263 lines
7.6 KiB
Python
263 lines
7.6 KiB
Python
"""
|
|
This module defines `Celery`_ tasks to manage LDAP entities.
|
|
|
|
.. _Celery: http://www.celeryproject.org/
|
|
|
|
"""
|
|
|
|
from __future__ import absolute_import
|
|
|
|
from django.core.exceptions import ObjectDoesNotExist
|
|
from celery import shared_task
|
|
from celery.utils.log import get_task_logger
|
|
from celery.exceptions import Reject
|
|
|
|
from ldapentities.models import (
|
|
LdapGroup,
|
|
LdapUser,
|
|
)
|
|
|
|
|
|
_logger = get_task_logger(__name__)
|
|
|
|
|
|
@shared_task
|
|
def create_ldap_group(groupname, gid, descr):
|
|
"""
|
|
This task creates an :py:class:`LDAP group <ldapentities.models.LdapGroup>`
|
|
if it does not exist yet.
|
|
|
|
If a group with the given name exists its group id and description
|
|
attributes are updated.
|
|
|
|
:param str groupname: the group name
|
|
:param int gid: the group id
|
|
:param str descr: description text for the group
|
|
:return: the distinguished name of the group
|
|
:rtype: str
|
|
"""
|
|
try:
|
|
ldapgroup = LdapGroup.objects.get(name=groupname)
|
|
_logger.info(
|
|
'ldap group with dn {0} already exists'.format(ldapgroup.dn)
|
|
)
|
|
ldapgroup.gid = gid
|
|
except LdapGroup.DoesNotExist:
|
|
ldapgroup = LdapGroup(gid=gid, name=groupname)
|
|
ldapgroup.description = descr
|
|
ldapgroup.save()
|
|
return ldapgroup.dn
|
|
|
|
|
|
@shared_task
|
|
def create_ldap_user(username, uid, gid, gecos, homedir, shell, password):
|
|
"""
|
|
This task creates an :py:class:`LDAP user <ldapentities.models.LdapUser>`
|
|
if it does not exist yet.
|
|
|
|
The task is rejected if the primary group of the user is not defined.
|
|
|
|
The user's fields are updated if the user already exists.
|
|
|
|
:param str username: the user name
|
|
:param int uid: the user id
|
|
:param int gid: the user's primary group's id
|
|
:param str gecos: the text for the GECOS field
|
|
:param str homedir: the user's home directory
|
|
:param str shell: the user's login shell
|
|
:param str or None password: the clear text password, if :py:const:`None`
|
|
is passed the password is not touched
|
|
:raises celery.exceptions.Reject: if the specified primary group does not
|
|
exist
|
|
:return: the distinguished name of the user
|
|
:rtype: str
|
|
|
|
"""
|
|
try:
|
|
ldapuser = LdapUser.objects.get(username=username)
|
|
_logger.info(
|
|
'ldap user with dn {0} already exists'.format(ldapuser.dn)
|
|
)
|
|
except LdapUser.DoesNotExist:
|
|
ldapuser = LdapUser(username=username)
|
|
try:
|
|
ldapgroup = LdapGroup.objects.get(gid=gid)
|
|
except ObjectDoesNotExist as exc:
|
|
_logger.info('ldap group with gid {0} does not exist')
|
|
raise Reject(exc, requeue=False)
|
|
ldapuser.uid = uid
|
|
ldapuser.group = gid
|
|
ldapuser.gecos = gecos
|
|
ldapuser.home_directory = homedir
|
|
ldapuser.login_shell = shell
|
|
ldapuser.username = username
|
|
ldapuser.common_name = username
|
|
if password is not None:
|
|
ldapuser.set_password(password)
|
|
if ldapuser.username in ldapgroup.members:
|
|
_logger.info('user {0} is already member of {1}'.format(
|
|
ldapuser.username, ldapgroup.dn)
|
|
)
|
|
else:
|
|
ldapgroup.members.append(ldapuser.username)
|
|
ldapgroup.save()
|
|
ldapuser.save()
|
|
return ldapuser.dn
|
|
|
|
|
|
@shared_task(bind=True)
|
|
def set_ldap_user_password(self, username, password):
|
|
"""
|
|
This task sets the password of an existing :py:class:`LDAP user
|
|
<ldapentities.models.LdapUser>`.
|
|
|
|
:param str username: the user name
|
|
:param str password: teh clear text password
|
|
:return: :py:const:`True` if the password has been set, :py:const:`False`
|
|
if the user does not exist.
|
|
|
|
"""
|
|
try:
|
|
ldapuser = LdapUser.objects.get(username=username)
|
|
except LdapUser.DoesNotExist:
|
|
return False
|
|
ldapuser.set_password(password)
|
|
ldapuser.save()
|
|
return True
|
|
|
|
|
|
@shared_task(bind=True)
|
|
def add_ldap_user_to_group(self, username, groupname):
|
|
"""
|
|
This task adds the specified user to the given group.
|
|
|
|
This task does nothing if the user is already member of the group.
|
|
|
|
:param str username: the user name
|
|
:param str groupname: the group name
|
|
:raises celery.exceptions.Retry: if the user does not exist yet,
|
|
:py:func:`create_ldap_user` should be called before
|
|
:return: True if the user has been added to the group otherwise False
|
|
:rtype: boolean
|
|
|
|
"""
|
|
try:
|
|
ldapgroup = LdapGroup.objects.get(name=groupname)
|
|
ldapuser = LdapUser.objects.get(username=username)
|
|
except LdapGroup.DoesNotExist:
|
|
_logger.error('ldap group {0} does not exist'.format(groupname))
|
|
except LdapUser.DoesNotExist as exc:
|
|
_logger.error('ldap user {0} does not exist'.format(username))
|
|
self.retry(exc=exc, time_limit=5)
|
|
else:
|
|
if not ldapuser.username in ldapgroup.members:
|
|
ldapgroup.members.append(ldapuser.username)
|
|
ldapgroup.save()
|
|
else:
|
|
_logger.info('ldap user {0} is already in group {1}'.format(
|
|
ldapuser.username, ldapgroup.dn)
|
|
)
|
|
return True
|
|
return False
|
|
|
|
|
|
@shared_task
|
|
def remove_ldap_user_from_group(username, groupname):
|
|
"""
|
|
This task removes the given user from the given group.
|
|
|
|
:param str username: the user name
|
|
:param str groupname: the group name
|
|
:return: True if the user has been removed, False otherwise
|
|
:rtype: boolean
|
|
|
|
"""
|
|
ldapgroup = LdapGroup.objects.get(name=groupname)
|
|
ldapuser = LdapUser.objects.get(username=username)
|
|
performdelete = ldapuser.username in ldapgroup.members
|
|
if performdelete:
|
|
ldapgroup.members.remove(ldapuser.username)
|
|
ldapgroup.save()
|
|
return performdelete
|
|
|
|
|
|
@shared_task
|
|
def delete_ldap_user(username):
|
|
"""
|
|
This task deletes the given user.
|
|
|
|
:param str username: the user name
|
|
:return: True if the user has been deleted, False otherwise
|
|
:rtype: boolean
|
|
|
|
"""
|
|
try:
|
|
ldapuser = LdapUser.objects.get(username=username)
|
|
except LdapUser.DoesNotExist:
|
|
_logger.info('there is no ldap user with uid {0}'.format(
|
|
username)
|
|
)
|
|
else:
|
|
try:
|
|
ldapgroup = LdapGroup.objects.get(gid=ldapuser.group)
|
|
except LdapGroup.DoesNotExist:
|
|
_logger.info('group {0} for user {1} does not exist'.format(
|
|
ldapuser.group, ldapuser.username)
|
|
)
|
|
else:
|
|
if ldapuser.username in ldapgroup.members:
|
|
ldapgroup.members.remove(ldapuser.username)
|
|
ldapgroup.save()
|
|
ldapuser.delete()
|
|
return True
|
|
return False
|
|
|
|
|
|
@shared_task
|
|
def delete_ldap_group_if_empty(groupname):
|
|
"""
|
|
This task deletes the given group.
|
|
|
|
:param str groupname: the group name
|
|
:return: True if the user has been deleted, False otherwise
|
|
:rtype: boolean
|
|
|
|
"""
|
|
try:
|
|
ldapgroup = LdapGroup.objects.get(name=groupname)
|
|
except LdapGroup.DoesNotExist:
|
|
_logger.info('ldap group with name {0} does not exist'.format(
|
|
groupname)
|
|
)
|
|
else:
|
|
if len(ldapgroup.members) == 0:
|
|
ldapgroup.delete()
|
|
return True
|
|
else:
|
|
_logger.info('ldap group {0} still has {1} members'.format(
|
|
ldapgroup.dn, len(ldapgroup.members))
|
|
)
|
|
return False
|
|
|
|
|
|
@shared_task
|
|
def delete_ldap_group(groupname):
|
|
"""
|
|
This taks deletes the given group.
|
|
|
|
:param str groupname: the group name
|
|
:return: True if the user has been deleted, False otherwise
|
|
:rtype: boolean
|
|
|
|
"""
|
|
try:
|
|
ldapgroup = LdapGroup.objects.get(name=groupname)
|
|
except LdapGroup.DoesNotExist:
|
|
_logger.info('ldap group with name {0} does not exist'.format(
|
|
groupname)
|
|
)
|
|
else:
|
|
ldapgroup.delete()
|
|
return True
|
|
return False
|