Module: check_mk
Branch: master
Commit: 049d209bc2193762d16e8f6082896d378598cece
URL:
http://git.mathias-kettner.de/git/?p=check_mk.git;a=commit;h=049d209bc21937…
Author: Lars Michelsen <lm(a)mathias-kettner.de>
Date: Thu Nov 15 11:14:48 2012 +0100
userdb/ldap: Added option to add custom vars to contacts.mk or multisite users.mk
---
web/htdocs/userdb.py | 10 ++++++++++
web/htdocs/wato.py | 8 ++++++--
web/plugins/userdb/ldap.py | 34 +++++++++++++++++++++++++++++-----
3 files changed, 45 insertions(+), 7 deletions(-)
diff --git a/web/htdocs/userdb.py b/web/htdocs/userdb.py
index f64e3c7..a216ec0 100644
--- a/web/htdocs/userdb.py
+++ b/web/htdocs/userdb.py
@@ -74,6 +74,16 @@ def locked_attributes(connector_id):
connector = get_connector(connector_id)
return connector.get('locked_attributes', lambda: [])()
+# Returns a list of multisite attributes
+def multisite_attributes(connector_id):
+ connector = get_connector(connector_id)
+ return connector.get('multisite_attributes', lambda: [])()
+
+# Returns a list of non contact attributes
+def non_contact_attributes(connector_id):
+ connector = get_connector(connector_id)
+ return connector.get('non_contact_attributes', lambda: [])()
+
# This is a function needed in WATO and the htpasswd module. This should
# really be modularized one day. Till this day this is a good place ...
def encrypt_password(password, salt = None):
diff --git a/web/htdocs/wato.py b/web/htdocs/wato.py
index 746e3bf..2de411c 100644
--- a/web/htdocs/wato.py
+++ b/web/htdocs/wato.py
@@ -8417,6 +8417,8 @@ def save_users(profiles):
"locked",
"automation_secret",
"language",
+ "serial",
+ "connector",
] + custom_values
# Keys to put into multisite configuration
@@ -8426,19 +8428,21 @@ def save_users(profiles):
"automation_secret",
"alias",
"language",
+ "serial",
+ "connector",
] + custom_values
# Remove multisite keys in contacts.
contacts = dict(
e for e in
- [ (id, split_dict(user, non_contact_keys, False))
+ [ (id, split_dict(user, non_contact_keys +
userdb.non_contact_attributes(user.get('connector')), False))
for (id, user)
in profiles.items() ])
# Only allow explicitely defined attributes to be written to multisite config
users = {}
for uid, profile in profiles.items():
- users[uid] = dict([ (p, val) for p, val in profile.items() if p in multisite_keys
])
+ users[uid] = dict([ (p, val) for p, val in profile.items() if p in multisite_keys
+ userdb.multisite_attributes(user.get('connector'))])
# Check_MK's monitoring contacts
filename = root_dir + "contacts.mk"
diff --git a/web/plugins/userdb/ldap.py b/web/plugins/userdb/ldap.py
index a6f8669..e605426 100644
--- a/web/plugins/userdb/ldap.py
+++ b/web/plugins/userdb/ldap.py
@@ -270,7 +270,7 @@ ldap_attribute_plugins['email'] = {
# gathered from ldap
'convert': ldap_convert_mail,
# User-Attributes to be written by this plugin and will be locked in WATO
- 'set_attributes': [ 'email' ],
+ 'lock_attributes': [ 'email' ],
}
ldap_attribute_plugins['alias'] = {
@@ -278,7 +278,7 @@ ldap_attribute_plugins['alias'] = {
'help': _('Synchronizes the alias of the LDAP user account into
Check_MK.'),
'needed_attributes': lambda: ldap_attrs(['cn']),
'convert': lambda user_id, ldap_user, user:
ldap_convert_simple(user_id, ldap_user, user, 'alias', 'cn'),
- 'set_attributes': [ 'alias' ],
+ 'lock_attributes': [ 'alias' ],
}
# Checks wether or not the user auth must be invalidated (increasing the serial).
@@ -313,7 +313,13 @@ ldap_attribute_plugins['auth_expire'] = {
'the password has changed in LDAP or the account has been
locked.'),
'needed_attributes': lambda: ldap_attrs(['pw_changed']),
'convert': ldap_convert_auth_expire,
- 'set_attributes': [],
+ 'lock_attributes': [],
+ # When a plugin introduces new user attributes, it should declare the output target
for
+ # this attribute. It can either be written to the multisites users.mk or the
check_mk
+ # contacts.mk to be forwarded to nagios. Undeclared attributes are stored in the
check_mk
+ # contacts.mk file.
+ 'multisite_attributes': ['ldap_pw_last_changed'],
+ 'non_contact_attributes': ['ldap_pw_last_changed'],
}
# .----------------------------------------------------------------------.
@@ -401,9 +407,25 @@ def ldap_sync(add_to_changelog, only_username):
def ldap_locked_attributes():
locked = set([ 'password' ]) # This attributes are locked in all cases!
for key in config.ldap_active_plugins:
- locked.update(ldap_attribute_plugins[key]['set_attributes'])
+ locked.update(ldap_attribute_plugins[key]['lock_attributes'])
return list(locked)
+# Calculates the attributes added in this connector which shal be written to
+# the multisites users.mk
+def ldap_multisite_attributes():
+ attrs = set([])
+ for key in config.ldap_active_plugins:
+ attrs.update(ldap_attribute_plugins[key].get('multisite_attributes',
[]))
+ return list(attrs)
+
+# Calculates the attributes added in this connector which shal NOT be written to
+# the check_mks contacts.mk
+def ldap_non_contact_attributes():
+ attrs = set([])
+ for key in config.ldap_active_plugins:
+ attrs.update(ldap_attribute_plugins[key].get('non_contact_attributes',
[]))
+ return list(attrs)
+
# Is called on every multisite http request
def ldap_page():
try:
@@ -429,5 +451,7 @@ multisite_user_connectors.append({
# synchronized and the user is enabled in LDAP and
disabled
# in Check_MK. When the user is locked in LDAP a
login is
# not possible.
- 'locked_attributes': ldap_locked_attributes,
+ 'locked_attributes': ldap_locked_attributes,
+ 'multisite_attributes': ldap_multisite_attributes,
+ 'non_contact_attributes': ldap_multisite_attributes,
})