--- a
+++ b/Allura/ldap-setup.py
@@ -0,0 +1,310 @@
+#!/usr/bin/env python
+import os
+import shutil
+import string
+from contextlib import contextmanager
+from tempfile import mkstemp
+from ConfigParser import ConfigParser, NoOptionError
+
+config = ConfigParser()
+
+def main():
+ config.read('.setup-scm-cache')
+ if not config.has_section('scm'):
+ config.add_section('scm')
+ suffix = get_value('suffix', 'dc=localdomain')
+ secret = get_value('admin password', 'secret')
+ firstdc = suffix.split(',')[0].split('=')[1]
+ if get_value('clear ldap config', 'y') == 'y':
+ run('apt-get -f install')
+ run('apt-get remove --purge slapd ldap-utils')
+ run('apt-get install slapd ldap-utils')
+ if get_value('start slapd', 'y') == 'y':
+ run('service slapd start')
+ if get_value('add base ldap schemas', 'y') == 'y':
+ run('ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif')
+ run('ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif')
+ run('ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif')
+ if get_value('add backend ldif', 'y') == 'y':
+ with tempfile(backend_ldif, locals()) as name:
+ run('ldapadd -Y EXTERNAL -H ldapi:/// -f %s' % name)
+ with open('/etc/ldap.secret', 'w') as fp:
+ fp.write(secret)
+ os.chmod('/etc/ldap.secret', 0400)
+ if get_value('add frontend ldif', 'y') == 'y':
+ with tempfile(frontend_ldif, locals()) as name:
+ run('ldapadd -c -x -D cn=admin,%s -W -f %s -y /etc/ldap.secret' % (suffix, name))
+ if get_value('add initial user/group', 'y') == 'y':
+ with tempfile(initial_user_ldif, locals()) as name:
+ run('ldapadd -c -x -D cn=admin,%s -W -f %s -y /etc/ldap.secret' % (suffix, name))
+ if get_value('setup ldap auth', 'y') == 'y':
+ run('apt-get install libnss-ldap')
+ run('dpkg-reconfigure ldap-auth-config')
+ run('auth-client-config -t nss -p lac_ldap')
+ run('pam-auth-update')
+ if get_value('setup ldapscripts', 'y') == 'y':
+ run('apt-get install ldapscripts')
+ with tempfile(ldapscripts_conf, locals()) as name:
+ shutil.copy(name, '/etc/ldapscripts/ldapscripts.conf')
+ print 'writing passwd'
+ with open('/etc/ldapscripts/ldapscripts.passwd', 'w') as fp:
+ fp.write(secret)
+ os.chmod('/etc/ldapscripts/ldapscripts.passwd', 0400)
+ print 'writing runtime'
+ with open('/usr/share/ldapscripts/runtime.debian', 'w') as fp:
+ fp.write(ldapscripts_debian)
+
+def get_value(key, default):
+ try:
+ default = config.get('scm', key)
+ except NoOptionError:
+ pass
+ value = raw_input('%s? [%s]' % (key, default))
+ if not value: value = default
+ config.set('scm', key, value)
+ with open('.setup-scm-cache', 'w') as fp:
+ config.write(fp)
+ return value
+
+def run(command):
+ rc = os.system(command)
+ if rc != 0:
+ print 'Error running %s' % command
+ assert rc == 0
+ return rc
+
+@contextmanager
+def tempfile(template, values):
+ fd, name = mkstemp()
+ os.write(fd, template.safe_substitute(values))
+ os.close(fd)
+ yield name
+ os.remove(name)
+
+backend_ldif=string.Template('''
+# Load dynamic backend modules
+dn: cn=module,cn=config
+objectClass: olcModuleList
+cn: module
+olcModulepath: /usr/lib/ldap
+olcModuleload: back_hdb
+
+# Database settings
+dn: olcDatabase=hdb,cn=config
+objectClass: olcDatabaseConfig
+objectClass: olcHdbConfig
+olcDatabase: {1}hdb
+olcSuffix: $suffix
+olcDbDirectory: /var/lib/ldap
+olcRootDN: cn=admin,$suffix
+olcRootPW: $secret
+olcDbConfig: set_cachesize 0 2097152 0
+olcDbConfig: set_lk_max_objects 1500
+olcDbConfig: set_lk_max_locks 1500
+olcDbConfig: set_lk_max_lockers 1500
+olcDbIndex: objectClass eq
+olcLastMod: TRUE
+olcDbCheckpoint: 512 30
+olcAccess: to attrs=userPassword by dn="cn=admin,$suffix" write by anonymous auth by self write by * none
+olcAccess: to attrs=shadowLastChange by self write by * read
+olcAccess: to dn.base="" by * read
+olcAccess: to * by dn="cn=admin,$suffix" write by * read
+
+''')
+
+frontend_ldif=string.Template('''
+# Create top-level object in domain
+dn: $suffix
+objectClass: top
+objectClass: dcObject
+objectclass: organization
+o: Example Organization
+dc: $firstdc
+description: LDAP Example
+
+# Create max uid generator
+dn: cn=maxUid,$suffix
+objectClass: extensibleObject
+objectClass: top
+uidNumber: 10000
+
+# Admin user.
+dn: cn=admin,$suffix
+objectClass: simpleSecurityObject
+objectClass: organizationalRole
+cn: admin
+description: LDAP administrator
+userPassword: $secret
+
+dn: ou=people,$suffix
+objectClass: organizationalUnit
+ou: people
+
+dn: ou=groups,$suffix
+objectClass: organizationalUnit
+ou: groups
+''')
+
+initial_user_ldif=string.Template('''
+dn: uid=john,ou=people,$suffix
+objectClass: inetOrgPerson
+objectClass: posixAccount
+objectClass: shadowAccount
+uid: john
+sn: Doe
+givenName: John
+cn: John Doe
+displayName: John Doe
+uidNumber: 1000
+gidNumber: 10000
+userPassword: password
+gecos: John Doe
+loginShell: /bin/bash
+homeDirectory: /home/john
+shadowExpire: -1
+shadowFlag: 0
+shadowWarning: 7
+shadowMin: 8
+shadowMax: 999999
+shadowLastChange: 10877
+mail: john.doe@example.com
+postalCode: 31000
+l: Toulouse
+o: Example
+mobile: +33 (0)6 xx xx xx xx
+homePhone: +33 (0)5 xx xx xx xx
+title: System Administrator
+postalAddress:
+initials: JD
+
+dn: cn=example,ou=groups,$suffix
+objectClass: posixGroup
+cn: example
+gidNumber: 10000
+''')
+
+open_ldap_config=string.Template('''
+[open_ldap]
+nss_passwd=passwd: files ldap
+nss_group=group: files ldap
+nss_shadow=shadow: files ldap
+nss_netgroup=netgroup: files ldap
+pam_auth=auth required pam_env.so
+ auth sufficient pam_unix.so likeauth nullok
+#the following line (containing pam_group.so) must be placed before pam_ldap.so
+#for ldap users to be placed in local groups such as fuse, plugdev, scanner, etc ...
+ auth required pam_group.so use_first_pass
+ auth sufficient pam_ldap.so use_first_pass
+ auth required pam_deny.so
+pam_account=account sufficient pam_unix.so
+ account sufficient pam_ldap.so
+ account required pam_deny.so
+pam_password=password sufficient pam_unix.so nullok md5 shadow
+ password sufficient pam_ldap.so use_first_pass
+ password required pam_deny.so
+pam_session=session required pam_limits.so
+ session required pam_mkhomedir.so skel=/etc/skel/
+ session required pam_unix.so
+ session optional pam_ldap.so
+''')
+
+ldapscripts_conf=string.Template('''
+SERVER=127.0.0.1
+BINDDN='cn=admin,$suffix'
+BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd"
+SUFFIX='$suffix'
+GSUFFIX='ou=Groups'
+USUFFIX='ou=People'
+MSUFFIX='ou=Computers'
+GIDSTART=10000
+UIDSTART=10000
+MIDSTART=10000
+''')
+
+
+ldapscripts_debian='''
+### Allura-customized
+### This file predefine some ldapscripts variables for Debian boxes.
+#
+# Copyright (c) 2005 Ganal LAPLANCHE - Linagora
+# Copyright (c) 2005-2007 Pierre Habouzit
+# Copyright (c) 2009 Alexander GQ Gerasiov
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,
+# USA.
+
+##### Beginning of ldapscripts configuration #####
+
+getfield() {
+ local field="$1"
+ local nssconffile='/etc/libnss-ldap.conf'
+ if [ -f "$nssconffile" ];then
+ local value=$(awk "/^\s*$field/ {print \$2}" /etc/libnss-ldap.conf)
+ else
+ local value="$2"
+ fi
+ echo ${value:-$2}
+}
+
+getsuffix() {
+ field="$1"
+ value="$(getfield "$1" | sed -e "s/,.*$//")"
+ echo ${value:-$2}
+}
+
+# LDAP Configuration
+SERVER=$(getfield uri "$(getfield host '')")
+BINDDN=$(getfield rootbinddn '')
+if [ -f /etc/libnss-ldap.secret ];then
+ BINDPWDFILE=/etc/libnss-ldap.secret
+elif [ -f /etc/ldap.secret ];then
+ BINDPWDFILE=/etc/ldap.secret
+fi
+
+SUFFIX=`getfield base`
+GSUFFIX=`getsuffix nss_base_group 'ou=Group'`
+USUFFIX=`getsuffix nss_base_passwd 'ou=People'`
+MSUFFIX=`getsuffix nss_base_hosts 'ou=Hosts'`
+
+# User properties
+[ -f /etc/adduser.conf ] && . /etc/adduser.conf
+USHELL=${DSHELL:-"/bin/bash"}
+UHOMES=${DHOME:-"/home"}"/%u"
+HOMESKEL=${SKEL:-"/etc/skel"}
+HOMEPERMS=${DIR_MODE:-"0755"}
+
+
+# Where to log
+LOGFILE="/var/log/ldapscripts.log"
+
+# Various binaries used within scripts
+LDAPSEARCHBIN=`which ldapsearch`
+LDAPADDBIN=`which ldapadd`
+LDAPDELETEBIN=`which ldapdelete`
+LDAPMODIFYBIN=`which ldapmodify`
+LDAPMODRDNBIN=`which ldapmodrdn`
+LDAPPASSWDBIN=`which ldappasswd`
+
+# Getent command to use - choose the ones used on your system. Leave blank or comment for auto-guess.
+# GNU/Linux
+GETENTPWCMD="getent passwd"
+GETENTGRCMD="getent group"
+
+
+TMPDIR="/tmp"
+##### End of configuration #####
+'''
+if __name__ == '__main__':
+ main()