search="ldapsearch ${host} ${port} -x ${search_dn} ${query}"
grep="grep ^${shell_field}:[[:space:]]"
sed="sed -e s/${shell_field}:[[:space:]][[:space:]]*//"
if ! out="$(${search} | ${grep} | ${sed})"; then
return 1
fi
echo ${out}
return 0
}
Again, the parameters to the function specify the information needed to set up the
ldapsearch
command. The
ldapsearch
results are then filtered and processed by
grep
and
sed
to produce the
loginShell
value.
Putting all of this together in the main body of the script, here is the code that actually retrieves the data and
builds the users:
for u in ${users}; do
if ! shell="$(get_user_shell "${u}" "${host}" "${search_dn}" "${port}" "${user_field}" "$
{shell_field}")"; then
echo "WARNING: could not find shell for '${u}', skipping..."
continue
fi
if [ -z "${remove_flag}" ]; then
if [ -z "${dry_run}" ]; then
echo "Adding user '${u}' with crayLoginShell '${shell}'"
if ! ux-tenant-add-user -s "${shell}" -u "${u}" ; then
echo "WARNING: adding user '${u}' with crayLoginShell '${shell}' failed, skipping this
user"
continue
fi
else
echo "Not really adding user '${u}' with crayLoginShell '${shell}' (dry-run)"
fi
else
if [ -z "${dry_run}" ]; then
echo "Removing user '${u}'"
if ! ux-tenant-remove-user -u "${u}" ; then
echo "WARNING: removing user '${u}' failed, skipping this user"
continue
fi
else
echo "Not really removing user '${u}' (dry-run)"
fi
fi
done
It can be seen that the script adds a user using the
ux-tenant-add-user
command in the following detail:
if ! ux-tenant-add-user -s "${shell}" -u "${u}" ; then
echo "WARNING: adding user '${u}' with crayLoginShell '${shell}' failed, skipping this user"
continue
fi
Notice that this code uses the -s option to
ux-tenant-add-user
to set the
crayLoginShell
value to the
loginShell
value for the user. This is because this script was designed to import all users with relaxed user
access, so it defines the users in one step.
Another way to achieve the same thing would be to do it in two steps:
if ! ux-tenant-add-user -s "${shell}" -u "${u}" ; then
echo "WARNING: adding user '${u}' failed, skipping this user"
continue
fi
if ! ux-tenant-relax -s "${shell}" ${u} ' ; then
echo "WARNING: relaxing access for user '${u}' failed, this user may be restricted"
fi
This allows adding checks for whether or not the user should have relaxed user access before actually relaxing
the user.
Security
S3016
214
