> So i've build around smbldap-tools this script (better call it a hack) > that copy membership information from ldap and store it in phpgw_acl > table.
Hem, second version, yesterday i've forgot to consider phpgwAccountID/GroupID using insted POSIX UID/GID. Fixed, sorry. -- dott. Marco Gaiarin GNUPG Key ID: 240A3D66 Associazione ``La Nostra Famiglia'' http://www.sv.lnf.it/ Polo FVG - Via della Bontà , 7 - 33078 - San Vito al Tagliamento (PN) marco.gaiarin(at)sv.lnf.it tel +39-0434-842711 fax +39-0434-842797
#!/usr/bin/perl -w # This code was developped by Marco Gaiarin <[EMAIL PROTECTED]> # taking ideas and code from smbldap-tools script by IDEALX # (http://IDEALX.org/) and # # Copyright (C) 2006 Marco Gaiarin # Copyright (C) 2001-2002 IDEALX # # This program is free software; you can redistribute it and/or # modify it under the terms of the GNU General Public License # as published by the Free Software Foundation; either version 2 # of the License, or (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, # USA. # Purpose of smbldap-phpgw: copy some data from the LDAP tree into the # phpgroupware system # CHANGELOG # # (Mon Jan 29 10:52:47 CET 2007) # + initial revision # (Tue Jan 30 10:46:22 CET 2007) # + hem, forgot to consider phpgwAccountID/GroupID insted of POSIX ones... # + added -u, autoshifting of conflicting users use strict; use smbldap_tools; ##################### use Getopt::Std; my %Options; my $lagtime = 180; my $ushift = 10000; my $ok = getopts('vdspPl:u:h?', \%Options); if ( (!$ok) || (@ARGV < 1) || ($Options{'?'}) || ($Options{'h'}) ) { print_banner; print "Usage: $0 [-vdspP?h] [-l days] [-u int] username\n"; print "Available options are:\n"; print " -v verbose mode\n"; print " -d dry-run (do all the checks but just not update)\n"; print " -s setup phpgw membership from LDAP\n"; print " -p setup also password expiration\n"; print " -P take password expiration data from POSIX (default: Samba)\n"; print " -l lag time to relax password expiration, default $lagtime (in days)\n"; print " -u shift value for conflicting UID, default $ushift\n"; print " -?|-h show this help message\n"; exit (1); } if ($< != 0) { print "You must be root to modify an user\n"; exit (1); } # Read only first @ARGV my $user = $ARGV[0]; # Let's connect to the directory first my $ldap_master=connect_ldap_master(); # Read user data my $user_entry = read_user_entry($user); if (!defined($user_entry)) { if ($Options{'v'}) { print "$0: user $user doesn't exist\n"; } exit (1); } my $dn = $user_entry->dn(); my @user_groups = &find_groups_of($user); my $user_number = $user_entry->get_value('uidNumber'); # some vars... my @mods; my $tmp; my $pai = 0; # reapup commandline... if (defined($tmp = $Options{'l'})) { $lagtime = int($tmp); } if (defined($tmp = $Options{'u'})) { $ushift = int($tmp); } # Eventually adding missing phpgwAccount OC if ( ($Options{'s'}) && (! grep ($_ =~ /^phpgwAccount$/i, $user_entry->get_value('objectClass'))) ) { my @objectclass = $user_entry->get_value('objectClass'); push(@mods, 'objectClass' => [ @objectclass, 'phpgwAccount' ]); $pai = $user_number; my $ge = read_group_entry_gid($user_number); if (defined($ge)) { $pai += $ushift; } push(@mods, 'phpgwAccountID' => $pai); push(@mods, 'phpgwAccountStatus' => 'A'); my $name = $user_entry->get_value('cn'); push(@mods, 'givenName' => $name); if ($Options{'v'}) { print "$0: user $user phpgwAccount ObjectClass missing added\n"; } } # Password expiration are handled automatically by samba, so if options p # was given we simply copy the data into phpgroupware objects... if ($Options{'p'}) { my $pls; my $pe; if ($Options{'P'}) { $pls = $user_entry->get_value('shadowLastChange') * 3600; $pe = $pls + (($user_entry->get_value('shadowMax') + $lagtime) * 3600); } else { $pls = $user_entry->get_value('sambaPwdLastSet'); $pe = $user_entry->get_value('sambaPwdMustChange') + ($lagtime * 3600); } my $ppls = $user_entry->get_value('phpgwLastPasswordChange'); if ( ! defined($ppls) ) { $ppls = 0; } if ( $pls > $ppls ) { if ($Options{'v'}) { print "$0: user $user setting up phgw account expiration data\n"; } push(@mods, 'phpgwLastPasswordChange' => $pls); push(@mods, 'phpgwAccountExpires' => $pe); } } # setting up membership in phpgroupware (phpgw_acl table) taking data from # LDAP # NOTE that we output SQL queries on stdout, it is outside the scope of # this script to manage multi-db compatibility and options... if ($Options{'s'}) { my $group_entry; my $pgi; if ($Options{'v'}) { print "$0: user $user setting up phgw membership\n"; } if ($pai == 0 ) { $pai = $user_entry->get_value('phpgwAccountID'); } print "delete from phpgw_acl where acl_appname='phpgw_group' and acl_account=$pai;\n"; foreach my $g (@user_groups) { $group_entry = read_group_entry($g); if ( grep ($_ =~ /^phpgwGroup$/i, $group_entry->get_value('objectClass')) ) { $pgi = $group_entry->get_value('phpgwGroupID'); print "insert into phpgw_acl values ('phpgw_group', $pgi, $pai, 1);\n"; } } } # apply changes if ( (@mods) && (! $Options{'d'}) ) { my $modify = $ldap_master->modify ( "$dn", 'replace' => { @mods } ); $modify->code && warn "failed to modify entry: ", $modify->error ; } # take down session $ldap_master->unbind; # exit exit(0); ############################################################ =head1 NAME smbldap-phpgw - Setup phpgw LDAP and SQL data syncing with the main LDAP tree =head1 SYNOPSIS smbldap-userexpire [-v] [-d] [-p] [-s] [-P] [-l days] login =head1 DESCRIPTION The smbldap-phpgw command (try to) copy all the usefoul data from an existing LDAP tree into the PHPGroupWare data, both on LDAP itself and on SQL table. It was build up as a simple tool/hack to setup quickly phpgw accounts, and to handle the expiration, in a setup where the phpgw user/group management itself was not the preferred way. This script are based on smbldap-tools, and so indeed these scripts are considered the firs choice in user administration. Note that SQL modification are directly printed on STDOUT, so to take care of them you have to disable verbose mode and feed someway to your sql interpreter. -v Verbose mode, print any action taken -d Dry-run, actually compute all needed modification but not apply them; usually used in conjunction with -v -s Setup PHPGroupWare membership (stored on phpgw_acl table) taking data from LDAP -p Sync password expiration data between POSIX(shadow) or Samba and PHPGroupWare -P For expiration counters, take into account the shadow data (default the Samba data) -l days Setting up account expliration, add to POSIX/Samba values these days; both Samba and POSIX set the password expiration time, so we have to not consider this strictly as account expiration. -u int Shift value for conflicting UID; we have to 'create' a PHPGroupWare User (eg, add the objectclass and minimal data) and we found a conflicting UID, shift the value adding this. NOTE that groups are not automatically added, and this you have to prevent conflict in groups manually. =head1 RETURN VALUES This script return 0 if all goes well, 1 if something goes wrong. =head1 SEE ALSO smbldap-usermod(1) smbldap-useraccess(1) chage(1) =cut #'
_______________________________________________ phpGroupWare-users mailing list phpGroupWare-users@gnu.org http://lists.gnu.org/mailman/listinfo/phpgroupware-users
