openvox 7.37.1

data/lib/puppet/provider/group/ldap.rb

@@ -0,0 +1,48 @@
+require_relative '../../../puppet/provider/ldap'
+
+Puppet::Type.type(:group).provide :ldap, :parent => Puppet::Provider::Ldap do
+  desc "Group management via LDAP.
+
+    This provider requires that you have valid values for all of the
+    LDAP-related settings in `puppet.conf`, including `ldapbase`.  You will
+    almost definitely need settings for `ldapuser` and `ldappassword` in order
+    for your clients to write to LDAP.
+
+    Note that this provider will automatically generate a GID for you if you do
+    not specify one, but it is a potentially expensive operation, as it
+    iterates across all existing groups to pick the appropriate next one."
+
+  confine :feature => :ldap, :false => (Puppet[:ldapuser] == "")
+
+  # We're mapping 'members' here because we want to make it
+  # easy for the ldap user provider to manage groups.  This
+  # way it can just use the 'update' method in the group manager,
+  # whereas otherwise it would need to replicate that code.
+  manages(:posixGroup).at("ou=Groups").and.maps :name => :cn, :gid => :gidNumber, :members => :memberUid
+
+  # Find the next gid after the current largest gid.
+  provider = self
+  manager.generates(:gidNumber).with do
+    largest = 500
+    existing = provider.manager.search
+    if existing
+      existing.each do |hash|
+        value = hash[:gid]
+        next unless value
+        num = value[0].to_i
+        largest = num if num > largest
+      end
+    end
+    largest + 1
+  end
+
+  # Convert a group name to an id.
+  def self.name2id(group)
+    result = manager.search("cn=#{group}")
+    return nil unless result and result.length > 0
+
+    # Only use the first result.
+    group = result[0]
+    group[:gid][0]
+  end
+end

data/lib/puppet/provider/group/pw.rb

@@ -0,0 +1,51 @@
+require_relative '../../../puppet/provider/nameservice/pw'
+
+Puppet::Type.type(:group).provide :pw, :parent => Puppet::Provider::NameService::PW do
+  desc "Group management via `pw` on FreeBSD and DragonFly BSD."
+
+  commands :pw => "pw"
+  has_features :manages_members
+
+  defaultfor :operatingsystem => [:freebsd, :dragonfly]
+  confine    :operatingsystem => [:freebsd, :dragonfly]
+
+  options :members, :flag => "-M", :method => :mem
+
+  verify :gid, _("GID must be an integer") do |value|
+    value.is_a? Integer
+  end
+
+  def addcmd
+    cmd = [command(:pw), "groupadd", @resource[:name]]
+
+    gid = @resource.should(:gid)
+    if gid
+      unless gid == :absent
+        cmd << flag(:gid) << gid
+      end
+    end
+
+    members = @resource.should(:members)
+    if members
+      unless members == :absent
+        if members.is_a?(Array)
+          members = members.join(",")
+        end
+        cmd << "-M" << members
+      end
+    end
+
+    cmd << "-o" if @resource.allowdupe?
+
+    cmd
+  end
+
+  def modifycmd(param, value)
+    # members may be an array, need a comma separated list
+    if param == :members and value.is_a?(Array)
+      value = value.join(",")
+    end
+    super(param, value)
+  end
+end
+

data/lib/puppet/provider/group/windows_adsi.rb

@@ -0,0 +1,113 @@
+require_relative '../../../puppet/util/windows'
+
+Puppet::Type.type(:group).provide :windows_adsi do
+  desc "Local group management for Windows. Group members can be both users and groups.
+    Additionally, local groups can contain domain users."
+
+  defaultfor :operatingsystem => :windows
+  confine    :operatingsystem => :windows
+
+  has_features :manages_members
+
+  def initialize(value={})
+    super(value)
+    @deleted = false
+  end
+
+  def members_insync?(current, should)
+    return false unless current
+
+    # By comparing account SIDs we don't have to worry about case
+    # sensitivity, or canonicalization of account names.
+
+    # Cannot use munge of the group property to canonicalize @should
+    # since the default array_matching comparison is not commutative
+
+    # dupes automatically weeded out when hashes built
+    current_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(current, true)
+    specified_members = Puppet::Util::Windows::ADSI::Group.name_sid_hash(should)
+
+    current_sids = current_members.keys.to_a
+    specified_sids = specified_members.keys.to_a
+
+    if @resource[:auth_membership]
+      current_sids.sort == specified_sids.sort
+    else
+      (specified_sids & current_sids) == specified_sids
+    end
+  end
+
+  def members_to_s(users)
+    return '' if users.nil? or !users.kind_of?(Array)
+    users = users.map do |user_name|
+      sid = Puppet::Util::Windows::SID.name_to_principal(user_name)
+      if !sid
+        resource.debug("#{user_name} (unresolvable to SID)")
+        next user_name
+      end
+
+      if sid.account =~ /\\/
+        account, _ = Puppet::Util::Windows::ADSI::User.parse_name(sid.account)
+      else
+        account = sid.account
+      end
+      resource.debug("#{sid.domain}\\#{account} (#{sid.sid})")
+      sid.domain ? "#{sid.domain}\\#{account}" : account
+    end
+    return users.join(',')
+  end
+
+  def member_valid?(user_name)
+    ! Puppet::Util::Windows::SID.name_to_principal(user_name).nil?
+  end
+
+  def group
+    @group ||= Puppet::Util::Windows::ADSI::Group.new(@resource[:name])
+  end
+
+  def members
+    @members ||= Puppet::Util::Windows::ADSI::Group.name_sid_hash(group.members, true)
+
+    # @members.keys returns an array of SIDs. We need to convert those SIDs into
+    # names so that `puppet resource` prints the right output.
+    members_to_s(@members.keys).split(',')
+  end
+
+  def members=(members)
+    group.set_members(members, @resource[:auth_membership])
+  end
+
+  def create
+    @group = Puppet::Util::Windows::ADSI::Group.create(@resource[:name])
+    @group.commit
+
+    self.members = @resource[:members]
+  end
+
+  def exists?
+    Puppet::Util::Windows::ADSI::Group.exists?(@resource[:name])
+  end
+
+  def delete
+    Puppet::Util::Windows::ADSI::Group.delete(@resource[:name])
+
+    @deleted = true
+  end
+
+  # Only flush if we created or modified a group, not deleted
+  def flush
+    @group.commit if @group && !@deleted
+  end
+
+  def gid
+    Puppet::Util::Windows::SID.name_to_sid(@resource[:name])
+  end
+
+  def gid=(value)
+    fail "gid is read-only"
+  end
+
+  def self.instances
+    Puppet::Util::Windows::ADSI::Group.map { |g| new(:ensure => :present, :name => g.name) }
+  end
+end

data/lib/puppet/provider/ldap.rb

@@ -0,0 +1,141 @@
+require_relative '../../puppet/provider'
+
+# The base class for LDAP providers.
+class Puppet::Provider::Ldap < Puppet::Provider
+  require_relative '../../puppet/util/ldap/manager'
+
+  class << self
+    attr_reader :manager
+  end
+
+  # Look up all instances at our location.  Yay.
+  def self.instances
+    list = manager.search
+    return [] unless list
+
+    list.collect { |entry| new(entry) }
+  end
+
+  # Specify the ldap manager for this provider, which is
+  # used to figure out how we actually interact with ldap.
+  def self.manages(*args)
+    @manager = Puppet::Util::Ldap::Manager.new
+    @manager.manages(*args)
+
+    # Set up our getter/setter methods.
+    mk_resource_methods
+    @manager
+  end
+
+  # Query all of our resources from ldap.
+  def self.prefetch(resources)
+    resources.each do |name, resource|
+      result = manager.find(name)
+      if result
+        result[:ensure] = :present
+        resource.provider = new(result)
+      else
+        resource.provider = new(:ensure => :absent)
+      end
+    end
+  end
+
+  def manager
+    self.class.manager
+  end
+
+  def create
+    @property_hash[:ensure] = :present
+    self.class.resource_type.validproperties.each do |property|
+      val = resource.should(property)
+      if val
+        if property.to_s == 'gid'
+          self.gid = val
+        else
+          @property_hash[property] = val
+        end
+      end
+    end
+  end
+
+  def delete
+    @property_hash[:ensure] = :absent
+  end
+
+  def exists?
+    @property_hash[:ensure] != :absent
+  end
+
+  # Apply our changes to ldap, yo.
+  def flush
+    # Just call the manager's update() method.
+    @property_hash.delete(:groups)
+    @ldap_properties.delete(:groups)
+    manager.update(name, ldap_properties, properties)
+    @property_hash.clear
+    @ldap_properties.clear
+  end
+
+  def initialize(*args)
+    raise(Puppet::DevError, _("No LDAP Configuration defined for %{class_name}") % { class_name: self.class }) unless self.class.manager
+    raise(Puppet::DevError, _("Invalid LDAP Configuration defined for %{class_name}") % { class_name: self.class }) unless self.class.manager.valid?
+    super
+
+    @property_hash = @property_hash.inject({}) do |result, ary|
+      param, values = ary
+
+      # Skip any attributes we don't manage.
+      next result unless self.class.resource_type.valid_parameter?(param)
+
+      paramclass = self.class.resource_type.attrclass(param)
+
+      unless values.is_a?(Array)
+        result[param] = values
+        next result
+      end
+
+      # Only use the first value if the attribute class doesn't manage
+      # arrays of values.
+      if paramclass.superclass == Puppet::Parameter or paramclass.array_matching == :first
+        result[param] = values[0]
+      else
+        result[param] = values
+      end
+      result
+    end
+
+    # Make a duplicate, so that we have a copy for comparison
+    # at the end.
+    @ldap_properties = @property_hash.dup
+  end
+
+  # Return the current state of ldap.
+  def ldap_properties
+    @ldap_properties.dup
+  end
+
+  # Return (and look up if necessary) the desired state.
+  def properties
+    if @property_hash.empty?
+      @property_hash = query || {:ensure => :absent}
+      @property_hash[:ensure] = :absent if @property_hash.empty?
+    end
+    @property_hash.dup
+  end
+
+  # Collect the current attributes from ldap.  Returns
+  # the results, but also stores the attributes locally,
+  # so we have something to compare against when we update.
+  # LAK:NOTE This is normally not used, because we rely on prefetching.
+  def query
+    # Use the module function.
+    attributes = manager.find(name)
+    unless attributes
+      @ldap_properties = {}
+      return nil
+    end
+
+    @ldap_properties = attributes
+    @ldap_properties.dup
+  end
+end