Skip to content

Commit

Permalink
Use mapping for LDAP sync/prune w/ Openshift group
Browse files Browse the repository at this point in the history
When syncing LDAP groups with --type=openshift or when pruning
groups, the LDAPGroupUIDToOpenShiftGroupNameMapping should be taken
into consideration since:

1. The system of truth in both flows is openshift groups
2. The mapping was probably used to name said openshift groups

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1484831

Signed-off-by: Monis Khan <mkhan@redhat.com>
  • Loading branch information
enj committed Aug 31, 2017
1 parent 248fa76 commit 3ae8e34
Show file tree
Hide file tree
Showing 3 changed files with 35 additions and 12 deletions.
6 changes: 6 additions & 0 deletions pkg/cmd/server/api/validation/ldap.go
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,12 @@ func ValidateLDAPSyncConfig(config *api.LDAPSyncConfig) ValidationResults {
bindPassword, _ := api.ResolveStringValue(config.BindPassword)
validationResults.Append(ValidateLDAPClientConfig(config.URL, config.BindDN, bindPassword, config.CA, config.Insecure, nil))

for ldapGroupUID, openShiftGroupName := range config.LDAPGroupUIDToOpenShiftGroupNameMapping {
if len(ldapGroupUID) == 0 || len(openShiftGroupName) == 0 {
validationResults.AddErrors(field.Invalid(field.NewPath("groupUIDNameMapping").Key(ldapGroupUID), openShiftGroupName, "has empty key or value"))
}
}

schemaConfigsFound := []string{}

if config.RFC2307Config != nil {
Expand Down
7 changes: 4 additions & 3 deletions pkg/oc/admin/groups/sync/cli/prune.go
Original file line number Diff line number Diff line change
Expand Up @@ -132,17 +132,18 @@ func NewCmdPrune(name, fullName string, f *clientcmd.Factory, out io.Writer) *co

func (o *PruneOptions) Complete(whitelistFile, blacklistFile, configFile string, args []string, f *clientcmd.Factory) error {
var err error
o.Whitelist, err = buildOpenShiftGroupNameList(args, whitelistFile)

o.Config, err = decodeSyncConfigFromFile(configFile)
if err != nil {
return err
}

o.Blacklist, err = buildOpenShiftGroupNameList([]string{}, blacklistFile)
o.Whitelist, err = buildOpenShiftGroupNameList(args, whitelistFile, o.Config.LDAPGroupUIDToOpenShiftGroupNameMapping)
if err != nil {
return err
}

o.Config, err = decodeSyncConfigFromFile(configFile)
o.Blacklist, err = buildOpenShiftGroupNameList([]string{}, blacklistFile, o.Config.LDAPGroupUIDToOpenShiftGroupNameMapping)
if err != nil {
return err
}
Expand Down
34 changes: 25 additions & 9 deletions pkg/oc/admin/groups/sync/cli/sync.go
Original file line number Diff line number Diff line change
Expand Up @@ -195,12 +195,18 @@ func (o *SyncOptions) Complete(typeArg, whitelistFile, blacklistFile, configFile
}

var err error

o.Config, err = decodeSyncConfigFromFile(configFile)
if err != nil {
return err
}

if o.Source == GroupSyncSourceOpenShift {
o.Whitelist, err = buildOpenShiftGroupNameList(args, whitelistFile)
o.Whitelist, err = buildOpenShiftGroupNameList(args, whitelistFile, o.Config.LDAPGroupUIDToOpenShiftGroupNameMapping)
if err != nil {
return err
}
o.Blacklist, err = buildOpenShiftGroupNameList([]string{}, blacklistFile)
o.Blacklist, err = buildOpenShiftGroupNameList([]string{}, blacklistFile, o.Config.LDAPGroupUIDToOpenShiftGroupNameMapping)
if err != nil {
return err
}
Expand All @@ -215,11 +221,6 @@ func (o *SyncOptions) Complete(typeArg, whitelistFile, blacklistFile, configFile
}
}

o.Config, err = decodeSyncConfigFromFile(configFile)
if err != nil {
return err
}

osClient, _, err := f.Clients()
if err != nil {
return err
Expand All @@ -230,13 +231,28 @@ func (o *SyncOptions) Complete(typeArg, whitelistFile, blacklistFile, configFile
}

// buildOpenShiftGroupNameList builds a list of OpenShift names from file and args
func buildOpenShiftGroupNameList(args []string, file string) ([]string, error) {
// nameMapping is used to override the OpenShift names built from file and args
func buildOpenShiftGroupNameList(args []string, file string, nameMapping map[string]string) ([]string, error) {
rawList, err := buildNameList(args, file)
if err != nil {
return nil, err
}

return openshiftGroupNamesOnlyList(rawList)
namesList, err := openshiftGroupNamesOnlyList(rawList)
if err != nil {
return nil, err
}

// override items in namesList if present in mapping
if len(nameMapping) > 0 {
for i, name := range namesList {
if nameOverride, ok := nameMapping[name]; ok {
namesList[i] = nameOverride
}
}
}

return namesList, nil
}

// buildNameLists builds a list from file and args
Expand Down

0 comments on commit 3ae8e34

Please sign in to comment.