/share/univention-config-registry/init-autostart.lib"
>+			check_autostart ad-$CONFIGBASENAME $CONFIGBASENAME/ad/autostart
>+		fi	
>+		log_action_msg "Starting univention-ad-connector daemon"
>+		cat /etc/univention/${CONFIGBASENAME}/ad/mapping | univention-config-registry filter --encode-utf8 >/etc/univention/${CONFIGBASENAME}/ad/mapping.py
>+		start-stop-daemon --start --quiet --pidfile "$ADCONNECTORPID" -a /usr/sbin/univention-ad-connector-password-read -- --configbase "$CONFIGBASENAME"
>+		log_action_end_msg 0
>+		;;
>+	stop)
>+		log_action_msg "Stopping univention-ad-connector daemon"
>+		start-stop-daemon --stop --retry TERM/300/KILL --quiet --pidfile "$ADCONNECTORPID" -a /usr/sbin/univention-ad-connector-password-read
>+		log_action_end_msg 0
>+		;;
>+	restart|force-reload)
>+		$0 stop
>+		sleep 1
>+		$0 start
>+		;;
>+	crestart)
>+		ADCONNECTOR=`cat $ADCONNECTORPID 2>/dev/null`
>+		if [ -n "$ADCONNECTOR" ]; then
>+			pgrep -s "$ADCONNECTOR" -f "connector-password-read" && $0 restart
>+		    ps xaw | grep connector-password-read | grep -q "$ADCONNECTOR" >/dev/null && $0 restart
>+		fi
>+		;;
>+	*)
>+		echo "Usage: /etc/init.d/univention-ad-connector {start|stop|restart|crestart|force-reload}"
>+		exit 1
>+		;;
>+esac
>+
>+
>diff -Nur univention-ad-connector-password-read.orig/debian/univention-ad-connector-password-read.install univention-ad-connector-password-read/debian/univention-ad-connector-password-read.install
>--- univention-ad-connector-password-read.orig/debian/univention-ad-connector-password-read.install	1970-01-01 01:00:00.000000000 +0100
>+++ univention-ad-connector-password-read/debian/univention-ad-connector-password-read.install	2011-03-29 07:21:52.000000000 +0200
>@@ -0,0 +1 @@
>+univention-ad-connector-password-read usr/sbin/
>diff -Nur univention-ad-connector-password-read.orig/debian/univention-ad-connector-password-read.postinst univention-ad-connector-password-read/debian/univention-ad-connector-password-read.postinst
>--- univention-ad-connector-password-read.orig/debian/univention-ad-connector-password-read.postinst	1970-01-01 01:00:00.000000000 +0100
>+++ univention-ad-connector-password-read/debian/univention-ad-connector-password-read.postinst	2011-03-31 14:18:38.000000000 +0200
>@@ -0,0 +1,83 @@
>+#!/bin/sh
>+#
>+# Univention AD Connector
>+#  postinst script of the ad connector package
>+#
>+# Copyright 2004-2010 Univention GmbH
>+#
>+# http://www.univention.de/
>+#
>+# All rights reserved.
>+#
>+# The source code of this program is made available
>+# under the terms of the GNU Affero General Public License version 3
>+# (GNU AGPL V3) as published by the Free Software Foundation.
>+#
>+# Binary versions of this program provided by Univention to you as
>+# well as other copyrighted, protected or trademarked materials like
>+# Logos, graphics, fonts, specific documentations and configurations,
>+# cryptographic keys etc. are subject to a license agreement between
>+# you and Univention and not subject to the GNU AGPL V3.
>+#
>+# In the case you use this program under the terms of the GNU AGPL V3,
>+# the program is provided in the hope that it will be useful,
>+# but WITHOUT ANY WARRANTY; without even the implied warranty of
>+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>+# GNU Affero General Public License for more details.
>+#
>+# You should have received a copy of the GNU Affero General Public
>+# License with the Debian GNU/Linux or Univention distribution in file
>+# /usr/share/common-licenses/AGPL-3; if not, see
>+# <http://www.gnu.org/licenses/>.
>+
>+eval "$(ucr shell)"
>+
>+CONFIGBASENAME="connectorpwdread"
>+
>+createLogfile () {
>+	if [ ! -e $1 ] ; then
>+		touch $1
>+		chown $2 $1
>+		chmod $3 $1
>+	fi
>+}
>+
>+createLogfile "/var/log/univention/${CONFIGBASENAME}.log" "root:adm" 640
>+createLogfile "/var/log/univention/${CONFIGBASENAME}-status.log" "root:adm" 640
>+
>+if [ "$1" = "configure" ] && [ -z "$2" ]; then
>+	if [ ! -e /etc/univention/"$CONFIGBASENAME" ]; then
>+
>+		univention-config-registry set	"$CONFIGBASENAME"/ad/autostart?"$connector_ad_autostart" \
>+										"$CONFIGBASENAME"/ad/ldap/base?"$connector_ad_ldap_base" \
>+										"$CONFIGBASENAME"/ad/ldap/binddn?"$connector_ad_ldap_binddn" \
>+										"$CONFIGBASENAME"/ad/ldap/bindpw?"$connector_ad_ldap_bindpw" \
>+										"$CONFIGBASENAME"/ad/ldap/certificate?"$connector_ad_ldap_certificate" \
>+										"$CONFIGBASENAME"/ad/ldap/host?"$connector_ad_ldap_host" \
>+										"$CONFIGBASENAME"/ad/mapping/kerberosdomain?"$connector_ad_mapping_kerberosdomain" \
>+										"$CONFIGBASENAME"/ad/mapping/language?"$connector_ad_mapping_language" \
>+										"$CONFIGBASENAME"/ad/ldap/port?"$connector_ad_ldap_port" \
>+										"$CONFIGBASENAME"/ad/ldap/ssl?"$connector_ad_ldap_ssl" \
>+										"$CONFIGBASENAME"/ad/listener/dir?"/var/lib/univention-$CONFIGBASENAME/ad" \
>+										"$CONFIGBASENAME"/ad/mapping/group/language?"$connector_ad_mapping_group_language" \
>+										"$CONFIGBASENAME"/ad/mapping/group/primarymail?"$connector_ad_mapping_group_primarymail" \
>+										"$CONFIGBASENAME"/ad/mapping/group/win2000/description?false \
>+										"$CONFIGBASENAME"/ad/mapping/syncmode?read \
>+										"$CONFIGBASENAME"/ad/mapping/user/primarymail?false \
>+										"$CONFIGBASENAME"/ad/mapping/user/win2000/description?false \
>+										"$CONFIGBASENAME"/ad/poll/sleep?5 \
>+										"$CONFIGBASENAME"/ad/retryrejected?10 \
>+										"$CONFIGBASENAME"/debug/function?0 \
>+										"$CONFIGBASENAME"/debug/level?1 \
>+										"$CONFIGBASENAME"/password/service/encoding?iso8859-15
>+		
>+		mkdir -p /etc/univention/"$CONFIGBASENAME"/ad
>+		cp -a /etc/univention/connector/ad/mapping /etc/univention/"$CONFIGBASENAME"/ad/
>+		sed -i "s|@%@connector/ad/|@%@$CONFIGBASENAME/ad/|g;s|'connector/ad/|'$CONFIGBASENAME/ad/|g" /etc/univention/"$CONFIGBASENAME"/ad/mapping
>+	fi
>+    
>+fi
>+
>+#DEBHELPER#
>+
>+exit 0
>diff -Nur univention-ad-connector-password-read.orig/univention-ad-connector-password-read univention-ad-connector-password-read/univention-ad-connector-password-read
>--- univention-ad-connector-password-read.orig/univention-ad-connector-password-read	1970-01-01 01:00:00.000000000 +0100
>+++ univention-ad-connector-password-read/univention-ad-connector-password-read	2011-04-01 16:17:15.000000000 +0200
>@@ -0,0 +1,445 @@
>+#!/usr/bin/python2.4
>+# -*- coding: utf-8 -*-
>+#
>+# Univention AD Connector Password Sync
>+#
>+# Copyright 2004-2011 Univention GmbH
>+#
>+# http://www.univention.de/
>+#
>+# All rights reserved.
>+#
>+# The source code of this program is made available
>+# under the terms of the GNU Affero General Public License version 3
>+# (GNU AGPL V3) as published by the Free Software Foundation.
>+#
>+# Binary versions of this program provided by Univention to you as
>+# well as other copyrighted, protected or trademarked materials like
>+# Logos, graphics, fonts, specific documentations and configurations,
>+# cryptographic keys etc. are subject to a license agreement between
>+# you and Univention and not subject to the GNU AGPL V3.
>+#
>+# In the case you use this program under the terms of the GNU AGPL V3,
>+# the program is provided in the hope that it will be useful,
>+# but WITHOUT ANY WARRANTY; without even the implied warranty of
>+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>+# GNU Affero General Public License for more details.
>+#
>+# You should have received a copy of the GNU Affero General Public
>+# License with the Debian GNU/Linux or Univention distribution in file
>+# /usr/share/common-licenses/AGPL-3; if not, see
>+# <http://www.gnu.org/licenses/>.
>+
>+import sys, string, os, time, signal, shutil
>+import base64, pdb, copy, types
>+from optparse import OptionParser
>+
>+import ldap, traceback
>+import univention
>+import univention.connector
>+import univention.connector.ad
>+import univention.uldap
>+import univention.admin.uldap
>+import univention.admin.modules
>+import univention.admin.objects
>+import univention.debug2 as ud
>+import univention.admin.uexceptions
>+
>+from univention.connector.ad import ad
>+
>+import univention_baseconfig
>+
>+from ldap.controls import LDAPControl
>+
>+# parse commandline options
>+
>+parser = OptionParser()
>+parser.add_option("--configbasename", dest="configbasename",
>+                  help="", metavar="CONFIGBASENAME", default="connector")
>+(options, args) = parser.parse_args()
>+
>+CONFIGBASENAME = "connector"
>+if options.configbasename:
>+	CONFIGBASENAME = options.configbasename
>+STATUSLOGFILE = "/var/log/univention/%s-status.log" % CONFIGBASENAME
>+
>+sys.path=['/etc/univention/%s/ad/' % CONFIGBASENAME]+sys.path
>+
>+import mapping
>+
>+def daemon():
>+	try:
>+		pid = os.fork()
>+	except OSError, e:
>+		print 'Daemon Mode Error: %s' % e.strerror
>+
>+	if (pid == 0):
>+		os.setsid()
>+		signal.signal(signal.SIGHUP, signal.SIG_IGN)
>+		try:
>+			pid = os.fork()
>+		except OSError, e:
>+			print 'Daemon Mode Error: %s' % e.strerror
>+		if (pid == 0):
>+			os.chdir("/")
>+			os.umask(0)
>+		else:
>+			pf=open('/var/run/univention-ad-%s' % CONFIGBASENAME, 'w+')
>+			pf.write(str(pid))
>+			pf.close()
>+			os._exit(0)
>+	else:
>+		os._exit(0)
>+
>+	try:
>+		maxfd = os.sysconf("SC_OPEN_MAX")
>+	except (AttributeError, ValueError):
>+		maxfd = 256       # default maximum
>+
>+	for fd in range(0, maxfd):
>+		try:
>+			os.close(fd)
>+		except OSError:   # ERROR (ignore)
>+			pass
>+
>+	os.open("/dev/null", os.O_RDONLY)
>+	os.open("/dev/null", os.O_RDWR)
>+	os.open("/dev/null", os.O_RDWR)
>+
>+
>+def connect():
>+
>+	daemon()
>+
>+	f=open(STATUSLOGFILE, 'w+')
>+	sys.stdout=f
>+	print time.ctime()
>+
>+	baseConfig=univention_baseconfig.baseConfig()
>+	baseConfig.load()
>+
>+	if not baseConfig.has_key('%s/ad/ldap/host' % CONFIGBASENAME):
>+		print '%s/ad/ldap/host not set' % CONFIGBASENAME
>+		f.close()
>+		sys.exit(1)
>+	if not baseConfig.has_key('%s/ad/ldap/port' % CONFIGBASENAME):
>+		print '%s/ad/ldap/port not set' % CONFIGBASENAME
>+		f.close()
>+		sys.exit(1)
>+	if not baseConfig.has_key('%s/ad/ldap/base' % CONFIGBASENAME):
>+		print '%s/ad/ldap/base not set' % CONFIGBASENAME
>+		f.close()
>+		sys.exit(1)
>+	if not baseConfig.has_key('%s/ad/ldap/binddn' % CONFIGBASENAME):
>+		print '%s/ad/ldap/binddn not set' % CONFIGBASENAME
>+		f.close()
>+		sys.exit(1)
>+	if not baseConfig.has_key('%s/ad/ldap/bindpw' % CONFIGBASENAME):
>+		print '%s/ad/ldap/bindpw not set' % CONFIGBASENAME
>+		f.close()
>+		sys.exit(1)
>+
>+	if not baseConfig.has_key('%s/ad/ldap/certificate' % CONFIGBASENAME) and not (baseConfig.has_key('%s/ad/ldap/ssl' % CONFIGBASENAME) and baseConfig['%s/ad/ldap/ssl' % CONFIGBASENAME] == 'no') :
>+		print '%s/ad/ldap/certificate not set' % CONFIGBASENAME
>+		f.close()
>+		sys.exit(1)
>+
>+	if baseConfig.is_true('%s/ad/ldap/ssl' % CONFIGBASENAME, True) or baseConfig.is_true('%s/ad/ldap/ldaps' % CONFIGBASENAME, False):
>+		# create a new CAcert file, which contains the UCS CA and the AD CA,
>+		# see Bug #17768 for details
>+		#  https://forge.univention.org/bugzilla/show_bug.cgi?id=17768
>+		new_ca_filename = '/var/cache/univention-ad-connector/CAcert-%s.pem' % CONFIGBASENAME
>+		new_ca = open(new_ca_filename, 'w')
>+
>+		ca = open('/etc/univention/ssl/ucsCA/CAcert.pem', 'r')
>+		new_ca.write(string.join(ca.readlines(),''))
>+		ca.close()
>+
>+		ca = open(baseConfig['%s/ad/ldap/certificate' % CONFIGBASENAME])
>+		new_ca.write(string.join(ca.readlines(),''))
>+		ca.close()
>+
>+		new_ca.close()
>+		
>+		ldap.set_option( ldap.OPT_X_TLS_CACERTFILE, new_ca_filename )
>+	
>+
>+	if not baseConfig.has_key('%s/ad/listener/dir' % CONFIGBASENAME):
>+		print '%s/ad/listener/dir not set' % CONFIGBASENAME
>+		f.close()
>+		sys.exit(1)
>+
>+	if not baseConfig.has_key('%s/ad/retryrejected' % CONFIGBASENAME):
>+		baseconfig_retry_rejected=10
>+	else:
>+		baseconfig_retry_rejected=baseConfig['%s/ad/retryrejected' % CONFIGBASENAME]
>+
>+	ad_ldap_bindpw=open(baseConfig['%s/ad/ldap/bindpw' % CONFIGBASENAME]).read()
>+	if ad_ldap_bindpw[-1] == '\n':
>+		ad_ldap_bindpw=ad_ldap_bindpw[0:-1]
>+	
>+	poll_sleep=int(baseConfig['%s/ad/poll/sleep' % CONFIGBASENAME])
>+	ad_init=None
>+	while not ad_init:
>+		try:
>+			ad_pwd=adpwd(	CONFIGBASENAME,
>+						mapping.ad_mapping,
>+						baseConfig,
>+						baseConfig['%s/ad/ldap/host' % CONFIGBASENAME],
>+						baseConfig['%s/ad/ldap/port' % CONFIGBASENAME],
>+						baseConfig['%s/ad/ldap/base' % CONFIGBASENAME],
>+						baseConfig['%s/ad/ldap/binddn' % CONFIGBASENAME],
>+						ad_ldap_bindpw,
>+						baseConfig['%s/ad/ldap/certificate' % CONFIGBASENAME],
>+						baseConfig['%s/ad/listener/dir' % CONFIGBASENAME])
>+			ad_init=True
>+		except ldap.SERVER_DOWN:
>+			print "Warning: Can't initialize LDAP-Connections, wait..."
>+			sys.stdout.flush()
>+			time.sleep(poll_sleep)
>+			pass
>+
>+
>+	ad_init=None
>+
>+	while not ad_init:
>+		try:
>+			ad_pwd.initialize()
>+			ad_init=True
>+		except ldap.SERVER_DOWN:
>+			time.sleep(poll_sleep)
>+			pass
>+
>+	f.close()
>+	retry_rejected=0
>+	connected = True
>+	while connected:
>+		f=open(STATUSLOGFILE, 'w+')
>+		sys.stdout=f
>+		print time.ctime()
>+		# Poll for changes
>+		change_counter=1
>+		while change_counter != 0:
>+			sys.stdout.flush()
>+			try:
>+				change_counter=ad_pwd.poll()
>+			except ldap.SERVER_DOWN:
>+				print "Can't contact LDAP server during ad-poll, sync not possible."
>+				connected = False
>+ 				sys.stdout.flush()
>+				time.sleep(poll_sleep)
>+
>+			if change_counter > 0:
>+				retry_rejected=0
>+
>+		if str(retry_rejected) == baseconfig_retry_rejected:
>+			ad_pwd.ad.resync_rejected()
>+			retry_rejected=0
>+		else:
>+			retry_rejected+=1
>+
>+		print '- sleep %s seconds (%s/%s until resync) -'%(poll_sleep, retry_rejected, baseconfig_retry_rejected)
>+		sys.stdout.flush()
>+		time.sleep(poll_sleep)
>+		f.close()
>+	ad_pwd.ad.close_debug()
>+
>+class adpwd:
>+	def __init__(self, CONFIGBASENAME, property, baseConfig, ad_ldap_host, ad_ldap_port, ad_ldap_base, ad_ldap_binddn, ad_ldap_bindpw, ad_ldap_certificate, listener_dir):
>+		self.ad = ad(CONFIGBASENAME, property, baseConfig, ad_ldap_host, ad_ldap_port, ad_ldap_base, ad_ldap_binddn, ad_ldap_bindpw, ad_ldap_certificate, listener_dir)
>+
>+		bindpw=open('/etc/ldap.secret').read()
>+		if bindpw[-1] == '\n':
>+			bindpw=bindpw[0:-1]
>+
>+		self.ad.lo=univention.admin.uldap.access(host=baseConfig['ldap/master'], base=baseConfig['ldap/base'], binddn='cn=admin,'+baseConfig['ldap/base'], bindpw=bindpw, start_tls=2)
>+
>+		# load UCS Modules
>+		self.ad.modules={}
>+		for key in self.ad.property.keys():
>+			if self.ad.property[key].ucs_module:
>+				self.ad.modules[key]=univention.admin.modules.get(self.ad.property[key].ucs_module)
>+			else:
>+				self.ad.modules[key]=None
>+
>+	def initialize(self):
>+		_d=ud.function('ldap.initialize')
>+
>+
>+		print "--------------------------------------"
>+		print "Initialize sync from AD"
>+		self.ad.resync_rejected()
>+		if self.ad._get_lastUSN() == 0: # we startup new
>+			ud.debug(ud.LDAP, ud.INFO, "initialize AD: last USN is 0, sync all")
>+			# query highest USN in LDAP
>+			highestCommittedUSN = self.ad._ad__get_highestCommittedUSN()
>+
>+			# poll for all objects without deleted objects
>+			polled=self.poll(show_deleted=False)
>+
>+			# compare highest USN from poll with highest before poll, if the last changes deletes
>+			# the highest USN from poll is to low
>+			self.ad._set_lastUSN(max(highestCommittedUSN,self._get_lastUSN()))
>+			ud.debug(ud.LDAP, ud.INFO, "initialize AD: sync of all objects finished, lastUSN is %d", self.ad._ad__get_highestCommittedUSN())
>+		else:
>+			polled=self.poll()		
>+		print "--------------------------------------"
>+
>+	def poll(self, show_deleted=True):
>+		'''
>+		poll for changes in AD
>+		'''
>+		_d=ud.function('ldap.poll')
>+		# search from last_usn for changes
>+		change_count = 0
>+		changes = []
>+		try:
>+			# call private methode
>+			changes = self.ad._ad__search_ad_changes(show_deleted=show_deleted)
>+		except (ldap.SERVER_DOWN, SystemExit):
>+			raise		
>+		except: # FIXME: which exception is to be caught?
>+			self._debug_traceback(ud.WARN,"Exception during search_ad_changes")
>+
>+		print "--------------------------------------"
>+		print "try to sync %s changes from AD" % len(changes)
>+		print "done:",
>+		sys.stdout.flush()
>+		done_counter = 0
>+		object = None
>+
>+		for element in changes:
>+			try:
>+				if element[0] == 'None': # referrals
>+					continue
>+				old_element = copy.deepcopy(element)
>+				object = self.ad._ad__object_from_element(element)
>+			except: # FIXME: which exception is to be caught?
>+				#ud.debug(ud.LDAP, ud.ERROR, "Exception during poll/object-mapping, tried to map element: %s" % old_element[0])
>+				#ud.debug(ud.LDAP, ud.ERROR, "This object will not be synced again!")
>+				# debug-trace may lead to a segfault here :(
>+				self._debug_traceback(ud.ERROR,"Exception during poll/object-mapping, object will not be synced again!")
>+				
>+			if object:
>+				property_key = self.ad._ad__identify(object)
>+				if property_key:
>+					
>+					if self.ad._ignore_object(property_key,object):
>+						# call private methode
>+						self.ad._ad__update_lastUSN(object)
>+						done_counter += 1
>+						print "%s"%done_counter,
>+						continue
>+
>+					sync_successfull = False
>+					try:
>+						ud.debug(ud.LDAP, ud.INFO, "Sync object (%s) property_key: %s" % (object['dn'], property_key))
>+						if property_key == 'user' and object['modtype'] == 'modify':
>+							if not self.ad._ignore_object(property_key,object):
>+								property_ucs = self.ad._ad__identify(object)
>+								object_ucs = self.ad._object_mapping(property_key,object)
>+
>+								try:
>+									univention.connector.ad.password.password_sync(self.ad, property_key, object_ucs)
>+								except univention.admin.uexceptions.noObject:
>+									# This is possible if the user does not exist in UCS (the main AD connector is in write mode)
>+									ud.debug(ud.LDAP, ud.INFO, "Object (%s) was not found in UCS (ignore)" % (object['dn']))
>+									pass
>+								sync_successfull = True
>+							else:
>+								sync_successfull = True
>+						else:
>+							sync_successfull = True
>+					except (ldap.SERVER_DOWN, SystemExit):
>+						raise
>+					except univention.admin.uexceptions.ldapError, msg:
>+						ud.debug(ud.LDAP, ud.INFO, "Exception during poll with message (1) %s"%msg)
>+						if msg == "Can't contact LDAP server":
>+							raise ldap.SERVER_DOWN
>+						else:
>+							self._debug_traceback(ud.WARN,"Exception during poll/sync_to_ucs")
>+					except univention.admin.uexceptions.ldapError, msg:
>+						ud.debug(ud.LDAP, ud.INFO, "Exception during poll with message (2) %s"%msg)
>+						if msg == "Can't contact LDAP server":
>+							raise ldap.SERVER_DOWN
>+						else:
>+							self._debug_traceback(ud.WARN,"Exception during poll")
>+					except: # FIXME: which exception is to be caught?
>+						self.ad._debug_traceback(ud.WARN, "Exception during poll/sync_to_ucs")
>+
>+
>+
>+					if not sync_successfull:
>+						ud.debug(ud.LDAP, ud.WARN,
>+											   "sync to ucs was not successfull, save rejected")
>+						ud.debug(ud.LDAP, ud.WARN,
>+											   "object was: %s"%object['dn'])
>+
>+					if sync_successfull:
>+						change_count+=1
>+						# call private methode
>+						self.ad._ad__update_lastUSN(object)
>+						try:
>+							GUID = old_element[1]['objectGUID'][0]
>+							self.ad._set_DN_for_GUID(GUID,old_element[0])
>+						except (ldap.SERVER_DOWN, SystemExit):
>+							raise
>+						except: # FIXME: which exception is to be caught?
>+							self._debug_traceback(ud.WARN,
>+									      "Exception during set_DN_for_GUID")
>+
>+					else:
>+						self.ad.save_rejected(object)
>+				else:
>+					# call private methode
>+					self.ad._ad__update_lastUSN(object)
>+
>+				done_counter += 1
>+				print "%s"%done_counter,
>+			else:
>+				done_counter += 1
>+				print "(%s)"%done_counter,
>+			sys.stdout.flush()
>+				
>+		print ""
>+
>+		# return number of synced objects
>+		rejected = self.ad._list_rejected()
>+		if rejected:
>+			print "Changes from AD:  %s (%s saved rejected)" % (change_count, len(rejected))
>+		else:
>+			print "Changes from AD:  %s (%s saved rejected)" % (change_count, '0')
>+		print "--------------------------------------"
>+		sys.stdout.flush()
>+		return change_count
>+
>+
>+def main():
>+	while True:
>+		try:
>+			connect()
>+		except SystemExit:
>+			raise
>+		except:
>+			f=open(STATUSLOGFILE, 'w+')
>+			sys.stdout=f
>+			print time.ctime()
>+			
>+			text = ''
>+			exc_info = sys.exc_info()
>+			lines = apply(traceback.format_exception, exc_info)
>+			text = text + '\n'
>+			for line in lines:
>+				text += line
>+			print " --- connect failed, failure was: ---"
>+			print text
>+			print " ---     retry in 30 seconds      ---"
>+			sys.stdout.flush()
>+			time.sleep(30)
>+
>+			f.close()
>+
>+
>+if __name__ == "__main__":
>+	main()
>+

Actions: View | Diff

Attachments on bug 22653: 4053