Class: PgLdapSync::Application

Inherits:
Object
  • Object
show all
Defined in:
lib/pg_ldap_sync/application.rb

Defined Under Namespace

Classes: LdapRole, MatchedMembership, MatchedRole, PgRole

Constant Summary collapse

PG_BUILTIN_ROLES =

List of default roles taken from www.postgresql.org/docs/current/predefined-roles.html

%w[ pg_read_all_data pg_write_all_data pg_read_all_settings pg_read_all_stats pg_stat_scan_tables pg_monitor pg_database_owner pg_signal_backend pg_read_server_files pg_write_server_files pg_execute_server_program pg_checkpoint]

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#config_fname ⇒ Object

Returns the value of attribute config_fname.



12
13
14
 
# File 'lib/pg_ldap_sync/application.rb', line 12

def config_fname
  @config_fname
end

#log ⇒ Object

Returns the value of attribute log.



13
14
15
 
# File 'lib/pg_ldap_sync/application.rb', line 13

def log
  @log
end

#test ⇒ Object

Returns the value of attribute test.



14
15
16
 
# File 'lib/pg_ldap_sync/application.rb', line 14

def test
  @test
end

Class Method Details

.run(argv) ⇒ Object 



418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
 
# File 'lib/pg_ldap_sync/application.rb', line 418

def self.run(argv)
  s = self.new
  s.config_fname = '/etc/pg_ldap_sync.yaml'
  s.log = Logger.new($stdout)
  s.log.level = Logger::ERROR

  OptionParser.new do |opts|
    opts.version = VERSION
    opts.banner = "Usage: #{$0} [options]"
    opts.on("-v", "--[no-]verbose", "Increase verbose level"){|v| s.log.level += v ? -1 : 1 }
    opts.on("-c", "--config FILE", "Config file [#{s.config_fname}]", &s.method(:config_fname=))
    opts.on("-t", "--[no-]test", "Don't do any change in the database", &s.method(:test=))

    opts.parse!(argv)
  end

  s.start!
end

Instance Method Details

#create_pg_role(role) ⇒ Object 



279
280
281
282
 
# File 'lib/pg_ldap_sync/application.rb', line 279

def create_pg_role(role)
  pg_conf = @config[role.type==:user ? :pg_users : :pg_groups]
  pg_exec_modify "CREATE ROLE \"#{role.name}\" #{pg_conf[:create_options]}"
end

#drop_pg_role(role) ⇒ Object 



284
285
286
 
# File 'lib/pg_ldap_sync/application.rb', line 284

def drop_pg_role(role)
  pg_exec_modify "DROP ROLE \"#{role.name}\""
end

#grant_membership(role_name, add_members) ⇒ Object 



337
338
339
340
341
 
# File 'lib/pg_ldap_sync/application.rb', line 337

def grant_membership(role_name, add_members)
  pg_conf = @config[:pg_groups]
  add_members_escaped = add_members.map{|m| "\"#{m}\"" }.join(",")
  pg_exec_modify "GRANT \"#{role_name}\" TO #{add_members_escaped} #{pg_conf[:grant_options]}"
end

#match_memberships(ldap_roles, pg_roles) ⇒ Object 



297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
 
# File 'lib/pg_ldap_sync/application.rb', line 297

def match_memberships(ldap_roles, pg_roles)
  hash_of_arrays = Hash.new { |h, k| h[k] = [] }
  ldap_by_dn = ldap_roles.inject(hash_of_arrays){|h,r| h[r.dn] << r; h }
  ldap_by_m2m = ldap_roles.inject([]) do |a,r|
    next a unless r.member_dns
    a + r.member_dns.flat_map do |dn|
      has_members = ldap_by_dn[dn]
      log.warn{"ldap member with dn #{dn} is unknown"} if has_members.empty?
      has_members.map do |has_member|
        [r.name, has_member.name]
      end
    end
  end

  hash_of_arrays = Hash.new { |h, k| h[k] = [] }
  pg_by_name = pg_roles.inject(hash_of_arrays){|h,r| h[r.name] << r; h }
  pg_by_m2m = pg_roles.inject([]) do |a,r|
    next a unless r.member_names
    a + r.member_names.flat_map do |name|
      has_members = pg_by_name[name]
      log.warn{"pg member with name #{name} is unknown"} if has_members.empty?
      has_members.map do |has_member|
        [r.name, has_member.name]
      end
    end
  end

  memberships  = (ldap_by_m2m & pg_by_m2m).map{|r,mo| MatchedMembership.new r, mo, :keep }
  memberships += (ldap_by_m2m - pg_by_m2m).map{|r,mo| MatchedMembership.new r, mo, :grant }
  memberships += (pg_by_m2m - ldap_by_m2m).map{|r,mo| MatchedMembership.new r, mo, :revoke }

  log.info do
    memberships.each do |membership|
      log.debug{ "#{membership.state} #{membership.role_name} to #{membership.has_member}" }
    end
    "membership stat: grant: #{memberships.count{|u| u.state==:grant }} revoke: #{memberships.count{|u| u.state==:revoke }} keep: #{memberships.count{|u| u.state==:keep }}"
  end
  return memberships
end

#match_roles(ldaps, pgs, type) ⇒ Object 



220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
 
# File 'lib/pg_ldap_sync/application.rb', line 220

def match_roles(ldaps, pgs, type)
  ldap_by_name = ldaps.inject({}){|h,u| h[u.name] = u; h }
  pg_by_name = pgs.inject({}){|h,u| h[u.name] = u; h }

  roles = []
  ldaps.each do |ld|
    pg = pg_by_name[ld.name]
    role = MatchedRole.new ld, pg, ld.name
    roles << role
  end
  pgs.each do |pg|
    ld = ldap_by_name[pg.name]
    next if ld
    role = MatchedRole.new ld, pg, pg.name
    roles << role
  end

  roles.each do |r|
    r.state = case
      when r.ldap && !r.pg then :create
      when !r.ldap && r.pg then :drop
      when r.pg && r.ldap then :keep
      else raise "invalid user #{r.inspect}"
    end
    r.type = type
  end

  log.info do
    roles.each do |role|
      log.debug{ "#{role.state} #{role.type}: #{role.name}" }
    end
    "#{type} stat: create: #{roles.count{|r| r.state==:create }} drop: #{roles.count{|r| r.state==:drop }} keep: #{roles.count{|r| r.state==:keep }}"
  end
  return roles
end

#pg_exec(sql) ⇒ Object 



274
275
276
277
 
# File 'lib/pg_ldap_sync/application.rb', line 274

def pg_exec(sql)
  res = @pgconn.exec sql
  (0...res.num_tuples).map{|t| (0...res.num_fields).map{|i| res.getvalue(t, i) } }
end

#pg_exec_modify(sql) ⇒ Object 



267
268
269
270
271
272
 
# File 'lib/pg_ldap_sync/application.rb', line 267

def pg_exec_modify(sql)
  log.info{ "SQL: #{sql}" }
  unless self.test
    try_sql sql
  end
end

#read_config_file(fname) ⇒ Object 



41
42
43
44
45
46
47
48
49
 
# File 'lib/pg_ldap_sync/application.rb', line 41

def read_config_file(fname)
  raise "Config file #{fname.inspect} does not exist" unless File.exist?(fname)
  config = YAML.load(File.read(fname))

  schema_fname = File.join(File.dirname(__FILE__), '../../config/schema.yaml')
  validate_config(config, schema_fname, fname)

  @config = string_to_symbol(config)
end

#retrieve_array_attribute(entry, attribute_name) ⇒ Object 



93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
 
# File 'lib/pg_ldap_sync/application.rb', line 93

def retrieve_array_attribute(entry, attribute_name)
  array = entry[attribute_name]
  if array.empty?
    # Possibly an attribute, which must be retrieved in several ranges

    ranged_attr = entry.attribute_names.find { |n| n =~ /\A#{Regexp.escape(attribute_name)};range=/ }
    if ranged_attr
      entry_dn = entry.dn

      loop do
        array += entry[ranged_attr]
        log.debug "retrieved attribute range #{ranged_attr.inspect} of dn #{entry_dn}"

        if ranged_attr =~ /;range=\d+\-\*\z/
          break
        end

        attribute_with_range = ranged_attr.to_s.gsub(/;range=.*/, ";range=#{array.size}-*")
        entry = @ldap.search(
          base: entry_dn,
          scope: Net::LDAP::SearchScope_BaseObject,
          attributes: attribute_with_range).first

        ranged_attr = entry.attribute_names.find { |n| n =~ /\A#{Regexp.escape(attribute_name)};range=/ }
      end
    end
  else
    # Values already received -> No ranged attribute
  end
  return array
end

#revoke_membership(role_name, rm_members) ⇒ Object 



343
344
345
346
 
# File 'lib/pg_ldap_sync/application.rb', line 343

def revoke_membership(role_name, rm_members)
  rm_members_escaped = rm_members.map{|m| "\"#{m}\"" }.join(",")
  pg_exec_modify "REVOKE \"#{role_name}\" FROM #{rm_members_escaped}"
end

#search_ldap_groups ⇒ Object

Raises:



125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
 
# File 'lib/pg_ldap_sync/application.rb', line 125

def search_ldap_groups
  ldap_group_conf = @config[:ldap_groups]
  name_attribute = ldap_group_conf[:name_attribute]
  member_attribute = ldap_group_conf[:member_attribute]

  groups = []
  res = @ldap.search(
        base: ldap_group_conf[:base],
        filter: ldap_group_conf[:filter],
        attributes: [name_attribute, member_attribute, :dn]
  ) do |entry|
    name = entry[name_attribute].first

    unless name
      log.warn "user attribute #{name_attribute.inspect} not defined for #{entry.dn}"
      next
    end

    log.info "found group-dn: #{entry.dn}"

    names = if ldap_group_conf[:bothcase_name]
      [name, name.downcase].uniq
    elsif ldap_group_conf[:lowercase_name]
      [name.downcase]
    else
      [name]
    end

    names.each do |n|
      group_members = retrieve_array_attribute(entry, member_attribute)
      groups << LdapRole.new(n, entry.dn, group_members)
    end
    entry.each do |attribute, values|
      log.debug "   #{attribute}:"
      values.each do |value|
        log.debug "      --->#{value.inspect}"
      end
    end
  end
  raise LdapError, "LDAP: #{@ldap.get_operation_result.message}" unless res
  return groups
end

#search_ldap_users ⇒ Object

Raises:



53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
 
# File 'lib/pg_ldap_sync/application.rb', line 53

def search_ldap_users
  ldap_user_conf = @config[:ldap_users]
  name_attribute = ldap_user_conf[:name_attribute]

  users = []
  res = @ldap.search(
        base: ldap_user_conf[:base],
        filter: ldap_user_conf[:filter],
        attributes: [name_attribute, :dn]
  ) do |entry|
    name = entry[name_attribute].first

    unless name
      log.warn "user attribute #{name_attribute.inspect} not defined for #{entry.dn}"
      next
    end
    log.info "found user-dn: #{entry.dn}"

    names = if ldap_user_conf[:bothcase_name]
      [name, name.downcase].uniq
    elsif ldap_user_conf[:lowercase_name]
      [name.downcase]
    else
      [name]
    end

    names.each do |n|
      users << LdapRole.new(n, entry.dn)
    end
    entry.each do |attribute, values|
      log.debug "   #{attribute}:"
      values.each do |value|
        log.debug "      --->#{value.inspect}"
      end
    end
  end
  raise LdapError, "LDAP: #{@ldap.get_operation_result.message}" unless res
  return users
end

#search_pg_groups ⇒ Object 



187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
 
# File 'lib/pg_ldap_sync/application.rb', line 187

def search_pg_groups
  pg_groups_conf = @config[:pg_groups]

  groups = []
  res = pg_exec "SELECT rolname, oid FROM pg_roles WHERE #{pg_groups_conf[:filter]}"
  res.each do |tuple|
    res2 = pg_exec "SELECT pr.rolname FROM pg_auth_members pam JOIN pg_roles pr ON pr.oid=pam.member WHERE pam.roleid=#{@pgconn.escape_string(tuple[1])}"
    member_names = res2.map{|row| row[0] }
    group = PgRole.new tuple[0], member_names
    next if PG_BUILTIN_ROLES.include?(group.name)
    log.info{ "found pg-group: #{group.name.inspect} with members: #{member_names.inspect}"}
    groups << group
  end
  return groups
end

#search_pg_users ⇒ Object 



173
174
175
176
177
178
179
180
181
182
183
184
185
 
# File 'lib/pg_ldap_sync/application.rb', line 173

def search_pg_users
  pg_users_conf = @config[:pg_users]

  users = []
  res = pg_exec "SELECT rolname FROM pg_roles WHERE #{pg_users_conf[:filter]}"
  res.each do |tuple|
    user = PgRole.new tuple[0]
    next if PG_BUILTIN_ROLES.include?(user.name)
    log.info{ "found pg-user: #{user.name.inspect}"}
    users << user
  end
  return users
end

#start! ⇒ Object 



361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
 
# File 'lib/pg_ldap_sync/application.rb', line 361

def start!
  read_config_file(@config_fname)

  ldap_conf = @config[:ldap_connection]
  auth_meth = ldap_conf.dig(:auth, :method).to_s
  if auth_meth == "gssapi"
    begin
      require 'net/ldap/auth_adapter/gssapi'
    rescue LoadError => err
      raise "#{err}\nTo use GSSAPI authentication please run:\n  gem install net-ldap-auth_adapter-gssapi"
    end
  elsif auth_meth == "gss_spnego"
    begin
      require 'net-ldap-gss-spnego'
      # This doesn't work since this file is defined in net-ldap as a placeholder:
      #   require 'net/ldap/auth_adapter/gss_spnego'
    rescue LoadError => err
      raise "#{err}\nTo use GSSAPI authentication please run:\n  gem install net-ldap-gss-spnego"
    end
  end

  # gather LDAP users and groups
  @ldap = Net::LDAP.new ldap_conf
  ldap_users = uniq_names search_ldap_users
  ldap_groups = uniq_names search_ldap_groups

  # gather PGs users and groups
  @pgconn = PG.connect @config[:pg_connection]
  begin
    @pgconn.transaction do
      pg_users = uniq_names search_pg_users
      pg_groups = uniq_names search_pg_groups

      # compare LDAP to PG users and groups
      mroles = match_roles(ldap_users, pg_users, :user)
      mroles += match_roles(ldap_groups, pg_groups, :group)

      # compare LDAP to PG memberships
      mmemberships = match_memberships(ldap_users+ldap_groups, pg_users+pg_groups)

      # drop/revoke roles/memberships first
      sync_membership_to_pg(mmemberships, :revoke)
      sync_roles_to_pg(mroles, :drop)
      # create/grant roles/memberships
      sync_roles_to_pg(mroles, :create)
      sync_membership_to_pg(mmemberships, :grant)
    end
  ensure
    @pgconn.close
  end

  # Determine exitcode
  if log.had_errors?
    raise ErrorExit.new(1, log.first_error)
  end
end

#string_to_symbol(hash) ⇒ Object 



16
17
18
19
20
21
22
23
24
25
26
 
# File 'lib/pg_ldap_sync/application.rb', line 16

def string_to_symbol(hash)
  if hash.kind_of?(Hash)
    return hash.inject({}) do |h, v|
      raise "expected String instead of #{h.inspect}" unless v[0].kind_of?(String)
      h[v[0].intern] = string_to_symbol(v[1])
      h
    end
  else
    return hash
  end
end

#sync_membership_to_pg(memberships, for_state) ⇒ Object 



348
349
350
351
352
353
354
355
356
357
358
359
 
# File 'lib/pg_ldap_sync/application.rb', line 348

def sync_membership_to_pg(memberships, for_state)
  grants = {}
  memberships.select{|ms| ms.state==for_state }.each do |ms|
    grants[ms.role_name] ||= []
    grants[ms.role_name] << ms.has_member
  end

  grants.each do |role_name, members|
    grant_membership(role_name, members) if for_state==:grant
    revoke_membership(role_name, members) if for_state==:revoke
  end
end

#sync_roles_to_pg(roles, for_state) ⇒ Object 



288
289
290
291
292
293
 
# File 'lib/pg_ldap_sync/application.rb', line 288

def sync_roles_to_pg(roles, for_state)
  roles.sort{|a,b| a.name<=>b.name }.each do |role|
    create_pg_role(role) if role.state==:create && for_state==:create
    drop_pg_role(role) if role.state==:drop && for_state==:drop
  end
end

#try_sql(text) ⇒ Object 



256
257
258
259
260
261
262
263
264
265
 
# File 'lib/pg_ldap_sync/application.rb', line 256

def try_sql(text)
  begin
    @pgconn.exec "SAVEPOINT try_sql;"
    @pgconn.exec text
  rescue PG::Error => err
    @pgconn.exec "ROLLBACK TO try_sql;"

    log.error{ "#{err} (#{err.class})" }
  end
end

#uniq_names(list) ⇒ Object 



203
204
205
206
207
208
209
210
211
212
213
214
215
216
 
# File 'lib/pg_ldap_sync/application.rb', line 203

def uniq_names(list)
  names = {}
  new_list = list.select do |entry|
    name = entry.name
    if names[name]
      log.warn{ "duplicated group/user #{name.inspect} (#{entry.inspect})" }
      next false
    else
      names[name] = true
      next true
    end
  end
  return new_list
end

#validate_config(config, schema, fname) ⇒ Object 



29
30
31
32
33
34
35
36
37
38
39
 
# File 'lib/pg_ldap_sync/application.rb', line 29

def validate_config(config, schema, fname)
  schema = YAML.load_file(schema)
  validator = Kwalify::Validator.new(schema)
  errors = validator.validate(config)
  if errors && !errors.empty?
    errors.each do |err|
      log.fatal "error in #{fname}: [#{err.path}] #{err.message}"
    end
    raise InvalidConfig, 78 # EX_CONFIG
  end
end