pg-ldap-sync 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1fb003bb7920f52ed32b13515630a10149a56044c43dae3d131c6d2c5d2b42ba
-  data.tar.gz: 973f117c4b23f726ffba5a0fec75b9388318428da44729076df441c92b6ca618
+  metadata.gz: 0e6ea134d34a9ff15f8e16aacb27ee545ff22a23500097e7474256c666bc4eff
+  data.tar.gz: 32aedf90f32b328497bee8df9d01943b073a6faaf6f3f4c0336b2e90f0d779cc
 SHA512:
-  metadata.gz: 022c17d2bc330f6e07a09339e0e407078af90446faf0651fd1fffb62a8fb6b271acbec0c2e9e7bc9ac608535712be63c88f5cb7ef7b00b5ccc58dc9e878e9ff5
-  data.tar.gz: c992719c0f6dd535db928c92d5c6b7223e6f1268410a13193cbb102ecd56573aaf839e57563439cf08cc9404a7a6ec81595c4787a54784d5494e9b9c0e681c0e
+  metadata.gz: 8ac395dee24a267cbab7c89ca277cb57f7bccfbdbff4f48ee6d9db2dc6f740c442df9127831658e6aa52fdbe708f853741f3b727061a7ae4c6814343ddecbc73
+  data.tar.gz: 14e0858af1c20fd488ba0ec9beb1bc5c71492e2f8904a97821612a09a2b5f4cf4def1e27631392cb4f1f88710f76564e74f9f5dd736ffd2dbf301b73725f057a

data/.travis.yml

@@ -1,17 +1,20 @@
 sudo: required
+dist: focal
 language: ruby
 rvm:
-  - "2.0.0"
+  - "2.4.0"
   - ruby-head
 env:
-  - "PGVERSION=10.0-1-linux-x64 PATH=\"/opt/PostgreSQL/10/bin:$PATH\""
-  - "PGVERSION=9.3.19-1-linux-x64 PATH=\"/opt/PostgreSQL/9.3/bin:$PATH\""
+  - "PGVERSION=14"
+  - "PGVERSION=9.6"
 before_install:
-  - gem install bundler
+  - gem install bundler --no-doc --conservative
   - bundle install
-  # Download and install postgresql version to test against in /opt
-  - |
-    wget http://get.enterprisedb.com/postgresql/postgresql-$PGVERSION.run && \
-      chmod +x postgresql-$PGVERSION.run && \
-      sudo ./postgresql-$PGVERSION.run --extract-only 1 --mode unattended
+  # Download and install postgresql version to test against in /opt (for non-cross compile only)
+  - echo "deb http://apt.postgresql.org/pub/repos/apt/ ${TRAVIS_DIST}-pgdg main $PGVERSION" | sudo tee -a /etc/apt/sources.list.d/pgdg.list
+  - wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
+  - sudo apt -y update
+  - sudo apt -y --allow-downgrades install postgresql-$PGVERSION libpq-dev
+  - export PATH=/usr/lib/postgresql/$PGVERSION/bin:$PATH
+
 script: rake test

data/CHANGELOG.md

@@ -0,0 +1,31 @@
+## 0.3.0 / 2022-01-18
+
+* Add config option :bothcase_name .
+  This adds both spellings "Fred_Flintstone" and "fred_flintstone" as PostgreSQL users/groups.
+* Update gem dependencies
+* Fix compatibility with PostgreSQL-14
+* Require ruby-2.4+
+
+
+## 0.2.0 / 2018-03-13
+
+* Update gem dependencies
+* Fix compatibility to pg-1.0 gem
+* Add `pg_ldap_sync --version`
+* Fix compatibility with PostgreSQL-10
+* Don't abort on SQL errors, but print ERROR notice
+* Run sync within a SQL transaction, so that no partial sync happens
+* Lots of improvements to the test suite
+* Run automated tests on Travis-CI and Appveyor
+* Remove support for postgres-pr, since it's no longer maintained
+
+
+## 0.1.1 / 2012-11-15
+
+* Add ability to lowercase the LDAP name for use as PG role name
+
+
+## 0.1.0 / 2011-07-13
+
+* Birthday!
+

data/README.md

@@ -1,4 +1,4 @@
-[![Build Status](https://travis-ci.org/larskanis/pg-ldap-sync.svg?branch=master)](https://travis-ci.org/larskanis/pg-ldap-sync) [![Build status](https://ci.appveyor.com/api/projects/status/09xn9q5p64jbxtka/branch/master?svg=true)](https://ci.appveyor.com/project/larskanis/pg-ldap-sync/branch/master)
+[![Build Status](https://app.travis-ci.com/larskanis/pg-ldap-sync.svg?branch=master)](https://app.travis-ci.com/larskanis/pg-ldap-sync) [![Build status](https://ci.appveyor.com/api/projects/status/09xn9q5p64jbxtka/branch/master?svg=true)](https://ci.appveyor.com/project/larskanis/pg-ldap-sync/branch/master)
 
 # Use LDAP permissions in PostgreSQL
 
@@ -24,13 +24,12 @@ It is meant to be started as a cron job.
 * Can use Active Directory as LDAP-Server
 * Nested groups/roles supported
 * Set scope of considered users/groups on LDAP and PG side
-* Runs with pg.gem (C-library) or postgres-pr.gem (pure Ruby)
 * Test mode which doesn't do any changes to the DBMS
 * Both LDAP and PG connections can be secured by SSL/TLS
 
 ## REQUIREMENTS:
 
-* Ruby-2.0+, JRuby-1.2, Rubinius-1.2 or better
+* Ruby-2.0+, JRuby-1.2+
 * LDAP-v3 server
 * PostgreSQL-server v9.0+
 
@@ -50,8 +49,9 @@ Install pg-ldap-sync and required dependencies:
 ```sh
   git clone https://github.com/larskanis/pg-ldap-sync.git
   cd pg-ldap-sync
-  bundle
-  rake install
+  gem install bundler
+  bundle install
+  bundle exec rake install
 ```
 
 ## USAGE:
@@ -74,7 +74,8 @@ Run in modify-mode:
 There is a small test suite in the `test` directory that runs against an internal LDAP server and a PostgreSQL server. Ensure `pg_ctl`, `initdb` and `psql` commands are in the `PATH` like so:
 ```sh
   cd pg-ldap-sync
-  PATH=$PATH:/usr/lib/postgresql/10/bin/ rake test
+  bundle install
+  PATH=$PATH:/usr/lib/postgresql/10/bin/ bundle exec rake test
 ```
 
 ## ISSUES:

data/appveyor.yml

@@ -1,3 +1,5 @@
+image: Visual Studio 2019
+
 init:
   - set PATH=C:/Ruby%ruby_version%/bin;c:/Program Files/Git/cmd;c:/Windows/system32;C:/Windows/System32/WindowsPowerShell/v1.0
   - set RUBYOPT=--verbose
@@ -6,7 +8,7 @@ install:
   - ver
   - ruby --version
   - gem --version
-  - gem install bundler --conservative
+  - gem install bundler --no-doc --conservative
   - bundle install
 
 build_script:
@@ -19,7 +21,7 @@ test_script:
 
 environment:
   matrix:
-    - ruby_version: "25-x64"
-      PGVER: 10
-    - ruby_version: "22"
+    - ruby_version: "27-x64"
+      PGVER: 13
+    - ruby_version: "24"
       PGVER: 10

data/config/sample-config2.yaml

@@ -25,6 +25,8 @@ ldap_users:
   name_attribute: sAMAccountName
   # lowercase name for use as PG role name
   lowercase_name: true
+  # Add lowercase name *and* original name for use as PG role names (useful for migrating between case types)
+  bothcase_name: false
 
 # Search parameters for LDAP groups which should be synchronized
 ldap_groups:

data/config/schema.yaml

@@ -20,6 +20,9 @@ mapping:
       "lowercase_name":
         type: bool
         required:  no
+      "bothcase_name":
+        type: bool
+        required:  no
 
   "ldap_groups":
     type: map
@@ -37,6 +40,9 @@ mapping:
       "lowercase_name":
         type: bool
         required:  no
+      "bothcase_name":
+        type: bool
+        required:  no
       "member_attribute":
         type: str
         required:  yes

data/lib/pg_ldap_sync/application.rb

@@ -15,11 +15,11 @@ class Application
 
   def string_to_symbol(hash)
     if hash.kind_of?(Hash)
-      return hash.inject({}){|h, v|
+      return hash.inject({}) do |h, v|
         raise "expected String instead of #{h.inspect}" unless v[0].kind_of?(String)
         h[v[0].intern] = string_to_symbol(v[1])
         h
-      }
+      end
     else
       return hash
     end
@@ -61,11 +61,19 @@ class Application
         log.warn "user attribute #{ldap_user_conf[:name_attribute].inspect} not defined for #{entry.dn}"
         next
       end
-      name.downcase! if ldap_user_conf[:lowercase_name]
-
       log.info "found user-dn: #{entry.dn}"
-      user = LdapRole.new name, entry.dn
-      users << user
+
+      names = if ldap_user_conf[:bothcase_name]
+        [name, name.downcase].uniq
+      elsif ldap_user_conf[:lowercase_name]
+        [name.downcase]
+      else
+        [name]
+      end
+
+      names.each do |n|
+        users << LdapRole.new(n, entry.dn)
+      end
       entry.each do |attribute, values|
         log.debug "   #{attribute}:"
         values.each do |value|
@@ -88,11 +96,19 @@ class Application
         log.warn "user attribute #{ldap_group_conf[:name_attribute].inspect} not defined for #{entry.dn}"
         next
       end
-      name.downcase! if ldap_group_conf[:lowercase_name]
-
       log.info "found group-dn: #{entry.dn}"
-      group = LdapRole.new name, entry.dn, entry[ldap_group_conf[:member_attribute]]
-      groups << group
+
+      names = if ldap_group_conf[:bothcase_name]
+        [name, name.downcase].uniq
+      elsif ldap_group_conf[:lowercase_name]
+        [name.downcase]
+      else
+        [name]
+      end
+
+      names.each do |n|
+        groups << LdapRole.new(n, entry.dn, entry[ldap_group_conf[:member_attribute]])
+      end
       entry.each do |attribute, values|
         log.debug "   #{attribute}:"
         values.each do |value|
@@ -106,8 +122,8 @@ class Application
 
   PgRole = Struct.new :name, :member_names
 
-  # List of default roles taken from https://www.postgresql.org/docs/current/static/default-roles.html
-  PG_BUILTIN_ROLES = %w[ pg_signal_backend pg_monitor pg_read_all_settings pg_read_all_stats pg_stat_scan_tables]
+  # List of default roles taken from https://www.postgresql.org/docs/current/predefined-roles.html
+  PG_BUILTIN_ROLES = %w[ pg_read_all_data pg_write_all_data pg_read_all_settings pg_read_all_stats pg_stat_scan_tables pg_monitor pg_database_owner pg_signal_backend pg_read_server_files pg_write_server_files pg_execute_server_program ]
 
   def search_pg_users
     pg_users_conf = @config[:pg_users]
@@ -183,12 +199,12 @@ class Application
       r.type = type
     end
 
-    log.info{
+    log.info do
       roles.each do |role|
         log.debug{ "#{role.state} #{role.type}: #{role.name}" }
       end
       "#{type} stat: create: #{roles.count{|r| r.state==:create }} drop: #{roles.count{|r| r.state==:drop }} keep: #{roles.count{|r| r.state==:keep }}"
-    }
+    end
     return roles
   end
 
@@ -234,42 +250,42 @@ class Application
   MatchedMembership = Struct.new :role_name, :has_member, :state
 
   def match_memberships(ldap_roles, pg_roles)
-    ldap_by_dn = ldap_roles.inject({}){|h,r| h[r.dn] = r; h }
-    ldap_by_m2m = ldap_roles.inject([]){|a,r|
+    hash_of_arrays = Hash.new { |h, k| h[k] = [] }
+    ldap_by_dn = ldap_roles.inject(hash_of_arrays){|h,r| h[r.dn] << r; h }
+    ldap_by_m2m = ldap_roles.inject([]) do |a,r|
       next a unless r.member_dns
-      a + r.member_dns.map{|dn|
-        if has_member=ldap_by_dn[dn]
+      a + r.member_dns.flat_map do |dn|
+        has_members = ldap_by_dn[dn]
+        log.warn{"ldap member with dn #{dn} is unknown"} if has_members.empty?
+        has_members.map do |has_member|
           [r.name, has_member.name]
-        else
-          log.warn{"ldap member with dn #{dn} is unknown"}
-          nil
         end
-      }.compact
-    }
+      end
+    end
 
-    pg_by_name = pg_roles.inject({}){|h,r| h[r.name] = r; h }
-    pg_by_m2m = pg_roles.inject([]){|a,r|
+    hash_of_arrays = Hash.new { |h, k| h[k] = [] }
+    pg_by_name = pg_roles.inject(hash_of_arrays){|h,r| h[r.name] << r; h }
+    pg_by_m2m = pg_roles.inject([]) do |a,r|
       next a unless r.member_names
-      a + r.member_names.map{|name|
-        if has_member=pg_by_name[name]
+      a + r.member_names.flat_map do |name|
+        has_members = pg_by_name[name]
+        log.warn{"pg member with name #{name} is unknown"} if has_members.empty?
+        has_members.map do |has_member|
           [r.name, has_member.name]
-        else
-          log.warn{"pg member with name #{name} is unknown"}
-          nil
         end
-      }.compact
-    }
+      end
+    end
 
     memberships  = (ldap_by_m2m & pg_by_m2m).map{|r,mo| MatchedMembership.new r, mo, :keep }
     memberships += (ldap_by_m2m - pg_by_m2m).map{|r,mo| MatchedMembership.new r, mo, :grant }
     memberships += (pg_by_m2m - ldap_by_m2m).map{|r,mo| MatchedMembership.new r, mo, :revoke }
 
-    log.info{
+    log.info do
       memberships.each do |membership|
         log.debug{ "#{membership.state} #{membership.role_name} to #{membership.has_member}" }
       end
       "membership stat: grant: #{memberships.count{|u| u.state==:grant }} revoke: #{memberships.count{|u| u.state==:revoke }} keep: #{memberships.count{|u| u.state==:keep }}"
-    }
+    end
     return memberships
   end
 

data/lib/pg_ldap_sync/version.rb

@@ -1,3 +1,3 @@
 module PgLdapSync
-  VERSION = "0.2.0"
+  VERSION = "0.3.0"
 end

data/pg-ldap-sync.gemspec

@@ -19,13 +19,14 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
   spec.rdoc_options = %w[--main README.md --charset=UTF-8]
+  spec.required_ruby_version = ">= 2.4"
 
   spec.add_runtime_dependency "net-ldap", "~> 0.16"
   spec.add_runtime_dependency "kwalify", "~> 0.7"
   spec.add_runtime_dependency "pg", ">= 0.14", "< 2.0"
   spec.add_development_dependency "ruby-ldapserver", "~> 0.3"
   spec.add_development_dependency "minitest", "~> 5.0"
-  spec.add_development_dependency "bundler", "~> 1.16"
-  spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_development_dependency "bundler", ">= 1.16", "< 3.0"
+  spec.add_development_dependency "rake", "~> 13.0"
   spec.add_development_dependency "minitest-hooks", "~> 1.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pg-ldap-sync
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Lars Kanis
@@ -10,9 +10,9 @@ bindir: exe
 cert_chain:
 - |
   -----BEGIN CERTIFICATE-----
-  MIIDLjCCAhagAwIBAgIBBjANBgkqhkiG9w0BAQsFADA9MQ4wDAYDVQQDDAVrYW5p
+  MIIDLjCCAhagAwIBAgIBCTANBgkqhkiG9w0BAQsFADA9MQ4wDAYDVQQDDAVrYW5p
   czEXMBUGCgmSJomT8ixkARkWB2NvbWNhcmQxEjAQBgoJkiaJk/IsZAEZFgJkZTAe
-  Fw0xODAzMDUwOTEzNDdaFw0xOTAzMDUwOTEzNDdaMD0xDjAMBgNVBAMMBWthbmlz
+  Fw0yMTA0MDcxMzQzNTZaFw0yMjA0MDcxMzQzNTZaMD0xDjAMBgNVBAMMBWthbmlz
   MRcwFQYKCZImiZPyLGQBGRYHY29tY2FyZDESMBAGCgmSJomT8ixkARkWAmRlMIIB
   IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApop+rNmg35bzRugZ21VMGqI6
   HGzPLO4VHYncWn/xmgPU/ZMcZdfj6MzIaZJ/czXyt4eHpBk1r8QOV3gBXnRXEjVW
@@ -21,15 +21,15 @@ cert_chain:
   Q53c63+VLGsOjODl1yPn/2ejyq8qWu6ahfTxiIlSar2UbwtaQGBDFdb2CXgEufXT
   L7oaPxlmj+Q2oLOfOnInd2Oxop59HoJCQPsg8f921J43NCQGA8VHK6paxIRDLQID
   AQABozkwNzAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHQ4EFgQUvgTdT7fe
-  x17ugO3IOsjEJwW7KP4wDQYJKoZIhvcNAQELBQADggEBAEr2BqIKipd4rQ++Qmxw
-  TU0prQzjlcDLxhQAX4JgmTMbSg8uO+cSvgsROcHfA1Cpo8VDDkZMoGISmfzmMegL
-  QvZJp0Fr1TpeVxexhZq+MnC6OgqJSBfbhHh6DCMX1QAy8fvNzcmEOwRA5d3BYmWK
-  bM8sBrAJGwrNRimekkTGTpYh5+gpiXm9JY07swwL2tR/faH/17IOXxJQ9sMXHNQU
-  In/Pt5lKfMn+h+Ts8GhM91pEJnfwmBc0ksG8tDXAKAAUWIeizjL73bwtiXXeRRlA
-  KtR70pH8rQHNxC2EvqVpBmRChJgWVMlfQofqhU2QK4s+5h52OHGZqMqCAeJ5taum
-  Lvw=
+  x17ugO3IOsjEJwW7KP4wDQYJKoZIhvcNAQELBQADggEBAGCQhS4TBqUG1bSY5gw5
+  emj2GNePHFNlXTZ/W0/7FlnXQz/LyBZeYmy4AIHcdY0w9xsu3bPNGk8kLBkHgK3Y
+  l/yWiUK0NYRI3K3yI2EoTfrHPDT8XIgBPeUUGv5Nje+SUYMQWsfYWKo3+vLEG64a
+  n1xP+1+g2Za39WCS5LwnDWMiIk47NnxR9yXErKd0Iau/Q/IarYsHFX6kWWmlMoln
+  W1lMomCcOJFwIPnsy6aqq7YfS0YcqyHjcvs1h5k3zPaIRWhoPlQivniMVMa3Txh+
+  NEF/4atY64rruzkyfxGEcrFFOHJIkWnWQjRGaiZdgULxf7ira2gEFvV/ZtamqJWF
+  c+I=
   -----END CERTIFICATE-----
-date: 2018-03-13 00:00:00.000000000 Z
+date: 2022-01-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: net-ldap
@@ -111,30 +111,36 @@ dependencies:
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.16'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.16'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: minitest-hooks
   requirement: !ruby/object:Gem::Requirement
@@ -160,8 +166,8 @@ files:
 - ".autotest"
 - ".gitignore"
 - ".travis.yml"
+- CHANGELOG.md
 - Gemfile
-- History.txt
 - LICENSE.txt
 - Manifest.txt
 - README.md
@@ -191,15 +197,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '2.4'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.3
+rubygems_version: 3.3.3
 signing_key: 
 specification_version: 4
 summary: Use LDAP permissions in PostgreSQL

data/History.txt

@@ -1,8 +0,0 @@
-=== 0.1.1 / 2012-11-15
-
-* Add ability to lowercase the LDAP name for use as PG role name
-
-=== 0.1.0 / 2011-07-13
-
-* Birthday!
-