Needed some cleanup.

[usit-rt.git] / local / bin / rt-update-groups

#!/usr/bin/perl
#
# Author: Petter Reinholdtsen
# Date:   2005-06-29
#
# Synchronize netgroups and RT groups, and make sure only users with
# group membership are privileged users.
#
# The list of groups to synchronize is generated by looking for the
# regex (netgroupsync: .+) in the group description.

# Location of RT's libs and scripts
# Remember to change to correct path on current RT instance
use lib '/www/data/rt/rt-perl/current-perl10/share/perl5';
use lib '/www/data/rt/rt-perl/current-perl10/lib/perl5';
use lib '/www/data/rt/rt-perl/current-perl10/lib64/perl5';

use lib ("/www/var/rt/local/lib", "/www/var/rt/lib");
use strict;
use warnings;

use Getopt::Std;
use Net::LDAP qw(LDAP_SUCCESS LDAP_PARTIAL_RESULTS);
use Net::LDAP::Util qw(ldap_error_name);
use RT::Interface::CLI qw(CleanEnv);
use RT::User;

my %opts;

getopts("dp", \%opts);

# Map from RT to netgroup group
my %groupmap;

CleanEnv();
RT::LoadConfig();
RT::Init();

my $LdapServer = "ldap.uio.no";
my $LdapNGBase = "cn=netgroups,cn=system,dc=uio,dc=no";
my %system_users = ('root'    => "Superuser",
                    'rt-user' => "Internal user");

# Merge static and dynamic list until all synced groups in RT have
# updated comments.
%groupmap = (%groupmap, get_synced_groups());

# Sync netgroup and RT group.  The netgroup is authorative.  Do this
# often.
#
#  - If a user exist in RT, and is listed in the netgroup but not in
#    the RT group, give it privilege rights and add it to the group.
#
#  - If a is listed in the RT group, but not in the netgroup, remove
#    the user from the RT group.

for my $rtgroupname (sort keys %groupmap) {
    my $netgroupname = $groupmap{$rtgroupname};
    print "Updating RT group $rtgroupname from netgroup $netgroupname\n"
        if $opts{'d'};
    my %in_netgroup;
    map { $in_netgroup{$_} = 1 if defined} netgroup_users($netgroupname);

    # First, revoke membership for users missing in the netgroup
    my $users = get_users_in_rtgroup($rtgroupname);
    while (my $user = $users->Next) {
        my $username = $user->Name;
        next if ($system_users{$username});

        if ( ! $in_netgroup{$username}) {
            my ($status, $statusmsg) = del_rtgroupmember($rtgroupname, $user);
            if (0 != $status) {
                my $msg = "Removed user '$username' as member ".
                    "of group $rtgroupname";
                $RT::Logger->info("$msg"); print "$msg\n" if $opts{'d'};
            } else {
                my $msg = "Failed do remove user '$username' as member ".
                    "of group $rtgroupname";
                $RT::Logger->info("$msg"); print "$msg\n" if $opts{'d'};
            }
        }
    }

    # Next, make sure all users in the netgroup are members of the rt group
    my $user = new RT::User($RT::SystemUser);
    for my $username (sort keys %in_netgroup) {
        $user->Load($username);
#
#        if ($user->Id && !is_rtgroupmember($rtgroupname, $user)) {
#
# There is someting strange about the RT api - something has changed in RT4
# Need to look into it ref https://rt.uio.no/Ticket/Display.html?id=954612

        if ($user->Id) {
            my $msg = "Adding user '$username' as member to group $rtgroupname";
            $RT::Logger->info("$msg"); print "$msg\n" if $opts{'d'};
            add_rtgroupmember($rtgroupname, $user);
        }
    }
}

# Remove privilege rights from privileged users without any user group
# membership.  Do this at night, to reduce the chance of conflict with
# manual group updates.

#  - Loop over all privileged users, check if they are member of at
#    least one group

if ($opts{'p'}) {
    my $users = get_users_in_rtgroup("privileged");
    while (my $user = $users->Next) {
        my $username = $user->Name;
        next if ($system_users{$username});
        if (! is_member_of_any_group($user)) {
            del_rtgroupmember("privileged", $user);
            my ($status, $statusmsg) = del_rtgroupmember("privileged", $user);
            if (0 != $status) {
                my $msg = "Made user '$username' non-privileged";
                $RT::Logger->info("$msg"); print "$msg\n" if $opts{'d'};
            } else {
                my $msg = "Failed to make user '$username' non-privileged";
                $RT::Logger->info("$msg"); print "$msg\n" if $opts{'d'};
            }
        }
    }
}

#
# Locate all groups with "(netgroupsync: <group>)" as part of the
# group description, return a hash with netgroupname => rtgroupname.
#
sub get_synced_groups {
    my %groupmap;

    my $Groups = new RT::Groups($RT::SystemUser);
    $Groups->LimitToUserDefinedGroups();
    $Groups->LimitToEnabled();

    while ( my $Group = $Groups->Next) {
        next unless ($Group->Description =~ m/\(netgroupsync: *(\S+)\)/);
        my $netgroupname = $1;
        $groupmap{$Group->Name} = $netgroupname;
    }
    return %groupmap;
}



sub netgroup_users {
    my $group = shift;
    my $ldap = LdapConnect();
    my @users;
    my %groups;
    my $mesg = $ldap->search(
                          base       => $LdapNGBase,
                          scope      => "one",
                          filter     => "cn=$group",
                          attributes => ["nisNetgroupTriple","memberNisNetgroup"],
                          );
    if ( ($mesg->code != LDAP_SUCCESS) and
         ($mesg->code != LDAP_PARTIAL_RESULTS) ) {
        $RT::Logger->critical("rt-group-sync: Search failed: ",
                              "retval=", $mesg->code, " ",
                              ldap_error_name($mesg->code));
        LdapDisconnect($ldap);
        return undef;
    }

    if (1 != $mesg->count) {
        LdapDisconnect($ldap);
        return undef;
    }

    while (my $entry = $mesg->shift_entry){
        for ($entry->get_value("memberNisNetgroup")) {
             $groups{$_} = 0 unless $groups{$_};
        }
        for ($entry->get_value("nisNetgroupTriple")) {
            m/\(,(.*?),\)/;
            push (@users, $1);
        }
    }
    for (keys %groups) {
	push (@users, netgroup_users ($_)) unless $groups{$_};
	$groups{$_}=1;
    }
    LdapDisconnect($ldap);
    chomp @users;
    return keys %{{ map { $_ => 1 } @users }};
}


sub get_users_in_rtgroup {
    my $rtgroupname = shift;
    my $users;
    if ("privileged" eq $rtgroupname) {
        $users = new RT::Users($RT::SystemUser);
        $users->LimitToPrivileged();
    } else {
        my $group = RT::Group->new($RT::SystemUser);
        $group->LoadUserDefinedGroup($rtgroupname);
        $users = $group->UserMembersObj()
    }
    return $users;
}

sub is_rtgroupmember {
    my ($rtgroupname, $user) = @_;
    return undef unless ($user->Id);
    if ("privileged" eq $rtgroupname) {
        return $user->Privileged;
    } else {
        my $group = RT::Group->new($RT::SystemUser);
        $group->LoadUserDefinedGroup($rtgroupname);
        return 1 if ($group->HasMember($user->PrincipalObj));
    }
    return undef;
}

sub add_rtgroupmember {
    my ($rtgroupname, $user) = @_;
    if ("privileged" eq $rtgroupname) {
        $user->SetPrivileged(1);
    } else {
        # Make sure user is privileged, to make it possible to add it
        # to a group.
        $user->SetPrivileged(1);
        my $group = RT::Group->new($RT::SystemUser);
        $group->LoadUserDefinedGroup($rtgroupname);
        $group->AddMember($user->id);
    }
}

sub del_rtgroupmember {
    my ($rtgroupname, $user) = @_;
    if ("privileged" eq $rtgroupname) {
        return $user->SetPrivileged(0);
    } else {
        my $group = RT::Group->new($RT::SystemUser);
        $group->LoadUserDefinedGroup($rtgroupname);
        return $group->DeleteMember($user->id);
    }
}

sub is_member_of_any_group {
    my $user = shift;
    my $groups = RT::Groups->new($RT::SystemUser);
    $groups->LimitToUserDefinedGroups();
    $groups->WithMember(PrincipalId => $user->id, Recursively => 1);
    return ($groups->Count > 0)
};



sub LdapConnect {

    my $mesg;
    my $ldap = Net::LDAP->new($LdapServer,
                              version => 3);

    unless ($ldap) {
        $RT::Logger->critical("rt-group-sync: Cannot connect to",
                              "LDAP server ", $LdapServer);
        return undef;
    }
    $mesg = $ldap->bind;
    if ($mesg->code != LDAP_SUCCESS) {
        $RT::Logger->critical("rt-group-sync: Cannot bind to LDAP: ",
                              "retval=", $mesg->code, " ",
                              ldap_error_name($mesg->code));
        return undef;
    }
    return $ldap;
}

sub LdapDisconnect {
    my $ldap = shift;
    my $mesg = $ldap->unbind();
    if ($mesg->code != LDAP_SUCCESS) {
        $RT::Logger->critical("LdapDisconnect: unbind failed: ",
                              "retval=", $mesg->code, " ",
                              ldap_error_name($mesg->code));
    }
}