syncLDAP.pl

#!/usr/bin/perl -T
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
#
# This Source Code Form is "Incompatible With Secondary Licenses", as
# defined by the Mozilla Public License, v. 2.0.

use 5.10.1;
use strict;
use warnings;

use lib qw(. lib);

use Net::LDAP;
use Bugzilla;
use Bugzilla::User;

my $cgi = Bugzilla->cgi;
my $dbh = Bugzilla->dbh;

my $readonly  = 0;
my $nodisable = 0;
my $noupdate  = 0;
my $nocreate  = 0;
my $quiet     = 0;

###
# Do some preparations
###
foreach my $arg (@ARGV) {
  if ($arg eq '-r') {
    $readonly = 1;
  }
  elsif ($arg eq '-d') {
    $nodisable = 1;
  }
  elsif ($arg eq '-u') {
    $noupdate = 1;
  }
  elsif ($arg eq '-c') {
    $nocreate = 1;
  }
  elsif ($arg eq '-q') {
    $quiet = 1;
  }
  else {
    print "LDAP Sync Script\n";
    print
      "Syncronizes the users table from the LDAP server with the Bugzilla users.\n";
    print "Takes mail-attribute from preferences and description from 'cn' or,\n";
    print "if not available, from the uid-attribute.\n\n";
    print "usage:\n syncLDAP.pl [options]\n\n";
    print "options:\n";
    print " -r Readonly, do not make changes to Bugzilla tables\n";
    print " -d No disable, don't disable login by users who are not in LDAP\n";
    print
      " -u No update, don't update users, which have different description in LDAP\n";
    print
      " -c No create, don't create users, which are in LDAP but not in Bugzilla\n";
    print " -q Quiet mode, give less output\n";
    print "\n";
    exit;
  }
}

my %ldap_users;

###
# Get current bugzilla users
###
my %bugzilla_users = %{
  $dbh->selectall_hashref(
    'SELECT login_name AS new_login_name, realname, disabledtext '
      . 'FROM profiles',
    'new_login_name'
  )
};

foreach my $login_name (keys %bugzilla_users) {

  # remove whitespaces
  $bugzilla_users{$login_name}{'realname'} =~ s/^\s+|\s+$//g;
}

###
# Get current LDAP users
###
my $LDAPserver = Bugzilla->params->{"LDAPserver"};
if ($LDAPserver eq "") {
  print "No LDAP server defined in bugzilla preferences.\n";
  exit;
}

my $LDAPconn;
if ($LDAPserver =~ /:\/\//) {

  # if the "LDAPserver" parameter is in uri scheme
  $LDAPconn = Net::LDAP->new($LDAPserver, version => 3);
}
else {
  my $LDAPport = "389";    # default LDAP port
  if ($LDAPserver =~ /:/) {
    ($LDAPserver, $LDAPport) = split(":", $LDAPserver);
  }
  $LDAPconn = Net::LDAP->new($LDAPserver, port => $LDAPport, version => 3);
}

if (!$LDAPconn) {
  print "Connecting to LDAP server failed. Check LDAPserver setting.\n";
  exit;
}
my $mesg;
if (Bugzilla->params->{"LDAPbinddn"}) {
  my ($LDAPbinddn, $LDAPbindpass) = split(":", Bugzilla->params->{"LDAPbinddn"});
  $mesg = $LDAPconn->bind($LDAPbinddn, password => $LDAPbindpass);
}
else {
  $mesg = $LDAPconn->bind();
}
if ($mesg->code) {
  print "Binding to LDAP server failed: "
    . $mesg->error
    . "\nCheck LDAPbinddn setting.\n";
  exit;
}

# We've got our anonymous bind;  let's look up the users.
$mesg = $LDAPconn->search(
  base   => Bugzilla->params->{"LDAPBaseDN"},
  scope  => "sub",
  filter => '(&('
    . Bugzilla->params->{"LDAPuidattribute"} . "=*)"
    . Bugzilla->params->{"LDAPfilter"} . ')',
);


if (!$mesg->count) {
  print "LDAP lookup failure. Check LDAPBaseDN setting.\n";
  exit;
}

my %val = %{$mesg->as_struct};

while (my ($key, $value) = each(%val)) {

  my @login_name = @{$value->{Bugzilla->params->{"LDAPmailattribute"}}};
  my @realname   = @{$value->{"cn"}};

  # no mail entered? go to next
  if (!@login_name) {
    print "$key has no valid mail address\n";
    next;
  }

  # no cn entered? use uid instead
  if (!@realname) {
    @realname = @{$value->{Bugzilla->params->{"LDAPuidattribute"}}};
  }

  my $login = shift @login_name;
  my $real  = shift @realname;
  $ldap_users{$login} = {realname => $real};
}

print "\n" unless $quiet;

###
# Sort the users into disable/update/create-Lists and display everything
###
my %disable_users;
my %update_users;
my %create_users;

print "Bugzilla-Users: \n" unless $quiet;
while (my ($key, $value) = each(%bugzilla_users)) {
  print " "
    . $key . " '"
    . $value->{'realname'} . "' "
    . $value->{'disabledtext'} . "\n"
    unless $quiet == 1;
  if (!exists $ldap_users{$key}) {
    if ($value->{'disabledtext'} eq '') {
      $disable_users{$key} = $value;
    }
  }
}

print "\nLDAP-Users: \n" unless $quiet;
while (my ($key, $value) = each(%ldap_users)) {
  print " " . $key . " '" . $value->{'realname'} . "'\n" unless $quiet == 1;
  if (!defined $bugzilla_users{$key}) {
    $create_users{$key} = $value;
  }
  else {
    my $bugzilla_user_value = $bugzilla_users{$key};
    if ($bugzilla_user_value->{'realname'} ne $value->{'realname'}) {
      $update_users{$key} = $value;
    }
  }
}

print "\nDetecting email changes: \n" unless $quiet;
while (my ($create_key, $create_value) = each(%create_users)) {
  while (my ($disable_key, $disable_value) = each(%disable_users)) {
    if ($create_value->{'realname'} eq $disable_value->{'realname'}) {
      print " " . $disable_key . " => " . $create_key . "'\n" unless $quiet == 1;
      $update_users{$disable_key}
        = {realname => $create_value->{'realname'}, new_login_name => $create_key};
      delete $create_users{$create_key};
      delete $disable_users{$disable_key};
    }
  }
}

if ($quiet == 0) {
  print "\nUsers to disable login for: \n";
  while (my ($key, $value) = each(%disable_users)) {
    print " " . $key . " '" . $value->{'realname'} . "'\n";
  }

  print "\nUsers to update: \n";
  while (my ($key, $value) = each(%update_users)) {
    print " " . $key . " '" . $value->{'realname'} . "' ";
    if (defined $value->{'new_login_name'}) {
      print "has changed email to " . $value->{'new_login_name'};
    }
    print "\n";
  }

  print "\nUsers to create: \n";
  while (my ($key, $value) = each(%create_users)) {
    print " " . $key . " '" . $value->{'realname'} . "'\n";
  }

  print "\n\n";
}


###
# now do the DB-Update
###
if ($readonly == 0) {
  print
    "Performing DB update:\nPhase 1: disabling login for users not in LDAP... "
    unless $quiet;

  my $sth_disable = $dbh->prepare(
    'UPDATE profiles
           SET disabledtext = ?
         WHERE ' . $dbh->sql_istrcmp('login_name', '?')
  );

  if ($nodisable == 0) {
    while (my ($key, $value) = each(%disable_users)) {
      $sth_disable->execute('auto-disabled by ldap sync', $key);
    }
    print "done!\n" unless $quiet;
  }
  else {
    print "disabled!\n" unless $quiet;
  }

  print "Phase 2: updating existing users... " unless $quiet;

  if ($noupdate == 0) {
    while (my ($key, $value) = each(%update_users)) {
      my $user = Bugzilla::User->check($key);
      if (defined $value->{'new_login_name'}) {
        $user->set_login($value->{'new_login_name'});
      }
      else {
        $user->set_name($value->{'realname'});
      }
      $user->update();
    }
    print "done!\n" unless $quiet;
  }
  else {
    print "disabled!\n" unless $quiet;
  }

  print "Phase 3: creating new users... " unless $quiet;
  if ($nocreate == 0) {
    while (my ($key, $value) = each(%create_users)) {
      Bugzilla::User->create({
        login_name => $key, realname => $value->{'realname'}, cryptpassword => '*'
      });
    }
    print "done!\n" unless $quiet;
  }
  else {
    print "disabled!\n" unless $quiet;
  }
}
else {
  print "No changes to DB because readonly mode\n" unless $quiet;
}