puppet-parse 0.0.1 → 0.0.2

data/lib/vendor/puppet/provider/user/aix.rb

@@ -0,0 +1,357 @@
+#
+# User Puppet provider for AIX. It uses standard commands to manage users:
+#  mkuser, rmuser, lsuser, chuser
+#
+# Notes:
+# - AIX users can have expiry date defined with minute granularity,
+#   but puppet does not allow it. There is a ticket open for that (#5431)
+# - AIX maximum password age is in WEEKs, not days
+#
+# See  http://projects.puppetlabs.com/projects/puppet/wiki/Development_Provider_Development
+# for more information
+#
+# Author::    Hector Rivas Gandara <keymon@gmail.com>
+#
+require 'puppet/provider/aixobject'
+require 'tempfile'
+require 'date'
+
+Puppet::Type.type(:user).provide :aix, :parent => Puppet::Provider::AixObject do
+  desc "User management for AIX."
+
+  # This will the the default provider for this platform
+  defaultfor :operatingsystem => :aix
+  confine :operatingsystem => :aix
+
+  # Commands that manage the element
+  commands :list      => "/usr/sbin/lsuser"
+  commands :add       => "/usr/bin/mkuser"
+  commands :delete    => "/usr/sbin/rmuser"
+  commands :modify    => "/usr/bin/chuser"
+
+  commands :lsgroup   => "/usr/sbin/lsgroup"
+  commands :chpasswd  => "/bin/chpasswd"
+
+  # Provider features
+  has_features :manages_aix_lam
+  has_features :manages_homedir, :manages_passwords
+  has_features :manages_expiry,  :manages_password_age
+
+  # Attribute verification (TODO)
+  #verify :gid, "GID must be an string or int of a valid group" do |value|
+  #  value.is_a? String || value.is_a? Integer
+  #end
+  #
+  #verify :groups, "Groups must be comma-separated" do |value|
+  #  value !~ /\s/
+  #end
+
+  # User attributes to ignore from AIX output.
+  def self.attribute_ignore
+    []
+  end
+
+  # AIX attributes to properties mapping.
+  #
+  # Valid attributes to be managed by this provider.
+  # It is a list with of hash
+  #  :aix_attr      AIX command attribute name
+  #  :puppet_prop   Puppet propertie name
+  #  :to            Method to adapt puppet property to aix command value. Optional.
+  #  :from          Method to adapt aix command value to puppet property. Optional
+  self.attribute_mapping = [
+    #:name => :name,
+    {:aix_attr => :pgrp,       :puppet_prop => :gid,
+        :to => :gid_to_attr, :from => :gid_from_attr},
+    {:aix_attr => :id,         :puppet_prop => :uid},
+    {:aix_attr => :groups,     :puppet_prop => :groups},
+    {:aix_attr => :home,       :puppet_prop => :home},
+    {:aix_attr => :shell,      :puppet_prop => :shell},
+    {:aix_attr => :expires,    :puppet_prop => :expiry,
+        :to => :expiry_to_attr, :from => :expiry_from_attr},
+    {:aix_attr => :maxage,     :puppet_prop => :password_max_age},
+    {:aix_attr => :minage,     :puppet_prop => :password_min_age},
+    {:aix_attr => :attributes, :puppet_prop => :attributes},
+  ]
+
+  #--------------
+  # Command definition
+
+  # Return the IA module arguments based on the resource param ia_load_module
+  def get_ia_module_args
+    if @resource[:ia_load_module]
+      ["-R", @resource[:ia_load_module].to_s]
+    else
+      []
+    end
+  end
+
+  # List groups and Ids
+  def lsgroupscmd(value=@resource[:name])
+    [command(:lsgroup)] +
+      self.get_ia_module_args +
+      ["-a", "id", value]
+  end
+
+  def lscmd(value=@resource[:name])
+    [self.class.command(:list)] + self.get_ia_module_args + [ value]
+  end
+
+  def lsallcmd()
+    lscmd("ALL")
+  end
+
+  def addcmd(extra_attrs = [])
+    # Here we use the @resource.to_hash to get the list of provided parameters
+    # Puppet does not call to self.<parameter>= method if it does not exists.
+    #
+    # It gets an extra list of arguments to add to the user.
+    [self.class.command(:add)] + self.get_ia_module_args +
+      self.hash2args(@resource.to_hash) +
+      extra_attrs + [@resource[:name]]
+  end
+
+  # Get modify command. Set translate=false if no mapping must be used.
+  # Needed for special properties like "attributes"
+  def modifycmd(hash = property_hash)
+    args = self.hash2args(hash)
+    return nil if args.empty?
+
+    [self.class.command(:modify)] + self.get_ia_module_args +
+      args + [@resource[:name]]
+  end
+
+  def deletecmd
+    [self.class.command(:delete)] + self.get_ia_module_args + [@resource[:name]]
+  end
+
+  #--------------
+  # We overwrite the create function to change the password after creation.
+  def create
+    super
+    # Reset the password if needed
+    self.password = @resource[:password] if @resource[:password]
+  end
+
+
+  def get_arguments(key, value, mapping, objectinfo)
+    # In the case of attributes, return a list of key=vlaue
+    if key == :attributes
+      raise Puppet::Error, "Attributes must be a list of pairs key=value on #{@resource.class.name}[#{@resource.name}]" \
+        unless value and value.is_a? Hash
+      return value.select { |k,v| true }.map { |pair| pair.join("=") }
+    end
+
+    super(key, value, mapping, objectinfo)
+  end
+
+  # Get the groupname from its id
+  def self.groupname_by_id(gid)
+    groupname=nil
+    execute(lsgroupscmd("ALL")).each_line { |entry|
+      attrs = self.parse_attr_list(entry, nil)
+      if attrs and attrs.include? :id and gid == attrs[:id].to_i
+        groupname = entry.split(" ")[0]
+      end
+    }
+    groupname
+  end
+
+  # Get the groupname from its id
+  def groupid_by_name(groupname)
+    attrs = self.parse_attr_list(execute(lsgroupscmd(groupname)).split("\n")[0], nil)
+    attrs ? attrs[:id].to_i : nil
+  end
+
+  # Check that a group exists and is valid
+  def verify_group(value)
+    if value.is_a? Integer or value.is_a? Fixnum
+      groupname = self.groupname_by_id(value)
+      raise ArgumentError, "AIX group must be a valid existing group" unless groupname
+    else
+      raise ArgumentError, "AIX group must be a valid existing group" unless groupid_by_name(value)
+      groupname = value
+    end
+    groupname
+  end
+
+  # The user's primary group.  Can be specified numerically or by name.
+  def gid_to_attr(value)
+    verify_group(value)
+  end
+
+  # Get the group gid from its name
+  def gid_from_attr(value)
+    groupid_by_name(value)
+  end
+
+  # The expiry date for this user. Must be provided in
+  # a zero padded YYYY-MM-DD HH:MM format
+  def expiry_to_attr(value)
+    # For chuser the expires parameter is a 10-character string in the MMDDhhmmyy format
+    # that is,"%m%d%H%M%y"
+    newdate = '0'
+    if value.is_a? String and value!="0000-00-00"
+      d = DateTime.parse(value, "%Y-%m-%d %H:%M")
+      newdate = d.strftime("%m%d%H%M%y")
+    end
+    newdate
+  end
+
+  def expiry_from_attr(value)
+    if value =~ /(..)(..)(..)(..)(..)/
+      #d= DateTime.parse("20#{$5}-#{$1}-#{$2} #{$3}:#{$4}")
+      #expiry_date = d.strftime("%Y-%m-%d %H:%M")
+      #expiry_date = d.strftime("%Y-%m-%d")
+      expiry_date = "20#{$5}-#{$1}-#{$2}"
+    else
+      Puppet.warn("Could not convert AIX expires date '#{value}' on #{@resource.class.name}[#{@resource.name}]") \
+        unless value == '0'
+      expiry_date = :absent
+    end
+    expiry_date
+  end
+
+  #--------------------------------
+  # Getter and Setter
+  # When the provider is initialized, create getter/setter methods for each
+  # property our resource type supports.
+  # If setter or getter already defined it will not be overwritten
+
+  #- **password**
+  #    The user's password, in whatever encrypted format the local machine
+  #    requires. Be sure to enclose any value that includes a dollar sign ($)
+  #    in single quotes (').  Requires features manages_passwords.
+  #
+  # Retrieve the password parsing directly the /etc/security/passwd
+  def password
+    password = :absent
+    user = @resource[:name]
+    f = File.open("/etc/security/passwd", 'r')
+    # Skip to the user
+    f.each_line { |l| break if l  =~ /^#{user}:\s*$/ }
+    if ! f.eof?
+      f.each_line { |l|
+        # If there is a new user stanza, stop
+        break if l  =~ /^\S*:\s*$/
+        # If the password= entry is found, return it
+        if l  =~ /^\s*password\s*=\s*(.*)$/
+          password = $1; break;
+        end
+      }
+    end
+    f.close()
+    return password
+  end
+
+  def password=(value)
+    user = @resource[:name]
+
+    # Puppet execute does not support strings as input, only files.
+    tmpfile = Tempfile.new('puppet_#{user}_pw')
+    tmpfile << "#{user}:#{value}\n"
+    tmpfile.close()
+
+    # Options '-e', '-c', use encrypted password and clear flags
+    # Must receive "user:enc_password" as input
+    # command, arguments = {:failonfail => true, :combine => true}
+    # Fix for bugs #11200 and #10915
+    cmd = [self.class.command(:chpasswd), get_ia_module_args, '-e', '-c', user].flatten
+    begin
+      output = execute(cmd, {:failonfail => false, :combine => true, :stdinfile => tmpfile.path })
+      # chpasswd can return 1, even on success (at least on AIX 6.1); empty output indicates success
+      if output != ""
+        raise Puppet::ExecutionFailure, "chpasswd said #{output}"
+      end
+    rescue Puppet::ExecutionFailure  => detail
+      raise Puppet::Error, "Could not set #{param} on #{@resource.class.name}[#{@resource.name}]: #{detail}"
+    ensure
+      tmpfile.delete()
+    end
+  end
+
+  def filter_attributes(hash)
+    # Return only not managed attributtes.
+    hash.select {
+        |k,v| !self.class.attribute_mapping_from.include?(k) and
+                !self.class.attribute_ignore.include?(k)
+      }.inject({}) {
+        |hash, array| hash[array[0]] = array[1]; hash
+      }
+  end
+
+  def attributes
+    filter_attributes(getosinfo(refresh = false))
+  end
+
+  def attributes=(attr_hash)
+    #self.class.validate(param, value)
+    param = :attributes
+    cmd = modifycmd({param => filter_attributes(attr_hash)})
+    if cmd
+      begin
+        execute(cmd)
+      rescue Puppet::ExecutionFailure  => detail
+        raise Puppet::Error, "Could not set #{param} on #{@resource.class.name}[#{@resource.name}]: #{detail}"
+      end
+    end
+  end
+
+  #- **comment**
+  #    A description of the user.  Generally is a user's full name.
+  #def comment=(value)
+  #end
+  #
+  #def comment
+  #end
+  # UNSUPPORTED
+  #- **profile_membership**
+  #    Whether specified roles should be treated as the only roles
+  #    of which the user is a member or whether they should merely
+  #    be treated as the minimum membership list.  Valid values are
+  #    `inclusive`, `minimum`.
+  # UNSUPPORTED
+  #- **profiles**
+  #    The profiles the user has.  Multiple profiles should be
+  #    specified as an array.  Requires features manages_solaris_rbac.
+  # UNSUPPORTED
+  #- **project**
+  #    The name of the project associated with a user  Requires features
+  #    manages_solaris_rbac.
+  # UNSUPPORTED
+  #- **role_membership**
+  #    Whether specified roles should be treated as the only roles
+  #    of which the user is a member or whether they should merely
+  #    be treated as the minimum membership list.  Valid values are
+  #    `inclusive`, `minimum`.
+  # UNSUPPORTED
+  #- **roles**
+  #    The roles the user has.  Multiple roles should be
+  #    specified as an array.  Requires features manages_solaris_rbac.
+  # UNSUPPORTED
+  #- **key_membership**
+  #    Whether specified key value pairs should be treated as the only
+  #    attributes
+  #    of the user or whether they should merely
+  #    be treated as the minimum list.  Valid values are `inclusive`,
+  #    `minimum`.
+  # UNSUPPORTED
+  #- **keys**
+  #    Specify user attributes in an array of keyvalue pairs  Requires features
+  #    manages_solaris_rbac.
+  # UNSUPPORTED
+  #- **allowdupe**
+  #  Whether to allow duplicate UIDs.  Valid values are `true`, `false`.
+  # UNSUPPORTED
+  #- **auths**
+  #    The auths the user has.  Multiple auths should be
+  #    specified as an array.  Requires features manages_solaris_rbac.
+  # UNSUPPORTED
+  #- **auth_membership**
+  #    Whether specified auths should be treated as the only auths
+  #    of which the user is a member or whether they should merely
+  #    be treated as the minimum membership list.  Valid values are
+  #    `inclusive`, `minimum`.
+  # UNSUPPORTED
+
+end

data/lib/vendor/puppet/provider/user/directoryservice.rb

@@ -0,0 +1,86 @@
+require 'puppet/provider/nameservice/directoryservice'
+
+Puppet::Type.type(:user).provide :directoryservice, :parent => Puppet::Provider::NameService::DirectoryService do
+  desc "User management using DirectoryService on OS X."
+
+  commands :dscl => "/usr/bin/dscl"
+  confine :operatingsystem => :darwin
+  defaultfor :operatingsystem => :darwin
+
+  # JJM: DirectoryService can manage passwords.
+  #      This needs to be a special option to dscl though (-passwd)
+  has_feature :manages_passwords
+
+  # JJM: comment matches up with the /etc/passwd concept of an user
+  options :comment, :key => "realname"
+  options :password, :key => "passwd"
+
+  autogen_defaults :home => "/var/empty", :shell => "/usr/bin/false"
+
+  verify :gid, "GID must be an integer" do |value|
+    value.is_a? Integer
+  end
+
+  verify :uid, "UID must be an integer" do |value|
+    value.is_a? Integer
+  end
+
+  def autogen_comment
+    @resource[:name].capitalize
+  end
+
+  # The list of all groups the user is a member of.
+  # JJM: FIXME: Override this method...
+  def groups
+    groups = []
+    groups.join(",")
+  end
+
+  # This is really lame.  We have to iterate over each
+  # of the groups and add us to them.
+  def groups=(groups)
+    # case groups
+    # when Fixnum
+    #     groups = [groups.to_s]
+    # when String
+    #     groups = groups.split(/\s*,\s*/)
+    # else
+    #     raise Puppet::DevError, "got invalid groups value #{groups.class} of type #{groups}"
+    # end
+    # # Get just the groups we need to modify
+    # diff = groups - (@is || [])
+    #
+    # data = {}
+    # open("| #{command(:nireport)} / /groups name users") do |file|
+    #     file.each do |line|
+    #         name, members = line.split(/\s+/)
+    #
+    #         if members.nil? or members =~ /NoValue/
+    #             data[name] = []
+    #         else
+    #             # Add each diff group's current members
+    #             data[name] = members.split(/,/)
+    #         end
+    #     end
+    # end
+    #
+    # user = @resource[:name]
+    # data.each do |name, members|
+    #     if members.include? user and groups.include? name
+    #         # I'm in the group and should be
+    #         next
+    #     elsif members.include? user
+    #         # I'm in the group and shouldn't be
+    #         setuserlist(name, members - [user])
+    #     elsif groups.include? name
+    #         # I'm not in the group and should be
+    #         setuserlist(name, members + [user])
+    #     else
+    #         # I'm not in the group and shouldn't be
+    #         next
+    #     end
+    # end
+  end
+
+
+end

data/lib/vendor/puppet/provider/user/hpux.rb

@@ -0,0 +1,31 @@
+Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
+  desc "User management for HP-UX. This provider uses the undocumented `-F`
+    switch to HP-UX's special `usermod` binary to work around the fact that
+    its standard `usermod` cannot make changes while the user is logged in."
+
+  defaultfor :operatingsystem => "hp-ux"
+  confine :operatingsystem => "hp-ux"
+
+  commands :modify => "/usr/sam/lbin/usermod.sam", :delete => "/usr/sam/lbin/userdel.sam", :add => "/usr/sbin/useradd"
+  options :comment, :method => :gecos
+  options :groups, :flag => "-G"
+  options :home, :flag => "-d", :method => :dir
+
+  verify :gid, "GID must be an integer" do |value|
+    value.is_a? Integer
+  end
+
+  verify :groups, "Groups must be comma-separated" do |value|
+    value !~ /\s/
+  end
+
+  has_features :manages_homedir, :allows_duplicates
+
+  def deletecmd
+    super.insert(1,"-F")
+  end
+
+  def modifycmd(param,value)
+    super.insert(1,"-F")
+  end
+end

data/lib/vendor/puppet/provider/user/ldap.rb

@@ -0,0 +1,129 @@
+require 'puppet/provider/ldap'
+
+Puppet::Type.type(:user).provide :ldap, :parent => Puppet::Provider::Ldap do
+  desc "User management via LDAP.
+
+    This provider requires that you have valid values for all of the
+    LDAP-related settings in `puppet.conf`, including `ldapbase`.  You will
+    almost definitely need settings for `ldapuser` and `ldappassword` in order
+    for your clients to write to LDAP.
+
+    Note that this provider will automatically generate a UID for you if
+    you do not specify one, but it is a potentially expensive operation,
+    as it iterates across all existing users to pick the appropriate next one."
+
+  confine :feature => :ldap, :false => (Puppet[:ldapuser] == "")
+
+  has_feature :manages_passwords
+
+  manages(:posixAccount, :person).at("ou=People").named_by(:uid).and.maps :name => :uid,
+    :password => :userPassword,
+    :comment => :cn,
+    :uid => :uidNumber,
+    :gid => :gidNumber,
+    :home => :homeDirectory,
+    :shell => :loginShell
+
+  # Use the last field of a space-separated array as
+  # the sn.  LDAP requires a surname, for some stupid reason.
+  manager.generates(:sn).from(:cn).with do |cn|
+    x = 1
+    cn[0].split(/\s+/)[-1]
+  end
+
+  # Find the next uid after the current largest uid.
+  provider = self
+  manager.generates(:uidNumber).with do
+    largest = 500
+    if existing = provider.manager.search
+      existing.each do |hash|
+        next unless value = hash[:uid]
+        num = value[0].to_i
+        largest = num if num > largest
+      end
+    end
+    largest + 1
+  end
+
+  # Convert our gid to a group name, if necessary.
+  def gid=(value)
+    value = group2id(value) unless [Fixnum, Bignum].include?(value.class)
+
+    @property_hash[:gid] = value
+  end
+
+  # Find all groups this user is a member of in ldap.
+  def groups
+    # We want to cache the current result, so we know if we
+    # have to remove old values.
+    unless @property_hash[:groups]
+      unless result = group_manager.search("memberUid=#{name}")
+        return @property_hash[:groups] = :absent
+      end
+
+      return @property_hash[:groups] = result.collect { |r| r[:name] }.sort.join(",")
+    end
+    @property_hash[:groups]
+  end
+
+  # Manage the list of groups this user is a member of.
+  def groups=(values)
+    should = values.split(",")
+
+    if groups == :absent
+      is = []
+    else
+      is = groups.split(",")
+    end
+
+    modes = {}
+    [is, should].flatten.uniq.each do |group|
+      # Skip it when they're in both
+      next if is.include?(group) and should.include?(group)
+
+      # We're adding a group.
+      modes[group] = :add and next unless is.include?(group)
+
+      # We're removing a group.
+      modes[group] = :remove and next unless should.include?(group)
+    end
+
+    modes.each do |group, form|
+      self.fail "Could not find ldap group #{group}" unless ldap_group = group_manager.find(group)
+
+      current = ldap_group[:members]
+
+      if form == :add
+        if current.is_a?(Array) and ! current.empty?
+          new = current + [name]
+        else
+          new = [name]
+        end
+      else
+        new = current - [name]
+        new = :absent if new.empty?
+      end
+
+      group_manager.update(group, {:ensure => :present, :members => current}, {:ensure => :present, :members => new})
+    end
+  end
+
+  # Convert a gropu name to an id.
+  def group2id(group)
+    Puppet::Type.type(:group).provider(:ldap).name2id(group)
+  end
+
+  private
+
+  def group_manager
+    Puppet::Type.type(:group).provider(:ldap).manager
+  end
+
+  def group_properties(values)
+    if values.empty? or values == :absent
+      {:ensure => :present}
+    else
+      {:ensure => :present, :members => values}
+    end
+  end
+end

data/lib/vendor/puppet/provider/user/pw.rb

@@ -0,0 +1,101 @@
+require 'puppet/provider/nameservice/pw'
+require 'open3'
+
+Puppet::Type.type(:user).provide :pw, :parent => Puppet::Provider::NameService::PW do
+  desc "User management via `pw` on FreeBSD."
+
+  commands :pw => "pw"
+  has_features :manages_homedir, :allows_duplicates, :manages_passwords, :manages_expiry
+
+  defaultfor :operatingsystem => :freebsd
+
+  options :home, :flag => "-d", :method => :dir
+  options :comment, :method => :gecos
+  options :groups, :flag => "-G"
+  options :expiry, :method => :expire
+
+  verify :gid, "GID must be an integer" do |value|
+    value.is_a? Integer
+  end
+
+  verify :groups, "Groups must be comma-separated" do |value|
+    value !~ /\s/
+  end
+
+  def addcmd
+    cmd = [command(:pw), "useradd", @resource[:name]]
+    @resource.class.validproperties.each do |property|
+      next if property == :ensure or property == :password
+      # the value needs to be quoted, mostly because -c might
+      # have spaces in it
+      if value = @resource.should(property) and value != ""
+        if property == :expiry
+          # FreeBSD uses DD-MM-YYYY rather than YYYY-MM-DD
+          value = value.split("-").reverse.join("-")
+        end
+        cmd << flag(property) << value
+      end
+    end
+
+    cmd << "-o" if @resource.allowdupe?
+
+    cmd << "-m" if @resource.managehome?
+
+    cmd
+  end
+
+  def modifycmd(param, value)
+    if param == :expiry
+      # FreeBSD uses DD-MM-YYYY rather than YYYY-MM-DD
+      value = value.split("-").reverse.join("-")
+    end
+    cmd = super(param, value)
+    cmd << "-m" if @resource.managehome?
+    cmd
+  end
+
+  def deletecmd
+    cmd = super
+    cmd << "-r" if @resource.managehome?
+    cmd
+  end
+
+  def create
+    super
+
+    # Set the password after create if given
+    self.password = @resource[:password] if @resource[:password]
+  end
+
+  # use pw to update password hash
+  def password=(cryptopw)
+    Puppet.debug "change password for user '#{@resource[:name]}' method called with hash '#{cryptopw}'"
+    stdin, stdout, stderr = Open3.popen3("pw user mod #{@resource[:name]} -H 0")
+    stdin.puts(cryptopw)
+    stdin.close
+    Puppet.debug "finished password for user '#{@resource[:name]}' method called with hash '#{cryptopw}'"
+  end
+
+  # get password from /etc/master.passwd
+  def password
+    Puppet.debug "checking password for user '#{@resource[:name]}' method called"
+    current_passline = `getent passwd #{@resource[:name]}`
+    current_password = current_passline.chomp.split(':')[1] if current_passline
+    Puppet.debug "finished password for user '#{@resource[:name]}' method called : '#{current_password}'"
+    current_password
+  end
+
+  # Get expiry from system and convert to Puppet-style date
+  def expiry
+    expiry = self.get(:expiry)
+    expiry = :absent if expiry == 0
+
+    if expiry != :absent
+      t = Time.at(expiry)
+      expiry = "%4d-%02d-%02d" % [t.year, t.month, t.mday]
+    end
+
+    expiry
+  end
+end
+