<s> """<STR_LIT>""" <EOL> import functools <EOL> import sys <EOL> from nova import exception <EOL> from nova import flags <EOL> from nova import log as logging <EOL> FLAGS = flags . FLAGS <EOL> flags . DEFINE_integer ( '<STR_LIT>' , <NUM_LIT:2> , <EOL> '<STR_LIT>' ) <EOL> flags . DEFINE_string ( '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' ) <EOL> flags . DEFINE_string ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ) <EOL> flags . DEFINE_string ( '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' ) <EOL> flags . DEFINE_string ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ) <EOL> flags . DEFINE_string ( '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' ) <EOL> flags . DEFINE_string ( '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ) <EOL> flags . DEFINE_string ( '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' ) <EOL> flags . DEFINE_boolean ( '<STR_LIT>' , False , <EOL> '<STR_LIT>' ) <EOL> flags . DEFINE_string ( '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' ) <EOL> flags . DEFINE_string ( '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' ) <EOL> flags . DEFINE_string ( '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' ) <EOL> flags . DEFINE_string ( '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' ) <EOL> flags . DEFINE_string ( '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' ) <EOL> flags . DEFINE_string ( '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' ) <EOL> flags . DEFINE_string ( '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' ) <EOL> LOG = logging . getLogger ( "<STR_LIT>" ) <EOL> if FLAGS . memcached_servers : <EOL> import memcache <EOL> else : <EOL> from nova import fakememcache as memcache <EOL> def _clean ( attr ) : <EOL> """<STR_LIT>""" <EOL> if attr is None : <EOL> return None <EOL> if type ( attr ) is unicode : <EOL> return str ( attr ) <EOL> return attr <EOL> def sanitize ( fn ) : <EOL> """<STR_LIT>""" <EOL> @ functools . wraps ( fn ) <EOL> def _wrapped ( self , * args , ** kwargs ) : <EOL> args = [ _clean ( x ) for x in args ] <EOL> kwargs = dict ( ( k , _clean ( v ) ) for ( k , v ) in kwargs ) <EOL> return fn ( self , * args , ** kwargs ) <EOL> _wrapped . func_name = fn . func_name <EOL> return _wrapped <EOL> class LDAPWrapper ( object ) : <EOL> def __init__ ( self , ldap , url , user , password ) : <EOL> self . ldap = ldap <EOL> self . url = url <EOL> self . user = user <EOL> self . password = password <EOL> self . conn = None <EOL> def __wrap_reconnect ( f ) : <EOL> def inner ( self , * args , ** kwargs ) : <EOL> if self . conn is None : <EOL> self . connect ( ) <EOL> return f ( self . conn ) ( * args , ** kwargs ) <EOL> else : <EOL> try : <EOL> return f ( self . conn ) ( * args , ** kwargs ) <EOL> except self . ldap . SERVER_DOWN : <EOL> self . connect ( ) <EOL> return f ( self . conn ) ( * args , ** kwargs ) <EOL> return inner <EOL> def connect ( self ) : <EOL> try : <EOL> self . conn = self . ldap . initialize ( self . url ) <EOL> self . conn . simple_bind_s ( self . user , self . password ) <EOL> except self . ldap . SERVER_DOWN : <EOL> self . conn = None <EOL> raise <EOL> search_s = __wrap_reconnect ( lambda conn : conn . search_s ) <EOL> add_s = __wrap_reconnect ( lambda conn : conn . add_s ) <EOL> delete_s = __wrap_reconnect ( lambda conn : conn . delete_s ) <EOL> modify_s = __wrap_reconnect ( lambda conn : conn . modify_s ) <EOL> class LdapDriver ( object ) : <EOL> """<STR_LIT>""" <EOL> project_pattern = '<STR_LIT>' <EOL> isadmin_attribute = '<STR_LIT>' <EOL> project_attribute = '<STR_LIT>' <EOL> project_objectclass = '<STR_LIT>' <EOL> conn = None <EOL> mc = None <EOL> def __init__ ( self ) : <EOL> """<STR_LIT>""" <EOL> self . ldap = __import__ ( '<STR_LIT>' ) <EOL> if FLAGS . ldap_schema_version == <NUM_LIT:1> : <EOL> LdapDriver . project_pattern = '<STR_LIT>' <EOL> LdapDriver . isadmin_attribute = '<STR_LIT>' <EOL> LdapDriver . project_attribute = '<STR_LIT>' <EOL> LdapDriver . project_objectclass = '<STR_LIT>' <EOL> self . __cache = None <EOL> if LdapDriver . conn is None : <EOL> LdapDriver . conn = LDAPWrapper ( self . ldap , FLAGS . ldap_url , <EOL> FLAGS . ldap_user_dn , <EOL> FLAGS . ldap_password ) <EOL> if LdapDriver . mc is None : <EOL> LdapDriver . mc = memcache . Client ( FLAGS . memcached_servers , debug = <NUM_LIT:0> ) <EOL> def __enter__ ( self ) : <EOL> self . __cache = { } <EOL> return self <EOL> def __exit__ ( self , exc_type , exc_value , traceback ) : <EOL> self . __cache = None <EOL> return False <EOL> def __local_cache ( key_fmt ) : <EOL> """<STR_LIT>""" <EOL> def do_wrap ( fn ) : <EOL> @ functools . wraps ( fn ) <EOL> def inner ( self , arg , ** kwargs ) : <EOL> cache_key = key_fmt % ( arg , ) <EOL> try : <EOL> res = self . __cache [ cache_key ] <EOL> LOG . debug ( '<STR_LIT>' % <EOL> ( fn . __name__ , cache_key ) ) <EOL> return res <EOL> except KeyError : <EOL> res = fn ( self , arg , ** kwargs ) <EOL> self . __cache [ cache_key ] = res <EOL> return res <EOL> return inner <EOL> return do_wrap <EOL> @ sanitize <EOL> @ __local_cache ( '<STR_LIT>' ) <EOL> def get_user ( self , uid ) : <EOL> """<STR_LIT>""" <EOL> attr = self . __get_ldap_user ( uid ) <EOL> return self . __to_user ( attr ) <EOL> @ sanitize <EOL> def get_user_from_access_key ( self , access ) : <EOL> """<STR_LIT>""" <EOL> cache_key = '<STR_LIT>' % ( access , ) <EOL> user_dn = self . mc . get ( cache_key ) <EOL> if user_dn : <EOL> user = self . __to_user ( <EOL> self . __find_object ( user_dn , scope = self . ldap . SCOPE_BASE ) ) <EOL> if user : <EOL> if user [ '<STR_LIT>' ] == access : <EOL> return user <EOL> else : <EOL> self . mc . set ( cache_key , None ) <EOL> query = '<STR_LIT>' % access <EOL> dn = FLAGS . ldap_user_subtree <EOL> user_obj = self . __find_object ( dn , query ) <EOL> user = self . __to_user ( user_obj ) <EOL> if user : <EOL> self . mc . set ( cache_key , user_obj [ '<STR_LIT>' ] [ <NUM_LIT:0> ] ) <EOL> return user <EOL> @ sanitize <EOL> @ __local_cache ( '<STR_LIT>' ) <EOL> def get_project ( self , pid ) : <EOL> """<STR_LIT>""" <EOL> dn = self . __project_to_dn ( pid , search = False ) <EOL> attr = self . __find_object ( dn , LdapDriver . project_pattern , <EOL> scope = self . ldap . SCOPE_BASE ) <EOL> return self . __to_project ( attr ) <EOL> @ sanitize <EOL> def get_users ( self ) : <EOL> """<STR_LIT>""" <EOL> attrs = self . __find_objects ( FLAGS . ldap_user_subtree , <EOL> '<STR_LIT>' ) <EOL> users = [ ] <EOL> for attr in attrs : <EOL> user = self . __to_user ( attr ) <EOL> if user is not None : <EOL> users . append ( user ) <EOL> return users <EOL> @ sanitize <EOL> def get_projects ( self , uid = None ) : <EOL> """<STR_LIT>""" <EOL> pattern = LdapDriver . project_pattern <EOL> if uid : <EOL> pattern = "<STR_LIT>" % ( pattern , self . __uid_to_dn ( uid ) ) <EOL> attrs = self . __find_objects ( FLAGS . ldap_project_subtree , <EOL> pattern ) <EOL> return [ self . __to_project ( attr ) for attr in attrs ] <EOL> @ sanitize <EOL> def create_user ( self , name , access_key , secret_key , is_admin ) : <EOL> """<STR_LIT>""" <EOL> if self . __user_exists ( name ) : <EOL> raise exception . LDAPUserExists ( user = name ) <EOL> if FLAGS . ldap_user_modify_only : <EOL> if self . __ldap_user_exists ( name ) : <EOL> user = self . __get_ldap_user ( name ) <EOL> attr = [ ] <EOL> if '<STR_LIT>' in user . keys ( ) : <EOL> attr . append ( ( self . ldap . MOD_REPLACE , '<STR_LIT>' , <EOL> [ secret_key ] ) ) <EOL> else : <EOL> attr . append ( ( self . ldap . MOD_ADD , '<STR_LIT>' , <EOL> [ secret_key ] ) ) <EOL> if '<STR_LIT>' in user . keys ( ) : <EOL> attr . append ( ( self . ldap . MOD_REPLACE , '<STR_LIT>' , <EOL> [ access_key ] ) ) <EOL> else : <EOL> attr . append ( ( self . ldap . MOD_ADD , '<STR_LIT>' , <EOL> [ access_key ] ) ) <EOL> if LdapDriver . isadmin_attribute in user . keys ( ) : <EOL> attr . append ( ( self . ldap . MOD_REPLACE , <EOL> LdapDriver . isadmin_attribute , <EOL> [ str ( is_admin ) . upper ( ) ] ) ) <EOL> else : <EOL> attr . append ( ( self . ldap . MOD_ADD , <EOL> LdapDriver . isadmin_attribute , <EOL> [ str ( is_admin ) . upper ( ) ] ) ) <EOL> self . conn . modify_s ( self . __uid_to_dn ( name ) , attr ) <EOL> return self . get_user ( name ) <EOL> else : <EOL> raise exception . LDAPUserNotFound ( user_id = name ) <EOL> else : <EOL> attr = [ <EOL> ( '<STR_LIT>' , [ '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' ] ) , <EOL> ( '<STR_LIT>' , [ FLAGS . ldap_user_unit ] ) , <EOL> ( FLAGS . ldap_user_id_attribute , [ name ] ) , <EOL> ( '<STR_LIT>' , [ name ] ) , <EOL> ( FLAGS . ldap_user_name_attribute , [ name ] ) , <EOL> ( '<STR_LIT>' , [ secret_key ] ) , <EOL> ( '<STR_LIT>' , [ access_key ] ) , <EOL> ( LdapDriver . isadmin_attribute , [ str ( is_admin ) . upper ( ) ] ) , <EOL> ] <EOL> self . conn . add_s ( self . __uid_to_dn ( name ) , attr ) <EOL> return self . __to_user ( dict ( attr ) ) <EOL> @ sanitize <EOL> def create_project ( self , name , manager_uid , <EOL> description = None , member_uids = None ) : <EOL> """<STR_LIT>""" <EOL> if self . __project_exists ( name ) : <EOL> raise exception . ProjectExists ( project = name ) <EOL> if not self . __user_exists ( manager_uid ) : <EOL> raise exception . LDAPUserNotFound ( user_id = manager_uid ) <EOL> manager_dn = self . __uid_to_dn ( manager_uid ) <EOL> if description is None : <EOL> description = name <EOL> members = [ ] <EOL> if member_uids is not None : <EOL> for member_uid in member_uids : <EOL> if not self . __user_exists ( member_uid ) : <EOL> raise exception . LDAPUserNotFound ( user_id = member_uid ) <EOL> members . append ( self . __uid_to_dn ( member_uid ) ) <EOL> if not manager_dn in members : <EOL> members . append ( manager_dn ) <EOL> attr = [ <EOL> ( '<STR_LIT>' , [ LdapDriver . project_objectclass ] ) , <EOL> ( '<STR_LIT>' , [ name ] ) , <EOL> ( '<STR_LIT:description>' , [ description ] ) , <EOL> ( LdapDriver . project_attribute , [ manager_dn ] ) , <EOL> ( '<STR_LIT>' , members ) ] <EOL> dn = self . __project_to_dn ( name , search = False ) <EOL> self . conn . add_s ( dn , attr ) <EOL> return self . __to_project ( dict ( attr ) ) <EOL> @ sanitize <EOL> def modify_project ( self , project_id , manager_uid = None , description = None ) : <EOL> """<STR_LIT>""" <EOL> if not manager_uid and not description : <EOL> return <EOL> attr = [ ] <EOL> if manager_uid : <EOL> if not self . __user_exists ( manager_uid ) : <EOL> raise exception . LDAPUserNotFound ( user_id = manager_uid ) <EOL> manager_dn = self . __uid_to_dn ( manager_uid ) <EOL> attr . append ( ( self . ldap . MOD_REPLACE , LdapDriver . project_attribute , <EOL> manager_dn ) ) <EOL> if description : <EOL> attr . append ( ( self . ldap . MOD_REPLACE , '<STR_LIT:description>' , description ) ) <EOL> dn = self . __project_to_dn ( project_id ) <EOL> self . conn . modify_s ( dn , attr ) <EOL> if not self . is_in_project ( manager_uid , project_id ) : <EOL> self . add_to_project ( manager_uid , project_id ) <EOL> @ sanitize <EOL> def add_to_project ( self , uid , project_id ) : <EOL> """<STR_LIT>""" <EOL> dn = self . __project_to_dn ( project_id ) <EOL> return self . __add_to_group ( uid , dn ) <EOL> @ sanitize <EOL> def remove_from_project ( self , uid , project_id ) : <EOL> """<STR_LIT>""" <EOL> dn = self . __project_to_dn ( project_id ) <EOL> return self . __remove_from_group ( uid , dn ) <EOL> @ sanitize <EOL> def is_in_project ( self , uid , project_id ) : <EOL> """<STR_LIT>""" <EOL> dn = self . __project_to_dn ( project_id ) <EOL> return self . __is_in_group ( uid , dn ) <EOL> @ sanitize <EOL> def has_role ( self , uid , role , project_id = None ) : <EOL> """<STR_LIT>""" <EOL> role_dn = self . __role_to_dn ( role , project_id ) <EOL> return self . __is_in_group ( uid , role_dn ) <EOL> @ sanitize <EOL> def add_role ( self , uid , role , project_id = None ) : <EOL> """<STR_LIT>""" <EOL> role_dn = self . __role_to_dn ( role , project_id ) <EOL> if not self . __group_exists ( role_dn ) : <EOL> description = '<STR_LIT>' % ( role , project_id ) <EOL> self . __create_group ( role_dn , role , uid , description ) <EOL> else : <EOL> return self . __add_to_group ( uid , role_dn ) <EOL> @ sanitize <EOL> def remove_role ( self , uid , role , project_id = None ) : <EOL> """<STR_LIT>""" <EOL> role_dn = self . __role_to_dn ( role , project_id ) <EOL> return self . __remove_from_group ( uid , role_dn ) <EOL> @ sanitize <EOL> def get_user_roles ( self , uid , project_id = None ) : <EOL> """<STR_LIT>""" <EOL> if project_id is None : <EOL> roles = [ ] <EOL> for role in FLAGS . allowed_roles : <EOL> role_dn = self . __role_to_dn ( role ) <EOL> if self . __is_in_group ( uid , role_dn ) : <EOL> roles . append ( role ) <EOL> return roles <EOL> else : <EOL> project_dn = self . __project_to_dn ( project_id ) <EOL> query = ( '<STR_LIT>' % <EOL> ( LdapDriver . project_pattern , self . __uid_to_dn ( uid ) ) ) <EOL> roles = self . __find_objects ( project_dn , query ) <EOL> return [ role [ '<STR_LIT>' ] [ <NUM_LIT:0> ] for role in roles ] <EOL> @ sanitize <EOL> def delete_user ( self , uid ) : <EOL> """<STR_LIT>""" <EOL> if not self . __user_exists ( uid ) : <EOL> raise exception . LDAPUserNotFound ( user_id = uid ) <EOL> self . __remove_from_all ( uid ) <EOL> if FLAGS . ldap_user_modify_only : <EOL> attr = [ ] <EOL> user = self . __get_ldap_user ( uid ) <EOL> if '<STR_LIT>' in user . keys ( ) : <EOL> attr . append ( ( self . ldap . MOD_DELETE , '<STR_LIT>' , <EOL> user [ '<STR_LIT>' ] ) ) <EOL> if '<STR_LIT>' in user . keys ( ) : <EOL> attr . append ( ( self . ldap . MOD_DELETE , '<STR_LIT>' , <EOL> user [ '<STR_LIT>' ] ) ) <EOL> if LdapDriver . isadmin_attribute in user . keys ( ) : <EOL> attr . append ( ( self . ldap . MOD_DELETE , <EOL> LdapDriver . isadmin_attribute , <EOL> user [ LdapDriver . isadmin_attribute ] ) ) <EOL> self . conn . modify_s ( self . __uid_to_dn ( uid ) , attr ) <EOL> else : <EOL> self . conn . delete_s ( self . __uid_to_dn ( uid ) ) <EOL> @ sanitize <EOL> def delete_project ( self , project_id ) : <EOL> """<STR_LIT>""" <EOL> project_dn = self . __project_to_dn ( project_id ) <EOL> self . __delete_roles ( project_dn ) <EOL> self . __delete_group ( project_dn ) <EOL> @ sanitize <EOL> def modify_user ( self , uid , access_key = None , secret_key = None , admin = None ) : <EOL> """<STR_LIT>""" <EOL> if not access_key and not secret_key and admin is None : <EOL> return <EOL> attr = [ ] <EOL> if access_key : <EOL> attr . append ( ( self . ldap . MOD_REPLACE , '<STR_LIT>' , access_key ) ) <EOL> if secret_key : <EOL> attr . append ( ( self . ldap . MOD_REPLACE , '<STR_LIT>' , secret_key ) ) <EOL> if admin is not None : <EOL> attr . append ( ( self . ldap . MOD_REPLACE , LdapDriver . isadmin_attribute , <EOL> str ( admin ) . upper ( ) ) ) <EOL> self . conn . modify_s ( self . __uid_to_dn ( uid ) , attr ) <EOL> def __user_exists ( self , uid ) : <EOL> """<STR_LIT>""" <EOL> return self . get_user ( uid ) is not None <EOL> def __ldap_user_exists ( self , uid ) : <EOL> """<STR_LIT>""" <EOL> return self . __get_ldap_user ( uid ) is not None <EOL> def __project_exists ( self , project_id ) : <EOL> """<STR_LIT>""" <EOL> return self . get_project ( project_id ) is not None <EOL> @ __local_cache ( '<STR_LIT>' ) <EOL> def __get_ldap_user ( self , uid ) : <EOL> """<STR_LIT>""" <EOL> dn = FLAGS . ldap_user_subtree <EOL> query = ( '<STR_LIT>' % <EOL> ( FLAGS . ldap_user_id_attribute , uid ) ) <EOL> return self . __find_object ( dn , query ) <EOL> def __find_object ( self , dn , query = None , scope = None ) : <EOL> """<STR_LIT>""" <EOL> objects = self . __find_objects ( dn , query , scope ) <EOL> if len ( objects ) == <NUM_LIT:0> : <EOL> return None <EOL> return objects [ <NUM_LIT:0> ] <EOL> def __find_dns ( self , dn , query = None , scope = None ) : <EOL> """<STR_LIT>""" <EOL> if scope is None : <EOL> scope = self . ldap . SCOPE_SUBTREE <EOL> try : <EOL> res = self . conn . search_s ( dn , scope , query ) <EOL> except self . ldap . NO_SUCH_OBJECT : <EOL> return [ ] <EOL> return [ dn for dn , _attributes in res ] <EOL> def __find_objects ( self , dn , query = None , scope = None ) : <EOL> """<STR_LIT>""" <EOL> if scope is None : <EOL> scope = self . ldap . SCOPE_SUBTREE <EOL> if query is None : <EOL> query = "<STR_LIT>" <EOL> try : <EOL> res = self . conn . search_s ( dn , scope , query ) <EOL> except self . ldap . NO_SUCH_OBJECT : <EOL> return [ ] <EOL> res1 = [ ] <EOL> for dn , attrs in res : <EOL> attrs [ '<STR_LIT>' ] = [ dn ] <EOL> res1 . append ( attrs ) <EOL> return res1 <EOL> def __find_role_dns ( self , tree ) : <EOL> """<STR_LIT>""" <EOL> query = ( '<STR_LIT>' % <EOL> LdapDriver . project_pattern ) <EOL> return self . __find_dns ( tree , query ) <EOL> def __find_group_dns_with_member ( self , tree , uid ) : <EOL> """<STR_LIT>""" <EOL> query = ( '<STR_LIT>' % <EOL> self . __uid_to_dn ( uid ) ) <EOL> dns = self . __find_dns ( tree , query ) <EOL> return dns <EOL> def __group_exists ( self , dn ) : <EOL> """<STR_LIT>""" <EOL> query = '<STR_LIT>' <EOL> return self . __find_object ( dn , query ) is not None <EOL> def __role_to_dn ( self , role , project_id = None ) : <EOL> """<STR_LIT>""" <EOL> if project_id is None : <EOL> return FLAGS . __getitem__ ( "<STR_LIT>" % role ) . value <EOL> else : <EOL> project_dn = self . __project_to_dn ( project_id ) <EOL> return '<STR_LIT>' % ( role , project_dn ) <EOL> def __create_group ( self , group_dn , name , uid , <EOL> description , member_uids = None ) : <EOL> """<STR_LIT>""" <EOL> if self . __group_exists ( group_dn ) : <EOL> raise exception . LDAPGroupExists ( group = name ) <EOL> members = [ ] <EOL> if member_uids is not None : <EOL> for member_uid in member_uids : <EOL> if not self . __user_exists ( member_uid ) : <EOL> raise exception . LDAPUserNotFound ( user_id = member_uid ) <EOL> members . append ( self . __uid_to_dn ( member_uid ) ) <EOL> dn = self . __uid_to_dn ( uid ) <EOL> if not dn in members : <EOL> members . append ( dn ) <EOL> attr = [ <EOL> ( '<STR_LIT>' , [ '<STR_LIT>' ] ) , <EOL> ( '<STR_LIT>' , [ name ] ) , <EOL> ( '<STR_LIT:description>' , [ description ] ) , <EOL> ( '<STR_LIT>' , members ) ] <EOL> self . conn . add_s ( group_dn , attr ) <EOL> def __is_in_group ( self , uid , group_dn ) : <EOL> """<STR_LIT>""" <EOL> if not self . __user_exists ( uid ) : <EOL> raise exception . LDAPUserNotFound ( user_id = uid ) <EOL> if not self . __group_exists ( group_dn ) : <EOL> return False <EOL> res = self . __find_object ( group_dn , <EOL> '<STR_LIT>' % self . __uid_to_dn ( uid ) , <EOL> self . ldap . SCOPE_BASE ) <EOL> return res is not None <EOL> def __add_to_group ( self , uid , group_dn ) : <EOL> """<STR_LIT>""" <EOL> if not self . __user_exists ( uid ) : <EOL> raise exception . LDAPUserNotFound ( user_id = uid ) <EOL> if not self . __group_exists ( group_dn ) : <EOL> raise exception . LDAPGroupNotFound ( group_id = group_dn ) <EOL> if self . __is_in_group ( uid , group_dn ) : <EOL> raise exception . LDAPMembershipExists ( uid = uid , group_dn = group_dn ) <EOL> attr = [ ( self . ldap . MOD_ADD , '<STR_LIT>' , self . __uid_to_dn ( uid ) ) ] <EOL> self . conn . modify_s ( group_dn , attr ) <EOL> def __remove_from_group ( self , uid , group_dn ) : <EOL> """<STR_LIT>""" <EOL> if not self . __group_exists ( group_dn ) : <EOL> raise exception . LDAPGroupNotFound ( group_id = group_dn ) <EOL> if not self . __user_exists ( uid ) : <EOL> raise exception . LDAPUserNotFound ( user_id = uid ) <EOL> if not self . __is_in_group ( uid , group_dn ) : <EOL> raise exception . LDAPGroupMembershipNotFound ( user_id = uid , <EOL> group_id = group_dn ) <EOL> sub_dns = self . __find_group_dns_with_member ( group_dn , uid ) <EOL> for sub_dn in sub_dns : <EOL> self . __safe_remove_from_group ( uid , sub_dn ) <EOL> def __safe_remove_from_group ( self , uid , group_dn ) : <EOL> """<STR_LIT>""" <EOL> attr = [ ( self . ldap . MOD_DELETE , '<STR_LIT>' , self . __uid_to_dn ( uid ) ) ] <EOL> try : <EOL> self . conn . modify_s ( group_dn , attr ) <EOL> except self . ldap . OBJECT_CLASS_VIOLATION : <EOL> LOG . debug ( _ ( "<STR_LIT>" <EOL> "<STR_LIT>" ) , group_dn ) <EOL> self . __delete_group ( group_dn ) <EOL> def __remove_from_all ( self , uid ) : <EOL> """<STR_LIT>""" <EOL> if not self . __user_exists ( uid ) : <EOL> raise exception . LDAPUserNotFound ( user_id = uid ) <EOL> role_dns = self . __find_group_dns_with_member ( <EOL> FLAGS . role_project_subtree , uid ) <EOL> for role_dn in role_dns : <EOL> self . __safe_remove_from_group ( uid , role_dn ) <EOL> project_dns = self . __find_group_dns_with_member ( <EOL> FLAGS . ldap_project_subtree , uid ) <EOL> for project_dn in project_dns : <EOL> self . __safe_remove_from_group ( uid , project_dn ) <EOL> def __delete_group ( self , group_dn ) : <EOL> """<STR_LIT>""" <EOL> if not self . __group_exists ( group_dn ) : <EOL> raise exception . LDAPGroupNotFound ( group_id = group_dn ) <EOL> self . conn . delete_s ( group_dn ) <EOL> def __delete_roles ( self , project_dn ) : <EOL> """<STR_LIT>""" <EOL> for role_dn in self . __find_role_dns ( project_dn ) : <EOL> self . __delete_group ( role_dn ) <EOL> def __to_project ( self , attr ) : <EOL> """<STR_LIT>""" <EOL> if attr is None : <EOL> return None <EOL> member_dns = attr . get ( '<STR_LIT>' , [ ] ) <EOL> return { <EOL> '<STR_LIT:id>' : attr [ '<STR_LIT>' ] [ <NUM_LIT:0> ] , <EOL> '<STR_LIT:name>' : attr [ '<STR_LIT>' ] [ <NUM_LIT:0> ] , <EOL> '<STR_LIT>' : <EOL> self . __dn_to_uid ( attr [ LdapDriver . project_attribute ] [ <NUM_LIT:0> ] ) , <EOL> '<STR_LIT:description>' : attr . get ( '<STR_LIT:description>' , [ None ] ) [ <NUM_LIT:0> ] , <EOL> '<STR_LIT>' : [ self . __dn_to_uid ( x ) for x in member_dns ] } <EOL> @ __local_cache ( '<STR_LIT>' ) <EOL> def __uid_to_dn ( self , uid , search = True ) : <EOL> """<STR_LIT>""" <EOL> userdn = ( FLAGS . ldap_user_id_attribute + '<STR_LIT>' <EOL> % ( uid , FLAGS . ldap_user_subtree ) ) <EOL> if search : <EOL> query = ( '<STR_LIT>' % ( FLAGS . ldap_user_id_attribute , uid ) ) <EOL> user = self . __find_dns ( FLAGS . ldap_user_subtree , query ) <EOL> if len ( user ) > <NUM_LIT:0> : <EOL> userdn = user [ <NUM_LIT:0> ] <EOL> return userdn <EOL> @ __local_cache ( '<STR_LIT>' ) <EOL> def __project_to_dn ( self , pid , search = True ) : <EOL> """<STR_LIT>""" <EOL> projectdn = ( '<STR_LIT>' % ( pid , FLAGS . ldap_project_subtree ) ) <EOL> if search : <EOL> query = ( '<STR_LIT>' % ( pid , LdapDriver . project_pattern ) ) <EOL> project = self . __find_dns ( FLAGS . ldap_project_subtree , query ) <EOL> if len ( project ) > <NUM_LIT:0> : <EOL> projectdn = project [ <NUM_LIT:0> ] <EOL> return projectdn <EOL> @ staticmethod <EOL> def __to_user ( attr ) : <EOL> """<STR_LIT>""" <EOL> if attr is None : <EOL> return None <EOL> if ( '<STR_LIT>' in attr . keys ( ) and '<STR_LIT>' in attr . keys ( ) and LdapDriver . isadmin_attribute in attr . keys ( ) ) : <EOL> return { <EOL> '<STR_LIT:id>' : attr [ FLAGS . ldap_user_id_attribute ] [ <NUM_LIT:0> ] , <EOL> '<STR_LIT:name>' : attr [ FLAGS . ldap_user_name_attribute ] [ <NUM_LIT:0> ] , <EOL> '<STR_LIT>' : attr [ '<STR_LIT>' ] [ <NUM_LIT:0> ] , <EOL> '<STR_LIT>' : attr [ '<STR_LIT>' ] [ <NUM_LIT:0> ] , <EOL> '<STR_LIT>' : ( attr [ LdapDriver . isadmin_attribute ] [ <NUM_LIT:0> ] == '<STR_LIT>' ) } <EOL> else : <EOL> return None <EOL> @ __local_cache ( '<STR_LIT>' ) <EOL> def __dn_to_uid ( self , dn ) : <EOL> """<STR_LIT>""" <EOL> query = '<STR_LIT>' <EOL> user = self . __find_object ( dn , query , scope = self . ldap . SCOPE_BASE ) <EOL> return user [ FLAGS . ldap_user_id_attribute ] [ <NUM_LIT:0> ] <EOL> class FakeLdapDriver ( LdapDriver ) : <EOL> """<STR_LIT>""" <EOL> def __init__ ( self ) : <EOL> import nova . auth . fakeldap <EOL> sys . modules [ '<STR_LIT>' ] = nova . auth . fakeldap <EOL> super ( FakeLdapDriver , self ) . __init__ ( ) </s>
