Skip to content

Fix #159 - more secure credential handling #176

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adobeDan merged 2 commits into from
May 3, 2017
Merged

Fix #159 - more secure credential handling #176

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c127325
Fix #159. Allow config files to be output from external commands.
adobeDan May 3, 2017
df6d2d8
Fix #175: users doesn't default to all, instead no users are read
adobeDan May 3, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 18 additions & 19 deletions user_sync/app.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,25 +233,24 @@ def create_config_loader_options(args):

# --users
users_args = args.users
if users_args is not None:
users_action = None if len(users_args) == 0 else user_sync.helper.normalize_string(users_args.pop(0))
if (users_action == None or users_action == 'all'):
config_options['directory_connector_module_name'] = 'user_sync.connector.directory_ldap'
elif (users_action == 'file'):
if len(users_args) == 0:
raise AssertionException('Missing file path for --users %s [file_path]' % users_action)
config_options['directory_connector_module_name'] = 'user_sync.connector.directory_csv'
config_options['directory_connector_overridden_options'] = {'file_path': users_args.pop(0)}
elif (users_action == 'mapped'):
config_options['directory_connector_module_name'] = 'user_sync.connector.directory_ldap'
config_options['directory_group_mapped'] = True
elif (users_action == 'group'):
if len(users_args) == 0:
raise AssertionException('Missing groups for --users %s [groups]' % users_action)
config_options['directory_connector_module_name'] = 'user_sync.connector.directory_ldap'
config_options['directory_group_filter'] = users_args.pop(0).split(',')
else:
raise AssertionException('Unknown argument --users %s' % users_action)
users_action = None if not users_args else user_sync.helper.normalize_string(users_args.pop(0))
if (users_action == None or users_action == 'all'):
config_options['directory_connector_module_name'] = 'user_sync.connector.directory_ldap'
elif (users_action == 'file'):
if len(users_args) == 0:
raise AssertionException('Missing file path for --users %s [file_path]' % users_action)
config_options['directory_connector_module_name'] = 'user_sync.connector.directory_csv'
config_options['directory_connector_overridden_options'] = {'file_path': users_args.pop(0)}
elif (users_action == 'mapped'):
config_options['directory_connector_module_name'] = 'user_sync.connector.directory_ldap'
config_options['directory_group_mapped'] = True
elif (users_action == 'group'):
if len(users_args) == 0:
raise AssertionException('Missing groups for --users %s [groups]' % users_action)
config_options['directory_connector_module_name'] = 'user_sync.connector.directory_ldap'
config_options['directory_group_filter'] = users_args.pop(0).split(',')
else:
raise AssertionException('Unknown argument --users %s' % users_action)

username_filter_pattern = args.username_filter_pattern
if (username_filter_pattern):
Expand Down
59 changes: 40 additions & 19 deletions user_sync/config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
import logging
import os
import re
import subprocess
import types

import keyring
Expand Down Expand Up @@ -641,6 +642,7 @@ def load_sub_config(cls, filename):
def load_other_config(cls, filename):
'''
same as load_root_config, but does no post-processing.
:type filename: str
'''
return cls.load_from_yaml(filename, {})

Expand All @@ -667,25 +669,41 @@ def load_from_yaml(cls, filename, path_keys):
does the key have a default value so that must be added to
the dictionary if there is not already a value found.
'''
cls.filepath = os.path.abspath(filename)
cls.filename = os.path.split(cls.filepath)[1]
cls.dirpath = os.path.dirname(cls.filepath)
if not os.path.isfile(cls.filepath):
raise AssertionException('No such configuration file: %s' % (cls.filepath,))

# read the dict from the YAML file
try:
with open(filename, 'r', 1) as input_file:
yml = yaml.load(input_file)
except IOError as e:
# if a file operation error occurred while loading the
# configuration file, swallow up the exception and re-raise this
# as an configuration loader exception.
raise AssertionException('Error reading configuration file: %s' % e)
except yaml.error.MarkedYAMLError as e:
# same as above, but indicate this problem has to do with
# parsing the configuration file.
raise AssertionException('Error parsing configuration file: %s' % e)
if filename.startswith('$(') and filename.endswith(')'):
# it's a command line to execute and read standard output
dir_end = filename.index(']')
if filename.startswith('$([') and dir_end > 0:
dir = filename[3:dir_end]
cmd = filename[dir_end+1:-1]
else:
dir = os.path.abspath(".")
cmd = filename[3:-1]
try:
bytes = subprocess.check_output(cmd, cwd=dir, shell=True)
yml = yaml.load(bytes)
except subprocess.CalledProcessError as e:
raise AssertionException("Error executing process '%s' in dir '%s': %s" % (cmd, dir, e))
except yaml.error.MarkedYAMLError as e:
raise AssertionException('Error parsing process YAML data: %s' % e)
else:
# it's a pathname to a configuration file to read
cls.filepath = os.path.abspath(filename)
if not os.path.isfile(cls.filepath):
raise AssertionException('No such configuration file: %s' % (cls.filepath,))
cls.filename = os.path.split(cls.filepath)[1]
cls.dirpath = os.path.dirname(cls.filepath)
try:
with open(filename, 'r', 1) as input_file:
yml = yaml.load(input_file)
except IOError as e:
# if a file operation error occurred while loading the
# configuration file, swallow up the exception and re-raise this
# as an configuration loader exception.
raise AssertionException('Error reading configuration file: %s' % e)
except yaml.error.MarkedYAMLError as e:
# same as above, but indicate this problem has to do with
# parsing the configuration file.
raise AssertionException('Error parsing configuration file: %s' % e)

# process the content of the dict
for path_key, options in path_keys.iteritems():
Expand Down Expand Up @@ -773,6 +791,9 @@ def relative_path(cls, val, must_exist):
if not isinstance(val, types.StringTypes):
raise AssertionException("Expected pathname for setting %s in config file %s" %
(cls.key_path, cls.filename))
if val.startswith('$(') and val.endswith(')'):
# this presumes
return "$([" + cls.dirpath + "]" + val[2:-1] + ")"
if cls.dirpath and not os.path.isabs(val):
val = os.path.abspath(os.path.join(cls.dirpath, val))
if must_exist and not os.path.isfile(val):
Expand Down