forked from bonnevil/ldap-freeipa
-
Notifications
You must be signed in to change notification settings - Fork 0
/
ldap-freeipa.py
executable file
·157 lines (134 loc) · 5.26 KB
/
ldap-freeipa.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
#!/usr/bin/env python
#
# ldap-freeipa.py
# Dynamic inventory script for FreeIPA using LDAP simple binds
# Steve Bonneville <sbonnevi@redhat.com>
#
# Copyright 2017 Red Hat, Inc.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
#
# 1. Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
#
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials provided
# with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY RED HAT, INC. ``AS IS'' AND ANY EXPRESS
# OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL RED HAT, INC. BE LIABLE FOR ANY DIRECT,
# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
# STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
# IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
import json
import ldap
import sys
###################################################
# DO NOT EDIT ABOVE THIS LINE.
##
# Configuration settings
##
# EDIT: LDAP URI of your FreeIPA server
LDAP_URI = "ldap://utility.lab.example.com"
# EDIT: BaseDN of your FreeIPA server
LDAP_BASEDN = "dc=lab,dc=example,dc=com"
# EDIT: DN and password of a service user on your FreeIPA server
# (anonymous bind can't see all the necessary attributes)
# should not be a normal end-user account since password is exposed
# to anyone with access to this script
# See http://www.freeipa.org/page/HowTo/LDAP (may be outdated)
LDAP_BINDDN = "uid=inventory,cn=users,cn=accounts,dc=lab,dc=example,dc=com"
LDAP_BINDPW = "needabetterpassword"
# Work needed:
# * LDAPS support for FreeIPA
# * Potentially set some host variables from other attributes
# * Make it easier for a newbie to set the LDAP_* variables above
# DO NOT EDIT BELOW THIS LINE.
###################################################
def listgroup():
# Simple bind to the FreeIPA server and run a subtree
# search for hostgroups (objectclass=ipahostgroup),
# and retrieve all values of their 'member' attributes
conn = ldap.initialize(LDAP_URI)
basedn = LDAP_BASEDN
search_scope = ldap.SCOPE_SUBTREE
search_filter = "(objectclass=ipahostgroup)"
search_attribute = ["cn", "member"]
try:
conn.protocol_version = ldap.VERSION3
conn.simple_bind_s(LDAP_BINDDN, LDAP_BINDPW)
except ldap.INVALID_CREDENTIALS:
print("Your bind DN or password is incorrect.")
sys.exit(1)
except ldap.LDAPError, e:
print("LDAPError: %s." % e)
sys.exit(1)
try:
ldap_result = conn.search(
basedn,
search_scope,
search_filter,
search_attribute
)
hostgroup = {}
while 1:
result_type, result_data = conn.result(ldap_result, 0)
if (result_data == []):
break
else:
if result_type == ldap.RES_SEARCH_ENTRY:
groupname = result_data[0][1]['cn'][0]
try:
memberlist = result_data[0][1]['member']
except KeyError:
memberlist = []
# If the RDN of a hostgroup member is "cn",
# then it's a nested hostgroup.
#
# If the RDN of a hostgroup member is "fqdn",
# then it's a host.
hosts = []
children = []
for member in memberlist:
memberdn = ldap.dn.str2dn(member)
if (memberdn[0][0][0] == "cn"):
children.append(memberdn[0][0][1])
if (memberdn[0][0][0] == "fqdn"):
hosts.append(memberdn[0][0][1])
if (children != []):
hostgroup[groupname] = {
'hosts': hosts,
'children': children
}
else:
hostgroup[groupname] = {
'hosts': hosts
}
# assume that we have no hostvars
hostgroup["_meta"] = {'hostvars': {}}
print(json.dumps(hostgroup))
except ldap.LDAPError, e:
print("LDAPError: %s." % e)
finally:
conn.unbind_s()
def listhost(hostname):
# does not check to ensure host exists
# assume that we have no hostvars
print(json.dumps({}))
if __name__ == '__main__':
if len(sys.argv) == 2 and (sys.argv[1] == '--list'):
listgroup()
elif len(sys.argv) == 3 and (sys.argv[1] == '--host'):
listhost(sys.argv[2])
else:
print("Usage: %s --list or --host <hostname>" % sys.argv[0])
sys.exit(1)