def _create_user(self, username, password, name, surname):
     # FIXME ms windows stores strings as UTF-8 while mmc base module waits for ascii
     # them so we decode
     #         username = username.decode('utf-8)')
     #         name = name.decode('utf-8)').encode('ascii', errors='replace')
     #         surname = surname.decode('utf-8)').encode('ascii', errors='replace')
     logger.debug('calling ldapUserGroupControl().addUser(%s, %s, %s, %s)',
                  username, password, name, surname)
     ldapUserGroupControl().addUser(username, password, name, surname)

 def _cbProvisioning(self, auth, authtoken):
     """
     Provision the MMC user account with ACLs
     """
     if not auth:
         self.logger.warning("User authentication with GLPI web interface failed, but going on with provisioning")
     profiles = Glpi().getUserProfiles(authtoken.getLogin())
     self.logger.debug("User %s GLPI profiles: %s" % (authtoken.getLogin(), str(profiles)))
     selected = None
     for profile in self.config.profilesOrder:
         if profile in profiles:
             selected = profile
             break
     if not selected:
         self.logger.info("User GLPI profile can't be applied")
     else:
         self.logger.debug("Selected GLPI profile is %s" % selected)
         try:
             acls = self.config.profilesAcl[selected.lower()]
         except KeyError:
             acls = None
         if not acls:
             self.logger.info("No ACL to apply for the GLPI profile %s" % selected)
         else:
             l = ldapUserGroupControl()
             self.logger.info("Setting MMC ACL corresponding to GLPI profile %s: %s" % (selected, acls))
             uid = authtoken.getLogin()
             entry = l.getDetailedUser(uid)
             if not "lmcUserObject" in entry["objectClass"]:
                 entry["objectClass"].append("lmcUserObject")
                 l.changeUserAttributes(uid, "objectClass", entry["objectClass"])
             l.changeUserAttributes(authtoken.getLogin(), "lmcAcl", acls)
     return authtoken

    def getACLOnShare(self, name):
        """
        Return a list with all the groups that have rwx access to the share.

        @param name: name of the share (last component of the path)
        @type name: str

        @rtype: tuple
        @return: tuple of groups, users that have rwx access to the share.
        """
        path = self.getContent(name, "path")
        ret = ([], [])
        ldapobj = ldapUserGroupControl()
        acl1 = posix1e.ACL(file=path)
        for e in acl1:
            if e.permset.write:
                if e.tag_type == posix1e.ACL_GROUP:
                    res = ldapobj.getDetailedGroupById(str(e.qualifier))
                    if res:
                        ret[0].append(res['cn'][0])
                    else:
                        ret[0].append(grp.getgrgid(e.qualifier).gr_name)
                if e.tag_type == posix1e.ACL_USER:
                    res = ldapobj.getDetailedUserById(str(e.qualifier))
                    if res:
                        ret[1].append(res['uid'][0])
                    else:
                        ret[1].append(pwd.getpwuid(e.qualifier).pw_name)

        return ret

 def setUp(self):
     cleanLdap()
     self.l = ldapUserGroupControl("tests-mds/basetest.ini")
     self.l.addGroup("grouptestA")
     self.l.addGroup("grouptestB")
     os.system("cp contrib/samba/smb.conf /etc/samba/smb.conf")
     self.s = smbConf(conffile="tests-mds/sambatest.ini", conffilebase="tests-mds/basetest.ini")
     os.system("rm -fr %s" % self.s.defaultSharesPath)

 def doProvisioning(self, authtoken):
     from mmc.plugins.base import ldapUserGroupControl
     self.logger.debug(str(authtoken.getInfos()))
     l = ldapUserGroupControl()
     userentry = authtoken.getInfos()[1]
     uid = userentry[self.config.ldap_uid][0]
     if l.existUser(uid):
         self.logger.debug("User %s already exists, so this user won't be added" % uid)
     else:
         givenName = userentry[self.config.ldap_givenName][0].decode("utf-8")
         sn = userentry[self.config.ldap_sn][0].decode("utf-8")
         l.addUser(uid, authtoken.getPassword(), givenName, sn)
     if self.config.profileAttr and self.config.profilesAcl:
         # Set or update the user right
         try:
             profile = userentry[self.config.profileAttr][0].lower()
         except KeyError:
             self.logger.info("No profile information for user %s in attribute %s" % (uid, self.config.profileAttr))
             profile = ""
         profile = profile.strip()
         try:
             acls = self.config.profilesAcl[profile]
         except KeyError:
             self.logger.info("No ACL defined in configuration file for profile '%s'" % profile)
             self.logger.info("Setting ACL to empty")
             acls = None
         if profile and acls:
             self.logger.info("Setting MMC ACL corresponding to user profile %s: %s" % (profile, str(acls)))
         entry = l.getDetailedUser(uid)
         if not "lmcUserObject" in entry["objectClass"]:
             entry["objectClass"].append("lmcUserObject")
             l.changeUserAttributes(uid, "objectClass", entry["objectClass"])
         l.changeUserAttributes(uid, "lmcAcl", acls)
         if self.config.profileGroupMapping:
             # Set user group membership according to mapping
             for prof in self.config.profilesAcl:
                 groupname = self.config.profileGroupPrefix + prof
                 if prof != profile:
                     # Delete the user from a group not belonging to her/his
                     # profile
                     try:
                         l.delUserFromGroup(groupname, uid)
                         self.logger.debug('Deleting user %s from group %s' % (uid, groupname))
                     except ldap.NO_SUCH_OBJECT:
                         # The group does not exist
                         pass
                 else:
                     # Add the user to this group
                     try:
                         l.addGroup(groupname)
                     except ldap.ALREADY_EXISTS:
                         # This group already exists
                         pass
                     self.logger.debug('Adding user %s to group %s' % (uid, groupname))
                     l.addUserToGroup(groupname, uid)

def activate():
    ldapObj = ldapUserGroupControl()
    logger = logging.getLogger()

    config = MailConfig("mail")
    if config.disabled:
        logger.warning("Plugin mail: disabled by configuration.")
        return False

    mailSchema = {
        "mailAccount" : ["mail", "mailalias", "maildrop", "mailenable", "mailbox", "mailuserquota", "mailhost", "mailproxy"],
        "mailGroup" : ["mail"],
        "mailDomain" : ["virtualdomain", "virtualdomaindescription", "mailuserquota"],
        }

    # Additional LDAP classes/attributes to check for ZARAFA support
    if config.zarafa:
        mailSchema['zarafa-user'] = ['zarafaAdmin', 'zarafaSharedStoreOnly',
                                     'zarafaAccount', 'zarafaSendAsPrivilege',
                                     'zarafaHidden']
        mailSchema['zarafa-group'] = []

    # Additional LDAP classes for virtual aliases
    if config.vAliasesSupport:
        mailSchema['mailAlias'] = ['mailaliasmember']

    for objectClass in mailSchema:
        schema = ldapObj.getSchema(objectClass)
        if not len(schema):
            logger.error("LDAP mail schema is not up to date: %s objectClass is not included in LDAP directory" % objectClass)
            return False
        for attribute in mailSchema[objectClass]:
            if not attribute in schema:
                logger.error("LDAP mail schema is not up to date: %s attribute is not included in LDAP directory" % attribute)
                return False

    if config.vAliasesSupport:
        # Create required OU
        head, path = config.vAliasesDN.split(",", 1)
        ouName = head.split("=")[1]
        ldapObj.addOu(ouName, path)

    if config.vDomainSupport:
        # Create required OU
        head, path = config.vDomainDN.split(",", 1)
        ouName = head.split("=")[1]
        ldapObj.addOu(ouName, path)

    return True

def activate():
    ldapObj = ldapUserGroupControl()
    logger = logging.getLogger()

    config = UserSshKeyConfig("sshlpk")
    if config.disabled:
        logger.warning("Plugin sshlpk: disabled by configuration.")
        return False

    sshkeySchema = ['posixAccount', 'ldapPublicKey']

    for objectClass in sshkeySchema:
        schema = ldapObj.getSchema(objectClass)
        if not len(schema):
            logger.error("OpenSSH LDAP public key schema is not available: %s objectClass is not included in LDAP directory" % objectClass);
            return False

    return True

    def getACLOnShare(self, name):
        """
        Return a list with all the groups that have rwx access to the share.

        @param name: name of the share (last component of the path)
        @type name: str

        @rtype: dict
        @return: dict of permissions: [list of users/groups]
        """
        ldapobj = ldapUserGroupControl(self.conffilebase)
        path = self.getContent(name, "path")
        public = self.getContent(name, "public")
        perms = {'rx': [], 'rwx': []}
        if path is False:
            return perms
        if public == "yes":
            return {'rwx': ['@all']}
        acls = posix1e.ACL(file=path)
        for e in acls:
            permset = zip(['r', 'w', 'x'], [e.permset.read, e.permset.write, e.permset.execute])
            perm = ''.join([r for r, b in permset if b is True])
            entity = ""

            if e.tag_type == posix1e.ACL_GROUP:
                res = ldapobj.getDetailedGroupById(str(e.qualifier))
                if res:
                    entity = '@' + res['cn'][0]
                else:
                    entity = '@' + grp.getgrgid(e.qualifier).gr_name

            if e.tag_type == posix1e.ACL_USER:
                res = ldapobj.getDetailedUserById(str(e.qualifier))
                if res:
                    entity = res['uid'][0]
                else:
                    entity = pwd.getpwuid(e.qualifier).pw_name

            if perm not in perms and entity:
                perms[perm] = [entity]
            elif entity:
                perms[perm].append(entity)

        return perms

def cleanLdap():
    # Wipe out /home
    os.system("rm -fr /home/*")
    # Wipe out LDAP
    os.system("/etc/init.d/slapd stop")
    os.system("killall -9 slapd")
    os.system("rm -f /var/lib/ldap/*")
    os.system("rm -fr /var/backups/*.ldapdb")
    os.system("cp contrib/ldap/*.schema /etc/ldap/schema")
    os.system("echo slapd slapd/password1 string secret | debconf-set-selections")
    os.system("echo slapd slapd/password2 string secret | debconf-set-selections")
    os.system("dpkg-reconfigure -pcritical slapd")
    os.system("cp contrib/ldap/slapd.conf /etc/ldap")
    os.system("/etc/init.d/slapd restart")
    time.sleep(5)
    # Create Base OU
    l = ldapUserGroupControl("tests-mds/basetest.ini")
    l.addOu("Groups", "dc=mandriva,dc=com")
    l.addOu("Users",  "dc=mandriva,dc=com")

def activate():
    ldapObj = ldapUserGroupControl()
    logger = logging.getLogger()

    config = RadiusConfig("radius")
    if config.disabled:
        logger.warning("Plugin radius: disabled by configuration.")
        return False

    radiusSchema = ['posixAccount', 'radiusprofile']

    for objectClass in radiusSchema:
        schema = ldapObj.getSchema(objectClass)
        if not len(schema):
            logger.error("Radius schema is not available: %s objectClass is \
                          not included in LDAP directory" % objectClass)
            return False

    return True

def activate():
    ldapObj = ldapUserGroupControl()

    config = PPolicyConfig("ppolicy")
    if config.disabled:
        logger.warning("Plugin ppolicy: disabled by configuration.")
        return False

    ppolicySchema = ['pwdPolicy', 'device']

    for objectClass in ppolicySchema:
        schema = ldapObj.getSchema(objectClass)
        if not len(schema):
            logger.error("LDAP Password Policy schema is not included in LDAP directory: %s objectClass is not available" % objectClass)
            return False

    # Register default password policy into the LDAP if it does not exist
    PPolicy().addPPolicy()

    return True

def activate():
    config = UserQuotaConfig("userquota")

    if config.disabled:
        logger.warning("Plugin userquota: disabled by configuration.")
        return False

    try:
        ldapObj = ldapUserGroupControl()
    except ldap.INVALID_CREDENTIALS:
        logger.error("Can't bind to LDAP: invalid credentials.")
        return False

    # Test if the quota LDAP schema is available in the directory
    try:
        schema = ldapObj.getSchema("systemQuotas")
        if len(schema) <= 0:
            logger.error("Quota schema is not included in LDAP directory");
            return False
    except:
        logger.exception("Invalid schema")
        return False

    # Check local file systems
    if config.runquotascript == "/bin/sh":
        for device in getDevicemap():
            dev, blocksize, name = device.split(':')
            if not os.path.exists(dev):
                logger.error("%s does not exists");
                return False
            code, out, err = mmctools.shlaunch("quotaon -aup | grep '%s) is on'" % dev)
            if code != 0 or not len(out) == 1:
                logger.error("User quotas are not enabled on %s" % dev);
                return False

    return True

 def setUp(self):
     cleanLdap()
     self.l = ldapUserGroupControl("tests-mds/basetest.ini")
     self.l.addGroup("allusers")
     self.u = UserQuotaControl(conffile = "tests-mds/userquotatest.ini", conffilebase = "tests-mds/basetest.ini")

 def _create_group(self, name, description=None):
     logger.debug('calling ldapUserGroupControl().addGroup(%s)', name)
     ldapUserGroupControl().addGroup(name)

def activate():
    """
     this function define if the module "base" can be activated.
     @return: return True if this module can be activate
     @rtype: boolean
    """
    config = SambaConfig("samba")

    if config.disabled:
        logger.info("samba plugin disabled by configuration.")
        return False

    if config.defaultSharesPath:
        if config.defaultSharesPath.endswith("/"):
            logger.error("Trailing / is not allowed in defaultSharesPath")
            return False
        if not os.path.exists(config.defaultSharesPath):
            logger.error("The default shares path '%s' does not exist" % config.defaultSharesPath)
            return False

    for cpath in config.authorizedSharePaths:
        if cpath.endswith("/"):
            logger.error("Trailing / is not allowed in authorizedSharePaths")
            return False
        if not os.path.exists(cpath):
            logger.error("The authorized share path '%s' does not exist" % cpath)
            return False

    # Verify if samba conf file exist
    conf = config.samba_conf_file
    if not os.path.exists(conf):
        logger.error(conf + " does not exist")
        return False

    # validate smb.conf
    smbconf = SambaConf()
    if not smbconf.validate(conf):
        logger.error("SAMBA configuration file is not valid")
        return False

    # For each share, test if it sharePath exists
    for share in getDetailedShares():
        shareName = share[0]
        infos = shareInfo(shareName)
        if infos:
            sharePath = infos["sharePath"]
            if sharePath and not "%" in sharePath and not os.path.exists(sharePath):
                # only show error
                logger.error("The samba share path '%s' does not exist." % sharePath)
        else:
            return False

    try:
        ldapObj = ldapUserGroupControl()
    except ldap.INVALID_CREDENTIALS:
        logger.error("Can't bind to LDAP: invalid credentials.")
        return False

    # Test if the Samba LDAP schema is available in the directory
    try:
        schema = ldapObj.getSchema("sambaSamAccount")
        if len(schema) <= 0:
            logger.error("Samba schema is not included in LDAP directory")
            return False
    except:
        logger.exception("invalid schema")
        return False

    # Verify if init script exist
    init = config.samba_init_script
    if not os.path.exists(init):
        logger.error(init + " does not exist")
        return False

    # If SAMBA is defined as a PDC, make extra checks
    if smbconf.isPdc():
        samba = SambaLDAP()
        # Create SAMBA computers account OU if it doesn't exist
        head, path = samba.baseComputersDN.split(",", 1)
        ouName = head.split("=")[1]
        samba.addOu(ouName, path)
        # Check that a sambaDomainName entry is in LDAP directory
        domainInfos = samba.getDomain()
        # Set domain policy
        samba.setDomainPolicy()
        if not domainInfos:
            logger.error(
                "Can't find sambaDomainName entry in LDAP for domain %s. Please check your SAMBA LDAP configuration."
                % smbconf.getContent("global", "workgroup")
            )
            return False
        smbconfbasesuffix = smbconf.getContent("global", "ldap suffix")
        if not smbconfbasesuffix:
            logger.error("SAMBA 'ldap suffix' option is not setted.")
            return False
        if ldap.explode_dn(samba.baseDN) != ldap.explode_dn(smbconfbasesuffix):
            logger.error("SAMBA 'ldap suffix' option is not equal to MMC 'baseDN' option.")
            return False
        # Check that SAMBA and MMC given OU are in sync
        for option in [
#.........这里部分代码省略.........

 # Add and set default mask to rwx
 # This is needed by the ACL system, else the ACLs won't be valid
 e = acl1.append()
 e.permset.add(posix1e.ACL_READ)
 e.permset.add(posix1e.ACL_WRITE)
 e.permset.add(posix1e.ACL_EXECUTE)
 e.tag_type = posix1e.ACL_MASK
 # For each specified group, we add rwx access
 for group in usergroups:
     e = acl1.append()
     e.permset.add(posix1e.ACL_READ)
     e.permset.add(posix1e.ACL_WRITE)
     e.permset.add(posix1e.ACL_EXECUTE)
     e.tag_type = posix1e.ACL_GROUP
     # Search the gid number corresponding to the given group
     ldapobj = ldapUserGroupControl(self.conffilebase)
     try:
         gidNumber = ldapobj.getDetailedGroup(group)['gidNumber'][0]
     except ldap.NO_SUCH_OBJECT:
         gidNumber = grp.getgrnam(group).gr_gid
     e.qualifier = int(gidNumber)
     # FIXME
     # howto use posix1e for this ?
     shlaunch("setfacl -d -m g:%s:rwx %s" % (str(gidNumber), path))
 for user in users:
     e = acl1.append()
     e.permset.add(posix1e.ACL_READ)
     e.permset.add(posix1e.ACL_WRITE)
     e.permset.add(posix1e.ACL_EXECUTE)
     e.tag_type = posix1e.ACL_USER
     # Search the gid number corresponding to the given group

 def setUp(self):
     cleanLdap()
     self.l = ldapUserGroupControl("tests-mds/basetest.ini")
     self.assertEqual(self.l.addGroup("allusers"), 10001)

 def _create_group(self, name, description=None):
     ldapUserGroupControl().addGroup(name)

 def _create_user(self, username, password, name, surname):
     ldapUserGroupControl().addUser(username, password, name, surname)

    def doProvisioning(self, authtoken):
        from mmc.plugins.base import ldapUserGroupControl
        self.logger.debug(str(authtoken.getInfos()))
        l = ldapUserGroupControl()
        userentry = authtoken.getInfos()[1]
        uid = userentry[self.config.ldap_uid][0]
        if l.existUser(uid):
            self.logger.debug("User %s already exists, so this user won't be added" % uid)
        else:
            givenName = userentry[self.config.ldap_givenName][0].decode("utf-8")
            sn = userentry[self.config.ldap_sn][0].decode("utf-8")
            l.addUser(uid, authtoken.getPassword(), givenName, sn)
        if self.config.profileAttr and self.config.profilesAcl:
            # Set or update the user right
            try:
                profile = userentry[self.config.profileAttr][0].lower()
            except KeyError:
                self.logger.info("No profile information for user %s in attribute %s" % (uid, self.config.profileAttr))
                profile = ""
            profile = profile.strip()
            
            try:
                entities = self.config.profilesEntity[profile].split()
                self.logger.info("*******ENTITE '%s' " % (entities))
            except KeyError:
                if self.config.profilesEntity.has_key("default"):
                    entities = self.config.profilesEntity["default"].split()
                    self.logger.info("Set the default profile to user.")
                    profile = 'default'
                else:
                    self.logger.info("No entity defined in configuration file for profile '%s'" % profile)
                    self.logger.info("Setting user's entity to empty")
                    entities = []
            if profile and entities:
                tmp = []
                for entity in entities:
                    if entity.startswith('%') and entity.endswith('%'):
                        attr = entity.strip('%')
                        if attr in userentry:
                            tmp.extend(userentry[attr])
                        else:
                            self.logger.info("The user '%s' doesn't have an attribute '%s'" % (uid, attr))

                    elif entity.startswith('plugin:'):
                        plugin = entity.replace('plugin:', '')
                        searchpath = os.path.join(os.path.dirname(__file__), 'provisioning_plugins')
                        try:
                            f, p, d = imp.find_module(plugin, [searchpath])
                            mod = imp.load_module(plugin, f, p, d)
                            klass = mod.PluginEntities
                            found = klass().get(authtoken)
                            if found:
                                self.logger.info("Plugin '%s' found these entities: %s" % (plugin, found))
                            else:
                                self.logger.info("Plugin '%s' found no matching entity" % plugin)
                            tmp.extend(found)
                        except ImportError:
                            self.logger.error("The plugin '%s' can't be imported" % plugin)
                        except Exception, e:
                            self.logger.error("Error while using the plugin '%s'" % plugin)
                            self.logger.exception(e)



                    else:
                        tmp.append(entity)
                entities = tmp[:]
                self.logger.info("****Setting user '%s' entities corresponding to user profile '%s': %s" % (uid, profile, str(entities)))
                from pulse2.database.inventory import Inventory
                Inventory().setUserEntities(uid, entities)
            
            
            try:
                acls = self.config.profilesAcl[profile]
            except KeyError:
                self.logger.info("No ACL defined in configuration file for profile '%s'" % profile)
                self.logger.info("Setting ACL to empty")
                acls = None
            if profile and acls:
                self.logger.info("Setting MMC ACL corresponding to user profile %s: %s" % (profile, str(acls)))
            entry = l.getDetailedUser(uid)
            if not "lmcUserObject" in entry["objectClass"]:
                entry["objectClass"].append("lmcUserObject")
                l.changeUserAttributes(uid, "objectClass", entry["objectClass"])
            l.changeUserAttributes(uid, "lmcAcl", acls)
            if self.config.profileGroupMapping:
                # Set user group membership according to mapping
                for prof in self.config.profilesAcl:
                    groupname = self.config.profileGroupPrefix + prof
                    if prof != profile:
                        # Delete the user from a group not belonging to her/his
                        # profile
                        try:
                            l.delUserFromGroup(groupname, uid)
                            self.logger.debug('Deleting user %s from group %s' % (uid, groupname))
                        except ldap.NO_SUCH_OBJECT:
                            # The group does not exist
                            pass
                    else:
                        # Add the user to this group
#.........这里部分代码省略.........