# -*- coding: utf-8 -*- # === activeldap - an OO-interface to LDAP objects inspired by ActiveRecord # Author: Will Drewry # License: See LICENSE and COPYING # Copyright 2004-2006 Will Drewry # Some portions Copyright 2006 Google Inc # # == Summary # ActiveLdap lets you read and update LDAP entries in a completely object # oriented fashion, even handling attributes with multiple names seamlessly. # It was inspired by ActiveRecord so extending it to deal with custom # LDAP schemas is as effortless as knowing the 'ou' of the objects, and the # primary key. (fix this up some) # # == Example # irb> require 'active_ldap' # > true # irb> user = ActiveLdap::User.new("drewry") # > # user.cn # > "foo" # irb> user.common_name # > "foo" # irb> user.cn = "Will Drewry" # > "Will Drewry" # irb> user.cn # > "Will Drewry" # irb> user.save # # require 'English' require 'thread' require 'erb' require 'set' module ActiveLdap # OO-interface to LDAP assuming pam/nss_ldap-style organization with # Active specifics # Each subclass does a ldapsearch for the matching entry. # If no exact match, raise an error. # If match, change all LDAP attributes in accessor attributes on the object. # -- these are ACTUALLY populated from schema - see active_ldap/schema.rb # example # -- extract objectClasses from match and populate # Multiple entries become lists. # If this isn't read-only then lists become multiple entries, etc. class << self include GetTextSupport def const_missing(id) case id when :ConnectionNotEstablished message = _("ActiveLdap::ConnectionNotEstablished has been deprecated " \ "since 1.1.0. " \ "Please use ActiveLdap::ConnectionNotSetup instead.") ActiveSupport::Deprecation.warn(message) const_set("ConnectionNotEstablished", ConnectionNotSetup) ConnectionNotEstablished else super end end end class Error < StandardError include GetTextSupport end # ConfigurationError # # An exception raised when there is a problem with Base.connect arguments class ConfigurationError < Error end # DeleteError # # An exception raised when an ActiveLdap delete action fails class DeleteError < Error end # SaveError # # An exception raised when an ActiveLdap save action failes class SaveError < Error end # AuthenticationError # # An exception raised when user authentication fails class AuthenticationError < Error end # ConnectionError # # An exception raised when the LDAP conenction fails class ConnectionError < Error end # ObjectClassError # # An exception raised when an objectClass is not defined in the schema class ObjectClassError < Error end # AttributeAssignmentError # # An exception raised when there is an issue assigning a value to # an attribute class AttributeAssignmentError < Error end # TimeoutError # # An exception raised when a connection action fails due to a timeout class TimeoutError < Error end class EntryNotFound < Error end class EntryAlreadyExist < Error end class StrongAuthenticationRequired < Error end class DistinguishedNameInputInvalid < Error attr_reader :input def initialize(input=nil) @input = input super(_("invalid distinguished name (DN) to parse: %s") % @input.inspect) end end class DistinguishedNameInvalid < Error attr_reader :dn, :reason def initialize(dn, reason=nil) @dn = dn @reason = reason if @reason message = _("%s is invalid distinguished name (DN): %s") % [@dn, @reason] else message = _("%s is invalid distinguished name (DN)") % @dn end super(message) end end class DistinguishedNameNotSetError < Error end class LdifInvalid < Error attr_reader :ldif, :reason, :line, :column, :nearest def initialize(ldif, reason=nil, line=nil, column=nil) @ldif = ldif @reason = reason @line = line @column = column @nearest = nil if @reason message = _("invalid LDIF: %s:") % @reason else message = _("invalid LDIF:") end if @line and @column @nearest = detect_nearest(@line, @column) snippet = generate_snippet message << "\n#{snippet}\n" end super("#{message}\n#{numbered_ldif}") end NEAREST_MARK = "|@|" private def detect_nearest(line, column) lines = Compatible.string_to_lines(@ldif).to_a nearest = lines[line - 1] || "" if column - 1 == nearest.size # for JRuby 1.0.2 :< nearest << NEAREST_MARK else nearest[column - 1, 0] = NEAREST_MARK end if nearest == NEAREST_MARK nearest = "#{lines[line - 2]}#{nearest}" end nearest end def generate_snippet nearest = @nearest.chomp column_column = ":#{@column}" target_position_info = "#{@line}#{column_column}: " if /\n/ =~ nearest snippet = "%#{Math.log10(@line).truncate}d" % (@line - 1) snippet << " " * column_column.size snippet << ": " snippet << nearest.gsub(/\n/, "\n#{target_position_info}") else snippet = "#{target_position_info}#{nearest}" end snippet end def numbered_ldif return @ldif if @ldif.blank? lines = Compatible.string_to_lines(@ldif) format = "%#{Math.log10(lines.size).truncate + 1}d: %s" i = 0 lines.collect do |line| i += 1 format % [i, line] end.join end end class EntryNotSaved < Error end class RequiredObjectClassMissed < Error end class RequiredAttributeMissed < Error end class EntryInvalid < Error attr_reader :entry def initialize(entry) @entry = entry errors = @entry.errors.full_messages.join(", ") super(errors) end end class OperationNotPermitted < Error end class ConnectionNotSetup < Error end class AdapterNotSpecified < Error end class AdapterNotFound < Error attr_reader :adapter def initialize(adapter) @adapter = adapter super(_("LDAP configuration specifies nonexistent %s adapter") % adapter) end end class UnknownAttribute < Error attr_reader :name def initialize(name) @name = name super(_("%s is unknown attribute") % @name) end end class AttributeValueInvalid < Error attr_reader :attribute, :value def initialize(attribute, value, message) @attribute = attribute @value = value super(message) end end class NotImplemented < Error attr_reader :target def initialize(target) @target = target super(_("not implemented: %s") % @target) end end # Base # # Base is the primary class which contains all of the core # ActiveLdap functionality. It is meant to only ever be subclassed # by extension classes. class Base include GetTextSupport public :gettext public :_ if Object.const_defined?(:Reloadable) if Reloadable.const_defined?(:Deprecated) include Reloadable::Deprecated else include Reloadable::Subclasses end end VALID_LDAP_MAPPING_OPTIONS = [:dn_attribute, :prefix, :scope, :classes, :recommended_classes, :excluded_classes, :sort_by, :order] cattr_accessor :logger cattr_accessor :configurations @@configurations = {} def self.class_local_attr_accessor(search_ancestors, *syms) syms.flatten.each do |sym| class_eval(<<-EOS, __FILE__, __LINE__ + 1) def self.#{sym}(search_superclasses=#{search_ancestors}) @#{sym} ||= nil return @#{sym} if @#{sym} if search_superclasses target = superclass value = nil loop do break nil unless target.respond_to?(:#{sym}) value = target.#{sym} break if value target = target.superclass end value else nil end end def #{sym}; self.class.#{sym}; end def self.#{sym}=(value); @#{sym} = value; end EOS end end class_local_attr_accessor false, :inheritable_prefix, :inheritable_base class_local_attr_accessor true, :dn_attribute, :scope, :sort_by, :order class_local_attr_accessor true, :required_classes, :recommended_classes class_local_attr_accessor true, :excluded_classes class_local_attr_accessor false, :sub_classes class << self # Hide new in Base private :new def inherited(sub_class) super sub_class.module_eval do include GetTextSupport end (self.sub_classes ||= []) << sub_class end # Set LDAP connection configuration up. It doesn't connect # and bind to LDAP server. A connection to LDAP server is # created when it's needed. # # == +config+ # +config+ must be a hash that may contain any of the following fields: # :password_block, :logger, :host, :port, :base, :bind_dn, # :try_sasl, :allow_anonymous # :bind_dn specifies the DN to bind with. # :password_block specifies a Proc object that will yield a String to # be used as the password when called. # :logger specifies a logger object (Logger, Log4r::Logger and s on) # :host sets the LDAP server hostname # :port sets the LDAP server port # :base overwrites Base.base - this affects EVERYTHING # :try_sasl indicates that a SASL bind should be attempted when binding # to the server (default: false) # :sasl_mechanisms is an array of SASL mechanism to try # (default: ["GSSAPI", "CRAM-MD5", "EXTERNAL"]) # :allow_anonymous indicates that a true anonymous bind is allowed when # trying to bind to the server (default: true) # :retries - indicates the number of attempts to reconnect that will be # undertaken when a stale connection occurs. -1 means infinite. # :sasl_quiet - if true, sets @sasl_quiet on the Ruby/LDAP connection # :method - whether to use :ssl, :tls, or :plain (unencrypted) # :retry_wait - seconds to wait before retrying a connection # :scope - dictates how to find objects. ONELEVEL by default to # avoid dn_attr collisions across OUs. Think before changing. # :timeout - time in seconds - defaults to disabled. This CAN interrupt # search() requests. Be warned. # :retry_on_timeout - whether to reconnect when timeouts occur. Defaults # to true # See lib/active_ldap/configuration.rb for defaults for each option def setup_connection(config=nil) super ensure_logger nil end # establish_connection is deprecated since 1.1.0. Please use # setup_connection() instead. def establish_connection(config=nil) message = _("ActiveLdap::Base.establish_connection has been deprecated " \ "since 1.1.0. " \ "Please use ActiveLdap::Base.setup_connection instead.") ActiveSupport::Deprecation.warn(message) setup_connection(config) end def create(attributes=nil, &block) if attributes.is_a?(Array) attributes.collect {|attrs| create(attrs, &block)} else object = new(attributes, &block) object.save object end end # This class function is used to setup all mappings between the subclass # and ldap for use in activeldap # # Example: # ldap_mapping :dn_attribute => 'uid', :prefix => 'ou=People', # :classes => ['top', 'posixAccount'], # :scope => :sub def ldap_mapping(options={}) options = options.symbolize_keys validate_ldap_mapping_options(options) self.dn_attribute = options[:dn_attribute] || default_dn_attribute self.dn_attribute = dn_attribute.to_s if dn_attribute.is_a?(Symbol) self.prefix = options[:prefix] || default_prefix self.scope = options[:scope] self.required_classes = options[:classes] self.recommended_classes = options[:recommended_classes] self.excluded_classes = options[:excluded_classes] self.sort_by = options[:sort_by] self.order = options[:order] public_class_method :new end # Base.base # # This method when included into Base provides # an inheritable, overwritable configuration setting # # This should be a string with the base of the # ldap server such as 'dc=example,dc=com', and # it should be overwritten by including # configuration.rb into this class. # When subclassing, the specified prefix will be concatenated. def base @base ||= compute_base end alias_method :parsed_base, :base # for backward compatibility def base=(value) self.inheritable_base = value @base = nil end def prefix @prefix ||= inheritable_prefix and DN.parse(inheritable_prefix) end def prefix=(value) self.inheritable_prefix = value @prefix = nil @base = nil end alias_method :scope_without_validation=, :scope= def scope=(scope) validate_scope(scope) self.scope_without_validation = scope end def validate_scope(scope) scope = scope.to_sym if scope.is_a?(String) return if scope.nil? or scope.is_a?(Symbol) raise ConfigurationError, _("scope '%s' must be a Symbol") % scope.inspect end def base_class if self == Base or superclass == Base self else superclass.base_class end end def default_search_attribute dn_attribute end def inspect if self == Base super elsif abstract_class? "#{super}(abstract)" else detail = nil begin must = [] may = [] class_names = classes.collect do |object_class| must.concat(object_class.must) may.concat(object_class.may) object_class.name end detail = ["objectClass:<#{class_names.join(', ')}>", "must:<#{inspect_attributes(must)}>", "may:<#{inspect_attributes(may)}>"].join(", ") rescue ActiveLdap::ConnectionNotSetup detail = "not-connected" rescue ActiveLdap::Error detail = "connection-failure" end "#{super}(#{detail})" end end attr_accessor :abstract_class def abstract_class? defined?(@abstract_class) && @abstract_class end def class_of_active_ldap_descendant(klass) if klass.superclass == Base or klass.superclass.abstract_class? klass elsif klass.superclass.nil? raise Error, _("%s doesn't belong in a hierarchy descending " \ "from ActiveLdap") % (name || to_s) else class_of_active_ldap_descendant(klass.superclass) end end def self_and_descendants_from_active_ldap klass = self classes = [klass] while klass != klass.base_class classes << klass = klass.superclass end classes rescue [self] end def human_name(options={}) defaults = self_and_descendants_from_active_ldap.collect do |klass| if klass.name.blank? nil else :"#{klass.name.underscore}" end end defaults << name.humanize defaults = defaults.compact defaults.first || name || to_s end protected def find_real_class(object_classes) (sub_classes || []).each do |sub_class| real_class = sub_class.find_real_class(object_classes) return real_class if real_class end if object_classes.superset?(Set.new(classes)) self else nil end end private def inspect_attributes(attributes) inspected_attribute_names = {} attributes.collect do |attribute| if inspected_attribute_names.has_key?(attribute.name) nil else inspected_attribute_names[attribute.name] = true inspect_attribute(attribute) end end.compact.join(', ') end def inspect_attribute(attribute) syntax = attribute.syntax result = "#{attribute.name}" if syntax and !syntax.description.blank? result << ": #{syntax.description}" end properties = [] properties << "read-only" if attribute.read_only? properties << "binary" if attribute.binary? properties << "binary-required" if attribute.binary_required? result << "(#{properties.join(', ')})" unless properties.empty? result end def validate_ldap_mapping_options(options) options.assert_valid_keys(VALID_LDAP_MAPPING_OPTIONS) end def ensure_logger @@logger ||= configuration[:logger] # Setup default logger to console if @@logger.nil? require 'logger' @@logger = Logger.new(STDERR) @@logger.progname = 'ActiveLdap' @@logger.level = Logger::ERROR end configuration[:logger] ||= @@logger end def instantiate(args) dn, attributes, options = args options ||= {} object_classes_raw = attributes["objectClass"] || attributes["objectclass"] || [] if sub_classes.nil? or object_classes_raw.empty? real_klass = self else object_classes = Set.new object_classes_raw.each do |object_class_raw| object_classes << schema.object_class(object_class_raw) end real_klass = find_real_class(object_classes) || self end obj = real_klass.allocate conn = options[:connection] || connection obj.connection = conn if conn != connection obj.instance_eval do initialize_by_ldap_data(dn, attributes) end obj end def default_dn_attribute dn_attribute = nil parent_class = ancestors[1] if parent_class.respond_to?(:dn_attribute) dn_attribute = parent_class.dn_attribute end dn_attribute || "cn" end def default_prefix if name.blank? nil else "ou=#{name.demodulize.pluralize}" end end def compute_base _base = inheritable_base _base = configuration[:base] if _base.nil? and configuration if _base.nil? target = superclass loop do break unless target.respond_to?(:base) _base = target.base break if _base target = target.superclass end end _prefix = prefix _base ||= connection.naming_contexts.first return _prefix if _base.blank? _base = DN.parse(_base) _base = _prefix + _base if _prefix _base end end self.scope = :sub self.required_classes = ['top'] self.recommended_classes = [] self.excluded_classes = [] ### All instance methods, etc # new # # Creates a new instance of Base initializing all class and all # initialization. Defines local defaults. See examples If multiple values # exist for dn_attribute, the first one put here will be authoritative def initialize(attributes=nil) init_base @new_entry = true initial_classes = required_classes | recommended_classes case attributes when nil self.classes = initial_classes when String, Array, DN self.classes = initial_classes self.dn = attributes when Hash attributes = attributes.clone classes = extract_object_class!(attributes) self.classes = classes | initial_classes self.attributes = attributes else format = _("'%s' must be either nil, DN value as ActiveLdap::DN, " \ "String or Array or attributes as Hash") raise ArgumentError, format % attributes.inspect end yield self if block_given? run_callbacks :initialize unless _initialize_callbacks.empty? end # Returns true if the +comparison_object+ is the same object, or is of # the same type and has the same dn. def ==(comparison_object) comparison_object.equal?(self) or (comparison_object.instance_of?(self.class) and comparison_object.dn == dn and !comparison_object.new_entry?) end # Delegates to == def eql?(comparison_object) self == (comparison_object) end # Delegates to id in order to allow two records of the same type and id # to work with something like: # [ User.find("a"), User.find("b"), User.find("c") ] & # [ User.find("a"), User.find("d") ] # => [ User.find("a") ] def hash return super if @_hashing # workaround for GetText :< _dn = nil begin @_hashing = true _dn = dn rescue DistinguishedNameInvalid, DistinguishedNameNotSetError return super ensure @_hashing = false end _dn.hash end def may entry_attribute.may end def must entry_attribute.must end # attributes # # Return attribute methods so that a program can determine available # attributes dynamically without schema awareness def attribute_names(normalize=false) entry_attribute.names(normalize) end def attribute_present?(name) values = get_attribute(name, true) !values.empty? or values.any? {|x| !(x and x.empty?)} end # exist? # # Return whether the entry exists in LDAP or not def exist? self.class.exists?(dn) end alias_method(:exists?, :exist?) # dn # # Return the authoritative dn def dn @dn ||= compute_dn end def id get_attribute(dn_attribute_with_fallback) end def to_param id end # Returns this entity’s dn wrapped in an Array or nil if the entity' s dn is not set. def to_key [dn] rescue DistinguishedNameNotSetError nil end def dn=(value) set_attribute(dn_attribute_with_fallback, value) end alias_method(:id=, :dn=) alias_method(:dn_attribute_of_class, :dn_attribute) def dn_attribute ensure_update_dn _dn_attribute = @dn_attribute || dn_attribute_of_class to_real_attribute_name(_dn_attribute) || _dn_attribute end def default_search_attribute self.class.default_search_attribute end # Updates a given attribute and saves immediately def update_attribute(name, value) send("#{name}=", value) save end # This performs a bulk update of attributes and immediately # calls #save. def update_attributes(attrs) self.attributes = attrs save end def update_attributes!(attrs) self.attributes = attrs save! end # This returns the key value pairs in @data with all values # cloned def attributes @simplified_data ||= simplify_data(@data) @simplified_data.clone end # This allows a bulk update to the attributes of a record # without forcing an immediate save or validation. # # It is unwise to attempt objectClass updates this way. # Also be sure to only pass in key-value pairs of your choosing. # Do not let URL/form hackers supply the keys. def attributes=(new_attributes) return if new_attributes.blank? assign_attributes(new_attributes) end def assign_attributes(new_attributes) return if new_attributes.blank? _schema = _local_entry_attribute = nil targets = sanitize_for_mass_assignment(new_attributes) have_dn = false dn_value = nil targets.each do |key, value| setter = "#{key}=" unless respond_to?(setter) _schema ||= schema attribute = _schema.attribute(key) next if attribute.id.nil? _local_entry_attribute ||= local_entry_attribute _local_entry_attribute.register(attribute) end case setter when "dn=", "id=" have_dn = true dn_value = value else send(setter, value) end end self.dn = dn_value if have_dn end def to_ldif_record super(dn, normalize_data(@data)) end def to_ldif Ldif.new([to_ldif_record]).to_s end def to_xml(options={}) options = options.dup options[:root] ||= (self.class.name || '').underscore options[:root] = 'anonymous' if options[:root].blank? [:only, :except].each do |attribute_names_key| names = options[attribute_names_key] next if names.nil? options[attribute_names_key] = names.collect do |name| if name.to_s.downcase == "dn" "dn" else to_real_attribute_name(name) end end.compact end XML.new(dn, normalize_data(@data), schema).to_s(options) end def to_s to_ldif end def have_attribute?(name, except=[]) real_name = to_real_attribute_name(name) !real_name.nil? and !except.include?(real_name) end alias_method :has_attribute?, :have_attribute? def [](name, force_array=false) if name == "dn" array_of(dn, force_array) else get_attribute(name, force_array) end end def []=(name, value) set_attribute(name, value) end def bind(config_or_password={}, config_or_ignore=nil, &block) if config_or_password.is_a?(String) config = (config_or_ignore || {}).merge(:password => config_or_password) else config = config_or_password end config = {:bind_dn => dn, :allow_anonymous => false}.merge(config) config[:password_block] ||= block if block_given? setup_connection(config) before_connection = @connection begin @connection = nil connection.connect @connection = connection clear_connection_based_cache clear_association_cache rescue ActiveLdap::Error remove_connection @connection = before_connection raise end true end def clear_connection_based_cache @schema = nil @local_entry_attribute = nil clear_object_class_based_cache end def clear_object_class_based_cache @entry_attribute = nil @real_names = {} clear_changes_information end def clear_removed_attributes_data(removed_attributes) return if removed_attributes.empty? removed_entry_attribute = EntryAttribute.new(nil, []) removed_attributes.each do |attribute| removed_entry_attribute.register(attribute) end @data.reject! do |key, _| removed_entry_attribute.exist?(key) end end def schema @schema ||= super end def base @base ||= compute_base end def base=(object_local_base) ensure_update_dn @dn = nil @base = nil @base_value = object_local_base end alias_method :scope_of_class, :scope def scope @scope || scope_of_class end def scope=(scope) self.class.validate_scope(scope) @scope = scope end def delete_all(options={}) super({:base => dn}.merge(options || {})) end def destroy_all(options={}) super({:base => dn}.merge(options || {})) end def inspect object_classes = entry_attribute.object_classes inspected_object_classes = object_classes.collect do |object_class| object_class.name end.join(', ') must_attributes = must.collect(&:name).sort.join(', ') may_attributes = may.collect(&:name).sort.join(', ') inspected_attributes = attribute_names.sort.collect do |name| inspect_attribute(name) end.join(', ') result = "\#<#{self.class} objectClass:<#{inspected_object_classes}>, " result << "must:<#{must_attributes}>, may:<#{may_attributes}>, " result << "#{inspected_attributes}>" result end private def dn_attribute_with_fallback begin dn_attribute rescue DistinguishedNameInvalid _dn_attribute = @dn_attribute || dn_attribute_of_class _dn_attribute = to_real_attribute_name(_dn_attribute) || _dn_attribute raise if _dn_attribute.nil? _dn_attribute end end def inspect_attribute(name) values = get_attribute(name, true) values.collect do |value| if value.is_a?(String) and value.length > 50 "#{value[0, 50]}...".inspect elsif value.is_a?(Date) || value.is_a?(Time) "#{value.to_s(:db)}" else value.inspect end end "#{name}: #{values.inspect}" end def find_object_class_values(data) data["objectClass"] || data["objectclass"] end def attribute_name_resolvable_without_connection? @entry_attribute and @local_entry_attribute end def entry_attribute @entry_attribute ||= connection.entry_attribute(find_object_class_values(@data) || []) end def local_entry_attribute @local_entry_attribute ||= connection.entry_attribute([]) end def extract_object_class!(attributes) classes = [] attributes.keys.each do |key| string_key = key.to_s if /\Aobject_?class\z/i =~ string_key classes.concat(attributes[key].to_a) attributes.delete(key) end end classes end def remove_dn_attribute!(attributes) _dn_attribute = dn_attribute attributes.keys.each do |key| case key when "id", :id, "dn", :dn attributes.delete(key) else normalized_key = to_real_attribute_name(key) || key if normalized_key == _dn_attribute attributes.delete(key) end end end end def init_base init_instance_variables end def initialize_by_ldap_data(dn, attributes) init_base dn = Compatible.convert_to_utf8_encoded_object(dn) attributes = Compatible.convert_to_utf8_encoded_object(attributes) @original_dn = dn.clone @dn = dn @base = nil @base_value = nil @new_entry = false @dn_is_base = false @ldap_data = attributes attributes = attributes.clone classes = extract_object_class!(attributes) self.classes = classes self.dn = dn remove_dn_attribute!(attributes) initialize_attributes(attributes) yield self if block_given? end def initialize_attributes(attributes) _schema = _local_entry_attribute = nil targets = sanitize_for_mass_assignment(attributes) targets.each do |key, value| unless have_attribute?(key) _schema ||= schema attribute = _schema.attribute(key) _local_entry_attribute ||= local_entry_attribute _local_entry_attribute.register(attribute) end set_attribute(key, value) end clear_changes_information end private :initialize_attributes def instantiate(args) dn, attributes, options = args options ||= {} obj = self.class.allocate obj.connection = options[:connection] || @connection obj.instance_eval do initialize_by_ldap_data(dn, attributes) end obj end def to_real_attribute_name(name, allow_normalized_name=true) return name if name.nil? if allow_normalized_name entry_attribute.normalize(name, allow_normalized_name) || local_entry_attribute.normalize(name, allow_normalized_name) else @real_names[name] ||= entry_attribute.normalize(name, false) || local_entry_attribute.normalize(name, false) end end # enforce_type # # enforce_type applies your changes without attempting to write to LDAP. # This means that if you set userCertificate to somebinary value, it will # wrap it up correctly. def enforce_type(key, value) # Enforce attribute value formatting normalize_attribute(key, value)[1] end def init_instance_variables @mutex = Mutex.new @data = {} # where the r/w entry data is stored @ldap_data = {} # original ldap entry data @dn_attribute = nil @base = nil @scope = nil @dn = nil @dn_is_base = false @dn_split_value = nil @connection ||= nil @_hashing = false clear_connection_based_cache end def register_new_dn_attribute(name, value) @dn = nil @dn_is_base = false if value.blank? @dn_split_value = nil [name, nil] else new_name, new_value, raw_new_value, new_bases = split_dn_value(value) @dn_split_value = [new_name, new_value, new_bases] if new_name.nil? and new_value.nil? new_name, raw_new_value = new_bases[0].to_a[0] end [to_real_attribute_name(new_name) || name, raw_new_value || value] end end def update_dn(new_name, new_value, bases) if new_name.nil? and new_value.nil? @dn_is_base = true @base = nil @base_value = nil attr, value = bases[0].to_a[0] @dn_attribute = attr _ = value # for suppress a warning on Ruby 1.9.3 else new_name ||= @dn_attribute || dn_attribute_of_class new_name = to_real_attribute_name(new_name) if new_name.nil? new_name = @dn_attribute || dn_attribute_of_class new_name = to_real_attribute_name(new_name) end new_bases = bases.empty? ? nil : DN.new(*bases).to_s dn_components = ["#{new_name}=#{new_value}", new_bases, self.class.base.to_s] dn_components = dn_components.find_all {|component| !component.blank?} DN.parse(dn_components.join(',')) @base = nil @base_value = new_bases @dn_attribute = new_name end end def split_dn_value(value) dn_value = relative_dn_value = nil value = value.first if value.is_a?(Array) and value.size == 1 dn_value = value if value.is_a?(DN) begin dn_value ||= DN.parse(value) rescue DistinguishedNameInvalid begin dn_value = DN.parse("#{dn_attribute}=#{value}") rescue DistinguishedNameInvalid return [nil, value, value, []] end end val = bases = nil begin relative_dn_value = dn_value base_of_class = self.class.base relative_dn_value -= base_of_class if base_of_class if relative_dn_value.rdns.empty? val = [] bases = dn_value.rdns else val, *bases = relative_dn_value.rdns end rescue ArgumentError val, *bases = dn_value.rdns end dn_attribute_name, dn_attribute_value = val.to_a[0] escaped_dn_attribute_value = nil unless dn_attribute_value.nil? escaped_dn_attribute_value = DN.escape_value(dn_attribute_value) end [dn_attribute_name, escaped_dn_attribute_value, dn_attribute_value, bases] end def need_update_dn? not @dn_split_value.nil? end def ensure_update_dn return unless need_update_dn? @mutex.synchronize do if @dn_split_value update_dn(*@dn_split_value) @dn_split_value = nil end end end def compute_dn return base if @dn_is_base ensure_update_dn dn_value = id if dn_value.nil? format = _("%s's DN attribute (%s) isn't set") message = format % [self.inspect, dn_attribute] raise DistinguishedNameNotSetError.new, message end dn_value = DN.escape_value(dn_value.to_s) _base = base _base = nil if _base.blank? DN.parse(["#{dn_attribute}=#{dn_value}", _base].compact.join(",")) end def compute_base ensure_update_dn base_of_class = self.class.base if @base_value.nil? base_of_class else base_of_object = DN.parse(@base_value) base_of_object += base_of_class if base_of_class base_of_object end end # array_of # # Returns the array form of a value, or not an array if # false is passed in. def array_of(value, to_a=true) case value when Array if to_a or value.size > 1 value.collect {|v| array_of(v, false)}.compact else if value.empty? nil else array_of(value.first, to_a) end end when Hash if to_a [value] else result = {} value.each {|k, v| result[k] = array_of(v, to_a)} result end else to_a ? [value] : value end end def normalize_data(data, except=[]) _schema = schema result = {} data.each do |key, values| next if except.include?(key) real_name = to_real_attribute_name(key) next if real_name and except.include?(real_name) real_name ||= key next if _schema.attribute(real_name).id.nil? result[real_name] ||= [] result[real_name].concat(enforce_type(real_name, values)) end result end def simplify_data(data) _schema = schema result = {} data.each do |key, values| attribute = _schema.attribute(key) if attribute.single_value? and values.is_a?(Array) and values.size == 1 values = values[0] end result[key] = type_cast(attribute, values) end result end def collect_modified_attributes(ldap_data, data) klass = self.class _dn_attribute = dn_attribute new_dn_value = nil attributes = [] # Now that all the options will be treated as unique attributes # we can see what's changed and add anything that is brand-spankin' # new. ldap_data.each do |k, v| value = data[k] || [] next if v == value value = klass.remove_blank_value(value) || [] next if v == value if klass.blank_value?(value) and schema.attribute(k).binary_required? value = [{'binary' => []}] end if k == _dn_attribute new_dn_value = value[0] else if (v.size == 1 and value.size == 1) or force_replace?(k) attributes.push([:replace, k, value]) else removed_values = v - value added_values = value - v attributes.push([:delete, k, removed_values]) unless removed_values.empty? attributes.push([:add, k, added_values]) unless added_values.empty? end end end data.each do |k, v| value = v || [] next if ldap_data.has_key?(k) value = klass.remove_blank_value(value) || [] next if klass.blank_value?(value) # Detect subtypes and account for them # REPLACE will function like ADD, but doesn't hit EQUALITY problems # TODO: Added equality(attr) to Schema if force_replace?(k) attributes.push([:replace, k, value]) else attributes.push([:add, k, value]) end end [new_dn_value, attributes] end def force_replace?(k) attribute = schema.attribute(k) attribute.single_value? or attribute.binary? # TODO: this should probably explicitly check for fields with no equality matching rule instead end def collect_all_attributes(data) dn_attr = dn_attribute dn_value = data[dn_attr] attributes = [] attributes.push([dn_attr, dn_value]) oc_value = data['objectClass'] attributes.push(['objectClass', oc_value]) except_keys = ['objectClass', dn_attr].collect(&:downcase) data.each do |key, value| next if except_keys.include?(key.downcase) value = self.class.remove_blank_value(value) next if self.class.blank_value?(value) attributes.push([key, value]) end attributes end def prepare_data_for_saving # Expand subtypes to real ldap_data attributes # We can't reuse @ldap_data because an exception would leave # an object in an unknown state ldap_data = normalize_data(@ldap_data) # Expand subtypes to real data attributes, but leave @data alone object_classes = find_object_class_values(@ldap_data) || [] original_attributes = connection.entry_attribute(object_classes).names bad_attrs = original_attributes - entry_attribute.names data = normalize_data(@data, bad_attrs) success = yield(data, ldap_data) if success @ldap_data = data.clone # Delete items disallowed by objectclasses. # They should have been removed from ldap. bad_attrs.each do |remove_me| @ldap_data.delete(remove_me) end @original_dn = dn.clone end success end end # Base end # ActiveLdap