pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0134-winsync-migrate-Convert-entity-names-to-posix-friend.patch

590d18
From d8395581497150602dc11248ba6ce380a3394254 Mon Sep 17 00:00:00 2001
590d18
From: Tomas Babej <tbabej@redhat.com>
590d18
Date: Wed, 23 Sep 2015 13:27:35 +0200
590d18
Subject: [PATCH] winsync-migrate: Convert entity names to posix friendly
590d18
 strings
590d18
590d18
During the migration from winsync replicated users to their
590d18
trusted identities, memberships are being preserved. However,
590d18
trusted users are external and as such cannot be added as
590d18
direct members to the IPA entities. External groups which
590d18
encapsulate the migrated users are added as members to those
590d18
entities instead.
590d18
590d18
The name of the external group is generated from the type
590d18
of the entity and its name. However, the entity's name can
590d18
contain characters which are invalid for use in the group
590d18
name.
590d18
590d18
Adds a helper function to convert a given string to a string
590d18
which would be valid for such use and leverages it in the
590d18
winsync-migrate tool.
590d18
590d18
https://fedorahosted.org/freeipa/ticket/5319
590d18
590d18
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
590d18
---
590d18
 ipapython/ipautil.py                     | 23 +++++++++++++++++++++++
590d18
 ipaserver/install/ipa_winsync_migrate.py | 15 ++++++++++++---
590d18
 2 files changed, 35 insertions(+), 3 deletions(-)
590d18
590d18
diff --git a/ipapython/ipautil.py b/ipapython/ipautil.py
590d18
index 88e89706b8e2aa6dea80809510d88bceaa836e85..64fe9bc27e58c8ecfcfabe69690db0493a10c3b1 100644
590d18
--- a/ipapython/ipautil.py
590d18
+++ b/ipapython/ipautil.py
590d18
@@ -1318,6 +1318,29 @@ def restore_hostname(statestore):
590d18
         except CalledProcessError, e:
590d18
             print >>sys.stderr, "Failed to set this machine hostname back to %s: %s" % (old_hostname, str(e))
590d18
 
590d18
+def posixify(string):
590d18
+    """
590d18
+    Convert a string to a more strict alpha-numeric representation.
590d18
+
590d18
+    - Alpha-numeric, underscore, dot and dash characters are accepted
590d18
+    - Space is converted to underscore
590d18
+    - Other characters are omitted
590d18
+    - Leading dash is stripped
590d18
+
590d18
+    Note: This mapping is not one-to-one and may map different input to the
590d18
+    same result. When using posixify, make sure the you do not map two different
590d18
+    entities to one unintentionally.
590d18
+    """
590d18
+
590d18
+    def valid_char(char):
590d18
+        return char.isalnum() or char in ('_', '.', '-')
590d18
+
590d18
+    # First replace space characters
590d18
+    replaced = string.replace(' ','_')
590d18
+    omitted = ''.join(filter(valid_char, replaced))
590d18
+
590d18
+    # Leading dash is not allowed
590d18
+    return omitted.lstrip('-')
590d18
 
590d18
 @contextmanager
590d18
 def private_ccache(path=None):
590d18
diff --git a/ipaserver/install/ipa_winsync_migrate.py b/ipaserver/install/ipa_winsync_migrate.py
590d18
index c327e502e6bfb6e402931e1962fe2410570b2bc2..4dacde3f27ead341fd4d7d2a744d28f74d5c5b95 100644
590d18
--- a/ipaserver/install/ipa_winsync_migrate.py
590d18
+++ b/ipaserver/install/ipa_winsync_migrate.py
590d18
@@ -24,7 +24,7 @@ from ipalib import api
590d18
 from ipalib import errors
590d18
 from ipapython import admintool
590d18
 from ipapython.dn import DN
590d18
-from ipapython.ipautil import realm_to_suffix
590d18
+from ipapython.ipautil import realm_to_suffix, posixify
590d18
 from ipapython.ipa_log_manager import log_mgr
590d18
 from ipaserver.plugins.ldap2 import ldap2
590d18
 from ipaserver.install import replication
590d18
@@ -214,12 +214,21 @@ class WinsyncMigrate(admintool.AdminTool):
590d18
 
590d18
         def winsync_group_name(object_entry):
590d18
             """
590d18
-            Returns the generated name of group containing migrated external users
590d18
+            Returns the generated name of group containing migrated external
590d18
+            users.
590d18
+
590d18
+            The group name is of the form:
590d18
+                 "<prefix>_<object name>_winsync_external"
590d18
+
590d18
+            Object name is converted to posix-friendly string by omitting
590d18
+            and/or replacing characters. This may lead to collisions, i.e.
590d18
+            if both 'trust_admins' and 'trust admin' groups have winsync
590d18
+            users being migrated.
590d18
             """
590d18
 
590d18
             return u"{0}_{1}_winsync_external".format(
590d18
                 winsync_group_prefix,
590d18
-                object_entry['cn'][0]
590d18
+                posixify(object_entry['cn'][0])
590d18
             )
590d18
 
590d18
         def create_winsync_group(object_entry):
590d18
-- 
590d18
2.4.3
590d18