mirror of
https://git.openldap.org/openldap/openldap.git
synced 2025-01-24 13:24:56 +08:00
ITS#9470 Add homedir overlay
This commit is contained in:
Ondřej Kuzník
Quanah Gibson-Mount
parent
61e9b6d37a
commit
8382d3c380
17
configure.ac
17
configure.ac
@ -349,6 +349,7 @@ Overlays="accesslog \
|
||||
deref \
|
||||
dyngroup \
|
||||
dynlist \
|
||||
homedir \
|
||||
memberof \
|
||||
ppolicy \
|
||||
proxycache \
|
||||
@ -388,6 +389,8 @@ OL_ARG_ENABLE(dyngroup, [AS_HELP_STRING([--enable-dyngroup], [Dynamic Group over
|
||||
no, [no yes mod], ol_enable_overlays)
|
||||
OL_ARG_ENABLE(dynlist, [AS_HELP_STRING([--enable-dynlist], [Dynamic List overlay])],
|
||||
no, [no yes mod], ol_enable_overlays)
|
||||
OL_ARG_ENABLE(homedir, [AS_HELP_STRING([--enable-homedir], [Home Directory Management overlay])],
|
||||
no, [no yes mod], ol_enable_overlays)
|
||||
OL_ARG_ENABLE(memberof, [AS_HELP_STRING([--enable-memberof], [Reverse Group Membership overlay])],
|
||||
no, [no yes mod], ol_enable_overlays)
|
||||
OL_ARG_ENABLE(ppolicy, [AS_HELP_STRING([--enable-ppolicy], [Password Policy overlay])],
|
||||
@ -587,6 +590,7 @@ BUILD_DEREF=no
|
||||
BUILD_DYNGROUP=no
|
||||
BUILD_DYNLIST=no
|
||||
BUILD_LASTMOD=no
|
||||
BUILD_HOMEDIR=no
|
||||
BUILD_MEMBEROF=no
|
||||
BUILD_PPOLICY=no
|
||||
BUILD_PROXYCACHE=no
|
||||
@ -2838,6 +2842,18 @@ if test "$ol_enable_dynlist" != no ; then
|
||||
AC_DEFINE_UNQUOTED(SLAPD_OVER_DYNLIST,$MFLAG,[define for Dynamic List overlay])
|
||||
fi
|
||||
|
||||
if test "$ol_enable_homedir" != no ; then
|
||||
BUILD_HOMEDIR=$ol_enable_homedir
|
||||
if test "$ol_enable_homedir" = mod ; then
|
||||
MFLAG=SLAPD_MOD_DYNAMIC
|
||||
SLAPD_DYNAMIC_OVERLAYS="$SLAPD_DYNAMIC_OVERLAYS homedir.la"
|
||||
else
|
||||
MFLAG=SLAPD_MOD_STATIC
|
||||
SLAPD_STATIC_OVERLAYS="$SLAPD_STATIC_OVERLAYS homedir.o"
|
||||
fi
|
||||
AC_DEFINE_UNQUOTED(SLAPD_OVER_HOMEDIR,$MFLAG,[define for Home Directory Management overlay])
|
||||
fi
|
||||
|
||||
if test "$ol_enable_memberof" != no ; then
|
||||
BUILD_MEMBEROF=$ol_enable_memberof
|
||||
if test "$ol_enable_memberof" = mod ; then
|
||||
@ -3110,6 +3126,7 @@ dnl overlays
|
||||
AC_SUBST(BUILD_DYNGROUP)
|
||||
AC_SUBST(BUILD_DYNLIST)
|
||||
AC_SUBST(BUILD_LASTMOD)
|
||||
AC_SUBST(BUILD_HOMEDIR)
|
||||
AC_SUBST(BUILD_MEMBEROF)
|
||||
AC_SUBST(BUILD_PPOLICY)
|
||||
AC_SUBST(BUILD_PROXYCACHE)
|
||||
|
||||
130
doc/man/man5/slapo-homedir.5
Normal file
130
doc/man/man5/slapo-homedir.5
Normal file
@ -0,0 +1,130 @@
|
||||
.TH SLAPO-HOMEDIR 5 "RELEASEDATE" "OpenLDAP LDVERSION"
|
||||
.\" Copyright 1998-2021 The OpenLDAP Foundation, All Rights Reserved.
|
||||
.\" Copying restrictions apply. See the COPYRIGHT file.
|
||||
.\" $OpenLDAP$
|
||||
.SH NAME
|
||||
slapo\-homedir \- Home directory provisioning overlay
|
||||
.SH SYNOPSIS
|
||||
ETCDIR/slapd.conf
|
||||
.SH DESCRIPTION
|
||||
The
|
||||
.B homedir
|
||||
overlay causes
|
||||
.BR slapd (8)
|
||||
to notice changes involving RFC-2307bis style user-objects and make
|
||||
appropriate changes to the local filesystem. This can be performed
|
||||
on both master and replica systems, so it is possible to perform
|
||||
remote home directory provisioning.
|
||||
.SH CONFIGURATION
|
||||
Both slapd.conf and back-config style configuration is supported.
|
||||
.TP
|
||||
.B overlay homedir
|
||||
This directive adds the homedir overlay to the current database,
|
||||
or to the frontend, if used before any database instantiation; see
|
||||
.BR slapd.conf (5)
|
||||
for details.
|
||||
.TP
|
||||
.B homedir\-skeleton\-path <pathname>
|
||||
.TP
|
||||
.B olcSkeletonPath: pathname
|
||||
These options set the path to the skeleton account directory.
|
||||
(Generally, /etc/skel) Files in this directory will be copied into
|
||||
newly created home directories. Copying is recursive and handles
|
||||
symlinks and fifos, but will skip most specials.
|
||||
.TP
|
||||
.B homedir\-min\-uidnumber <user id number>
|
||||
.TP
|
||||
.B olcMinimumUidNumber: number
|
||||
These options configure the minimum userid to use in any home
|
||||
directory attempt. This is a basic safety measure to prevent
|
||||
accidently using system accounts. See REPLICATION for more flexible
|
||||
options for selecting accounts.
|
||||
.TP
|
||||
.B homedir\-regexp <regexp> <path>
|
||||
.TP
|
||||
.B olcHomedirRegexp: regexp path
|
||||
These options configure a set of regular expressions to use for
|
||||
matching and optionally remapping incoming
|
||||
.B homeDirectory
|
||||
attribute values to pathnames on the local filesystem. $number
|
||||
expansion is supported to access values captured in parentheses.
|
||||
|
||||
For example, to accept any directory starting with \/home and use it
|
||||
verbatim on the local filesystem:
|
||||
|
||||
.B homedir-regexp ^(/home/[\-_/a\-z0\-9]+)$ $1
|
||||
|
||||
To match the same set of directories, but create them instead under
|
||||
\/export\/home, as is popular on Solaris NFS servers:
|
||||
|
||||
.B homedir-regexp ^(/home/[\-_/a\-z0\-9]+)$ /export$1
|
||||
.TP
|
||||
.B homedir\-delete\-style style
|
||||
.TP
|
||||
.B olcHomedirDeleteStyle: style
|
||||
These options configure how deletes of posixAccount entries or their
|
||||
attributes are handled; valid styles are
|
||||
.B IGNORE,
|
||||
which does nothing, and
|
||||
.B DELETE,
|
||||
which immediately performs a recursive delete on the home directory,
|
||||
and
|
||||
.B ARCHIVE,
|
||||
which archives the home directory contents in a TAR file for later
|
||||
examination. The default is IGNORE. Use with caution. ARCHIVE
|
||||
requires homedir-archive-path to be set, or it functions similar to
|
||||
IGNORE.
|
||||
.TP
|
||||
.B homedir\-archive\-path <pathname>
|
||||
.TP
|
||||
.B olcArchivePath: pathname
|
||||
These options specify the destination path for TAR files created by
|
||||
the ARCHIVE delete style.
|
||||
.SH REPLICATION
|
||||
The homedir overlay can operate on either master or replica systems
|
||||
with no changes. See
|
||||
.BR slapd.conf (5)
|
||||
or
|
||||
.BR slapd\-config (5)
|
||||
for more information on configure syncrepl.
|
||||
|
||||
Partial replication (e.g. with filters) is especially useful for
|
||||
providing different provisioning options to different sets of users.
|
||||
.SH BUGS
|
||||
DELETE, MOD, and MODRDN operations that remove the unix attributes
|
||||
when delete style is set to DELETE will recursively delete the (regex
|
||||
modified) home directory from the disk. Please be careful when
|
||||
deleting or changing values.
|
||||
|
||||
MOD and MODRDN will correctly respond to homeDirectory changes and
|
||||
perform a non-destructive rename() operation on the filesystem, but
|
||||
this does not correctly retry with a recursive copy when moving
|
||||
between filesystems.
|
||||
|
||||
The recursive copy/delete/chown/tar functions are not aware of ACLs,
|
||||
extended attributes, forks, sparse files, or hard links. Block and
|
||||
character device archival is non-portable, but should not be an issue
|
||||
in home directories, hopefully.
|
||||
|
||||
Copying and archiving may not support files larger than 2GiB on some
|
||||
architectures. Bare POSIX UStar archives cannot support internal
|
||||
files larger than 8GiB. The current tar generator does not attempt to
|
||||
resolve uid/gid into symbolic names.
|
||||
|
||||
No attempt is made to try to mkdir() the parent directories needed for
|
||||
a given home directory or archive path.
|
||||
.SH FILES
|
||||
.TP
|
||||
ETCDIR/slapd.conf
|
||||
default slapd configuration file
|
||||
.TP
|
||||
/etc/skel (or similar)
|
||||
source of new homedir files.
|
||||
.SH SEE ALSO
|
||||
.BR slapd.conf (5),
|
||||
.BR slapd\-config (5),
|
||||
.BR slapd (8),
|
||||
RFC-2307, RFC-2307bis.
|
||||
.SH ACKNOWLEDGEMENTS
|
||||
.P
|
||||
This module was written in 2009 by Emily Backes for Symas Corporation.
|
||||
@ -22,6 +22,7 @@ SRCS = overlays.c \
|
||||
deref.c \
|
||||
dyngroup.c \
|
||||
dynlist.c \
|
||||
homedir.c \
|
||||
memberof.c \
|
||||
pcache.c \
|
||||
collect.c \
|
||||
@ -88,6 +89,9 @@ dyngroup.la : dyngroup.lo
|
||||
dynlist.la : dynlist.lo
|
||||
$(LTLINK_MOD) -module -o $@ dynlist.lo version.lo $(LINK_LIBS)
|
||||
|
||||
homedir.la : homedir.lo
|
||||
$(LTLINK_MOD) -module -o $@ homedir.lo version.lo $(LINK_LIBS)
|
||||
|
||||
memberof.la : memberof.lo
|
||||
$(LTLINK_MOD) -module -o $@ memberof.lo version.lo $(LINK_LIBS)
|
||||
|
||||
|
||||
2074
servers/slapd/overlays/homedir.c
Normal file
2074
servers/slapd/overlays/homedir.c
Normal file
File diff suppressed because it is too large
Load Diff
1
tests/data/homedir/skel/.dotfile
Normal file
1
tests/data/homedir/skel/.dotfile
Normal file
@ -0,0 +1 @@
|
||||
some config
|
||||
1
tests/data/homedir/skel/directory/broken link
Symbolic link
1
tests/data/homedir/skel/directory/broken link
Symbolic link
@ -0,0 +1 @@
|
||||
../target
|
||||
1
tests/data/homedir/skel/symlink
Symbolic link
1
tests/data/homedir/skel/symlink
Symbolic link
@ -0,0 +1 @@
|
||||
directory
|
||||
57
tests/data/slapd-homedir.conf
Normal file
57
tests/data/slapd-homedir.conf
Normal file
@ -0,0 +1,57 @@
|
||||
# stand-alone slapd config -- for testing (with deref overlay)
|
||||
# $OpenLDAP$
|
||||
## This work is part of OpenLDAP Software <http://www.openldap.org/>.
|
||||
##
|
||||
## Copyright 2004-2021 The OpenLDAP Foundation.
|
||||
## All rights reserved.
|
||||
##
|
||||
## Redistribution and use in source and binary forms, with or without
|
||||
## modification, are permitted only as authorized by the OpenLDAP
|
||||
## Public License.
|
||||
##
|
||||
## A copy of this license is available in the file LICENSE in the
|
||||
## top-level directory of the distribution or, alternatively, at
|
||||
## <http://www.OpenLDAP.org/license.html>.
|
||||
|
||||
include @SCHEMADIR@/core.schema
|
||||
include @SCHEMADIR@/cosine.schema
|
||||
include @SCHEMADIR@/inetorgperson.schema
|
||||
include @SCHEMADIR@/openldap.schema
|
||||
include @SCHEMADIR@/nis.schema
|
||||
|
||||
#
|
||||
pidfile @TESTDIR@/slapd.1.pid
|
||||
argsfile @TESTDIR@/slapd.1.args
|
||||
|
||||
#mod#modulepath ../servers/slapd/back-@BACKEND@/
|
||||
#mod#moduleload back_@BACKEND@.la
|
||||
#homedirmod#moduleload ../servers/slapd/overlays/homedir.la
|
||||
|
||||
#######################################################################
|
||||
# database definitions
|
||||
#######################################################################
|
||||
|
||||
database @BACKEND@
|
||||
suffix "dc=example,dc=com"
|
||||
rootdn "cn=Manager,dc=example,dc=com"
|
||||
rootpw secret
|
||||
#null#bind on
|
||||
#~null~#directory @TESTDIR@/db.1.a
|
||||
#indexdb#index objectClass eq
|
||||
#indexdb#index cn,sn,uid pres,eq,sub
|
||||
#mdb#maxsize 33554432
|
||||
#ndb#dbname db_1
|
||||
#ndb#include @DATADIR@/ndb.conf
|
||||
|
||||
overlay homedir
|
||||
|
||||
homedir-min-uidnumber @MINUID@
|
||||
homedir-skeleton-path @DATADIR@/homedir/skel
|
||||
homedir-regexp ^(/home/[-_/a-z0-9]+)$ @TESTDIR@/$1
|
||||
homedir-delete-style ARCHIVE
|
||||
homedir-archive-path @TESTDIR@/archive
|
||||
|
||||
database config
|
||||
include @TESTDIR@/configpw.conf
|
||||
|
||||
database monitor
|
||||
@ -47,6 +47,7 @@ AC_constraint=constraint@BUILD_CONSTRAINT@
|
||||
AC_dds=dds@BUILD_DDS@
|
||||
AC_deref=deref@BUILD_DEREF@
|
||||
AC_dynlist=dynlist@BUILD_DYNLIST@
|
||||
AC_homedir=homedir@BUILD_HOMEDIR@
|
||||
AC_memberof=memberof@BUILD_MEMBEROF@
|
||||
AC_pcache=pcache@BUILD_PROXYCACHE@
|
||||
AC_ppolicy=ppolicy@BUILD_PPOLICY@
|
||||
@ -78,8 +79,8 @@ if test "${AC_asyncmeta}" = "asyncmetamod" && test "${AC_LIBS_DYNAMIC}" = "stati
|
||||
AC_meta="asyncmetano"
|
||||
fi
|
||||
export AC_ldap AC_mdb AC_meta AC_asyncmeta AC_monitor AC_null AC_perl AC_relay AC_sql \
|
||||
AC_accesslog AC_argon2 AC_autoca AC_constraint AC_dds AC_deref AC_dynlist AC_memberof \
|
||||
AC_pcache AC_ppolicy AC_refint AC_remoteauth \
|
||||
AC_accesslog AC_argon2 AC_autoca AC_constraint AC_dds AC_deref AC_dynlist \
|
||||
AC_homedir AC_memberof AC_pcache AC_ppolicy AC_refint AC_remoteauth \
|
||||
AC_retcode AC_rwm AC_unique AC_syncprov AC_translucent \
|
||||
AC_valsort \
|
||||
AC_lloadd \
|
||||
|
||||
@ -40,6 +40,7 @@ sed -e "s/@BACKEND@/${BACKEND}/" \
|
||||
-e "s/^#${AC_dds}#//" \
|
||||
-e "s/^#${AC_deref}#//" \
|
||||
-e "s/^#${AC_dynlist}#//" \
|
||||
-e "s/^#${AC_homedir}#//" \
|
||||
-e "s/^#${AC_pcache}#//" \
|
||||
-e "s/^#${AC_ppolicy}#//" \
|
||||
-e "s/^#${AC_refint}#//" \
|
||||
|
||||
@ -35,6 +35,7 @@ CONSTRAINT=${AC_constraint-constraintno}
|
||||
DDS=${AC_dds-ddsno}
|
||||
DEREF=${AC_deref-derefno}
|
||||
DYNLIST=${AC_dynlist-dynlistno}
|
||||
HOMEDIR=${AC_homedir-homedirno}
|
||||
MEMBEROF=${AC_memberof-memberofno}
|
||||
PROXYCACHE=${AC_pcache-pcacheno}
|
||||
PPOLICY=${AC_ppolicy-ppolicyno}
|
||||
@ -150,6 +151,7 @@ ACICONF=$DATADIR/slapd-aci.conf
|
||||
VALSORTCONF=$DATADIR/slapd-valsort.conf
|
||||
DEREFCONF=$DATADIR/slapd-deref.conf
|
||||
DYNLISTCONF=$DATADIR/slapd-dynlist.conf
|
||||
HOMEDIRCONF=$DATADIR/slapd-homedir.conf
|
||||
RCONSUMERCONF=$DATADIR/slapd-repl-consumer-remote.conf
|
||||
PLSRCONSUMERCONF=$DATADIR/slapd-syncrepl-consumer-persist-ldap.conf
|
||||
PLSRPROVIDERCONF=$DATADIR/slapd-syncrepl-multiproxy.conf
|
||||
|
||||
139
tests/scripts/test085-homedir
Executable file
139
tests/scripts/test085-homedir
Executable file
@ -0,0 +1,139 @@
|
||||
#! /bin/sh
|
||||
# $OpenLDAP$
|
||||
## This work is part of OpenLDAP Software <http://www.openldap.org/>.
|
||||
##
|
||||
## Copyright 2021 The OpenLDAP Foundation.
|
||||
## All rights reserved.
|
||||
##
|
||||
## Redistribution and use in source and binary forms, with or without
|
||||
## modification, are permitted only as authorized by the OpenLDAP
|
||||
## Public License.
|
||||
##
|
||||
## A copy of this license is available in the file LICENSE in the
|
||||
## top-level directory of the distribution or, alternatively, at
|
||||
## <http://www.OpenLDAP.org/license.html>.
|
||||
|
||||
echo "running defines.sh"
|
||||
. $SRCDIR/scripts/defines.sh
|
||||
|
||||
if test $DEREF = homedirno; then
|
||||
echo "Homedir overlay not available, test skipped"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
mkdir -p $TESTDIR $DBDIR1 $TESTDIR/home $TESTDIR/archive
|
||||
|
||||
$SLAPPASSWD -g -n >$CONFIGPWF
|
||||
echo "rootpw `$SLAPPASSWD -T $CONFIGPWF`" >$TESTDIR/configpw.conf
|
||||
|
||||
echo "Running slapadd to build slapd database..."
|
||||
. $CONFFILTER $BACKEND < $HOMEDIRCONF | sed "s/@MINUID@/`id -u`/" > $CONF1
|
||||
$SLAPADD -f $CONF1 -l $LDIF
|
||||
RC=$?
|
||||
if test $RC != 0 ; then
|
||||
echo "slapadd failed ($RC)!"
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
echo "Starting slapd on TCP/IP port $PORT1..."
|
||||
$SLAPD -f $CONF1 -h $URI1 -d $LVL > $LOG1 2>&1 &
|
||||
PID=$!
|
||||
if test $WAIT != 0 ; then
|
||||
echo PID $PID
|
||||
read foo
|
||||
fi
|
||||
KILLPIDS="$PID"
|
||||
|
||||
sleep 1
|
||||
|
||||
echo "Using ldapsearch to check that slapd is running..."
|
||||
for i in 0 1 2 3 4 5; do
|
||||
$LDAPSEARCH -s base -b "$MONITOR" -H $URI1 \
|
||||
'objectclass=*' > /dev/null 2>&1
|
||||
RC=$?
|
||||
if test $RC = 0 ; then
|
||||
break
|
||||
fi
|
||||
echo "Waiting 5 seconds for slapd to start..."
|
||||
sleep 5
|
||||
done
|
||||
if test $RC != 0 ; then
|
||||
echo "ldapsearch failed ($RC)!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
echo "Adding a new user..."
|
||||
$LDAPADD -D "$MANAGERDN" -H $URI1 -w $PASSWD <<EOMOD >> $TESTOUT 2>&1
|
||||
dn: uid=user1,ou=People,$BASEDN
|
||||
objectClass: account
|
||||
objectClass: posixAccount
|
||||
uid: user1
|
||||
cn: One user
|
||||
uidNumber: `id -u`
|
||||
gidNumber: `id -g`
|
||||
homeDirectory: /home/user1
|
||||
EOMOD
|
||||
RC=$?
|
||||
if test $RC != 0 ; then
|
||||
echo "ldapadd failed ($RC)!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
sleep 1
|
||||
|
||||
if ! test -e $TESTDIR/home/user1 ; then
|
||||
echo "Home directory for user1 not created!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Moving home directory for user1..."
|
||||
$LDAPMODIFY -D "$MANAGERDN" -H $URI1 -w $PASSWD <<EOMOD >> $TESTOUT 2>&1
|
||||
dn: uid=user1,ou=People,$BASEDN
|
||||
changetype: modify
|
||||
replace: homeDirectory
|
||||
homeDirectory: /home/user1_new
|
||||
EOMOD
|
||||
RC=$?
|
||||
if test $RC != 0 ; then
|
||||
echo "ldapadd failed ($RC)!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
sleep 1
|
||||
|
||||
if test -e $TESTDIR/home/user1 || ! test -e $TESTDIR/home/user1_new ; then
|
||||
echo "Home directory for user1 not moved!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Removing user1, should get archived..."
|
||||
$LDAPDELETE -D "$MANAGERDN" -H $URI1 -w $PASSWD \
|
||||
"uid=user1,ou=People,$BASEDN" >> $TESTOUT
|
||||
RC=$?
|
||||
if test $RC != 0 ; then
|
||||
echo "ldapdelete failed ($RC)!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit $RC
|
||||
fi
|
||||
|
||||
sleep 1
|
||||
|
||||
if test -e $TESTDIR/home/user1_new || \
|
||||
! test -e $TESTDIR/archive/user1_new-*-0.tar ; then
|
||||
echo "Home directory for user1 not archived properly!"
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
exit 1
|
||||
fi
|
||||
|
||||
test $KILLSERVERS != no && kill -HUP $KILLPIDS
|
||||
|
||||
test $KILLSERVERS != no && wait
|
||||
|
||||
echo ">>>>> Test succeeded"
|
||||
|
||||
exit 0
|
||||
Loading…
Reference in New Issue
Block a user