Index: doc/manual/import-hooks-de.xml =================================================================== --- doc/manual/import-hooks-de.xml (Revision 74005) +++ doc/manual/import-hooks-de.xml (Arbeitskopie) @@ -116,12 +116,20 @@ zugeordnet wird. - Über drei weitere &ucsUCR;-Variablen kann das Verhalten des Hooks gesteuert + Über vier weitere &ucsUCR;-Variablen kann das Verhalten des Hooks gesteuert werden: + ucsschool/import/generate/share/marktplatz/name + + + Diese Variable definiert den Namen der Freigabe. Der Standard ist Marktplatz. + + + + ucsschool/import/generate/share/marktplatz/sharepath Index: doc/manual/performance-de.xml =================================================================== --- doc/manual/performance-de.xml (Revision 74005) +++ doc/manual/performance-de.xml (Arbeitskopie) @@ -93,6 +93,10 @@ + + Der Teil des Gruppennamens der hier <Edukativnetz> ist, kann seit &ucsUAS;-Version 4.1 R2 v7 + verändert werden. Siehe dazu auch . + Index: doc/manual/setup-school-generic-de.xml =================================================================== --- doc/manual/setup-school-generic-de.xml (Revision 74005) +++ doc/manual/setup-school-generic-de.xml (Arbeitskopie) @@ -39,14 +39,13 @@ Zugriffsrechte gesetzt werden. Dabei kann der Zugriff für einzelne Benutzer oder ganze Gruppen erlaubt bzw. gesperrt werden. Um den Schülern den Zugriff auf die physikalischen Drucker zu verbieten, muss an den Druckerfreigaben für diese Drucker der Zugriff durch Benutzer der - OU-spezifischen Gruppe - schueler- - OU - - > (z.B. schueler-gsmitte) - verboten werden. Für den PDF-Drucker PDFDrucker sollten keine - Einschränkungen - gemacht werden. + OU-spezifischen Gruppe schueler-OU + (z.B. schueler-gsmitte) verboten werden. Für den PDF-Drucker + PDFDrucker sollten keine Einschränkungen gemacht werden. + + Der Teil des Gruppennamens der hier <schueler-> ist, kann seit &ucsUAS;-Version 4.1 R2 v7 verändert + werden. Siehe dazu auch . + Schüler haben damit nur noch die Möglichkeit Druckaufträge an den @@ -228,6 +227,9 @@ Anlegen einer OU kann durch das Setzen der &ucsUCRV; ucsschool/import/generate/marktplatz auf den Wert no verhindert werden. + + Weiterführnde Informationen zur Marktplatz-Freigabe finden sich unter . + Diese Freigaben müssen zwingend auf dem Schulserver bereitgestellt @@ -280,6 +282,10 @@ Die Freigabe erlaubt der Gruppe lehrer-<OU> den administrativen Zugriff auf das Basisverzeichnis /home/<OU>/schueler. + + Der Teil des Gruppennamens der hier <schueler-> bzw.<lehrer-> ist, kann seit + &ucsUAS;-Version 4.1 R2 v7 verändert werden. Siehe dazu auch . + Per Voreinstellung wird der Lehrergruppe Lesezugriff gewährt. @@ -310,23 +316,23 @@ Option zu Schuladministratoren umgewandelt werden. - + Die zusätzliche Gruppenmitgliedschaft muss manuell über das &ucsUMC;-Modul - Benutzer - auf dem &ucsMaster; hinzugefügt werden. Auf dem Reiter - Gruppen - muss das Benutzerkonto in die Gruppe + Benutzer auf dem &ucsMaster; hinzugefügt werden. Auf dem Reiter + Gruppen muss das Benutzerkonto in die Gruppe admins-OU (für die OU gym17 ist dies die Gruppe admins-gym17) aufgenommen werden. - + + Der Teil des Gruppennamens der hier <admins-> ist, kann seit &ucsUAS;-Version 4.1 R2 v7 + verändert werden. Siehe dazu auch . + + Im &ucsUMC;-Modul Benutzer muss außerdem im Reiter - Optionen - die Option - + Optionen die Option eingeschaltet werden. Index: doc/manual/structure-de.xml =================================================================== --- doc/manual/structure-de.xml (Revision 74005) +++ doc/manual/structure-de.xml (Arbeitskopie) @@ -329,6 +329,84 @@ +
+ Gruppen-, Verzeichnis- und Containernamen + + Seit &ucsUAS;-Version 4.1 R2 v7 können mit Hilfe von UCR-Variablen Teile der Gruppen-, Verzeichnis- und Containernamen + vor der Installation der &ucsUAS;-App bestimmt werden. + + + Beispielsweise wird die Gruppe Member-Edukativnetz durch Setzen + der UCR-Variablen ucsschool/ldap/default/groupname/all-educational-member=Membre-Enseignement + mit dem Namen Membre-Enseignement angelegt. + + + Sollen zum Beispiel die Benutzerkonten von Schülern nicht im Container + cn=schueler,cn=groups,ou=gymmitte,dc=example,dc=com gespeichert werden, sondern unter + cn=ecolier,cn=groups,ou=gymmitte,dc=example,dc=com, muss + ucsschool/ldap/default/container/pupils=ecolier gesetzt werden. + + + Die Bedeutung der aller UCR-Variablen können Sie durch das Lesen der Hilfetexte zu den UCR-Variablen erfahren + (siehe ). + + + + Die folgenden Teile von Containernamen (z.B. in cn=admins,cn=groups,ou=gymmitte,dc=example,dc=com) können gesetzt werden: + + + admins: ucsschool/ldap/default/container/admins + schueler: ucsschool/ldap/default/container/pupils + mitarbeiter: ucsschool/ldap/default/container/staff + lehrer und mitarbeiter: ucsschool/ldap/default/container/teachers-and-staff + lehrer: ucsschool/ldap/default/container/teachers + klassen: ucsschool/ldap/default/container/class + raeume: ucsschool/ldap/default/container/rooms + examusers: ucsschool/ldap/default/container/exam + + + + + Die folgenden Präfixe von Gruppennamen (z.B. in schueler-gymmitte) können gesetzt werden: + + + schueler-: ucsschool/ldap/default/groupprefix/pupils + lehrer-: ucsschool/ldap/default/groupprefix/teachers + admins-: ucsschool/ldap/default/groupprefix/admins + mitarbeiter-: ucsschool/ldap/default/groupprefix/staff + + + Die folgenden Gruppennamen können per UCR gesetzt werden. Bei Namen die %(ou)s enthalten + wird dieses vom System durch das jeweilige Schulkürzel ersetzt (z.B. gymmitte in + OUgymmitte-DC-Edukativnetz). + + + DC-Edukativnetz: ucsschool/ldap/default/groupname/all-educational-dc + Member-Edukativnetz: ucsschool/ldap/default/groupname/all-educational-member + DC-Verwaltungsnetz: ucsschool/ldap/default/groupname/all-administrativ-dc + Member-Verwaltungsnetz: ucsschool/ldap/default/groupname/all-administrativ-member + OU%(ou)s-DC-Edukativnetz: ucsschool/ldap/default/groupname/ou-educational-dc + OU%(ou)s-Member-Edukativnetz: ucsschool/ldap/default/groupname/ou-educational-member + OU%(ou)s-DC-Verwaltungsnetz: ucsschool/ldap/default/groupname/ou-administrativ-dc + OU%(ou)s-Member-Verwaltungsnetz: ucsschool/ldap/default/groupname/ou-administrativ-member + OU%(ou)s-Klassenarbeit: ucsschool/ldap/default/groupname/exam + + + Die folgenden Verzeichnisnamen können per UCR gesetzt werden (z.B. klassen in /home/groups/klassen/3b): + + + klassen: ucsschool/ldap/default/share/class + schueler: ucsschool/ldap/default/share/pupils + lehrer: ucsschool/ldap/default/share/teachers + Unterrichtsmaterial: ucsschool/datadistribution/datadir/sender + Unterrichtsmaterial: ucsschool/datadistribution/datadir/recipient + Klassenarbeiten: ucsschool/ldap/default/share/exams + schueler, lehrer, mitarbeiter: ucsschool/import/roleshare/.*/path + Marktplatz: ucsschool/import/generate/share/marktplatz/name + + +
+
Weitere &ucsUAS;-Objekte Index: ucs-school-import/debian/ucs-school-import.univention-config-registry-variables =================================================================== --- ucs-school-import/debian/ucs-school-import.univention-config-registry-variables (Revision 74005) +++ ucs-school-import/debian/ucs-school-import.univention-config-registry-variables (Arbeitskopie) @@ -4,54 +4,150 @@ Type=str Categories=ucsschool-base +[ucsschool/ldap/default/container/admins] +Description[de]=Standard-Container-Name für Administratoren. Standard ist "admins". +Description[en]=Default container name for administrators. Default is "admins". +Type=str +Categories=ucsschool-base + +[ucsschool/ldap/default/container/class] +Description[de]=Standard-Container-Name für Schulklassen. Standard ist "klassen". +Description[en]=Default container name for school classes. Default is "klassen". +Type=str +Categories=ucsschool-base + +[ucsschool/ldap/default/container/exam] +Description[de]=Standard-Container-Name für Schüler in einer Prüfung. Standard ist "examusers". +Description[en]=Default container name name for pupils writing exams. Default is "examusers". +Type=str +Categories=ucsschool-base + [ucsschool/ldap/default/container/pupils] -Description[de]=Standard-Container für Schüler -Description[en]=Default container for pupils +Description[de]=Standard-Container-Name für Schüler. Standard ist "schueler". +Description[en]=Default container name for pupils. Default is "schueler". Type=str Categories=ucsschool-base +[ucsschool/ldap/default/container/rooms] +Description[de]=Standard-Container-Name für Klassenräume. Standard ist "raeume". +Description[en]=Default container name for class rooms. Default is "raeume". +Type=str +Categories=ucsschool-base + +[ucsschool/ldap/default/container/staff] +Description[de]=Standard-Container-Name für Mitarbeiter. Standard ist "mitarbeiter". +Description[en]=Default container name for staff members. Default is "mitarbeiter". +Type=str +Categories=ucsschool-base + [ucsschool/ldap/default/container/teachers] -Description[de]=Standard-Container für Lehrer -Description[en]=Default container for teachers +Description[de]=Standard-Container-Name für Lehrer. Standard ist "lehrer". +Description[en]=Default container name for teachers. Default is "lehrer". Type=str Categories=ucsschool-base -[ucsschool/ldap/default/container/admins] -Description[de]=Standard-Container für Administratoren -Description[en]=Default container for administrators +[ucsschool/ldap/default/container/teachers-and-staff] +Description[de]=Standard-Container-Name für Benutzer die gleichzeitig Lehrer und Mitarbeiter sind. Standard ist "lehrer und mitarbeiter". +Description[en]=Default container name for users that are both teachers and staff members. Default is "lehrer und mitarbeiter". Type=str Categories=ucsschool-base -[ucsschool/ldap/default/container/staff] -Description[de]=Standard-Container für Mitarbeiter -Description[en]=Default container for staff members +[ucsschool/ldap/default/groupname/exam] +Description[de]=Standard Gruppenname für Schüler in einer Prüfung. Das "%(ou)s" im Namen wird mit dem Schulkürzel (OU) ersetzt. Standard ist "OU%(ou)s-Klassenarbeit". +Description[en]=Default group name for pupils writing exams. The "%(ou)s" in the name will be replaced by the short name of the school (OU). Default is "OU%(ou)s-Klassenarbeit". Type=str Categories=ucsschool-base -[ucsschool/ldap/default/groupprefix/pupils] -Description[de]=Standard-Prefix für die Schüler-Gruppen -Description[en]=Default prefix for pupils groups +[ucsschool/ldap/default/groupname/all-administrativ-dc] +Description[de]=Standard Gruppenname für Domain Controller in Verwaltungsnetzen. Standard ist "DC-Verwaltungsnetz". +Description[en]=Default group name for domain controllers in administrativ networks. Default is "DC-Verwaltungsnetz". Type=str Categories=ucsschool-base -[ucsschool/ldap/default/groupprefix/teachers] -Description[de]=Standard-Prefix für die Lehrer-Gruppen -Description[en]=Default prefix for teacher groups +[ucsschool/ldap/default/groupname/all-administrativ-member] +Description[de]=Standard Gruppenname für Member Server in Verwaltungsnetzen. Standard ist "Member-Verwaltungsnetz". +Description[en]=Default group name for member servers in administrativ networks. Default is "Member-Verwaltungsnetz". Type=str Categories=ucsschool-base +[ucsschool/ldap/default/groupname/all-educational-dc] +Description[de]=Standard Gruppenname für Domain Controller in Edukativnetzen. Standard ist "DC-Edukativnetz". +Description[en]=Default group name for domain controllers in educational networks. Default is "DC-Edukativnetz". +Type=str +Categories=ucsschool-base + +[ucsschool/ldap/default/groupname/all-educational-member] +Description[de]=Standard Gruppenname für Member Server in Edukativnetzen. Standard ist "Member-Edukativnetz". +Description[en]=Default group name for member servers in educational networks. Default is "Member-Edukativnetz". +Type=str +Categories=ucsschool-base + +[ucsschool/ldap/default/groupname/ou-administrativ-dc] +Description[de]=Standard Gruppenname für Domain Controller im Verwaltungsnetz einer bestimmten Schule. Das "%(ou)s" im Namen wird mit dem Schulkürzel (OU) ersetzt. Standard ist "OU%(ou)s-DC-Verwaltungsnetz". +Description[en]=Default group name for domain controllers in the administrativ network. The "%(ou)s" in the name will be replaced by the short name of the school (OU). Default is "OU%(ou)s-DC-Verwaltungsnetz". +Type=str +Categories=ucsschool-base + +[ucsschool/ldap/default/groupname/ou-administrativ-member] +Description[de]=Standard Gruppenname für Member Server im Verwaltungsnetz einer bestimmten Schule. Das "%(ou)s" im Namen wird mit dem Schulkürzel (OU) ersetzt. Standard ist "OU%(ou)s-Member-Verwaltungsnetz". +Description[en]=Default group name for member servers in the administrativ network. The "%(ou)s" in the name will be replaced by the short name of the school (OU). Default is "OU%(ou)s-Member-Verwaltungsnetz". +Type=str +Categories=ucsschool-base + +[ucsschool/ldap/default/groupname/ou-educational-dc] +Description[de]=Standard Gruppenname für Domain Controller im Edukativnetz einer bestimmten Schule. Das "%(ou)s" im Namen wird mit dem Schulkürzel (OU) ersetzt. Standard ist "OU%(ou)s-DC-Edukativnetz". +Description[en]=Default group name for domain controllers in the educational network. The "%(ou)s" in the name will be replaced by the short name of the school (OU). Default is "OU%(ou)s-DC-Edukativnetz". +Type=str +Categories=ucsschool-base + +[ucsschool/ldap/default/groupname/ou-educational-member] +Description[de]=Standard Gruppenname für Member Server im Edukativnetz einer bestimmten Schule. Das "%(ou)s" im Namen wird mit dem Schulkürzel (OU) ersetzt. Standard ist "OU%(ou)s-Member-Edukativnetz". +Description[en]=Default group name for member servers in the educational network. The "%(ou)s" in the name will be replaced by the short name of the school (OU). Default is "OU%(ou)s-Member-Edukativnetz". +Type=str +Categories=ucsschool-base + [ucsschool/ldap/default/groupprefix/admins] -Description[de]=Standard-Prefix für die Administrator-Gruppen -Description[en]=Default prefix for admin groups +Description[de]=Standard-Prefix für die Administrator-Gruppen. Standard ist "admins-". +Description[en]=Default prefix for admin groups. Default is "admins-". Type=str Categories=ucsschool-base +[ucsschool/ldap/default/groupprefix/pupils] +Description[de]=Standard-Prefix für die Schüler-Gruppen. Standard ist "schueler-". +Description[en]=Default prefix for pupils groups. Default is "schueler-". +Type=str +Categories=ucsschool-base + [ucsschool/ldap/default/groupprefix/staff] -Description[de]=Standard-Prefix für die Mitarbeiter-Gruppen -Description[en]=Default prefix for staff groups +Description[de]=Standard-Prefix für die Mitarbeiter-Gruppen. Standard ist "mitarbeiter-". +Description[en]=Default prefix for staff groups. Default is "mitarbeiter-". Type=str Categories=ucsschool-base +[ucsschool/ldap/default/groupprefix/teachers] +Description[de]=Standard-Prefix für die Lehrer-Gruppen. Standard ist "lehrer-". +Description[en]=Default prefix for teacher groups. Default is "lehrer-". +Type=str +Categories=ucsschool-base + +[ucsschool/ldap/default/share/class] +Description[de]=Standard Verzeichnisname für die Klassen-Freigabe. Standard ist "klassen". +Description[en]=Default directory name for the class share. Default is "klassen". +Type=str +Categories=ucsschool-base + +[ucsschool/ldap/default/share/pupils] +Description[de]=Standard Verzeichnisname für die Schüler-Verzeichnisse. Standard ist "schueler". +Description[en]=Default directory name for the pupils directories. Default is "schueler". +Type=str +Categories=ucsschool-base + +[ucsschool/ldap/default/share/teachers] +Description[de]=Standard Verzeichnisname für die Lehrer-Verzeichnisse. Standard ist "lehrer". +Description[en]=Default directory name for the teachers directories. Default is "lehrer". +Type=str +Categories=ucsschool-base + [ucsschool/ldap/default/dcs] Description[de]=Spezifiziert welche Schul-DCs beim Erzeugen einer Schule angelegt werden sollen (Werte: edukativ und/oder verwaltung) Description[en]=Specifies which school DCs are created during the school set up (values: edukativ and/or verwaltung) @@ -64,6 +160,12 @@ Type=str Categories=ucsschool-base +[ucsschool/import/generate/share/marktplatz/name] +Description[de]=Name der Freigabe (Default: "Marktplatz"). +Description[en]=Name of share (default: "Marktplatz"). +Type=str +Categories=ucsschool-base + [ucsschool/import/generate/share/marktplatz/sharepath] Description[de]=Vorgabepfad der Freigabe "Marktplatz" (Default: /home/$ou/groups/Marktplatz) Description[en]=Default path of share "Marktplatz" (default: /home/$ou/groups/Marktplatz) @@ -125,7 +227,7 @@ Categories=ucsschool-base [ucsschool/import/roleshare] -Description[de]=Falls diese Variable nicht auf "false" oder "no" gesetzt, dann werden Homeverzeichnisse für Benutzer und Klassengruppen in einer rollen- und schulspezifischen Struktur von Unterverzeichnissen angelegt, z.B. unter /home/$ou/schueler/. +Description[de]=Falls diese Variable nicht auf "false" oder "no" gesetzt wird, werden Homeverzeichnisse für Benutzer und Klassengruppen in einer rollen- und schulspezifischen Struktur von Unterverzeichnissen angelegt, z.B. unter /home/$ou/schueler/. Description[en]=If this variable is not set to "false" or "no", then home directories for users and class groups will be created in a role and school specific structure of subdirectories, e.g. in /home/$ou/schueler/. Type=str Categories=ucsschool-base Index: ucs-school-import/modules/ucsschool/importer/models/import_user.py =================================================================== --- ucs-school-import/modules/ucsschool/importer/models/import_user.py (Revision 74005) +++ ucs-school-import/modules/ucsschool/importer/models/import_user.py (Arbeitskopie) @@ -94,7 +94,7 @@ self.config = Configuration() self.reader = self.factory.make_reader() self.logger = get_logger() - self.username_max_length = 20 - len(self.ucr.get("ucsschool/ldap/default/userprefix/exam", "exam-")) + self.username_max_length = 20 - len(Student.get_search_base(school).user_prefix_exam) self._lo = None self._userexpiry = None super(ImportUser, self).__init__(name, school, **kwargs) Index: ucs-school-import/tests/test_move_domaincontroller_to_ou =================================================================== --- ucs-school-import/tests/test_move_domaincontroller_to_ou (Revision 74005) +++ ucs-school-import/tests/test_move_domaincontroller_to_ou (Arbeitskopie) @@ -37,6 +37,8 @@ exit 1 fi +. /usr/share/ucs-school-lib/base.sh + eval "$(ucr shell)" ./create_ou test1 dctest1 @@ -51,8 +53,10 @@ udm computers/domaincontroller_slave create --position "cn=computers,$ldap_base" --set name=dctest7-01 ./create_ou test7 -udm computers/domaincontroller_slave modify --dn "cn=dctest7-01,cn=computers,$ldap_base" --append groups="cn=OUtest7-DC-Edukativnetz,cn=ucsschool,cn=groups,$ldap_base" +test7_dc="$(ucr_names_default ucsschool/ldap/default/groupname/ou-educational-dc test7)" +udm computers/domaincontroller_slave modify --dn "cn=dctest7-01,cn=computers,$ldap_base" --append groups="cn=$test7_dc,cn=ucsschool,cn=groups,$ldap_base" + echo "TEST: DC is unknown" ./move_domaincontroller_to_ou --dcname UnKnOwN --ou test1 echo "EXITCODE: $?" Index: ucs-school-import/usr/share/ucs-school-import/hooks/ou_create_post.d/52marktplatz_create =================================================================== --- ucs-school-import/usr/share/ucs-school-import/hooks/ou_create_post.d/52marktplatz_create (Revision 74005) +++ ucs-school-import/usr/share/ucs-school-import/hooks/ou_create_post.d/52marktplatz_create (Arbeitskopie) @@ -1,7 +1,7 @@ #!/bin/bash # # 52marktplatz_create -# Creates a Markplatz share for the specified OUs +# Creates a Marktplatz share for the specified OUs # # Depends: ucs-school-import # @@ -35,11 +35,14 @@ [ $# -ne 2 ] && echo "USAGE: $(basename $0) FILE DN" && exit 1 . /usr/share/univention-lib/ucr.sh +. /usr/share/ucs-school-lib/base.sh eval "$(ucr shell)" +name="$(ucr_names_default ucsschool/import/generate/share/marktplatz/name)" + if ! is_ucr_true "ucsschool/import/generate/share/marktplatz" ; then - echo "$(basename $0): creation of share 'Marktplatz' has been disabled by ucsschool/import/generate/share/marktplatz" + echo "$(basename $0): creation of share '$name' has been disabled by ucsschool/import/generate/share/marktplatz" exit 0 fi @@ -58,9 +61,9 @@ sharepath="$ucsschool_import_generate_share_marktplatz_sharepath" if [ -z "$sharepath" ] ; then if [ -z "$ucsschool_import_roleshare" ] || is_ucr_true "ucsschool/import/roleshare"; then - sharepath="/home/$ou/groups/Marktplatz" + sharepath="/home/$ou/groups/$name" else - sharepath="/home/groups/Marktplatz" + sharepath="/home/groups/$name" fi fi @@ -77,12 +80,12 @@ udm shares/share create --ignore_exists \ --position "cn=shares,ou=${ou}${district},${ldap_base}" \ - --set name=Marktplatz \ + --set name="${name}" \ --set "host=${dcname}" \ --set "path=${sharepath}" \ --set "directorymode=${sharemode}" \ --set "group=${grpuidnumber}" -echo "$(basename $0): added new share Markplatz for server ${dcname}" +echo "$(basename $0): added new share '$name' for server ${dcname}" exit 0 Index: ucs-school-import/usr/share/ucs-school-import/scripts/ucs-school-import =================================================================== --- ucs-school-import/usr/share/ucs-school-import/scripts/ucs-school-import (Revision 74005) +++ ucs-school-import/usr/share/ucs-school-import/scripts/ucs-school-import (Arbeitskopie) @@ -77,8 +77,8 @@ import univention.lib.policy_result from ucsschool.lib.roles import role_pupil, role_teacher, role_staff from ucsschool.lib.roleshares import roleshare_home_subdir -from ucsschool.lib.models.utils import stopped_notifier, add_stream_logger_to_schoollib -from ucsschool.lib.models.utils import create_passwd +from ucsschool.lib.models.utils import stopped_notifier, add_stream_logger_to_schoollib, create_passwd +from ucsschool.lib.models import School, SchoolClass, ClassShare ldap_errors = (ldap.LDAPError, univention.admin.uexceptions.base,) @@ -106,17 +106,6 @@ pwLengthOu = {} -cn_pupils = configRegistry.get('ucsschool/ldap/default/container/pupils', 'schueler') -cn_teachers = configRegistry.get('ucsschool/ldap/default/container/teachers', 'lehrer') -cn_teachers_staff = configRegistry.get('ucsschool/ldap/default/container/teachers-and-staff', 'lehrer und mitarbeiter') -cn_admins = configRegistry.get('ucsschool/ldap/default/container/admins', 'admins') -cn_staff = configRegistry.get('ucsschool/ldap/default/container/staff', 'mitarbeiter') - -grp_prefix_pupils = configRegistry.get('ucsschool/ldap/default/groupprefix/pupils', 'schueler-') -grp_prefix_teachers = configRegistry.get('ucsschool/ldap/default/groupprefix/teachers', 'lehrer-') -grp_prefix_admins = configRegistry.get('ucsschool/ldap/default/groupprefix/admins', 'admins-') -grp_prefix_staff = configRegistry.get('ucsschool/ldap/default/groupprefix/staff', 'mitarbeiter-') - grp_policy_pupils = configRegistry.get('ucsschool/ldap/default/policy/umc/pupils', 'cn=ucsschool-umc-pupils-default,cn=UMC,cn=policies,%s' % baseDN) grp_policy_teachers = configRegistry.get('ucsschool/ldap/default/policy/umc/teachers', 'cn=ucsschool-umc-teachers-default,cn=UMC,cn=policies,%s' % baseDN) grp_policy_admins = configRegistry.get('ucsschool/ldap/default/policy/umc/admins', 'cn=ucsschool-umc-admins-default,cn=UMC,cn=policies,%s' % baseDN) @@ -134,10 +123,10 @@ TYPE_DC_EDUCATIONAL = 'educational' -# IP address prefix len conecerning the netmask +# IP address prefix len concerning the netmask default_prefixlen = 24 -if not (cn_pupils and cn_teachers and cn_teachers_staff and cn_admins and cn_staff): +if not (cn_pupils and cn_classes): print '''ERROR: Unable to proceed: one of the following UCR variables is not set correctly: ucsschool/ldap/default/container/pupils ucsschool/ldap/default/container/teachers @@ -265,6 +254,7 @@ else: self.allsNrs=[self.sNr] self.other_sNr=[] + self.search_base = School.get_search_base(self.allsNrs[0]) # split into multiple class number if comma is present if ',' in self.cNr: @@ -319,14 +309,13 @@ def getPosition_dn(self): # resolution order for the position is pupil, teacher, staff - cn = cn_pupils if role_teacher in self.getRole() and role_staff in self.getRole(): - cn = cn_teachers_staff + return self.search_base.teachersAndStaff elif role_teacher in self.getRole (): - cn = cn_teachers - elif role_staff in self.getRole (): - cn = cn_staff - return "cn=%s,cn=users,%s" % (cn, getDN (self.sNr)) + return self.search_base.teachers + elif role_staff in self.getRole(): + return self.search_base.staff + return self.search_base.students def getDN(self): return "uid="+self.login+","+self.getPosition_dn() @@ -335,19 +324,20 @@ default_groups=[] # default group - default_groups.append("cn=Domain Users "+self.sNr+",cn=groups,%s" % (getDN (self.sNr), )) + default_groups.append("cn=Domain Users %s,%s" % (self.sNr, self.search_base.groups)) - for role in self.getRole (): - user_grp_prefix = { role_teacher:grp_prefix_teachers, - role_pupil:grp_prefix_pupils, - role_staff:grp_prefix_staff }[role] + grp_dns = { + role_teacher: self.search_base.teachers_ou_group, + role_pupil: self.search_base.students_ou_group, + role_staff: self.search_base.staff_ou_group} + for role in self.getRole(): if role == role_staff and not configRegistry.is_true('ucsschool/ldap/noneducational/create/objects', True): continue # class if available for cnr in self.cNr: - default_groups.append("cn=" + cnr + ",cn=klassen,cn=%s,cn=groups,%s" % (cn_pupils, getDN (self.sNr))) + default_groups.append("cn=%s,%s" % (cnr, self.search_base.classes)) - default_groups.append("cn=%s%s,cn=groups,%s"%(user_grp_prefix, self.sNr, getDN (self.sNr))) + default_groups.append(grp_dns[role]) return default_groups @@ -498,21 +488,23 @@ if district_enabled: verify_container(getDN (schoolNr, base='district'), ou_module, co, lo, superordinate, baseDN) - print "verify ou for school nr %s"%schoolNr + print "verify ou for school nr %s" % schoolNr + search_base = School.get_search_base(schoolNr) # list of needed sub-containers, the dictionary-key adds the container as default during create in verify_container - container={'0printerPath':['cn=printers'], - '1userPath':['cn=users','cn=%s,cn=users' % cn_pupils,'cn=%s,cn=users' % cn_teachers,'cn=%s,cn=users' % cn_admins], - '2computerPath':['cn=computers','cn=server,cn=computers','cn=dc,cn=server,cn=computers'], - '3networkPath':['cn=networks'], - '4groupPath':['cn=groups','cn=%s,cn=groups' % cn_pupils,'cn=%s,cn=groups' % cn_teachers,'cn=klassen,cn=%s,cn=groups' % cn_pupils,'cn=raeume,cn=groups'], - '5dhcpPath':['cn=dhcp'], - '6policyPath':['cn=policies'], - '7sharePath':['cn=shares','cn=klassen,cn=shares'], - '8none':['cn=dc,cn=server,cn=computers'] - } + container = { + '0printerPath': [search_base.printers], + '1userPath': [search_base.users, search_base.students, search_base.teachers, search_base.admins], + '2computerPath': [search_base.computers, 'cn=server,{}'.format(search_base.computers), 'cn=dc,cn=server,{}'.format(search_base.computers)], + '3networkPath': [search_base.networks], + '4groupPath': [search_base.groups, search_base.workgroups, search_base.teachers_group, search_base.classes, search_base.rooms], + '5dhcpPath': [search_base.dhcp], + '6policyPath': [search_base.policies], + '7sharePath': [search_base.shares, search_base.classShares], + '8none': ['cn=dc,cn=server,{}'.format(search_base.computers)] + } if configRegistry.is_true('ucsschool/ldap/noneducational/create/objects', True): - container['1userPath'].extend(['cn=%s,cn=users' % cn_staff, 'cn=%s,cn=users' % cn_teachers_staff]) - container['4groupPath'].append('cn=%s,cn=groups' % cn_staff) + container['1userPath'].extend([search_base.staff, search_base.teachersAndStaff]) + container['4groupPath'].append(search_base.staff_group) # FIXME: die Policies sollten besser mit der Gruppe verknüpft werden, um # z.B. Mitarbeiter und Lehrer im selben Container pflegen zu können #container_policies = { 'cn=%s,cn=users' % cn_teachers: ['cn=default-lehrer,cn=UMC,cn=policies,' + baseDN] } @@ -527,20 +519,13 @@ dccn = '' myline = '%s\t%s' % ( schoolNr, dccn ) hooks.pre( 'ou', 'A', line = myline ) + search_base = School.get_search_base(schoolNr) # verify global dc groups - groups_administrative = [ - "cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,%s" % baseDN, - "cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,%s" % baseDN] - groups_education=[ - "cn=DC-Edukativnetz,cn=ucsschool,cn=groups,%s" % baseDN, - "cn=Member-Edukativnetz,cn=ucsschool,cn=groups,%s" % baseDN] - groups_administrativeOU=[ - "cn=OU%s-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,%s" % (schoolNr.lower(), baseDN), - "cn=OU%s-Member-Verwaltungsnetz,cn=ucsschool,cn=groups,%s" % (schoolNr.lower(), baseDN)] - groups_educationOU=[ - "cn=OU%s-DC-Edukativnetz,cn=ucsschool,cn=groups,%s" % (schoolNr.lower(), baseDN), - "cn=OU%s-Member-Edukativnetz,cn=ucsschool,cn=groups,%s" % (schoolNr.lower(), baseDN)] + groups_administrative = [search_base.administrative_dc_group, search_base.administrative_member_group] + groups_education = [search_base.educational_dc_group, search_base.educational_member_group] + groups_administrativeOU = [search_base.administrative_ou_dc_group, search_base.administrative_ou_member_group] + groups_educationOU = [search_base.educational_ou_dc_group, search_base.educational_ou_member_group] if configRegistry.is_true('ucsschool/ldap/noneducational/create/objects', True): groups = groups_administrative + groups_education + groups_administrativeOU + groups_educationOU @@ -555,7 +540,7 @@ dcobject = object_exists( server_module, co, lo, 'sub', superordinate, baseDN, univention.admin.filter.expression('cn', dccn), None) - + if dcobject: zone = "edukativ" dcobject.open() @@ -562,15 +547,15 @@ # TODO FIXME The following snippet does not make any sense: # if the DC is member of DC-Verwaltungsnetz then is added again to that group?!? Looks like this code is unused. for grp in dcobject['groups']: - if grp.startswith("cn=DC-Verwaltungsnetz,"): + if grp.startswith(univention.admin.uldap.explodeDn(search_base.administrative_dc_group)[0]): zone = "verwaltung" groups = [] if zone == "edukativ": - groups.append("cn=DC-Edukativnetz,cn=ucsschool,cn=groups,%s" % baseDN) - groups.append("cn=OU%s-DC-Edukativnetz,cn=ucsschool,cn=groups,%s" % (schoolNr.lower(), baseDN)) + groups.append(search_base.educational_dc_group) + groups.append(search_base.educational_ou_dc_group) if zone == "verwaltung": - groups.append("cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,%s" % baseDN) - groups.append("cn=OU%s-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,%s" % (schoolNr.lower(), baseDN)) + groups.append(search_base.administrative_dc_group) + groups.append(search_base.administrative_ou_dc_group) modified = False for grp in groups: if not grp in dcobject['groups']: @@ -578,8 +563,8 @@ dcobject['groups'].append(grp) if modified: dcobject.modify() - + created, dn = verify_container(ou_base, ou_module, co, lo, superordinate, baseDN, path='') if created: # get name of new dc @@ -619,24 +604,22 @@ if displayName is not None: r = lo.modify(ou_base, [('displayName', lo.get(ou_base, ['displayName']).get('displayName',[]), [displayName])]) - keys=container.keys() - keys.sort() - for path in keys: + for path in sorted(container.keys()): for dn in container[path]: - if path[1:]=='none': path=' ' - verify_container('%s,%s'%(dn,ou_base),cn_module, co, lo, superordinate, baseDN, path=path[1:]) + if path[1:] == 'none': + path=' ' + verify_container(dn, cn_module, co, lo, superordinate, baseDN, path=path[1:]) # create groups if not existant - grp_ouadmins = "cn=%s%s,cn=ouadmins,cn=groups,%s" % (grp_prefix_admins, schoolNr.lower(), baseDN) - groups=[ ( grp_ouadmins, grp_policy_admins ), - ( "cn=%s%s,cn=groups,%s" % (grp_prefix_pupils, schoolNr.lower(), getDN(schoolNr)), grp_policy_pupils ), - ( "cn=%s%s,cn=groups,%s" % (grp_prefix_teachers, schoolNr.lower(), getDN(schoolNr)), grp_policy_teachers ), - ] + grp_ouadmins = search_base.admin_group + groups = [ + (grp_ouadmins, grp_policy_admins), + (search_base.students_ou_group, grp_policy_pupils), + (search_base.teachers_ou_group, grp_policy_teachers), + ] if configRegistry.is_true('ucsschool/ldap/noneducational/create/objects', True): - groups.append( - ( "cn=%s%s,cn=groups,%s" % (grp_prefix_staff, schoolNr.lower(), getDN(schoolNr)), grp_policy_staff ), - ) + groups.append((search_base.staff_ou_group, grp_policy_staff)) if configRegistry.is_true('ucsschool/import/attach/policy/default-umc-users', True): domain_users_school = "cn=Domain Users %s,cn=groups,%s" % (schoolNr.lower(), getDN(schoolNr)) groups.append((domain_users_school, "cn=default-umc-users,cn=UMC,cn=policies,%s" % (baseDN,))) @@ -673,8 +656,7 @@ else: dccn = 'dc%s-01' % schoolNr.lower () - dcgroups = ["cn=OU%s-DC-Edukativnetz,cn=ucsschool,cn=groups,%s" % (schoolNr.lower (), baseDN), - "cn=DC-Edukativnetz,cn=ucsschool,cn=groups,%s" % (baseDN, )] + dcgroups = [search_base.educational_ou_dc_group, search_base.educational_dc_group] if dc == 'verwaltung': if not configRegistry.is_true('ucsschool/ldap/noneducational/create/objects', True): @@ -686,8 +668,7 @@ dccn = configRegistry.get('hostname') else: dccn = 'dc%sv-01' % schoolNr.lower () # this is the naming convention, a trailing v for Verwaltungsnetz DCs - dcgroups = ["cn=OU%s-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,%s" % (schoolNr.lower (), baseDN), - "cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,%s" % (baseDN, )] + dcgroups = [search_base.administrative_ou_dc_group, search_base.administrative_dc_group] # create server if not exsistant objects = univention.admin.modules.lookup(computer_module, co, lo, scope='sub', superordinate=superordinate, base=baseDN, @@ -708,9 +689,9 @@ if not server_exists and not dcName: try: if dc == 'verwaltung': - grpdn = 'cn=OU%s-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,%s' % (schoolNr.lower (), baseDN) + grpdn = search_base.administrative_ou_dc_group else: - grpdn = 'cn=OU%s-DC-Edukativnetz,cn=ucsschool,cn=groups,%s' % (schoolNr.lower (), baseDN) + grpdn = search_base.educational_ou_dc_group hostlist = lo.get(grpdn, ['uniqueMember']).get('uniqueMember',[]) except ldap.NO_SUCH_OBJECT: hostlist = [] @@ -1071,7 +1052,7 @@ if (schoolNr, classNr.lower()) in verified_group_shares: return True - position_dn="cn=%s,cn=klassen,cn=shares,%s"%(classNr, getDN (schoolNr, basedn=base)) + position_dn = ClassShare(school=schoolNr, name=classNr).dn module = univention.admin.modules.get("shares/share") position_basedn = univention.admin.uldap.position(baseDN) univention.admin.modules.init (lo, position_basedn, module) @@ -1104,7 +1085,9 @@ print "need to create groupshare %s"%position_dn # get gid form corresponding group - group_dn="cn=%s,cn=klassen,cn=%s,cn=groups,%s"%(classNr, cn_pupils, getDN (schoolNr, basedn=base)) + school_class = SchoolClass(school=schoolNr, name=classNr) + class_share = ClassShare.from_school_class(school_class) + group_dn = school_class.dn gids=lo.get(group_dn,['gidNumber']) gid = 0 if len(gids) > 1: # TODO FIXME This doesn't look correct to me - gids is a dict and not a list! @@ -1155,10 +1138,7 @@ object.open() object["name"] = "%s"%classNr object["host"] = serverfqdn - if configRegistry.is_true('ucsschool/import/roleshare', True): - object["path"] = "/home/" + os.path.join(schoolNr, "groups/klassen/%s" % (classNr,)) - else: - object["path"] = "/home/groups/klassen/%s" % (classNr,) + object["path"] = class_share.get_share_path() object["writeable"] = "1" object["sambaWriteable"] = "1" object["sambaBrowseable"] = "1" @@ -1315,11 +1295,17 @@ # FIXME / TODO # Test should be following: # if ( ( ( parts[0].startswith( 'cn=%s' % grp_prefix_pupils) or parts[0].startswith( 'cn=%s' % grp_prefix_pupils) ) and parts[1] == 'cn=groups' and parts[2].startswith('ou=') ) or - # ( parts[1] == 'cn=klassen' and parts[2] == 'cn=%s' % cn_pupils and parts[3] == 'cn=groups' and parts[4].startswith('ou=') ) ): + # ( parts[1] == 'cn=%s' % cn_classes and parts[2] == 'cn=%s' % cn_pupils and parts[3] == 'cn=groups' and parts[4].startswith('ou=') ) ): + search_base = School.get_search_base(None) + cn_pupils = ldap.explode_dn(search_base.students, True)[0] + cn_classes = ldap.explode_dn(search_base.classes, True)[0] + grp_prefix_pupils = search_base.group_prefix_students + grp_prefix_teachers = search_base.group_prefix_teachers + if ( parts[0].startswith( 'cn=%s' % grp_prefix_pupils ) or parts[0].startswith( 'cn=%s' % grp_prefix_teachers ) or - ( parts[1] == 'cn=klassen' and parts[2] == 'cn=%s' % cn_pupils ) ): + (parts[1] == 'cn=%s' % cn_classes and parts[2] == 'cn=%s' % cn_pupils)): # group looks like a default group, so we don't need it anymore print "remove from group: %s"%group remove_groups.append(group) @@ -1600,12 +1586,13 @@ main_person.isTeacher = '0' main_person.isStaff = '0' - if object.dn.endswith(',cn=%s,cn=users,%s' % (cn_teachers_staff, getDN(ou))): + search_base = School.get_search_base(ou) + if object.dn.endswith(',%s' % search_base.teachersAndStaff): main_person.isTeacher = '1' main_person.isStaff = '1' - elif object.dn.endswith(',cn=%s,cn=users,%s' % (cn_teachers, getDN(ou))): + elif object.dn.endswith(',%s' % search_base.teachers): main_person.isTeacher = '1' - elif object.dn.endswith(',cn=%s,cn=users,%s' % (cn_staff, getDN(ou))): + elif object.dn.endswith(',%s' % search_base.staff): main_person.isStaff = '1' if ou in main_person.allsNrs: @@ -2208,6 +2195,7 @@ zone = parsed[6] verify_school_ou(schoolNr, co, lo, baseDN) + search_base = School.get_search_base(schoolNr) try: ip = ipaddr.IPv4Network(IP) @@ -2224,11 +2212,11 @@ groups = {} if ctype == "memberserver": if zone == "edukativ": - groups["cn=OU%s-Member-Edukativnetz,cn=ucsschool,cn=groups,%s" % (schoolNr.lower(), baseDN)] = 1 - groups["cn=Member-Edukativnetz,cn=ucsschool,cn=groups,%s" % baseDN] = 1 + groups[search_base.educational_ou_member_group] = 1 + groups[search_base.educational_member_group] = 1 if zone == "verwaltung": - groups["cn=OU%s-Member-Verwaltungsnetz,cn=ucsschool,cn=groups,%s" % (schoolNr.lower(), baseDN)] = 1 - groups["cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,%s" % baseDN] = 1 + groups[search_base.administrative_ou_member_group] = 1 + groups[search_base.administrative_member_group] = 1 # invoke pre hooks hooks.pre( 'computer', 'A', line = line ) @@ -2331,8 +2319,8 @@ ClassID = parsed[2] Descrpt = parsed[3] - group_dn="cn=%s,cn=klassen,cn=%s,cn=groups,%s"%(ClassID, cn_pupils, getDN (schoolNr)) - share_dn="cn=%s,cn=klassen,cn=shares,%s"%(ClassID, getDN (schoolNr)) + group_dn = SchoolClass(school=schoolNr, name=ClassID).dn + share_dn = ClassShare(school=schoolNr, name=ClassID).dn verify_school_ou(schoolNr, co, lo, baseDN) @@ -2874,14 +2862,15 @@ slave = slaves[0] ouDn = oulist[0].dn + search_base = School.get_search_base(options.ou) group_filter = univention.admin.filter.conjunction('&', [ - univention.admin.filter.conjunction('|', [ - univention.admin.filter.expression('cn', 'OU%s-DC-Edukativnetz' % options.ou), - univention.admin.filter.expression('cn', 'OU%s-DC-Verwaltungsnetz' % options.ou), - ]), - univention.admin.filter.expression('uniqueMember', slave.dn), - ]) + univention.admin.filter.conjunction('|', [ + univention.admin.uldap.explodeDn(search_base.educational_ou_dc_group)[0], + univention.admin.uldap.explodeDn(search_base.administrative_ou_dc_group)[0], + ]), + univention.admin.filter.expression('uniqueMember', slave.dn), + ]) groups = univention.admin.modules.lookup(group_module, co, lo, scope='sub', base=baseDN, filter=group_filter) if not groups: print 'ERROR: cannot move domaincontroller slave with hostname "%s" to OU "%s"' % (options.dcname, options.ou) @@ -2980,15 +2969,12 @@ print 'ERROR: specified OU %r does not exist' % ou_name sys.exit(1) - + search_base = School.get_search_base(ou_name) # get list of desired group memberships - group_dn_list = { TYPE_DC_ADMINISTRATIVE: ['cn=OU%s-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,%s' % (ou_name.lower(), baseDN), - 'cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,%s' % (baseDN,), - ], - TYPE_DC_EDUCATIONAL: ['cn=DC-Edukativnetz,cn=ucsschool,cn=groups,%s' % (baseDN,), - 'cn=OU%s-DC-Edukativnetz,cn=ucsschool,cn=groups,%s' % (ou_name.lower(), baseDN), - ], - }[dc_type] + group_dn_list = { + TYPE_DC_ADMINISTRATIVE: [search_base.administrative_ou_dc_group, search_base.administrative_dc_group], + TYPE_DC_EDUCATIONAL: [search_base.educational_dc_group, search_base.educational_ou_dc_group] + }[dc_type] for grpdn in group_dn_list: verify_group(grpdn, co, lo, superordinate, baseDN) Index: ucs-school-import/usr/share/ucs-school-import/scripts/ucs-school-join-secondary-samba4 =================================================================== --- ucs-school-import/usr/share/ucs-school-import/scripts/ucs-school-join-secondary-samba4 (Revision 74005) +++ ucs-school-import/usr/share/ucs-school-import/scripts/ucs-school-join-secondary-samba4 (Arbeitskopie) @@ -31,6 +31,7 @@ # . . /usr/share/univention-lib/all.sh +. /usr/share/ucs-school-lib/base.sh display_help() { cat <<-EOL @@ -195,11 +196,13 @@ while read service; do case "$service" in "UCS@school Education") - target_server_ucsschool_type=Edukativnetz + target_server_all_dcs="$(ucr_names_default ucsschool/ldap/default/groupname/all-educational-dc)" + target_server_ou_dcs="$(ucr_names_default ucsschool/ldap/default/groupname/ou-educational-dc)" target_server_ucsschool_service="$service" ;; "UCS@school Administration") - target_server_ucsschool_type=Verwaltungsnetz + target_server_all_dcs="$(ucr_names_default ucsschool/ldap/default/groupname/all-administrativ-dc)" + target_server_ou_dcs="$(ucr_names_default ucsschool/ldap/default/groupname/ou-administrativ-dc)" target_server_ucsschool_service="$service" ;; esac @@ -258,17 +261,17 @@ echo -n "Check group memberschip : " test_output=$(univention-ssh "$ROOTPWD" "root@${target_school_dc_ip}" \ - /usr/sbin/udm groups/group list --filter name="DC-$target_server_ucsschool_type" | sed -n "/^ *hosts: $target_ldap_hostdn$/p") + /usr/sbin/udm groups/group list --filter name="$target_server_all_dcs" | sed -n "/^ *hosts: $target_ldap_hostdn$/p") if [ -z "$test_output" ]; then echo -e "\033[60Gfailed" - echo "$hostname is not member of the group DC-$target_server_ucsschool_type, this needs to be fixed first manually." + echo "$hostname is not member of the group $target_server_all_dcs, this needs to be fixed first manually." exit 1 fi test_output=$(univention-ssh "$ROOTPWD" "root@${target_school_dc_ip}" \ - /usr/sbin/udm groups/group list --filter name="OU$my_school_ou-DC-$target_server_ucsschool_type" | sed -n "/^ *hosts: $target_ldap_hostdn$/p") + /usr/sbin/udm groups/group list --filter name="$(replace_ou "$target_server_ou_dcs" "$my_school_ou")" | sed -n "/^ *hosts: $target_ldap_hostdn$/p") if [ -z "$test_output" ]; then echo -e "\033[60Gfailed" - echo "$hostname is not member of the group OU$my_school_ou-DC-$target_server_ucsschool_type, this needs to be fixed first manually." + echo "$hostname is not member of the group $(replace_ou "$target_server_ou_dcs" "$my_school_ou"), this needs to be fixed first manually." exit 1 else echo -e "\033[60Gdone" Index: ucs-school-import/usr/share/ucs-school-import/scripts/ucs-school-verify-class-memberships =================================================================== --- ucs-school-import/usr/share/ucs-school-import/scripts/ucs-school-verify-class-memberships (Revision 74005) +++ ucs-school-import/usr/share/ucs-school-import/scripts/ucs-school-verify-class-memberships (Arbeitskopie) @@ -42,6 +42,7 @@ import univention.admin.handlers.groups.group import univention.admin.handlers.users.user import univention.admin.objects +from ucsschool.lib.models import School, SchoolClass, Staff, Student, Teacher class Problem(Exception): @@ -160,7 +161,8 @@ def parse_line(lo, line): - oubase = 'ou=%s,%s' % (line['school'], ucr['ldap/base'],) + school = School(name=line['school']) + oubase = school.dn uid = line['name'] try: dn = lo.search(filter_format('uid=%s', (uid,)), oubase, unique=True)[0][0] @@ -173,8 +175,8 @@ raise StudentDoesNotExists(line, uid) else: raise StudentIsInAnotherSchool(line, uid, dn) - if not dn.endswith(',cn=schueler,cn=users,%s' % (oubase,)): - if not dn.endswith(',cn=lehrer,cn=users,%s' % (oubase,)) or not dn.endswith(',cn=mitarbeiter,cn=users,%s' % (oubase,)): + if not dn.endswith(Student.get_container(school.name)): + if not dn.endswith(Teacher.get_container(school.name)) or not dn.endswith(Staff.get_container(school.name)): print('Ignoring teacher/staff %r' % (uid,)) return msg('ERROR: %s (%s %s) is not a student/teacher/staff.' % (uid, line['firstname'], line['lastname'])) @@ -186,7 +188,7 @@ correct = False invalid_groups = set() for gdn, group in groups: # pylint: disable=W0612 - if not gdn.endswith(',cn=klassen,cn=schueler,cn=groups,%s' % (oubase,)): + if not gdn.endswith(SchoolClass.get_container(school.name)): if not gdn.endswith(oubase) and re.search(',ou=[^,]+,%s$' % (ucr['ldap/base'],), gdn, re.I): raise StudentIsInAnotherClassInAnotherSchool(line, uid, dn, gdn) continue # ignore workgroups / Domain Users Index: ucs-school-ldap-acls-master/61ucsschool_presettings =================================================================== --- ucs-school-ldap-acls-master/61ucsschool_presettings (Revision 74005) +++ ucs-school-ldap-acls-master/61ucsschool_presettings (Arbeitskopie) @@ -1,65 +1,95 @@ +@!@ +# -*- coding: utf-8 -*- +import re + + +def replace_ucr_variables(template): + variable_token = re.compile('@[$]@') + + dir_ucsschool = { + 'ALL_ADM_DC': configRegistry.get('ucsschool/ldap/default/groupname/all-administrativ-dc', 'DC-Verwaltungsnetz'), + 'ALL_ADM_MEMBER': configRegistry.get('ucsschool/ldap/default/groupname/all-administrativ-member', 'Member-Verwaltungsnetz'), + 'ALL_EDU_DC': configRegistry.get('ucsschool/ldap/default/groupname/all-educational-dc', 'DC-Edukativnetz'), + 'ALL_EDU_MEMBER': configRegistry.get('ucsschool/ldap/default/groupname/all-educational-member', 'Member-Edukativnetz'), + } + + while 1: + i = variable_token.finditer(template) + try: + start = i.next() + end = i.next() + name = template[start.end():end.start()] + + template = template[:start.start()] + dir_ucsschool.get(name,'') + template[end.end():] + except StopIteration: + break + + return template + + +aclset += """ # start 61ucsschool_presettings # revert rule from UCS; Bug #41402 access to attrs=entry,objectClass,uniqueMember,ou,uid,loginShell,homeDirectory,uidNumber,gidNumber,sn,cn,gecos,description,memberUid by dn.regex=".*cn=computers,ou=([^,]+),(ou=[^,]+,)?@%@ldap/base@%@" none break - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none break - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none break - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none break - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none break + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none break + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none break + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none break + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none break by set="user/objectClass & ([ucsschoolStudent] | [ucsschoolTeacher] | [ucsschoolStaff] | [ucsschoolAdministrator])" none break by * +0 break # Slave-Controller und Member-Server duerfen Samba-Domaenenobjekt(e) modifizieren access to filter="(objectClass=sambaDomain)" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by * +0 break # grant write access to domaincontroller slave/member server for certain univention app center settings access to dn.regex="^univentionAppID=([^,]+),cn=([^,]+),cn=apps,cn=univention,@%@ldap/base@%@$" filter="(objectClass=univentionApp)" - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by * +0 break access to dn.regex="^cn=([^,]+),cn=apps,cn=univention,@%@ldap/base@%@$" attrs=children,entry - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by * +0 break access to dn="cn=apps,cn=univention,@%@ldap/base@%@" attrs=children,entry - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by * +0 break # Slave controllers and memberservers require write access to virtual machine manager objects access to dn.regex="^univentionVirtualMachineUUID=([^,]+),cn=Information,cn=Virtual Machine Manager,@%@ldap/base@%@" filter="(objectClass=univentionVirtualMachine)" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by * +0 break access to dn.regex="^cn=([^,]+),cn=CloudConnection,cn=Virtual Machine Manager,@%@ldap/base@%@" filter="(objectClass=univentionVirtualMachineCloudConnection)" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by * +0 break access to dn="cn=(Information|CloudConnection),cn=Virtual Machine Manager,@%@ldap/base@%@" attrs=children,entry - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by dn.regex="^[^,]+,cn=dc,cn=computers,@%@ldap/base@%@$$" write by dn.regex="^[^,]+,cn=memberserver,cn=computers,@%@ldap/base@%@$$" write by * +0 break @@ -66,47 +96,51 @@ # Slave-Controller und Member-Server benoetigen idmap-Container access to dn.base="cn=idmap,cn=univention,@%@ldap/base@%@" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by * +0 break # Slave-Controller und Member-Server benoetigen ID-Mapping access to dn.subtree="cn=idmap,cn=univention,@%@ldap/base@%@" filter="(|(&(objectClass=sambaUnixIdPool)(objectClass=organizationalRole)(objectClass=top))(&(objectClass=sambaIdmapEntry)(objectClass=sambaSidEntry)))" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by * +0 break # Slave-Controller und Member-Server benoetigen nicht alle Container access to dn.subtree="cn=backup,@%@ldap/base@%@" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none by * +0 break access to dn.subtree="cn=printers,@%@ldap/base@%@" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none by * +0 break access to dn.subtree="cn=networks,@%@ldap/base@%@" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none by * +0 break access to dn.regex="^(.*,)?cn=(cups|ppolicy|packages|services|templates|admin-settings|default containers|saml-serviceprovider),cn=univention,@%@ldap/base@%@$$" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none by * +0 break # end 61ucsschool_presettings +""" + +print replace_ucr_variables(aclset) +@!@ Index: ucs-school-ldap-acls-master/65ucsschool =================================================================== --- ucs-school-ldap-acls-master/65ucsschool (Revision 74005) +++ ucs-school-ldap-acls-master/65ucsschool (Arbeitskopie) @@ -13,19 +13,23 @@ def replace_ucr_variables(template): variable_token = re.compile('@[$]@') - dir_ucsschool = { } - dir_ucsschool[ 'DISTRICT' ] = '' - if configRegistry.get('ucsschool/ldap/district/enable','no').lower() in ( 'yes', 'true', '1' ): - dir_ucsschool[ 'DISTRICT' ] = 'ou=[^,]+,' - dir_ucsschool[ 'PUPILS' ] = configRegistry.get('ucsschool/ldap/default/container/pupils', 'schueler') - dir_ucsschool[ 'TEACHERS' ] = configRegistry.get('ucsschool/ldap/default/container/teachers', 'lehrer') - dir_ucsschool[ 'STAFF' ] = configRegistry.get('ucsschool/ldap/default/container/staff', 'mitarbeiter') - dir_ucsschool[ 'TEACHERS-STAFF' ] = configRegistry.get('ucsschool/ldap/default/container/teachers-and-staff', 'lehrer und mitarbeiter') - dir_ucsschool[ 'ADMINS' ] = configRegistry.get('ucsschool/ldap/default/container/admins', 'admins') - dir_ucsschool[ 'GRPADMINS' ] = configRegistry.get('ucsschool/ldap/default/groupprefix/admins', 'admins-') - dir_ucsschool[ 'EXAM' ] = configRegistry.get('ucsschool/ldap/default/container/exam', 'examusers') + dir_ucsschool = { + 'DISTRICT': 'ou=[^,]+,' if configRegistry.is_true('ucsschool/ldap/district/enable') else '', + 'PUPILS': configRegistry.get('ucsschool/ldap/default/container/pupils', 'schueler'), + 'TEACHERS': configRegistry.get('ucsschool/ldap/default/container/teachers', 'lehrer'), + 'STAFF': configRegistry.get('ucsschool/ldap/default/container/staff', 'mitarbeiter'), + 'TEACHERS-STAFF': configRegistry.get('ucsschool/ldap/default/container/teachers-and-staff', 'lehrer und mitarbeiter'), + 'ADMINS': configRegistry.get('ucsschool/ldap/default/container/admins', 'admins'), + 'GRPADMINS': configRegistry.get('ucsschool/ldap/default/groupprefix/admins', 'admins-'), + 'EXAM': configRegistry.get('ucsschool/ldap/default/container/exam', 'examusers'), + 'CLASS': configRegistry.get('ucsschool/ldap/default/container/class', 'klassen'), + 'ROOMS': configRegistry.get('ucsschool/ldap/default/container/rooms', 'raeume'), + 'ALL_ADM_DC': configRegistry.get('ucsschool/ldap/default/groupname/all-administrativ-dc', 'DC-Verwaltungsnetz'), + 'ALL_ADM_MEMBER': configRegistry.get('ucsschool/ldap/default/groupname/all-administrativ-member', 'Member-Verwaltungsnetz'), + 'ALL_EDU_DC': configRegistry.get('ucsschool/ldap/default/groupname/all-educational-dc', 'DC-Edukativnetz'), + 'ALL_EDU_MEMBER': configRegistry.get('ucsschool/ldap/default/groupname/all-educational-member', 'Member-Edukativnetz'), + } - while 1: i = variable_token.finditer(template) try: @@ -43,20 +47,20 @@ aclset += """ # DC Slaves need write access to the members of the group Domain Computers access to dn.exact="cn=Domain Computers,cn=groups,@%@ldap/base@%@" attrs="uniqueMember,memberUid" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by * +0 break # Slave DCs can read and write policy containers for MS GPOs and msPrintConnectionPolicy objects access to dn.subtree="cn=policies,cn=system,@%@ldap/base@%@" filter="(|(objectClass=msGPOContainer)(objectClass=organizationalRole)(objectClass=msPrintConnectionPolicy))" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by * +0 break # Slave DCs can read and write policy containers for MS WMI filter objects access to dn.subtree="cn=WMIPolicy,cn=system,@%@ldap/base@%@" filter="(|(objectClass=msWMISom)(objectClass=organizationalRole))" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by * +0 break # Lehrer, Mitarbeiter und OU-Admins duerfen Schueler-Passwoerter aendern @@ -70,12 +74,12 @@ by * +0 break # Lehrer, Mitarbeiter und OU-Admins duerfen Raum-Gruppen anlegen und bearbeiten -access to dn.regex="^cn=raeume,cn=groups,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" attrs=children,entry +access to dn.regex="^cn=@$@ROOMS@$@,cn=groups,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" attrs=children,entry by set.expand="[$1] & ([ldap:///]+user/entryDN+[?entryDN?base?%28%7C%28objectClass%3DucsschoolTeacher%29%28objectClass%3DucsschoolAdministrator%29%28objectClass%3DucsschoolStaff%29%29])/ucsschoolSchool" write @$@# old rule@$@ by dn.regex="^uid=([^,]+),cn=(@$@TEACHERS@$@|@$@TEACHERS-STAFF@$@|@$@STAFF@$@|@$@ADMINS@$@),cn=users,ou=$1,@$@DISTRICT@$@@%@ldap/base@%@$$" write by * +0 break -access to dn.regex="^cn=([^,]+),cn=raeume,cn=groups,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" filter="(&(!(|(uidNumber=*)(objectClass=SambaSamAccount)))(objectClass=univentionGroup))" +access to dn.regex="^cn=([^,]+),cn=@$@ROOMS@$@,cn=groups,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" filter="(&(!(|(uidNumber=*)(objectClass=SambaSamAccount)))(objectClass=univentionGroup))" by set.expand="[$2] & ([ldap:///]+user/entryDN+[?entryDN?base?%28%7C%28objectClass%3DucsschoolTeacher%29%28objectClass%3DucsschoolAdministrator%29%28objectClass%3DucsschoolStaff%29%29])/ucsschoolSchool" write @$@# old rule@$@ by dn.regex="^uid=([^,]+),cn=(@$@TEACHERS@$@|@$@TEACHERS-STAFF@$@|@$@STAFF@$@|@$@ADMINS@$@),cn=users,ou=$2,@$@DISTRICT@$@@%@ldap/base@%@$$" write by * +0 break @@ -145,10 +149,10 @@ by * +0 break access to dn.subtree="cn=temporary,cn=univention,@%@ldap/base@%@" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none by * +0 break # OU-Admins duerfen MAC-Adressen im Rechner- und DHCP-Objekt aendern @@ -172,24 +176,24 @@ # domaincontroller slaves and memberservers of management group are not allowed to replicate pupils and teachers access to dn.regex="^.+,cn=(@$@TEACHERS@$@|@$@PUPILS@$@),cn=users,ou=[^,]+,@$@DISTRICT@$@@%@ldap/base@%@$$" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none by * +0 break access to filter="(|(objectClass=ucsschoolStudent)(&(objectClass=ucsschoolTeacher)(!(objectClass=ucsschoolStaff))))" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none by * +0 break # domaincontroller slaves and memberservers of educational group are not allowed to replicate staff users access to dn.regex="^.+,cn=@$@STAFF@$@,cn=users,ou=[^,]+,@$@DISTRICT@$@@%@ldap/base@%@$$" - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none by * +0 break access to filter="(&(objectClass=ucsschoolStaff)(!(objectClass=ucsschoolTeacher))(!(objectClass=ucsschoolAdministrator)))" - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" none by * +0 break # FIXME: this rule allows to read all passwords underneath of all OU's instead of only the password belonging to the OU; explain why or fix it @@ -196,41 +200,41 @@ # TODO: are the following attributes missing here?: 'sambaBadPasswordCount', 'krb5PasswordEnd', 'shadowMax', 'sambaAcctFlags', 'sambaPasswordHistory' # Memberserver duerfen Passwoerter aller Objekte unterhalb einer Schule lesen access to dn.regex="^(.+,)?ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" attrs=userPassword,krb5Key,krb5KDCFlags,sambaNTPassword,sambaLMPassword,shadowLastChange,sambaPwdLastSet,pwhistory,krb5KeyVersionNumber,sambaPwdCanChange,sambaPwdMustChange - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" +rscxd - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" +rscxd + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" +rscxd + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" +rscxd by * +0 break # Alle DC-Slaves muessen alle Benutzercontainer und Gruppen jeder Schule lesen koennen access to dn.regex="^ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" filter="objectClass=ucsschoolOrganizationalUnit" - by group/univentionGroup/uniqueMember.expand="cn=OU$1-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember.expand="cn=OU$1-DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember.expand="cn=OU$1-@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember.expand="cn=OU$1-@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by dn.regex="^cn=.*,cn=server,cn=computers,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" +rscxd by * +0 break access to dn.regex="^cn=(users|groups|@$@EXAM@$@),ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" - by group/univentionGroup/uniqueMember.expand="cn=OU$2-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember.expand="cn=OU$2-DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember.expand="cn=OU$2-@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember.expand="cn=OU$2-@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by dn.regex="^cn=.*,cn=server,cn=computers,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" +rscxd by * +0 break access to dn.regex="^([^,]+),cn=groups,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" - by group/univentionGroup/uniqueMember.expand="cn=OU$2-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember.expand="cn=OU$2-DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember.expand="cn=OU$2-@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember.expand="cn=OU$2-@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by dn.regex="^cn=.*,cn=server,cn=computers,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" +rscxd by * +0 break access to dn.regex="^cn=(@$@PUPILS@$@|@$@TEACHERS@$@|@$@TEACHERS-STAFF@$@|@$@STAFF@$@|@$@ADMINS@$@),cn=users,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" - by group/univentionGroup/uniqueMember.expand="cn=OU$2-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember.expand="cn=OU$2-DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember.expand="cn=OU$2-@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember.expand="cn=OU$2-@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by dn.regex="^cn=.*,cn=server,cn=computers,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" +rscxd by * +0 break # DC-Slaves muessen die Benutzer ihrer Schule lesen und schreiben duerfen access to dn.regex="^uid=([^,]+),cn=(@$@PUPILS@$@|@$@TEACHERS@$@|@$@TEACHERS-STAFF@$@|@$@STAFF@$@|@$@ADMINS@$@),cn=users,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" - by set="([cn=OU]+this/ucsschoolSchool+[-DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@])/uniqueMember & user" write + by set="([cn=OU]+this/ucsschoolSchool+[-@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@])/uniqueMember & user" write by * +0 break access to dn.regex="^uid=([^,]+),cn=@$@EXAM@$@,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" - by set="([cn=OU]+this/ucsschoolSchool+[-DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@])/uniqueMember & user" write + by set="([cn=OU]+this/ucsschoolSchool+[-@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@])/uniqueMember & user" write by * +0 break # Schul-Slave-Server duerfen nur Eintraege ihrer OU lesen und schreiben (Passwortaenderungen etc.) @@ -237,13 +241,13 @@ # Lehrer und Memberserver duerfen sie lesen, ou-eigene bekommen Standard-ACLs, ou-fremde Server/user duerfen nichts access to dn.regex="^(.+,)?ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" by set.expand="[ldap:///ou=$2,@%@ldap/base@%@?ou?base?%28%21%28objectClass%3DucsschoolOrganizationalUnit%29%29]/ou" +0 break - by group/univentionGroup/uniqueMember.expand="cn=OU$2-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember.expand="cn=OU$2-DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember.expand="cn=OU$2-@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember.expand="cn=OU$2-@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by group/univentionLDAPACL/univentionLDAPAccessWrite.expand="ou=$2,@$@DISTRICT@$@@%@ldap/base@%@" write by dn.regex="^uid=([^,]+),cn=(@$@TEACHERS@$@|@$@TEACHERS-STAFF@$@|@$@STAFF@$@|@$@ADMINS@$@),cn=users,ou=$2,@$@DISTRICT@$@@%@ldap/base@%@$$" +rscxd continue by set.expand="[$2] & ([ldap:///]+user/entryDN+[?entryDN?base?%28%7C%28objectClass%3DucsschoolTeacher%29%28objectClass%3DucsschoolAdministrator%29%28objectClass%3DucsschoolStaff%29%29])/ucsschoolSchool" +rscxd continue - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" +0 stop - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" +0 stop + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" +0 stop + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" +0 stop by set.expand="([ldap:///]+user/entryDN+[?entryDN?base?%28%7C%28objectClass%3DucsschoolTeacher%29%28objectClass%3DucsschoolAdministrator%29%28objectClass%3DucsschoolStaff%29%29])/ucsschoolSchool" +0 stop by dn.regex="^.*,ou=$2,@$@DISTRICT@$@@%@ldap/base@%@$$" +rscxd break by dn.regex="^.*,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" +0 stop @@ -250,22 +254,22 @@ by * +0 break # Slave-Controller duerfen Klassen-Gruppen bearbeiten (AUSNAHME! Wird fuer Lehrerzuordnung in UMC benoetigt!) -access to dn.regex="^cn=klassen,cn=@$@PUPILS@$@,cn=groups,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" attrs=children,entry - by group/univentionGroup/uniqueMember.expand="cn=OU$1-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember.expand="cn=OU$1-DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write +access to dn.regex="^cn=@$@CLASS@$@,cn=@$@PUPILS@$@,cn=groups,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" attrs=children,entry + by group/univentionGroup/uniqueMember.expand="cn=OU$1-@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember.expand="cn=OU$1-@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by * +0 break access to dn.regex="^cn=([^,]+),cn=klassen,cn=@$@PUPILS@$@,cn=groups,ou=([^,]+),@$@DISTRICT@$@@%@ldap/base@%@$$" filter="(&(!(|(uidNumber=*)(objectClass=SambaSamAccount)))(objectClass=univentionGroup))" - by group/univentionGroup/uniqueMember.expand="cn=OU$2-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write - by group/univentionGroup/uniqueMember.expand="cn=OU$2-DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember.expand="cn=OU$2-@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write + by group/univentionGroup/uniqueMember.expand="cn=OU$2-@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" write by * +0 break # Schulserver duerfen die Passwoerter aller globalen Objekte replizieren access to dn.regex="^(.+,)?cn=(users|kerberos|computers),@%@ldap/base@%@$$" - by group/univentionGroup/uniqueMember="cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" +rscxd - by group/univentionGroup/uniqueMember="cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" +rscxd - by group/univentionGroup/uniqueMember="cn=DC-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" +rscxd - by group/univentionGroup/uniqueMember="cn=Member-Edukativnetz,cn=ucsschool,cn=groups,@%@ldap/base@%@" +rscxd + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" +rscxd + by group/univentionGroup/uniqueMember="cn=@$@ALL_ADM_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" +rscxd + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_DC@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" +rscxd + by group/univentionGroup/uniqueMember="cn=@$@ALL_EDU_MEMBER@$@,cn=ucsschool,cn=groups,@%@ldap/base@%@" +rscxd by * +0 break """ Index: ucs-school-ldap-acls-master/70ucsschool-ldap-acls-master.inst =================================================================== --- ucs-school-ldap-acls-master/70ucsschool-ldap-acls-master.inst (Revision 74005) +++ ucs-school-ldap-acls-master/70ucsschool-ldap-acls-master.inst (Arbeitskopie) @@ -32,6 +32,8 @@ VERSION=7 . /usr/share/univention-join/joinscripthelper.lib . /usr/share/univention-lib/ldap.sh +. /usr/share/ucs-school-lib/base.sh + joinscript_init eval "$(univention-config-registry shell)" @@ -43,7 +45,11 @@ --set name="ucsschool" # create global groups required for LDAP ACLs for UCS@school -for grp in "DC-Verwaltungsnetz" "Member-Verwaltungsnetz" "DC-Edukativnetz" "Member-Edukativnetz" ; do +for grp in \ + "$(ucr_names_default ucsschool/ldap/default/groupname/all-administrativ-dc)" \ + "$(ucr_names_default ucsschool/ldap/default/groupname/all-administrativ-member)" \ + "$(ucr_names_default ucsschool/ldap/default/groupname/all-educational-dc)" \ + "$(ucr_names_default ucsschool/ldap/default/groupname/all-educational-member)"; do univention-directory-manager groups/group create "$@" \ --ignore_exist \ --position="cn=ucsschool,cn=groups,$ldap_base" \ Index: ucs-school-ldap-acls-master/debian/control =================================================================== --- ucs-school-ldap-acls-master/debian/control (Revision 74005) +++ ucs-school-ldap-acls-master/debian/control (Arbeitskopie) @@ -9,7 +9,7 @@ Package: ucs-school-ldap-acls-master Architecture: all -Depends: univention-ldap-server, univention-ldap-config +Depends: univention-ldap-server, univention-ldap-config, shell-ucs-school Conflicts: univention-server-slave, univention-server-member, univention-mobile-client, univention-managed-client, univention-basesystem Description: Special LDAP ACLs for UCS@school This package provides additional LDAP ACLs for slapd Index: ucs-school-lib/python/models/school.py =================================================================== --- ucs-school-lib/python/models/school.py (Revision 74005) +++ ucs-school-lib/python/models/school.py (Arbeitskopie) @@ -79,22 +79,18 @@ def get_container(cls, school=None): return ucr.get('ldap/base') - @classmethod - def cn_name(cls, name, default): - ucr_var = 'ucsschool/ldap/default/container/%s' % name - return ucr.get(ucr_var, default) - def create_default_containers(self, lo): - cn_pupils = self.cn_name('pupils', 'schueler') - cn_teachers = self.cn_name('teachers', 'lehrer') - cn_admins = self.cn_name('admins', 'admins') - cn_classes = self.cn_name('class', 'klassen') - cn_rooms = self.cn_name('rooms', 'raeume') + search_base = self.get_search_base(self.name) + cn_pupils = ldap.explode_dn(search_base.students, True)[0] + cn_teachers = ldap.explode_dn(search_base.teachers, True)[0] + cn_admins = ldap.explode_dn(search_base.admins, True)[0] + cn_classes = ldap.explode_dn(search_base.classes, True)[0] + cn_rooms = ldap.explode_dn(search_base.rooms, True)[0] user_containers = [cn_pupils, cn_teachers, cn_admins] group_containers = [cn_pupils, [cn_classes], cn_teachers, cn_rooms] if self.shall_create_administrative_objects(): - cn_staff = self.cn_name('staff', 'mitarbeiter') - cn_teachers_staff = self.cn_name('teachers-and-staff', 'lehrer und mitarbeiter') + cn_staff = ldap.explode_dn(search_base.staff, True)[0] + cn_teachers_staff = ldap.explode_dn(search_base.teachersAndStaff, True)[0] user_containers.extend([cn_staff, cn_teachers_staff]) group_containers.append(cn_staff) containers_with_path = { @@ -126,12 +122,6 @@ for cn in containers: last_dn = _add_container(cn, last_dn, self.dn, path, lo) - def group_name(self, prefix_var, default_prefix): - ucr_var = 'ucsschool/ldap/default/groupprefix/%s' % prefix_var - name_part = ucr.get(ucr_var, default_prefix) - school_part = self.name.lower() - return '%s%s' % (name_part, school_part) - def get_umc_policy_dn(self, name): # at least the default ones should exist due to the join script return ucr.get('ucsschool/ldap/default/policy/umc/%s' % name, 'cn=ucsschool-umc-%s-default,cn=UMC,cn=policies,%s' % (name, ucr.get('ldap/base'))) @@ -152,8 +142,8 @@ group.create(lo) # cn=ouadmins - admin_group_container = 'cn=ouadmins,cn=groups,%s' % ucr.get('ldap/base') - group = BasicGroup.cache(self.group_name('admins', 'admins-'), container=admin_group_container) + search_base = self.get_search_base(self.name) + group = BasicGroup.cache("{}{}".format(search_base.group_prefix_admins, self.name.lower()), container=search_base.globalGroupContainer) group.create(lo) group.add_umc_policy(self.get_umc_policy_dn('admins'), lo) try: @@ -168,18 +158,18 @@ udm_obj.modify() # cn=schueler - group = Group.cache(self.group_name('pupils', 'schueler-'), self.name) + group = Group.cache("{}{}".format(search_base.group_prefix_students, self.name.lower()), self.name) group.create(lo) group.add_umc_policy(self.get_umc_policy_dn('pupils'), lo) # cn=lehrer - group = Group.cache(self.group_name('teachers', 'lehrer-'), self.name) + group = Group.cache("{}{}".format(search_base.group_prefix_teachers, self.name.lower()), self.name) group.create(lo) group.add_umc_policy(self.get_umc_policy_dn('teachers'), lo) # cn=mitarbeiter if self.shall_create_administrative_objects(): - group = Group.cache(self.group_name('staff', 'mitarbeiter-'), self.name) + group = Group.cache("{}{}".format(search_base.group_prefix_staff, self.name.lower()), self.name) group.create(lo) group.add_umc_policy(self.get_umc_policy_dn('staff'), lo) @@ -236,20 +226,34 @@ return flatten([self.get_administrative_group_name(group_type, True, ou_specific, as_dn), self.get_administrative_group_name(group_type, False, ou_specific, as_dn)]) if ou_specific == 'both': return flatten([self.get_administrative_group_name(group_type, domain_controller, False, as_dn), self.get_administrative_group_name(group_type, domain_controller, True, as_dn)]) + search_base = self.get_search_base(self.name) + base_dn = ucr.get('ldap/base') if group_type == 'administrative': - name = 'Verwaltungsnetz' + if domain_controller: + if ou_specific: + dn = search_base.administrative_ou_dc_group + else: + dn = search_base.administrative_dc_group + else: + if ou_specific: + dn = search_base.administrative_ou_member_group + else: + dn = search_base.administrative_member_group else: - name = 'Edukativnetz' - if domain_controller: - name = 'DC-%s' % name - else: - name = 'Member-%s' % name - if ou_specific: - name = 'OU%s-%s' % (self.name.lower(), name) + if domain_controller: + if ou_specific: + dn = search_base.educational_ou_dc_group + else: + dn = search_base.educational_dc_group + else: + if ou_specific: + dn = search_base.educational_ou_member_group + else: + dn = search_base.educational_member_group if as_dn: - return 'cn=%s,cn=ucsschool,cn=groups,%s' % (name, ucr.get('ldap/base')) + return dn else: - return name + return ldap.explode_dn(dn, True)[0] def get_administrative_server_names(self, lo): dn = self.get_administrative_group_name('administrative', ou_specific=True, as_dn=True) Index: ucs-school-lib/python/models/share.py =================================================================== --- ucs-school-lib/python/models/share.py (Revision 74005) +++ ucs-school-lib/python/models/share.py (Arbeitskopie) @@ -138,6 +138,6 @@ def get_share_path(self): if ucr.is_true('ucsschool/import/roleshare', True): - return '/home/%s/groups/klassen/%s' % (self.school_group.school, self.name) + return '/home/%s/groups/%s/%s' % (self.school_group.school, self.get_search_base(self.school).share_name_class, self.name) else: - return '/home/groups/klassen/%s' % self.name + return '/home/groups/%s/%s' % (self.get_search_base(self.school).share_name_class, self.name) Index: ucs-school-lib/python/models/user.py =================================================================== --- ucs-school-lib/python/models/user.py (Revision 74005) +++ ucs-school-lib/python/models/user.py (Arbeitskopie) @@ -445,15 +445,15 @@ return [self.get_group_dn('Domain Users %s' % school, school) for school in self.schools] def get_students_groups(self): - prefix = ucr.get('ucsschool/ldap/default/groupprefix/pupils', 'schueler-') + prefix = self.get_search_base(self.school).group_prefix_students return [self.get_group_dn('%s%s' % (prefix, school), school) for school in self.schools] def get_teachers_groups(self): - prefix = ucr.get('ucsschool/ldap/default/groupprefix/teachers', 'lehrer-') + prefix = self.get_search_base(self.school).group_prefix_teachers return [self.get_group_dn('%s%s' % (prefix, school), school) for school in self.schools] def get_staff_groups(self): - prefix = ucr.get('ucsschool/ldap/default/groupprefix/staff', 'mitarbeiter-') + prefix = self.get_search_base(self.school).group_prefix_staff return [self.get_group_dn('%s%s' % (prefix, school), school) for school in self.schools] def groups_used(self, lo): @@ -677,6 +677,6 @@ @classmethod def from_student_dn(cls, lo, school, dn): - examUserPrefix = ucr.get('ucsschool/ldap/default/userprefix/exam', 'exam-') + examUserPrefix = cls.get_search_base(school).user_prefix_exam dn = 'uid=%s%s,%s' % (escape_dn_chars(examUserPrefix), explode_dn(dn, True)[0], cls.get_container(school)) return cls.from_dn(dn, school, lo) Index: ucs-school-lib/python/roleshares.py =================================================================== --- ucs-school-lib/python/roleshares.py (Revision 74005) +++ ucs-school-lib/python/roleshares.py (Arbeitskopie) @@ -36,7 +36,7 @@ import univention.config_registry from ucsschool.lib.roles import role_pupil, role_teacher, role_staff from ucsschool.lib.i18n import ucs_school_name_i18n -from ucsschool.lib.models import Group, School +from ucsschool.lib.models import Group, School, Share from ucsschool.lib.schoolldap import LDAP_Connection, USER_READ, USER_WRITE, MACHINE_READ import univention.admin.uexceptions import univention.admin.uldap as udm_uldap @@ -147,7 +147,7 @@ ucr.load() school_ou = school.name - share_container_dn = school.get_search_base(school.name).shares + share_container_dn = Share.get_container(school.name) teacher_groupname = '-'.join((ucs_school_name_i18n(role_teacher), school_ou)) teacher_group = Group(name=teacher_groupname, school=school_ou).get_udm_object(ldap_user_read) Index: ucs-school-lib/python/schoolldap.py =================================================================== --- ucs-school-lib/python/schoolldap.py (Revision 74005) +++ ucs-school-lib/python/schoolldap.py (Arbeitskopie) @@ -30,29 +30,26 @@ # /usr/share/common-licenses/AGPL-3; if not, see # . +import inspect +import re +from functools import wraps +from ldap.filter import escape_filter_chars, filter_format + +import univention.admin.config +import univention.admin.modules +import univention.admin.modules as udm_modules import univention.config_registry import univention.uldap -import univention.admin.config -import univention.admin.modules from univention.admin.filter import conjunction, parse from univention.admin.uexceptions import noObject - -import univention.admin.modules as udm_modules -from univention.management.console.protocol.message import Message - from univention.lib.i18n import Translation - -from functools import wraps -import re -import inspect -from ldap.filter import escape_filter_chars, filter_format - from univention.management.console.config import ucr +from univention.management.console.ldap import get_machine_connection, get_admin_connection, get_user_connection#, reset_cache as reset_connection_cache from univention.management.console.log import MODULE -from univention.management.console.ldap import get_machine_connection, get_admin_connection, get_user_connection#, reset_cache as reset_connection_cache from univention.management.console.modules import Base, UMC_Error from univention.management.console.modules.decorators import sanitize from univention.management.console.modules.sanitizers import StringSanitizer +from univention.management.console.protocol.message import Message # load UDM modules udm_modules.update() @@ -161,7 +158,16 @@ self._school = school or availableSchools[0] self._schoolDN = dn or School.cache(self.school).dn - # prefixes + # + # When adding/updating UCRV defaults, also add/update them in shell/base.sh. + # + + # + # When changing any of ucsschool/ldap/default/groupname/all-{administrativ, educational}-{dc, member} + # copy the changes to ucs-school-ldap-acls-master/{61ucsschool_presettings, 65ucsschool}. + # + + # containers self._containerAdmins = ucr.get('ucsschool/ldap/default/container/admins', 'admins') self._containerStudents = ucr.get('ucsschool/ldap/default/container/pupils', 'schueler') self._containerStaff = ucr.get('ucsschool/ldap/default/container/staff', 'mitarbeiter') @@ -170,12 +176,38 @@ self._containerClass = ucr.get('ucsschool/ldap/default/container/class', 'klassen') self._containerRooms = ucr.get('ucsschool/ldap/default/container/rooms', 'raeume') self._examUserContainerName = ucr.get('ucsschool/ldap/default/container/exam', 'examusers') - self._examGroupNameTemplate = ucr.get('ucsschool/ldap/default/groupname/exam', 'OU%(ou)s-Klassenarbeit') - + # group names + self._examGroupName = ucr.get('ucsschool/ldap/default/groupname/exam', + 'OU%(ou)s-Klassenarbeit') % {'ou': self._school.lower()} + self._all_administrativ_dc = ucr.get('ucsschool/ldap/default/groupname/all-administrativ-dc', + 'DC-Verwaltungsnetz') + self._all_administrativ_member = ucr.get('ucsschool/ldap/default/groupname/all-administrativ-member', + 'Member-Verwaltungsnetz') + self._all_educational_dc = ucr.get('ucsschool/ldap/default/groupname/all-educational-dc', + 'DC-Edukativnetz') + self._all_educational_member = ucr.get('ucsschool/ldap/default/groupname/all-educational-member', + 'Member-Edukativnetz') + self._ou_administrativ_dc = ucr.get('ucsschool/ldap/default/groupname/ou-administrativ-dc', + 'OU%(ou)s-DC-Verwaltungsnetz') % {'ou': self._school.lower()} + self._ou_administrativ_member = ucr.get('ucsschool/ldap/default/groupname/ou-administrativ-member', + 'OU%(ou)s-Member-Verwaltungsnetz') % {'ou': self._school.lower()} + self._ou_educational_dc = ucr.get('ucsschool/ldap/default/groupname/ou-educational-dc', + 'OU%(ou)s-DC-Edukativnetz') % {'ou': self._school.lower()} + self._ou_educational_member = ucr.get('ucsschool/ldap/default/groupname/ou-educational-member', + 'OU%(ou)s-Member-Edukativnetz') % {'ou': self._school.lower()} + # group prefixes self.group_prefix_students = ucr.get('ucsschool/ldap/default/groupprefix/pupils', 'schueler-') self.group_prefix_teachers = ucr.get('ucsschool/ldap/default/groupprefix/teachers', 'lehrer-') self.group_prefix_admins = ucr.get('ucsschool/ldap/default/groupprefix/admins', 'admins-') self.group_prefix_staff = ucr.get('ucsschool/ldap/default/groupprefix/staff', 'mitarbeiter-') + # user prefix + self.user_prefix_exam = ucr.get('ucsschool/ldap/default/userprefix/exam', 'exam-') + # share/directory names + self.share_name_class = ucr.get('ucsschool/ldap/default/share/class', 'klassen') + self.share_name_pupils = ucr.get('ucsschool/ldap/default/share/pupils', 'schueler') + self.share_name_teachers = ucr.get('ucsschool/ldap/default/share/teachers', 'lehrer') + self.share_name_exams = ucr.get('ucsschool/ldap/default/share/exams', 'Klassenarbeiten') + self.share_name_marktplatz = ucr.get('ucsschool/import/generate/share/marktplatz/name', 'Marktplatz') @classmethod def getOU(cls, dn): @@ -244,25 +276,65 @@ @property def students(self): + """cn=schueler,cn=users,""" return "cn=%s,cn=users,%s" % (self._containerStudents, self.schoolDN) @property + def students_group(self): + """cn=schueler,cn=groups,""" + return "cn=%s,cn=groups,%s" % (self._containerStudents, self.schoolDN) + + @property + def students_ou_group(self): + """cn=schueler-%(ou)s,cn=groups, (ou already replaced)""" + return "cn=%s%s,cn=groups,%s" % (self.group_prefix_students, self.school, self.schoolDN) + + @property def teachers(self): + """cn=lehrer,cn=users,""" return "cn=%s,cn=users,%s" % (self._containerTeachers, self.schoolDN) @property + def teachers_group(self): + """cn=lehrer,cn=groups,""" + return "cn=%s,cn=groups,%s" % (self._containerTeachers, self.schoolDN) + + @property + def teachers_ou_group(self): + """cn=lehrer-%(ou)s,cn=groups, (ou already replaced)""" + return "cn=%s%s,cn=groups,%s" % (self.group_prefix_teachers, self.school, self.schoolDN) + + @property def teachersAndStaff(self): + """cn=lehrer und mitarbeiter,cn=users,""" return "cn=%s,cn=users,%s" % (self._containerTeachersAndStaff, self.schoolDN) @property def staff(self): + """cn=mitarbeiter,cn=users,""" return "cn=%s,cn=users,%s" % (self._containerStaff, self.schoolDN) @property + def staff_group(self): + """cn=mitarbeiter,cn=groups,""" + return "cn=%s,cn=groups,%s" % (self._containerStaff, self.schoolDN) + + @property + def staff_ou_group(self): + """cn=mitarbeiter-%(ou)s,cn=groups, (ou already replaced)""" + return "cn=%s%s,cn=groups,%s" % (self.group_prefix_staff, self.school, self.schoolDN) + + @property def admins(self): + """cn=admins,cn=users,""" return "cn=%s,cn=users,%s" % (self._containerAdmins, self.schoolDN) @property + def admin_group(self): + """cn=admins-%(ou)s,cn=ouadmins,cn=groups, (ou already replaced)""" + return "cn=%s%s,cn=ouadmins,cn=groups,%s" % (self.group_prefix_admins, self.school, self.schoolDN) + + @property def classShares(self): return "cn=%s,cn=shares,%s" % (self._containerClass, self.schoolDN) @@ -288,28 +360,72 @@ @property def educationalDCGroup(self): - return "cn=OU%s-DC-Edukativnetz,cn=ucsschool,cn=groups,%s" % (self.school, self._ldapBase) + """deprecated, please use educational_ou_dc_group""" + return self.educational_ou_dc_group @property def educationalMemberGroup(self): - return "cn=OU%s-Member-Edukativnetz,cn=ucsschool,cn=groups,%s" % (self.school, self._ldapBase) + """deprecated, please use educational_ou_member_group""" + return self.educational_ou_member_group @property def administrativeDCGroup(self): - return "cn=OU%s-DC-Verwaltungsnetz,cn=ucsschool,cn=groups,%s" % (self.school, self._ldapBase) + """deprecated, please use administrative_ou_dc_group""" + return self.administrative_ou_dc_group @property def administrativeMemberGroup(self): - return "cn=OU%s-Member-Verwaltungsnetz,cn=ucsschool,cn=groups,%s" % (self.school, self._ldapBase) + """deprecated, please use administrative_ou_member_group""" + return self.administrative_ou_member_group @property + def administrative_dc_group(self): + """cn=DC-Verwaltungsnetz,cn=ucsschool,cn=groups,""" + return "cn=%s,cn=ucsschool,cn=groups,%s" % (self._all_administrativ_dc, self._ldapBase) + + @property + def administrative_member_group(self): + """cn=Member-Verwaltungsnetz,cn=ucsschool,cn=groups,""" + return "cn=%s,cn=ucsschool,cn=groups,%s" % (self._all_administrativ_member, self._ldapBase) + + @property + def educational_dc_group(self): + """cn=DC-Edukativnetz,cn=ucsschool,cn=groups,""" + return "cn=%s,cn=ucsschool,cn=groups,%s" % (self._all_educational_dc, self._ldapBase) + + @property + def educational_member_group(self): + """cn=Member-Edukativnetz,cn=ucsschool,cn=groups,""" + return "cn=%s,cn=ucsschool,cn=groups,%s" % (self._all_educational_member, self._ldapBase) + + @property + def educational_ou_dc_group(self): + """cn=OU%(ou)s-DC-Edukativnetz,cn=ucsschool,cn=groups, (ou already replaced)""" + return "cn=%s,cn=ucsschool,cn=groups,%s" % (self._ou_educational_dc, self._ldapBase) + + @property + def educational_ou_member_group(self): + """cn=OU%(ou)s-Member-Edukativnetz,cn=ucsschool,cn=groups, (ou already replaced)""" + return "cn=%s,cn=ucsschool,cn=groups,%s" % (self._ou_educational_member, self._ldapBase) + + @property + def administrative_ou_dc_group(self): + """cn=OU%(ou)s-DC-Verwaltungsnetz,cn=ucsschool,cn=groups, (ou already replaced)""" + return "cn=%s,cn=ucsschool,cn=groups,%s" % (self._ou_administrativ_dc, self._ldapBase) + + @property + def administrative_ou_member_group(self): + """cn=OU%(ou)s-Member-Verwaltungsnetz,cn=ucsschool,cn=groups, (ou already replaced)""" + return "cn=%s,cn=ucsschool,cn=groups,%s" % (self._ou_administrativ_member, self._ldapBase) + + @property def examGroupName(self): - ## replace '%(ou)s' strings in generic exam_group_name - ucr_value_keywords = { 'ou': self.school } - return self._examGroupNameTemplate % ucr_value_keywords + """OU%(ou)s-Klassenarbeit (only name, not a DN, ou already replaced)""" + return self._examGroupName @property def examGroup(self): + """cn=OU%(ou)s-Klassenarbeit,cn=ucsschool,cn=groups, (ou already replaced)""" return "cn=%s,cn=ucsschool,cn=groups,%s" % (self.examGroupName, self._ldapBase) def isWorkgroup(self, groupDN): Index: ucs-school-lib/shell/base.sh =================================================================== --- ucs-school-lib/shell/base.sh (Revision 74005) +++ ucs-school-lib/shell/base.sh (Arbeitskopie) @@ -110,7 +110,7 @@ # # $ servers_school_ous -h $(ucr get ldap/master) -p $(ucr get ldap/master/port) # ou=bar,dc=example,dc=com - local ldap_hostdn ldap_base ldap_server ldap_port IFS + local ldap_hostdn ldap_base ldap_server ldap_port IFS res . /usr/share/univention-lib/ucr.sh ldap_base="$(/usr/sbin/univention-config-registry get ldap/base)" @@ -140,10 +140,9 @@ res="" for oudn in $(univention-ldapsearch $ldap_server $ldap_port -xLLL -b "$ldap_base" 'objectClass=ucsschoolOrganizationalUnit' dn | ldapsearch-wrapper | sed -nre 's/^dn: //p') ; do ouname="$(school_ou "$oudn")" - if is_ucr_true ucsschool/singlemaster; then - search_str="(|(cn=OU${ouname}-DC-Edukativnetz)(cn=OU${ouname}-DC-Verwaltungsnetz))" - else - search_str="(&(|(cn=OU${ouname}-DC-Edukativnetz)(cn=OU${ouname}-DC-Verwaltungsnetz))(uniqueMember=${ldap_hostdn}))" + search_str="(|(cn=$(ucr_names_default ucsschool/ldap/default/groupname/ou-educational-dc ${ouname}))(cn=$(ucr_names_default ucsschool/ldap/default/groupname/ou-administrativ-dc OU${ouname})))" + if ! is_ucr_true ucsschool/singlemaster; then + search_str="(&${search_str}(uniqueMember=${ldap_hostdn}))" fi if univention-ldapsearch $ldap_server $ldap_port -xLLL "$search_str" dn | grep -q "^dn: "; then res="$res @@ -152,3 +151,92 @@ done echo -n "${res}" | egrep -v "^\s*$" } + +replace_ou() { + # syntax: replace_ou