def adconnector_save(self, request): """Saves the Active Directory connection configuration options: Host_IP: IP address of the AD server LDAP_Host: hostname of the AD server LDAP_Base: LDAP base of the AD server LDAP_BindDN: LDAP DN to use for authentication KerberosDomain: kerberos domain PollSleep: time in seconds between polls RetryRejected: how many time to retry a synchronisation MappingSyncMode: synchronisation mode MappingGroupLanguage: language of the AD server return: { 'success' : (True|False), 'message' : <details> } """ for umckey, ucrkey, default in Instance.OPTION_MAPPING: val = request.options.get(umckey, default) if val: if isinstance(val, bool): val = 'yes' if val else 'no' MODULE.info('Setting %s=%s' % (ucrkey, val)) univention.config_registry.handler_set([u'%s=%s' % (ucrkey, val)]) ucr.load() if ucr.get('connector/ad/ldap/ldaps'): MODULE.info('Unsetting connector/ad/ldap/ldaps') univention.config_registry.handler_unset([u'connector/ad/ldap/ldaps']) if ucr.get('connector/ad/ldap/port') == '636': MODULE.info('Setting ldap port to 389') univention.config_registry.handler_set([u'connector/ad/ldap/port=389']) if not request.options.get('LDAP_Password') in (None, '', DO_NOT_CHANGE_PWD): fn = ucr.get('connector/ad/ldap/bindpw', FN_BINDPW) try: with open(fn, 'w') as fd: fd.write(request.options.get('LDAP_Password')) os.chmod(fn, 0o600) os.chown(fn, 0, 0) univention.config_registry.handler_set([u'connector/ad/ldap/bindpw=%s' % fn]) except Exception as e: MODULE.info('Saving bind password failed (filename=%(fn)s ; exception=%(exception)s)' % {'fn': fn, 'exception': str(e.__class__)}) self.finished(request.id, {'success': False, 'message': _('Saving bind password failed (filename=%(fn)s ; exception=%(exception)s)') % {'fn': fn, 'exception': str(e.__class__)}}) return ssldir = '/etc/univention/ssl/%s' % request.options.get('LDAP_Host') if not os.path.exists(ssldir): self._create_certificate(request) return # enter a static host entry such that the AD server's FQDN can be resolved univention.config_registry.handler_set([u'hosts/static/%(Host_IP)s=%(LDAP_Host)s' % request.options]) # check for SSL support on AD side if admember.server_supports_ssl(server=request.options.get('LDAP_Host')): MODULE.process('Enabling SSL...') admember.enable_ssl() else: MODULE.warn('SSL is not supported') admember.disable_ssl() # UCR variables are set, and now we can try to guess the language of # the AD domain ad_lang = guess_ad_domain_language() univention.config_registry.handler_set([u'connector/ad/mapping/group/language=%s' % ad_lang]) self.finished(request.id, {'success': True, 'message': _('Active Directory connection settings have been saved.')})
def admember_join(self, username, password, ad_server_address, progress): progress.title = _('Joining UCS into Active Directory domain') progress.total = 100.0 progress.warnings = [] overall_success = False MODULE.process(progress.title) def _progress(steps, msg): progress.current = float(steps) progress.message = msg MODULE.process(msg) time.sleep(0.2) def _err(exc=None, msg=None): exc_str = '' if exc is not None: exc_str = str(exc) or exc.__doc__ # if no message, take the doc string exc_class_name = exc.__class__.__name__ MODULE.error('Join process failed [%s]: %s' % (exc_class_name, exc_str)) if msg: MODULE.error(msg) else: msg = _('An unexpected error occurred: %s') % exc_str progress.finish_with_result({ 'success': False, 'error': msg, 'warnings': progress.warnings, }) ad_domain_info = {} try: admember.check_server_role() ad_domain_info = admember.lookup_adds_dc(ad_server_address) ad_server_ip = ad_domain_info['DC IP'] _progress(5, _('Configuring time synchronization...')) admember.time_sync(ad_server_ip) admember.set_timeserver(ad_server_ip) _progress(10, _('Configuring DNS server...')) admember.set_nameserver([ad_server_ip]) admember.prepare_ucr_settings() _progress(15, _('Configuring Kerberos settings...')) admember.disable_local_heimdal() admember.disable_local_samba4() _progress(20, _('Configuring reverse DNS settings...')) admember.prepare_dns_reverse_settings(ad_domain_info) _progress(25, _('Configuring software components...')) _step_offset = 30.0 _nsteps = 35.0 def _step_handler(step): MODULE.process('Package manager progress: %.1f' % step) progress.current = (step / 100.0) * _nsteps + _step_offset def _err_handler(err): MODULE.warn(err) progress.warnings.append(err) success = admember.remove_install_univention_samba(info_handler=MODULE.process, error_handler=_err_handler, step_handler=_step_handler) if not success: raise RuntimeError(_('An error occurred while installing necessary software components.')) _progress(65, _('Configuring synchronization from AD...')) admember.prepare_connector_settings(username, password, ad_domain_info) admember.disable_ssl() _progress(70, _('Renaming well known SID objects...')) admember.rename_well_known_sid_objects(username, password) _progress(75, _('Configuring Administrator account...')) admember.prepare_administrator(username, password) _progress(80, _('Running Samba join script...')) admember.run_samba_join_script(username, password) _progress(85, _('Configuring DNS entries...')) admember.add_domaincontroller_srv_record_in_ad(ad_server_ip, username, password) admember.add_host_record_in_ad(uid=username, bindpw=password, sso=True) admember.make_deleted_objects_readable_for_this_machine(username, password) admember.synchronize_account_position(ad_domain_info, username, password) _progress(90, _('Starting Active Directory connection service...')) admember.start_service('univention-ad-connector') _progress(95, _('Registering LDAP service entry...')) admember.add_admember_service_to_localhost() overall_success = True _progress(100, _('Join has been finished successfully.')) # error handling... except admember.invalidUCSServerRole as exc: _err(exc, _('The AD member mode can only be configured on a DC master server.')) except admember.failedADConnect as exc: _err(exc, _('Could not connect to AD Server %s. Please verify that the specified address is correct. (%s)') % (ad_domain_info.get('DC DNS Name'), 'admember_join: %s' % (exc,))) except admember.domainnameMismatch as exc: _err(exc, _('The domain name of the AD Server (%(ad_domain)s) does not match the local UCS domain name (%(ucs_domain)s). For the AD member mode, it is necessary to setup a UCS system with the same domain name as the AD Server.') % {'ad_domain': ad_domain_info["Domain"], 'ucs_domain': ucr['domainname']}) except admember.connectionFailed as exc: _err(exc, _('Could not connect to AD Server %s. Please verify that username and password are correct. (Details:\n%s)') % (ad_domain_info.get('DC DNS Name'), exc)) except admember.failedToSetAdministratorPassword as exc: _err(exc, _('Failed to set the password of the UCS Administrator to the Active Directory Administrator password.')) except admember.failedToCreateAdministratorAccount as exc: _err(exc, _('Failed to create the Administrator account in UCS.')) except admember.sambaSidNotSetForAdministratorAccount as exc: _err(exc, _('The sambaSID could not set for the Administrator account in UCS.')) except admember.failedToSearchForWellKnownSid as exc: _err(exc, _('Failed to search for the well known SID.')) except admember.failedToAddAdministratorAccountToDomainAdmins as exc: _err(exc, _('Failed to add the Administrator account to the Domain Admins group.')) except admember.timeSyncronizationFailed as exc: _err(exc, _('Could not synchronize the time between the UCS system and the Active Directory domain controller: %s') % exc) except RuntimeError as exc: _err(exc) except Exception as exc: # catch all other errors that are unlikely to occur _err(exc) MODULE.error('Traceback:\n%s' % traceback.format_exc()) if not overall_success: _progress(100, _('Join has been finished with errors.')) admember.revert_ucr_settings() admember.revert_connector_settings() if hasattr(progress, 'result'): # some error probably occurred -> return the result in the progress return progress.result return {'success': success}
class Instance(Base, ProgressMixin): OPTION_MAPPING = ( ('LDAP_Host', 'connector/ad/ldap/host', ''), ('LDAP_Base', 'connector/ad/ldap/base', ''), ('LDAP_BindDN', 'connector/ad/ldap/binddn', ''), ('KerberosDomain', 'connector/ad/mapping/kerberosdomain', ''), ('PollSleep', 'connector/ad/poll/sleep', 5), ('RetryRejected', 'connector/ad/retryrejected', 10), ('DebugLevel', 'connector/debug/level', 2), ('DebugFunction', 'connector/debug/function', False), ('MappingSyncMode', 'connector/ad/mapping/syncmode', 'sync'), ('MappingGroupLanguage', 'connector/ad/mapping/group/language', 'de') ) def init(self): self.__update_status() def state(self, request): """Retrieve current status of the Active Directory connection configuration and the service options: {} return: { 'configured' : (True|False), 'certificate' : (True|False), 'running' : (True|False) } """ self.__update_status() self.finished(request.id, { 'ssl_enabled': self.status_ssl, 'password_sync_enabled': self.status_password_sync, 'running': self.status_running, 'certificate': self.status_certificate, 'mode_admember': self.status_mode_admember, 'mode_adconnector': self.status_mode_adconnector, 'configured': self.status_mode_adconnector or self.status_mode_admember, 'server_role': ucr.get('server/role'), }) def load(self, request): """Retrieve current status of the Active Directory connection configuration and the service options: {} return: { <all AD connector UCR variables> } """ result = {} for option, var, default in Instance.OPTION_MAPPING: result[option] = ucr.get(var, default) pwd_file = ucr.get('connector/ad/ldap/bindpw') result['passwordExists'] = bool(pwd_file and os.path.exists(pwd_file)) self.finished(request.id, result) @sanitize(LDAP_Host=StringSanitizer(required=True)) def adconnector_save(self, request): """Saves the Active Directory connection configuration options: Host_IP: IP address of the AD server LDAP_Host: hostname of the AD server LDAP_Base: LDAP base of the AD server LDAP_BindDN: LDAP DN to use for authentication KerberosDomain: kerberos domain PollSleep: time in seconds between polls RetryRejected: how many time to retry a synchronisation MappingSyncMode: synchronisation mode MappingGroupLanguage: language of the AD server return: { 'success' : (True|False), 'message' : <details> } """ self.required_options(request, 'Host_IP') self.required_options(request, *[x[0] for x in Instance.OPTION_MAPPING if x[2] == '']) for umckey, ucrkey, default in Instance.OPTION_MAPPING: val = request.options.get(umckey, default) if val: if isinstance(val, bool): val = val and 'yes' or 'no' MODULE.info('Setting %s=%s' % (ucrkey, val)) univention.config_registry.handler_set([u'%s=%s' % (ucrkey, val)]) ucr.load() if ucr.get('connector/ad/ldap/ldaps'): MODULE.info('Unsetting connector/ad/ldap/ldaps') univention.config_registry.handler_unset([u'connector/ad/ldap/ldaps']) if ucr.get('connector/ad/ldap/port') == '636': MODULE.info('Setting ldap port to 389') univention.config_registry.handler_set([u'connector/ad/ldap/port=389']) if not request.options.get('LDAP_Password') in (None, '', DO_NOT_CHANGE_PWD): fn = ucr.get('connector/ad/ldap/bindpw', FN_BINDPW) try: fd = open(fn, 'w') fd.write(request.options.get('LDAP_Password')) fd.close() os.chmod(fn, 0600) os.chown(fn, 0, 0) univention.config_registry.handler_set([u'connector/ad/ldap/bindpw=%s' % fn]) except Exception, e: MODULE.info('Saving bind password failed (filename=%(fn)s ; exception=%(exception)s)' % {'fn': fn, 'exception': str(e.__class__)}) self.finished(request.id, {'success': False, 'message': _('Saving bind password failed (filename=%(fn)s ; exception=%(exception)s)') % {'fn': fn, 'exception': str(e.__class__)}}) return ssldir = '/etc/univention/ssl/%s' % request.options.get('LDAP_Host') if not os.path.exists(ssldir): self._create_certificate(request) return # enter a static host entry such that the AD server's FQDN can be resolved univention.config_registry.handler_set([u'hosts/static/%(Host_IP)s=%(LDAP_Host)s' % request.options]) # check for SSL support on AD side if admember.server_supports_ssl(server=request.options.get('LDAP_Host')): MODULE.process('Enabling SSL...') admember.enable_ssl() else: MODULE.warn('SSL is not supported') admember.disable_ssl() # UCR variables are set, and now we can try to guess the language of # the AD domain ad_lang = guess_ad_domain_language() univention.config_registry.handler_set([u'connector/ad/mapping/group/language=%s' % ad_lang]) self.finished(request.id, {'success': True, 'message': _('Active Directory connection settings have been saved.')})