File: //usr/lib/python3.9/site-packages/ipapython/__pycache__/ipaldap.cpython-39.opt-1.pyc
a
�N(i � @ s` d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ d dl Z d dl
Z
d dl Z d dl Z d dl
mZ d dlmZ d dlZd dlZd dlZd dlmZmZ d dlZd dlZd dlmZmZm Z d d l m Z d d
l m Z d d l!m"Z"m#Z# d d l$m%Z%m&Z& d d
l'm(Z( d dl)m*Z* d dl+m,Z, ej-�r0e.Z/e�0e1�Z2ej3�3i d�Z4ej3�3i d�Z5dZ6e7� Z8dZ9dZ:dZ;e7� Z<e7� Z=e7� Z>e%d�Z?ej@�r�eAed��r�e jBdejCd� dd� ZDd d � ZEd6d d �ZFG d d!� d!�ZGG d"d#� d#�ZHeH� ZIG d$d%� d%e,�ZJG d&d'� d'e,�ZKG d(d)� d)eK�ZLG d*d+� d+eK�ZMG d,d-� d-�ZNd7d0d1�ZOG d2d3� d3�ZPG d4d5� d5eN�ZQdS )8� N)�datetime)�Decimal)�deepcopy)� OrderedDict)�
serialization)�SimplePagedResultsControl�GetEffectiveRightsControl)�errors�x509�_)� LDAP_GENERALIZED_TIME_FORMAT)�paths)�
format_netloc�CIDict)�DN�RDN)�DNSName)� Principal)�MutableMappingZGSSAPIz
GSS-SPNEGOF� � � )�cnzdirectory manager�LDAPBytesWarning�ignore)�action�categoryc C s d� | �d��S )z/Convert Kerberos realm name to 389-DS server id�-�.)�join�split)�
realm_name� r" �5/usr/lib/python3.9/site-packages/ipapython/ipaldap.py�realm_to_serveridZ s r$ c C s" t | �}tj|f }dt�|� S )z(Get ldapi:// URI to 389-DS's Unix socket�ldapi://)r$ r
Z SLAPD_INSTANCE_SOCKET_TEMPLATE�ldapurlZ
ldapUrlEscape)r! ZserveridZ
socketnamer" r" r# �realm_to_ldapi_uri_ s r' c C s~ t �| �}|�t jt j� | �d�sz|rNtj�|�s@t t
j |��|�t j |� |�t j
d� |�t jt j� |�t jd� |S )a� Wrapper around ldap.initialize()
The function undoes global and local ldap.conf settings that may cause
issues or reduce security:
* Canonization of SASL host names is disabled.
* With cacertfile=None, the connection uses OpenSSL's default verify
locations, also known as system-wide trust store.
* Cert validation is enforced.
* SSLv2 and SSLv3 are disabled.
r% i r )�ldapZ
initialize�
set_option�OPT_X_SASL_NOCANONZOPT_ON�
startswith�os�path�isfile�IOError�errno�ENOENTZOPT_X_TLS_CACERTFILEZOPT_X_TLS_PROTOCOL_MINZOPT_X_TLS_REQUIRE_CERTZOPT_X_TLS_DEMANDZOPT_X_TLS_NEWCTX)�uri�
cacertfile�connr" r" r# �ldap_initializef s
r5 c @ s e Zd ZdZdd� ZdS )�
_ServerSchemaz?
Properties of a schema retrieved from an LDAP server.
c C s || _ || _t�� | _d S �N)�server�schema�timeZretrieve_timestamp)�selfr8 r9 r" r" r# �__init__� s z_ServerSchema.__init__N)�__name__�
__module__� __qualname__�__doc__r< r" r" r" r# r6 � s r6 c @ s2 e Zd ZdZdd� Zd dd�Zdd� Zd d
� Zd S )
� SchemaCachez:
Cache the schema's from individual LDAP servers.
c C s
i | _ d S r7 )�servers�r; r" r" r# r< � s zSchemaCache.__init__Fc C sH |r| � |� | j�|�}|du rB| �||�}t||�}|| j|< |jS )a
Return schema belonging to a specific LDAP server.
For performance reasons the schema is retrieved once and
cached unless force_update is True. force_update flushes the
existing schema for the server from the cache and reacquires
it.
N)�flushrB �get� _retrieve_schema_from_serverr6 r9 )r; �urlr4 � force_updateZ
server_schemar9 r" r" r# �
get_schema� s
zSchemaCache.get_schemac C s0 t �d|� z | j|= W n ty* Y n0 d S )Nz flushing %s from SchemaCache)�logger�debugrB �KeyError)r; rG r" r" r# rD � s
zSchemaCache.flushc
C s t �d||� z\z |jdtjddgd�d }W n8 tjyf t �d� |jdtjddgd�d }Y n0 W n� tjy� tj|d d
��Y nh tj y� } zN|j
d d � � }|j
d � d d
�� � }tj
d| d||f d��W Y d}~n
d}~0 0 tj�|d �S )a
Retrieve the LDAP schema from the provided url and determine if
User-Private Groups (upg) are configured.
Bind using kerberos credentials. If in the context of the
in-tree "lite" server then use the current ccache. If in the context of
Apache then create a new ccache and bind using the Apache HTTP service
principal.
If a connection is provided then it the credentials bound to it are
used. The connection is not closed when the request is done.
z0retrieving schema for SchemaCache url=%s conn=%sz cn=schema�attributetypes�
objectclasses)Zattrlistr z-cn=schema not found, fallback to cn=subschemaz cn=subschemaz0LDAP Server Down, unable to retrieve LDAP schema�r2 �error�desc�info� zuri=%sz&Unable to retrieve LDAP schema: %s: %s�rQ rR Nr )rJ rK Zsearch_sr( �
SCOPE_BASE�NO_SUCH_OBJECT� SERVER_DOWNr � NetworkError� LDAPError�args�striprE �
DatabaseErrorr9 Z SubSchema)r; rG r4 Z schema_entry�erQ rR r" r" r# rF � s8 �
��
���
� z(SchemaCache._retrieve_schema_from_serverN)F)r= r> r? r@ r< rI rD rF r" r" r" r# rA � s
rA c s e Zd ZdZdZd:� fdd� Zedd� �Zedd� �Zej d d� �Zed
d � �Z
ed d
� �Z dd� Z dd� Z
dd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Z d0d1� Z d2d3� Z d;d4d5�Z d6d7� Z d8d9� Z!� Z"S )<� LDAPEntry)
�_conn�_dn�_names�_nice�_raw�_sync� _not_list� _orig_raw� _raw_view�_single_value_viewNc s t t| ��� t|t�r"|}|j}t|t�r6|}|j}|du rBi }|| _|| _t� | _i | _i | _ i | _
t � | _ i | _
d| _d| _t|t�r�t |j �| _ t|j
�| _
|j|u r�t|j�| _t|j�| _t|j �| _ t|j
�| _
n| j�|j� i }| j|fi |�� dS )a�
LDAPEntry constructor.
Takes 1 to 3 positional arguments and an arbitrary number of keyword
arguments. The 3 forms of positional arguments are:
* LDAPEntry(entry) - create a shallow copy of an existing LDAPEntry.
* LDAPEntry(dn, entry) - create a shallow copy of an existing
LDAPEntry with a different DN.
* LDAPEntry(conn, dn, mapping) - create a new LDAPEntry using the
specified LDAPClient and DN and optionally initialize
attributes from the specified mapping object.
Keyword arguments can be used to override values of specific attributes.
N)�superr^ r< �
isinstancer_ r` r ra rb rc rd �setre rf rg rh �dictr4 �raw�update)r; r_ r` �_obj�kwargs�� __class__r" r# r< � s<
zLDAPEntry.__init__c C s | j S r7 �r_ rC r" r" r# r4 , s zLDAPEntry.connc C s | j S r7 �r` rC r" r" r# �dn0 s z LDAPEntry.dnc C s
|| _ d S r7 rt )r; �valuer" r" r# ru 4 s c C s | j d u rt| �| _ | j S r7 )rg �RawLDAPEntryViewrC r" r" r# rm 9 s
z
LDAPEntry.rawc C s | j d u rt| �| _ | j S r7 )rh �SingleValueLDAPEntryViewrC r" r" r# � single_value? s
zLDAPEntry.single_valuec C s: t | j�}|�dd� | j�� D �� dt| �j| j|f S )Nc s s" | ]\}}|d ur||fV qd S r7 r" ��.0�k�vr" r" r# � <genexpr>G � z%LDAPEntry.__repr__.<locals>.<genexpr>z
%s(%r, %r))rl rc rn rb �items�typer= r` )r; �datar" r" r# �__repr__E s
zLDAPEntry.__repr__c C s t | �S r7 �r^ rC r" r" r# �copyJ s zLDAPEntry.copyc C s� | j | }| j| }| j�|g g f�\}}||kr>||kr>d S t|�t|� }t|�t|� }t|�t|� }t|�t|� } |D ]$}
| j�|
�}
|
|v r�q�|�|
� q�| D ]f}
z| j�|
|�}
W n8 t y� } z t dj
| | j d���W Y d } ~ n
d } ~ 0 0 |
|v �rq�|�|
� q�t ||j
d�D ]*}
| j�|
�}
|
| v �r@�q"|�|
� �q"t ||j
d�D ]l}
z| j�|
|�}
W n: t �y� } z t dj
| | j d���W Y d } ~ n
d } ~ 0 0 |
|v �r��q\|�|
� �q\t|�t|�f| j|< t|�dk�r�| j�|� d S )Nz {error} in LDAP entry '{dn}')rP ru ��keyr )rb rc rd �
setdefaultrk r_ �encode�remove�decode�
ValueError�formatr` �sorted�index�appendr �lenre �discard) r; �name�nicerm Z nice_syncZraw_syncZ nice_addsZ nice_delsZraw_addsZraw_delsrv r] r" r" r# �
_sync_attrM sT
�
�
zLDAPEntry._sync_attrc C s6 t |t�s td|jj|f ��t |t�r2|�d�}|S )Nz7attribute name must be unicode or str, got %s object %r�utf-8)rj �str� TypeErrorrr r= �bytesr� �r; r� r" r" r# �
_attr_name� s
��
zLDAPEntry._attr_namec C s� || j v r| j | S | jjd urxtjr2|�d�}n|}| jj�tjj|�}|d urx|j D ] }tjrl|�
d�}|| j |< qX|| j |< t | j �D ]*}| j �
|�|kr�| j �|�| j |< q�q�|S �Nr� )ra r_ r9 �six�PY2r� �get_objr( �
AttributeType�namesr� �listrf rE �pop)r; r� Z encoded_nameZattrtype�altnameZoldnamer" r" r# �_add_attr_name� s(
�
zLDAPEntry._add_attr_namec C s� | � |�}| �|�}t|t�s@|d u r,g }n|g}| j�|� n | j�|� | j�|�|ur~|| j|< d | j |< | j
� |d � | j | d ur�| � |� d S r7 )
r� r� rj r� re �addr� rb rE rc rd r� r� �r; r� rv r" r" r# � _set_nice� s
zLDAPEntry._set_nicec C s� | � |�}t|t�s*td||jj|f ��t|�D ]*\}}t|t�s2td|||jj|f ��q2| �|�}| j �
|�|ur�|| j |< d | j |< | j �
|d � | j | d ur�| �|� d S )Nz'%s value must be list, got %s object %rz,%s[%d] value must be bytes, got %s object %r)r� rj r� r� rr r= � enumerater� r� rc rE rb rd r� r� )r; r� rv �i�itemr" r" r# �_set_raw� s&
�
��
zLDAPEntry._set_rawc C s | � ||� d S r7 )r� r� r" r" r# � __setitem__� s zLDAPEntry.__setitem__c C s | � |�}| j| }|S r7 )r� ra r� r" r" r# �_get_attr_name� s
zLDAPEntry._get_attr_namec C sb | � |�}| j| }|d u r*g }| j|< | j| d urB| �|� || jv r^|rZ|d }nd }|S )Nr )r� rb rc r� re r� r" r" r# � _get_nice� s
zLDAPEntry._get_nicec C sF | � |�}| j| }|d u r*g }| j|< | j| d urB| �|� |S r7 )r� rc rb r� r� r" r" r# �_get_raw� s
zLDAPEntry._get_rawc C s
| � |�S r7 )r� r� r" r" r# � __getitem__� s zLDAPEntry.__getitem__c C s` | � |�}t| j�� �D ]\}}||kr| j|= q| j|= | j|= | j�|d � | j� |� d S r7 )
r� r� ra r� rb rc rd r� re r� )r; r� r� Zkeynamer" r" r# � __delitem__� s
zLDAPEntry.__delitem__c C s6 | j �� | j�� | j�� | j�� | j�� d S r7 )ra �clearrb rc rd re rC r" r" r# r� s
zLDAPEntry.clearc C s
t | j�S r7 )r� rb rC r" r" r# �__len__ s zLDAPEntry.__len__c C s
|| j v S r7 )ra r� r" r" r# � __contains__ s zLDAPEntry.__contains__c C s || v S r7 r" r� r" r" r# �has_key s zLDAPEntry.has_keyc C s t |t�stS || u S r7 �rj r^ �NotImplemented�r; �otherr" r" r# �__eq__ s
zLDAPEntry.__eq__c C s t |t�stS || uS r7 r� r� r" r" r# �__ne__ s
zLDAPEntry.__ne__c C s |d u r | }t t|j��| _d S r7 )r rl rm rf r� r" r" r# �
reset_modlist% s zLDAPEntry.reset_modlistc s g }t | �}|�| j� |D ]�}| j�|g �� | j�|g ���rX� sX|�tj|d f� q �st� rt|�tj|� f� q �fdd�� D �}� fdd��D �}|r�| j �
|�r�t |�dkr�t j
|d��|�tj||f� q |r�|�tj||f� |r |�tj||f� q |jdd� d� |S ) Nc s g | ]}|� vr|�qS r" r" �r{ rv )�oldr" r# �
<listcomp>= r z.LDAPEntry.generate_modlist.<locals>.<listcomp>c s g | ]}|� vr|�qS r" r" r� )�newr" r# r� > r r ��attrc S s | d � � dkS )Nr rM ��lower)�mr" r" r# �<lambda>P r z,LDAPEntry.generate_modlist.<locals>.<lambda>r� )rk rn rf rm rE r� r( Z
MOD_DELETEZ MOD_REPLACEr4 �get_attribute_single_valuer� r ZOnlyOneValueAllowedZMOD_ADD�sort)r; �modlistr� r� ZaddsZdelsr" )r� r� r# �generate_modlist+ s0 zLDAPEntry.generate_modlistc C s
t | j�S r7 )�iterrb rC r" r" r# �__iter__T s zLDAPEntry.__iter__)NN)N)#r= r> r? � __slots__�__hash__r< �propertyr4 ru �setterrm ry r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� �
__classcell__r" r" rq r# r^ � sF ;
5
)r^ c @ sH e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Zd d
� Z dd� Z
dS )�
LDAPEntryView��_entryc C s
|| _ d S r7 r� �r; �entryr" r" r# r< [ s zLDAPEntryView.__init__c C s | j |= d S r7 r� r� r" r" r# r� _ s zLDAPEntryView.__delitem__c C s | j �� d S r7 )r� r� rC r" r" r# r� b s zLDAPEntryView.clearc C s
t | j�S r7 )r� r� rC r" r" r# r� e s zLDAPEntryView.__iter__c C s
t | j�S r7 )r� r� rC r" r" r# r� h s zLDAPEntryView.__len__c C s
|| j v S r7 r� r� r" r" r# r� k s zLDAPEntryView.__contains__c C s || v S r7 r" r� r" r" r# r� n s zLDAPEntryView.has_keyN) r= r> r? r� r< r� r� r� r� r� r� r" r" r" r# r� X s r� c @ s e Zd Zdd� Zdd� ZdS )rw c C s | j �|�S r7 )r� r� r� r" r" r# r� r s z RawLDAPEntryView.__getitem__c C s | j �||� d S r7 )r� r� r� r" r" r# r� u s z RawLDAPEntryView.__setitem__N�r= r> r? r� r� r" r" r" r# rw q s rw c @ s e Zd Zdd� Zdd� ZdS )rx c C sL | j | }t|t�s|S |s d S t|�dkr4|d S td|t|�f ��d S )Nr r z %s has %s values, one expected)r� rj r� r� r� r� r" r" r# r� y s
�z$SingleValueLDAPEntryView.__getitem__c C s$ |d u rd | j |< n |g| j |< d S r7 r� r� r" r" r# r� � s z$SingleValueLDAPEntryView.__setitem__Nr� r" r" r" r# rx x s
rx c + @ s� e Zd ZdZdZdZdZejZej Z ej
Z
e e e e e e e e
e ee e e e ee
e
e
e
e
e
e
e
e
e
ee
e
e
e
e
e
ee
e
eeee
e
eed�*Zee
e
e
e
e
eeeeeeejejejejeeeed��Zedddddddddddd� �Zd Zd
Zdgd
d�Zedd� �Z ee j dfdd��Z edd� �Z dd� Z!dd� Z"e#dd� �Z$e#dd � �Z%d d � Z&d d � Z'd!d"� Z(d#d$� Z)d%d&� Z*d'd(� Z+d)d*� Z,d+d,� Z-e.j/dhd-d.��Z0e1d/d0� �Z2e#d1d2� �Z3did4d5�Z4d6d7� Z5d8d9� Z6d:d;� Z7d<d=� Z8djd>d?�Z9dkd@dA�Z:dldBdC�Z;dDdE� Z<dmdFdG�Z=dndIdJ�Z>dodKdL�Z?edpdMdN��Z@edqdOdP��ZAedrdQdR��ZBej
d d d fdSdT�ZCd d d ej
d d d d fdUdV�ZDdWdX� ZEdsdYdZ�ZFdtd[d\�ZGd]d^� ZHdud_d`�ZIdadb� ZJdcdd� ZKdedf� ZLd S )v�
LDAPClienta� LDAP backend class
This class abstracts a LDAP connection, providing methods that work with
LADPEntries.
The purpose of this class is to provide a boundary between IPA and
python-ldap. In IPA we use IPA defined types because they are
richer and are designed to meet our needs. We also require that we
consistently use those types without exception. On the other hand
python-ldap uses different types. The goal is to be able to have
IPA code call python-ldap methods using the types native to
IPA. This class accomplishes that goal by exposing python-ldap
methods which take IPA types, convert them to python-ldap types,
call python-ldap, and then convert the results returned by
python-ldap into IPA types.
�|�&�!)*z 1.3.6.1.4.1.1466.115.121.1.1z 1.3.6.1.4.1.1466.115.121.1.4z 1.3.6.1.4.1.1466.115.121.1.5z 1.3.6.1.4.1.1466.115.121.1.7z 1.3.6.1.4.1.1466.115.121.1.8z 1.3.6.1.4.1.1466.115.121.1.9z 1.3.6.1.4.1.1466.115.121.1.10z 1.3.6.1.4.1.1466.115.121.1.12z 1.3.6.1.4.1.1466.115.121.1.23z 1.3.6.1.4.1.1466.115.121.1.24z 1.3.6.1.4.1.1466.115.121.1.28z 1.3.6.1.4.1.1466.115.121.1.40z 1.3.6.1.4.1.1466.115.121.1.49z 1.3.6.1.4.1.1466.115.121.1.51z1.3.6.1.4.1.5322.21.2.5z2.16.840.1.113730.3.8.3.3z2.16.840.1.113730.3.8.3.18z2.16.840.1.113730.3.8.3.5z2.16.840.1.113730.3.8.3.7z2.16.840.1.113730.3.8.3.20z2.16.840.1.113730.3.8.11.4z2.16.840.1.113730.3.8.11.21z2.16.840.1.113730.3.8.11.22z2.16.840.1.113730.3.8.7.1z2.16.840.1.113730.3.8.7.2z 2.16.840.1.113719.1.301.4.6.1z 2.16.840.1.113719.1.301.4.14.1z 2.16.840.1.113719.1.301.4.17.1z 2.16.840.1.113719.1.301.4.18.1z 2.16.840.1.113719.1.301.4.26.1z 2.16.840.1.113719.1.301.4.29.1z 2.16.840.1.113719.1.301.4.36.1z 2.16.840.1.113719.1.301.4.37.1z 2.16.840.1.113719.1.301.4.40.1z 2.16.840.1.113719.1.301.4.41.1z 2.16.840.1.113719.1.301.4.45.1z 2.16.840.1.113719.1.301.4.48.1z 2.16.840.1.113719.1.301.4.49.1z 2.16.840.1.113719.1.301.4.52.1z 2.16.840.1.113719.1.301.4.53.1z 2.16.840.1.113730.3.8.16.1.3z 2.16.840.1.113730.3.8.16.1.4)ZmanagedtemplateZ managedbaseZmemberindirectZmemberofindirectZ originscope�idnsnameZ idnssoamnameZ idnssoarnameZdnszoneidnsnameZkrbcanonicalnameZkrbprincipalname�usercertificate�usercertificate;binaryZ
cACertificatezcACertificate;binaryZnsds5replicalastupdatestartZnsds5replicalastupdateendZnsds5replicalastinitstartZnsds5replicalastinitendT) znsslapd-ssl-check-hostnameznsslapd-lookthroughlimitznsslapd-idlistscanlimitznsslapd-anonlimitsdnz nsslapd-minssf-exclude-rootdseznsslapd-enable-upgrade-hashznsslapd-db-locksz%nsslapd-logging-hr-timestamps-enabledz nsslapd-ldapientrysearchbaseznsslapd-ldapidnmappingbaseznsslapd-sizelimit� �r FNc C sT |dur|| _ || _|| _|| _|| _|| _|| _d| _d| _|durP| � � | _
dS )a� Create LDAPClient object.
:param ldap_uri: The LDAP URI to connect to
:param start_tls: Use STARTTLS
:param force_schema_updates:
If true, this object will always request a new schema from the
server. If false, a cached schema will be reused if it exists.
Generally, it should be true if the API context is 'installer' or
'updates', but it must be given explicitly since the API object
is not always available
:param no_schema: If true, schema is never requested from the server.
:param decode_attrs:
If true, attributes are decoded to Python types according to their
syntax.
NF) �ldap_uri�
_start_tls�_force_schema_updates�
_no_schema�
_decode_attrs�_cacert�
_sasl_nocanon� _has_schema�_schema�_connectr_ )r; r� � start_tls�force_schema_updates� no_schema� decode_attrs�cacert� sasl_nocanonr" r" r# r< s zLDAPClient.__init__c K s t |�}| |fddd�|��S )z;Create a LDAPI connection to local 389-DS instance
FN�r� r� )r' )�clsr! rp r2 r" r" r# �
from_realm, s zLDAPClient.from_realmc K s8 |rdt |d� }ndt |d� }| |f||d�|��S )a� Create LDAP or LDAPS connection to a remote 389-DS instance
This constructor is opinionated and doesn't let you shoot yourself in
the foot. It always creates a secure connection. By default it
returns a LDAP connection to port 389 and performs STARTTLS using the
default CA cert. With start_tls=False, it creates a LDAPS connection
to port 636 instead.
Note: Microsoft AD does not support SASL encryption and integrity
verification with a TLS connection. For AD, use a plain connection
with GSSAPI and a MIN_SSF >= 56. SASL GSSAPI and SASL GSS SPNEGO
ensure data integrity and confidentiality with SSF > 1. Also see
https://msdn.microsoft.com/en-us/library/cc223500.aspx
� ldap://%s� �
ldaps://%si| r� �r )r� �hostnamer� r� rp r2 r" r" r# �from_hostname_secure3 s z LDAPClient.from_hostname_securec K s dt |d� }| |fi |��S )z�Create a plain LDAP connection with TLS/SSL
Note: A plain TLS connection should only be used in combination with
GSSAPI bind.
r� r� r� )r� r� rp r2 r" r" r# �from_hostname_plainJ s z LDAPClient.from_hostname_plainc C s | j S r7 )r� rC r" r" r# �__str__V s zLDAPClient.__str__c s( t |�}� fdd�|D �}� j�||�S )Nc s" g | ]\}}}||� � |�f�qS r" �r� �r{ �a�b�crC r" r# r� ] r z'LDAPClient.modify_s.<locals>.<listcomp>)r� r4 �modify_s)r; ru r� r" rC r# r Y s zLDAPClient.modify_sc C s | j S r7 rs rC r" r" r# r4 ` s zLDAPClient.connc C s | j r| j �dd�d S d S d S )Nz://r r )r� r rC r" r" r# �protocold s zLDAPClient.protocolc C sj | j r
d S | jsdztj| j| j| jd�}W n tjt fyF d }Y n0 t
� | d|� t
� | dd� | j S )N)rH r� r� T)
r� r� � schema_cacherI r� r4 r� r ZExecutionError�
IndexError�object� __setattr__r� )r; r9 r" r" r# � _get_schemak s �
zLDAPClient._get_schemac C s t �| dd� t �| dd� dS )zr
Force this instance to forget it's cached schema and reacquire
it from the schema cache.
r� Fr� N)r r rC r" r" r# �
_flush_schema} s zLDAPClient._flush_schemac C s| | j s
tS tjr$t|t�r$|�d�}|| jv r8| j| S | �� }|d urx|� t
j j |�}|d urx|j
| jv rx| j|j
S tS r� )r� r� r� r� rj �unicoder� �_SYNTAX_OVERRIDEr r� r( r9 r� Zsyntax�_SYNTAX_MAPPING�r; � name_or_oidr9 �objr" r" r# �get_attribute_type� s
z LDAPClient.get_attribute_typec C s | � |�tu S )zf
Check the schema to see if the attribute uses DN syntax.
Returns True/False
)r r )r; r
r" r" r# �
has_dn_syntax� s zLDAPClient.has_dn_syntaxc C s` t jrt|t�r|�d�}|| jv r.| j| S | �� }|dur\|�tj j
|�}|dur\|j S dS )z�
Check the schema to see if the attribute is single-valued.
If the attribute is in the schema then returns True/False
If there is a problem loading the schema or the attribute is
not in the schema return None
r� N) r� r� rj r r� �_SINGLE_VALUE_OVERRIDEr r� r( r9 r� ry r r" r" r# r� � s
z%LDAPClient.get_attribute_single_valuec s" t |t�r|rdS dS �nt |tttttf�r<t|��d�S t |t �rT|�
� �d�S t |t �rb|S t |t �r~� fdd�|D �S t |t
�r�t
� fdd�|D ��S t |t�r�t� fd d�|�� D ��}|S t |t�r�|�t��d�S t |tj�� r�|�tjj�S |d
u �r
d
S td |t|�f ��d
S ) zL
Encode attribute value to LDAP representation (str/bytes).
s TRUEs FALSEr� �asciic s g | ]}� � |��qS r" r� �r{ r� rC r" r# r� � r z%LDAPClient.encode.<locals>.<listcomp>c 3 s | ]}� � |�V qd S r7 r� r rC r" r# r~ � r z$LDAPClient.encode.<locals>.<genexpr>c 3 s | ]\}}|� � |�fV qd S r7 r� rz rC r" r# r~ � r Nz:attempt to pass unsupported type to ldap, value=%s type=%s)rj �boolr �intr r r r� r� r Zto_textr� r� �tuplerl r� r �strftimer r
�IPACertificate� public_bytes�Encoding�DERr� r� )r; �val�dctr" rC r# r� � s0
zLDAPClient.encodec s� t |t��r ��� �}z�|tu r&|W S |tu r:|�d�W S |tu rR|�d�dkW S |tu rnt�|�d�t�W S |t u r�t �
|�d��W S |t t fv r�||�d��W S |t
ju r�t
�|�W S ||�W S W n6 t� y� d� ||f }t�d|� t|��Y n0 n�t |t��r � �fdd�|D �S t |t��rDt� �fdd�|D ��S t |t��rj�fd d
�|�� D �}|S |d u �rxd S td |t|�f ��d S )
zN
Decode attribute value from LDAP representation (str/bytes).
r� ZTRUEz6unable to convert the attribute %r value %r to type %s�%sc s g | ]}�� |� ��qS r" �r� r �r� r; r" r# r� r z%LDAPClient.decode.<locals>.<listcomp>c 3 s | ]}�� |� �V qd S r7 r r r r" r# r~ r z$LDAPClient.decode.<locals>.<genexpr>c s$ i | ] \}}|� d �� � ||��qS )r� r rz rC r" r# �
<dictcomp> s z%LDAPClient.decode.<locals>.<dictcomp>Nz<attempt to pass unsupported type from ldap, value=%s type=%s)rj r� r r r� r r �strptimer r Z from_textr r r
r Zload_der_x509_certificate� ExceptionrJ rP r� r� r rl r� r� r� )r; r r� Z target_type�msgr r" r r# r� � sH
�
�
zLDAPClient.decodec
C s� g }|D ]v}|d }|d }|du rBdj t|�d�}t�d|� qt| t|��}|�� D ]\}} | |j|< qX|�� |� |� qt
r�t�d|� |S )a�
result is a python-ldap result tuple of the form (dn, attrs),
where dn is a string containing the dn (distinguished name) of
the entry, and attrs is a dictionary containing the attributes
associated with the entry. The keys of attrs are strings, and
the associated values are lists of strings.
We convert the tuple to an LDAPEntry object.
r r Nz Referral entry ignored: {ref})�refr zldap.result: %s) r� r� rJ rK r^ r r� rm r� r� �_debug_log_ldap)
r; �resultZ
ipa_resultZdn_tupleZ original_dnZoriginal_attrsZlog_msgZ ipa_entryr� �original_valuesr" r" r# �_convert_result s$ � zLDAPClient._convert_resultc
c s� d}z�z
dV W n~ t jy, t�� �Y nd t jy� } zJ|jd d �� }|jd �dd��� }|durxd||f }� W Y d}~n
d}~0 0 W �n\ t jy� tj |p�dd��Y �n8 t j
y� t� � �Y �n t j y� tj |d ��Y �n� t j
�y4 d
}|�|��r t� � �ntj||d ��Y �n� t j�yV tj|d ��Y �n� t j�y� tjd
||f d ��Y �nr t j�y� tjd||f d ��Y �nH t j�y� t�� �Y �n* t j�y� tj|d��Y �n t j�y tj|d ��Y �n� t j�y* t�� �Y �n� t j �yH t� � �Y �n� t j �yf t� � �Y �n� t j �y� tj!|d��Y �nj t j"�y� tj#|d ��Y �nH t j$�y� t�%� �Y �n* t j&�y� tj'| j(|d��Y �n t j)�y tj|d ��Y n� t j*�y" Y n� t j+�yD tj||d ��Y n� t j,�yf tj||d ��Y n� t j-�y� tjd||f d ��Y nd t j�y� } zHd|v �r�tjdd ��t.�/dt0|�j1t2|�� tj||d ��W Y d}~n
d}~0 0 dS )z0Context manager that handles LDAPErrors
Nr rQ rR rS z%s arguments: %sz
no such entry��reason)�messagez:Another entry with the same attribute value already existsrT )rR z%s %sz%s: %sr� rO z%s (%s)ZNOT_ALLOWED_TO_DELEGATEz$KDC returned NOT_ALLOWED_TO_DELEGATEzUnhandled LDAPError: %s: %s)3r( ZTIMEOUTr ZDatabaseTimeoutrY rZ r[ rE rV �NotFoundZALREADY_EXISTSZDuplicateEntryZTYPE_OR_VALUE_EXISTSZCONSTRAINT_VIOLATIONr+ r\ ZINSUFFICIENT_ACCESSZACIErrorZINVALID_CREDENTIALSZINAPPROPRIATE_AUTHZNO_SUCH_ATTRIBUTEZMidairCollisionZINVALID_SYNTAXZ
InvalidSyntaxZOBJECT_CLASS_VIOLATIONZObjectclassViolation�ADMINLIMIT_EXCEEDED�AdminLimitExceeded�SIZELIMIT_EXCEEDED�SizeLimitExceeded�TIMELIMIT_EXCEEDED�TimeLimitExceededZNOT_ALLOWED_ON_RDNZNotAllowedOnRDNZ FILTER_ERRORZBadSearchFilterZNOT_ALLOWED_ON_NONLEAFZNotAllowedOnNonLeafrW rX r� Z LOCAL_ERROR�SUCCESSZ
CONNECT_ERRORZUNWILLING_TO_PERFORMZ AUTH_UNKNOWNrJ rK r� r= r� )r; Zarg_descrQ r] rR Z_msgr" r" r# �
error_handler@ s�
�
��zLDAPClient.error_handlerc C sJ | sd S | t u rt�� �n,| tu r,t�� �n| tu r>t�� �nt�� �d S r7 )�TRUNCATED_ADMIN_LIMITr r/ �TRUNCATED_SIZE_LIMITr1 �TRUNCATED_TIME_LIMITr3 �LimitsExceeded)� truncatedr" r" r# �handle_truncated_result� s
z"LDAPClient.handle_truncated_resultc C s | � � S )z'schema associated with this LDAP server)r rC r" r" r# r9 � s zLDAPClient.schema�allc C s� | j d u rd S g }|D ]p}| j �tj j|�}|d urn|dkrH||j7 }q�|dkr\||j7 }q�||j|j 7 }q|rtjtd�| d��qdd� t t
|��D �S )N�must�mayzobjectclass %s not foundr* c S s g | ]}t |��� �qS r" )r r� �r{ r� r" r" r# r� � r z5LDAPClient.get_allowed_attributes.<locals>.<listcomp>) r9 r� r( Z ObjectClassr= r> r r- r r� rk )r; rN Zraise_on_unknownZ
attributesZallowed_attributes�ocr r" r" r# �get_allowed_attributes� s
�z!LDAPClient.get_allowed_attributesc C s | S r7 r" rC r" r" r# � __enter__� s zLDAPClient.__enter__c C s | � � d S r7 )�close)r; �exc_type� exc_value� tracebackr" r" r# �__exit__� s zLDAPClient.__exit__c C s
d| _ dS )z'
Close the connection.
Nrs rC r" r" r# rC � s zLDAPClient.closec C sj | � � �N t| j| jd�}| js0|�tjtj� | j rH| j
dkrH|� � W d � n1 s\0 Y |S )N)r3 r( ) r5 r5 r� r� r� r) r( r* ZOPT_OFFr� r Z start_tls_s)r; r4 r" r" r# r� � s
&zLDAPClient._connectc C sx | j dkr | js |r |s td��| �� �< | �� t|�}| �|�}| j�||||� W d � n1 sj0 Y dS )z0
Perform simple bind operation.
r( z)simple_bind over insecure LDAP connectionN) r r� r� r5 r r� r� r4 Z
simple_bind_s)r; �bind_dnZ
bind_password�server_controls�client_controlsZ
insecure_bindr" r" r# � simple_bind� s ��
�zLDAPClient.simple_bindc C sb t �t�� �j}| �� �6 tj�|�}| � � | j
� d|||� W d � n1 sT0 Y dS )zP
Perform SASL bind operation using the SASL EXTERNAL mechanism.
rS N) �pwd�getpwuidr, �geteuid�pw_namer5 r( �saslZexternalr r4 �sasl_interactive_bind_s)r; rI rJ Z user_name� auth_tokensr" r" r# �
external_bind� s
�zLDAPClient.external_bindc C sZ | � � �> | jdkrt}nt}| �� | j�d|||� W d � n1 sL0 Y dS )zN
Perform SASL bind operation using the SASL GSSAPI mechanism.
�ldapirS N)r5 r �SASL_GSS_SPNEGO� SASL_GSSAPIr r4 rQ )r; rI rJ rR r" r" r# � gssapi_bind� s
�zLDAPClient.gssapi_bindc C s> | � � �" | �� | j�� W d � n1 s00 Y dS )z+
Perform unbind operation.
N)r5 r r4 Zunbind_srC r" r" r# �unbind� s
zLDAPClient.unbindc C s2 |du rt � }t|ttf�r$|d }t ||f|�S )z�
Make distinguished name from attribute.
Keyword arguments:
parent_dn -- DN of the parent entry (default '')
Nr )r rj r� r )r; r� rv � parent_dnr" r" r# �make_dn_from_attr s
z LDAPClient.make_dn_from_attrr c C s t ||| f|�S )z�
Make distinguished name from entry attributes.
Keyword arguments:
primary_key -- attribute from which to make RDN (default 'cn')
parent_dn -- DN of the parent entry (default '')
)r )r; � entry_attrsZ primary_keyrY r" r" r# �make_dn s zLDAPClient.make_dnc K s t | ||fi |��S r7 r� )r; r` ro rp r" r" r# �
make_entry" s zLDAPClient.make_entryc C s� dd� |D �}|r4|| j kr4d| j | �|| j�f S t|�dkrJd| }nd}|D ]"}|�d�shd| }d ||f }qRt|�dkr�d
| }|S ) z�
Combine filters into one for ldap2.find_entries.
Keyword arguments:
rules -- see ldap2.make_filter
c S s g | ] }|r|�qS r" r" )r{ Zfxr" r" r# r� : r z.LDAPClient.combine_filters.<locals>.<listcomp>z(%s%s)r z(%srS �(z(%s)z%s%sz%s))�
MATCH_NONE�combine_filters� MATCH_ANYr� r+ )r� �filters�rulesZflt�fr" r" r# r` / s �
zLDAPClient.combine_filtersc s" t �ttf�r4� ����fdd��D �}��||�S �du�r t �tj�rX��tjj ��t �t
�r�t � ���
d��d��fdd�tj�dt��d �D ���n6t �t�r���t��tj����nt���tj�����s�d
}�r�d | }�r�|d }|� �|�jk�rd � �f S d
� �f S dS )a]
Make filter for ldap2.find_entries from attribute.
Keyword arguments:
rules -- see ldap2.make_filter
exact -- boolean, True - make filter as (attr=value)
False - make filter as (attr=*value*)
leading_wildcard -- boolean:
True - allow heading filter wildcard when exact=False
False - forbid heading filter wildcard when exact=False
trailing_wildcard -- boolean:
True - allow trailing filter wildcard when exact=False
False - forbid trailing filter wildcard when exact=False
c s g | ]}�j � |���d ��qS ))�exact�leading_wildcard�trailing_wildcard)�make_filter_from_attr)r{ r} )r� r� re rf rg r" r# r� ^ s ��z4LDAPClient.make_filter_from_attr.<locals>.<listcomp>Nr �\c 3 s | ]}� ||d � V qdS )r Nr" )r{ r� )rv r" r# r~ l s z3LDAPClient.make_filter_from_attr.<locals>.<genexpr>���r r �*z
(!(%s=%s))z(%s=%s)rS )rj r� r r` r
r r r r r r� �binasciiZhexlifyr� r r� Zmoves�ranger� r r r r( �filterZescape_filter_charsr� r_ ) r� r� rv rc re rf rg �flts�templater" )r� r� re rf rg rv r# rh K s> �
�
� z LDAPClient.make_filter_from_attrc
C s� || j kr| j}n|}g }|du rP|�� D ]"\} }
|�| �| |
||||�� q*n8|D ]2} |�| d�} | durT|�| �| | ||||�� qT| �||�S )a�
Make filter for ldap2.find_entries from entry attributes.
Keyword arguments:
attrs_list -- list of attributes to use, all if None (default None)
rules -- specifies how to determine a match (default ldap2.MATCH_ANY)
exact -- boolean, True - make filter as (attr=value)
False - make filter as (attr=*value*)
leading_wildcard -- boolean:
True - allow heading filter wildcard when exact=False
False - forbid heading filter wildcard when exact=False
trailing_wildcard -- boolean:
True - allow trailing filter wildcard when exact=False
False - forbid trailing filter wildcard when exact=False
rules can be one of the following:
ldap2.MATCH_NONE - match entries that do not match any attribute
ldap2.MATCH_ALL - match entries that match all attributes
ldap2.MATCH_ANY - match entries that match any of attribute
N)r_ ra r� r� rh rE r` )
r� r[ �
attrs_listrc re rf rg Zmake_filter_rulesro r| r} r� rv r" r" r# � make_filter� s,
�� ��zLDAPClient.make_filterc
K sl | j f |||||d�|��\}}z| �|� W n8 tjyf } z t�d| ||� � W Y d} ~ n
d} ~ 0 0 |S )a� Return a list of matching entries.
:raises: errors.LimitsExceeded if the list is truncated by the server
:raises: errors.NotFound if result set is empty
or base_dn doesn't exist
:param base_dn: dn of the entry at which to start the search
:param scope: search scope, see LDAP docs (default ldap2.SCOPE_SUBTREE)
:param filter: LDAP filter to apply
:param attrs_list: ist of attributes to return, all if None (default)
:param get_effective_rights: use GetEffectiveRights control
:param kwargs: additional keyword arguments. See find_entries method
for their description.
)�base_dn�scopern rq �get_effective_rightsz2%s while getting entries (base DN: %s, filter: %s)N)� find_entriesr; r r9 rJ rP )
r; rs rt rn rq ru rp �entriesr: r] r" r" r# � get_entries� s ��
�zLDAPClient.get_entriesc C s( |du rt � }|sd}g } d}
|du r,| j}|dkr8d}|du rF| j}t|t�sXt|�}t|t�sjt|�}|r�dd� t|�D �}g } |r�| �| �� � d} |dkr�|nd d
}
|
dkr�d}| � � ��2 t
j r�| � |�}| � |�}|r�| t
d|
| �g }n| p�d}z�| jjt|�||||||d �}| j�|d�}|\}}}}|tjk�rJ�ql| �|�}|�r | �|d � �q |�r�|D ] }t|t
��rv|j} �q��qvd} W �n8 tj�y� t}
Y �q�Y �n tj�y� t}
Y �q�Y n� tj�y� t}
Y �q�Y n� tj �y� } z�|�r�| �r�t
dd| �g}z"| jj t|�||||||d � W n4 tj �y~ } zt � d |� W Y d}~n
d}~0 0 d} z|�W n4 tjtjtjf�y� d
}
Y W Y d}~�q�Y n0 W Y d}~n
d}~0 0 |�r�| s�q�q�W d � n1 �s�0 Y | �s |
�s t j!dd��| |
fS )a%
Return a list of entries and indication of whether the results were
truncated ([(dn, entry_attrs)], truncated) matching specified search
parameters followed by truncated flag. If the truncated flag is True,
search hit a server limit and its results are incomplete.
Keyword arguments:
:param attrs_list: list of attributes to return, all if None
(default None)
:param base_dn: dn of the entry at which to start the search
(default '')
:param scope: search scope, see LDAP docs (default ldap2.SCOPE_SUBTREE)
:param time_limit: time limit in seconds (default unlimited)
:param size_limit: size (number of entries returned) limit
(default unlimited)
:param paged_search: search using paged results control
:param get_effective_rights: use GetEffectiveRights control
:raises: errors.NotFound if result set is empty
or base_dn doesn't exist
Nz(objectClass=*)Fr r� c S s g | ] }|� � �qS r" r� r? r" r" r# r� � r z+LDAPClient.find_entries.<locals>.<listcomp>rS i� r )Z serverctrls�timeoutZ sizelimitz!Error cancelling paged search: %sTzno matching entry foundr* )"r �
time_limit�
size_limitrj r �floatrk r� �)_LDAPClient__get_effective_rights_controlr5 r� r� r� r r4 Z
search_extr� Zresult3r( ZRES_SEARCH_RESULTr) �cookier. r6 r0 r7 r2 r8 rY Z search_ext_srJ Zwarningr � EmptyResult)r; rn rq rs rt rz r{ Z paged_searchru �resr: Z base_sctrlsr~ Z page_sizeZsctrls�idr' ZobjtypeZres_listZ_res_idZ res_ctrlsZctrlr] �e2r" r" r# rv � s�
� �
�
�
� ,
& zLDAPClient.find_entriesc C s( | j �� dd� }tdd�|��d��S )z8Construct a GetEffectiveRights control for current user.� NTzdn: {0}r� )r4 Zwhoami_sr r� r� )r; rH r" r" r# Z __get_effective_rights_controlU s �z)LDAPClient.__get_effective_rights_controlc C s^ |du rt � }||d|i}| j|| jd�}| j|||d�}t|�dkrVtjt|�d��|d S )a
Find entry (dn, entry_attrs) by attribute and object class.
Keyword arguments:
attrs_list - list of attributes to return, all if None (default None)
base_dn - dn of the entry at which to start the search (default '')
NZ objectClass)rc )rn rq r )�foundr )r rr � MATCH_ALLrx r� r ZSingleMatchExpected) r; r� rv Z object_classrq rs Z search_kwrn rw r" r" r# �find_entry_by_attr[ s
� z LDAPClient.find_entry_by_attrc C s" | j || jd||||d�}|d S )z�
Get entry (dn, entry_attrs) by dn.
Keyword arguments:
attrs_list - list of attributes to return, all if None (default None)
N)rz r{ ru r )rx rU )r; ru rq rz r{ ru rw r" r" r# � get_entrys s
�zLDAPClient.get_entryc C sr t dd� |j�� D ��}| �� �6 | �|�}| j�t|j�t |�� �� W d � n1 s\0 Y |�
� dS )zPCreate a new entry.
This should be called as add_entry(entry).
c s s | ]\}}|r||fV qd S r7 r" rz r" r" r# r~ � r z'LDAPClient.add_entry.<locals>.<genexpr>N) rl rm r� r5 r� r4 Zadd_sr� ru r� r� )r; r� �attrsr" r" r# � add_entry� s
:zLDAPClient.add_entryc C s� ||krt �� �|d }|dd� |dd� kr6d}ntt|dd� � �}| �� �: | jjt|�t|�|t|�d� t� d� W d � n1 s�0 Y dS )a�
Move an entry (either to a new superior or/and changing relative distinguished name)
Keyword arguments:
dn: DN of the source entry
new_dn: DN of the target entry
del_old -- delete old RDN value (default True)
:raises:
errors.NotFound if source entry or target superior entry doesn't exist
errors.EmptyModlist if source and target are identical
r r N)Z newsuperiorZdeloldg333333�?)
r � EmptyModlistr� r r5 r4 Zrename_sr r: �sleep)r; ru �new_dn�del_oldZnew_rdnZ new_superiorr" r" r# �
move_entry� s
�zLDAPClient.move_entryc sz |� � }|st�� �t�d|� � �� �6 � fdd�|D �}� j�t|j �|� W d � n1 sd0 Y |�
� dS )zZUpdate entry's attributes.
This should be called as update_entry(entry).
zupdate_entry modlist %sc s& g | ] \}}}|t |�� �|�f�qS r" )r� r� r� rC r" r# r� � s �z+LDAPClient.update_entry.<locals>.<listcomp>N) r� r r� rJ rK r5 r4 r r� ru r� )r; r� r� r" rC r# � update_entry� s
�2zLDAPClient.update_entryc C sR t |t�r|}n|j}| �� � | j�t|�� W d � n1 sD0 Y dS )z7Delete an entry given either the DN or the entry itselfN)rj r ru r5 r4 Zdelete_sr� �r; Z entry_or_dnru r" r" r# � delete_entry� s
zLDAPClient.delete_entryc C s2 z| j |g d� W n tjy( Y dS 0 dS dS )z?
Test whether the given object exists in LDAP.
)rq FTN)r� r r- �r; ru r" r" r# � entry_exists� s
zLDAPClient.entry_exists)FFFTNT)N)Fr< )NNF)NN)NN)N)r N)NN)r� )r� TTT)Nr� TTT)NN)NNNF)T)Mr= r> r? r@ ra r� r_ r( rU ZSCOPE_ONELEVELZ
SCOPE_SUBTREEr� r r r r r r r r
r r r
r rz r{ r< � classmethodr� r
Z
IPA_CA_CRTr� r� r� r r� r4 r r r r r r� r� r� r) �
contextlib�contextmanagerr5 � staticmethodr; r9 rA rB rG rC r� rK rS rW rX rZ r\ r] r` rh rr rx rv r} r� r� r� r� r� r� r� r" r" r" r# r� � sH �9�� �
$
�
#*% O
�
�
� 6 � .�
�
�
�
r� rS r� c C s| |d u r$|rd}n|d ur d}nd}|dkr:dt | |� S |dkrVdd�|�d�� S |dkrldt | |� S td | ��d S )
NrT Zldapsr( r� z)ldapi://%%2fvar%%2frun%%2fslapd-%s.socketr r r� zProtocol %r not supported)r r r r� )�host�portr� rT Zrealmr r" r" r# � get_ldap_uri� s �r� c @ s e Zd Zddd�ZdS )�
CacheEntryNFc C s || _ || _|| _|| _d S r7 )r� rq � exceptionr< )r; r� rq r� ru r< r" r" r# r< � s zCacheEntry.__init__)NNNFF)r= r> r? r< r" r" r" r# r� � s �r� c s� e Zd ZdZd&� fdd� Zedd � �Zed
d � �Zed d
� �Zdd� Z g fdd�Z
d'dd�Z dd� Z dd� Z
dd� Z� fdd�Z� fd d �Z� fd d �Zd(� fd d!� Z� fd"d#�Zd)� fd$d%� Z� ZS )*� LDAPCachez+A very basic LRU Cache using an OrderedDictFTN�d c s� t � | _d| _d| _t�| dd� t�| dd� t�| d|oB| dk� t�| d|
� t�| d| � tt| ��|||||||� d S ) NTF�
_cache_missesr � _cache_hits�
_enable_cache� _debug_cache� _cache_size) r �cacher� r� r r ri r� r< ) r; r� r� r� r� r� r� r� Z enable_cacheZ
cache_sizeZ debug_cacherq r" r# r< � s
�
�zLDAPCache.__init__c C s | j S r7 )r� rC r" r" r# �hit s z
LDAPCache.hitc C s | j S r7 )r� rC r" r" r# �miss s zLDAPCache.missc C s | j S r7 )r� rC r" r" r# � max_entries s zLDAPCache.max_entriesc O s( | j r$| jr$tj|g|�R i |�� d S r7 )r� r� rJ rK )r; r$ rZ rp r" r" r# �emit s zLDAPCache.emitc C sz t | t|��}|s*|j�tt|j��� n4|j�� D ](\}}|�� |vrJq4t|�|j|�� < q4tt|j��|_|� � |S r7 )
r^ r rm rn r rl r� r� rf r� )r; ru r� r� Z new_entryr� r( r" r" r# �
copy_entry" s zLDAPCache.copy_entryc C s� h d�}| j sd S | �|� td�|v s@td�|v s@td�|v rDd S |rf| �d|� t|d�| j|< n,|�|�s�t|�� |�� |d�| j|< nd S | �d|||� | j�|� t | j�| j
kr�| jj d d
�\}}| �d |� d S ) N> Z cospriorityr� r� r� z cn=configz cn=kerberoszo=ipacazEXC: Caching exception %s�r� )r� rq r< zADD: %s: %s all=%sF)�lastzLRU: removed %s) r� �remove_cache_entryr r� r� r� � intersectionr� � move_to_endr� r� �popitem)r; ru rq �get_allr� r� Z BANNED_ATTRSr" r" r# �add_cache_entry2 s4
�
�
�
� zLDAPCache.add_cache_entryc C s: | � d� t�| dt� � t�| dd� t�| dd� d S )NZFINALr� r� r r� )� cache_statusr r r rC r" r" r# � clear_cacheb s
zLDAPCache.clear_cachec C s | � d|| j| jt| j�� d S )Nz %s: Hits %d Misses %d Size %d)r� r� r� r� r� )r; r� r" r" r# r� h s �zLDAPCache.cache_statusc C s0 | � d|� || jv r | j|= n | � d|� d S )NzDROP: %szDROP: not in cache %s)r� r� r� r" r" r# r� l s
z LDAPCache.remove_cache_entryc s* | � d� | �|j� tt| ��|� d S )Nr� )r� r� ru ri r� r� r� rq r" r# r� v s
zLDAPCache.add_entryc s* | � d� | �|j� tt| ��|� d S )Nr� )r� r� ru ri r� r� r� rq r" r# r� { s
zLDAPCache.update_entryc s> | � d� t|t�r|}n|j}| �|� tt| ��|� d S )Nr� )r� rj r ru r� ri r� r� r� rq r" r# r� � s
zLDAPCache.delete_entryc s6 | � d� | �|� | �|� tt| ��|||� d S )Nr� )r� r� ri r� r� )r; ru r� r� rq r" r# r� � s
zLDAPCache.move_entryc s� | � d� t|t�s t|�}| � d|� |D ]R\}}}|�� dv r,|D ]6}t|ttf�sFt|�d��}| � d|� | �|� qFq,| � d|� | �|� tt| �� ||�S )Nr z
modlist %s)�memberZ ipaallowedtoperform_write_keysZmanagedby_hostr� z modify_s %s)
r� rj r r� r r� r� ri r� r )r; ru r� Z_opr� Zmod_dn�drq r" r# r � s
zLDAPCache.modify_sc
s� | j s tt| ��|||||�S | �d|� | j�|�}|rB|rBd }|r�|jr�| jd }t �
| d|� | �d|j� | � d� |j�| �d|� |r�| �d|j � |s�dg}n|d gkr�d
g}d }|r�|dgd gfv r�|j
r�d }|�r"|j
�r"|�r"| jd }t �
| d|� | � d� | �||j�S |�r�|�r�td
d� t|�D ��} tdd� |j D ��}
| �|
��r�| jd }t �
| d|� | � d� | �||j| �S z tt| ��|||||�}W nx tjtjf�y } zB| j|| d� | jd } t �
| d| � | � d| � � W Y d } ~ nbd } ~ 0 t�y* � Y nF0 |dgd gfv �rBd }| j|tdd� |j�� D ��|| �||�d� | jd } t �
| d| � | � d� |S )NzCache lookup: %sr r� zHIT: Re-raising %sZHITzRequested attrs_list %szCached attrs_list %srk rS ru FTc s s | ]}|� � V qd S r7 r� �r{ r� r" r" r# r~ � r z&LDAPCache.get_entry.<locals>.<genexpr>c s s | ]}|� � V qd S r7 r� r� r" r" r# r~ � r r� r� zMISS: %sc s s | ]}|� � V qd S r7 r� )r{ r| r" r" r# r~ � r )rq r� r� ZMISS)r� ri r� r� r� r� rE r� r� r r r� rq r< r� r� rk �issubsetr r- r r� r� r# ra �keys)
r; ru rq rz r{ ru r� �hitsr� Z req_attrsZ cache_attrsr] �missesrq r" r# r� � s�
�
���
�
�
zLDAPCache.get_entry) FFFTNTTr� F)NFNN)T)NNNF)r= r> r? r@ r< r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r� r� r" r" rq r# r� � s8 �
�
0
�r� )N)rS r� NFNN)Rrl r0 Zloggingr: r Zdecimalr r� r r� r, rL �warnings� collectionsr Z cryptography.hazmat.primitivesr r( Z ldap.saslZ ldap.filterZ
ldap.controlsr r r& r� Zipalibr r
r Zipalib.constantsr Zipaplatform.pathsr
Zipapython.ipautilr r Z ipapython.dnr r Zipapython.dnsutilr Zipapython.kerberosr �collections.abcr ZPY3r� r Z getLoggerr= rJ rP rV rU r& r Z_missingZ
AUTOBIND_AUTOZAUTOBIND_ENABLEDZAUTOBIND_DISABLEDr7 r8 r6 Z DIRMAN_DNr� �hasattr�filterwarningsr r$ r' r5 r6 rA r r^ r� rw rx r� r� r� r� r" r" r" r# �<module> s�
�
( N p W �