[checkmk-commits] Check_MK Git: check_mk: #2145 FIX LDAP-Sync: Handling user ids with special characters more user friendly

Module: check_mk Branch: master Commit: ae7080734c23a13bb51b0032f779042b833a0725 URL: http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=ae7080734c23a1… Author: Lars Michelsen &lt;lm(a)mathias-kettner.de&gt; Date: Tue Mar 17 10:10:23 2015 +0100 #2145 FIX LDAP-Sync: Handling user ids with special characters more user friendly At the moment the Check_MK GUI does not allow to use special characters like german umlauts in the user ID. By default the LDAP sync pluginn tries to replace these umlauts with some similar characters, or if enabled, it tries to skip these users during sync. But if a user ID contains other special characters, which are not handled by the LDAP code, this could result in exceptions after synchronising such users. We improved the handling of those users to skip them silently during synchronisation. If you miss some users, just enable the diagnostic log and have a look at the LDAP debug log (located in <tt>var/check_mk/web/ldap-debug.log</tt> in OMD sites) and search for <tt>Skipped user: ...</tt> entries. If you need these users within Check_MK please let us know, we will add the needed umlauts to the translation map. For future innovation releases we plan to make such special characters usable in user IDs, then this translation map will not be needed anymore. --- .werks/2145 | 27 +++++++++++++++++++++++++ ChangeLog | 1 + web/plugins/userdb/ldap.py | 48 ++++++++++++++++++++++++++------------------ 3 files changed, 56 insertions(+), 20 deletions(-) diff --git a/.werks/2145 b/.werks/2145 new file mode 100644 index 0000000..67a69cd --- /dev/null +++ b/.werks/2145 @@ -0,0 +1,27 @@ +Title: LDAP-Sync: Handling user ids with special characters more user friendly +Level: 1 +Component: multisite +Class: fix +Compatible: compat +State: unknown +Version: 1.2.7i1 +Date: 1426583054 + +At the moment the Check_MK GUI does not allow to use special characters like +german umlauts in the user ID. By default the LDAP sync pluginn tries to +replace these umlauts with some similar characters, or if enabled, it tries +to skip these users during sync. + +But if a user ID contains other special characters, which are not handled by +the LDAP code, this could result in exceptions after synchronising such users. + +We improved the handling of those users to skip them silently during +synchronisation. If you miss some users, just enable the diagnostic log and +have a look at the LDAP debug log (located in <tt>var/check_mk/web/ldap-debug.log</tt> +in OMD sites) and search for <tt>Skipped user: ...</tt> entries. If you need +these users within Check_MK please let us know, we will add the needed umlauts +to the translation map. + +For future innovation releases we plan to make such special characters usable +in user IDs, then this translation map will not be needed anymore. + diff --git a/ChangeLog b/ChangeLog index bef1923..3d78848 100644 --- a/ChangeLog +++ b/ChangeLog @@ -311,6 +311,7 @@ * 2054 FIX: Sidebar snapin "Tree of folders": fixed exception when using localized default value... * 2090 FIX: Fixed errors when editing / rendering custom url dashlets in some cases... * 2092 FIX: Dashboards: Possible to configure an empty custom title + * 2145 FIX: LDAP-Sync: Handling user ids with special characters more user friendly... WATO: * 1760 Added search form to manual checks page diff --git a/web/plugins/userdb/ldap.py b/web/plugins/userdb/ldap.py index 3ba6bed..0704fa4 100644 --- a/web/plugins/userdb/ldap.py +++ b/web/plugins/userdb/ldap.py @@ -92,6 +92,20 @@ ldap_filter_map = { }, } +# All these characters are replaced from user ids by default. Check_MK +# currently does not support special characters in user ids, so users +# not matching this specification are cleaned up with this map. When the +# user accounts still do not match the specification, they are skipped. +ldap_umlaut_translation = { + ord(u'ü'): u'ue', + ord(u'ö'): u'oe', + ord(u'ä'): u'ae', + ord(u'ß'): u'ss', + ord(u'Ü'): u'UE', + ord(u'Ö'): u'OE', + ord(u'Ä'): u'AE', +} + #. # .-General LDAP code----------------------------------------------------. # | _ ____ _ ____ | @@ -106,6 +120,8 @@ ldap_filter_map = { def ldap_log(s): if config.ldap_debug_log is not None: + if type(s) == unicode: + s = s.encode('utf-8') file(ldap_replace_macros(config.ldap_debug_log), "a").write('%s %s\n' % (time.strftime('%Y-%m-%d %H:%M:%S'), s)) @@ -414,29 +430,21 @@ def ldap_rewrite_user_id(user_id): user_id = user_id.lower() umlauts = config.ldap_userspec.get('user_id_umlauts', 'replace') - new = "" - for c in user_id: - if c == u'ü': - new += 'ue' - elif c == u'ö': - new += 'oe' - elif c == u'ä': - new += 'ae' - elif c == u'ß': - new += 'ss' - elif c == u'Ü': - new += 'UE' - elif c == u'Ö': - new += 'OE' - elif c == u'Ä': - new += 'AE' - else: - new += c + new_user_id = user_id.translate(ldap_umlaut_translation) + if umlauts == 'replace': - user_id = new - elif umlauts == 'skip' and user_id != new: + user_id = new_user_id + elif umlauts == 'skip' and user_id != new_user_id: return None # This makes the user being skipped + # Now check whether or not the user id matches our specification + try: + str(user_id) + except UnicodeEncodeError: + # Skipping this user: not all "bad" characters were replaced before + ldap_log('Skipped user: %s (contains not allowed special characters)' % user_id) + return None + return user_id def ldap_user_id_attr():