smeserver/smeserver-ibays
6
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

* Sat May 18 2024 Jean-Philippe Pialasse <jpp@koozali.org> 11.0.0-7.sme

Browse Source 
- edit LDAP entries using Net::LDAP rather than cpu [SME: 12687]
This commit is contained in:
Jean-Philippe Pialasse
2024-05-18 14:07:19 -04:00
parent 0e72a182b7
commit 1d67d9bd64
3 changed files with 169 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

124
root/etc/e-smith/events/actions/ibay-modify
View File

@@ -2,6 +2,7 @@
#----------------------------------------------------------------------
# copyright (C) 1999-2005 Mitel Networks Corporation
# copyright (C) 2024 Koozali foundation inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -27,6 +28,7 @@ use esmith::util;
use esmith::templates;
use esmith::AccountsDB;
use esmith::ConfigDB;
use Net::LDAP;
my $conf = esmith::ConfigDB->open_ro
or die "Could not open Config DB";
@@ -34,6 +36,23 @@ my $conf = esmith::ConfigDB->open_ro
my $ldapauth = $conf->get('ldap')->prop('Authentication') || 'disabled';
my $x = 0; # exit value
my $domain = $conf->get('DomainName')
|| die("Couldn't determine domain name");
$domain = $domain->value;
my $result;
# prepare LDAP bind
my $pw = esmith::util::LdapPassword();
my $base = esmith::util::ldapBase ($domain);
my $ldap = Net::LDAP->new('localhost')
or die "$@";
$ldap->bind(
dn => "cn=root,$base",
password => $pw
);
$ENV{'PATH'} = "/bin";
my $event = $ARGV [0];
@@ -54,8 +73,9 @@ if ($event eq 'ibay-create')
# Check the Unix account.
#------------------------------------------------------------
# Create the ibay's unique group first
#------------------------------------------------------------
# create unix user and group account, unless we switch to ldap authentication
#------------------------------------------------------------
if ($ldapauth ne 'enabled')
{
system(
@@ -85,31 +105,49 @@ if ($event eq 'ibay-create')
) == 0 or ( $x = 255, warn "Failed to create (unix) account $ibayName.\n" );
}
system(
"/usr/sbin/cpu", "-C/etc/cpu-system.conf", "groupadd",
"-g",
$ibay->prop("Gid"),
$ibayName
) == 0 or ( $x = $ldapauth ne 'enabled' ? $x : 255, warn "Failed to create (ldap) group $ibayName.\n" );
system(
"/usr/sbin/cpu", "-C/etc/cpu-system.conf", "useradd",
"-u",
$ibay->prop("Uid"),
"-g",
$ibay->prop("Gid"),
"-c",
$ibay->prop("Name"),
"-d",
"/home/e-smith/files/ibays/$ibayName/files",
"-G",
"shared,"
. $ibay->prop("Group"),
"-s",
"/bin/false",
"$ibayName"
) == 0 or ( $x = $ldapauth ne 'enabled' ? $x : 255, warn "Failed to create (ldap) account $ibayName.\n" );
#------------------------------------------------------------
# add new ibay group to ldap
#------------------------------------------------------------
$result = $ldap->add("cn=$ibayName,ou=Groups,$base",
attrs => [
"cn"=> $ibayName,
"gidNumber"=> $ibay->prop("Gid"),
"objectClass" => [ 'posixGroup', 'mailboxRelatedObject']
]);
$result->code && ( $x = $ldapauth ne 'enabled' ? $x : 255, warn "Failed to create (ldap) group $ibayName.\n" );
#------------------------------------------------------------
# add new ibay user to ldap
#------------------------------------------------------------
$result = $ldap->add("uid=$ibayName,ou=Users,$base",
attrs => [
"uidNumber" => $ibay->prop("Uid"),
"gidNumber" => $ibay->prop("Gid"),
"cn" => $ibay->prop("Name"),
"objectClass" => [ 'account', 'posixAccount', 'shadowAccount'],
"homeDirectory" => "/home/e-smith/files/ibays/$ibayName",
"loginShell" => "/bin/false",
"shadowExpire" => -1,
"shadowFlag" => 134538308,
"shadowInactive" => -1,
"shadowLastChange" => 15997,
"shadowMax" => 99999,
"shadowMin" => -1,
"shadowWarning"=> 7,
]
);
$result->code && ( $x = $ldapauth ne 'enabled' ? $x : 255, warn "Failed to create (ldap) account $ibayName.\n" );
#------------------------------------------------------------
# Loop to add new user to groups "shared,". $ibay->prop("Group")
#------------------------------------------------------------
foreach my $grp ( 'shared', $ibay->prop("Group") ) {
$result = $ldap->modify("cn=$grp,ou=Groups,$base",
add => {
"memberUid"=> [ $ibay->prop("Uid")]
});
# error code 20 is entry already exits.
$result->code && ( $result->code != 20 ) && ( $x = $ldapauth ne 'enabled' ? $x : 255, warn "Failed to add (ldap) account $ibayName to supplementary group $grp.\n" );
}
#------------------------------------------------------------
# Create the ibay files and set the password.
#------------------------------------------------------------
@@ -130,15 +168,18 @@ if ($event eq 'ibay-create')
or ( $x = 255, warn "Error locking (unix) account $ibayName" );
}
system("/usr/sbin/cpu", "-C/etc/cpu-system.conf", "usermod", "-L", $ibayName) == 0
or ( $x = $ldapauth ne 'enabled' ? $x : 255, warn "Error locking (ldap) account $ibayName" );
#------------------------------------------------------------
# lock password in ldap
#------------------------------------------------------------
$result = $ldap->modify("uid=$ibayName,ou=Users,$base",
replace => { 'userPassword' => "{crypt}!*"});
$result->code && ( $x = $ldapauth ne 'enabled' ? $x : 255, warn "Error locking (ldap) account $ibayName.\n" );
}
elsif ($event eq 'ibay-modify' and $ibayName ne 'Primary')
{
#------------------------------------------------------------
# Modify ibay description in /etc/passwd using "usermod"
#------------------------------------------------------------
if ($ldapauth ne 'enabled')
{
system("/usr/sbin/usermod", "-c", $ibay->prop("Name"),
@@ -146,9 +187,28 @@ elsif ($event eq 'ibay-modify' and $ibayName ne 'Primary')
or ( $x = 255, warn "Failed to modify (unix) account $ibayName.\n" );
}
system("/usr/sbin/cpu", "-C/etc/cpu-system.conf", "usermod", "-c", $ibay->prop("Name"),
"-G", "shared," . $ibay->prop("Group"), "$ibayName") == 0
or ( $x = $ldapauth ne 'enabled' ? $x : 255, warn "Failed to modify (ldap) account $ibayName.\n" );
#------------------------------------------------------------
# Modify ibay description in ldap"
#------------------------------------------------------------
$result = $ldap->modify("uid=$ibayName,ou=Users,$base",
replace => {
"cn" => $ibay->prop("Name"),
}
);
$result->code && ( $x = $ldapauth ne 'enabled' ? $x : 255, warn "Failed to modify email of (ldap) account $ibayName.\n" );
#------------------------------------------------------------
# Loop to add new user to groups "shared,". $ibay->prop("Group")
#------------------------------------------------------------
foreach my $grp ( 'shared', $ibay->prop("Group") ) {
$result = $ldap->modify("cn=$grp,ou=Groups,$base",
add=> {
"memberUid"=> [ $ibay->prop("Uid")]
} );
# error code 20 is entry already exits.
$result->code && ( $result->code != 20 ) && ( $x = $ldapauth ne 'enabled' ? $x : 255, warn "Failed to add (ldap) account $ibayName to supplementary group $grp.\n" );
}
}
#------------------------------------------------------------