ucert 0.2.57

data/lib/ucert/vpn_tracker.rb

@@ -0,0 +1,94 @@
+#--
+# ucert
+#
+# A  Ruby library for enterprise user account certification / recertification / audit project
+#
+# Copyright (c)  CMBNY Risk Department
+#++
+
+# Class to handle VPN user account IDs
+class Ucert::VpnTracker
+	include Ucert::Utils
+	# Class constant variables
+
+	attr_accessor  :verbose
+	attr_reader    :vpn_user_entitlement
+
+  # Instance default variables
+  def initialize (params ={})
+
+    @verbose=params.fetch(:verbose, false)
+    # VPN users are defined by assigning AD user into 3 different containers in CMBNY domain controller
+    # Refer to the screenshot for further details
+		#
+		#
+		# Load the group entitlement instance variable
+    @vpn_class={"CN=Class1VPN,CN=Users,DC=ny,DC=cmbchina,DC=com"=>"class_1", "CN=Class2VPN,CN=Users,DC=ny,DC=cmbchina,DC=com"=>"class_2", "CN=Class3VPN,CN=Users,DC=ny,DC=cmbchina,DC=com"=>"class_3"}
+		# Load the user entitlement instance variable by perform the AD lookup
+		@vpn_user_entitlement=parse_vpn_user_info
+	end
+
+  # Parsing the VPN user entitlement report in CSV format
+	def parse_vpn_user_info
+			begin
+				puts "Parsing known AD objects in search of the current VPN users" if @verbose
+				vpn_entitlement=Hash.new
+        user_record=0
+        tracker=Ucert::AdTracker.new
+				tracker.ad_person_records.keys.map do |record|
+          puts "Processing record #{record.inspect}" if @verbose
+          memberships=tracker.get_dn_attributes("person", record, "memberOf")
+          my_class = memberships & @vpn_class.keys
+					if my_class.size >0
+						puts "VPN user found: #{record}" if @verbose
+						user_record+=1
+						vpn_entitlement[user_record]=Hash.new unless vpn_entitlement[user_record]
+						vpn_entitlement[user_record]['CN']=tracker.extract_first_cn(record)
+						vpn_entitlement[user_record]['department']=tracker.get_dn_attribute("person",record,"department")
+						vpn_entitlement[user_record]['sAMAccountName']=tracker.get_dn_attribute("person",record,"sAMAccountName")
+						vpn_entitlement[user_record]['VPN Class']=@vpn_class[my_class.first]
+						vpn_entitlement[user_record]['DN']=record
+					end
+			  end
+				tracker=nil
+        return vpn_entitlement
+      rescue => ee
+				puts "Exception on method #{__method__}: #{ee}"
+			end
+	end
+
+	# Print out the user entitlement table in plain text, to be imported into database
+	def print_user_entitlement
+		begin
+			puts "VPN User Entitlement Report in Plain-text Format" if @verbose
+      @vpn_user_entitlement[1].keys.map {|x| print x,"|"} if @verbose
+			puts if @verbose
+			@vpn_user_entitlement.values.each do |record|
+				record.values.map {|y| print y,"|"}
+				puts
+			end
+      puts
+		rescue => ee
+			puts "Exception on method #{__method__}: #{ee}"
+		end
+	end
+  alias_method :print_user, :print_user_entitlement
+
+
+	# Search user entitlement record by AD DN
+	def vpn_search_by_dn (dn)
+		begin
+      puts "Perform search on the user entitlement record by AD DN: #{dn}" if @verbose
+      @vpn_user_entitlement.each do |key, val|
+          return val if @vpn_user_entitlement[key]['DN'].eql? dn
+      end
+			return nil
+    rescue => ee
+      puts "Exception on method #{__method__}: #{ee}"
+    end
+	end
+	alias_method  :search_by_dn, :vpn_search_by_dn
+
+	private	:parse_vpn_user_info
+
+end

data/lib/ucert/wms_tracker.rb

@@ -0,0 +1,240 @@
+#--
+# ucert
+#
+# A  Ruby library for enterprise user account certification / recertification / audit project
+#
+# Copyright (c)  CMBNY Risk Department
+#++
+
+# Class to handle Wms user account IDs
+class Ucert::WmsTracker
+	include Ucert::Utils
+	# Class constant variables
+
+	attr_accessor  :verbose, :wms_user_report, :wms_role_report, :file_user_map
+	attr_reader    :wms_user_entitlement, :wms_role_entitlement, :wms_2_ad_user
+
+  # Instance default variables
+  def initialize (params ={})
+
+    @verbose=params.fetch(:verbose, false)
+    # Wms user entitlement report in CSV format, generated by Ryan Li's user table exportation script
+    @wms_user_report = File.dirname(__FILE__)+"/../../data/wms/user_rpt.txt"
+		# Wms user entitlement report in CSV format, generated by Ryan Li's user table exportation script
+    @wms_role_report = File.dirname(__FILE__)+"/../../data/wms/role_rpt.txt"
+		# WMS to AD user map file
+		@file_user_map =  File.dirname(__FILE__)+"/../../data/wms/wms_user_map.txt"
+		# Load the user map file to an instance variable (for performance gain)
+		@wms_2_ad_user=load_known_user_map_from_file(@file_user_map)
+		# Load the user entitlement instance variable from the native Wms user entitlement report
+		@wms_user_entitlement=parse_wms_user_report(@wms_user_report)
+		# Insert DN field into the user entitlement data structure
+		insert_dn
+		# Load the role entitlement instance variable from the native Wms role entitlement reportk=Uc
+    @wms_role_entitlement=parse_wms_role_report(@wms_role_report)
+		save!
+	end
+
+  # Parsing the Wms user entitlement report in CSV format
+	def parse_wms_user_report (file)
+			begin
+        user_entitlement=Hash.new
+        user_record=0
+        line_cnt=0
+				cur_user_id=String.new
+        File.open(file,'r:gb2312:UTF-8').each do |line|
+          puts "Processing line number #{line_cnt.inspect}" if @verbose
+          # skip the 1st line of the file (header line)
+          if line_cnt == 0
+            line_cnt+=1
+            next
+          end
+#          entry=line.chomp.split(/(\t|\,)/).map {|x| x.gsub("\"","")} # clean the entry data
+					entry=line.chomp.split(",").map {|x| x.gsub("\"","")} # clean the entry data
+          puts entry.inspect if @verbose
+          # Determine the start of a user_user_record
+          entry[0].strip!
+          if entry[0].nil?
+						line_cnt+=1
+            next
+        	elsif entry[0].empty?
+						line_cnt+=1
+						next
+						#app=Hash.new
+          elsif entry[0] != cur_user_id
+            user_record+=1
+						cur_user_id = entry[0]
+          end
+          user_entitlement[user_record]=Hash.new unless user_entitlement.key?(user_record)
+  				user_entitlement[user_record]['USERID']=entry[0].strip unless user_entitlement[user_record]['USERID']
+          user_entitlement[user_record]['USERNAME']=entry[1].strip unless user_entitlement[user_record]['USERNAME']
+					user_entitlement[user_record]['STATUS']=entry[2] unless user_entitlement[user_record]['STATUS']
+					user_entitlement[user_record]['ORGNAME']=entry[3] unless user_entitlement[user_record]['ORGNAME']
+          user_entitlement[user_record]['ROLEID']=Hash.new unless user_entitlement[user_record]['ROLEID']
+          unless entry[4].nil?
+            unless entry[4].empty?
+              role=Hash.new
+              role[entry[4]]=true
+              user_entitlement[user_record]['ROLEID'].merge!(role)
+            end
+          end
+          line_cnt+=1
+          #return if line_cnt==3
+			  end
+        return user_entitlement
+      rescue => ee
+				puts "Exception on method #{__method__}: #{ee}"
+			end
+	end
+
+  # Parsing the WMS role entitlement report in CSV format
+	def parse_wms_role_report (file)
+			begin
+        role_entitlement=Hash.new
+        line_cnt=0
+				cur_role_id = String.new
+        File.open(file,'r:gb2312:UTF-8').each do |line|
+          puts "Processing line number #{line_cnt.inspect}" if @verbose
+          # skip the 1st line of the file (header line)
+          if line_cnt == 0
+            line_cnt+=1
+            next
+          end
+          entry=line.chomp.split(',').map {|x| x.gsub("\"","")} # clean the entry data
+          puts entry.inspect if @verbose
+          # Determine the start of a user_record
+          entry[0].strip!
+          if entry[0].nil?
+            #do nothing
+						line_cnt+=1
+						next
+          elsif entry[0].empty?
+            #do nothing
+						line_cnt+=1
+						next
+          elsif entry[0]!=cur_role_id
+						puts "Processing role_id: #{entry[0]}" if @verbose
+						cur_role_id = entry[0]
+          end
+  				role_entitlement[cur_role_id] = Hash.new unless role_entitlement.key?(cur_role_id)
+          role_entitlement[cur_role_id]['ROLENAME'] = entry[1] unless role_entitlement[cur_role_id]['ROLENAME']
+					role_entitlement[cur_role_id]['PRV'] = Array.new unless role_entitlement[cur_role_id]['PRV']
+          unless entry[2].nil?
+            prv=Hash.new
+            prv['PRVID']=entry[2]
+						prv['PRVNAME']=entry[3]
+            prv['URL']=entry[4]
+            role_entitlement[cur_role_id]['PRV'].push(prv)
+          end
+          line_cnt+=1
+			  end
+        return role_entitlement
+			rescue => ee
+				puts "Exception on method #{__method__}: #{ee}"
+			end
+	end
+
+	# Procedures to add additonal field 'dn' into the @wms_user_entitlement data structure, by person the AD search
+	def insert_dn
+			begin
+				 tracker = Ucert::AdTracker.new(:verbose=>false)
+				 @wms_user_entitlement.each do |index, record|
+					puts "\n\nPerform DN lookup for record: #{record}" if @verbose
+					key1 = record['USERNAME'] if record['USERNAME']
+					key2 = record['USERID'] if record['USERID']
+					my_key = key1.upcase + ":" + key2.upcase
+					puts "Perform 1st order search from the local cache: #{my_key}" if @verbose
+					if @wms_2_ad_user.key?(my_key)
+						dn=@wms_2_ad_user[my_key]
+						# additional logic to update the existing DN record
+						unless tracker.ad_person_records.key?(dn)
+							dn = update_dn(tracker,dn)
+						end
+						puts "Found in the local cache file: #{dn}" if @verbose
+					else
+						if dn.nil? and !key1.nil?
+							puts "Perform 2nd order search only if the 1st one fail, by using: #{key1}" if @verbose
+							dn = tracker.ad_search_by_text(key1, "person")
+						end
+						if dn.nil? and !key2.nil?
+							puts "Perform 3rd order search only if the last fail, by using: #{key2}" if @verbose
+							dn = tracker.ad_search_by_text(key2, "person")
+						end
+					end
+					@wms_user_entitlement[index]['DN'] = dn
+				end
+				tracker=nil
+			rescue => ee
+				puts "Exception on method #{__method__}: #{ee}"
+				tracker=nil
+			end
+	end
+
+	# Print out the user entitlement table in plain text, to be imported into database
+	def print_user_entitlement
+		begin
+      puts "user Entitlement Report in Plain-text Format" if @verbose
+			@wms_user_entitlement.first[1].each {|k,v| print k,"|"} if @verbose
+			puts if @verbose
+			@wms_user_entitlement.values.map do |rec|
+				rec.each {|k,v| print v,"|"}
+				puts
+      end
+		rescue => ee
+			puts "Exception on method #{__method__}: #{ee}"
+		end
+	end
+  alias_method :print_user, :print_user_entitlement
+
+  # Print out the role entitlement table in plain text, to be imported into database
+  def print_role_entitlement
+    begin
+      puts "Role Entitlement Report in Plain-text Format" if @verbose
+      puts "ROLEID	| ROLENAME	| PRIVILEGE" if @verbose
+      @wms_role_entitlement.each do |key, record|
+          puts "#{key}|#{record['ROLENAME']}|#{record['PRV']}"
+					# "\t#{record['VERSION']}\t#{record['FUNCTION']}"
+      end
+    rescue => ee
+      puts "Exception on method #{__method__}: #{ee}"
+    end
+  end
+  alias_method :print_role, :print_role_entitlement
+
+	# Save the WMS to AD user mapping relation into the cache file
+	def save_wms_user_map!(file=@file_user_map)
+		puts "Saving the known Wms to AD user mapping relationship to file: #{file} ..." if @verbose
+		begin
+			timestamp=Time.now
+			f=File.open(file, 'w')
+			f.write "# local Wms to AD user map file created by the #{self.class} class #{__method__} method at: #{timestamp}"
+			@wms_user_entitlement.values.map do |record|
+				key = record['USERNAME'].upcase + ':' + record['USERID'].upcase
+				value = record['DN']
+				f.write "\n#{key}|#{value}"
+			end
+			f.close
+			puts "WMS to AD user map file is successfully saved to: #{file}" if @verbose
+		rescue => ee
+			puts "Exception on method #{__method__}: #{ee}" if @verbose
+		end
+	end
+	alias_method  :save!, :save_wms_user_map!
+
+	# Search user entitlement record by AD DN
+	def wms_search_by_dn (dn)
+		begin
+      puts "Perform search on the user entitlement record by AD DN: #{dn}" if @verbose
+      @wms_user_entitlement.each do |key, val|
+          return val if @wms_user_entitlement[key]['DN'].eql? dn
+      end
+			return nil
+    rescue => ee
+      puts "Exception on method #{__method__}: #{ee}"
+    end
+	end
+	alias_method  :search_by_dn, :wms_search_by_dn
+
+	private	:parse_wms_user_report, :parse_wms_role_report, :insert_dn
+
+end

data/lib/ucert/yst_tracker.rb

@@ -0,0 +1,264 @@
+#--
+# ucert
+#
+# A  Ruby library for enterprise user account certification / recertification / audit project
+#
+# Copyright (c)  CMBNY Risk Department
+#++
+
+# Class to handle Yi Shi Tong (一事通) user account IDs
+class Ucert::YstTracker
+	include Ucert::Utils
+	# Class constant variables
+
+	attr_accessor  :verbose, :yst_user_report, :yst_org_report, :file_user_map
+	attr_reader    :yst_user_entitlement, :yst_org_entitlement, :yst_2_ad_user
+
+  # Instance default variables
+  def initialize (params ={})
+
+    @verbose=params.fetch(:verbose, false)
+    # Yst user entitlement report in CSV format, generated by Ryan Li's user table exportation script
+    @yst_user_report = File.dirname(__FILE__)+"/../../data/yst/YiShiTong_User.csv"
+		# Yst user entitlement report in CSV format, generated by Ryan Li's user table exportation script
+    @yst_org_report = File.dirname(__FILE__)+"/../../data/yst/YiShiTong_Org.csv"
+		# Yst to AD user map file
+		@file_user_map =  File.dirname(__FILE__)+"/../../data/yst/yst_user_map.txt"
+		# Load the user map file to an instance variable (for performance gain)
+		@yst_2_ad_user=load_known_user_map_from_file(@file_user_map)
+		# Load the user entitlement instance variable from the native Yst user entitlement report
+		@yst_user_entitlement=parse_yst_user_report(@yst_user_report)
+		# Insert DN field into the user entitlement data structure
+		insert_dn
+		# Load the org entitlement instance variable from the native Yst org entitlement reportk=Uc
+    @yst_org_entitlement=parse_yst_org_report(@yst_org_report)
+		save!
+	end
+
+  # Parsing the Yst user entitlement report in CSV format
+	def parse_yst_user_report (file)
+			begin
+        user_entitlement=Hash.new
+        user_record=0
+        line_cnt=0
+				cur_user_id=String.new
+				header=Array.new
+#        File.open(file,'r:gb18030:UTF-8').each do |line|
+				# YST report encoding format change since September 2017. Refer to Ryan Li for more info. - Yang Li
+				File.open(file,'r').each do |line|
+          puts "Processing YST user report line number #{line_cnt.inspect}" if @verbose
+					entry=line.chomp.split(",").map {|x| x.gsub(/(\s|\")/,"")}
+          # skip the 1st line of the file (header line)
+          if line_cnt == 0
+						header=entry
+            line_cnt+=1
+            next
+          end
+					 # clean the entry data
+          puts entry.inspect if @verbose
+          # Determine the start of a user_user_record
+          entry[0].strip!
+          if entry[0].nil?
+						line_cnt+=1
+            next
+        	elsif entry[0].empty?
+						line_cnt+=1
+						next
+						#app=Hash.new
+          elsif entry[0] != cur_user_id
+            user_record+=1
+						cur_user_id=entry[0]
+          end
+          record=Hash[header.zip(entry)] unless entry[0].nil?
+					puts "User record: #{record}" if @verbose
+          user_entitlement[user_record]=record unless user_entitlement.key?(user_record)
+          line_cnt+=1
+			  end
+        return user_entitlement
+      rescue => ee
+				puts "Exception on method #{__method__}: #{ee}"
+			end
+	end
+
+  # Parsing the Yi Shi Tong org entitlement report in CSV format
+	def parse_yst_org_report (file)
+		begin
+			org_entitlement=Hash.new
+			line_cnt=0
+			cur_org_id=String.new
+			header=Array.new
+			#File.open(file,'r:gb18030:UTF-8').each do |line|
+			# YST report encoding format change since September 2017. Refer to Ryan Li for more info. - Yang Li
+			File.open(file,'r').each do |line|
+				puts "Processing YST organization report line number #{line_cnt.inspect}" if @verbose
+				entry=line.chomp.split(",").map {|x| x.gsub(/(\s|\")/,"")}
+				# skip the 1st line of the file (header line)
+				if line_cnt == 0
+					header=entry
+					line_cnt+=1
+					next
+				end
+				 # clean the entry data
+				puts entry.inspect if @verbose
+				# Determine the start of a user_user_record
+				entry[0].strip!
+				if entry[0].nil?
+					line_cnt+=1
+					next
+				elsif entry[0].empty?
+					line_cnt+=1
+					next
+					#app=Hash.new
+				elsif entry[0] != cur_org_id
+					cur_org_id=entry[0]
+				end
+				record=Hash[header.zip(entry)] unless entry[0].nil?
+				puts "User record: #{record}" if @verbose
+				org_entitlement[cur_org_id]=record unless org_entitlement.key?(cur_org_id)
+				line_cnt+=1
+			end
+			return org_entitlement
+		rescue => ee
+			puts "Exception on method #{__method__}: #{ee}"
+		end
+	end
+
+	# Procedures to add additonal field 'dn' into the @yst_user_entitlement data structure, by person the AD search
+	def insert_dn
+			begin
+				 puts "Insert DN into the record ..." if @verbose
+				 tracker = Ucert::AdTracker.new(:verbose=>@verbose)
+				 @yst_user_entitlement.each do |index, record|
+					puts "\n\nPerform DN lookup for record: #{record}" if @verbose
+					key1 = record['USER_NAME'] if record['USER_NAME']
+					key2 = record['EMAIL'] if record['EMAIL']
+					key3 = key2.gsub(/\d+/,"")
+					key4 = key3.split("_")[0]
+					my_key = key1.upcase + ":" + key2.upcase
+					puts "Perform 1st order search from the local cache: #{my_key}" if @verbose
+					if @yst_2_ad_user.key?(my_key)
+						dn=@yst_2_ad_user[my_key]
+						# additional logic to update the existing DN record
+						unless tracker.ad_person_records.key?(dn)
+							dn = update_dn(tracker,dn)
+						end
+						puts "Found in the local cache file: #{dn}" if @verbose
+					else
+						if dn.nil? and !key1.nil?
+							puts "Perform 2nd order search only if the 1st one fail, by using: #{key1}" if @verbose
+							dn = tracker.ad_search_by_text(key1, "person")
+						end
+						if dn.nil? and !key2.nil?
+							puts "Perform 3rd order search only if the last fail, by using: #{key2}" if @verbose
+							dn = tracker.ad_search_by_text(key2, "person")
+						end
+						if dn.nil? and !key3.nil?
+							puts "Perform 4th order search only if the last fail, by using: #{key3}" if @verbose
+							dn = tracker.ad_search_by_text(key3, "person")
+						end
+						if dn.nil? and !key4.nil?
+							puts "Perform 5th order search only if the last fail, by using: #{key4}" if @verbose
+							dn = tracker.ad_search_by_text(key4, "person")
+						end
+					end
+					@yst_user_entitlement[index]['DN'] = dn
+				end
+				tracker=nil
+			rescue => ee
+				puts "Exception on method #{__method__}: #{ee}"
+				tracker=nil
+			end
+	end
+
+  # DN lookup via YST for systems under YST, such as CVM
+	def yst_id_2_dn (id)
+		@yst_user_entitlement.each do |key,val|
+			return val["DN"] if val["USER_ID"] == id.strip
+		end
+		return nil
+	end
+
+
+	# Print out the user entitlement table in plain text, to be imported into database
+	def print_user_entitlement
+		begin
+      puts "User Entitlement Report in Plain-text Format" if @verbose
+			@yst_user_entitlement.first[1].each {|k,v| print k,"|"} if @verbose
+			puts if @verbose
+			@yst_user_entitlement.values.map do |rec|
+				rec.each {|k,v| print v,"|"}
+				puts
+      end
+		rescue => ee
+			puts "Exception on method #{__method__}: #{ee}"
+		end
+	end
+  alias_method :print_user, :print_user_entitlement
+
+  # Print out the org entitlement table in plain text, to be imported into database
+  def print_org_entitlement
+    begin
+			puts "Organization Entitlement Report in Plain-text Format" if @verbose
+			@yst_org_entitlement.first[1].each {|k,v| print k,"|"} if @verbose
+			puts if @verbose
+			@yst_org_entitlement.values.map do |rec|
+				rec.each {|k,v| print v,"|"}
+				puts
+      end
+		rescue => ee
+			puts "Exception on method #{__method__}: #{ee}"
+		end
+  end
+  alias_method :print_org, :print_org_entitlement
+
+	# Save the Yi Shi Tong to AD user mapping relation into the cache file
+	def save_yst_user_map!(file=@file_user_map)
+		puts "Saving the known Yst to AD user mapping relationship to file: #{file} ..." if @verbose
+		begin
+			timestamp=Time.now
+			f=File.open(file, 'w')
+			f.write "# local Yst to AD user map file created by the #{self.class} class #{__method__} method at: #{timestamp}"
+			@yst_user_entitlement.values.map do |record|
+				key = record['USER_NAME'].upcase + ':' + record['EMAIL'].upcase
+				value = record['DN']
+				f.write "\n#{key}|#{value}"
+			end
+			f.close
+			puts "Yst to AD user map file is successfully saved to: #{file}" if @verbose
+		rescue => ee
+			puts "Exception on method #{__method__}: #{ee}" if @verbose
+		end
+	end
+	alias_method  :save!, :save_yst_user_map!
+
+	# Search user entitlement record by AD DN
+	def yst_search_by_dn (dn)
+		begin
+      puts "Perform search on the user entitlement record by AD DN: #{dn}" if @verbose
+      @yst_user_entitlement.each do |key, val|
+          return val if @yst_user_entitlement[key]['DN'].eql? dn
+      end
+			return nil
+    rescue => ee
+      puts "Exception on method #{__method__}: #{ee}"
+    end
+	end
+	alias_method  :search_by_dn, :yst_search_by_dn
+
+	# Search user entitlement record by USER_ID
+	def yst_search_by_id (id)
+		begin
+      puts "Perform search on the user entitlement record by USER_ID: #{id}" if @verbose
+      @yst_user_entitlement.each do |key, val|
+          return val if @yst_user_entitlement[key]['USER_ID'].eql? id.strip
+      end
+			return nil
+    rescue => ee
+      puts "Exception on method #{__method__}: #{ee}"
+    end
+	end
+	alias_method  :search_by_id, :yst_search_by_id
+
+	private	:parse_yst_user_report, :parse_yst_org_report, :insert_dn
+
+end