return 0
}
The arguments to the function are:
●
The host where the site LDAP server is running ($1)
●
The distinguished name of the table to search on that server for the user ($2)
●
The TCP/IP port number on which the server is running (by default, not specified which lets
ldapsearch
choose a default of 389) ($3)
●
The name of the field containing the user's name (by default
uid
) ($4)
This is used to compose an
ldapsearch
command that is then filtered and reduced to a list of user names by
the
grep
and
sed
commands that follow it in the pipe line.
If the site LDAP has a way to distinguish users with access to Urika-GX using some user attribute, group
membership, etc., querying might return all the users in a particular group or set of groups instead of simply taking
the complete list of users.
Along similar lines, it may be required to gather the names of users based on tenant membership using, for
example, group membership. In that case, go through users in a tenant, then possibly through users with relaxed
access, and then install them differently:
●
the tenant users with tenant membership and restricted access, i.e., not specifying a
crayLoginShell
value
in the
ux-tenant-add-user
command
●
the users with relaxed access (who might be a subset of users with tenant access) by searching for a different
group membership, then:
○
getting the user's
loginShell
value to use as a
crayLoginShell
value when relaxing the user
○
adding each user using the
ux-tenant-add-user
command with no tenants specified. This will not
alter existing user entries, but will add the new ones in restricted mode with no tenant membership.
○
relaxing each user (as appropriate) using the
ux-tenant-relax
command, while specifying the user's
crayLoginShell
value using the -s option
The code this script uses to look up the
loginShell
(or equivalent) parameter is:
# Read the shell attribute for the specified user from LDAP and return
# the value as a string
get_user_shell() {
user="${1}"
host="-h ${2}"
search_dn="-b ${3}"
port=""
query="-t uid"
user_field="uid"
shell_field="loginShell"
if [ ! -z "${4}" ]; then
port="-p ${4}"
fi
if [ ! -z "${5}" ]; then
user_field="${5}"
fi
if [ ! -z "${6}" ]; then
shell_field=${6}
fi
if [ ! -z "${5}" ]; then
passwd="-w ${5} -x"
fi
if [ ! -z "${6}" ]; then
port="-p ${6}"
fi
query="-t ${user_field}=${user} ${shell_field}"
Security
S3016
213
