Module: check_mk
Branch: master
Commit: b9bc1194cb72d3f652c0c682162e2f20c3791d08
URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=b9bc1194cb72d3…
Author: Lars Michelsen <lm(a)mathias-kettner.de>
Date: Mon Nov 19 16:17:09 2012 +0100
Updated changelog
---
ChangeLog | 17 +++++++++--------
1 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index b14ed34..2e5a7a0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,15 @@
Checks:
* logwatch: Fixed confusion with ignore/ok states of log messages
+ Multisite:
+ * Implemented LDAP integration of Multisite. You can now authenticate your
+ users using the form based authentication with LDAP. It is also possible
+ to synchronize some attributes like mail addresses, names and roles from
+ LDAP into multisite.
+ * Modularized the authentication and user management code in WATO
+ * Restructured cookie auth cookies (all auth cookies will be invalid
+ after update -> all users have to login again)
+ * Modularized login and cookie validation
1.2.1i2:
Core:
@@ -39,14 +48,6 @@
* Allow event expiration also on acknowledged events (configurable)
Multisite:
- * Implemented LDAP integration of Multisite. You can now authenticate your
- users using the form based authentication with LDAP. It is also possible
- to synchronize some attributes like mail addresses, names and roles from
- LDAP into multisite.
- * Modularized the authentication and user management code in WATO
- * Restructured cookie auth cookies (all auth cookies will be invalid
- after update -> all users have to login again)
- * Modularized login and cookie validation
* Enable automation login with _username= and _secret=, while
_secret is the content of var/check_mk/web/$USER/automation.secret
* FIX: Fixed releasing of locks and livestatus connections when logging out
Module: check_mk
Branch: master
Commit: a02cc36390e12f83d2778a51ad090741ea96f1e3
URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=a02cc36390e12f…
Author: Lars Michelsen <lm(a)mathias-kettner.de>
Date: Fri Nov 16 15:39:12 2012 +0100
Restructured LDAP connection settings
---
web/plugins/userdb/ldap.py | 4 +-
web/plugins/wato/check_mk_configuration.py | 42 +++++++++++++--------------
2 files changed, 22 insertions(+), 24 deletions(-)
diff --git a/web/plugins/userdb/ldap.py b/web/plugins/userdb/ldap.py
index a771ccb..00cb989 100644
--- a/web/plugins/userdb/ldap.py
+++ b/web/plugins/userdb/ldap.py
@@ -86,7 +86,7 @@ class MKLDAPException(MKGeneralException):
ldap_connection = None
def ldap_uri():
- if config.ldap_connection.get('use_ssl', False):
+ if 'use_ssl' in config.ldap_connection:
uri = 'ldaps://'
else:
uri = 'ldap://'
@@ -139,7 +139,7 @@ def ldap_connect():
# Bind with the default credentials
def ldap_default_bind():
try:
- if config.ldap_connection['bind']:
+ if 'bind' in config.ldap_connection:
ldap_bind(ldap_replace_macros(config.ldap_connection['bind'][0]),
config.ldap_connection['bind'][1], catch = False)
else:
diff --git a/web/plugins/wato/check_mk_configuration.py b/web/plugins/wato/check_mk_configuration.py
index 5bd68c7..7d68aa9 100644
--- a/web/plugins/wato/check_mk_configuration.py
+++ b/web/plugins/wato/check_mk_configuration.py
@@ -312,10 +312,11 @@ register_configvar(group,
maxvalue = 65535,
default_value = 389,
)),
- ("use_ssl", Checkbox(
- title = _("Use SSL"),
- label = _("SSL encrypted connection"),
- help = _("Connect to the LDAP server with a SSL encrypted connection."),
+ ("use_ssl", FixedValue(
+ title = _("Use SSL"),
+ help = _("Connect to the LDAP server with a SSL encrypted connection."),
+ value = True,
+ totext = _("Encrypt the network connection using SSL."),
)),
("version", Integer(
title = _("LDAP Version"),
@@ -335,22 +336,7 @@ register_configvar(group,
("openldap", _("OpenLDAP")),
],
)),
- ("bind", Optional(
- Tuple(
- elements = [
- LDAPDistinguishedName(
- title = _("Bind DN"),
- help = _("Specify the distinguished name to be used to bind to "
- "the LDAP directory."),
- size = 80,
- ),
- Password(
- title = _("Bind Password"),
- help = _("Specify the password to be used to bind to "
- "the LDAP directory."),
- ),
- ],
- ),
+ ("bind", Tuple(
title = _("LDAP Bind Credentials"),
help = _("Set the credentials to be used to connect to the LDAP server. The "
"used account must not be allowed to do any changes in the directory "
@@ -359,10 +345,22 @@ register_configvar(group,
"case you don't have to configure anything here."
"It must be possible to list all needed user and group objects from the "
"directory."),
- label = _("Specify bind credentials"),
+ elements = [
+ LDAPDistinguishedName(
+ title = _("Bind DN"),
+ help = _("Specify the distinguished name to be used to bind to "
+ "the LDAP directory."),
+ size = 80,
+ ),
+ Password(
+ title = _("Bind Password"),
+ help = _("Specify the password to be used to bind to "
+ "the LDAP directory."),
+ ),
+ ],
)),
],
- optional_keys = [],
+ optional_keys = ['use_ssl', 'bind', ],
),
domain = "multisite",
)
Module: check_mk
Branch: master
Commit: 23c81a9db024f87c1ae2db7884daadf447ff22ef
URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=23c81a9db024f8…
Author: Lars Michelsen <lm(a)mathias-kettner.de>
Date: Mon Nov 19 11:56:57 2012 +0100
ldap: added sync plugin to add user roles depending on group memberships
---
web/htdocs/wato.py | 17 ++++++++---------
web/plugins/userdb/ldap.py | 43 +++++++++++++++++++++++++++++++++++++++++--
2 files changed, 49 insertions(+), 11 deletions(-)
diff --git a/web/htdocs/wato.py b/web/htdocs/wato.py
index 0bfc779..039186f 100644
--- a/web/htdocs/wato.py
+++ b/web/htdocs/wato.py
@@ -8175,6 +8175,7 @@ def mode_edit_user(phase):
forms.section(_("Roles"))
entries = roles.items()
entries.sort(cmp = lambda a,b: cmp((a[1]["alias"],a[0]), (b[1]["alias"],b[0])))
+ is_member_of_at_least_one = False
for role_id, role in entries:
if not is_locked('roles'):
html.checkbox("role_" + role_id, role_id in user.get("roles", []))
@@ -8182,17 +8183,15 @@ def mode_edit_user(phase):
html.write("<a href='%s'>%s</a><br>" % (url, role["alias"]))
else:
is_member = role_id in user.get("roles", [])
- html.hidden_field("role_" + role_id, is_member and '1' or '')
- if not is_member:
- html.write('<i>%s</i>' % _('No roles assigned.'))
- else:
+ if is_member:
+ is_member_of_at_least_one = True
+
url = make_link([("mode", "edit_role"), ("edit", role_id)])
html.write("<a href='%s'>%s</a><br>" % (url, role["alias"]))
- html.help(_("By assigning roles to a user he obtains permissions. "
- "If a user has more than one role, he gets the maximum of all "
- "permissions of his roles. "
- "Users without any role have no permissions to use Multisite at all "
- "but still can be monitoring contacts and receive notifications."))
+
+ html.hidden_field("role_" + role_id, is_member and '1' or '')
+ if not is_member_of_at_least_one:
+ html.write('<i>%s</i>' % _('No roles assigned.'))
# Contact groups
forms.header(_("Contact Groups"), isopen=False)
diff --git a/web/plugins/userdb/ldap.py b/web/plugins/userdb/ldap.py
index 284fdee..9a31d96 100644
--- a/web/plugins/userdb/ldap.py
+++ b/web/plugins/userdb/ldap.py
@@ -248,7 +248,7 @@ def ldap_get_users(add_filter = None):
return result
-def ldap_user_groups(username):
+def ldap_user_groups(username, attr = 'cn'):
user_dn = ldap_get_user_dn(username)
# Apply configured group ldap filter and only reply with groups
@@ -259,7 +259,11 @@ def ldap_user_groups(username):
groups = []
for dn, group in ldap_search(ldap_replace_macros(config.ldap_groupspec['dn']),
filt, ['cn']):
- groups.append(group['cn'][0])
+ if attr == 'cn':
+ groups.append(group['cn'][0])
+
+ elif attr == 'dn':
+ groups.append(dn)
return groups
@@ -440,6 +444,41 @@ ldap_attribute_plugins['groups_to_contactgroups'] = {
'lock_attributes': ['contactgroups'],
}
+def ldap_convert_groups_to_roles(params, user_id, ldap_user, user):
+ groups = []
+ # 1. Fetch DNs of all LDAP groups of the user
+ ldap_groups = [ g.lower() for g in ldap_user_groups(user_id, 'dn') ]
+
+ # 2. Loop all roles mentioned in params (configured to be synchronized)
+ roles = []
+ for role_id, dn in params.items():
+ if dn.lower() in ldap_groups:
+ roles.append(role_id)
+
+ return {'roles': roles}
+
+def ldap_list_roles_with_group_dn():
+ import wato
+ roles = wato.load_roles()
+
+ elements = []
+ for role_id, role in wato.load_roles().items():
+ elements.append((role_id, LDAPDistinguishedName(
+ title = role['alias'] + ' - ' + _("Specify the Group DN"),
+ help = _("Distinguished Name of the LDAP group to add users this role."),
+ size = 80,
+ )))
+ return elements
+
+ldap_attribute_plugins['groups_to_roles'] = {
+ 'title': _('Roles'),
+ 'help': _('Configures the roles of the user depending on its group memberships '
+ 'in LDAP.'),
+ 'convert': ldap_convert_groups_to_roles,
+ 'lock_attributes': ['roles'],
+ 'parameters': ldap_list_roles_with_group_dn,
+}
+
# .----------------------------------------------------------------------.
# | _ _ _ |
# | | | | | ___ ___ | | _____ |
Module: check_mk
Branch: master
Commit: 2fc1da1610e5af767c225dfdbaca89925123a45f
URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=2fc1da1610e5af…
Author: Lars Michelsen <lm(a)mathias-kettner.de>
Date: Tue Nov 20 15:24:30 2012 +0100
ldap: removed invalid default value
---
web/plugins/wato/check_mk_configuration.py | 1 -
1 files changed, 0 insertions(+), 1 deletions(-)
diff --git a/web/plugins/wato/check_mk_configuration.py b/web/plugins/wato/check_mk_configuration.py
index eb4fa59..a9daf3d 100644
--- a/web/plugins/wato/check_mk_configuration.py
+++ b/web/plugins/wato/check_mk_configuration.py
@@ -458,7 +458,6 @@ register_configvar(group,
'or disabled. When enabling a plugin, it is used upon the next synchonisation of '
'user accounts for gathering their attributes. The user options which get imported '
'into Check_MK from LDAP will be locked in WATO.'),
- default_value = [ 'email', 'cn_to_alias', 'auth_expire' ],
elements = userdb.ldap_attribute_plugins_elements,
),
domain = "multisite",