ansible-ldap-modules/ldap_upsert

#!/usr/bin/env python

from traceback import format_exc

import ldap
import ldap.modlist
import ldap.sasl

DOCUMENTATION = """
---
module: ldap_upsert
short_description: Insert or update an LDAP entry.
description:
    - Insert or update an LDAP entry. Existing entries with matching
      C(dn) will have their attributes updated.  Otherwise a new entry
      will be created with the given attributes.  This module cannot
      delete entries or remove attributes, see M(ldap_entry) and
      M(ldap_attr), respectively.
notes: []
version_added: null
author: Peter Sagerson
requirements:
    - python-ldap
options:
    dn:
        required: true
        description:
            - The DN of the entry to insert or update.
    objectClass:
        required: true
        description:
            - Must be a list of objectClass values to use when
              creating the entry. It can either be a string containing
              a comma-separated list of values, or an actual list of
              strings.  When updating, these values are not used.
    '...':
        required: false
        description:
            - All additional arguments are taken to be LDAP attribute
              names like C(objectClass), with similar lists of values.
              If the entry exists, these attributes will be updated if
              necessary.  Otherwise the newly created entry will have
              these attributes.
    server_uri:
        required: false
        default: ldapi:///
        description:
            - A URI to the LDAP server. The default value lets the underlying
              LDAP client library look for a UNIX domain socket in its default
              location.
    start_tls:
        required: false
        default: false
        description:
            - If true, we'll use the START_TLS LDAP extension.
    bind_dn:
        required: false
        description:
            - A DN to bind with. If this is omitted, we'll try a SASL bind with
              the EXTERNAL mechanism. If this is blank, we'll use an anonymous
              bind.
    bind_pw:
        required: false
        description:
            - The password to use with C(bind_dn).
"""


EXAMPLES = """
# Make sure we have a parent entry for users.
- ldap_entry: dn='ou=users,dc=example,dc=com' objectClass=organizationalUnit description="My Org Unit"
  sudo: true

# Make sure we have an admin user.
- ldap_entry:
    dn: 'cn=admin,dc=example,dc=com'
    objectClass: simpleSecurityObject,organizationalRole
    description: An LDAP administrator
    userPassword: '{SSHA}pedsA5Y9wHbZ5R90pRdxTEZmn6qvPdzm'
  sudo: true
"""

def main():
    module = AnsibleModule(
        argument_spec={
            'dn': dict(required=True),
            'server_uri': dict(default='ldapi:///'),
            'start_tls': dict(default='false', choices=(list(BOOLEANS)+['True', True, 'False', False])),
            'bind_dn': dict(default=None),
            'bind_pw': dict(default='', no_log=True),
        },
        check_invalid_arguments=False,
        supports_check_mode=False,
    )

    try:
        LdapUpsert(module).main()
    except ldap.LDAPError, e:
        module.fail_json(msg=str(e), exc=format_exc())


class LdapUpsert(object):

    def __init__(self, module):
        self.module = module

        # Parameters that we have to directly pass to python-ldap need
        # to converted to UTF-8 first, as python-ldap doesn't
        # understand unicode strings.
        
        # Server parameters
        self.server_uri = self.module.params['server_uri']
        self.start_tls  = self.module.boolean(self.module.params['start_tls'])
        self.bind_dn    = self._utf8_param('bind_dn')
        self.bind_pw    = self._utf8_param('bind_pw')

        # Entry parameters
        self.dn = self._utf8_param('dn')
        self._load_attrs()

        if 'objectClass' not in self.attrs:
            self.module.fail_json(msg="At least one objectClass must be provided")

    def _force_utf8(self, value):
        """If value is Unicode, encode to UTF-8."""
        if isinstance(value, unicode):
            return value.encode('utf-8')
        return value

    def _utf8_param(self, name):
        """Extract a parameter as UTF-8."""
        return self._force_utf8(self.module.params[name])

    def _load_attrs(self):
        self.attrs = {}
        for name, raw in self.module.params.iteritems():
            if name not in self.module.argument_spec:
                self.attrs[name] = self._load_attr_values(name, raw)
        
    def _load_attr_values(self, name, raw):
        if isinstance(raw, basestring):
            values = raw.split(',')
        else:
            values = raw

        if not (isinstance(values, list) and all(isinstance(value, basestring) for value in values)):
            self.module.fail_json(msg="{} must be a string or list of strings.".format(name))

        return list(map(self._force_utf8, values))
        
            
    def main(self):
        if self.entry_exists():
            results = self.update_entry()
            self.module.exit_json(**results)
        else:
            insert_result = self.insert_entry()
            self.module.exit_json(changed=True, results=[insert_result])

    def entry_exists(self):
        try:
            results = self.connection.search_s(self.dn, ldap.SCOPE_BASE)
            for result in results:
                if result[0] == self.dn:
                    return True
        except ldap.NO_SUCH_OBJECT:
            return False
    
    def insert_entry(self):
        modlist = ldap.modlist.addModlist(self.attrs)
        result  = self.connection.add_s(self.dn, modlist)
        return result

    def update_entry(self):
        results = []
        for attr, values in self.attrs.iteritems():
            if attr == 'objectClass': continue
            check = self._attribute_values_check(attr, values)
            if check is False:
                op = ldap.MOD_REPLACE
            elif check is None:
                op = ldap.MOD_ADD
            else:
                op = None       # Nothing to see here...
            if op is not None:
                result = self.connection.modify_s(self.dn, [(op, attr, values)])
                results.append(result)
        if len(results) == 0:
            return dict(changed=False)
        else:
            return dict(changed=True, results=results)

    def _attribute_values_check(self, attr, values):
        try:
            return all(self._attribute_value_check(attr, value) for value in values)
        except ldap.NO_SUCH_ATTRIBUTE:
            return None
        
    def _attribute_value_check(self, attr, value):
        return bool(self.connection.compare_s(self.dn, attr, value))

    #
    # LDAP Connection
    #
    _connection = None

    @property
    def connection(self):
        """ An authenticated connection to the LDAP server (cached). """
        if self._connection is None:
            self._connection = self._connect_to_ldap()

        return self._connection
        
    def _connect_to_ldap(self):
        connection = ldap.initialize(self.server_uri)

        if self.start_tls:
            connection.start_tls_s()

        if self.bind_dn is not None:
            connection.simple_bind_s(self.bind_dn, self.bind_pw)
        else:
            connection.sasl_interactive_bind_s('', ldap.sasl.external())

        return connection
        
from ansible.module_utils.basic import *  # noqa
main()