Merged in osalmi/puppet/user (pull request #36)

user module refactoring

user/manifests/init.pp

@@ -355,37 +355,26 @@ class user::system {
 
 # Add local user account.
 #
-define user::newuser($uid, $gid, $comment, $home, $shell, $groups=undef, $requiregroups=undef) {
+define user::add($uid, $gid, $comment, $home, $shell, $groups=undef) {
 
     user { $name:
         ensure     => present,
+        managehome => true,
         uid        => $uid,
         gid        => $gid,
         comment    => $comment,
         home       => $home,
         shell      => $shell,
         groups     => $groups,
-        require => $requiregroups,
-        notify  => $::operatingsystem ? {
-            OpenBSD => [ Exec["user-mod-${name}"],
-                         Exec["user-home-${name}"], ],
-            default => undef,
-        }
     }
 
-    exec { "user-mod-${name}":
+    if $::operatingsystem == "OpenBSD" {
-        command     => "usermod -L ldap ${name}",
+        exec { "usermod -L ldap ${name}":
-        path        => "/sbin:/usr/sbin:/bin:/usr/bin",
             refreshonly => true,
+            path        => "/sbin:/usr/sbin:/bin:/usr/bin",
+            subscribe   => User[$name],
             require     => File["/etc/login.conf"],
         }
-
-    exec { "user-home-${name}":
-        command     => "/bin/sh -c 'umask 077; mkdir -p ${home} && tar cf - . | tar xf - -C ${home} && chown -R ${uid}:${gid} ${home}'",
-        cwd         => "/etc/skel",
-        path        => "/sbin:/usr/sbin:/bin:/usr/bin",
-        creates     => $home,
-        refreshonly => true,
     }
 
 }

user/scripts/update-classes.rb

@@ -1,32 +1,26 @@
+require "set"
+require "uri"
+require "ldap"
 
-require 'ldap'
+conn = nil
-require 'uri'
+basedn = nil
 
-basedn = ''
+File.readlines("/etc/openldap/ldap.conf").each do |line|
-conn = ''
-
-f = File.new('/etc/openldap/ldap.conf', 'r')
-f.readlines.each do |line|
     line = line.strip
-    next if line =~ /^#/
+    next if line.empty? or line.start_with?("#")
-    next if line == ''
     line = line.split
-    if line[0] == 'BASE'
+    if line[0] == "BASE"
         basedn = line[1]
-    elsif line[0] == 'URI'
+    elsif line[0] == "URI"
         line.shift
         line.each do |uri|
             uri = URI.parse(uri)
             begin
-                if uri.scheme == 'ldaps'
+                if uri.scheme == "ldaps"
-                    if ! uri.port
+                    uri.port = 636 unless uri.port
-                        uri.port = 636
-                    end
                     conn = LDAP::SSLConn.new(uri.host, uri.port)
                 else
-                    if ! uri.port
+                    uri.port = 389 unless uri.port
-                        uri.port = 389
-                    end
                     conn = LDAP::Conn.new(uri.host, uri.port)
                 end
                 conn.bind
@@ -37,67 +31,52 @@ f.readlines.each do |line|
         end
     end
 end
-f.close
 
-user_classes = []
+groups = {}
-group_classes = []
+user_pp = []
+group_pp = []
 
-userlist = {}
+filter = "objectClass=posixAccount"
-conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, 'objectClass=posixAccount',
+attrib = %w(uid gidNumber)
-            ['uid', 'gidNumber']) { |entry|
+conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, filter, attrib) do |entry|
-    groups = []
+    uid = entry["uid"].first
-    filter = '(&(objectClass=posixGroup)(|(uniqueMember=' + entry.get_dn + \
+    next if uid.include?("$") # skip samba machine accounts
-	     ')(memberUid=' + entry['uid'][0] + ')))'
-    conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, filter, ['cn']) { |group|
-        groups << group['cn'][0]
-    }
-    conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, \
-                '(&(objectClass=posixGroup)(gidNumber=' + \
-		entry['gidNumber'][0] + '))', \
-                ['cn']) { |group|
-	groups << group['cn'][0]
-    }
 
-    # create user class
+    dn = entry.get_dn
-    if entry['uid'][0] !~ /.*\$.*/
+    gidnumber = entry["gidNumber"].first
-	user_classes << "class user::user::" + entry['uid'][0] + " inherits user::virtual {\n"
+
-	user_classes << "    realize(User::Newuser['" + entry['uid'][0] + "'])\n"
+    gids = Set.new
-	groups.each do |group|
+
-	    user_classes << "    realize(Group['" + group + "'])\n"
+    # find primary group
-	end
+    filter = "(&(objectClass=posixGroup)(gidNumber=#{gidnumber}))"
-	user_classes << "}\n\n"
+    conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, filter, ["cn"]) do |group|
+        gid = group["cn"].first
+        gids << gid
+        groups[gid] = Set.new unless groups.has_key?(gid)
+        groups[gid] << uid
     end
 
-    userlist[entry.get_dn()] = entry['uid'][0]
+    # find supplementary groups
-}
+    filter = "(&(objectClass=posixGroup)(|(uniqueMember=#{dn})(memberUid=#{uid})))"
+    conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, filter, ["cn"]) do |group|
+        gid = group["cn"].first
+        gids << gid
+        groups[gid] = Set.new unless groups.has_key?(gid)
+        groups[gid] << uid
+    end
 
+    user_pp << "class user::user::#{uid} inherits user::virtual {\n\n"
+    user_pp << "    realize(User::Add[\"#{uid}\"])\n"
+    gids.sort.each { |gid| user_pp << "    realize(Group[\"#{gid}\"])\n" }
+    user_pp << "\n}\n\n"
+end
 
-conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, 'objectClass=posixGroup',
+groups.each do |gid, uids|
-	    ['cn', 'gidNumber', 'memberUid', 'uniqueMember']) { |entry|
+    next if uids.length == 1 and uids.include?(gid)
+    group_pp << "class user::group::%s {\n\n" % gid
+    uids.sort.each { |uid| group_pp << "    include user::user::#{uid}\n" }
+    group_pp << "\n}\n\n"
+end
 
-    members = []
+puts user_pp if ARGV.include?("-u")
-    if entry.attrs.index('memberUid')
+puts group_pp if ARGV.include?("-g")
-	entry['memberUid'].each do |member|
-	    if userlist.has_value?(member)
-		members << member
-	    end
-	end
-    end
-    if entry.attrs.index('uniqueMember')
-	entry['uniqueMember'].each do |member|
-	    if userlist.has_key?(member)
-		members << userlist[member]
-	    end
-	end
-    end
-    if members.length > 0
-	group_classes << "class user::group::" + entry['cn'][0] + " {\n"
-	members.uniq.sort.each do |member|
-	    group_classes << "    include user::user::" + member + "\n"
-	end
-	group_classes << "}\n\n"
-    end
-}
-
-puts user_classes if ARGV.include?("-u")
-puts group_classes if ARGV.include?("-g")

user/scripts/update-virtual.rb

@@ -1,32 +1,26 @@
+require "set"
+require "uri"
+require "ldap"
 
-require 'ldap'
+conn = nil
-require 'uri'
+basedn = nil
 
-basedn = ''
+File.readlines("/etc/openldap/ldap.conf").each do |line|
-conn = ''
-
-f = File.new('/etc/openldap/ldap.conf', 'r')
-f.readlines.each do |line|
     line = line.strip
-    next if line =~ /^#/
+    next if line.empty? or line.start_with?("#")
-    next if line == ''
     line = line.split
-    if line[0] == 'BASE'
+    if line[0] == "BASE"
         basedn = line[1]
-    elsif line[0] == 'URI'
+    elsif line[0] == "URI"
         line.shift
         line.each do |uri|
             uri = URI.parse(uri)
             begin
-                if uri.scheme == 'ldaps'
+                if uri.scheme == "ldaps"
-                    if ! uri.port
+                    uri.port = 636 unless uri.port
-                        uri.port = 636
-                    end
                     conn = LDAP::SSLConn.new(uri.host, uri.port)
                 else
-                    if ! uri.port
+                    uri.port = 389 unless uri.port
-                        uri.port = 389
-                    end
                     conn = LDAP::Conn.new(uri.host, uri.port)
                 end
                 conn.bind
@@ -37,76 +31,74 @@ f.readlines.each do |line|
         end
     end
 end
-f.close
 
-print "class user::virtual {\n"
+virtual = "class user::virtual {\n"
 
-conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, 'objectClass=posixAccount',
+filter = "objectClass=posixAccount"
-	    ['uid', 'uidNumber', 'gidNumber', 'gecos', 'homeDirectory',
+attrib = %w(uid uidNumber gidNumber gecos homeDirectory loginShell)
-	     'loginShell' ]) { |entry|
+conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, filter, attrib) do |entry|
-    groups = []
+    dn = entry.get_dn
-    filter = '(&(objectClass=posixGroup)(|(uniqueMember=' + entry.get_dn \
+    uid = entry["uid"].first
-	     + ')(memberUid=' + entry['uid'][0] + ')))'
+    uidnumber = entry["uidNumber"].first
-    conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, filter, ['cn']) { |group|
+    gidnumber = entry["gidNumber"].first
-	groups << group['cn'][0]
+
-    }
+    primarygroup = nil
-    prigroup = nil
+    groups = Set.new
-    conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, \
+
-		'(&(objectClass=posixGroup)(gidNumber=' + entry['gidNumber'][0] + '))', \
+    filter = "(&(objectClass=posixGroup)(gidNumber=#{gidnumber}))"
-		['cn']) { |group|
+    conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, filter, ["cn"]) do |group|
-	prigroup = group['cn'][0]
+        primarygroup = group["cn"].first
+    end
+
+    continue if primarygroup.nil?
+
+    filter = "(&(objectClass=posixGroup)(|(uniqueMember=#{dn})(memberUid=#{uid})))"
+    conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, filter, ["cn"]) do |group|
+        groups << group["cn"].first
+    end
+
+    comment = entry["gecos"] ? entry["gecos"].first : entry["uid"].first
+    shell = entry["loginShell"] ? entry["loginShell"].first : "/bin/bash"
+    home = entry["homeDirectory"].first
+
+    virtual << <<-EOF
+
+    @user::add { "#{uid}":
+        uid     => "#{uidnumber}",
+        gid     => "#{gidnumber}",
+        comment => "#{comment}",
+        home    => "#{home}",
+        shell   => "#{shell}",
+    EOF
+
+    unless groups.empty?
+        virtual << "        groups  => $::operatingsystem ? {\n"
+        virtual << "            \"openbsd\" => [ "
+        groups.each { |group| virtual << "\"#{group}\", " }
+        virtual << "\"wheel\", " if groups.include?("sysadm")
+        virtual << "],\n            default   => [ "
+        groups.each { |group| virtual << "\"#{group}\", " }
+        virtual << "],\n        },\n"
+    end
+    virtual << "        require => [\n"
+    virtual << "            Group[\"#{primarygroup}\"],\n"
+    groups.each { |group| virtual << "            Group[\"#{group}\"],\n" }
+    virtual << "        ],\n    }\n"
+end
+
+filter = "objectClass=posixGroup"
+attrib = %w(cn gidNumber memberUid uniqueMember)
+conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, filter, attrib) do |entry|
+    cn = entry["cn"].first
+    gid = entry["gidNumber"].first
+
+    virtual << <<-EOF
+
+    @group { "#{cn}":
+        ensure => present,
+        gid    => "#{gid}",
     }
+    EOF
+end
 
-    print "\n"
+puts virtual, "\n}"
-    print "    @user::newuser { '%s':\n" % entry['uid'][0]
-    print "        uid           => '%s',\n" % entry['uidNumber'][0]
-    print "        gid           => '%s',\n" % entry['gidNumber'][0]
-    begin
-        print "        comment       => '%s',\n" % entry['gecos'][0]
-    rescue
-        print "        comment       => '%s',\n" % entry['uid'][0]
-    end
-    print "        home          => '%s',\n" % entry['homeDirectory'][0]
-    begin
-        print "        shell         => '%s',\n" % entry['loginShell'][0]
-    rescue
-        print "        shell         => '%s',\n" % "/bin/bash"
-    end
-    if groups.length > 0
-	print "        groups        => $operatingsystem ? {\n"
-	print "            openbsd => [ "
-	groups.each do |group|
-	    print "'" + group + "', "
-	end
-	print "'wheel', " if groups.include?('sysadm')
-	print "],\n"
-	print "            default => [ "
-	groups.each do |group|
-	    print "'" + group + "', "
-	end
-	print "],\n        },\n"
-    end
-    print "        requiregroups => [ Group['" + prigroup + "'],"
-    groups.each do |group|
-	print "\n                           Group['" + group + "'],"
-    end
-    print " ],\n"
-    print "    }\n"
-
-}
-
-
-conn.search(basedn, LDAP::LDAP_SCOPE_SUBTREE, 'objectClass=posixGroup',
-	    ['cn', 'gidNumber', 'memberUid', 'uniqueMember']) { |entry|
-
-    # generate virtual group entry
-    print "\n"
-    print "    @group { '" + entry['cn'][0] + "':\n"
-    print "        ensure => present,\n"
-    print "        gid    => '" + entry['gidNumber'][0] + "',\n"
-    print "    }\n"
-
-}
-
-
-print "\n}\n"