--- /dev/null
+#!/usr/bin/perl -w
+
+# Created by P.Wieleba@iem.pw.edu.pl in 2004
+
+use strict;
+use Getopt::Std;
+use FindBin;
+use FindBin qw($RealBin);
+use lib "$RealBin/";
+use smbldap_tools;
+
+# function declaration
+sub migrate_user;
+sub migrate_shadow_user;
+sub get_user_entry;
+sub exist_in_tab;
+sub del_from_tab;
+sub add_to_tab;
+sub read_shadow_file;
+
+# smbldap-migrate-unix-accounts (-? or -h for help)
+#
+#
+
+my %Options;
+
+my $ok = getopts('M:P:S:vn?hd:a', \%Options);
+
+if ( (!$ok) || ($Options{'?'}) || ($Options{'h'}) || (!keys(%Options)) ) {
+ print "Usage: $0 [-PSMvn?hda]\n";
+ print " -?|-h show this help message\n";
+ print " -P file import passwd file\n";
+ print " -S file import shadow file\n";
+ print " -M file import FreeBSD master.passwd\n";
+ print " -v displays modified entries to STDOUT\n";
+ print " -n do everything execpt updating LDAP\n";
+ print " -d obj_nam delete and add (not just update) existing entry in LDAP\n";
+ print " -a adds sambaSamAccount objectClass\n";
+ exit (1);
+}
+
+my $INFILE = undef;
+my %shadowUsers;
+
+if ( $Options{'M'} ) {
+ open($INFILE,$Options{'M'}) or
+ die "I cannot open file: " . $Options{'M'} . "\n";
+} elsif ( $Options{'P'} ) {
+ open($INFILE,$Options{'P'}) or
+ die "I cannot open file: " . $Options{'P'} . "\n";
+ # if defined -S option also read shadow file
+ if ( $Options{'S'} ) {
+ %shadowUsers = read_shadow_file($Options{'S'});
+ (%shadowUsers) or ( close($INFILE) and
+ die "I cannot open file: " . $Options{'S'} . "\n" );
+ }
+} elsif ( $Options{'S'} ) {
+ open($INFILE,$Options{'S'}) or
+ die "I cannot open file: " . $Options{'S'} . "\n";
+}
+
+my $ldap_master=connect_ldap_master();
+
+while ( my $line=<$INFILE> ) {
+ chop($line);
+ next if ( $line =~ /^\s*$/ ); # whitespace
+ next if ( $line =~ /^#/ );
+ next if ( $line =~ /^\+/ );
+ my $entry = undef;
+ if ($Options{'M'}) {
+ my($user,$pwd,$uid,$gid,$class,$change,$expire,$gecos,$homedir,$shell) = split(/:/,$line);
+ # if user is not in LDAP new entry will be created
+ $entry = get_user_entry($ldap_master,$user);
+ $entry = migrate_user($entry,$user,$pwd,$uid,$gid,$gecos,$homedir,$shell);
+ # for master.passwd file (nss_ldap)
+ if ($entry) {
+ my @objectClass = $entry->get_value( 'objectClass' );
+ $entry->replace( 'objectClass' => [add_to_tab(\@objectClass,'shadowAccount')] );
+ }
+ } elsif ($Options{'P'}) {
+ my($user,$pwd,$uid,$gid,$gecos,$homedir,$shell) = split(/:/,$line);
+ # if user is not in LDAP new entry will be created
+ $entry = get_user_entry($ldap_master,$user);
+ $entry = migrate_user($entry,$user,$pwd,$uid,$gid,$gecos,$homedir,$shell,undef);
+
+ # should I delete next functionality
+ # add shadow entries if also -S defined
+ if ($Options{'S'} and $shadowUsers{$user}) {
+ my($user,$pwd,$lastchg,$min,$max,$warn,$inactive,$expire,$flag) = split(/:/,$shadowUsers{$user});
+ $entry = migrate_shadow_user($entry,$user,$pwd,$lastchg,$min,$max,$warn,$inactive,$expire,$flag);
+ }
+ } elsif ($Options{'S'}) {
+ my($user,$pwd,$lastchg,$min,$max,$warn,$inactive,$expire,$flag)=split(/:/,$line);
+ # if user is not in LDAP new entry will be created
+ $entry = get_user_entry($ldap_master,$user);
+ $entry = migrate_shadow_user($entry,$user,$pwd,$lastchg,$min,$max,$warn,$inactive,$expire,$flag);
+ }
+
+ if ($entry) {
+ # objectClass $Options{'d'} will be removed
+ # from entry if it exists
+ if ($Options{'d'}) {
+ my @objectClass = $entry->get_value( 'objectClass' );
+ $entry->replace( 'objectClass' => [del_from_tab(\@objectClass,$Options{'d'})] );
+ #$entry->delete( 'objectClass' => [ $Options{'d'} ] );
+ }
+ # if used "-a" and sambaSamAccount doesn't exist.
+ if ( $Options{'a'} and !exist_in_tab([$entry->get_value('objectClass')],'sambaSamAccount') ) {
+ my @objectClass = $entry->get_value( 'objectClass' );
+ $entry->replace( 'objectclass' => [add_to_tab(\@objectClass,'sambaSamAccount')] );
+
+ # the below part comes from smbldap-useradd and
+ # maybe it should be replaced by a new subroutine.
+ my $userUidNumber = $entry->get_value('uidNumber');
+ # as rid we use 2 * uid + 1000
+ my $userRid = 2 * $userUidNumber + 1000;
+ # let's test if this SID already exist
+ my $user_sid = "$config{SID}-$userRid";
+ my $test_exist_sid = does_sid_exist($user_sid,$config{usersdn});
+ if ($test_exist_sid->count == 1) {
+ print "User SID already owned by\n";
+ # there should not exist more than one entry, but ...
+ foreach my $entry ($test_exist_sid->all_entries) {
+ my $dn= $entry->dn;
+ chomp($dn);
+ print "$dn\n";
+ }
+ } else {
+ $entry->replace( 'sambaSID' => $user_sid );
+ }
+ }
+ if ($Options{'v'}) {
+ $entry->dump();
+ }
+ if (!$Options{'n'}) {
+ my $mesg;
+ if ( $Options{'d'} ) {
+ # delete entry from LDAP if it exists
+ $mesg = $ldap_master->search( base => $entry->dn(),
+ scope => 'sub',
+ filter => '(objectClass=*)'
+ );
+ if ( $mesg->count() == 1 ) {
+ $mesg = $ldap_master->delete($entry->dn());
+ if ($mesg->is_error()) {
+ print "Error: " . $mesg->error() . "\n";
+ }
+ $entry->changetype('add');
+ }
+ }
+ $mesg = $entry->update($ldap_master);
+ if ($mesg->is_error()) {
+ print "Error: " . $mesg->error() . "\n";
+ }
+ }
+ }
+}
+
+$INFILE and close($INFILE);
+# take down the session
+$ldap_master and $ldap_master->unbind;
+
+# returns updated $entry
+sub migrate_user
+ {
+ my($entry,$user,$pwd,$uid,$gid,$gecos,$homedir,$shell) = @_;
+ my($name,$office,$wphone,$hphone)=split(/,/,$gecos);
+ my($cn);
+
+ # posixAccount MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory )
+ my @objectClass = $entry->get_value( 'objectClass' );
+ @objectClass = add_to_tab(\@objectClass,'posixAccount');
+ @objectClass = add_to_tab(\@objectClass,'inetOrgPerson');
+ $entry->replace( 'objectClass' => \@objectClass );
+
+ $entry->replace( 'uid' => $user );
+ if ($name) {
+ $cn = $name;
+ } else {
+ $cn = $user;
+ }
+ $entry->replace( 'cn' => $cn );
+ # perhaps I should delete it
+ if ( exist_in_tab(\@objectClass,'inetOrgPerson') ) {
+ # 'sn' is required by person objectClass from core.schema
+ my @tmp = split(/\s+/,$cn);
+ my $sn = $tmp[$#tmp];
+ $entry->replace( 'sn' => $sn );
+ # perhaps 'telephoneNumber' 'roomNumber' 'homePhone'
+ # and 'givenName' also should be modified ???????
+ }
+ ($pwd) and $entry->replace( 'userPassword' => "{crypt}" . $pwd );
+ ($uid ne "") and $entry->replace( 'uidNumber' => $uid );
+ ($gid ne "") and $entry->replace( 'gidNumber' => $gid );
+ ($gecos) and $entry->replace( 'gecos' => $gecos );
+ ($homedir) and $entry->replace( 'homeDirectory' => $homedir );
+ ($shell) and $entry->replace( 'loginShell' => $shell );
+
+ return $entry;
+ }
+
+# returns updated $entry
+sub migrate_shadow_user
+ {
+ my($entry,$user,$pwd,$lastchg,$min,$max,$warn,$inactive,$expire,$flag) = @_;
+
+ # shadowAccount MUST uid
+ my @objectClass = $entry->get_value( 'objectClass' );
+ # if the entry doesn't exist, it needs structural objectclass
+ (@objectClass) or push(@objectClass,'account');
+ $entry->replace( 'objectClass' => [add_to_tab(\@objectClass,'shadowAccount')] );
+
+ $entry->replace( 'uid' => $user );
+ ($pwd) and $entry->replace( 'userPassword' => "{crypt}" . $pwd );
+ ($lastchg) and $entry->replace( 'shadowLastChange' => $lastchg );
+ ($min) and $entry->replace( 'shadowMin' => $min );
+ ($max) and $entry->replace( 'shadowMax' => $max );
+ ($warn) and $entry->replace( 'shadowWarning' => $warn );
+ ($inactive) and $entry->replace( 'shadowInactive' => $inactive );
+ ($expire) and $entry->replace( 'shadowExpire' => $expire );
+ ($flag) and $entry->replace( 'shadowFlag' => $flag );
+
+ return $entry;
+ }
+
+# creates a _new_entry_ if user doesn't exist in ldap
+# else return's ldap user entry
+sub get_user_entry
+ {
+ my($ldap_master,$user) = @_;
+
+ # do not use read_user_entry()
+ my $mesg = $ldap_master->search( base => $config{usersdn},
+ scope => 'one',
+ filter => "(uid=$user)"
+ );
+ my $entry;
+ if ( $mesg->count() != 1 ) {
+ $entry = Net::LDAP::Entry->new();
+ $entry->dn("uid=$user,$config{usersdn}");
+ } else {
+ $entry = $mesg->entry(0); # ????
+ }
+ return $entry;
+ }
+
+# Check if a $text element exists in @table
+# eg. exist_in_tab(\@table,$text);
+sub exist_in_tab
+ {
+ my($ref_tab,$text) = @_;
+ my @tab = @$ref_tab;
+
+ foreach my $elem (@tab) {
+ if ( lc($elem) eq lc($text) ) {
+ return 1;
+ }
+ }
+ return 0;
+ }
+
+# Delete $text element from @table
+# eg. del_from_tab(\@table,$text);
+sub del_from_tab
+ {
+ my($ref_tab,$text) = @_;
+ my @tab = @$ref_tab;
+ my @new_tab;
+
+ foreach my $elem (@tab) {
+ if ( lc($elem) ne lc($text) ) {
+ push(@new_tab,$elem);
+ }
+ }
+ return @new_tab;
+ }
+
+# Add $text to tab if it doesn't exist there
+sub add_to_tab
+ {
+ my($ref_tab,$text) = @_;
+ my @tab = @$ref_tab;
+
+ if ( !exist_in_tab(\@tab,$text) ) {
+ push(@tab,$text);
+ }
+ return @tab;
+ }
+
+# reads shadow file entries and places them in a hash
+sub read_shadow_file
+ {
+ my($shadow) = @_;
+
+ my $shadowUser;
+ my %shadowUsers;
+ open(SHADOW,$shadow) or
+ return ;
+ while (my $line=<SHADOW>) {
+ chop($line);
+ next if ( $line =~ /^\s*$/ ); # whitespace
+ next if ( $line =~ /^#/ );
+ ($shadowUser) = split(/:/, $line);
+ $shadowUsers{$shadowUser} = $line;
+ }
+ close(SHADOW);
+ return %shadowUsers;
+ }
+
+########################################
+
+=head1 NAME
+
+smbldap-migrate-unix-accounts - Migrate unix accounts to LDAP
+
+=head1 SYNOPSIS
+
+smbldap-migrate-unix-accounts [-P file] [-S file] [-M file] [-n] [-v]
+[-h] [-?] [-d]
+
+=head1 DESCRIPTION
+
+This command processes one file as defined by option and
+creates new or changes existing ldap user entry.
+New attributes are added, and existing are changed.
+None of the existing attributes is deleted.
+
+-P passwd_file
+ Processes passwd_file and uptades LDAP. Creates new ldap user
+ entry or just adds posixAccount objectclass and corresponding
+ attributes to the ldap user entry or just uptades their values.
+
+-S shadow_file
+ Reads shadow_file and uptades LDAP. Creates new ldap user
+ entry or just adds shadowAccount objectclass and corresponding
+ attributes to the ldap user entry or just uptades their values.
+
+-M master.passwd_file
+ Reads master.passwd_file and uptades LDAP. Creates new ldap user
+ entry or just adds shadowAccount and posixAccount objectclass
+ and corresponding attributes to the ldap user entry or just
+ uptades their values.
+
+-h show the help message
+
+-? the same as -h
+
+-v displayes modified entries to STDOUT
+
+-n do everything execpt updating LDAP. It is useful when used
+ with -v switch.
+
+-d objeClass_name
+ In spite of just updating existing user entry, the entry will be
+ deleted from LDAP and a new one will be added.
+ It is essential to use this option if you update users in LDAP
+ and want to change their structural objectClass.
+ Use it in the example schema:
+ There are no users in LDAP, and you migrate samba first.
+ # pdbedit -e ldapsam:ldap://localhost
+ # smbldap-migrate-passwd -P passwd -d 'account'
+
+-a adds sambaSamAccount objectClass and generates sambaSID attribute
+
+=cut
+
+#'
+
+# The End
+
+
projects / samba / blobdiff