",$text{'batch_desc'.$pft},"
\n";
print "$text{'batch_descafter'}
\n";
print "$text{'batch_descafter2'}
\n";
print "$text{'batch_descafter3'}
\n";
print "
\n"; &ui_print_footer("/", $text{'index'}); exit; } $nss = &get_nss_config(); if ($nss->{'pidfile'} || $nss->{'directory'}) { print &text('index_econfig2', "$config{'auth_ldap'}", "$gconfig{'webprefix'}/config.cgi?$module_name"),"
\n"; &ui_print_footer("/", $text{'index'}); exit; } } else { if (!$config{'ldap_host'} || !$config{'login'} || !$config{'pass'} || !$config{'user_base'} || !$config{'group_base'}) { print &text('index_ehost', "$gconfig{'webprefix'}/config.cgi?$module_name"),"
\n"; &ui_print_footer("/", $text{'index'}); exit; } } # Make sure the LDAP Perl module is installed, and if not offer to install if (!$got_net_ldap) { local @needs; foreach $m ("Convert::ASN1", "Net::LDAP") { eval "use $m"; push(@needs, $m) if ($@); } $missing = &urlize(join(" ", @needs)); print &text('index_eperl', "$missing", "/cpan/download.cgi?source=3&cpan=$missing&mode=2&". "return=/$module_name/&returndesc=". &urlize($text{'index_return'})),"
\n"; print "$text{'index_eperl2'}\n"; print "
$net_ldap_error\n"; &ui_print_footer("/", $text{'index'}); exit; } # Try to login .. may fail $ldap = &ldap_connect(1); if (!ref($ldap)) { print &text('index_eldap', $ldap, "$gconfig{'webprefix'}/config.cgi?$module_name"),"
\n"; &ui_print_footer("/", $text{'index'}); exit; } if ($config{'imap_host'}) { # Make sure the IMAP Perl module is installed, and if not offer # to install if (!$got_net_imap) { print &text('index_eperl', "Net::IMAP", "/cpan/download.cgi?source=3&cpan=Net::IMAP&mode=2&". "return=/$module_name/&returndesc=". &urlize($text{'index_return'})),"
\n"; print "$text{'index_eperl2'}\n"; print "
$net_imap_error\n"; &ui_print_footer("/", $text{'index'}); exit; } # Try to connect to the IMAP server $imap = &imap_connect(1); if (!ref($imap)) { print &text('index_eimap', $imap, "$gconfig{'webprefix'}/config.cgi?$module_name"),"
\n"; &ui_print_footer("/", $text{'index'}); exit; } } # If using MD5, make sure needed perl modules or programs are installed if ($config{'md5'} == 1) { # Check if MD5 perl module is installed, and offer to install &foreign_require("useradmin", "user-lib.pl"); if ($err = &useradmin::check_md5()) { print &text('index_emd5', "../config.cgi?$module_name", "$err", "../cpan/download.cgi?source=3&cpan=Digest::MD5&mode=2&return=/$module_name/&returndesc=".&urlize($text{'index_return'})),"
\n"; &ui_print_footer("/", $text{'index'}); exit; } } elsif ($config{'md5'} == 3) { # Check if slappasswd is installed if (!&has_command($config{'slappasswd'})) { print &text('index_eslappasswd', "../config.cgi?$module_name", "$config{'slappasswd'}"),"
\n"; &ui_print_footer("/", $text{'index'}); exit; } } # Count the number of users and groups $base = &get_user_base(); $rv = $ldap->search(base => $base, filter => '(objectClass=posixAccount)', sizelimit => $mconfig{'display_max'}+1); $ucount = $rv->count; $base = &get_group_base(); $rv = $ldap->search(base => $base, filter => '(objectClass=posixGroup)', sizelimit => $mconfig{'display_max'}+1); $gcount = $rv->count; # Get the list of users and groups if ($ucount <= $mconfig{'display_max'}) { @allulist = &list_users(); @ulist = &useradmin::list_allowed_users(\%access, \@allulist); } if ($gcount <= $mconfig{'display_max'}) { @allglist = &list_groups(); @glist = &useradmin::list_allowed_groups(\%access, \@allglist); } # Build links for adding users @links = ( ); if ($access{'ucreate'}) { push(@links, "$text{'index_uadd'}"); } if ($access{'batch'}) { push(@links, "$text{'index_batch'}"); } # Show users list header if ($ucount || $access{'ucreate'}) { print "\n"; print "
| ".&ui_subheading($text{'index_users'})." | \n"; if ($gcount || $access{'gcreate'}) { print "", "$text{'index_gjump'} | \n"; } print "
\n"; print "
\n"; print &ui_links_row(\@links); } elsif (@ulist) { # Show table of all users @ulist = &useradmin::sort_users(\@ulist, $mconfig{'sort_mode'}); &useradmin::users_table(\@ulist, $form++, 1, 0, \@links); } else { # No users $base = &get_user_base(); print "",&text('index_unone', "$base"),"\n"; print &ui_links_row(\@links); } # Show groups header if ($gcount || $access{'gcreate'}) { print "
| ".&ui_subheading($text{'index_groups'})." | \n"; if ($ucount || $access{'ucreate'}) { print "", "$text{'index_ujump'} | \n"; } print "
\n";
print &ui_links_row(\@links);
}
&ui_print_footer("/", $text{'index'});
ldap-useradmin/config.info 0100664 0005671 0000012 00000011740 10664401635 015600 0 ustar jcameron wheel line1=LDAP server options,11
auth_ldap=Linux LDAP NSS library config file,3,None
ldap_host=LDAP server host,3,From NSS config file
ldap_port=LDAP server port,3,From NSS config file or default
ldap_tls=LDAP server uses TLS?,1,1-Yes,0-No
login=Bind to LDAP server as,3,Bind name from NSS config file
pass=Credentials for bind name above,12
user_base=Base for users,3,From NSS config file
group_base=Base for groups,3,From NSS config file
other_class=Other objectClasses to add to new users,0
gother_class=Other objectClasses to add to new groups,0
given=Show fields for given name and surname?,1,1-Yes,0-No
given_class=Object class to add for given name?,0
slappasswd=Full path to slappasswd program,0
line9=LDAP attributes,11
props=LDAP properties for all new users
(In fieldname: value format),9,40,3,\t
mod_props=LDAP properties for modified users
(In fieldname: value format),9,40,3,\t
fields=Extra LDAP user properties to allow editing of
(In fieldname description format),9,40,3,\t
group_props=LDAP properties for all new groups
(In fieldname: value format),9,40,3,\t
group_mod_props=LDAP properties for modified groups
(In fieldname: value format),9,40,3,\t
group_fields=Extra LDAP group properties to allow editing of
(In fieldname description format),9,40,3,\t
multi_fields=Allow multiple values for extra properties?,1,1-Yes,0-No
noclash=Attributes for which duplicates are disallowed,0
line5=Home directory options,11
homedir_perms=Permissions on new home directories,3,From Users and Groups module
user_files=Copy files into new home directories from,3,From Users and Groups module
home_base=Automatic home directory base,3,From Users and Groups module
home_style=Automatic home directory style,4,0-home/username,1-home/u/username,2-home/u/us/username,3-home/u/s/username,4-Just base directory,5-home/primary_group/username,-From Users and Groups module
line6=New user options,11
base_uid=Lowest UID for new users,3,From Users and Groups module
base_gid=Lowest GID for new groups,3,From Users and Groups module
md5=Encryption method for passwords,1,3-LDAP MD5,1-Unix MD5,0-crypt,2-Plain text
shells=Build list of shells from,2,fixed-Builtin list,passwd-System users,shells-/etc/shells
line7=New user defaults,11
default_group=Default primary group for new users,3,From Users and Groups module
default_secs=Default secondary groups for new users,3,From Users and Groups module
default_shell=Default shell for new users,3,From Users and Groups module
default_min=Default minimum days for new users,3,From Users and Groups module
default_max=Default maximum days for new users,3,From Users and Groups module
default_warn=Default warning days for new users,3,From Users and Groups module
default_inactive=Default inactive days for new users,3,From Users and Groups module
default_expire=Default expiry date for new users (dd/mm/yyyy),3,From Users and Groups module
default_other=Create and update in other modules,1,1-Yes,0-No,-From Users and Groups module
line8=Display options,11
display_max=Maximum number of users or groups to display,3,From Users and Groups module
passwd_stars=Conceal plain-text password?,1,1-Yes,0-No,-From Users and Groups module
random_password=Generate password for new users?,1,1-Yes,0-No,-From Users and Groups module
charset=Character set for editing users and groups,3,From Webmin language
secmode=Show secondary groups on user form?,1,0-Yes,1-No,2-As text box
line2=Samba account options,11
samba_class=LDAP object class for Samba users,10,sambaAccount-sambaAccount (Samba 2),sambaSamAccount-sambaSamAccount (Samba 3),Other
samba_def=Enabled Samba account by default?,1,1-Yes,0-No
samba_domain=Domain SID for Samba3,0
samba_props=LDAP properties for new Samba users,9,40,3,\t
samba_gclass=LDAP object class for Samba groups,10,-sambaGroup (Samba 2),sambaSamGroup-sambaSamGroup (Samba 3 old schema),sambaGroupMapping-sambaGroupMapping (Samba 3 new schema),Other
samba_gid=Primary group SID,10,none-None,-Work out automatically
line3=Cyrus IMAP server options,11
imap_class=LDAP object class for IMAP users,0
imap_def=Enabled IMAP account by default?,1,1-Yes,0-No
imap_host=Cyrus IMAP server host,3,None
imap_login=Administration login for IMAP server,0
imap_pass=Administration password for IMAP server,0
imap_props=LDAP properties for new IMAP users,9,40,5,\t
imap_folders=Folders to create for new IMAP users,9,30,3,\t
imap_folderalt=Path for folders,1,1-user.$user.$folder,0-$folder
domain=Email domain for mail attribute,0,Don't add mail attributes
mailfmt=Email address format,1,0-firstname.surname@domain,1-username@domain
addressbook=Address book base,3,None
quota_support=IMAP server supports quotas?,1,1-Yes,0-No
quota=Default quota for new Cyrus users,3,None,,,kB
maillocaladdress=Attribute for mail aliases,3,Default (alias)
alias_same=Can two users have the same alias?,1,1-Yes,0-No
line4=Before and after commands,11
pre_command=Command to run before making changes,0
post_command=Command to run after making changes,0
ldap-useradmin/config-macos 0100664 0005671 0000012 00000000616 10664401635 015746 0 ustar jcameron wheel ldap_host=localhost
imap_login=cyrus
samba_class=sambaAccount
imap_class=SuSEeMailObject
imap_folders=old public sent-mail
md5=0
given=0
other_class=person inetorgperson top organizationalPerson extensibleObject apple-user
slappasswd=slappasswd
samba_def=0
imap_def=0
multi_fields=0
mailfmt=0
shells=fixed,ldap,passwd,shells
secmode=0
samba_gclass=sambaGroup
alias_same=0
given_class=inetOrgPerson
ldap-useradmin/config 0100664 0005671 0000012 00000000511 10664401635 014640 0 ustar jcameron wheel ldap_host=localhost
imap_login=cyrus
samba_class=sambaAccount
imap_class=SuSEeMailObject
imap_folders=old public sent-mail
md5=0
given=0
slappasswd=slappasswd
samba_def=0
imap_def=0
multi_fields=0
mailfmt=0
shells=fixed,ldap,passwd,shells
secmode=0
imap_folderalt=1
samba_gclass=sambaGroup
alias_same=0
given_class=inetOrgPerson
ldap-useradmin/search_user.cgi 0100775 0005671 0000012 00000002650 10664401635 016450 0 ustar jcameron wheel #!/usr/local/bin/perl
# search_user.cgi
# Ask the LDAP server to return users matching some query
require './ldap-useradmin-lib.pl';
&ReadParse();
# Do the search
$ldap = &ldap_connect();
$base = &get_user_base();
if ($in{'match'} == 0) {
$search = "($in{'field'}=$in{'what'})";
}
elsif ($in{'match'} == 1) {
$search = "($in{'field'}=*$in{'what'}*)";
}
elsif ($in{'match'} == 2) {
$search = "(!($in{'field'}=$in{'what'}))";
}
elsif ($in{'match'} == 3) {
$search = "(!($in{'field'}=*$in{'what'}*))";
}
$rv = $ldap->search(base => $base,
filter => "(&(objectClass=posixAccount)$search)");
if ($rv->code) {
&error(&text('search_err', "$search",
"$base", $rv->error));
}
@users = $rv->all_entries;
if ($in{'match'} == 6) {
# Apply less-than filter manually
@users = grep { $_->get_value($in{'field'}) < $in{'what'} } @users;
}
elsif ($in{'match'} == 7) {
# Apply greater-than filter manually
@users = grep { $_->get_value($in{'field'}) > $in{'what'} } @users;
}
if ($rv->count == 1) {
# If one result, go direct to that user
&redirect("edit_user.cgi?dn=".&urlize($users[0]->dn()));
}
else {
# List matching users
&ui_print_header(undef, $text{'search_title'}, "");
if (@users == 0) {
print "
$text{'search_notfound'}.
\n";
}
else {
@ulist = map { { &dn_to_hash($_) } } @users;
&useradmin::users_table(\@ulist, 0, 1, 0);
}
&ui_print_footer("", $text{'index_return'});
}
ldap-useradmin/save_user.cgi 0100775 0005671 0000012 00000054437 10664401635 016153 0 ustar jcameron wheel #!/usr/local/bin/perl
# save_user.cgi
# Create, update or delete an LDAP user
require './ldap-useradmin-lib.pl';
use Time::Local;
&ReadParse();
$ldap = &ldap_connect();
$schema = $ldap->schema();
if (!$in{'new'}) {
# Get existing user
$rv = $ldap->search(base => $in{'dn'},
scope => 'base',
filter => '(&(objectClass=posixAccount))');
($uinfo) = $rv->all_entries;
$uinfo || &error($text{'usave_egone'});
%ouser = &dn_to_hash($uinfo);
&can_edit_user(\%ouser) || &error($text{'usave_eedit'});
}
else {
$access{'ucreate'} || &error($text{'usave_ecreate'});
}
if ($in{'mailboxes'}) {
# Just re-direct to mailboxes page
&redirect("../mailboxes/list_mail.cgi?user=$ouser{'user'}");
exit;
}
elsif ($in{'switch'}) {
# Just re-direct to Usermin switch user program
&redirect("../usermin/switch.cgi?user=$ouser{'user'}");
exit;
}
elsif ($in{'delete'}) {
# Delete the user .. but ask first!
&ui_print_header(undef, $text{'udel_title'}, "");
$home = $uinfo->get_value("homeDirectory");
$user = $uinfo->get_value("uid");
if ($in{'confirm'}) {
# Run the before command
%uhash = &dn_to_hash($uinfo);
&set_user_envs(\%uhash, 'DELETE_USER', undef, undef);
$merr = &making_changes();
&error(&text('usave_emaking', "$merr"))
if (defined($merr));
# Work out old classes
@classes = $uinfo->get_value("objectClass");
@cyrus_class_2 = split(' ',$cyrus_class);
$wascyrus = &indexof($cyrus_class_2[0], @classes) >= 0;
# Delete from other modules
%user = &dn_to_hash($uinfo);
if ($in{'others'}) {
print "$text{'udel_other'}
\n";
&useradmin::other_modules("useradmin_delete_user",
\%user);
print "$text{'udel_done'}
\n";
}
# Delete from any groups
print "$text{'udel_groups'}
\n";
$base = &get_group_base();
$rv = $ldap->search(base => $base,
filter => '(&(objectClass=posixGroup))');
foreach $g ($rv->all_entries) {
local @mems = $g->get_value("memberUid");
local $idx = &indexof($user, @mems);
if ($idx >= 0) {
# Take out of this group
splice(@mems, $idx, 1);
$rv = $ldap->modify($g->dn(), replace =>
{ 'memberUid' => \@mems });
if ($rv->code) {
&error(&text('usave_emodgroup',
$g->get_value('cn'),
$rv->error));
}
}
}
print "$text{'udel_done'}
\n";
# Delete from the LDAP db
print "$text{'udel_pass'}
\n";
$rv = $ldap->delete($in{'dn'});
if ($rv->code) {
&error(&text('usave_edelete', $rv->error));
}
print "$text{'udel_done'}
\n";
# Delete his addressbook entry
if ($config{'addressbook'} && $wascyrus) {
print "$text{'udel_book'}
\n";
$err = &delete_addressbook();
if ($err) {
print &text('udel_failed', $err),"
\n"; } else { print "$text{'udel_done'}
\n";
}
}
# Delete his home directory
if ($in{'delhome'}) {
print "$text{'udel_home'}
\n";
$home = $uinfo->get_value("homeDirectory");
if (-d $home && $home ne "/") {
local $realhome = &resolve_links($home);
local $qhome = quotemeta($realhome);
system("rm -rf $qhome >/dev/null 2>&1");
unlink($home); # in case of links
}
print "$text{'udel_done'}
\n";
# Delete his IMAP mailbox only if home gets deleted, too
if ($config{'imap_host'}) {
print "$text{'udel_imap'}
\n";
$imap = &imap_connect();
$rv = $imap->delete("user.".$uinfo->get_value("uid"));
$imap->logout();
print "$text{'udel_done'}
\n"; } } &made_changes(); %p = ( %in, %user ); &webmin_log("delete", "user", $user{'user'}, \%p); } else { # Show confirmation page print "
\n"; } $ldap->unbind(); &ui_print_footer("", $text{'index_return'}); exit; } elsif ($in{'raw'}) { # Show all LDAP attributes for user &redirect("raw.cgi?user=1&dn=".&urlize($in{'dn'})); exit; } else { # Validate inputs &error_setup($text{'usave_err'}); $in{'user'} =~ /^[^:\t]+$/ || &error(&text('usave_ebadname', $in{'user'})); $in{'user'} =~ s/\r//g; $in{'real'} || &error($text{'usave_ereal'}); @users = split(/\n/, $in{'user'}); $user = $users[0]; $in{'uid'} =~ /^\-?[0-9]+$/ || &error(&text('usave_euid', $in{'uid'})); $uid = $in{'uid'}; $in{'real'} =~ /^[^:]*$/ || &error(&text('usave_ereal', $in{'real'})); $firstname = $in{'firstname'}; $lastname = $in{'lastname'}; $real = $in{'real'}; $shell = $in{'shell'} eq '*' ? $in{'othersh'} : $in{'shell'}; if ($in{'new'}) { &check_user_used($ldap, $user) && &error(&text('usave_einuse', $user)); } # Validate IMAP quota $quota = undef; if ($config{'quota_support'} && !$in{'quota_def'}) { $in{'quota'} =~ /^\d+$/ || &error($text{'usave_equota'}); $quota = $in{'quota'}; } # Compute and validate home directory if ($access{'autohome'}) { if ($in{'new'} || $ouser{'user'} ne $user) { $home = &auto_home_dir($access{'home'}, $user, $grp); } else { $home = $ouser{'home'}; } } elsif ($mconfig{'home_base'} && $in{'home_base'}) { $home = &auto_home_dir($mconfig{'home_base'}, $user); } else { $home = $in{'home'}; $home =~ /^\// || &error(&text('usave_ehome', $home)); } if (!$access{'autohome'}) { $home =~ /^\// || &error(&text('usave_ehome', $home)); $al = length($access{'home'}); if (length($home) < $al || substr($home, 0, $al) ne $access{'home'}) { &error(&text('usave_ehomepath', $home)); } } local $pfx = $config{'md5'} == 1 || $config{'md5'} == 3 ? "{md5}" : $config{'md5'} == 0 ? "{crypt}" : ""; if ($in{'passmode'} == 0) { # Password is blank if (!$mconfig{'empty_mode'}) { local $err = &useradmin::check_password_restrictions( "", $user); &error($err) if ($err); } $pass = ""; } elsif ($in{'passmode'} == 1) { # Password is locked $pass = $mconfig{'lock_string'}; } elsif ($in{'passmode'} == 2) { # Specific encrypted password entered, or possibly no change $pass = $in{'encpass'}; $pass = $pfx.$pass if ($pass !~ /^\{[a-z0-9]+\}/i && $pfx); } elsif ($in{'passmode'} == 3) { # Normal password entered - check restrictions local $err = &useradmin::check_password_restrictions( $in{'pass'}, $user); &error($err) if ($err); $pass = $pfx.&encrypt_password($in{'pass'}); $plainpass = $in{'pass'}; } if ($in{'disable'} && ($in{'passmode'} == 2 || $in{'passmode'} == 3)) { $pass = $useradmin::disable_string.$pass; } if ($in{'gid'} =~ /^\d+$/) { $gid = $in{'gid'}; } else { $gid = &all_getgrnam($in{'gid'}); defined($gid) || &error(&text('usave_egid', $in{'gid'})); } # Build useradmin-style hash of user details local %uhash = ( 'user' => $user, 'uid' => $uid, 'gid' => $gid, 'group' => $in{'group'}, 'real' => $real, 'shell' => $shell, 'pass' => $pass, 'plainpass' => $plainpass, 'home' => $home ); if ($in{'new'}) { defined(&all_getpwnam($user)) && &error(&text('usave_einuse', $user)); if ($in{'passmode'} == 1 || $in{'passmode'} == 2) { if ($in{'cyrus'}) { &error($text{'usave_ecyruspass'}); } } # Run the pre-change command &set_user_envs(\%uhash, 'CREATE_USER', $in{'passmode'} == 3 ? $in{'pass'} : "", undef); $merr = &making_changes(); &error(&text('usave_emaking', "$merr")) if (defined($merr)); # Create home dir if (!-e $home && $in{'makehome'}) { &lock_file($home); mkdir($home, oct($mconfig{'homedir_perms'})) || &error(&text('usave_emkdir', $!)); chmod(oct($mconfig{'homedir_perms'}), $home) || &error(&text('usave_echmod', $!)); chown($uid, $gid, $home) || &error(&text('usave_echown', $!)); &unlock_file($home); } # Get configured properties for new users local @props = &split_props($config{'props'}, \%uhash); if ($in{'cyrus'}) { push(@props, &split_props($config{'imap_props'}, \%uhash)); } # Build Samba-related properties if ($in{'samba'}) { &samba_properties(1, \%uhash, $in{'passmode'}, $in{'pass'}, $schema, \@props, $ldap); } if ($in{'cyrus'}) { # Build mail-related properties &mail_props(); } # Add any extra LDAP fields &parse_extra_fields($config{'fields'}, \@props, \@rprops, $ldap); # Add shadow LDAP fields $shadow = &shadow_fields(); # Add to the ldap database @classes = ( "posixAccount", "shadowAccount" ); push(@classes, split(/\s+/, $config{'other_class'})); push(@classes, $samba_class) if ($in{'samba'}); push(@classes, split(' ',$cyrus_class)) if ($in{'cyrus'}); &name_fields(); @classes = &unique(@classes); $base = &get_user_base(); $newdn = "uid=$user,$base"; $rv = $ldap->add($newdn, attr => [ "cn" => $real, "uid" => \@users, "uidNumber" => $uid, "loginShell" => $shell, "homeDirectory" => $home, "gidNumber" => $gid, "userPassword" => $pass, "objectClass" => \@classes, @props ]); if ($rv->code) { &error(&text('usave_eadd', $rv->error)); } if ($in{'cyrus'}) { if ($config{'addressbook'}) { # Create addressbook entry &setup_addressbook(\%uhash); } # Disconnect to save the changes $ldap->unbind(); undef($ldap); # Create imap account &setup_imap(\%uhash, $quota); # Re-connect for later LDAP operations $ldap = &ldap_connect(); } # Copy files into user's directory if ($in{'makehome'} && $mconfig{'user_files'}) { local $uf = $mconfig{'user_files'}; local $shell = $user{'shell'}; $shell =~ s/^(.*)\///g; $uf =~ s/\$group/$in{'gid'}/g; $uf =~ s/\$gid/$user{'gid'}/g; $uf =~ s/\$shell/$shell/g; &useradmin::copy_skel_files($uf, $home, $uid, $gid); } } else { # Modifying a user $olduser = $uinfo->get_value('uid'); if ($olduser ne $user) { defined(&all_getpwnam($user)) && &error(&text('usave_einuse', $user)); } # Work out old settings @classes = $uinfo->get_value("objectClass"); $wassamba = &indexof($samba_class, @classes) >= 0; @cyrus_class_2 = split(' ',$cyrus_class); $wascyrus = &indexof($cyrus_class_2[0], @classes) >= 0; if ($in{'passmode'} == 1 || $in{'passmode'} == 2) { if (!$wascyrus && $in{'cyrus'}) { &error($text{'usave_ecyruspass'}); } } # Run the pre-change command &set_user_envs(\%uhash, 'MODIFY_USER', $in{'passmode'} == 3 ? $in{'pass'} : "", undef); $merr = &making_changes(); &error(&text('usave_emaking', "$merr")) if (defined($merr)); # Rename home dir, if needed $oldhome = $uinfo->get_value("homeDirectory"); if ($home ne $oldhome && -d $oldhome && !-e $home && $in{'movehome'}) { $out = `mv '$oldhome' '$home' 2>&1`; if ($?) { &error(&text('usave_emove', $out)); } } # Change GID on files if needed $oldgid = $uinfo->get_value("gidNumber"); $olduid = $uinfo->get_value("uidNumber"); if ($oldgid != $gid && $in{'chgid'}) { if ($in{'chgid'} == 1) { &useradmin::recursive_change($home, $olduid, $oldgid, -1, $gid); } else { &useradmin::recursive_change("/", $olduid, $oldgid, -1, $gid); } } # Change UID on files if needed if ($olduid != $uid && $in{'chuid'}) { if ($in{'chuid'} == 1) { &useradmin::recursive_change($home, $olduid, -1, $uid, -1); } else { &useradmin::recursive_change("/", $olduid, -1, $uid, -1); } } # Get properties for modified users local @props = &split_props($config{'mod_props'}, \%uhash); # Work out samba-related property changes $oldpass = $uinfo->get_value('userPassword'); if ($in{'samba'}) { # Is a samba user .. add or update props $passmode = $in{'passmode'}; if ($passmode == 2 && $wassamba && $in{'encpass'} eq $oldpass) { # Not being changed $passmode = 4; } &samba_properties(!$wassamba, \%uhash, $passmode, $in{'pass'}, $schema, \@props); } elsif ($wassamba) { # Is no longer a samba user .. take away standard # samba properties &samba_removes(\%uhash, $schema, \@rprops); } # Work out imap-related property changes if ($in{'cyrus'}) { &mail_props(); } if ($in{'cyrus'} && !$wascyrus) { # Add any extra properties for IMAP users push(@props, &split_props($config{'imap_props'})); } elsif (!$in{'cyrus'} && $wascyrus) { # Take away properties for IMAP users push(@rprops, &split_first($config{'imap_props'})); &delete_mail_props(); } # Add or update any extra LDAP fields &parse_extra_fields($config{'fields'}, \@props, \@rprops, $ldap, $in{'dn'}); # Add or update shadow LDAP fields $shadow = &shadow_fields(); # Update the ldap database if ($in{'samba'}) { push(@classes, $samba_class); } else { @classes = grep { $_ ne $samba_class } @classes; } if ($in{'cyrus'}) { push(@classes, split(' ',$cyrus_class)); } else { @cyrus_class_4 = split(' ',$cyrus_class); foreach $one_cyrus_class (@cyrus_class_4) { @classes = grep { $_ ne $one_cyrus_class } @classes; } } push(@classes, "shadowAccount") if ($shadow); &name_fields(); @classes = &unique(@classes); @rprops = grep { defined($uinfo->get_value($_)) } @rprops; $newdn = $in{'dn'}; $rv = $ldap->modify($in{'dn'}, replace => { "cn" => $real, "uid" => \@users, "uidNumber" => $uid, "loginShell" => $shell, "homeDirectory" => $home, "gidNumber" => $gid, "userPassword" => $pass, "objectClass" => [ &unique(@classes) ], @props }, 'delete' => \@rprops); if ($rv->code) { &error(&text('usave_emod', $rv->error)); } if ($olduser ne $user) { # Need to rename the LDAP dn itself $renaming = 1; $base = &get_user_base(); $newdn = "uid=$user,$base"; $rv = $ldap->moddn($in{'dn'}, newrdn => "uid=$user"); if ($rv->code) { &error(&text('usave_emoddn', $rv->error)); } # Check if an addressbook dn exists local $olda = "ou=$olduser, $config{'addressbook'}"; $rv = $ldap->search(base => $olda, scope => 'base', filter => '(&(objectClass=organizationalUnit))'); ($oldbook) = $rv->all_entries; if ($oldbook) { # Need to rename the addressbook dn $rv = $ldap->modify($olda, replace => { "ou" => $user }); if ($rv->code) { &error(&text('usave_emodbook', $rv->error)); } $rv = $ldap->moddn($olda, newrdn => "ou=$user"); if ($rv->code) { &error(&text('usave_emodbookdn', $rv->error)); } } } if ($in{'cyrus'} && !$wascyrus) { # Adding IMAP support if ($config{'addressbook'}) { # Create addressbook entry &setup_addressbook(); } # Setup the imap account as well &setup_imap(\%uhash, $quota); } elsif (!$in{'cyrus'} && $wascyrus) { # Removing IMAP support if ($config{'addressbook'}) { # Delete addressbook entry &delete_addressbook(); } } elsif ($in{'cyrus'} && $wascyrus) { # Changing IMAP support if (!$in{'quota_def'}) { &set_imap_quota(\%uhash, $in{'quota'}); } } } if ($config{'secmode'} != 1) { # Update any groups that the user has been added to/removed from @sgnames = $config{'secmode'} == 2 ? split(/\s+/, $in{'sgid'}) : split(/\0/, $in{'sgid'}); foreach $gname (@sgnames) { $ingroup{$gname}++; } $base = &get_group_base(); $rv = $ldap->search(base => $base, filter => '(&(objectClass=posixGroup))'); foreach $g ($rv->all_entries) { local @mems = $g->get_value("memberUid"); local $gname = $g->get_value("cn"); if ($renaming) { local $idx = &indexof($olduser, @mems); if ($ingroup{$gname} && $idx<0) { # Need to add to the group push(@mems, $user); } elsif (!$ingroup{$gname} && $idx>=0) { # Need to remove from the group splice(@mems, $idx, 1); } elsif ($idx >= 0) { # Need to rename in group $mems[$idx] = $user; } else { next; } } else { local $idx = &indexof($user, @mems); if ($ingroup{$gname} && $idx<0) { # Need to add to the group push(@mems, $user); } elsif (!$ingroup{$gname} && $idx>=0) { # Need to remove from the group splice(@mems, $idx, 1); } else { next; } } # Actually change the group $rv = $ldap->modify($g->dn(), replace => { 'memberUid' => \@mems }); if ($rv->code) { &error(&text('usave_emodgroup', $g->get_value('cn'), $rv->error)); } } } # Get the updated user object $rv = $ldap->search(base => $newdn, scope => 'base', filter => '(&(objectClass=posixAccount))'); ($uinfo) = $rv->all_entries; %user = &dn_to_hash($uinfo); # Run post-change script &set_user_envs(\%user, $in{'new'} ? 'CREATE_USER' : 'MODIFY_USER', $in{'passmode'} == 3 ? $in{'pass'} : "", undef); &made_changes(); # Run other modules' scripts if ($in{'others'}) { $user{'passmode'} = $in{'passmode'}; if ($in{'passmode'} == 2 && $user{'pass'} eq $ouser{'pass'}) { # not changing password $user{'passmode'} = 4; } $user{'plainpass'} = $in{'pass'} if ($in{'passmode'} == 3); $ldap->unbind(); # force commit? if (!$in{'new'}) { $user{'olduser'} = $ouser{'user'}; &useradmin::other_modules("useradmin_modify_user", \%user, \%ouser); } else { &useradmin::other_modules("useradmin_create_user", \%user); } } } $ldap->unbind(); delete($in{'pass'}); delete($in{'passmode'}); &webmin_log(!$in{'new'} ? 'modify' : 'create', 'user', $user, \%in); &redirect($in{'return'} || ""); # mail_props() # Add properties for mail and aliases sub mail_props { # Do nothing if no domain is set return if (!$config{'domain'}); # Add surname and first name details local ($autofirstname, $autolastname); if ($firstname && $lastname) { $autofirstname = $firstname; $autolastname = $lastname; } elsif ($in{'real'} =~ /(\S+)\s+(\S+)$/) { $autofirstname = lc($1); $autolastname = lc($2); } elsif ($in{'real'} =~ /(\S+)/) { $autofirstname = lc($1); } else { $autofirstname = lc($in{'user'}); } if ($autolastname) { if (&in_schema($schema, "mail")) { if ($config{'mailfmt'} == 0) { push(@props, "mail", "$autofirstname.$autolastname\@$config{'domain'}") } else { push(@props, "mail", "$user\@$config{'domain'}") } } } else { push(@props, "mail", "$autofirstname\@$config{'domain'}") if (&in_schema($schema, "mail")); } # Add extra aliases local $aattr = $config{'maillocaladdress'} || "alias"; if (&in_schema($schema, $aattr)) { local @alias = split(/\s+/, $in{'alias'}); if ($in{'alias'}) { if (!$config{'alias_same'}) { ($dup, $dupwhat) = &check_duplicates($ldap, $aattr, \@alias, $in{'dn'}); $dup && &error(&text('save_ealiasdup', $dupwhat, $dup->dn())); } push(@props, $aattr, \@alias); } else { push(@rprops, $aattr); } } local $battr = $config{'mailroutingaddress'}; push(@props, $battr, lc($in{'user'})."\@$config{'imap_host'}") if ($battr ne "") && (&in_schema($schema, $battr)); } # delete_mail_props() # Take away any extra properties added by mail_props sub delete_mail_props { local $aattr = $config{'maillocaladdress'} || "alias"; if (&in_schema($schema, $aattr)) { push(@rprops, $aattr); } local $battr = $config{'mailroutingaddress'}; if (($battr ne "") && &in_schema($schema, $battr)) { push(@rprops, $battr); } push(@rprops, "mail") if (&in_schema($schema, "mail")); } sub delete_addressbook { return &delete_ldap_subtree($ldap, "ou=$user, $config{'addressbook'}"); } sub name_fields { if ($config{'given'}) { if ($firstname) { if (&in_schema($schema, "gn")) { push(@props, "gn", $firstname); } elsif (&in_schema($schema, "givenName")) { push(@props, "givenName", $firstname) } } if ($lastname && &in_schema($schema, "sn")) { push(@props, "sn", $lastname); } if ($firstname || $lastname) { push(@classes, $config{'given_class'}); } } if (&in_schema($schema, "gecos")) { push(@props, "gecos", &remove_accents($in{'real'})); } } sub shadow_fields { if (&in_schema($schema, "shadowLastChange")) { # Validate shadow-password inputs $in{'min'} =~ /^\-?[0-9]*$/ || &error(&text('usave_emin', $in{'min'})); if ($in{'min'} ne '') { push(@props, "shadowMin", $in{'min'}); } else { push(@rprops, "shadowMin"); } $in{'max'} =~ /^\-?[0-9]*$/ || &error(&text('usave_emax', $in{'max'})); if ($in{'max'} ne '') { push(@props, "shadowMax", $in{'max'}); } else { push(@rprops, "shadowMax"); } if ($in{'expired'} ne "" && $in{'expirem'} ne "" && $in{'expirey'} ne "") { eval { $expire = timelocal(0, 0, 12, $in{'expired'}, $in{'expirem'}-1, $in{'expirey'}-1900); }; if ($@) { &error($text{'usave_eexpire'}); } push(@props, "shadowExpire", int($expire / (60*60*24))); } else { push(@rprops, "shadowExpire"); } $in{'warn'} =~ /^\-?[0-9]*$/ || &error(&text('usave_ewarn', $in{'warn'})); if ($in{'warn'} ne '') { push(@props, "shadowWarning", $in{'warn'}); } else { push(@rprops, "shadowWarning"); } $in{'inactive'} =~ /^\-?[0-9]*$/ || &error(&text('usave_einactive', $in{'inactive'})); if ($in{'inactive'} ne '') { push(@props, "shadowInactive", $in{'inactive'}); } else { push(@rprops, "shadowInactive"); } if ($in{'passmode'} == 3 || $in{'passmode'} == 2 && $pass ne $oldpass) { $daynow = int(time() / (60*60*24)); push(@props, "shadowLastChange", $daynow); } return 1; } else { return 0; } } ldap-useradmin/search_group.cgi 0100775 0005671 0000012 00000002407 10664401635 016626 0 ustar jcameron wheel #!/usr/local/bin/perl # search_group.cgi # Ask the LDAP server to return groups matching some query require './ldap-useradmin-lib.pl'; &ReadParse(); # Do the search $ldap = &ldap_connect(); $base = &get_group_base(); if ($in{'match'} == 0) { $search = "($in{'field'}=$in{'what'})"; } elsif ($in{'match'} == 1) { $search = "($in{'field'}=*$in{'what'}*)"; } elsif ($in{'match'} == 2) { $search = "(!($in{'field'}=$in{'what'}))"; } elsif ($in{'match'} == 3) { $search = "(!($in{'field'}=*$in{'what'}*))"; } $rv = $ldap->search(base => $base, filter => "(&(objectClass=posixGroup)$search)"); if ($rv->code) { &error(&text('search_err', "$search", "$base", $rv->error)); } @groups = $rv->all_entries; if ($in{'match'} == 6) { # Apply less-than filter manually @groups = grep { $_->get_value($in{'field'}) < $in{'what'} } @groups; } elsif ($in{'match'} == 7) { # Apply greater-than filter manually @groups = grep { $_->get_value($in{'field'}) > $in{'what'} } @groups; } &ui_print_header(undef, $text{'search_title'}, ""); if (@groups == 0) { print "$text{'search_gnotfound'}.
\n";
}
else {
@glist = map { { &dn_to_hash($_) } } @groups;
&useradmin::groups_table(\@glist, 0, 1);
}
&ui_print_footer("", $text{'index_return'});
ldap-useradmin/config-debian-squirrelmail-linux 0100664 0005671 0000012 00000000754 10664401635 021735 0 ustar jcameron wheel auth_ldap=/etc/ldap/ldap.conf
imap_login=cyrus
samba_class=sambaSamAccount
imap_class=SquirrelMailUser inetLocalMailRecipient
imap_folders=old public sent-mail
md5=0
given=0
slappasswd=slappasswd
maillocaladdress=mailLocalAddress
mailroutingaddress=mailRoutingAddress
mailsyntax_first=$firstname
mailsyntax_sep=.
mailsyntax_last=$surname
samba_def=0
imap_def=0
multi_fields=0
mailfmt=0
shells=fixed,ldap,passwd,shells
secmode=0
samba_gclass=sambaGroup
alias_same=0
given_class=inetOrgPerson
ldap-useradmin/help/ 0040775 0005671 0000012 00000000000 10664401636 014407 5 ustar jcameron wheel ldap-useradmin/help/intro.html 0100664 0005671 0000012 00000003313 10664401635 016424 0 ustar jcameron wheel
Naturally, an LDAP server must be running on your system or on some host on your network for this module to be used. In addition, one or most hosts must be configured to use LDAP for user and/or group authentication. Neither of these tasks can be done from within the module - they must be done manually, or with other Webmin modules for the purpose.
If you have Samba configured to use an LDAP server as well, this module can also create and manage the necessary password attributes for each LDAP user to be able to login to the Samba server as well. For this feature to work, your LDAP server must be configured to support the additional Samba attributes and object class for each user in its schema. Only when the Samba login? option is set to Yes will the Samba attributes be created.
The module can also create users on a Cyrus IMAP server, if it is set up to authenticate against the same LDAP database. It will create mailboxes for each new user, subscribe the user to his mailboxes and grant admin access to them. If an LDAP user is deleted, his IMAP mailbox will be as well. Currently this feature only works with the Cyrus IMAP server - it has not been tested and is probably not even necessary for other servers, which use users' home directories for mail storage.
Naturalment, hi ha d'haver un servidor LDAP executant-se al sistema o en algun host de la xarxa per poder fer servir aquest mdul. A ms a ms, cal configurar un o ms hosts per a utilitzar LDAP per autenticar usuaris i/o grups. No es pot fer cap d'aquestes tasques des d'aquest mdul -s'han de fer manualment, o amb altres mduls Webmin per aquest propsit.
Si tamb tens Samba configurat per utilitzar un servidor LDAP, aquest mdul pot tamb crear i gestionar els atributs de contrasenyes necessaris per tal que cada usuari LDAP pugui entrar tamb al servidor Samba. Per tal que aquesta caracterstica funcioni, s'ha de configurar el servidor LDAP per suportar els atributs addicionals Samba i la classe d'objecte per a cada usuari en el seu esquema. Noms es crearam les atributs Samba quan l'opci Usuaris Samba estigui a S.
El mdul tamb pot crear usuaris en un servidor IMAP Cyrus, si est configurat per a l'autenticaci contra la mateixa base de dades LDAP. Crear bsties per a cada nou usuari, subscriur l'usuari a les seves bsties i li donar permisos d'administrador sobre les mateixes. Si se suprimeix un usuari LDAP, la seva bstia IMAP tamb ho ser. Actualment, aquesta caracterstica noms funciona amb el servidor IMAP Cyrus - no s'ha provat i probablement no sigui necessari per altres servidors, que fan servir el directori arrel de l'usuari per a emmagatzemar el correu.
name1: value1
name2: value2
The following substitutions can be used, which are replaced when the user is saved :
${USER} The user's login name
${PLAINPASS} The user's un-encrypted password, if one was given
${REAL} The user's real name
${UID} The user's Unix UID number
${GID} The user's Unix group ID number
${HOME} The user's home directory
${SHELL} The user's login shell