Class: PgLdapSync::Application

Inherits:
Object
  • Object
show all
Defined in:
lib/pgls/application.rb

Defined Under Namespace

Classes: LdapRole, MatchedMembership, MatchedRole, PgRole

Constant Summary collapse

PG_BUILTIN_ROLES =

List of default roles taken from www.postgresql.org/docs/current/predefined-roles.html

%w[ pg_read_all_data pg_write_all_data pg_read_all_settings pg_read_all_stats pg_stat_scan_tables pg_monitor pg_database_owner pg_signal_backend pg_read_server_files pg_write_server_files pg_execute_server_program pg_checkpoint]

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#config_fname ⇒ Object

Returns the value of attribute config_fname.



12
13
14
 
# File 'lib/pgls/application.rb', line 12

def config_fname
  @config_fname
end

#groups_fname ⇒ Object

Returns the value of attribute groups_fname.



13
14
15
 
# File 'lib/pgls/application.rb', line 13

def groups_fname
  @groups_fname
end

#log ⇒ Object

Returns the value of attribute log.



14
15
16
 
# File 'lib/pgls/application.rb', line 14

def log
  @log
end

#test ⇒ Object

Returns the value of attribute test.



15
16
17
 
# File 'lib/pgls/application.rb', line 15

def test
  @test
end

Class Method Details

.run(argv) ⇒ Object 



476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
 
# File 'lib/pgls/application.rb', line 476

def self.run(argv)
  s = self.new
  s.config_fname = '/etc/pg_ldap_sync.yaml'
  s.groups_fname = ''
  s.log = Logger.new($stdout)
  s.log.level = Logger::ERROR

  OptionParser.new do |opts|
    opts.version = VERSION
    opts.banner = "Usage: #{$0} [options]"
    opts.on("-v", "--[no-]verbose", "Increase verbose level"){|v| s.log.level += v ? -1 : 1 }
    opts.on("-c", "--config FILE", "Config file [#{s.config_fname}]", &s.method(:config_fname=))
    opts.on("-g", "--groups FILE", "Groups file [#{s.groups_fname}]", &s.method(:groups_fname=))
    opts.on("-t", "--[no-]test", "Don't do any change in the database", &s.method(:test=))

    opts.parse!(argv)
  end

  s.start!
end

Instance Method Details

#create_pg_role(role) ⇒ Object 



332
333
334
335
 
# File 'lib/pgls/application.rb', line 332

def create_pg_role(role)
  pg_conf = @config[role.type==:user ? :pg_users : :pg_groups]
  pg_exec_modify "CREATE ROLE \"#{role.name}\" #{pg_conf[:create_options]}"
end

#drop_pg_role(role) ⇒ Object 



337
338
339
 
# File 'lib/pgls/application.rb', line 337

def drop_pg_role(role)
  pg_exec_modify "DROP ROLE \"#{role.name}\""
end

#format_groups_for_ldap_groups(groups) ⇒ Object 



71
72
73
74
75
76
 
# File 'lib/pgls/application.rb', line 71

def format_groups_for_ldap_groups(groups)
  # Используйте метод map для преобразования каждой группы в соответствующий формат
  formatted_groups = groups.map { |group| "(cn=#{group})" }
  # Используйте метод join для объединения форматированных групп в одну строку с оператором "или" (|)
  "(|" + formatted_groups.join + ")"
end

#format_groups_for_ldap_users(groups, filter) ⇒ Object 



64
65
66
67
68
69
 
# File 'lib/pgls/application.rb', line 64

def format_groups_for_ldap_users(groups, filter)
  # Используйте метод map для преобразования каждой группы в соответствующий формат
  formatted_groups = groups.map { |group| "(memberOf=CN=#{group},#{filter})" }
  # Используйте метод join для объединения форматированных групп в одну строку с оператором "или" (|)
  "(&(objectClass=organizationalPerson)(|" + formatted_groups.join + "))"
end

#grant_membership(role_name, add_members) ⇒ Object 



395
396
397
398
399
 
# File 'lib/pgls/application.rb', line 395

def grant_membership(role_name, add_members)
  pg_conf = @config[:pg_groups]
  add_members_escaped = add_members.map{|m| "\"#{m}\"" }.join(",")
  pg_exec_modify "GRANT \"#{role_name}\" TO #{add_members_escaped} #{pg_conf[:grant_options]}"
end

#match_memberships(ldap_roles, pg_roles) ⇒ Object 



350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
 
# File 'lib/pgls/application.rb', line 350

def match_memberships(ldap_roles, pg_roles)
  ldap_group_conf = @config[:ldap_groups]
  hash_of_arrays = Hash.new { |h, k| h[k] = [] }
  if ldap_group_conf[:ald_domain]
    ldap_by_dn = ldap_roles.inject(hash_of_arrays){|h,r| h[r.name] << r; h }
  else
    ldap_by_dn = ldap_roles.inject(hash_of_arrays){|h,r| h[r.dn] << r; h }
  end
  ldap_by_m2m = ldap_roles.inject([]) do |a,r|
    next a unless r.member_dns
    a + r.member_dns.flat_map do |dn|
      has_members = ldap_by_dn[dn]
      log.warn{"ldap member with dn #{dn} is unknown"} if has_members.empty?
      has_members.map do |has_member|
        [r.name, has_member.name]
      end
    end
  end

  hash_of_arrays = Hash.new { |h, k| h[k] = [] }
  pg_by_name = pg_roles.inject(hash_of_arrays){|h,r| h[r.name] << r; h }
  pg_by_m2m = pg_roles.inject([]) do |a,r|
    next a unless r.member_names
    a + r.member_names.flat_map do |name|
      has_members = pg_by_name[name]
      log.warn{"pg member with name #{name} is unknown"} if has_members.empty?
      has_members.map do |has_member|
        [r.name, has_member.name]
      end
    end
  end

  memberships  = (ldap_by_m2m & pg_by_m2m).map{|r,mo| MatchedMembership.new r, mo, :keep }
  memberships += (ldap_by_m2m - pg_by_m2m).map{|r,mo| MatchedMembership.new r, mo, :grant }
  memberships += (pg_by_m2m - ldap_by_m2m).map{|r,mo| MatchedMembership.new r, mo, :revoke }

  log.info do
    memberships.each do |membership|
      log.debug{ "#{membership.state} #{membership.role_name} to #{membership.has_member}" }
    end
    "membership stat: grant: #{memberships.count{|u| u.state==:grant }} revoke: #{memberships.count{|u| u.state==:revoke }} keep: #{memberships.count{|u| u.state==:keep }}"
  end
  return memberships
end

#match_roles(ldaps, pgs, type) ⇒ Object 



273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
 
# File 'lib/pgls/application.rb', line 273

def match_roles(ldaps, pgs, type)
  ldap_by_name = ldaps.inject({}){|h,u| h[u.name] = u; h }
  pg_by_name = pgs.inject({}){|h,u| h[u.name] = u; h }

  roles = []
  ldaps.each do |ld|
    pg = pg_by_name[ld.name]
    role = MatchedRole.new ld, pg, ld.name
    roles << role
  end
  pgs.each do |pg|
    ld = ldap_by_name[pg.name]
    next if ld
    role = MatchedRole.new ld, pg, pg.name
    roles << role
  end

  roles.each do |r|
    r.state = case
      when r.ldap && !r.pg then :create
      when !r.ldap && r.pg then :drop
      when r.pg && r.ldap then :keep
      else raise "invalid user #{r.inspect}"
    end
    r.type = type
  end

  log.info do
    roles.each do |role|
      log.debug{ "#{role.state} #{role.type}: #{role.name}" }
    end
    "#{type} stat: create: #{roles.count{|r| r.state==:create }} drop: #{roles.count{|r| r.state==:drop }} keep: #{roles.count{|r| r.state==:keep }}"
  end
  return roles
end

#pg_exec(sql) ⇒ Object 



327
328
329
330
 
# File 'lib/pgls/application.rb', line 327

def pg_exec(sql)
  res = @pgconn.exec sql
  (0...res.num_tuples).map{|t| (0...res.num_fields).map{|i| res.getvalue(t, i) } }
end

#pg_exec_modify(sql) ⇒ Object 



320
321
322
323
324
325
 
# File 'lib/pgls/application.rb', line 320

def pg_exec_modify(sql)
  log.info{ "SQL: #{sql}" }
  unless self.test
    try_sql sql
  end
end

#read_config_file(fname) ⇒ Object 



42
43
44
45
46
47
48
49
50
 
# File 'lib/pgls/application.rb', line 42

def read_config_file(fname)
  raise "Config file #{fname.inspect} does not exist" unless File.exist?(fname)
  config = YAML.load(File.read(fname))

  schema_fname = File.join(File.dirname(__FILE__), '../../config/schema.yaml')
  validate_config(config, schema_fname, fname)

  @config = string_to_symbol(config)
end

#read_groups_from_file(fname) ⇒ Object 



54
55
56
57
58
59
60
61
62
 
# File 'lib/pgls/application.rb', line 54

def read_groups_from_file(fname)
  groups = []
  File.foreach(fname) do |line|
    # Удалите пробелы и символы новой строки с помощью strip
    group = line.strip
    groups << group unless group.empty?
  end
  groups
end

#retrieve_array_attribute(entry, attribute_name) ⇒ Object 



133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
 
# File 'lib/pgls/application.rb', line 133

def retrieve_array_attribute(entry, attribute_name)
  array = entry[attribute_name]
  if array.empty?
    # Possibly an attribute, which must be retrieved in several ranges

    ranged_attr = entry.attribute_names.find { |n| n =~ /\A#{Regexp.escape(attribute_name)};range=/ }
    if ranged_attr
      entry_dn = entry.dn

      loop do
        array += entry[ranged_attr]
        log.debug "retrieved attribute range #{ranged_attr.inspect} of dn #{entry_dn}"

        if ranged_attr =~ /;range=\d\-\*\z/
          break
        end

        attribute_with_range = ranged_attr.to_s.gsub(/;range=.*/, ";range=#{array.size}-*")
        entry = @ldap.search(
          base: entry_dn,
          scope: Net::LDAP::SearchScope_BaseObject,
          attributes: attribute_with_range).first

        ranged_attr = entry.attribute_names.find { |n| n =~ /\A#{Regexp.escape(attribute_name)};range=/ }
      end
    end
  else
    # Values already received -> No ranged attribute
  end
  return array
end

#revoke_membership(role_name, rm_members) ⇒ Object 



401
402
403
404
 
# File 'lib/pgls/application.rb', line 401

def revoke_membership(role_name, rm_members)
  rm_members_escaped = rm_members.map{|m| "\"#{m}\"" }.join(",")
  pg_exec_modify "REVOKE \"#{role_name}\" FROM #{rm_members_escaped}"
end

#search_ldap_groups ⇒ Object

Raises:



165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
 
# File 'lib/pgls/application.rb', line 165

def search_ldap_groups
  ldap_group_conf = @config[:ldap_groups]
  name_attribute = ldap_group_conf[:name_attribute]
  member_attribute = ldap_group_conf[:member_attribute]

  groups = []

  if @groups_fname != ''
    res = @ldap.search(
          base: ldap_group_conf[:base],
          filter: format_groups_for_ldap_groups(@groups),
          attributes: [name_attribute, member_attribute, :dn]
    )
  else
    res = @ldap.search(
          base: ldap_group_conf[:base],
          filter: ldap_group_conf[:filter],
          attributes: [name_attribute, member_attribute, :dn]
    )
  end

  res.each do |entry|
    name = entry[name_attribute].first

    unless name
      log.warn "user attribute #{name_attribute.inspect} not defined for #{entry.dn}"
      next
    end

    log.info "found group-dn: #{entry.dn}"

    names = if ldap_group_conf[:bothcase_name]
      [name, name.downcase].uniq
    elsif ldap_group_conf[:lowercase_name]
      [name.downcase]
    elsif ldap_group_conf[:uppercase_name]
       [name.upcase]
    else
      [name]
    end

    names.each do |n|
      group_members = retrieve_array_attribute(entry, member_attribute)
      groups << LdapRole.new(n, entry.dn, group_members)
    end
    entry.each do |attribute, values|
      log.debug "   #{attribute}:"
      values.each do |value|
        log.debug "      --->#{value.inspect}"
      end
    end
  end
  raise LdapError, "LDAP: #{@ldap.get_operation_result.message}" unless res
  return groups
end

#search_ldap_users ⇒ Object

Raises:



78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
 
# File 'lib/pgls/application.rb', line 78

def search_ldap_users
  ldap_user_conf = @config[:ldap_users]
  name_attribute = ldap_user_conf[:name_attribute]

  users = []
  
  if @groups_fname != ''
    @groups = read_groups_from_file(@groups_fname)

    res = @ldap.search(
          base: ldap_user_conf[:base],
          filter: format_groups_for_ldap_users(@groups, ldap_user_conf[:filter]),
          attributes: [name_attribute, :dn]
    )
  else
    res = @ldap.search(
          base: ldap_user_conf[:base],
          filter: ldap_user_conf[:filter],
          attributes: [name_attribute, :dn]
    )
  end
  
  res.each do |entry|
    name = entry[name_attribute].first

    unless name
      log.warn "user attribute #{name_attribute.inspect} not defined for #{entry.dn}"
      next
    end
    log.info "found user-dn: #{entry.dn}"

    names = if ldap_user_conf[:bothcase_name]
      [name, name.downcase].uniq
    elsif ldap_user_conf[:lowercase_name]
      [name.downcase]
    elsif ldap_user_conf[:uppercase_name]
      [name.upcase]
    else
      [name]
    end

    names.each do |n|
      users << LdapRole.new(n, entry.dn)
    end
    entry.each do |attribute, values|
      log.debug "   #{attribute}:"
      values.each do |value|
        log.debug "      --->#{value.inspect}"
      end
    end
  end
  raise LdapError, "LDAP: #{@ldap.get_operation_result.message}" unless res
  return users
end

#search_pg_groups ⇒ Object 



240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
 
# File 'lib/pgls/application.rb', line 240

def search_pg_groups
  pg_groups_conf = @config[:pg_groups]

  groups = []
  res = pg_exec "SELECT rolname, oid FROM pg_roles WHERE #{pg_groups_conf[:filter]}"
  res.each do |tuple|
    res2 = pg_exec "SELECT pr.rolname FROM pg_auth_members pam JOIN pg_roles pr ON pr.oid=pam.member WHERE pam.roleid=#{@pgconn.escape_string(tuple[1])}"
    member_names = res2.map{|row| row[0] }
    group = PgRole.new tuple[0], member_names
    next if PG_BUILTIN_ROLES.include?(group.name)
    log.info{ "found pg-group: #{group.name.inspect} with members: #{member_names.inspect}"}
    groups << group
  end
  return groups
end

#search_pg_users ⇒ Object 



226
227
228
229
230
231
232
233
234
235
236
237
238
 
# File 'lib/pgls/application.rb', line 226

def search_pg_users
  pg_users_conf = @config[:pg_users]

  users = []
  res = pg_exec "SELECT rolname FROM pg_roles WHERE #{pg_users_conf[:filter]}"
  res.each do |tuple|
    user = PgRole.new tuple[0]
    next if PG_BUILTIN_ROLES.include?(user.name)
    log.info{ "found pg-user: #{user.name.inspect}"}
    users << user
  end
  return users
end

#start! ⇒ Object 



419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
 
# File 'lib/pgls/application.rb', line 419

def start!
  read_config_file(@config_fname)

  ldap_conf = @config[:ldap_connection]
  auth_meth = ldap_conf.dig(:auth, :method).to_s
  if auth_meth == "gssapi"
    begin
      require 'net/ldap/auth_adapter/gssapi'
    rescue LoadError => err
      raise "#{err}\nTo use GSSAPI authentication please run:\n  gem install net-ldap-auth_adapter-gssapi"
    end
  elsif auth_meth == "gss_spnego"
    begin
      require 'net-ldap-gss-spnego'
      # This doesn't work since this file is defined in net-ldap as a placeholder:
      #   require 'net/ldap/auth_adapter/gss_spnego'
    rescue LoadError => err
      raise "#{err}\nTo use GSSAPI authentication please run:\n  gem install net-ldap-gss-spnego"
    end
  end

  # gather LDAP users and groups
  @ldap = Net::LDAP.new ldap_conf
  ldap_users = uniq_names search_ldap_users
  ldap_groups = uniq_names search_ldap_groups

  # gather PGs users and groups
  @pgconn = PG.connect @config[:pg_connection]
  begin
    @pgconn.transaction do
      pg_users = uniq_names search_pg_users
      pg_groups = uniq_names search_pg_groups

      # compare LDAP to PG users and groups
      mroles = match_roles(ldap_users, pg_users, :user)
      mroles += match_roles(ldap_groups, pg_groups, :group)

      # compare LDAP to PG memberships
      mmemberships = match_memberships(ldap_users+ldap_groups, pg_users+pg_groups)

      # drop/revoke roles/memberships first
      sync_membership_to_pg(mmemberships, :revoke)
      sync_roles_to_pg(mroles, :drop)
      # create/grant roles/memberships
      sync_roles_to_pg(mroles, :create)
      sync_membership_to_pg(mmemberships, :grant)
    end
  ensure
    @pgconn.close
  end

  # Determine exitcode
  if log.had_errors?
    raise ErrorExit.new(1, log.first_error)
  end
end

#string_to_symbol(hash) ⇒ Object 



17
18
19
20
21
22
23
24
25
26
27
 
# File 'lib/pgls/application.rb', line 17

def string_to_symbol(hash)
  if hash.kind_of?(Hash)
    return hash.inject({}) do |h, v|
      raise "expected String instead of #{h.inspect}" unless v[0].kind_of?(String)
      h[v[0].intern] = string_to_symbol(v[1])
      h
    end
  else
    return hash
  end
end

#sync_membership_to_pg(memberships, for_state) ⇒ Object 



406
407
408
409
410
411
412
413
414
415
416
417
 
# File 'lib/pgls/application.rb', line 406

def sync_membership_to_pg(memberships, for_state)
  grants = {}
  memberships.select{|ms| ms.state==for_state }.each do |ms|
    grants[ms.role_name] ||= []
    grants[ms.role_name] << ms.has_member
  end

  grants.each do |role_name, members|
    grant_membership(role_name, members) if for_state==:grant
    revoke_membership(role_name, members) if for_state==:revoke
  end
end

#sync_roles_to_pg(roles, for_state) ⇒ Object 



341
342
343
344
345
346
 
# File 'lib/pgls/application.rb', line 341

def sync_roles_to_pg(roles, for_state)
  roles.sort{|a,b| a.name<=>b.name }.each do |role|
    create_pg_role(role) if role.state==:create && for_state==:create
    drop_pg_role(role) if role.state==:drop && for_state==:drop
  end
end

#try_sql(text) ⇒ Object 



309
310
311
312
313
314
315
316
317
318
 
# File 'lib/pgls/application.rb', line 309

def try_sql(text)
  begin
    @pgconn.exec "SAVEPOINT try_sql;"
    @pgconn.exec text
  rescue PG::Error => err
    @pgconn.exec "ROLLBACK TO try_sql;"

    log.error{ "#{err} (#{err.class})" }
  end
end

#uniq_names(list) ⇒ Object 



256
257
258
259
260
261
262
263
264
265
266
267
268
269
 
# File 'lib/pgls/application.rb', line 256

def uniq_names(list)
  names = {}
  new_list = list.select do |entry|
    name = entry.name
    if names[name]
      log.warn{ "duplicated group/user #{name.inspect} (#{entry.inspect})" }
      next false
    else
      names[name] = true
      next true
    end
  end
  return new_list
end

#validate_config(config, schema, fname) ⇒ Object 



30
31
32
33
34
35
36
37
38
39
40
 
# File 'lib/pgls/application.rb', line 30

def validate_config(config, schema, fname)
  schema = YAML.load_file(schema)
  validator = Kwalify::Validator.new(schema)
  errors = validator.validate(config)
  if errors && !errors.empty?
    errors.each do |err|
      log.fatal "error in #{fname}: [#{err.path}] #{err.message}"
    end
    raise InvalidConfig, 78 # EX_CONFIG
  end
end