open_directory_utils 0.1.1 → 0.1.2

data/lib/open_directory_utils/connection.rb

@@ -1,6 +1,7 @@
 require 'net/ssh'
-require "open_directory_utils/dscl"
-require "open_directory_utils/pwpolicy"
+# require "open_directory_utils/dscl"
+# require "open_directory_utils/pwpolicy"
+require "open_directory_utils/commands_base"
 require "open_directory_utils/commands_group"
 require "open_directory_utils/commands_user_attribs_od"
 require "open_directory_utils/commands_user_attribs_ldap"
@@ -10,8 +11,9 @@ module OpenDirectoryUtils
 
     attr_reader :srv_info, :dir_info
 
-    include OpenDirectoryUtils::Dscl
-    include OpenDirectoryUtils::Pwpolicy
+    # include OpenDirectoryUtils::Dscl
+    # include OpenDirectoryUtils::Pwpolicy
+    include OpenDirectoryUtils::CommandsBase
     include OpenDirectoryUtils::CommandsGroup
     include OpenDirectoryUtils::CommandsUserAttribsOd
     include OpenDirectoryUtils::CommandsUserAttribsLdap
@@ -30,6 +32,7 @@ module OpenDirectoryUtils
                     data_path: config[:dir_datapath],
                     dscl: config[:dscl_path],
                     pwpol: config[:pwpol_path],
+                    dsedit: config[:dsedit_path],
                   }
       raise ArgumentError, 'server hostname missing' if srv_info[:hostname].nil? or
                                                         srv_info[:hostname].empty?
@@ -47,10 +50,10 @@ module OpenDirectoryUtils
       # just in case clear record_name and calculate later
       params[:record_name] = nil
       ssh_cmds = send(command, params, dir_info)
-      results  = send_cmds_to_od_server(ssh_cmds)
       # pp ssh_cmds
+      results  = send_cmds_to_od_server(ssh_cmds)
       # pp results
-      format_results(results, command, params, ssh_cmds)
+      process_results(results, command, params, ssh_cmds)
       rescue ArgumentError, NoMethodError => error
         {error:  {response: error.message, command: command,
                   attributes: params, dscl_cmds: ssh_cmds}}
@@ -70,44 +73,83 @@ module OpenDirectoryUtils
       return output
     end
 
-    def format_results(results, command, params, ssh_cmds)
-      errors = true         if results.to_s.include? 'Error'
-      errors = false    unless results.to_s.include? 'Error'
+    def process_results(results, command, params, ssh_cmds)
+      results_str = results.to_s
+      errors = true         if results_str.include? 'Error'
+      errors = false    unless results_str.include? 'Error'
 
       if command.eql?(:user_exists?) or command.eql?(:group_exists?)
-        errors  = false        # in this case not actually an error
-        unless results.to_s.include?('eDSRecordNotFound')
-          results = [true]
-        else
-          results = [false]
-        end
+        found   = record_found?(results_str)
+        results = [ found, results ]
+        return format_results(results, command, params, ssh_cmds, false)
+      end
+
+      if results_str.include?('Group not found') or               # can't find group to move user into
+          results.to_s.include?('eDSRecordNotFound') or           # return error if resource wasn't found
+          results_str.include?('Record was not found') or         # can't find user to move into a group
+          results.to_s.include?('eDSAuthAccountDisabled') or      # can't set passwd when disabled
+          results_str.include?('unknown AuthenticationAuthority') # can't reset password when account disabled
+        return format_results(results, command, params, ssh_cmds, true)
+      end
+
+      if command.eql?(:user_password_verified?) or command.eql?(:user_password_ok?)
+        passed  = password_verified?(results_str)
+        results = [ passed, results ]
+        return format_results(results, command, params, ssh_cmds, false)
+      end
+
+      if command.eql?(:user_login_enabled?)
+        # puts "login enabled -- #{results}".upcase
+        enabled = login_enabled?(results_str)
+        results = [ enabled, results ]
+        return format_results(results, command, params, ssh_cmds, false)
       end
 
       if command.eql?(:user_in_group?) or command.eql?(:group_has_user?)
-        username = nil
-        username = username || params[:user_name]
-        username = username || params[:username]
-        username = username || params[:uid]
-        username = username.to_s.strip
-
-        raise ArgumentError, "username invalid or missing"  if username.eql? '' or username.include? ' '
-        raise ArgumentError, "groupname invalid or missing" if results.to_s.include?('eDSRecordNotFound')
-
-        if results.to_s.include?( username )
-          results = [true]
-        else
-          results = [false]
+        username = params[:value]
+        unless username.nil? or username.eql? '' or username.include? ' ' or
+                results_str.include?('eDSRecordNotFound')
+          results = [true, results]      if results_str.include?( username )
+          results = [false, results] unless results_str.include?( username )
         end
       end
 
-      ans = case errors
+      if errors and ( results_str.include?('eDSRecordNotFound') or
+                      results_str.include?('unknown AuthenticationAuthority') )
+        results = ["Resource not found", results]
+      end
+
+      return format_results(results, command, params, ssh_cmds, errors)
+
+    end
+
+    def format_results(results, command, params, ssh_cmds, errors)
+      answer = case errors
       when false
         {success:{response: results, command: command, attributes: params}}
       else
         {error:  {response: results, command: command,
                   attributes: params, dscl_cmds: ssh_cmds}}
       end
-      return ans
+      return answer
+    end
+
+    def login_enabled?(results_str)
+      return false if results_str.include?('account is disabled')
+      return false if results_str.include?('isDisabled=1')
+      # some enabled accounts return no policies ?#$?
+      # return true  if results_str.include?('isDisabled=0')
+      true
+    end
+
+    def password_verified?(results_str)
+      return false if results_str.include?('eDSAuthFailed')
+      true
+    end
+
+    def record_found?(results_str)
+      return false  if results_str.include?('eDSRecordNotFound')
+      true
     end
 
     def defaults
@@ -118,10 +160,11 @@ module OpenDirectoryUtils
 
         dir_username: ENV['DIR_ADMIN_USER'],
         dir_password: ENV['DIR_ADMIN_PASS'],
-        dir_datapath: (ENV['DIR_DATAPATH'] || '/LDAPv3/127.0.0.1/'),
+        dir_datapath: (ENV['DIR_DATAPATH'] || '/LDAPv3/127.0.0.1'),
 
-        dscl_path:    ENV['DSCL_PATH']  || '/usr/bin/dscl',
-        pwpol_path:   ENV['PWPOL_PATH'] || '/usr/bin/pwpolicy'
+        dscl_path:    ENV['DSCL_PATH']   || '/usr/bin/dscl',
+        pwpol_path:   ENV['PWPOL_PATH']  || '/usr/bin/pwpolicy',
+        dsedit_path:  ENV['DSEDIT_PATH'] || '/usr/sbin/dseditgroup',
       }
     end
 

data/lib/open_directory_utils/dscl.rb

@@ -23,7 +23,7 @@ module OpenDirectoryUtils
     def build_dscl_command(attribs, dir_info)
       # allow :recordname to be passed-in if using dscl directly
       attribs[:record_name] = attribs[:record_name] || attribs[:recordname]
-      # /usr/bin/dscl -u diradmin -P "BigSecret" /LDAPv3/127.0.0.1/ -append /Users/$UID_USERNAME apple-keyword "$VALUE"
+      # /usr/bin/dscl -u diradmin -P "BigSecret" /LDAPv3/127.0.0.1 -append /Users/$UID_USERNAME apple-keyword "$VALUE"
       # "/usr/bin/dscl -plist -u #{od_username} -P #{od_password} #{od_dsclpath} -#{command} #{resource} #{params}"
       ans  = "#{dir_info[:dscl]}"
       unless attribs[:format].nil?

data/lib/open_directory_utils/version.rb

@@ -1,5 +1,5 @@
 module OpenDirectoryUtils
   module Version
-    VERSION = "0.1.1"
+    VERSION = "0.1.2"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: open_directory_utils
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Bill Tihen
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-06-06 00:00:00.000000000 Z
+date: 2018-06-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: net-ssh
@@ -86,8 +86,12 @@ files:
 - Rakefile
 - bin/console
 - bin/setup
+- examples/connection-sample.yml
+- examples/create_od_users.rb
+- examples/users-sample.yml
 - lib/open_directory_utils.rb
 - lib/open_directory_utils/clean_check.rb
+- lib/open_directory_utils/commands_base.rb
 - lib/open_directory_utils/commands_group.rb
 - lib/open_directory_utils/commands_user_attribs_ldap.rb
 - lib/open_directory_utils/commands_user_attribs_od.rb