Checkmk git commits December 2013

checkmk-commits@lists.checkmk.com

6 participants
316 discussions

Check_MK Git: check_mk: FIX UserDB: Fixed lost passwords when changing users in large user databases

by Lars Michelsen

Module: check_mk Branch: master Commit: 2331d5dc8a487116a8a384b5af6afa6c50fe32e9 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=2331d5dc8a4871… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Fri Dec 20 13:27:45 2013 +0100 FIX UserDB: Fixed lost passwords when changing users in large user databases This issue affects local users whose passwords are stored in the local htpasswd file. When saving users after modification, the htpasswd file might corrupt and invalidate all passwords of all users. This has been fixed now. --- .werks/421 | 13 +++++++++++++ ChangeLog | 1 + web/plugins/userdb/htpasswd.py | 5 ++++- 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/.werks/421 b/.werks/421 new file mode 100644 index 0000000..ba5364c --- /dev/null +++ b/.werks/421 @@ -0,0 +1,13 @@ +Title: UserDB: Fixed lost passwords when changing users in large user databases +Level: 1 +Component: multisite +Class: fix +State: unknown +Version: 1.2.5i1 +Date: 1387542360 +Targetversion: future + +This issue affects local users whose passwords are stored in the local htpasswd +file. When saving users after modification, the htpasswd file might corrupt and +invalidate all passwords of all users. This has been fixed now. + diff --git a/ChangeLog b/ChangeLog index 2f8830e..d2cb01b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -95,6 +95,7 @@ * 0394 FIX: LDAP: Auth expiration plugin now checks users for being disabled (in AD)... * 0436 FIX: Fix broken Site status switching via sidebar snapin... * 0420 FIX: LDAP: Roles/Groups are now synced even if case of DNs do not match... + * 0421 FIX: UserDB: Fixed lost passwords when changing users in large user databases... WATO: * 0308 Multisite can now set rotation view permissions for NagVis... diff --git a/web/plugins/userdb/htpasswd.py b/web/plugins/userdb/htpasswd.py index f65b8ab..883e3f1 100644 --- a/web/plugins/userdb/htpasswd.py +++ b/web/plugins/userdb/htpasswd.py @@ -107,7 +107,8 @@ def htpasswd_save(users): # users from htpasswd are lost. If you start managing users with # WATO, you should continue to do so or stop doing to for ever... # Locked accounts get a '!' before their password. This disable it. - out = create_user_file(defaults.htpasswd_file, "w") + filename = defaults.htpasswd_file + '.new' + out = create_user_file(filename, "w") for id, user in users.items(): # only process users which are handled by htpasswd connector if user.get('connector', 'htpasswd') != 'htpasswd': @@ -119,6 +120,8 @@ def htpasswd_save(users): else: locksym = "" out.write("%s:%s%s\n" % (id, locksym, user["password"])) + out.close() + os.rename(filename, filename[:-4]) multisite_user_connectors.append({ 'id': 'htpasswd',

10 years, 6 months

Check_MK Git: check_mk: FIX Fixed error on creating very large WATO snapshots

by Andreas Boesl

Module: check_mk Branch: master Commit: 3ece33ae4f513330877462eaa8cf1d7ecb8d6e35 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=3ece33ae4f5133… Author: Andreas Boesl <ab(a)mathias-kettner.de> Date: Fri Dec 20 13:16:01 2013 +0100 FIX Fixed error on creating very large WATO snapshots The snapshot creating process could crash when the data in the snapshots exceeds several gigabytes. --- .werks/250 | 10 ++++++++++ ChangeLog | 1 + modules/automation.py | 27 ++++++++++++++++++--------- 3 files changed, 29 insertions(+), 9 deletions(-) diff --git a/.werks/250 b/.werks/250 new file mode 100644 index 0000000..1e14255 --- /dev/null +++ b/.werks/250 @@ -0,0 +1,10 @@ +Title: Fixed error on creating very large WATO snapshots +Level: 1 +Component: wato +Class: fix +State: unknown +Version: 1.2.5i1 +Date: 1387541661 +Targetversion: future + +The snapshot creating process could crash when the data in the snapshots exceeds several gigabytes. diff --git a/ChangeLog b/ChangeLog index 9f0ec40..969a8a8 100644 --- a/ChangeLog +++ b/ChangeLog @@ -127,6 +127,7 @@ * 0418 FIX: LDAP: Fixed broken role sync plugin with OpenLDAP... * 0419 FIX: LDAP: The default user profile roles are only assigned to users without roles... * 0249 FIX: Backup & Restore: fixed bug when uploading legacy snapshots... + * 0250 FIX: Fixed error on creating very large WATO snapshots... Notifications: * 0362 sms: now searching PATH for sendsms and smssend commands... diff --git a/modules/automation.py b/modules/automation.py index cc86a98..f54b76d 100644 --- a/modules/automation.py +++ b/modules/automation.py @@ -768,7 +768,7 @@ def automation_create_snapshot(args): filename_work = "%s/%s.work" % (work_dir, snapshot_name) filename_status = "%s/%s.status" % (work_dir, snapshot_name) filename_pid = "%s/%s.pid" % (work_dir, snapshot_name) - filename_subtar = "%s/%s.subtar" % (work_dir, snapshot_name) + filename_subtar = "" current_domain = "" file(filename_target, "w").close() @@ -788,7 +788,7 @@ def automation_create_snapshot(args): statusfile.write("%s:%s\n" % status) lock_status_file.release() - # Set intitial status info + # Set initial status info statusinfo = {} for name in data.get("domains", {}).keys(): statusinfo[name] = "TODO" @@ -819,7 +819,7 @@ def automation_create_snapshot(args): def cleanup(): for filename in [filename_work, filename_status, filename_pid, filename_subtar]: - if os.path.exists(filename): + if filename and os.path.exists(filename): os.unlink(filename) def check_should_abort(): @@ -863,6 +863,9 @@ def automation_create_snapshot(args): tarinfo.size = len(snapshot_type) tar_in_progress.addfile(tarinfo, cStringIO.StringIO(snapshot_type)) + # Close tar in progress, all other files are included via command line tar + tar_in_progress.close() + # Process domains (sorted) subtar_update_thread = thread.start_new_thread(update_subtar_size, (1,)) domains = map(lambda x: x, data.get("domains").items()) @@ -876,22 +879,28 @@ def automation_create_snapshot(args): paths = map(lambda x: x[1] == "" and "." or x[1], paths) - command = "cd %s ; tar czf %s --force-local -C %s %s" % (prefix, filename_subtar, prefix, " ".join(paths)) + # Create tar.gz subtar + filename_subtar = "%s.tar.gz" % name + command = "cd %s ; tar czf %s --ignore-failed-read --force-local -C %s %s" % (work_dir, filename_subtar, prefix, " ".join(paths)) proc = subprocess.Popen(command, shell=True) proc.wait() - tarinfo = get_basic_tarinfo("%s.tar.gz" %name) - tarinfo.size = os.stat(filename_subtar).st_size + subtar_size = os.stat("%s/%s" % (work_dir, filename_subtar)).st_size + + # Append tar.gz subtar to snapshot + command = "cd %s ; tar --append --file=%s %s ; rm %s" % (work_dir, filename_work, filename_subtar, filename_subtar) + proc = subprocess.Popen(command, shell=True) + proc.wait() current_domain = "" - tar_in_progress.addfile(tarinfo, file(filename_subtar)) - update_status_file(name, "Finished / Size: %d" % tarinfo.size) + update_status_file(name, "Finished / Size: %d" % subtar_size) current_domain = None - tar_in_progress.close() shutil.move(filename_work, filename_target) cleanup() except Exception, e: raise MKAutomationError(str(e)) + +

10 years, 6 months

Check_MK Git: check_mk: uptime.include: fixed cleanups

by Bernd Stroessenreuther

Module: check_mk Branch: master Commit: 8b93187a8fd2888880863096fdedfd7e177ae1cc URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=8b93187a8fd288… Author: Bernd Stroessenreuther <bs(a)mathias-kettner.de> Date: Fri Dec 20 11:56:22 2013 +0100 uptime.include: fixed cleanups --- checks/uptime.include | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checks/uptime.include b/checks/uptime.include index 0d7a43c..0effeb6 100644 --- a/checks/uptime.include +++ b/checks/uptime.include @@ -31,7 +31,7 @@ # "max" : ( 86400 * 7, 86400 * 14), # Maximum required uptime (warn, crit) # } -def check_uptime_sec(params, uptime_sec): +def check_uptime_seconds(params, uptime_sec): seconds = uptime_sec % 60 rem = uptime_sec / 60 minutes = rem % 60

10 years, 6 months

Check_MK Git: check_mk: Fixed typo

by Bastian Kuhn

Module: check_mk Branch: master Commit: bd2b2cf970434a2a598705c0dc5990fe615028b2 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=bd2b2cf970434a… Author: Bastian Kuhn <bk(a)mathias-kettner.de> Date: Fri Dec 20 11:33:54 2013 +0100 Fixed typo --- web/plugins/wato/check_mk_configuration.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/plugins/wato/check_mk_configuration.py b/web/plugins/wato/check_mk_configuration.py index 3d4b34d..efb2a88 100644 --- a/web/plugins/wato/check_mk_configuration.py +++ b/web/plugins/wato/check_mk_configuration.py @@ -1865,7 +1865,7 @@ group = "monconf/" + _("Various") register_rule(group, "clustered_services_mapping", TextAscii( - title = _("Explicit mapping of Clusterd Services"), + title = _("Explicit mapping of Clustered Services"), help = _( "It's possible to have overlaping nodes between multiple clusters." "With this rule the direct mapping of services from nodes to the " "favored Cluster can be done."),

10 years, 6 months

Check_MK Git: check_mk: FIX Backup & Restore: fixed bug when uploading legacy snapshots

by Andreas Boesl

Module: check_mk Branch: master Commit: 2f0a4f6e6a994c2b076c6172af41c8c64b7b2b2a URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=2f0a4f6e6a994c… Author: Andreas Boesl <ab(a)mathias-kettner.de> Date: Fri Dec 20 11:19:51 2013 +0100 FIX Backup & Restore: fixed bug when uploading legacy snapshots Uploaded legacy snapshots couldn't get classified correctly as tar.gz files, which resulted in an extraction error. --- .werks/249 | 11 +++++++++++ ChangeLog | 1 + web/htdocs/multitar.py | 2 +- web/htdocs/wato.py | 26 ++++++++++++++++---------- 4 files changed, 29 insertions(+), 11 deletions(-) diff --git a/.werks/249 b/.werks/249 new file mode 100644 index 0000000..b38d5e8 --- /dev/null +++ b/.werks/249 @@ -0,0 +1,11 @@ +Title: Backup & Restore: fixed bug when uploading legacy snapshots +Level: 1 +Component: wato +Class: fix +State: unknown +Version: 1.2.5i1 +Date: 1387534673 +Targetversion: future + +Uploaded legacy snapshots couldn't get classified correctly as tar.gz files, +which resulted in an extraction error. diff --git a/ChangeLog b/ChangeLog index 2f8830e..aa9aadf 100644 --- a/ChangeLog +++ b/ChangeLog @@ -125,6 +125,7 @@ * 0248 FIX: Backup & Restore: Snapshot comments now support unicode character... * 0418 FIX: LDAP: Fixed broken role sync plugin with OpenLDAP... * 0419 FIX: LDAP: The default user profile roles are only assigned to users without roles... + * 0249 FIX: Backup & Restore: fixed bug when uploading legacy snapshots... Notifications: * 0362 sms: now searching PATH for sendsms and smssend commands... diff --git a/web/htdocs/multitar.py b/web/htdocs/multitar.py index a4a0204..8ad5098 100644 --- a/web/htdocs/multitar.py +++ b/web/htdocs/multitar.py @@ -131,7 +131,7 @@ def extract_domains(tar, domains): else: return check_exists_or_writable(path_tokens[:-1]) - # The complete tar.gz file never fits in stringIO buffer.. + # The complete tar file never fits in stringIO buffer.. tar.extract(tar_member, restore_dir) subtar = tarfile.open("%s/%s" % (restore_dir, tar_member.name)) diff --git a/web/htdocs/wato.py b/web/htdocs/wato.py index b99c916..f30546b 100644 --- a/web/htdocs/wato.py +++ b/web/htdocs/wato.py @@ -5525,15 +5525,18 @@ def get_snapshot_status(name): file_info[name] = { "size" :info } status["files"] = file_info else: # tarfile is finished, read comment + # Determine snapshot type: legacy / new + is_legacy_snapshot = True + try: + tarfile.open(snapshot_dir + name, "r:gz") + except: + is_legacy_snapshot = False + # Legacy snapshots - if name.endswith(".tar.gz"): + if is_legacy_snapshot: status["type"] = "legacy" status["type_text"] = _("Snapshot created with old version") status["comment"] = _("Snapshot created with old version") - try: - tarfile.open(snapshot_dir + name, "r:gz").getmembers() - except: - raise # New snapshots else: status["files"] = multitar.list_tar_content(snapshot_dir + name) @@ -5548,10 +5551,12 @@ def get_snapshot_status(name): status["type"] = "legacy" status["type_text"] = _("Snapshot created with old version") status["comment"] = _("Snapshot created with old version") - try: - tarfile.open(snapshot_dir + name, "r").getmembers() - except: - raise + try: + # Simple validity check - try to read snapshot content + # Note: Opening it with "r" works on tar and tar.gz + tarfile.open(snapshot_dir + name, "r").getmembers() + except: + raise except: status["broken"] = True pass @@ -5756,7 +5761,8 @@ def mode_snapshot(phase): html.attrencode(snapshot_file) ) if c: - if snapshot_file.endswith(".tar.gz"): # Old snapshot type + status = get_snapshot_status(snapshot_file) + if status["type"] == "legacy": multitar.extract_from_file(snapshot_dir + snapshot_file, backup_paths) else: multitar.extract_from_file(snapshot_dir + snapshot_file, backup_domains)

10 years, 6 months

Check_MK Git: check_mk: Explicit mapping of clustered services can now be done with Wato.

by Bastian Kuhn

Module: check_mk Branch: master Commit: 00a1654a397f1ae089792ec4fa48a878df4e094b URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=00a1654a397f1a… Author: Bastian Kuhn <bk(a)mathias-kettner.de> Date: Fri Dec 20 11:19:39 2013 +0100 Explicit mapping of clustered services can now be done with Wato. --- .werks/112 | 8 ++++++++ ChangeLog | 1 + web/plugins/wato/check_mk_configuration.py | 7 ++++++- 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/.werks/112 b/.werks/112 new file mode 100644 index 0000000..31e4e7c --- /dev/null +++ b/.werks/112 @@ -0,0 +1,8 @@ +Title: Explicit mapping of clustered services can now be done with Wato. +Level: 1 +Component: wato +Version: 1.2.5i1 +Date: 1387534743 +Class: feature + + diff --git a/ChangeLog b/ChangeLog index 2f8830e..21f9ab6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -102,6 +102,7 @@ NOTE: Please refer to the migration notes! * 0244 New features for WATO page Backup & Restore... * 0382 Active HTTP check now supports multiline regexp matching... + * 0112 Explicit mapping of clustered services can now be done with Wato. * 0057 FIX: Fix exception in WATO host editor on custom tag without topic... * 0241 FIX: Improved sorting of WATO folders in dropdown menu... * 0019 FIX: Fixed wording in WATO rule for MSSQL check diff --git a/web/plugins/wato/check_mk_configuration.py b/web/plugins/wato/check_mk_configuration.py index e7f39d0..3d4b34d 100644 --- a/web/plugins/wato/check_mk_configuration.py +++ b/web/plugins/wato/check_mk_configuration.py @@ -1864,7 +1864,12 @@ group = "monconf/" + _("Various") register_rule(group, "clustered_services_mapping", - TextAscii( title = _("Clustered services of") ), + TextAscii( + title = _("Explicit mapping of Clusterd Services"), + help = _( "It's possible to have overlaping nodes between multiple clusters." + "With this rule the direct mapping of services from nodes to the " + "favored Cluster can be done."), + ), itemtype = "service", )

10 years, 6 months

Check_MK Git: check_mk: First proof of concept for clustered_service_of in wato

by Bastian Kuhn

Module: check_mk Branch: master Commit: 09f5dcdba82d4892d02ea049ba3e3a6f9649949e URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=09f5dcdba82d48… Author: Bastian Kuhn <bk(a)mathias-kettner.de> Date: Fri Dec 20 10:38:54 2013 +0100 First proof of concept for clustered_service_of in wato --- modules/check_mk.py | 5 +++++ web/plugins/wato/check_mk_configuration.py | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/modules/check_mk.py b/modules/check_mk.py index 97e4228..92e4316 100755 --- a/modules/check_mk.py +++ b/modules/check_mk.py @@ -309,6 +309,7 @@ timeperiods = {} # needed for WATO clusters = {} clustered_services = [] clustered_services_of = {} # new in 1.1.4 +clustered_services_mapping = [] # new for 1.2.5i1 Wato Rule datasource_programs = [] service_aggregations = [] service_dependencies = [] @@ -944,6 +945,10 @@ def host_of_clustered_service(hostname, servicedesc): if not the_clusters: return hostname + cluster_mapping = service_extra_conf(hostname, servicedesc, clustered_services_mapping) + if cluster_mapping: + return cluster_mapping[0] + # 1. New style: explicitly assigned services for cluster, conf in clustered_services_of.items(): nodes = nodes_of(cluster) diff --git a/web/plugins/wato/check_mk_configuration.py b/web/plugins/wato/check_mk_configuration.py index 7c75551..e7f39d0 100644 --- a/web/plugins/wato/check_mk_configuration.py +++ b/web/plugins/wato/check_mk_configuration.py @@ -1863,6 +1863,12 @@ register_rule(group, group = "monconf/" + _("Various") register_rule(group, + "clustered_services_mapping", + TextAscii( title = _("Clustered services of") ), + itemtype = "service", + ) + +register_rule(group, "extra_host_conf:service_period", TimeperiodSelection( title = _("Service period for hosts"),

10 years, 6 months

Check_MK Git: check_mk: FIX LDAP: Roles/ Groups are now synced even if case of DNs do not match

by Lars Michelsen

Module: check_mk Branch: master Commit: ff84fdbd6285878d38d2058a8a9811e41929f240 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=ff84fdbd628587… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Fri Dec 20 09:17:37 2013 +0100 FIX LDAP: Roles/Groups are now synced even if case of DNs do not match Most LDAP related filters are case insentive. To match user expectations the distinguished name matching used during group / role sync has been changed to be case insensitive. --- .werks/420 | 12 ++++++++++++ ChangeLog | 1 + web/plugins/userdb/ldap.py | 9 +++++---- 3 files changed, 18 insertions(+), 4 deletions(-) diff --git a/.werks/420 b/.werks/420 new file mode 100644 index 0000000..ba10886 --- /dev/null +++ b/.werks/420 @@ -0,0 +1,12 @@ +Title: LDAP: Roles/Groups are now synced even if case of DNs do not match +Level: 1 +Component: multisite +Class: fix +State: unknown +Version: 1.2.5i1 +Date: 1387527273 +Targetversion: future + +Most LDAP related filters are case insentive. To match user expectations +the distinguished name matching used during group / role sync has been +changed to be case insensitive. diff --git a/ChangeLog b/ChangeLog index 8e7c4fd..2f8830e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -94,6 +94,7 @@ * 0393 FIX: LDAP: Enabled paged LDAP search by default now with a page size of 1000... * 0394 FIX: LDAP: Auth expiration plugin now checks users for being disabled (in AD)... * 0436 FIX: Fix broken Site status switching via sidebar snapin... + * 0420 FIX: LDAP: Roles/Groups are now synced even if case of DNs do not match... WATO: * 0308 Multisite can now set rotation view permissions for NagVis... diff --git a/web/plugins/userdb/ldap.py b/web/plugins/userdb/ldap.py index 8fc4be0..9af7443 100644 --- a/web/plugins/userdb/ldap.py +++ b/web/plugins/userdb/ldap.py @@ -332,7 +332,7 @@ def ldap_search(base, filt = '(objectclass=*)', columns = [], scope = None): for key, val in obj.iteritems(): # Convert all keys to lower case! new_obj[key.lower().decode('utf-8')] = [ i.decode('utf-8') for i in val ] - result.append((dn, new_obj)) + result.append((dn.lower(), new_obj)) success = True except ldap.NO_SUCH_OBJECT, e: raise MKLDAPException(_('The given base object "%s" does not exist in LDAP (%s))') % (base, e)) @@ -585,7 +585,7 @@ def ldap_group_members(filters, filt_attr = 'cn', nested = False): for dn, obj in ldap_search(ldap_replace_macros(config.ldap_groupspec['dn']), filt, ['cn', member_attr]): groups[dn] = { 'cn' : obj['cn'][0], - 'members' : [ m.encode('utf-8') for m in obj.get(member_attr,[]) ], + 'members' : [ m.encode('utf-8').lower() for m in obj.get(member_attr,[]) ], } else: # Special handling for OpenLDAP when searching for groups by DN @@ -593,7 +593,7 @@ def ldap_group_members(filters, filt_attr = 'cn', nested = False): for dn, obj in ldap_search(ldap_replace_macros(f_dn), filt, ['cn', member_attr]): groups[f_dn] = { 'cn' : obj['cn'][0], - 'members' : [ m.encode('utf-8') for m in obj.get(member_attr,[]) ], + 'members' : [ m.encode('utf-8').lower() for m in obj.get(member_attr,[]) ], } else: @@ -622,7 +622,7 @@ def ldap_group_members(filters, filt_attr = 'cn', nested = False): 'cn' : cn, } for user_dn, obj in ldap_search(ldap_replace_macros(config.ldap_userspec['dn']), filt, columns = ['dn']): - groups[dn]['members'].append(user_dn) + groups[dn]['members'].append(user_dn.lower) g_ldap_group_cache[cache_key] = groups return groups @@ -882,6 +882,7 @@ def ldap_convert_groups_to_roles(plugin, params, user_id, ldap_user, user): for role_id, dn in params.items(): if not isinstance(dn, str): continue # skip non configured ones + dn = dn.lower() # lower case matching for DNs! # if group could be found and user is a member, add the role if dn in ldap_groups and ldap_user['dn'] in ldap_groups[dn]['members']:

10 years, 6 months

Check_MK Git: check_mk: FIX LDAP: Fixed broken role sync plugin with OpenLDAP

by Lars Michelsen

Module: check_mk Branch: master Commit: 64000bd2db818c8081d38a668b58b198ddf11848 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=64000bd2db818c… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Fri Dec 20 08:56:51 2013 +0100 FIX LDAP: Fixed broken role sync plugin with OpenLDAP The role sync plugin simply did not sync the roles of users even if the group memberships in the OpenLDAP directory were OK. --- .werks/418 | 11 ++++++++++ ChangeLog | 1 + web/plugins/userdb/ldap.py | 51 ++++++++++++++++++++++++++++++-------------- 3 files changed, 47 insertions(+), 16 deletions(-) diff --git a/.werks/418 b/.werks/418 new file mode 100644 index 0000000..444b131 --- /dev/null +++ b/.werks/418 @@ -0,0 +1,11 @@ +Title: LDAP: Fixed broken role sync plugin with OpenLDAP +Level: 1 +Component: wato +Class: fix +State: unknown +Version: 1.2.5i1 +Date: 1387526157 +Targetversion: future + +The role sync plugin simply did not sync the roles of users even +if the group memberships in the OpenLDAP directory were OK. diff --git a/ChangeLog b/ChangeLog index 060a468..856a34c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -121,6 +121,7 @@ * 0415 FIX: LDAP: The LDAP Settings dialog is now disabled when the LDAP Connector is disabled * 0416 FIX: When doing user sync on user page rendering, contact group memberships are shown correctly now... * 0417 FIX: LDAP: Fixed "Sync-Plugin: Roles" test with OpenLDAP + * 0418 FIX: LDAP: Fixed broken role sync plugin with OpenLDAP... * 0419 FIX: LDAP: The default user profile roles are only assigned to users without roles... Notifications: diff --git a/web/plugins/userdb/ldap.py b/web/plugins/userdb/ldap.py index 5f85267..8fc4be0 100644 --- a/web/plugins/userdb/ldap.py +++ b/web/plugins/userdb/ldap.py @@ -566,21 +566,36 @@ def ldap_group_members(filters, filt_attr = 'cn', nested = False): if cache_key in g_ldap_group_cache: return g_ldap_group_cache[cache_key] - # When not searching for nested memberships, it is easy. Simply query the group - # for the memberships in one single query. + # When not searching for nested memberships, it is easy when using the an AD base LDAP. + # The group objects can be queried using the attribute distinguishedname. Therefor we + # create an alternating match filter to match that attribute when searching by DNs. + # In OpenLDAP the distinguishedname is no user attribute, therefor it can not be used + # as filter expression. We have to do one ldap query per group. Maybe, in the future, + # we change the role sync plugin parameters to snapins to make this part a little easier. if not nested: + groups = {} filt = ldap_filter('groups') - if filters: - add_filt = '(|%s)' % ''.join([ '(%s=%s)' % (filt_attr, f) for f in filters ]) - filt = '(&%s%s)' % (filt, add_filt) - member_attr = ldap_member_attr().lower() - groups = {} - for dn, obj in ldap_search(ldap_replace_macros(config.ldap_groupspec['dn']), filt, ['cn', member_attr]): - groups[dn] = { - 'cn' : obj['cn'][0], - 'members' : [ m.encode('utf-8') for m in obj.get(member_attr,[]) ], - } + + if config.ldap_connection['type'] == 'ad' or filt_attr != 'distinguishedname': + if filters: + add_filt = '(|%s)' % ''.join([ '(%s=%s)' % (filt_attr, f) for f in filters ]) + filt = '(&%s%s)' % (filt, add_filt) + + for dn, obj in ldap_search(ldap_replace_macros(config.ldap_groupspec['dn']), filt, ['cn', member_attr]): + groups[dn] = { + 'cn' : obj['cn'][0], + 'members' : [ m.encode('utf-8') for m in obj.get(member_attr,[]) ], + } + else: + # Special handling for OpenLDAP when searching for groups by DN + for f_dn in filters: + for dn, obj in ldap_search(ldap_replace_macros(f_dn), filt, ['cn', member_attr]): + groups[f_dn] = { + 'cn' : obj['cn'][0], + 'members' : [ m.encode('utf-8') for m in obj.get(member_attr,[]) ], + } + else: # Nested querying is more complicated. We have no option to simply do a query for group objects # to make them resolve the memberships here. So we need to query all users with the nested @@ -861,8 +876,7 @@ def ldap_convert_groups_to_roles(plugin, params, user_id, ldap_user, user): ldap_groups = dict(ldap_group_members([ dn for role_id, dn in params.items() if isinstance(dn, str) ], filt_attr = 'distinguishedname', nested = params.get('nested', False))) - # Load default roles from default user profile - roles = config.default_user_profile['roles'][:] + roles = set([]) # Loop all roles mentioned in params (configured to be synchronized) for role_id, dn in params.items(): @@ -871,9 +885,14 @@ def ldap_convert_groups_to_roles(plugin, params, user_id, ldap_user, user): # if group could be found and user is a member, add the role if dn in ldap_groups and ldap_user['dn'] in ldap_groups[dn]['members']: - roles.append(role_id) + roles.add(role_id) + + # Load default roles from default user profile when the user got no role + # by the role sync plugin + if not roles: + roles = config.default_user_profile['roles'][:] - return {'roles': roles} + return {'roles': list(roles)} def ldap_list_roles_with_group_dn(): elements = []

10 years, 6 months

Check_MK Git: check_mk: FIX LDAP: The default user profile roles are only assigned to users without roles

by Lars Michelsen

Module: check_mk Branch: master Commit: 88b5b03fb10dfdbf3f2b6a213b711fb059a2157a URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=88b5b03fb10dfd… Author: Lars Michelsen <lm(a)mathias-kettner.de> Date: Fri Dec 20 08:58:04 2013 +0100 FIX LDAP: The default user profile roles are only assigned to users without roles In previous releases the roles of the default user profile were assigned to all users synced with LDAP. This was not correct and has now been changed. Only users which do not get a role assigned by the role sync plugin get the default role(s). --- .werks/419 | 12 ++++++++++++ ChangeLog | 1 + 2 files changed, 13 insertions(+) diff --git a/.werks/419 b/.werks/419 new file mode 100644 index 0000000..7387eac --- /dev/null +++ b/.werks/419 @@ -0,0 +1,12 @@ +Title: LDAP: The default user profile roles are only assigned to users without roles +Level: 1 +Component: wato +Class: fix +State: unknown +Version: 1.2.5i1 +Date: 1387526213 +Targetversion: future + +In previous releases the roles of the default user profile were assigned to all +users synced with LDAP. This was not correct and has now been changed. Only users +which do not get a role assigned by the role sync plugin get the default role(s). diff --git a/ChangeLog b/ChangeLog index ba499b9..060a468 100644 --- a/ChangeLog +++ b/ChangeLog @@ -121,6 +121,7 @@ * 0415 FIX: LDAP: The LDAP Settings dialog is now disabled when the LDAP Connector is disabled * 0416 FIX: When doing user sync on user page rendering, contact group memberships are shown correctly now... * 0417 FIX: LDAP: Fixed "Sync-Plugin: Roles" test with OpenLDAP + * 0419 FIX: LDAP: The default user profile roles are only assigned to users without roles... Notifications: * 0362 sms: now searching PATH for sendsms and smssend commands...

10 years, 6 months

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

Checkmk git commits December 2013