D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
lib
/
python3.9
/
site-packages
/
ipapython
/
__pycache__
/
Filename :
ipaldap.cpython-39.pyc
back
Copy
a � �i � @ s` d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dlmZ d dl Z d dl Z d dl Z d dl Z d dl mZ d dlmZ d dlZd dlZd dlZd dlmZmZ d dlZd dlZd dlmZmZm Z d d l m Z d d l m Z d d l!m"Z"m#Z# d d l$m%Z%m&Z& d d l'm(Z( d dl)m*Z* d dl+m,Z, ej-�r0e.Z/e�0e1�Z2ej3�3i d�Z4ej3�3i d�Z5dZ6e7� Z8dZ9dZ:dZ;e7� Z<e7� Z=e7� Z>e%d�Z?ej@�r�eAed��r�e jBdejCd� dd� ZDd d � ZEd6d d �ZFG d d!� d!�ZGG d"d#� d#�ZHeH� ZIG d$d%� d%e,�ZJG d&d'� d'e,�ZKG d(d)� d)eK�ZLG d*d+� d+eK�ZMG d,d-� d-�ZNd7d0d1�ZOG d2d3� d3�ZPG d4d5� d5eN�ZQdS )8� N)�datetime)�Decimal)�deepcopy)� OrderedDict)� serialization)�SimplePagedResultsControl�GetEffectiveRightsControl)�errors�x509�_)� LDAP_GENERALIZED_TIME_FORMAT)�paths)� format_netloc�CIDict)�DN�RDN)�DNSName)� Principal)�MutableMappingZGSSAPIz GSS-SPNEGOF� � � )�cnzdirectory manager�LDAPBytesWarning�ignore)�action�categoryc C s d� | �d��S )z/Convert Kerberos realm name to 389-DS server id�-�.)�join�split)� realm_name� r" �5/usr/lib/python3.9/site-packages/ipapython/ipaldap.py�realm_to_serveridZ s r$ c C s" t | �}tj|f }dt�|� S )z(Get ldapi:// URI to 389-DS's Unix socket�ldapi://)r$ r Z SLAPD_INSTANCE_SOCKET_TEMPLATE�ldapurlZ ldapUrlEscape)r! ZserveridZ socketnamer" r" r# �realm_to_ldapi_uri_ s r' c C s~ t �| �}|�t jt j� | �d�sz|rNtj�|�s@t t j |��|�t j |� |�t j d� |�t jt j� |�t jd� |S )a� Wrapper around ldap.initialize() The function undoes global and local ldap.conf settings that may cause issues or reduce security: * Canonization of SASL host names is disabled. * With cacertfile=None, the connection uses OpenSSL's default verify locations, also known as system-wide trust store. * Cert validation is enforced. * SSLv2 and SSLv3 are disabled. r% i r )�ldapZ initialize� set_option�OPT_X_SASL_NOCANONZOPT_ON� startswith�os�path�isfile�IOError�errno�ENOENTZOPT_X_TLS_CACERTFILEZOPT_X_TLS_PROTOCOL_MINZOPT_X_TLS_REQUIRE_CERTZOPT_X_TLS_DEMANDZOPT_X_TLS_NEWCTX)�uri� cacertfile�connr" r" r# �ldap_initializef s r5 c @ s e Zd ZdZdd� ZdS )� _ServerSchemaz? Properties of a schema retrieved from an LDAP server. c C s || _ || _t�� | _d S �N)�server�schema�timeZretrieve_timestamp)�selfr8 r9 r" r" r# �__init__� s z_ServerSchema.__init__N)�__name__� __module__� __qualname__�__doc__r< r" r" r" r# r6 � s r6 c @ s2 e Zd ZdZdd� Zd dd�Zdd� Zd d � Zd S ) � SchemaCachez: Cache the schema's from individual LDAP servers. c C s i | _ d S r7 )�servers�r; r" r" r# r< � s zSchemaCache.__init__Fc C sH |r| � |� | j�|�}|du rB| �||�}t||�}|| j|< |jS )a Return schema belonging to a specific LDAP server. For performance reasons the schema is retrieved once and cached unless force_update is True. force_update flushes the existing schema for the server from the cache and reacquires it. N)�flushrB �get� _retrieve_schema_from_serverr6 r9 )r; �urlr4 � force_updateZ server_schemar9 r" r" r# � get_schema� s zSchemaCache.get_schemac C s0 t �d|� z | j|= W n ty* Y n0 d S )Nz flushing %s from SchemaCache)�logger�debugrB �KeyError)r; rG r" r" r# rD � s zSchemaCache.flushc C s |dus J �t �d||� z\z |jdtjddgd�d }W n8 tjyr t �d� |jd tjddgd�d }Y n0 W n� tjy� tj|d d ��Y nh tj y� } zN|j d d � � }|j d � d d�� � }tj d| d||f d��W Y d}~n d}~0 0 tj�|d �S )a Retrieve the LDAP schema from the provided url and determine if User-Private Groups (upg) are configured. Bind using kerberos credentials. If in the context of the in-tree "lite" server then use the current ccache. If in the context of Apache then create a new ccache and bind using the Apache HTTP service principal. If a connection is provided then it the credentials bound to it are used. The connection is not closed when the request is done. Nz0retrieving schema for SchemaCache url=%s conn=%sz cn=schema�attributetypes� objectclasses)Zattrlistr z-cn=schema not found, fallback to cn=subschemaz cn=subschemaz0LDAP Server Down, unable to retrieve LDAP schema�r2 �error�desc�info� zuri=%sz&Unable to retrieve LDAP schema: %s: %s�rQ rR r )rJ rK Zsearch_sr( � SCOPE_BASE�NO_SUCH_OBJECT� SERVER_DOWNr � NetworkError� LDAPError�args�striprE � DatabaseErrorr9 Z SubSchema)r; rG r4 Z schema_entry�erQ rR r" r" r# rF � s: � �� ��� � z(SchemaCache._retrieve_schema_from_serverN)F)r= r> r? r@ r< rI rD rF r" r" r" r# rA � s rA c s e Zd ZdZdZd:� fdd� Zedd� �Zedd� �Zej d d� �Zed d � �Z ed d � �Z dd� Z dd� Z dd� Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Z d0d1� Z d2d3� Z d;d4d5�Z d6d7� Z d8d9� Z!� Z"S )<� LDAPEntry) �_conn�_dn�_names�_nice�_raw�_sync� _not_list� _orig_raw� _raw_view�_single_value_viewNc s@ t t| ��� t|t�r.|du s$J �|}|j}t|t�s<J �t|t�r\|du sRJ �|}|j}t|t�sjJ �|du rvi }|| _|| _t� | _ i | _ i | _ i | _ t � | _i | _d| _d| _t|t��r*t |j�| _t|j�| _|j|u �rt|j �| _ t|j �| _ t|j �| _ t|j �| _ n| j�|j� i }| j|fi |�� dS )a� LDAPEntry constructor. Takes 1 to 3 positional arguments and an arbitrary number of keyword arguments. The 3 forms of positional arguments are: * LDAPEntry(entry) - create a shallow copy of an existing LDAPEntry. * LDAPEntry(dn, entry) - create a shallow copy of an existing LDAPEntry with a different DN. * LDAPEntry(conn, dn, mapping) - create a new LDAPEntry using the specified LDAPClient and DN and optionally initialize attributes from the specified mapping object. Keyword arguments can be used to override values of specific attributes. N)�superr^ r< � isinstancer_ � LDAPClientr` r r ra rb rc rd �setre rf rg rh �dictr4 �raw�update)r; r_ r` �_obj�kwargs�� __class__r" r# r< � sD zLDAPEntry.__init__c C s | j S r7 �r_ rC r" r" r# r4 , s zLDAPEntry.connc C s | j S r7 )r` rC r" r" r# �dn0 s z LDAPEntry.dnc C s t |t�sJ �|| _d S r7 )rj r r` )r; �valuer" r" r# ru 4 s c C s | j d u rt| �| _ | j S r7 )rg �RawLDAPEntryViewrC r" r" r# rn 9 s z LDAPEntry.rawc C s | j d u rt| �| _ | j S r7 )rh �SingleValueLDAPEntryViewrC r" r" r# � single_value? s zLDAPEntry.single_valuec C s: t | j�}|�dd� | j�� D �� dt| �j| j|f S )Nc s s" | ]\}}|d ur||fV qd S r7 r" ��.0�k�vr" r" r# � <genexpr>G � z%LDAPEntry.__repr__.<locals>.<genexpr>z %s(%r, %r))rm rc ro rb �items�typer= r` )r; �datar" r" r# �__repr__E s zLDAPEntry.__repr__c C s t | �S r7 �r^ rC r" r" r# �copyJ s zLDAPEntry.copyc C s | j | }t|t�sJ �| j| }t|t�s0J �| j�|g g f�\}}||krZ||krZd S t|�t|� }t|�t|� }t|�t|� }t|�t|� } |D ]$} | j�| �} | |v r�q�|� | � q�| D ]h} z| j� | |�} W n: t �y } z t dj | | j d���W Y d } ~ n d } ~ 0 0 | |v �r&q�|� | � q�t||jd�D ]*} | j�| �} | | v �r^�q@|�| � �q@t||jd�D ]l} z| j� | |�} W n: t �y� } z t dj | | j d���W Y d } ~ n d } ~ 0 0 | |v �rڐqz|�| � �qzt|�t|�f| j|< t|�dk�r| j�|� d S )Nz {error} in LDAP entry '{dn}')rP ru ��keyr )rb rj �listrc rd � setdefaultrl r_ �encode�remove�decode� ValueError�formatr` �sorted�index�appendr �lenre �discard) r; �name�nicern Z nice_syncZraw_syncZ nice_addsZ nice_delsZraw_addsZraw_delsrv r] r" r" r# � _sync_attrM sX � � zLDAPEntry._sync_attrc C s6 t |t�s td|jj|f ��t |t�r2|�d�}|S )Nz7attribute name must be unicode or str, got %s object %r�utf-8)rj �str� TypeErrorrs r= �bytesr� �r; r� r" r" r# � _attr_name� s �� zLDAPEntry._attr_namec C s� || j v r| j | S | jjd urxtjr2|�d�}n|}| jj�tjj|�}|d urx|j D ] }tjrl|� d�}|| j |< qX|| j |< t | j �D ]*}| j � |�|kr�| j �|�| j |< q�q�|S �Nr� )ra r_ r9 �six�PY2r� �get_objr( � AttributeType�namesr� r� rf rE �pop)r; r� Z encoded_nameZattrtype�altnameZoldnamer" r" r# �_add_attr_name� s( � zLDAPEntry._add_attr_namec C s� | � |�}| �|�}t|t�s@|d u r,g }n|g}| j�|� n | j�|� | j�|�|ur~|| j|< d | j |< | j � |d � | j | d ur�| � |� d S r7 ) r� r� rj r� re �addr� rb rE rc rd r� r� �r; r� rv r" r" r# � _set_nice� s zLDAPEntry._set_nicec C s� | � |�}t|t�s*td||jj|f ��t|�D ]*\}}t|t�s2td|||jj|f ��q2| �|�}| j � |�|ur�|| j |< d | j |< | j � |d � | j | d ur�| �|� d S )Nz'%s value must be list, got %s object %rz,%s[%d] value must be bytes, got %s object %r)r� rj r� r� rs r= � enumerater� r� rc rE rb rd r� r� )r; r� rv �i�itemr" r" r# �_set_raw� s& � �� zLDAPEntry._set_rawc C s | � ||� d S r7 )r� r� r" r" r# � __setitem__� s zLDAPEntry.__setitem__c C s | � |�}| j| }|S r7 )r� ra r� r" r" r# �_get_attr_name� s zLDAPEntry._get_attr_namec C s� | � |�}| j| }|d u r*g }| j|< t|t�s8J �| j| d urP| �|� || jv r|t|�dksjJ �|rx|d }nd }|S )Nr r )r� rb rj r� rc r� re r� r� r" r" r# � _get_nice� s zLDAPEntry._get_nicec C sT | � |�}| j| }|d u r*g }| j|< t|t�s8J �| j| d urP| �|� |S r7 )r� rc rj r� rb r� r� r" r" r# �_get_raw� s zLDAPEntry._get_rawc C s | � |�S r7 )r� r� r" r" r# � __getitem__� s zLDAPEntry.__getitem__c C s` | � |�}t| j�� �D ]\}}||kr| j|= q| j|= | j|= | j�|d � | j� |� d S r7 ) r� r� ra r� rb rc rd r� re r� )r; r� r� Zkeynamer" r" r# � __delitem__� s zLDAPEntry.__delitem__c C s6 | j �� | j�� | j�� | j�� | j�� d S r7 )ra �clearrb rc rd re rC r" r" r# r� s zLDAPEntry.clearc C s t | j�S r7 )r� rb rC r" r" r# �__len__ s zLDAPEntry.__len__c C s || j v S r7 )ra r� r" r" r# � __contains__ s zLDAPEntry.__contains__c C s || v S r7 r" r� r" r" r# �has_key s zLDAPEntry.has_keyc C s t |t�stS || u S r7 �rj r^ �NotImplemented�r; �otherr" r" r# �__eq__ s zLDAPEntry.__eq__c C s t |t�stS || uS r7 r� r� r" r" r# �__ne__ s zLDAPEntry.__ne__c C s. |d u r | }t |t�sJ �tt|j��| _d S r7 )rj r^ r rm rn rf r� r" r" r# � reset_modlist% s zLDAPEntry.reset_modlistc s g }t | �}|�| j� |D ]�}| j�|g �� | j�|g ���rX� sX|�tj|d f� q �st� rt|�tj|� f� q �fdd�� D �}� fdd��D �}|r�| j � |�r�t |�dkr�t j |d��|�tj||f� q |r�|�tj||f� |r |�tj||f� q |jdd� d� |S ) Nc s g | ]}|� vr|�qS r" r" �r{ rv )�oldr" r# � <listcomp>= r z.LDAPEntry.generate_modlist.<locals>.<listcomp>c s g | ]}|� vr|�qS r" r" r� )�newr" r# r� > r r ��attrc S s | d � � dkS )Nr rM ��lower)�mr" r" r# �<lambda>P r z,LDAPEntry.generate_modlist.<locals>.<lambda>r� )rl ro rf rn rE r� r( Z MOD_DELETEZ MOD_REPLACEr4 �get_attribute_single_valuer� r ZOnlyOneValueAllowedZMOD_ADD�sort)r; �modlistr� r� ZaddsZdelsr" )r� r� r# �generate_modlist+ s0 zLDAPEntry.generate_modlistc C s t | j�S r7 )�iterrb rC r" r" r# �__iter__T s zLDAPEntry.__iter__)NN)N)#r= r> r? � __slots__�__hash__r< �propertyr4 ru �setterrn ry r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� � __classcell__r" r" rr r# r^ � sF ; 5 )r^ c @ sH e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dd� Z dS )� LDAPEntryView��_entryc C s t |t�sJ �|| _d S r7 )rj r^ r� �r; �entryr" r" r# r< [ s zLDAPEntryView.__init__c C s | j |= d S r7 r� r� r" r" r# r� _ s zLDAPEntryView.__delitem__c C s | j �� d S r7 )r� r� rC r" r" r# r� b s zLDAPEntryView.clearc C s t | j�S r7 )r� r� rC r" r" r# r� e s zLDAPEntryView.__iter__c C s t | j�S r7 )r� r� rC r" r" r# r� h s zLDAPEntryView.__len__c C s || j v S r7 r� r� r" r" r# r� k s zLDAPEntryView.__contains__c C s || v S r7 r" r� r" r" r# r� n s zLDAPEntryView.has_keyN) r= r> r? r� r< r� r� r� r� r� r� r" r" r" r# r� X s r� c @ s e Zd Zdd� Zdd� ZdS )rw c C s | j �|�S r7 )r� r� r� r" r" r# r� r s z RawLDAPEntryView.__getitem__c C s | j �||� d S r7 )r� r� r� r" r" r# r� u s z RawLDAPEntryView.__setitem__N�r= r> r? r� r� r" r" r" r# rw q s rw c @ s e Zd Zdd� Zdd� ZdS )rx c C sL | j | }t|t�s|S |s d S t|�dkr4|d S td|t|�f ��d S )Nr r z %s has %s values, one expected)r� rj r� r� r� r� r" r" r# r� y s �z$SingleValueLDAPEntryView.__getitem__c C s$ |d u rd | j |< n |g| j |< d S r7 r� r� r" r" r# r� � s z$SingleValueLDAPEntryView.__setitem__Nr� r" r" r" r# rx x s rx c + @ s� e Zd ZdZdZdZdZejZej Z ej Z e e e e e e e e e ee e e e ee e e e e e e e e e ee e e e e e ee e eeee e eed�*Zee e e e e eeeeeeejejejejeeeed��Zedddddddddddd� �Zd Zd Zdgd d�Zedd� �Z ee j dfdd��Z edd� �Z dd� Z!dd� Z"e#dd� �Z$e#dd � �Z%d d � Z&d d � Z'd!d"� Z(d#d$� Z)d%d&� Z*d'd(� Z+d)d*� Z,d+d,� Z-e.j/dhd-d.��Z0e1d/d0� �Z2e#d1d2� �Z3did4d5�Z4d6d7� Z5d8d9� Z6d:d;� Z7d<d=� Z8djd>d?�Z9dkd@dA�Z:dldBdC�Z;dDdE� Z<dmdFdG�Z=dndIdJ�Z>dodKdL�Z?edpdMdN��Z@edqdOdP��ZAedrdQdR��ZBej d d d fdSdT�ZCd d d ej d d d d fdUdV�ZDdWdX� ZEdsdYdZ�ZFdtd[d\�ZGd]d^� ZHdud_d`�ZIdadb� ZJdcdd� ZKdedf� ZLd S )vrk a� LDAP backend class This class abstracts a LDAP connection, providing methods that work with LADPEntries. The purpose of this class is to provide a boundary between IPA and python-ldap. In IPA we use IPA defined types because they are richer and are designed to meet our needs. We also require that we consistently use those types without exception. On the other hand python-ldap uses different types. The goal is to be able to have IPA code call python-ldap methods using the types native to IPA. This class accomplishes that goal by exposing python-ldap methods which take IPA types, convert them to python-ldap types, call python-ldap, and then convert the results returned by python-ldap into IPA types. �|�&�!)*z 1.3.6.1.4.1.1466.115.121.1.1z 1.3.6.1.4.1.1466.115.121.1.4z 1.3.6.1.4.1.1466.115.121.1.5z 1.3.6.1.4.1.1466.115.121.1.7z 1.3.6.1.4.1.1466.115.121.1.8z 1.3.6.1.4.1.1466.115.121.1.9z 1.3.6.1.4.1.1466.115.121.1.10z 1.3.6.1.4.1.1466.115.121.1.12z 1.3.6.1.4.1.1466.115.121.1.23z 1.3.6.1.4.1.1466.115.121.1.24z 1.3.6.1.4.1.1466.115.121.1.28z 1.3.6.1.4.1.1466.115.121.1.40z 1.3.6.1.4.1.1466.115.121.1.49z 1.3.6.1.4.1.1466.115.121.1.51z1.3.6.1.4.1.5322.21.2.5z2.16.840.1.113730.3.8.3.3z2.16.840.1.113730.3.8.3.18z2.16.840.1.113730.3.8.3.5z2.16.840.1.113730.3.8.3.7z2.16.840.1.113730.3.8.3.20z2.16.840.1.113730.3.8.11.4z2.16.840.1.113730.3.8.11.21z2.16.840.1.113730.3.8.11.22z2.16.840.1.113730.3.8.7.1z2.16.840.1.113730.3.8.7.2z 2.16.840.1.113719.1.301.4.6.1z 2.16.840.1.113719.1.301.4.14.1z 2.16.840.1.113719.1.301.4.17.1z 2.16.840.1.113719.1.301.4.18.1z 2.16.840.1.113719.1.301.4.26.1z 2.16.840.1.113719.1.301.4.29.1z 2.16.840.1.113719.1.301.4.36.1z 2.16.840.1.113719.1.301.4.37.1z 2.16.840.1.113719.1.301.4.40.1z 2.16.840.1.113719.1.301.4.41.1z 2.16.840.1.113719.1.301.4.45.1z 2.16.840.1.113719.1.301.4.48.1z 2.16.840.1.113719.1.301.4.49.1z 2.16.840.1.113719.1.301.4.52.1z 2.16.840.1.113719.1.301.4.53.1z 2.16.840.1.113730.3.8.16.1.3z 2.16.840.1.113730.3.8.16.1.4)ZmanagedtemplateZ managedbaseZmemberindirectZmemberofindirectZ originscope�idnsnameZ idnssoamnameZ idnssoarnameZdnszoneidnsnameZkrbcanonicalnameZkrbprincipalname�usercertificate�usercertificate;binaryZ cACertificatezcACertificate;binaryZnsds5replicalastupdatestartZnsds5replicalastupdateendZnsds5replicalastinitstartZnsds5replicalastinitendT) znsslapd-ssl-check-hostnameznsslapd-lookthroughlimitznsslapd-idlistscanlimitznsslapd-anonlimitsdnz nsslapd-minssf-exclude-rootdseznsslapd-enable-upgrade-hashznsslapd-db-locksz%nsslapd-logging-hr-timestamps-enabledz nsslapd-ldapientrysearchbaseznsslapd-ldapidnmappingbaseznsslapd-sizelimit� �r FNc C sb |dur || _ | jdv s J �|| _|| _|| _|| _|| _|| _d| _d| _ |dur^| � � | _ dS )a� Create LDAPClient object. :param ldap_uri: The LDAP URI to connect to :param start_tls: Use STARTTLS :param force_schema_updates: If true, this object will always request a new schema from the server. If false, a cached schema will be reused if it exists. Generally, it should be true if the API context is 'installer' or 'updates', but it must be given explicitly since the API object is not always available :param no_schema: If true, schema is never requested from the server. :param decode_attrs: If true, attributes are decoded to Python types according to their syntax. N> �ldapsr( �ldapiF) �ldap_uri�protocol� _start_tls�_force_schema_updates� _no_schema� _decode_attrs�_cacert� _sasl_nocanon� _has_schema�_schema�_connectr_ )r; r� � start_tls�force_schema_updates� no_schema� decode_attrs�cacert� sasl_nocanonr" r" r# r< s zLDAPClient.__init__c K s t |�}| |fddd�|��S )z;Create a LDAPI connection to local 389-DS instance FN�r� r� )r' )�clsr! rq r2 r" r" r# � from_realm, s zLDAPClient.from_realmc K s8 |rdt |d� }ndt |d� }| |f||d�|��S )a� Create LDAP or LDAPS connection to a remote 389-DS instance This constructor is opinionated and doesn't let you shoot yourself in the foot. It always creates a secure connection. By default it returns a LDAP connection to port 389 and performs STARTTLS using the default CA cert. With start_tls=False, it creates a LDAPS connection to port 636 instead. Note: Microsoft AD does not support SASL encryption and integrity verification with a TLS connection. For AD, use a plain connection with GSSAPI and a MIN_SSF >= 56. SASL GSSAPI and SASL GSS SPNEGO ensure data integrity and confidentiality with SSF > 1. Also see https://msdn.microsoft.com/en-us/library/cc223500.aspx � ldap://%s� � ldaps://%si| r� �r )r� �hostnamer� r� rq r2 r" r" r# �from_hostname_secure3 s z LDAPClient.from_hostname_securec K s6 d|vs J �d|vsJ �dt |d� }| |fi |��S )z�Create a plain LDAP connection with TLS/SSL Note: A plain TLS connection should only be used in combination with GSSAPI bind. r� r� r� r� r� )r� r� rq r2 r" r" r# �from_hostname_plainJ s z LDAPClient.from_hostname_plainc C s | j S r7 )r� rC r" r" r# �__str__V s zLDAPClient.__str__c s6 t |t�sJ �t|�}� fdd�|D �}� j�||�S )Nc s" g | ]\}}}||� � |�f�qS r" �r� �r{ �a�b�crC r" r# r� ] r z'LDAPClient.modify_s.<locals>.<listcomp>)rj r r� r4 �modify_s)r; ru r� r" rC r# r Y s zLDAPClient.modify_sc C s | j S r7 rt rC r" r" r# r4 ` s zLDAPClient.connc C s | j r| j �dd�d S d S d S )Nz://r r )r� r rC r" r" r# r� d s zLDAPClient.protocolc C sj | j r d S | jsdztj| j| j| jd�}W n tjt fyF d }Y n0 t � | d|� t � | dd� | j S )N)rH r� r� T) r� r� � schema_cacherI r� r4 r� r ZExecutionError� IndexError�object� __setattr__r� )r; r9 r" r" r# � _get_schemak s � zLDAPClient._get_schemac C s t �| dd� t �| dd� dS )zr Force this instance to forget it's cached schema and reacquire it from the schema cache. r� Fr� N)r r rC r" r" r# � _flush_schema} s zLDAPClient._flush_schemac C s| | j s tS tjr$t|t�r$|�d�}|| jv r8| j| S | �� }|d urx|� t j j |�}|d urx|j | jv rx| j|j S tS r� )r� r� r� r� rj �unicoder� �_SYNTAX_OVERRIDEr r� r( r9 r� Zsyntax�_SYNTAX_MAPPING�r; � name_or_oidr9 �objr" r" r# �get_attribute_type� s z LDAPClient.get_attribute_typec C s | � |�tu S )zf Check the schema to see if the attribute uses DN syntax. Returns True/False )r r )r; r r" r" r# � has_dn_syntax� s zLDAPClient.has_dn_syntaxc C s` t jrt|t�r|�d�}|| jv r.| j| S | �� }|dur\|�tj j |�}|dur\|j S dS )z� Check the schema to see if the attribute is single-valued. If the attribute is in the schema then returns True/False If there is a problem loading the schema or the attribute is not in the schema return None r� N) r� r� rj r r� �_SINGLE_VALUE_OVERRIDEr r� r( r9 r� ry r r" r" r# r� � s z%LDAPClient.get_attribute_single_valuec s" t |t�r|rdS dS �nt |tttttf�r<t|��d�S t |t �rT|� � �d�S t |t �rb|S t |t �r~� fdd�|D �S t |t �r�t � fdd�|D ��S t |t�r�t� fd d�|�� D ��}|S t |t�r�|�t��d�S t |tj�� r�|�tjj�S |d u �r d S td |t|�f ��d S ) zL Encode attribute value to LDAP representation (str/bytes). s TRUEs FALSEr� �asciic s g | ]}� � |��qS r" r� �r{ r� rC r" r# r� � r z%LDAPClient.encode.<locals>.<listcomp>c 3 s | ]}� � |�V qd S r7 r� r rC r" r# r~ � r z$LDAPClient.encode.<locals>.<genexpr>c 3 s | ]\}}|� � |�fV qd S r7 r� rz rC r" r# r~ � r Nz:attempt to pass unsupported type to ldap, value=%s type=%s)rj �boolr �intr r r r� r� r Zto_textr� r� �tuplerm r� r �strftimer r �IPACertificate� public_bytes�Encoding�DERr� r� )r; �val�dctr" rC r# r� � s0 zLDAPClient.encodec s� t |t��r ��� �}z�|tu r&|W S |tu r:|�d�W S |tu rR|�d�dkW S |tu rnt�|�d�t�W S |t u r�t � |�d��W S |t t fv r�||�d��W S |t ju r�t �|�W S ||�W S W n6 t� y� d� ||f }t�d|� t|��Y n0 n�t |t��r � �fdd�|D �S t |t��rDt� �fdd�|D ��S t |t��rj�fd d �|�� D �}|S |d u �rxd S td |t|�f ��d S ) zN Decode attribute value from LDAP representation (str/bytes). r� ZTRUEz6unable to convert the attribute %r value %r to type %s�%sc s g | ]}�� |� ��qS r" �r� r �r� r; r" r# r� r z%LDAPClient.decode.<locals>.<listcomp>c 3 s | ]}�� |� �V qd S r7 r r r! r" r# r~ r z$LDAPClient.decode.<locals>.<genexpr>c s$ i | ] \}}|� d �� � ||��qS )r� r rz rC r" r# � <dictcomp> s z%LDAPClient.decode.<locals>.<dictcomp>Nz<attempt to pass unsupported type from ldap, value=%s type=%s)rj r� r r r� r r �strptimer r Z from_textr r r r Zload_der_x509_certificate� ExceptionrJ rP r� r� r rm r� r� r� )r; r r� Z target_type�msgr r" r! r# r� � sH � � zLDAPClient.decodec C s� g }|D ]v}|d }|d }|du rBdj t|�d�}t�d|� qt| t|��}|�� D ]\}} | |j|< qX|�� |� |� qt r�t�d|� |S )a� result is a python-ldap result tuple of the form (dn, attrs), where dn is a string containing the dn (distinguished name) of the entry, and attrs is a dictionary containing the attributes associated with the entry. The keys of attrs are strings, and the associated values are lists of strings. We convert the tuple to an LDAPEntry object. r r Nz Referral entry ignored: {ref})�refr zldap.result: %s) r� r� rJ rK r^ r r� rn r� r� �_debug_log_ldap) r; �resultZ ipa_resultZdn_tupleZ original_dnZoriginal_attrsZlog_msgZ ipa_entryr� �original_valuesr" r" r# �_convert_result s$ � zLDAPClient._convert_resultc c s� d}z�z dV W n~ t jy, t�� �Y nd t jy� } zJ|jd d �� }|jd �dd��� }|durxd||f }� W Y d}~n d}~0 0 W �n\ t jy� tj |p�dd��Y �n8 t j y� t� � �Y �n t j y� tj |d ��Y �n� t j �y4 d }|�|��r t� � �ntj||d ��Y �n� t j�yV tj|d ��Y �n� t j�y� tjd ||f d ��Y �nr t j�y� tjd||f d ��Y �nH t j�y� t�� �Y �n* t j�y� tj|d��Y �n t j�y tj|d ��Y �n� t j�y* t�� �Y �n� t j �yH t� � �Y �n� t j �yf t� � �Y �n� t j �y� tj!|d��Y �nj t j"�y� tj#|d ��Y �nH t j$�y� t�%� �Y �n* t j&�y� tj'| j(|d��Y �n t j)�y tj|d ��Y n� t j*�y" Y n� t j+�yD tj||d ��Y n� t j,�yf tj||d ��Y n� t j-�y� tjd||f d ��Y nd t j�y� } zHd|v �r�tjdd ��t.�/dt0|�j1t2|�� tj||d ��W Y d}~n d}~0 0 dS )z0Context manager that handles LDAPErrors Nr rQ rR rS z%s arguments: %sz no such entry��reason)�messagez:Another entry with the same attribute value already existsrT )rR z%s %sz%s: %sr� rO z%s (%s)ZNOT_ALLOWED_TO_DELEGATEz$KDC returned NOT_ALLOWED_TO_DELEGATEzUnhandled LDAPError: %s: %s)3r( ZTIMEOUTr ZDatabaseTimeoutrY rZ r[ rE rV �NotFoundZALREADY_EXISTSZDuplicateEntryZTYPE_OR_VALUE_EXISTSZCONSTRAINT_VIOLATIONr+ r\ ZINSUFFICIENT_ACCESSZACIErrorZINVALID_CREDENTIALSZINAPPROPRIATE_AUTHZNO_SUCH_ATTRIBUTEZMidairCollisionZINVALID_SYNTAXZ InvalidSyntaxZOBJECT_CLASS_VIOLATIONZObjectclassViolation�ADMINLIMIT_EXCEEDED�AdminLimitExceeded�SIZELIMIT_EXCEEDED�SizeLimitExceeded�TIMELIMIT_EXCEEDED�TimeLimitExceededZNOT_ALLOWED_ON_RDNZNotAllowedOnRDNZ FILTER_ERRORZBadSearchFilterZNOT_ALLOWED_ON_NONLEAFZNotAllowedOnNonLeafrW rX r� Z LOCAL_ERROR�SUCCESSZ CONNECT_ERRORZUNWILLING_TO_PERFORMZ AUTH_UNKNOWNrJ rK r� r= r� )r; Zarg_descrQ r] rR Z_msgr" r" r# � error_handler@ s� � ��zLDAPClient.error_handlerc C sJ | sd S | t u rt�� �n,| tu r,t�� �n| tu r>t�� �nt�� �d S r7 )�TRUNCATED_ADMIN_LIMITr r0 �TRUNCATED_SIZE_LIMITr2 �TRUNCATED_TIME_LIMITr4 �LimitsExceeded)� truncatedr" r" r# �handle_truncated_result� s z"LDAPClient.handle_truncated_resultc C s | � � S )z'schema associated with this LDAP server)r rC r" r" r# r9 � s zLDAPClient.schema�allc C s� | j d u rd S g }|D ]p}| j �tj j|�}|d urn|dkrH||j7 }q�|dkr\||j7 }q�||j|j 7 }q|rtjtd�| d��qdd� t t |��D �S )N�must�mayzobjectclass %s not foundr+ c S s g | ]}t |��� �qS r" )r r� �r{ r r" r" r# r� � r z5LDAPClient.get_allowed_attributes.<locals>.<listcomp>) r9 r� r( Z ObjectClassr> r? r r. r r� rl )r; rN Zraise_on_unknownZ attributesZallowed_attributes�ocr r" r" r# �get_allowed_attributes� s �z!LDAPClient.get_allowed_attributesc C s | S r7 r" rC r" r" r# � __enter__� s zLDAPClient.__enter__c C s | � � d S r7 )�close)r; �exc_type� exc_value� tracebackr" r" r# �__exit__� s zLDAPClient.__exit__c C s d| _ dS )z' Close the connection. Nrt rC r" r" r# rD � s zLDAPClient.closec C sj | � � �N t| j| jd�}| js0|�tjtj� | j rH| j dkrH|� � W d � n1 s\0 Y |S )N)r3 r( ) r6 r5 r� r� r� r) r( r* ZOPT_OFFr� r� Z start_tls_s)r; r4 r" r" r# r� � s &zLDAPClient._connectc C s� | j dkr | js |r |s td��| �� �J | �� t|t�s@J �t|�}| �|�}| j � ||||� W d � n1 sx0 Y dS )z0 Perform simple bind operation. r( z)simple_bind over insecure LDAP connectionN) r� r� r� r6 r rj r r� r� r4 Z simple_bind_s)r; �bind_dnZ bind_password�server_controls�client_controlsZ insecure_bindr" r" r# � simple_bind� s �� �zLDAPClient.simple_bindc C sb t �t�� �j}| �� �6 tj�|�}| � � | j � d|||� W d � n1 sT0 Y dS )zP Perform SASL bind operation using the SASL EXTERNAL mechanism. rS N) �pwd�getpwuidr, �geteuid�pw_namer6 r( �saslZexternalr r4 �sasl_interactive_bind_s)r; rJ rK Z user_name� auth_tokensr" r" r# � external_bind� s �zLDAPClient.external_bindc C sZ | � � �> | jdkrt}nt}| �� | j�d|||� W d � n1 sL0 Y dS )zN Perform SASL bind operation using the SASL GSSAPI mechanism. r� rS N)r6 r� �SASL_GSS_SPNEGO� SASL_GSSAPIr r4 rR )r; rJ rK rS r" r" r# � gssapi_bind� s �zLDAPClient.gssapi_bindc C s> | � � �" | �� | j�� W d � n1 s00 Y dS )z+ Perform unbind operation. N)r6 r r4 Zunbind_srC r" r" r# �unbind� s zLDAPClient.unbindc C s2 |du rt � }t|ttf�r$|d }t ||f|�S )z� Make distinguished name from attribute. Keyword arguments: parent_dn -- DN of the parent entry (default '') Nr )r rj r� r )r; r� rv � parent_dnr" r" r# �make_dn_from_attr s z LDAPClient.make_dn_from_attrr c C s, ||v s J �t |t�sJ �t||| f|�S )z� Make distinguished name from entry attributes. Keyword arguments: primary_key -- attribute from which to make RDN (default 'cn') parent_dn -- DN of the parent entry (default '') )rj r )r; � entry_attrsZ primary_keyrY r" r" r# �make_dn s zLDAPClient.make_dnc K s t | ||fi |��S r7 r� )r; r` rp rq r" r" r# � make_entry" s zLDAPClient.make_entryc C s� t |ttf�sJ �dd� |D �}|rF|| jkrFd| j| �|| j�f S t|�dkr\d| }nd}|D ]"}|�d�szd| }d ||f }qdt|�dkr�d | }|S ) z� Combine filters into one for ldap2.find_entries. Keyword arguments: rules -- see ldap2.make_filter c S s g | ] }|r|�qS r" r" )r{ Zfxr" r" r# r� : r z.LDAPClient.combine_filters.<locals>.<listcomp>z(%s%s)r z(%srS �(z(%s)z%s%sz%s))rj r� r � MATCH_NONE�combine_filters� MATCH_ANYr� r+ )r� �filters�rulesZflt�fr" r" r# r` / s � zLDAPClient.combine_filtersc s" t �ttf�r4� ����fdd��D �}��||�S �du�r t �tj�rX��tjj ��t �t �r�t � ��� d��d��fdd�tj�dt��d �D ���n6t �t�r���t��tj����nt���tj�����s�d }�r�d | }�r�|d }|� �|�jk�rd � �f S d � �f S dS )a] Make filter for ldap2.find_entries from attribute. Keyword arguments: rules -- see ldap2.make_filter exact -- boolean, True - make filter as (attr=value) False - make filter as (attr=*value*) leading_wildcard -- boolean: True - allow heading filter wildcard when exact=False False - forbid heading filter wildcard when exact=False trailing_wildcard -- boolean: True - allow trailing filter wildcard when exact=False False - forbid trailing filter wildcard when exact=False c s g | ]}�j � |���d ��qS ))�exact�leading_wildcard�trailing_wildcard)�make_filter_from_attr)r{ r} )r� r� re rf rg r" r# r� ^ s ��z4LDAPClient.make_filter_from_attr.<locals>.<listcomp>Nr �\c 3 s | ]}� ||d � V qdS )r Nr" )r{ r� )rv r" r# r~ l s z3LDAPClient.make_filter_from_attr.<locals>.<genexpr>���r r �*z (!(%s=%s))z(%s=%s)rS )rj r� r r` r r r r r r r� �binasciiZhexlifyr� r r� Zmoves�ranger� r r r r( �filterZescape_filter_charsr� r_ ) r� r� rv rc re rf rg �flts�templater" )r� r� re rf rg rv r# rh K s> � � � z LDAPClient.make_filter_from_attrc C s� || j kr| j}n|}g }|du rP|�� D ]"\} } |�| �| | ||||�� q*n8|D ]2} |�| d�} | durT|�| �| | ||||�� qT| �||�S )a� Make filter for ldap2.find_entries from entry attributes. Keyword arguments: attrs_list -- list of attributes to use, all if None (default None) rules -- specifies how to determine a match (default ldap2.MATCH_ANY) exact -- boolean, True - make filter as (attr=value) False - make filter as (attr=*value*) leading_wildcard -- boolean: True - allow heading filter wildcard when exact=False False - forbid heading filter wildcard when exact=False trailing_wildcard -- boolean: True - allow trailing filter wildcard when exact=False False - forbid trailing filter wildcard when exact=False rules can be one of the following: ldap2.MATCH_NONE - match entries that do not match any attribute ldap2.MATCH_ALL - match entries that match all attributes ldap2.MATCH_ANY - match entries that match any of attribute N)r_ ra r� r� rh rE r` ) r� r[ � attrs_listrc re rf rg Zmake_filter_rulesro r| r} r rv r" r" r# � make_filter� s, �� ��zLDAPClient.make_filterc K sl | j f |||||d�|��\}}z| �|� W n8 tjyf } z t�d| ||� � W Y d} ~ n d} ~ 0 0 |S )a� Return a list of matching entries. :raises: errors.LimitsExceeded if the list is truncated by the server :raises: errors.NotFound if result set is empty or base_dn doesn't exist :param base_dn: dn of the entry at which to start the search :param scope: search scope, see LDAP docs (default ldap2.SCOPE_SUBTREE) :param filter: LDAP filter to apply :param attrs_list: ist of attributes to return, all if None (default) :param get_effective_rights: use GetEffectiveRights control :param kwargs: additional keyword arguments. See find_entries method for their description. )�base_dn�scopern rq �get_effective_rightsz2%s while getting entries (base DN: %s, filter: %s)N)� find_entriesr< r r: rJ rP ) r; rs rt rn rq ru rq �entriesr; r] r" r" r# � get_entries� s �� �zLDAPClient.get_entriesc C s: |du rt � }t|t �s J �|s$d}g } d} |du r:| j}|dkrFd}|du rT| j}t|t�sft|�}t|t�sxt|�}|r�dd� t|�D �}g } |r�| �| �� � d} |dkr�|nd d } | dkr�d}| � � ��6 t j r�| � |�}| � |�}|�r| t d| | �g }n | �pd}z�| jjt|�||||||d �}| j�|d�}|\}}}}|tjk�r\�q~| �|�}|�r2| �|d � �q2|�r�|D ] }t|t ��r�|j} �q��q�d} W �n8 tj�y� t} Y �q�Y �n tj�y� t} Y �q�Y n� tj�y t} Y �q�Y n� tj �y� } z�|�r�| �r�t dd| �g}z"| jj t|�||||||d � W n4 tj �y� } zt � d |� W Y d}~n d}~0 0 d} z|�W n4 tjtjtjf�y� d } Y W Y d}~�q�Y n0 W Y d}~n d}~0 0 |�r�| s�q�q�W d � n1 �s0 Y | �s2| �s2t j!dd��| | fS )a% Return a list of entries and indication of whether the results were truncated ([(dn, entry_attrs)], truncated) matching specified search parameters followed by truncated flag. If the truncated flag is True, search hit a server limit and its results are incomplete. Keyword arguments: :param attrs_list: list of attributes to return, all if None (default None) :param base_dn: dn of the entry at which to start the search (default '') :param scope: search scope, see LDAP docs (default ldap2.SCOPE_SUBTREE) :param time_limit: time limit in seconds (default unlimited) :param size_limit: size (number of entries returned) limit (default unlimited) :param paged_search: search using paged results control :param get_effective_rights: use GetEffectiveRights control :raises: errors.NotFound if result set is empty or base_dn doesn't exist Nz(objectClass=*)Fr r� c S s g | ] }|� � �qS r" r� r@ r" r" r# r� � r z+LDAPClient.find_entries.<locals>.<listcomp>rS i� r )Z serverctrls�timeoutZ sizelimitz!Error cancelling paged search: %sTzno matching entry foundr+ )"r rj � time_limit� size_limitr �floatrl r� �)_LDAPClient__get_effective_rights_controlr6 r� r� r� r r4 Z search_extr� Zresult3r( ZRES_SEARCH_RESULTr* �cookier/ r7 r1 r8 r3 r9 rY Z search_ext_srJ Zwarningr � EmptyResult)r; rn rq rs rt rz r{ Z paged_searchru �resr; Z base_sctrlsr~ Z page_sizeZsctrls�idr( ZobjtypeZres_listZ_res_idZ res_ctrlsZctrlr] �e2r" r" r# rv � s� � � � � � , & zLDAPClient.find_entriesc C s( | j �� dd� }tdd�|��d��S )z8Construct a GetEffectiveRights control for current user.� NTzdn: {0}r� )r4 Zwhoami_sr r� r� )r; rI r" r" r# Z __get_effective_rights_controlU s �z)LDAPClient.__get_effective_rights_controlc C sl |du rt � }t|t �s J �||d|i}| j|| jd�}| j|||d�}t|�dkrdtjt|�d��|d S )a Find entry (dn, entry_attrs) by attribute and object class. Keyword arguments: attrs_list - list of attributes to return, all if None (default None) base_dn - dn of the entry at which to start the search (default '') NZ objectClass)rc )rn rq r )�foundr )r rj rr � MATCH_ALLrx r� r ZSingleMatchExpected) r; r� rv Z object_classrq rs Z search_kwrn rw r" r" r# �find_entry_by_attr[ s � z LDAPClient.find_entry_by_attrc C s0 t |t�sJ �| j|| jd||||d�}|d S )z� Get entry (dn, entry_attrs) by dn. Keyword arguments: attrs_list - list of attributes to return, all if None (default None) N)rz r{ ru r )rj r rx rU )r; ru rq rz r{ ru rw r" r" r# � get_entrys s �zLDAPClient.get_entryc C sr t dd� |j�� D ��}| �� �6 | �|�}| j�t|j�t |�� �� W d � n1 s\0 Y |� � dS )zPCreate a new entry. This should be called as add_entry(entry). c s s | ]\}}|r||fV qd S r7 r" rz r" r" r# r~ � r z'LDAPClient.add_entry.<locals>.<genexpr>N) rm rn r� r6 r� r4 Zadd_sr� ru r� r� )r; r� �attrsr" r" r# � add_entry� s :zLDAPClient.add_entryc C s� t |t�sJ �t |t�s J �||kr,t�� �|d }|dd� |dd� krRd}ntt|dd� � �}| �� �: | jjt|�t|�|t|�d� t � d� W d � n1 s�0 Y dS )a� Move an entry (either to a new superior or/and changing relative distinguished name) Keyword arguments: dn: DN of the source entry new_dn: DN of the target entry del_old -- delete old RDN value (default True) :raises: errors.NotFound if source entry or target superior entry doesn't exist errors.EmptyModlist if source and target are identical r r N)Z newsuperiorZdeloldg333333�?) rj r r � EmptyModlistr� r6 r4 Zrename_sr r: �sleep)r; ru �new_dn�del_oldZnew_rdnZ new_superiorr" r" r# � move_entry� s �zLDAPClient.move_entryc sz |� � }|st�� �t�d|� � �� �6 � fdd�|D �}� j�t|j �|� W d � n1 sd0 Y |� � dS )zZUpdate entry's attributes. This should be called as update_entry(entry). zupdate_entry modlist %sc s& g | ] \}}}|t |�� �|�f�qS r" )r� r� r� rC r" r# r� � s �z+LDAPClient.update_entry.<locals>.<listcomp>N) r� r r� rJ rK r6 r4 r r� ru r� )r; r� r� r" rC r# � update_entry� s �2zLDAPClient.update_entryc C sR t |t�r|}n|j}| �� � | j�t|�� W d � n1 sD0 Y dS )z7Delete an entry given either the DN or the entry itselfN)rj r ru r6 r4 Zdelete_sr� �r; Z entry_or_dnru r" r" r# � delete_entry� s zLDAPClient.delete_entryc C s@ t |t�sJ �z| j|g d� W n tjy6 Y dS 0 dS dS )z? Test whether the given object exists in LDAP. )rq FTN)rj r r� r r. �r; ru r" r" r# � entry_exists� s zLDAPClient.entry_exists)FFFTNT)N)Fr= )NNF)NN)NN)N)r N)NN)r� )r� TTT)Nr� TTT)NN)NNNF)T)Mr= r> r? r@ ra r� r_ r( rU ZSCOPE_ONELEVELZ SCOPE_SUBTREEr� r r r r r r r r r r r r rz r{ r< � classmethodr� r Z IPA_CA_CRTr� r� r� r r� r4 r� r r r r r� r� r� r* � contextlib�contextmanagerr6 � staticmethodr< r9 rB rC rH rD r� rL rT rW rX rZ r\ r] r` rh rr rx rv r} r� r� r� r� r� r� r� r" r" r" r# rk � sH �9�� � $ � #*% O � � � 6 � .� � � � rk rS r� c C s| |d u r$|rd}n|d ur d}nd}|dkr:dt | |� S |dkrVdd�|�d�� S |dkrldt | |� S td | ��d S ) Nr� r� r( r� z)ldapi://%%2fvar%%2frun%%2fslapd-%s.socketr r r� zProtocol %r not supported)r r r r� )�host�portr� r� Zrealmr� r" r" r# � get_ldap_uri� s �r� c @ s e Zd Zddd�ZdS )� CacheEntryNFc C s || _ || _|| _|| _d S r7 )r� rq � exceptionr= )r; r� rq r� ru r= r" r" r# r< � s zCacheEntry.__init__)NNNFF)r= r> r? r< r" r" r" r# r� � s �r� c s� e Zd ZdZd&� fdd� Zedd � �Zed d � �Zed d � �Zdd� Z g fdd�Z d'dd�Z dd� Z dd� Z dd� Z� fdd�Z� fd d �Z� fd d �Zd(� fd d!� Z� fd"d#�Zd)� fd$d%� Z� ZS )*� LDAPCachez+A very basic LRU Cache using an OrderedDictFTN�d c s� t � | _d| _d| _t�| dd� t�| dd� t�| d|oB| dk� t�| d| � t�| d| � tt| ��|||||||� d S ) NTF� _cache_missesr � _cache_hits� _enable_cache� _debug_cache� _cache_size) r �cacher� r� r r ri r� r< ) r; r� r� r� r� r� r� r� Z enable_cacheZ cache_sizeZ debug_cacherr r" r# r< � s � �zLDAPCache.__init__c C s | j S r7 )r� rC r" r" r# �hit s z LDAPCache.hitc C s | j S r7 )r� rC r" r" r# �miss s zLDAPCache.missc C s | j S r7 )r� rC r" r" r# � max_entries s zLDAPCache.max_entriesc O s( | j r$| jr$tj|g|�R i |�� d S r7 )r� r� rJ rK )r; r% rZ rq r" r" r# �emit s zLDAPCache.emitc C sz t | t|��}|s*|j�tt|j��� n4|j�� D ](\}}|�� |vrJq4t|�|j|�� < q4tt|j��|_|� � |S r7 ) r^ r rn ro r rm r� r� rf r� )r; ru r� r� Z new_entryr� r) r" r" r# � copy_entry" s zLDAPCache.copy_entryc C s� h d�}| j sd S | �|� td�|v s@td�|v s@td�|v rDd S |rf| �d|� t|d�| j|< n,|�|�s�t|�� |�� |d�| j|< nd S | �d|||� | j�|� t | j�| j kr�| jj d d �\}}| �d |� d S ) N> Z cospriorityr� r� r� z cn=configz cn=kerberoszo=ipacazEXC: Caching exception %s�r� )r� rq r= zADD: %s: %s all=%sF)�lastzLRU: removed %s) r� �remove_cache_entryr r� r� r� � intersectionr� � move_to_endr� r� �popitem)r; ru rq �get_allr� r� Z BANNED_ATTRSr" r" r# �add_cache_entry2 s4 � � � � zLDAPCache.add_cache_entryc C s: | � d� t�| dt� � t�| dd� t�| dd� d S )NZFINALr� r� r r� )� cache_statusr r r rC r" r" r# � clear_cacheb s zLDAPCache.clear_cachec C s | � d|| j| jt| j�� d S )Nz %s: Hits %d Misses %d Size %d)r� r� r� r� r� )r; r� r" r" r# r� h s �zLDAPCache.cache_statusc C s> t |t�sJ �| �d|� || jv r.| j|= n | �d|� d S )NzDROP: %szDROP: not in cache %s)rj r r� r� r� r" r" r# r� l s z LDAPCache.remove_cache_entryc s* | � d� | �|j� tt| ��|� d S )Nr� )r� r� ru ri r� r� r� rr r" r# r� v s zLDAPCache.add_entryc s* | � d� | �|j� tt| ��|� d S )Nr� )r� r� ru ri r� r� r� rr r" r# r� { s zLDAPCache.update_entryc s> | � d� t|t�r|}n|j}| �|� tt| ��|� d S )Nr� )r� rj r ru r� ri r� r� r� rr r" r# r� � s zLDAPCache.delete_entryc s6 | � d� | �|� | �|� tt| ��|||� d S )Nr� )r� r� ri r� r� )r; ru r� r� rr r" r# r� � s zLDAPCache.move_entryc s� | � d� t|t�s t|�}| � d|� |D ]R\}}}|�� dv r,|D ]6}t|ttf�sFt|�d��}| � d|� | �|� qFq,| � d|� | �|� tt| �� ||�S )Nr z modlist %s)�memberZ ipaallowedtoperform_write_keysZmanagedby_hostr� z modify_s %s) r� rj r r� r r� r� ri r� r )r; ru r� Z_opr� Zmod_dn�drr r" r# r � s zLDAPCache.modify_sc s� | j s tt| ��|||||�S | �d|� | j�|�}|rB|rBd }|r�|jr�| jd }t � | d|� | �d|j� | � d� |j�| �d|� |r�| �d|j � |s�dg}n|d gkr�d g}d }|r�|dgd gfv r�|j r�d }|�r"|j �r"|�r"| jd }t � | d|� | � d� | �||j�S |�r�|�r�td d� t|�D ��} tdd� |j D ��} | �| ��r�| jd }t � | d|� | � d� | �||j| �S z tt| ��|||||�}W nx tjtjf�y } zB| j|| d� | jd } t � | d| � | � d| � � W Y d } ~ nbd } ~ 0 t�y* � Y nF0 |dgd gfv �rBd }| j|tdd� |j�� D ��|| �||�d� | jd } t � | d| � | � d� |S )NzCache lookup: %sr r� zHIT: Re-raising %sZHITzRequested attrs_list %szCached attrs_list %srk rS ru FTc s s | ]}|� � V qd S r7 r� �r{ r� r" r" r# r~ � r z&LDAPCache.get_entry.<locals>.<genexpr>c s s | ]}|� � V qd S r7 r� r� r" r" r# r~ � r r� r� zMISS: %sc s s | ]}|� � V qd S r7 r� )r{ r| r" r" r# r~ � r )rq r� r� ZMISS)r� ri r� r� r� r� rE r� r� r r r� rq r= r� r� rl �issubsetr r. r r� r� r$ ra �keys) r; ru rq rz r{ ru r� �hitsr� Z req_attrsZ cache_attrsr] �missesrr r" r# r� � s� � ��� � � zLDAPCache.get_entry) FFFTNTTr� F)NFNN)T)NNNF)r= r> r? r@ r< r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r� r� r" r" rr r# r� � s8 � � 0 �r� )N)rS r� NFNN)Rrl r0 Zloggingr: r Zdecimalr r� r r� r, rM �warnings� collectionsr Z cryptography.hazmat.primitivesr r( Z ldap.saslZ ldap.filterZ ldap.controlsr r r& r� Zipalibr r r Zipalib.constantsr Zipaplatform.pathsr Zipapython.ipautilr r Z ipapython.dnr r Zipapython.dnsutilr Zipapython.kerberosr �collections.abcr ZPY3r� r Z getLoggerr= rJ rQ rV rU r' r Z_missingZ AUTOBIND_AUTOZAUTOBIND_ENABLEDZAUTOBIND_DISABLEDr8 r9 r7 Z DIRMAN_DNr� �hasattr�filterwarningsr r$ r' r5 r6 rA r r^ r� rw rx rk r� r� r� r" r" r" r# �<module> s� � ( N p W �