Class List Method List File List

# Class: Yast::LdapClass

Inherits:
  Module
  - Object
  - Module
  - Yast::LdapClass
  show all
Defined in:
  ../../src/modules/Ldap.rb

## Instance Method Summary (collapse)

- - (Object) AddLdapConfEntry(entry, value)

  Add a new value to the entry in /etc/ldap.conf.

- - (Object) AddMissingAttributes(object)

  For a given object, add all atributes this object is allowed to have according to its “objectClass” value.

- - (Object) AttributeDescription(attr)

  Gets the description of attribute (from schema).

- - (Hash) AutoPackages

  Return needed packages and packages to be removed during autoinstallation.

- - (Object) BaseDNChanged

  If the base DN has changed from a nonempty one, it may only be changed at boot time.

- - (Object) CheckBaseConfig(dn)

  Check if base config DN belongs to some existing object and offer creating it if necessary.

- - (Object) CheckLDAPConnection(args)

  Check if LDAP connection can be established with given values.

- - (Object) CheckNDS

  Check the server if it is NDS (novell directory service).

- - (Object) CheckOES

  Check if current machine runs OES.

- - (Object) CheckOrderOfCreation

  Check if references to other objects are correct; create these objects if possible.

- - (Object) CheckTemplateDN(dn)

  Check if given DN exist and if it points to some template.

- - (Object) CommitConfigModules(modules)

  Save the edited map of configuration modules to global map.

- - (Object) CommitTemplates(templs)

  Save the edited map of templates to global map.

- - (Object) ConnectWithoutTLS(errmap)

  popup shown after failed connection: ask for retry withou TLS (see bug 246397).

- - (Object) ConvertDefaultValues(templ)

  In template object, convert the list of values (which is in the form [ “a1=v1”, “a2=v2”]) to map (in the form $[ “a1”:“v1”, “a2”:“v2”].

- - (Object) CreateDefaultLDAPConfiguration

  create the default objects for users and groups.

- - (Object) CreateModule(cn, _class)

  Creates default new map for new configuration object.

- - (Object) CreateTemplate(cn, classes)

  Creates default new map for a new object template.

- - (Object) DomainChanged

  obsolete, use BaseDNChanged.

- - (Object) Export

  Dump the LDAP settings to a map, for autoinstallation use.

- - (Object) GetAllAttributes(_class)

  Returns allowed and required attributes of given object class Read it from LDAP if it was not done yet.

- - (Object) GetBaseDN

  Get the Base DN.

- - (Object) GetBindDN

  return administrator's DN if it was not read yet, read it now.

- - (Object) GetConfigModules

  Return the map of configuration modules (new copy) (in the form $[ DN: $[ map_of_one_module] ]).

- - (Object) GetDefaultObjectClasses(template)

  Return list of default object classes for user or group There is fixed list here, it is not saved anywhere (only in default users plugin for LDAP objects).

- - (Object) GetDomain

  obsolete, use GetBaseDN.

- - (Object) GetFirstPort(servers)

  this is a hack.

- - (Object) GetFirstServer(servers)

  this is a hack.

- - (Object) GetGroupsDN(base)

  Returns DN's of groups (objectClass=posixGroup) in given base.

- - (Hash) GetLDAPEntry(dn)

  Search for one entry (=base scope) in LDAP directory.

- - (Object) GetLDAPPassword(enable_anonymous)

  Asks user for bind password to LDAP server.

- - (Object) GetMainConfigDN

  Return main configuration object DN.

- - (Object) GetObjectAttributes(classes)

  Returns the list of all allowed and required attributes for each object class, given in the list of object classes.

- - (Object) GetOptionalAttributes(_class)
- - (Object) GetRequiredAttributes(_class)

  Returns required attributes of given object class Read it from LDAP if it was not done yet.

- - (Object) GetTemplates

  Return the map of templates (new copy).

- - (Object) Import(settings)

  Get all the LDAP configuration from a map.

- - (Object) InitSchema

  Prepare agent for later schema queries (agent reads schema to its internal structures).

- - (Object) LDAPAskAndBind(enable_anonymous)

  Asks for LDAP password and tries to bind with it.

- - (Object) LDAPBind(pass)

  Binds to LDAP server.

- - (Object) LDAPClose

  Shut down existing LDAP connection.

- - (Object) LDAPError

  Reads and returns error message from agent.

- - (Object) LDAPErrorMap

  Reads and returns error map (=message + code) from agent.

- - (Object) LDAPErrorMessage(type, error)

  Error popup for errors detected during LDAP operation.

- - (Object) LDAPInit

  Initializes LDAP agent.

- - (Object) LDAPInitArgs(args)

  Initializes LDAP agent; use the data passed as argument instead global values Returns whole error map, not just message.

- - (Object) LDAPInitWithTLSCheck(args)

  Initializes LDAP agent, offers to turn off TLS if it failed.

- - (Object) main
- - (Object) ObjectClassExists(_class)

  Returns true if given object class exists in schema.

- - (Object) ObjectClassStructural(_class)

  Returns true if given object class is of 'structural' type.

- - (Object) ParentExists(dn)

  Check for existence of parent object of given DN in LDAP tree return the answer.

- - (Object) Read

  Reads LDAP settings from the SCR.

- - (String) ReadConfigModules

  Read configuration moduels from LDAP server.

- - (Array) ReadDN(base, search_filter)

  Searches for DN's of all objects defined by filter in given base (“sub”).

- - (Object) ReadKrb5Conf

  For sssd, some kerberos values are needed.

- - (Object) ReadLdapConfEntries(entry)

  Read multi-valued entry from /etc/ldap.conf file.

- - (Object) ReadLdapConfEntry(entry, defvalue)

  Read single entry from /etc/ldap.conf file.

- - (Object) ReadLdapHosts

  Read values of LDAP hosts from ldap.conf get them from 'uri' or 'host' values.

- - (String) ReadTemplates

  Read object templates from LDAP server.

- - (Object) RestartSSHD(restart)

  Set the value of restart_sshd (= restart sshd during write).

- - (void) Set(settings)

  Only set variables, without checking anything.

- - (Object) SetAnonymous(anon)

  Set the value of 'anonymous' variable (= bind without password).

- - (Object) SetBaseDN(new_base_dn)

  Set new LDAP base DN.

- - (Object) SetBindPassword(pass)

  Set the value of bind_pass variable.

- - (Object) SetDefaults(settings)

  Set the defualt values, which should replace the ones from Read () Used during instalation, when we want to do a reasonable proposal.

- - (Object) SetDomain(new_domain)

  obsolete, use SetBaseDN.

- - (Object) SetGUI(gui)

  Set the value of 'use_gui' variable (= show error popups).

- - (Object) SetReadSettings(read)

  set the value of read_settings variable which means, do not read some settings from system.

- - (Object) ShortSummary

  returns html formated configuration summary (shorter than Summary).

- - (Object) SingleValued(attr)

  Check if attribute allowes only single or multiple value.

- - (Object) Summary

  Summary() returns html formated configuration summary.

- - (Object) uri2servers(uri)

  convert list of uri's to list of hosts.

- - (Symbol) Write(abort)

  Saves LDAP configuration.

- - (Object) WriteLDAP(objects)

  Writes map of objects to LDAP.

- - (Object) WriteLdapConfEntries(entry, value)

  Write (possibly multi valued) entry to /etc/ldap.conf in /etc/ldap.conf should be written as “entry attr1 attr2” WriteLdapConfEntries (“nss_map_attribute”, [“uniquemember”, “member”]).

- - (Object) WriteLdapConfEntry(entry, value)

  Write (single valued) entry to /etc/ldap.conf.

- - (Object) WriteNow

  wrapper for Write, without abort block.

- - (Object) WriteNscdCache(start_sssd)

  Adpat passwd and group cache in /etc/nscd.conf Caching should be disabled with sssd on.

- - (Object) WriteOpenLdapConf

  Modify also /etc/openldap/ldap.conf for the use of ldap client utilities (like ldapsearch).

- - (Object) WritePlusLine(login)

  If a file does not + entry, add it.

- - (Object) WriteSSSDConfig

  Write updated /etc/sssd/sssd.conf file.

- - (Object) WriteToLDAP(objects)

  Writes map of objects to LDAP $[ DN: (map) attribute_values].

## Instance Method Details

### - (`Object`) AddLdapConfEntry(entry, value)

Add a new value to the entry in /etc/ldap.conf

Parameters:

- entry (`String`) —

  name

- value (`String`)

    719
    720
    721
    722
    723
    724
    725
    726
    727
    728
    729
    730
    731
    # File '../../src/modules/Ldap.rb', line 719

    def AddLdapConfEntry(entry, value)
      current = ReadLdapConfEntries(entry)
      current = Builtins.maplist(current) { |e| Builtins.tolower(e) }

      if !Builtins.contains(current, Builtins.tolower(value))
        SCR.Write(
          Builtins.add(path(".etc.ldap_conf.v.\"/etc/ldap.conf\""), entry),
          Builtins.union(current, [value])
        )
      end

      nil
    end

### - (`Object`) AddMissingAttributes(object)

For a given object, add all atributes this object is allowed to have according to its "objectClass" value. Added attributes have empty values.

Parameters:

- object (`Hash`) —

  map describing LDAP entry

Returns:

- updated map

    1665
    1666
    1667
    1668
    1669
    1670
    1671
    1672
    1673
    1674
    1675
    1676
    1677
    1678
    1679
    1680
    1681
    1682
    # File '../../src/modules/Ldap.rb', line 1665

    def AddMissingAttributes(object)
      object = deep_copy(object)
      Builtins.foreach(Ops.get_list(object, "objectClass", [])) do |_class|
        Builtins.foreach(
          Convert.convert(
            GetAllAttributes(_class),
            :from => "list",
            :to   => "list <string>"
          )
        ) do |attr|
          if !Builtins.haskey(object, attr) &&
              !Builtins.haskey(object, Builtins.tolower(attr))
            object = Builtins.add(object, attr, [])
          end
        end
      end
      deep_copy(object)
    end

### - (`Object`) AttributeDescription(attr)

Gets the description of attribute (from schema)

Parameters:

- attr (`String`) —

  attribute name

Returns:

- description

    1562
    1563
    1564
    1565
    1566
    1567
    1568
    1569
    1570
    1571
    # File '../../src/modules/Ldap.rb', line 1562

    def AttributeDescription(attr)
      if !Builtins.haskey(@attr_types, attr)
        attr_type = Convert.to_map(
          SCR.Read(path(".ldap.schema.at"), { "name" => attr })
        )
        attr_type = {} if attr_type == nil
        Ops.set(@attr_types, attr, attr_type)
      end
      Ops.get_string(@attr_types, [attr, "desc"], "")
    end

### - (`Hash`) AutoPackages

Return needed packages and packages to be removed during autoinstallation.

Returns:

- (`Hash`) —

  of lists.

    375
    376
    377
    378
    379
    380
    381
    382
    383
    384
    385
    386
    387
    388
    389
    390
    391
    392
    393
    394
    # File '../../src/modules/Ldap.rb', line 375

    def AutoPackages
      if @start
        @required_packages = Convert.convert(
          Builtins.union(
            @required_packages,
            @sssd ? @sssd_packages : @pam_nss_packages
          ),
          :from => "list",
          :to   => "list <string>"
        )
        if @sssd_with_krb
          @required_packages = Convert.convert(
            Builtins.union(@required_packages, @kerberos_packages),
            :from => "list",
            :to   => "list <string>"
          )
        end
      end
      { "install" => @required_packages, "remove" => [] }
    end

### - (`Object`) BaseDNChanged

If the base DN has changed from a nonempty one, it may only be changed at boot time. Use this to warn the user.

Returns:

- whether changed by SetBaseDN

    323
    324
    325
    # File '../../src/modules/Ldap.rb', line 323

    def BaseDNChanged
      @base_dn_changed
    end

### - (`Object`) CheckBaseConfig(dn)

Check if base config DN belongs to some existing object and offer creating it if necessary

    3268
    3269
    3270
    3271
    3272
    3273
    3274
    3275
    3276
    3277
    3278
    3279
    3280
    3281
    3282
    3283
    3284
    3285
    3286
    3287
    3288
    3289
    3290
    3291
    3292
    3293
    3294
    3295
    3296
    3297
    3298
    3299
    3300
    3301
    3302
    3303
    # File '../../src/modules/Ldap.rb', line 3268

    def CheckBaseConfig(dn)
      object = GetLDAPEntry(dn)
      return false if object == nil
      if object == {}
        # yes/no popup, %1 is value of DN
        if !@use_gui ||
            Popup.YesNo(
              Builtins.sformat(
                _(
                  "No entry with DN '%1'\nexists on the LDAP server. Create it now?\n"
                ),
                dn
              )
            )
          return false if !ParentExists(dn)
          config_object = {
            "objectClass" => ["top", "organizationalUnit"],
            "modified"    => "added",
            "ou"          => get_cn(dn)
          }
          if @nds
            Ops.set(
              config_object,
              "acl",
              [
                "3#subtree#[Public]#[All Attributes Rights]",
                "1#subtree#[Public]#[Entry Rights]"
              ]
            )
          end
          return WriteLDAP({ dn => config_object })
        end
        return false
      end
      true
    end

### - (`Object`) CheckLDAPConnection(args)

Check if LDAP connection can be established with given values.

    1276
    1277
    1278
    1279
    1280
    1281
    1282
    1283
    1284
    1285
    1286
    1287
    1288
    1289
    1290
    1291
    1292
    1293
    1294
    1295
    1296
    1297
    1298
    1299
    1300
    1301
    1302
    1303
    1304
    1305
    1306
    1307
    1308
    1309
    1310
    1311
    1312
    1313
    1314
    1315
    1316
    1317
    1318
    1319
    1320
    1321
    1322
    1323
    1324
    1325
    1326
    1327
    1328
    1329
    1330
    1331
    1332
    1333
    1334
    1335
    1336
    1337
    1338
    1339
    1340
    1341
    1342
    1343
    1344
    # File '../../src/modules/Ldap.rb', line 1276

    def CheckLDAPConnection(args)
      args = deep_copy(args)
      LDAPClose()
      errmap = LDAPInitArgs(args)

      return true if errmap == {}

      details = Ops.get_string(errmap, "msg", "")
      if Ops.get_string(errmap, "server_msg", "") != ""
        details = Builtins.sformat(
          "%1\n%2",
          details,
          Ops.get_string(errmap, "server_msg", "")
        )
      end
      hint = Ops.get_string(errmap, "hint", "")

      UI.OpenDialog(
        HBox(
          HSpacing(0.5),
          VBox(
            VSpacing(0.5),
            # label
            Left(Heading(Label.ErrorMsg)),
            # error message
            Left(
              Label(_("Connection to the LDAP server cannot be established."))
            ),
            ReplacePoint(Id(:rp), Empty()),
            VSpacing(0.2),
            Left(
              CheckBox(
                Id(:details),
                Opt(:notify),
                # checkbox label
                _("&Show Details"),
                false
              )
            ),
            VSpacing(),
            hint != "" ? VBox(Left(Label(hint)), VSpacing()) : VBox(),
            Left(
              Label(
                # question following error message (yes/no buttons follow)
                _("Really keep this configuration?")
              )
            ),
            HBox(
              PushButton(Id(:yes), Opt(:key_F10, :default), Label.YesButton),
              PushButton(Id(:no), Opt(:key_F9), Label.NoButton)
            )
          ),
          HSpacing(0.5)
        )
      )
      ret = nil
      begin
        ret = UI.UserInput
        if ret == :details
          if Convert.to_boolean(UI.QueryWidget(Id(:details), :Value))
            UI.ReplaceWidget(Id(:rp), VBox(Label(details)))
          else
            UI.ReplaceWidget(Id(:rp), Empty())
          end
        end
      end while ret != :yes && ret != :no
      UI.CloseDialog
      ret == :yes
    end

### - (`Object`) CheckNDS

Check the server if it is NDS (novell directory service)

    2733
    2734
    2735
    2736
    2737
    2738
    2739
    2740
    2741
    2742
    2743
    2744
    2745
    2746
    2747
    2748
    2749
    2750
    2751
    2752
    2753
    2754
    2755
    2756
    2757
    2758
    2759
    2760
    2761
    2762
    2763
    2764
    # File '../../src/modules/Ldap.rb', line 2733

    def CheckNDS
      if !@ldap_initialized
        msg = LDAPInit()
        if msg != ""
          # no popup: see bug #132909
          return false
        end
      end

      vendor = Convert.to_list(
        SCR.Read(
          path(".ldap.search"),
          {
            "base_dn" => "",
            "scope"   => 0,
            "attrs"   => ["vendorVersion", "vendorName"]
          }
        )
      )

      Builtins.y2debug("vendor: %1", vendor)
      output = Ops.get_map(vendor, 0, {})
      Builtins.foreach(output) do |attr, value|
        if Builtins.issubstring(Ops.get_string(value, 0, ""), "Novell")
          Builtins.y2debug("value: %1", Ops.get_string(value, 0, ""))
          @nds = true
        end
      end

      @nds_checked = true
      @nds
    end

### - (`Object`) CheckOES

Check if current machine runs OES

    734
    735
    736
    737
    # File '../../src/modules/Ldap.rb', line 734

    def CheckOES
      @oes = Package.Installed("NOVLam")
      @oes
    end

### - (`Object`) CheckOrderOfCreation

Check if references to other objects are correct; create these objects if possible

    2499
    2500
    2501
    2502
    2503
    2504
    2505
    2506
    2507
    2508
    2509
    2510
    2511
    2512
    2513
    2514
    2515
    2516
    2517
    2518
    2519
    2520
    2521
    2522
    2523
    2524
    2525
    2526
    2527
    2528
    2529
    2530
    2531
    2532
    2533
    2534
    2535
    2536
    2537
    2538
    2539
    2540
    2541
    2542
    2543
    2544
    2545
    2546
    2547
    2548
    2549
    2550
    2551
    2552
    2553
    2554
    2555
    2556
    2557
    2558
    2559
    2560
    2561
    2562
    2563
    2564
    2565
    2566
    2567
    2568
    2569
    2570
    2571
    2572
    2573
    2574
    2575
    2576
    2577
    2578
    2579
    2580
    2581
    2582
    2583
    2584
    2585
    2586
    2587
    2588
    2589
    2590
    2591
    # File '../../src/modules/Ldap.rb', line 2499

    def CheckOrderOfCreation
      Builtins.foreach(
        Convert.convert(
          @config_modules,
          :from => "map",
          :to   => "map <string, map>"
        )
      ) do |dn, m|
        # 1. create suseDefaultBase object if not present
        base_dn = Ops.get_string(m, ["suseDefaultBase", 0], "")
        if base_dn != ""
          object = GetLDAPEntry(base_dn)
          if object == nil
            Builtins.y2warning("reference to nothing? (%1)", base_dn)
            Ops.set(@config_modules, dn, Builtins.remove(m, "suseDefaultBase"))
          elsif object == {}
            default_base = {
              "objectClass" => ["top", "organizationalUnit"],
              "modified"    => "added",
              "ou"          => get_cn(base_dn)
            }
            if @nds
              Ops.set(
                default_base,
                "acl",
                [
                  "3#subtree#[Public]#[All Attributes Rights]",
                  "1#subtree#[Public]#[Entry Rights]"
                ]
              )
            end
            if !ParentExists(base_dn) || !WriteLDAP({ base_dn => default_base })
              Builtins.y2error("%1 cannot be created", base_dn)
              Ops.set(
                @config_modules,
                dn,
                Builtins.remove(m, "suseDefaultBase")
              )
            end
          end
        end
        # 2. empty template must be created when there is a reference
        template_dn = Ops.get_string(m, ["suseDefaultTemplate", 0], "")
        if template_dn != "" && !Builtins.haskey(@templates, template_dn)
          object = GetLDAPEntry(template_dn)
          if Builtins.size(object) == 0
            Builtins.y2milestone("template does not exist, creating default...")
            t_class = Builtins.contains(
              Ops.get_list(m, "objectClass", []),
              "suseGroupConfiguration"
            ) ?
              "suseGroupTemplate" :
              "suseUserTemplate"
            template = { "modified" => "added", "cn" => get_cn(template_dn) }
            template = Builtins.union(
              template,
              Ops.get_map(@new_objects, t_class, {})
            )
            if !ParentExists(template_dn) ||
                !WriteLDAP({ template_dn => template })
              Builtins.y2error("%1 cannot be created", template_dn)
              Ops.set(
                @config_modules,
                dn,
                Builtins.remove(m, "suseDefaultTemplate")
              )
            end
          end
        end
      end

      # 3. check references to secondary groups in templates
      Builtins.foreach(
        Convert.convert(@templates, :from => "map", :to => "map <string, map>")
      ) do |dn, m|
        groups = Ops.get_list(m, "suseSecondaryGroup", [])
        if Ops.greater_than(Builtins.size(groups), 0)
          new_groups = []
          Builtins.foreach(
            Convert.convert(groups, :from => "list", :to => "list <string>")
          ) do |group|
            object = GetLDAPEntry(group)
            if object == nil || object == {}
              Builtins.y2warning("no such group %1;removing reference", group)
            else
              new_groups = Builtins.add(new_groups, group)
            end
          end
          Ops.set(m, "suseSecondaryGroup", new_groups)
        end
      end
      true
    end

### - (`Object`) CheckTemplateDN(dn)

Check if given DN exist and if it points to some template

Parameters:

- dn (`String`)

Returns:

- empty map if DN don't exist, template map if DN points to template object, nil if object with given DN is not template

    2039
    2040
    2041
    2042
    2043
    2044
    2045
    2046
    2047
    2048
    2049
    2050
    2051
    2052
    2053
    2054
    2055
    2056
    2057
    2058
    2059
    2060
    2061
    2062
    2063
    # File '../../src/modules/Ldap.rb', line 2039

    def CheckTemplateDN(dn)
      object = GetLDAPEntry(dn)
      return nil if object == nil
      if object == {}
        # OK, does not exist
        return {}
      end
      cls = Builtins.maplist(Ops.get_list(object, "objectClass", [])) do |c|
        Builtins.tolower(c)
      end
      if Builtins.contains(cls, "suseobjecttemplate")
        # exists as a template -> return object
        object = ConvertDefaultValues(object)
        Ops.set(object, "modified", "edited")
        return AddMissingAttributes(object)
      else
        # error message
        Popup.Error(
          _(
            "An object with the selected DN exists, but it is not a template object.\nSelect another one.\n"
          )
        )
        return nil
      end
    end

### - (`Object`) CommitConfigModules(modules)

Save the edited map of configuration modules to global map

    2066
    2067
    2068
    2069
    2070
    2071
    2072
    2073
    2074
    2075
    2076
    2077
    2078
    2079
    2080
    2081
    2082
    2083
    2084
    2085
    2086
    2087
    2088
    2089
    2090
    2091
    # File '../../src/modules/Ldap.rb', line 2066

    def CommitConfigModules(modules)
      modules = deep_copy(modules)
      Builtins.foreach(
        Convert.convert(modules, :from => "map", :to => "map <string, map>")
      ) do |dn, modmap|
        if !Builtins.haskey(@config_modules, dn)
          Ops.set(@config_modules, dn, Builtins.eval(modmap))
          @ldap_modified = true
          next
        end
        # 'val' can be list (most time), map (default_values), string
        Builtins.foreach(
          Convert.convert(modmap, :from => "map", :to => "map <string, any>")
        ) do |attr, val|
          if Ops.get(@config_modules, [dn, attr]) != val
            Ops.set(@config_modules, [dn, attr], val)
            if !Builtins.haskey(modmap, "modified")
              Ops.set(@config_modules, [dn, "modified"], "edited")
            end
            @ldap_modified = true
            Builtins.y2debug("modified value: %1", val)
          end
        end
      end
      true
    end

### - (`Object`) CommitTemplates(templs)

Save the edited map of templates to global map

    2094
    2095
    2096
    2097
    2098
    2099
    2100
    2101
    2102
    2103
    2104
    2105
    2106
    2107
    2108
    2109
    2110
    2111
    2112
    2113
    2114
    2115
    2116
    2117
    2118
    2119
    2120
    # File '../../src/modules/Ldap.rb', line 2094

    def CommitTemplates(templs)
      templs = deep_copy(templs)
      Builtins.foreach(
        Convert.convert(templs, :from => "map", :to => "map <string, map>")
      ) do |dn, template|
        if !Builtins.haskey(@templates, dn)
          # dn changed
          Ops.set(@templates, dn, Builtins.eval(template))
          @ldap_modified = true
          next
        end
        # 'val' can be list (most time), map (default_values), string
        Builtins.foreach(
          Convert.convert(template, :from => "map", :to => "map <string, any>")
        ) do |attr, val|
          if Ops.get(@templates, [dn, attr]) != val
            Ops.set(@templates, [dn, attr], val)
            if !Builtins.haskey(template, "modified")
              Ops.set(@templates, [dn, "modified"], "edited")
            end
            @ldap_modified = true
            Builtins.y2debug("modified value: %1", val)
          end
        end
      end
      true
    end

### - (`Object`) ConnectWithoutTLS(errmap)

popup shown after failed connection: ask for retry withou TLS (see bug 246397)

Returns:

- true if user wants to retry without TLS

    1348
    1349
    1350
    1351
    1352
    1353
    1354
    1355
    1356
    1357
    1358
    1359
    1360
    1361
    1362
    1363
    1364
    1365
    1366
    1367
    1368
    1369
    1370
    1371
    1372
    1373
    1374
    1375
    1376
    1377
    1378
    1379
    1380
    1381
    1382
    1383
    1384
    1385
    1386
    1387
    1388
    1389
    1390
    1391
    1392
    1393
    1394
    1395
    1396
    1397
    1398
    1399
    1400
    1401
    1402
    1403
    1404
    1405
    1406
    1407
    1408
    1409
    1410
    1411
    1412
    1413
    1414
    # File '../../src/modules/Ldap.rb', line 1348

    def ConnectWithoutTLS(errmap)
      errmap = deep_copy(errmap)
      details = Ops.get_string(errmap, "msg", "")
      if Ops.get_string(errmap, "server_msg", "") != ""
        details = Builtins.sformat(
          "%1\n%2",
          details,
          Ops.get_string(errmap, "server_msg", "")
        )
      end

      UI.OpenDialog(
        HBox(
          HSpacing(0.5),
          VBox(
            VSpacing(0.5),
            # label
            Left(Heading(Label.ErrorMsg)),
            # error message
            Left(
              Label(_("Connection to the LDAP server cannot be established."))
            ),
            ReplacePoint(Id(:rp), Empty()),
            VSpacing(0.2),
            Left(
              CheckBox(
                Id(:details),
                Opt(:notify),
                # checkbox label
                _("&Show Details"),
                false
              )
            ),
            VSpacing(),
            Left(
              Label(
                # question following error message (yes/no buttons follow)
                _(
                  "A possible reason for the failed connection may be that your client is\n" +
                    "configured for TLS/SSL but the server does not support it.\n" +
                    "\n" +
                    "Retry connection without TLS/SSL?\n"
                )
              )
            ),
            ButtonBox(
              PushButton(Id(:yes), Opt(:key_F10, :default), Label.YesButton),
              PushButton(Id(:no), Opt(:key_F9), Label.NoButton)
            )
          ),
          HSpacing(0.5)
        )
      )
      ret = nil
      begin
        ret = UI.UserInput
        if ret == :details
          if Convert.to_boolean(UI.QueryWidget(Id(:details), :Value))
            UI.ReplaceWidget(Id(:rp), VBox(Label(details)))
          else
            UI.ReplaceWidget(Id(:rp), Empty())
          end
        end
      end while ret != :yes && ret != :no
      UI.CloseDialog
      ret == :yes
    end

### - (`Object`) ConvertDefaultValues(templ)

In template object, convert the list of values (which is in the form [ "a1=v1", "a2=v2"]) to map (in the form $[ "a1":"v1", "a2":"v2"]

Parameters:

- templ (`Hash`) —

  original template map

Returns:

- updated template map

    1712
    1713
    1714
    1715
    1716
    1717
    1718
    1719
    1720
    1721
    1722
    1723
    1724
    1725
    # File '../../src/modules/Ldap.rb', line 1712

    def ConvertDefaultValues(templ)
      templ = deep_copy(templ)
      template = Builtins.add(templ, "default_values", {})
      Builtins.foreach(Ops.get_list(templ, "suseDefaultValue", [])) do |value|
        lvalue = Builtins.splitstring(value, "=")
        at = Ops.get(lvalue, 0, "")
        v = Ops.greater_than(Builtins.size(lvalue), 1) ?
          # '=' could be part of value, so we cannot use lvalue[1]
          Builtins.substring(value, Ops.add(Builtins.search(value, "="), 1)) :
          ""
        Ops.set(template, ["default_values", at], v)
      end
      deep_copy(template)
    end

### - (`Object`) CreateDefaultLDAPConfiguration

create the default objects for users and groups

    2594
    2595
    2596
    2597
    2598
    2599
    2600
    2601
    2602
    2603
    2604
    2605
    2606
    2607
    2608
    2609
    2610
    2611
    2612
    2613
    2614
    2615
    2616
    2617
    2618
    2619
    2620
    2621
    2622
    2623
    2624
    2625
    2626
    2627
    2628
    2629
    2630
    2631
    2632
    2633
    2634
    2635
    2636
    2637
    2638
    2639
    2640
    2641
    2642
    2643
    2644
    2645
    2646
    2647
    2648
    2649
    2650
    2651
    2652
    2653
    2654
    2655
    2656
    2657
    2658
    2659
    2660
    2661
    2662
    2663
    2664
    2665
    2666
    2667
    2668
    2669
    2670
    2671
    2672
    2673
    2674
    2675
    2676
    2677
    2678
    2679
    2680
    2681
    2682
    2683
    2684
    2685
    2686
    2687
    2688
    2689
    2690
    2691
    2692
    2693
    2694
    2695
    2696
    2697
    2698
    2699
    2700
    2701
    2702
    2703
    2704
    2705
    2706
    2707
    2708
    2709
    2710
    2711
    2712
    2713
    2714
    2715
    2716
    2717
    2718
    2719
    2720
    2721
    2722
    2723
    2724
    2725
    2726
    2727
    2728
    2729
    2730
    # File '../../src/modules/Ldap.rb', line 2594

    def CreateDefaultLDAPConfiguration
      msg = ""
      if !@ldap_initialized
        msg = LDAPInit()
        if msg != ""
          LDAPErrorMessage("init", msg)
          return false
        end
      end
      if !@schema_initialized
        msg = InitSchema()
        LDAPErrorMessage("schema", msg) if msg != ""
      end
      if @bind_pass != nil && !@bound
        msg = LDAPBind(@bind_pass)
        if msg != ""
          LDAPErrorMessage("bind", msg)
          @bind_pass = nil
        end
      end
      # create base configuration object
      object = GetLDAPEntry(@base_config_dn)
      return false if object == nil
      if object == {}
        if ParentExists(@base_config_dn)
          config_object = {
            "objectClass" => ["top", "organizationalUnit"],
            "modified"    => "added",
            "ou"          => get_cn(@base_config_dn)
          }
          if @nds
            Ops.set(
              config_object,
              "acl",
              [
                "3#subtree#[Public]#[All Attributes Rights]",
                "1#subtree#[Public]#[Entry Rights]"
              ]
            )
          end
          if !WriteLDAP({ @base_config_dn => config_object })
            Builtins.y2error("%1 cannot be created", @base_config_dn)
          end
        end
        #TODO fail?
      end

      modules = {}
      templs = {}
      user_dn = get_dn("userconfiguration")
      group_dn = get_dn("groupconfiguration")

      ReadConfigModules() if @config_modules == {}

      # check which objects already exist...
      Builtins.foreach(
        Convert.convert(
          @config_modules,
          :from => "map",
          :to   => "map <string, map>"
        )
      ) do |dn, m|
        cl = Builtins.maplist(Ops.get_list(m, "objectClass", [])) do |c|
          Builtins.tolower(c)
        end
        user_dn = dn if Builtins.contains(cl, "suseuserconfiguration")
        group_dn = dn if Builtins.contains(cl, "susegroupconfiguration")
      end

      # create user configuration object
      if Ops.get_map(@config_modules, user_dn, {}) == {} &&
          GetLDAPEntry(user_dn) == {}
        Ops.set(
          modules,
          user_dn,
          CreateModule(get_cn(user_dn), "suseUserConfiguration")
        )
      end

      # create group configuration object
      if Ops.get_map(@config_modules, group_dn, {}) == {} &&
          GetLDAPEntry(group_dn) == {}
        Ops.set(
          modules,
          group_dn,
          CreateModule(get_cn(group_dn), "suseGroupConfiguration")
        )
      end

      CommitConfigModules(modules)
      modules = GetConfigModules()
      update_modules = false

      # create user template...
      template_dn = get_string(
        Ops.get_map(modules, user_dn, {}),
        "suseDefaultTemplate"
      )
      if Ops.get_list(modules, [user_dn, "suseDefaultTemplate"], []) == []
        template_dn = Ops.add("cn=usertemplate,", @base_config_dn)
        Ops.set(modules, [user_dn, "suseDefaultTemplate"], [template_dn])
        update_modules = true
      end

      if Ops.get_map(@templates, template_dn, {}) == {} &&
          GetLDAPEntry(template_dn) == {}
        Ops.set(
          templs,
          template_dn,
          CreateTemplate(get_cn(template_dn), ["suseUserConfiguration"])
        )
      end

      # group template...
      template_dn = get_string(
        Ops.get_map(modules, group_dn, {}),
        "suseDefaultTemplate"
      )
      if Ops.get_list(modules, [group_dn, "suseDefaultTemplate"], []) == []
        template_dn = Ops.add("cn=grouptemplate,", @base_config_dn)
        Ops.set(modules, [group_dn, "suseDefaultTemplate"], [template_dn])
        update_modules = true
      end

      if Ops.get_map(@templates, template_dn, {}) == {} &&
          GetLDAPEntry(template_dn) == {}
        Ops.set(
          templs,
          template_dn,
          CreateTemplate(get_cn(template_dn), ["suseGroupConfiguration"])
        )
      end

      CommitConfigModules(modules) if update_modules
      CommitTemplates(templs)
      true
    end

### - (`Object`) CreateModule(cn, _class)

Creates default new map for new configuration object

Parameters:

- class (`String`) —

  additional objectClass of new module (e.g.userConfiguration)

Returns:

- new module map

    1925
    1926
    1927
    1928
    1929
    1930
    1931
    1932
    1933
    1934
    1935
    1936
    1937
    1938
    1939
    1940
    1941
    1942
    1943
    1944
    1945
    1946
    1947
    1948
    1949
    1950
    1951
    1952
    1953
    1954
    1955
    1956
    1957
    1958
    1959
    1960
    1961
    1962
    1963
    1964
    1965
    1966
    1967
    1968
    1969
    1970
    1971
    1972
    1973
    1974
    1975
    1976
    1977
    1978
    1979
    1980
    1981
    1982
    1983
    1984
    1985
    1986
    1987
    1988
    1989
    1990
    1991
    1992
    1993
    1994
    1995
    1996
    1997
    1998
    # File '../../src/modules/Ldap.rb', line 1925

    def CreateModule(cn, _class)
      obj = {
        "cn"          => [cn],
        "objectClass" => Builtins.add(
          ["top", "suseModuleConfiguration"],
          _class
        ),
        "modified"    => "added"
      }
      # create some good defaults
      obj = Builtins.union(obj, Ops.get_map(@new_objects, _class, {}))
      templs = []
      templ_cn = ""
      default_base = ""
      if Builtins.tolower(_class) == "suseuserconfiguration"
        Builtins.foreach(
          Convert.convert(
            @templates,
            :from => "map",
            :to   => "map <string, map <string, any>>"
          )
        ) do |dn, t|
          cls = Builtins.maplist(Ops.get_list(t, "objectClass", [])) do |c|
            Builtins.tolower(c)
          end
          if Builtins.contains(cls, "suseusertemplate")
            templs = Builtins.add(templs, dn)
          end
        end
        templ_cn = "usertemplate" if templs == []
        default_base = Builtins.sformat("ou=people,%1", @base_dn)

        # for eDirectory, we have to use cleartext passwords!
        if @nds &&
            Builtins.tolower(Ops.get_string(obj, ["susePasswordHash", 0], "")) != "clear"
          Ops.set(obj, "susePasswordHash", ["clear"])
        end
      end
      if Builtins.tolower(_class) == "susegroupconfiguration"
        Builtins.foreach(
          Convert.convert(
            @templates,
            :from => "map",
            :to   => "map <string, map <string, any>>"
          )
        ) do |dn, t|
          cls = Builtins.maplist(Ops.get_list(t, "objectClass", [])) do |c|
            Builtins.tolower(c)
          end
          if Builtins.contains(cls, "susegrouptemplate")
            templs = Builtins.add(templs, dn)
          end
        end
        templ_cn = "grouptemplate" if templs == []
        default_base = Builtins.sformat("ou=group,%1", @base_dn)
      end
      # create proposal for defaultTemplate DN
      if templ_cn != ""
        tdn = Builtins.sformat("cn=%1,%2", templ_cn, @base_config_dn)
        i = 0
        while Ops.greater_than(Builtins.size(GetLDAPEntry(tdn)), 0)
          tdn = Builtins.sformat("cn=%1%2,%3", templ_cn, i, @base_config_dn)
          i = Ops.add(i, 1)
        end
        templs = [tdn]
      end
      Ops.set(obj, "suseDefaultTemplate", templs)
      Ops.set(obj, "suseDefaultBase", [default_base])
      Convert.convert(
        AddMissingAttributes(obj),
        :from => "map",
        :to   => "map <string, any>"
      )
    end

### - (`Object`) CreateTemplate(cn, classes)

Creates default new map for a new object template

Parameters:

- cn (`String`) —

  cn of new template

- classes (`Array<String>`) —

  object classes of the object the template will belong to

Returns:

- template map

    1900
    1901
    1902
    1903
    1904
    1905
    1906
    1907
    1908
    1909
    1910
    1911
    1912
    1913
    1914
    1915
    1916
    1917
    1918
    1919
    1920
    # File '../../src/modules/Ldap.rb', line 1900

    def CreateTemplate(cn, classes)
      classes = deep_copy(classes)
      obj = { "cn" => [cn], "modified" => "added" }
      classes = Builtins.maplist(classes) { |c| Builtins.tolower(c) }
      if Builtins.contains(classes, "suseuserconfiguration")
        obj = Builtins.union(
          obj,
          Ops.get_map(@new_objects, "suseUserTemplate", {})
        )
      elsif Builtins.contains(classes, "susegroupconfiguration")
        obj = Builtins.union(
          obj,
          Ops.get_map(@new_objects, "suseGroupTemplate", {})
        )
      else
        Ops.set(obj, "objectClass", ["top", "suseObjectTemplate"])
      end

      obj = ConvertDefaultValues(obj)
      AddMissingAttributes(obj)
    end

### - (`Object`) DomainChanged

obsolete, use BaseDNChanged

    328
    329
    330
    # File '../../src/modules/Ldap.rb', line 328

    def DomainChanged
      BaseDNChanged()
    end

### - (`Object`) Export

Dump the LDAP settings to a map, for autoinstallation use.

    475
    476
    477
    478
    479
    480
    481
    482
    483
    484
    485
    486
    487
    488
    489
    490
    491
    492
    493
    494
    495
    496
    497
    498
    499
    500
    501
    502
    503
    504
    505
    506
    507
    508
    509
    510
    511
    512
    513
    514
    515
    # File '../../src/modules/Ldap.rb', line 475

    def Export
      e = {
        "start_ldap"       => @start,
        "ldap_server"      => @server,
        "ldap_domain"      => @base_dn,
        "ldap_tls"         => @ldap_tls,
        "bind_dn"          => @bind_dn,
        "file_server"      => @file_server,
        "base_config_dn"   => @base_config_dn,
        "pam_password"     => @pam_password,
        "member_attribute" => @member_attribute,
        "create_ldap"      => @create_ldap,
        "login_enabled"    => @login_enabled,
        "mkhomedir"        => @mkhomedir,
        "sssd"             => @sssd,
        "sssd_with_krb"    => @sssd_with_krb
      }
      Ops.set(e, "tls_checkpeer", @tls_checkpeer) if @tls_checkpeer != "yes"
      Ops.set(e, "tls_cacertdir", @tls_cacertdir) if @tls_cacertdir != ""
      Ops.set(e, "tls_cacertfile", @tls_cacertfile) if @tls_cacertfile != ""
      if @nss_base_passwd != @base_dn
        Ops.set(e, "nss_base_passwd", @nss_base_passwd)
      end
      if @nss_base_shadow != @base_dn
        Ops.set(e, "nss_base_shadow", @nss_base_shadow)
      end
      if @nss_base_group != @base_dn
        Ops.set(e, "nss_base_group", @nss_base_group)
      end
      Ops.set(e, "start_autofs", @_start_autofs) if @_autofs_allowed
      Ops.set(e, "krb5_realm", @krb5_realm) if @krb5_realm != ""
      Ops.set(e, "krb5_kdcip", @krb5_kdcip) if @krb5_kdcip != ""
      if @sssd_ldap_schema != "rfc2307bis"
        Ops.set(e, "sssd_ldap_schema", @sssd_ldap_schema)
      end
      Ops.set(e, "sssd_enumerate", @sssd_enumerate) if @sssd_enumerate
      if @sssd_cache_credentials
        Ops.set(e, "sssd_cache_credentials", @sssd_cache_credentials)
      end
      deep_copy(e)
    end

### - (`Object`) GetAllAttributes(_class)

Returns allowed and required attributes of given object class Read it from LDAP if it was not done yet.

Parameters:

- class (`String`) —

  name of object class

Returns:

- attribute names (list of strings)

    1595
    1596
    1597
    1598
    1599
    1600
    1601
    1602
    1603
    1604
    1605
    1606
    1607
    1608
    1609
    1610
    1611
    1612
    1613
    1614
    1615
    1616
    1617
    1618
    1619
    1620
    1621
    1622
    1623
    1624
    1625
    1626
    1627
    1628
    1629
    1630
    # File '../../src/modules/Ldap.rb', line 1595

    def GetAllAttributes(_class)
      _class = Builtins.tolower(_class)
      if !Builtins.haskey(@object_classes, _class)
        object_class = Convert.to_map(
          SCR.Read(path(".ldap.schema.oc"), { "name" => _class })
        )
        object_class = {} if object_class == nil #TODO return from function?
        Ops.set(
          object_class,
          "all",
          Builtins.union(
            Ops.get_list(object_class, "may", []),
            Ops.get_list(object_class, "must", [])
          )
        )
        # read attributes of superior classes
        Builtins.foreach(Ops.get_list(object_class, "sup", [])) do |sup_oc|
          sup_all = GetAllAttributes(sup_oc)
          Ops.set(
            object_class,
            "all",
            Builtins.union(Ops.get_list(object_class, "all", []), sup_all)
          )
          Ops.set(
            object_class,
            "must",
            Builtins.union(
              Ops.get_list(object_class, "must", []),
              Ops.get_list(@object_classes, [sup_oc, "must"], [])
            )
          )
        end
        Ops.set(@object_classes, _class, object_class)
      end
      Ops.get_list(@object_classes, [_class, "all"], [])
    end

### - (`Object`) GetBaseDN

Get the Base DN

    333
    334
    335
    # File '../../src/modules/Ldap.rb', line 333

    def GetBaseDN
      @base_dn
    end

### - (`Object`) GetBindDN

return administrator's DN if it was not read yet, read it now

    1180
    1181
    1182
    1183
    1184
    1185
    1186
    1187
    1188
    1189
    # File '../../src/modules/Ldap.rb', line 1180

    def GetBindDN
      if @bind_pass == nil && Builtins.size(@bind_dn) == 0
        Builtins.y2milestone("--- bind dn not read yet or empty, reading now")
        @bind_dn = Convert.to_string(SCR.Read(path(".sysconfig.ldap.BIND_DN")))
        if @bind_dn == nil || @bind_dn == ""
          @bind_dn = ReadLdapConfEntry("binddn", "")
        end
      end
      @bind_dn
    end

### - (`Object`) GetConfigModules

Return the map of configuration modules (new copy) (in the form $[ DN: $[ map_of_one_module] ])

    1868
    1869
    1870
    # File '../../src/modules/Ldap.rb', line 1868

    def GetConfigModules
      Builtins.eval(@config_modules)
    end

### - (`Object`) GetDefaultObjectClasses(template)

Return list of default object classes for user or group There is fixed list here, it is not saved anywhere (only in default users plugin for LDAP objects)

Parameters:

- template (`Hash`) —

  used for differ if we need user or group list

    1881
    1882
    1883
    1884
    1885
    1886
    1887
    1888
    1889
    1890
    1891
    1892
    1893
    1894
    # File '../../src/modules/Ldap.rb', line 1881

    def GetDefaultObjectClasses(template)
      template = deep_copy(template)
      ocs = Builtins.maplist(Ops.get_list(template, "objectClass", [])) do |c|
        Builtins.tolower(c)
      end

      if Builtins.contains(ocs, "susegrouptemplate")
        return ["top", "posixGroup", "groupOfNames"]
        # TODO sometimes there is groupofuniquenames...
      elsif Builtins.contains(ocs, "suseusertemplate")
        return ["top", "posixAccount", "shadowAccount", "InetOrgPerson"]
      end
      []
    end

### - (`Object`) GetDomain

obsolete, use GetBaseDN

    338
    339
    340
    # File '../../src/modules/Ldap.rb', line 338

    def GetDomain
      GetBaseDN()
    end

### - (`Object`) GetFirstPort(servers)

this is a hack

    1205
    1206
    1207
    1208
    1209
    1210
    1211
    1212
    1213
    1214
    1215
    1216
    1217
    1218
    1219
    1220
    # File '../../src/modules/Ldap.rb', line 1205

    def GetFirstPort(servers)
      if @bind_pass == nil && servers == ""
        Builtins.y2milestone("--- server not read yet or empty, reading now")
        servers = ReadLdapHosts()
      end

      l_servers = Builtins.splitstring(servers, " \t")
      srv = Ops.get_string(l_servers, 0, "")
      return @default_port if !Builtins.issubstring(srv, ":")
      s_port = Builtins.substring(srv, Ops.add(Builtins.search(srv, ":"), 1))
      if s_port == "" || Builtins.tointeger(s_port) == nil
        return @default_port
      else
        return Builtins.tointeger(s_port)
      end
    end

### - (`Object`) GetFirstServer(servers)

this is a hack

    1193
    1194
    1195
    1196
    1197
    1198
    1199
    1200
    1201
    1202
    # File '../../src/modules/Ldap.rb', line 1193

    def GetFirstServer(servers)
      if @bind_pass == nil && servers == ""
        Builtins.y2milestone("--- server not read yet or empty, reading now")
        servers = ReadLdapHosts()
      end

      l_servers = Builtins.splitstring(servers, " \t")
      srv = Ops.get_string(l_servers, 0, "")
      Ops.get(Builtins.splitstring(srv, ":"), 0, "")
    end

### - (`Object`) GetGroupsDN(base)

Returns DN's of groups (objectClass=posixGroup) in given base

Parameters:

- base (`String`) —

  LDAP search base

    2030
    2031
    2032
    2033
    # File '../../src/modules/Ldap.rb', line 2030

    def GetGroupsDN(base)
      @groups_dn = ReadDN(base, "objectClass=posixGroup") if @groups_dn == []
      deep_copy(@groups_dn)
    end

### - (`Hash`) GetLDAPEntry(dn)

Search for one entry (=base scope) in LDAP directory

Parameters:

- dn (`String`) —

  DN of entry

Returns:

- (`Hash`) —

  with entry values, empty map if nothing found, nil on error

    1792
    1793
    1794
    1795
    1796
    1797
    1798
    1799
    1800
    1801
    1802
    1803
    1804
    1805
    1806
    1807
    1808
    1809
    1810
    1811
    1812
    1813
    1814
    1815
    1816
    1817
    1818
    1819
    1820
    1821
    1822
    1823
    1824
    1825
    1826
    1827
    # File '../../src/modules/Ldap.rb', line 1792

    def GetLDAPEntry(dn)
      if !@ldap_initialized
        msg = LDAPInit()
        if msg != ""
          LDAPErrorMessage("init", msg)
          return nil
        end
      end
      if !@schema_initialized
        msg = InitSchema()
        if msg != ""
          LDAPErrorMessage("schema", msg)
          return nil
        end
      end
      if @bind_pass == nil && !@anonymous
        @bind_pass = LDAPAskAndBind(true)
        return nil if @bind_pass == nil
      end
      objects = Convert.to_list(
        SCR.Read(
          path(".ldap.search"),
          {
            "base_dn"      => dn,
            "attrs"        => [],
            "scope"        => 0, # only this one
            "not_found_ok" => true
          }
        )
      )
      if objects == nil
        LDAPErrorMessage("read", LDAPError())
        return nil
      end
      Ops.get_map(objects, 0, {})
    end

### - (`Object`) GetLDAPPassword(enable_anonymous)

Asks user for bind password to LDAP server

Parameters:

- anonymous —

  if anonymous access could be allowed

Returns:

- password

    1487
    1488
    1489
    1490
    1491
    1492
    1493
    1494
    1495
    1496
    1497
    1498
    1499
    1500
    1501
    1502
    1503
    1504
    1505
    1506
    1507
    1508
    1509
    1510
    1511
    1512
    1513
    1514
    1515
    1516
    1517
    1518
    1519
    1520
    1521
    1522
    1523
    1524
    1525
    1526
    # File '../../src/modules/Ldap.rb', line 1487

    def GetLDAPPassword(enable_anonymous)
      UI.OpenDialog(
        Opt(:decorated),
        VBox(
          HSpacing(40),
          # password entering label
          Password(Id(:pw), Opt(:hstretch), _("&LDAP Server Password")),
          # label
          Label(
            Builtins.sformat(
              _("Server: %1:%2"),
              GetFirstServer(@server),
              GetFirstPort(@server)
            )
          ),
          # label (%1 is admin DN - string)
          Label(Builtins.sformat(_("Administrator: %1"), GetBindDN())),
          ButtonBox(
            PushButton(Id(:ok), Opt(:key_F10, :default), Label.OKButton),
            # button label
            PushButton(Id(:anon), Opt(:key_F6), _("&Anonymous Access")),
            PushButton(Id(:cancel), Opt(:key_F9), Label.CancelButton)
          )
        )
      )
      UI.ChangeWidget(Id(:anon), :Enabled, false) if !enable_anonymous
      UI.SetFocus(Id(:pw))
      ret = UI.UserInput
      pw = ""
      if ret == :ok
        pw = Convert.to_string(UI.QueryWidget(Id(:pw), :Value))
        @anonymous = false
      elsif ret == :cancel
        pw = nil
      else
        @anonymous = true
      end
      UI.CloseDialog
      pw
    end

### - (`Object`) GetMainConfigDN

Return main configuration object DN

    1862
    1863
    1864
    # File '../../src/modules/Ldap.rb', line 1862

    def GetMainConfigDN
      @base_config_dn
    end

### - (`Object`) GetObjectAttributes(classes)

Returns the list of all allowed and required attributes for each object class, given in the list of object classes

Parameters:

- classes (`Array`) —

  list of object classes whose attributes we want

Returns:

- attribute names (list of strings)

    1652
    1653
    1654
    1655
    1656
    1657
    1658
    1659
    # File '../../src/modules/Ldap.rb', line 1652

    def GetObjectAttributes(classes)
      classes = deep_copy(classes)
      ret = []
      Builtins.foreach(
        Convert.convert(classes, :from => "list", :to => "list <string>")
      ) { |_class| ret = Builtins.union(ret, GetAllAttributes(_class)) }
      deep_copy(ret)
    end

### - (`Object`) GetOptionalAttributes(_class)

    1642
    1643
    1644
    1645
    1646
    # File '../../src/modules/Ldap.rb', line 1642

    def GetOptionalAttributes(_class)
      _class = Builtins.tolower(_class)
      GetAllAttributes(_class) if !Builtins.haskey(@object_classes, _class)
      Ops.get_list(@object_classes, [_class, "may"], [])
    end

### - (`Object`) GetRequiredAttributes(_class)

Returns required attributes of given object class Read it from LDAP if it was not done yet.

Parameters:

- class (`String`) —

  name of object class

Returns:

- attribute names (list of strings)

    1636
    1637
    1638
    1639
    1640
    # File '../../src/modules/Ldap.rb', line 1636

    def GetRequiredAttributes(_class)
      _class = Builtins.tolower(_class)
      GetAllAttributes(_class) if !Builtins.haskey(@object_classes, _class)
      Ops.get_list(@object_classes, [_class, "must"], [])
    end

### - (`Object`) GetTemplates

Return the map of templates (new copy)

    1873
    1874
    1875
    # File '../../src/modules/Ldap.rb', line 1873

    def GetTemplates
      Builtins.eval(@templates)
    end

### - (`Object`) Import(settings)

Get all the LDAP configuration from a map. When called by ldap_auto (preparing autoinstallation data) the map may be empty.

Parameters:

- settings (`Hash`) —

  $[“start”: “domain”: “servers”: ]

Returns:

- success

    467
    468
    469
    470
    471
    # File '../../src/modules/Ldap.rb', line 467

    def Import(settings)
      settings = deep_copy(settings)
      Set(settings)
      true
    end

### - (`Object`) InitSchema

Prepare agent for later schema queries (agent reads schema to its internal structures)

Returns:

- error message

    1687
    1688
    1689
    1690
    1691
    1692
    1693
    1694
    1695
    1696
    1697
    1698
    1699
    1700
    1701
    1702
    1703
    1704
    1705
    # File '../../src/modules/Ldap.rb', line 1687

    def InitSchema
      schemas = Convert.to_list(
        SCR.Read(
          path(".ldap.search"), #0:base
          { "base_dn" => "", "attrs" => ["subschemaSubentry"], "scope" => 0 }
        )
      )
      schema_dn = Ops.get_string(schemas, [0, "subschemaSubentry", 0], "")
      return LDAPError() if schemas == nil || schema_dn == ""

      if !Convert.to_boolean(
          SCR.Execute(path(".ldap.schema"), { "schema_dn" => schema_dn })
        )
        return LDAPError()
      end

      @schema_initialized = true
      ""
    end

### - (`Object`) LDAPAskAndBind(enable_anonymous)

Asks for LDAP password and tries to bind with it

Returns:

- password entered, nil on cancel

    1530
    1531
    1532
    1533
    1534
    1535
    1536
    1537
    1538
    1539
    1540
    1541
    1542
    # File '../../src/modules/Ldap.rb', line 1530

    def LDAPAskAndBind(enable_anonymous)
      return nil if Mode.commandline
      pw = GetLDAPPassword(enable_anonymous)
      if pw != nil
        ldap_msg = LDAPBind(pw)
        while pw != nil && ldap_msg != ""
          LDAPErrorMessage("bind", ldap_msg)
          pw = GetLDAPPassword(enable_anonymous)
          ldap_msg = LDAPBind(pw)
        end
      end
      pw
    end

### - (`Object`) LDAPBind(pass)

Binds to LDAP server

Parameters:

- pass (`String`) —

  password

    1470
    1471
    1472
    1473
    1474
    1475
    1476
    1477
    1478
    1479
    1480
    1481
    1482
    # File '../../src/modules/Ldap.rb', line 1470

    def LDAPBind(pass)
      ret = ""
      if pass != nil
        args = {}
        args = { "bind_dn" => @bind_dn, "bind_pw" => pass } if !@anonymous
        if !Convert.to_boolean(SCR.Execute(path(".ldap.bind"), args))
          ret = LDAPError()
        else
          @bound = true
        end
      end
      ret
    end

### - (`Object`) LDAPClose

Shut down existing LDAP connection

    1223
    1224
    1225
    1226
    # File '../../src/modules/Ldap.rb', line 1223

    def LDAPClose
      @ldap_initialized = false
      Convert.to_boolean(SCR.Execute(path(".ldap.close")))
    end

### - (`Object`) LDAPError

Reads and returns error message from agent

    1164
    1165
    1166
    1167
    1168
    1169
    1170
    1171
    1172
    1173
    1174
    1175
    # File '../../src/modules/Ldap.rb', line 1164

    def LDAPError
      err_map = LDAPErrorMap()
      error = Ops.get_string(err_map, "msg", "")
      if Ops.get_string(err_map, "server_msg", "") != ""
        error = Builtins.sformat(
          "%1\n(%2)",
          error,
          Ops.get_string(err_map, "server_msg", "")
        )
      end
      error
    end

### - (`Object`) LDAPErrorMap

Reads and returns error map (=message + code) from agent

    1151
    1152
    1153
    1154
    1155
    1156
    1157
    1158
    1159
    1160
    1161
    # File '../../src/modules/Ldap.rb', line 1151

    def LDAPErrorMap
      ret = Convert.to_map(SCR.Read(path(".ldap.error")))
      if Ops.get_string(@ldap_error_hints, Ops.get_integer(ret, "code", 0), "") != ""
        Ops.set(
          ret,
          "hint",
          Ops.get_string(@ldap_error_hints, Ops.get_integer(ret, "code", 0), "")
        )
      end
      deep_copy(ret)
    end

### - (`Object`) LDAPErrorMessage(type, error)

Error popup for errors detected during LDAP operation

Parameters:

- type (`String`) —

  error type: binding/reading/writing

- detailed —

  error message (from agent-ldap)

    1044
    1045
    1046
    1047
    1048
    1049
    1050
    1051
    1052
    1053
    1054
    1055
    1056
    1057
    1058
    1059
    1060
    1061
    1062
    1063
    1064
    1065
    1066
    1067
    1068
    1069
    1070
    1071
    1072
    1073
    1074
    1075
    1076
    1077
    1078
    1079
    1080
    1081
    1082
    1083
    1084
    1085
    1086
    1087
    1088
    1089
    1090
    1091
    1092
    1093
    1094
    1095
    1096
    1097
    1098
    1099
    1100
    1101
    1102
    1103
    1104
    1105
    1106
    1107
    1108
    1109
    1110
    1111
    1112
    1113
    1114
    1115
    1116
    1117
    1118
    1119
    1120
    1121
    1122
    1123
    1124
    1125
    1126
    1127
    1128
    1129
    1130
    1131
    1132
    1133
    1134
    1135
    1136
    1137
    1138
    1139
    1140
    1141
    1142
    1143
    1144
    1145
    1146
    1147
    1148
    # File '../../src/modules/Ldap.rb', line 1044

    def LDAPErrorMessage(type, error)
      ldap_error = {
        # error message:
        "initialize"   => _(
          "\nThe server could be down or unreachable.\n"
        ),
        # error message:
        "missing_dn"   => _(
          "\nThe value of DN is missing or invalid.\n"
        ),
        # error message:
        "at_not_found" => _("\nAttribute type not found.\n"),
        # error message:
        "oc_not_found" => _("\nObject class not found.\n")
      }

      error_type = {
        # error message, more specific description follows
        "init"   => _(
          "Connection to the LDAP server cannot be established."
        ),
        # error message, more specific description follows
        "bind"   => _(
          "A problem occurred while connecting to the LDAP server."
        ),
        # error message, more specific description follows
        "read"   => _(
          "A problem occurred while reading data from the LDAP server."
        ),
        # error message, more specific description follows
        "users"  => _(
          "A problem occurred while writing LDAP users."
        ),
        # error message, more specific description follows
        "groups" => _(
          "A problem occurred while writing LDAP groups."
        ),
        # error message, more specific description follows
        "write"  => _(
          "A problem occurred while writing data to the LDAP server."
        ),
        # error message, more specific description follows
        "schema" => _(
          "A problem occurred while reading schema from the LDAP server."
        )
      }

      if !@use_gui || Mode.commandline
        Builtins.y2error(Ops.get_string(error_type, type, "Unknown LDAP error"))
        Builtins.y2error(Ops.get_string(ldap_error, error, error))
        return
      end

      error = "YaST error?" if error == nil

      UI.OpenDialog(
        HBox(
          HSpacing(0.5),
          VBox(
            VSpacing(0.5),
            # label
            Left(Heading(Label.ErrorMsg)),
            # default error message
            Label(
              Ops.get_locale(
                error_type,
                type,
                _("An unknown LDAP error occurred.")
              )
            ),
            ReplacePoint(Id(:rp), Empty()),
            VSpacing(0.5),
            Left(
              CheckBox(
                Id(:details),
                Opt(:notify),
                # checkbox label
                _("&Show Details"),
                false
              )
            ),
            PushButton(Id(:ok), Opt(:key_F10, :default), Label.OKButton)
          ),
          HSpacing(0.5)
        )
      )
      ret = nil
      UI.ChangeWidget(Id(:details), :Enabled, false) if error == ""
      begin
        ret = UI.UserInput
        if ret == :details
          if Convert.to_boolean(UI.QueryWidget(Id(:details), :Value))
            UI.ReplaceWidget(
              Id(:rp),
              VBox(Label(Ops.get_string(ldap_error, error, error)))
            )
          else
            UI.ReplaceWidget(Id(:rp), Empty())
          end
        end
      end while ret != :ok && ret != :cancel
      UI.CloseDialog

      nil
    end

### - (`Object`) LDAPInit

Initializes LDAP agent

    1229
    1230
    1231
    1232
    1233
    1234
    1235
    1236
    1237
    1238
    1239
    1240
    1241
    1242
    1243
    1244
    1245
    1246
    1247
    1248
    1249
    # File '../../src/modules/Ldap.rb', line 1229

    def LDAPInit
      # FIXME what if we have more servers? -> choose dialog?
      ret = ""
      args = {
        "hostname"   => GetFirstServer(@server),
        "port"       => GetFirstPort(@server),
        "use_tls"    => @ldap_tls ? "yes" : "no",
        "cacertdir"  => @tls_cacertdir,
        "cacertfile" => @tls_cacertfile
      }
      init = Convert.to_boolean(SCR.Execute(path(".ldap"), args))
      if init == nil
        # error message
        ret = _("Unknown error. Perhaps 'yast2-ldap' is not available.")
      else
        @ldap_initialized = init
        @tls_when_initialized = @ldap_tls
        ret = LDAPError() if !init
      end
      ret
    end

### - (`Object`) LDAPInitArgs(args)

Initializes LDAP agent; use the data passed as argument instead global values Returns whole error map, not just message

    1253
    1254
    1255
    1256
    1257
    1258
    1259
    1260
    1261
    1262
    1263
    1264
    1265
    1266
    1267
    1268
    1269
    1270
    1271
    1272
    1273
    # File '../../src/modules/Ldap.rb', line 1253

    def LDAPInitArgs(args)
      args = deep_copy(args)
      ret = {}
      init = Convert.to_boolean(SCR.Execute(path(".ldap"), args))
      if init == nil
        # error message
        Ops.set(
          ret,
          "msg",
          _("Unknown error. Perhaps 'yast2-ldap' is not available.")
        )
      else
        @ldap_initialized = init
        if !init
          ret = LDAPErrorMap()
        else
          @tls_when_initialized = Ops.get_string(args, "use_tls", "") == "yes"
        end
      end
      deep_copy(ret)
    end

### - (`Object`) LDAPInitWithTLSCheck(args)

Initializes LDAP agent, offers to turn off TLS if it failed

    1418
    1419
    1420
    1421
    1422
    1423
    1424
    1425
    1426
    1427
    1428
    1429
    1430
    1431
    1432
    1433
    1434
    1435
    1436
    1437
    1438
    1439
    1440
    1441
    1442
    1443
    1444
    1445
    1446
    1447
    1448
    1449
    1450
    1451
    1452
    1453
    1454
    1455
    1456
    1457
    1458
    1459
    1460
    1461
    1462
    1463
    1464
    1465
    1466
    # File '../../src/modules/Ldap.rb', line 1418

    def LDAPInitWithTLSCheck(args)
      args = deep_copy(args)
      ret = ""
      if args == {}
        args = {
          "hostname"   => GetFirstServer(@server),
          "port"       => GetFirstPort(@server),
          "use_tls"    => @ldap_tls ? "yes" : "no",
          "cacertdir"  => @tls_cacertdir,
          "cacertfile" => @tls_cacertfile
        }
      end
      init = Convert.to_boolean(SCR.Execute(path(".ldap"), args))
      # error message
      unknown = _("Unknown error. Perhaps 'yast2-ldap' is not available.")
      if init == nil
        ret = unknown
      else
        if !init
          errmap = LDAPErrorMap()
          if Ops.get_string(args, "use_tls", "") == "yes" &&
              Ops.get_boolean(errmap, "tls_error", false) &&
              ConnectWithoutTLS(errmap)
            Ops.set(args, "use_tls", "no")
            init = Convert.to_boolean(SCR.Execute(path(".ldap"), args))
            if init == nil
              ret = unknown
            elsif !init
              ret = LDAPError()
            else
              Builtins.y2milestone("switching TLS off...")
              @tls_switched_off = true
            end
          else
            ret = Ops.get_string(errmap, "msg", "")
            if Ops.get_string(errmap, "server_msg", "") != ""
              ret = Builtins.sformat(
                "%1\n%2",
                ret,
                Ops.get_string(errmap, "server_msg", "")
              )
            end
          end
        end
        @ldap_initialized = init
        @tls_when_initialized = Ops.get_string(args, "use_tls", "no") == "yes"
      end
      ret
    end

### - (`Object`) main

    33
    34
    35
    36
    37
    38
    39
    40
    41
    42
    43
    44
    45
    46
    47
    48
    49
    50
    51
    52
    53
    54
    55
    56
    57
    58
    59
    60
    61
    62
    63
    64
    65
    66
    67
    68
    69
    70
    71
    72
    73
    74
    75
    76
    77
    78
    79
    80
    81
    82
    83
    84
    85
    86
    87
    88
    89
    90
    91
    92
    93
    94
    95
    96
    97
    98
    99
    100
    101
    102
    103
    104
    105
    106
    107
    108
    109
    110
    111
    112
    113
    114
    115
    116
    117
    118
    119
    120
    121
    122
    123
    124
    125
    126
    127
    128
    129
    130
    131
    132
    133
    134
    135
    136
    137
    138
    139
    140
    141
    142
    143
    144
    145
    146
    147
    148
    149
    150
    151
    152
    153
    154
    155
    156
    157
    158
    159
    160
    161
    162
    163
    164
    165
    166
    167
    168
    169
    170
    171
    172
    173
    174
    175
    176
    177
    178
    179
    180
    181
    182
    183
    184
    185
    186
    187
    188
    189
    190
    191
    192
    193
    194
    195
    196
    197
    198
    199
    200
    201
    202
    203
    204
    205
    206
    207
    208
    209
    210
    211
    212
    213
    214
    215
    216
    217
    218
    219
    220
    221
    222
    223
    224
    225
    226
    227
    228
    229
    230
    231
    232
    233
    234
    235
    236
    237
    238
    239
    240
    241
    242
    243
    244
    245
    246
    247
    248
    249
    250
    251
    252
    253
    254
    255
    256
    257
    258
    259
    260
    261
    262
    263
    264
    265
    266
    267
    268
    269
    270
    271
    272
    273
    274
    275
    276
    277
    278
    279
    280
    281
    282
    283
    284
    285
    286
    287
    288
    289
    290
    291
    292
    293
    294
    295
    296
    297
    298
    299
    300
    301
    302
    303
    304
    305
    306
    307
    308
    309
    310
    311
    312
    313
    314
    315
    316
    # File '../../src/modules/Ldap.rb', line 33

    def main
      Yast.import "UI"
      textdomain "ldap-client"

      Yast.import "Autologin"
      Yast.import "Directory"
      Yast.import "FileUtils"
      Yast.import "DNS"
      Yast.import "Hostname"
      Yast.import "Label"
      Yast.import "Message"
      Yast.import "Mode"
      Yast.import "Nsswitch"
      Yast.import "Package"
      Yast.import "Pam"
      Yast.import "Popup"
      Yast.import "ProductFeatures"
      Yast.import "Progress"
      Yast.import "Report"
      Yast.import "Service"
      Yast.import "Stage"
      Yast.import "String"
      Yast.import "Summary"
      Yast.import "URL"

      # show popups with error messages?
      @use_gui = true

      # DN of base configuration object
      @base_config_dn = ""

      Yast.include self, "ldap/routines.rb"

      # Required packages for this module to operate
      # -- they are now required only when LDAP is set for authentication
      @required_packages = []

      # Write only, used during autoinstallation.
      # Don't run services and SuSEconfig, it's all done at one place.
      @write_only = false

      # Are LDAP services available via nsswitch.conf?
      @start = false
      @old_start = false

      # Is NIS service available? If yes, and LDAP client will be enabled, warn
      # user (see bug #36981)
      @nis_available = false

      # If no, automounter will not be affected.
      @_autofs_allowed = true
      # Start automounter and import the settings from LDAP
      @_start_autofs = false

      # If login of LDAP uses to local machine is enabled
      @login_enabled = true

      # which attribute have LDAP groups for list of members
      @member_attribute = ""
      @old_member_attribute = ""

      # IP addresses of LDAP server.
      @server = ""
      @old_server = ""

      # local settings modified?
      @modified = false

      # /etc/openldap/ldap.conf modified?
      @openldap_modified = false

      # base DN
      @base_dn = ""
      @old_base_dn = nil
      @base_dn_changed = false

      @ldap_tls = true

      # CA certificates for server certificate verification
      # At least one of these are required if tls_checkpeer is "yes"
      @tls_cacertdir = ""
      @tls_cacertfile = ""
      # Require and verify server certificate (yes/no)
      @tls_checkpeer = "yes"

      # Which crypt method should be used?
      @pam_password = "exop"

      # lines of /etc/passwd, starting with +/-
      @plus_lines_passwd = []

      @default_port = 389

      # If home directories of LDAP users are stored on this machine
      @file_server = false

      # settings from ldap.conf
      @nss_base_passwd = ""
      @nss_base_shadow = ""
      @nss_base_group = ""
      # settings from LDAP configuration objects
      @user_base = ""
      @group_base = ""

      # stored values of /etc/nsswitch.conf
      @nsswitch = {
        "passwd"        => [],
        "group"         => [],
        "passwd_compat" => [],
        "group_compat"  => []
      }

      # are we binding anonymously?
      @anonymous = false

      # bind password for LDAP server
      @bind_pass = nil

      # DN for binding to LDAP server
      @bind_dn = ""

      # DN of currently edited configuration module
      @current_module_dn = ""
      # DN of currently edited template
      @current_template_dn = ""

      # if LDAP configuration objects should be created automaticaly
      @create_ldap = false

      # if eDirectory is used as server
      @nds = false

      # if crypted connection was switched of after failure (#330054)
      @tls_switched_off = false

      @nds_checked = false

      # if OES is used as a client
      @oes = false

      # expert ui means "server product"
      @expert_ui = false

      # defaults for adding new config objects and templates
      @new_objects = {
        "suseUserConfiguration"  => {
          "suseSearchFilter"      => ["objectClass=posixAccount"],
          "susePasswordHash"      => ["SSHA"],
          "suseSkelDir"           => ["/etc/skel"],
          "suseMinUniqueId"       => ["1000"],
          "suseNextUniqueId"      => ["1000"],
          "suseMaxUniqueId"       => ["60000"],
          "suseMinPasswordLength" => ["5"],
          "suseMaxPasswordLength" => ["8"]
        },
        "suseGroupConfiguration" => {
          "suseSearchFilter" => ["objectClass=posixGroup"],
          "suseMinUniqueId"  => ["1000"],
          "suseNextUniqueId" => ["1000"],
          "suseMaxUniqueId"  => ["60000"]
        },
        "suseUserTemplate"       => {
          "objectClass"         => [
            "top",
            "suseObjectTemplate",
            "suseUserTemplate"
          ],
          "suseNamingAttribute" => ["uid"],
          "suseDefaultValue"    => [
            "homeDirectory=/home/%uid",
            "loginShell=/bin/bash"
          ],
          "susePlugin"          => ["UsersPluginLDAPAll"]
        },
        "suseGroupTemplate"      => {
          "objectClass"         => [
            "top",
            "suseObjectTemplate",
            "suseGroupTemplate"
          ],
          "suseNamingAttribute" => ["cn"],
          "susePlugin"          => ["UsersPluginLDAPAll"]
        }
      }

      @base_template_dn = @base_config_dn

      # settings saved at LDAP server modified
      @ldap_modified = false

      @config_modules = {}
      @templates = {}

      @bound = false

      # DN's of groups (posixGroups) in LDAP
      @groups_dn = []

      # Map of object classes (from schema). Indexed by names.
      @object_classes = {}

      # Map of atribute types (from schema). Indexed by names.
      @attr_types = {}

      # encryption schemes supported by slappasswd
      @hash_schemas = ["CLEAR", "CRYPT", "SHA", "SSHA", "MD5", "SMD5"]

      # Available configuration modules (objectClass names)
      # TODO update
      @available_config_modules = [
        "suseUserConfiguration",
        "suseGroupConfiguration"
      ]

      # The defualt values, which should replace the ones from Read ()
      # Used during instalation, when we want to do a reasonable proposal
      @initial_defaults = {}

      # If the default values, used from ldap-server module were used
      # to configure ldap-client
      @initial_defaults_used = false

      @schema_initialized = false

      @ldap_initialized = false

      # was LDAP connection initialized with TLS?
      @tls_when_initialized = false

      # If false, do not read settings already set from outside
      # used e.g. for Users YaPI. see bug #60898
      @read_settings = true

      # if sshd should be restarted during write phase
      @restart_sshd = false

      # if /etc/passwd was read
      @passwd_read = false

      # if pam_mkhomedir is set in /etc/pam.d/commond-session
      @mkhomedir = false

      # packages needed for pam_ldap/nss_ldap configuration
      @pam_nss_packages = ["pam_ldap", "nss_ldap"]

      # packages needed for sssd configuration
      @sssd_packages = ["sssd"]

      # packages needed for sssd + kerberos configuration
      @kerberos_packages = ["krb5-client"]

      # if sssd is used instead of pam_ldap/nss_ldap (fate#308902)
      @sssd = true

      # enable/disable offline authentication ('cache_credentials' key)
      @sssd_cache_credentials = false

      # if kerberos should be set up for sssd
      @sssd_with_krb = false

      # Kerberos default realm (for sssd)
      @krb5_realm = ""

      # adress of KDC (key distribution centre) server for default realm
      @krb5_kdcip = ""

      # ldap_schema argument of /etc/sssd/sssd.conf
      @sssd_ldap_schema = "rfc2307bis"

      # enumerate users/group
      @sssd_enumerate = false

      @ldap_error_hints = {
        -1  => _("Verify that the LDAP Server is running and reachable."),
        -11 => _(
          "Failed to establish TLS encryption.\nVerify that the correct CA Certificate is installed and the Server Certificate is valid."
        ),
        # hint to error message
        2   => _(
          "Failed to establish TLS encryption.\nVerify that the Server has StartTLS support enabled."
        )
      }
    end

### - (`Object`) ObjectClassExists(_class)

Returns true if given object class exists in schema

Parameters:

- class (`String`) —

  ObjectClass name

    1575
    1576
    1577
    1578
    1579
    # File '../../src/modules/Ldap.rb', line 1575

    def ObjectClassExists(_class)
      Convert.to_boolean(
        SCR.Read(path(".ldap.schema.oc.check"), { "name" => _class })
      )
    end

### - (`Object`) ObjectClassStructural(_class)

Returns true if given object class is of 'structural' type

Parameters:

- class (`String`) —

  ObjectClass name

    1583
    1584
    1585
    1586
    1587
    1588
    # File '../../src/modules/Ldap.rb', line 1583

    def ObjectClassStructural(_class)
      object_class = Convert.to_map(
        SCR.Read(path(".ldap.schema.oc"), { "name" => _class })
      )
      Ops.get_integer(object_class, "kind", 0) == 1
    end

### - (`Object`) ParentExists(dn)

Check for existence of parent object of given DN in LDAP tree return the answer

    1831
    1832
    1833
    1834
    1835
    1836
    1837
    1838
    1839
    1840
    1841
    1842
    1843
    1844
    1845
    1846
    1847
    1848
    1849
    1850
    1851
    1852
    1853
    1854
    1855
    1856
    1857
    1858
    1859
    # File '../../src/modules/Ldap.rb', line 1831

    def ParentExists(dn)
      return false if !Builtins.issubstring(dn, ",")

      parent = Builtins.substring(dn, Ops.add(Builtins.search(dn, ","), 1))
      object = GetLDAPEntry(parent)
      return false if object == nil
      if object == {}
        if !@use_gui
          Builtins.y2error(
            "A direct parent for DN %1 does not exist in the LDAP directory. The object with the selected DN cannot be created.",
            dn
          )
          return false
        end
        # error message, %1 is DN
        Popup.Error(
          Builtins.sformat(
            _(
              "A direct parent for DN '%1' \n" +
                "does not exist in the LDAP directory.\n" +
                "The object with the selected DN cannot be created.\n"
            ),
            dn
          )
        )
        return false
      end
      true
    end

### - (`Object`) Read

Reads LDAP settings from the SCR

Returns:

- success

    769
    770
    771
    772
    773
    774
    775
    776
    777
    778
    779
    780
    781
    782
    783
    784
    785
    786
    787
    788
    789
    790
    791
    792
    793
    794
    795
    796
    797
    798
    799
    800
    801
    802
    803
    804
    805
    806
    807
    808
    809
    810
    811
    812
    813
    814
    815
    816
    817
    818
    819
    820
    821
    822
    823
    824
    825
    826
    827
    828
    829
    830
    831
    832
    833
    834
    835
    836
    837
    838
    839
    840
    841
    842
    843
    844
    845
    846
    847
    848
    849
    850
    851
    852
    853
    854
    855
    856
    857
    858
    859
    860
    861
    862
    863
    864
    865
    866
    867
    868
    869
    870
    871
    872
    873
    874
    875
    876
    877
    878
    879
    880
    881
    882
    883
    884
    885
    886
    887
    888
    889
    890
    891
    892
    893
    894
    895
    896
    897
    898
    899
    900
    901
    902
    903
    904
    905
    906
    907
    908
    909
    910
    911
    912
    913
    914
    915
    916
    917
    918
    919
    920
    921
    922
    923
    924
    925
    926
    927
    928
    929
    930
    931
    932
    933
    934
    935
    936
    937
    938
    939
    940
    941
    942
    943
    944
    945
    946
    947
    948
    949
    950
    951
    952
    953
    954
    955
    956
    957
    958
    959
    960
    961
    962
    963
    964
    965
    966
    967
    968
    969
    970
    971
    972
    973
    974
    975
    976
    977
    978
    979
    980
    981
    982
    983
    984
    985
    986
    987
    988
    989
    990
    991
    992
    993
    994
    995
    996
    997
    998
    999
    1000
    1001
    1002
    1003
    1004
    1005
    1006
    1007
    1008
    1009
    1010
    1011
    1012
    1013
    1014
    1015
    1016
    1017
    1018
    1019
    1020
    1021
    1022
    1023
    1024
    1025
    1026
    1027
    1028
    1029
    1030
    1031
    1032
    1033
    1034
    1035
    1036
    1037
    # File '../../src/modules/Ldap.rb', line 769

    def Read
      @expert_ui = ProductFeatures.GetFeature("globals", "ui_mode") == "expert"

      CheckOES()

      Builtins.foreach(["passwd", "group", "passwd_compat", "group_compat"]) do |db|
        Ops.set(@nsswitch, db, Nsswitch.ReadDb(db))
      end

      # 'start' means that LDAP is present in nsswitch somehow... either as 'compat'/'ldap'...
      @start = Builtins.contains(Ops.get_list(@nsswitch, "passwd", []), "ldap") ||
        Builtins.contains(Ops.get_list(@nsswitch, "passwd", []), "compat") &&
          Builtins.contains(
            Ops.get_list(@nsswitch, "passwd_compat", []),
            "ldap"
          ) ||
        @oes && Builtins.contains(Ops.get_list(@nsswitch, "passwd", []), "nam")

      if @start
        # nss_ldap is used
        @sssd = false
      else
        # ... or as 'sssd'
        @sssd = Builtins.contains(Ops.get_list(@nsswitch, "passwd", []), "sss")
        @start = @sssd
      end

      # nothing is configured, but some packages are installed
      if !@start && Package.InstalledAll(@pam_nss_packages) &&
          !Package.InstalledAll(@sssd_packages)
        @sssd = false
      end

      @old_start = @start

      @nis_available = Builtins.contains(
        Ops.get_list(@nsswitch, "passwd", []),
        "nis"
      ) ||
        Builtins.contains(Ops.get_list(@nsswitch, "passwd", []), "compat") &&
          (Builtins.contains(
            Ops.get_list(@nsswitch, "passwd_compat", []),
            "nis"
          ) ||
            Builtins.size(Ops.get_list(@nsswitch, "passwd_compat", [])) == 0)
      @nis_available = @nis_available && Service.Status("ypbind") == 0

      @server = ReadLdapHosts()

      @base_dn = ReadLdapConfEntry("base", "")

      @old_base_dn = @base_dn
      @old_server = @server

      # ask DNS for LDAP server address if none is defined
      if (@server == "" ||
          @server == "127.0.0.1" && @base_dn == "dc=example,dc=com") &&
          FileUtils.Exists("/usr/bin/dig") &&
          !Mode.test
        domain = Hostname.CurrentDomain
        # workaround for bug#393951
        if domain == "" && Stage.cont
          out2 = Convert.to_map(
            SCR.Execute(path(".target.bash_output"), "domainname")
          )
          if Ops.get_integer(out2, "exit", 0) == 0
            domain = Builtins.deletechars(
              Ops.get_string(out2, "stdout", ""),
              "\n"
            )
          end
        end
        out = Convert.to_map(
          SCR.Execute(
            path(".target.bash_output"),
            Builtins.sformat("dig SRV _ldap._tcp.%1 +short", domain)
          )
        )
        first = Ops.get(
          Builtins.splitstring(Ops.get_string(out, "stdout", ""), "\n"),
          0,
          ""
        )
        srv = Ops.get(Builtins.splitstring(first, " "), 3, "")
        if srv != ""
          # remove dot from the end of line
          @server = Builtins.substring(
            srv,
            0,
            Ops.subtract(Builtins.size(srv), 1)
          )
          Builtins.y2milestone("LDAP server address acquired from DNS...")
          # now, check if there is reasonable 'default' DN
          dn = ""
          Builtins.foreach(Builtins.splitstring(domain, ".")) do |part|
            dn = Ops.add(dn, ",") if dn != ""
            dn = Ops.add(Ops.add(dn, "dc="), part)
          end
          if 0 ==
              SCR.Execute(
                path(".target.bash"),
                Builtins.sformat(
                  "ldapsearch -x -h %1 -s base -b '' namingContexts | grep -i '^namingContexts: %2'",
                  @server,
                  dn
                )
              )
            Builtins.y2milestone("proposing DN %1 based on %2", dn, domain)
            @base_dn = dn
          end
        end
      end

      @ldap_tls = ReadLdapConfEntry("ssl", "no") == "start_tls"
      @tls_cacertdir = ReadLdapConfEntry("tls_cacertdir", "")
      @tls_cacertfile = ReadLdapConfEntry("tls_cacertfile", "")
      @tls_checkpeer = ReadLdapConfEntry("tls_checkpeer", "yes")

      @nss_base_passwd = ReadLdapConfEntry("nss_base_passwd", @base_dn)
      @nss_base_shadow = ReadLdapConfEntry("nss_base_shadow", @base_dn)
      @nss_base_group = ReadLdapConfEntry("nss_base_group", @base_dn)

      @pam_password = ReadLdapConfEntry("pam_password", "exop")
      # check if Password Modify extenstion is supported (bnc#546398, c#6)
      if @pam_password == "exop"
        if 0 == SCR.Execute(path(".target.bash"), "ldapsearch -x -b '' -s base") &&
            0 !=
              SCR.Execute(
                path(".target.bash"),
                "ldapsearch -x -b '' -s base supportedExtension | grep -i '^supportedExtension:[[:space:]]*1.3.6.1.4.1.4203.1.11.1'"
              ) # LDAP server accessible
          Builtins.y2warning(
            "'exop' value not supported on server, using 'crypt'"
          )
          @pam_password = "crypt"
        end
      end

      # read sysconfig values
      @base_config_dn = Convert.to_string(
        SCR.Read(path(".sysconfig.ldap.BASE_CONFIG_DN"))
      )
      @base_config_dn = "" if @base_config_dn == nil

      @file_server = Convert.to_string(
        SCR.Read(path(".sysconfig.ldap.FILE_SERVER"))
      ) == "yes"

      if @read_settings || @bind_dn == ""
        @bind_dn = Convert.to_string(SCR.Read(path(".sysconfig.ldap.BIND_DN")))
      end
      if @bind_dn == nil || @bind_dn == ""
        @bind_dn = ReadLdapConfEntry("binddn", "")
      end

      if @read_settings || @member_attribute == ""
        map_attrs = ReadLdapConfEntries("nss_map_attribute")
        Builtins.foreach(map_attrs) do |map_attr|
          if Builtins.issubstring(Builtins.tolower(map_attr), "uniquemember")
            attr = Builtins.splitstring(map_attr, " \t")
            if Builtins.tolower(Ops.get(attr, 0, "")) == "uniquemember"
              @member_attribute = Ops.get(attr, 1, @member_attribute)
              # LDAP needs to know correct attribute name
              if @member_attribute == "uniquemember"
                @member_attribute = "uniqueMember"
              end
              @old_member_attribute = @member_attribute
            end
          end
        end
      end

      # install on demand
      @_autofs_allowed = true
      @_start_autofs = @_autofs_allowed && Service.Enabled("autofs")

      # read /etc/passwd to check + line:
      if !Convert.to_boolean(
          SCR.Execute(path(".passwd.init"), { "base_directory" => "/etc" })
        )
        error = Convert.to_string(SCR.Read(path(".passwd.error")))
        Builtins.y2error("error: %1", error)
      else
        @passwd_read = true
        @plus_lines_passwd = Convert.convert(
          SCR.Read(path(".passwd.passwd.pluslines")),
          :from => "any",
          :to   => "list <string>"
        )
        Builtins.foreach(@plus_lines_passwd) do |plus_line|
          plus = Builtins.splitstring(plus_line, ":")
          if Ops.get(plus, Ops.subtract(Builtins.size(plus), 1), "") == "/sbin/nologin"
            @login_enabled = false
          end
        end
      end

      @mkhomedir = Pam.Enabled("mkhomedir")

      Autologin.Read

      ReadKrb5Conf() if Pam.Enabled("krb5")
      if FileUtils.Exists("/etc/sssd/sssd.conf")
        # read realm and kdc from sssd.conf if available
        domain = Builtins.add(path(".etc.sssd_conf.v"), "domain/default")
        realm = Convert.to_string(SCR.Read(Builtins.add(domain, "krb5_realm")))
        @krb5_realm = realm if realm != nil
        kdc = Convert.to_string(SCR.Read(Builtins.add(domain, "krb5_kdcip")))
        @krb5_kdcip = kdc if kdc != nil
        schema = Convert.to_string(
          SCR.Read(Builtins.add(domain, "ldap_schema"))
        )
        @sssd_ldap_schema = schema if schema != nil

        cache_credentials = Convert.to_string(
          SCR.Read(Builtins.add(domain, "cache_credentials"))
        )
        @sssd_cache_credentials = cache_credentials != nil &&
          Builtins.tolower(cache_credentials) == "true"
        enumerate = Convert.to_string(
          SCR.Read(Builtins.add(domain, "enumerate"))
        )
        @sssd_enumerate = enumerate != nil &&
          Builtins.tolower(enumerate) == "true"

        id_start_tls = Convert.to_string(
          SCR.Read(Builtins.add(domain, "ldap_id_use_start_tls"))
        )
        if id_start_tls != nil
          @ldap_tls = Builtins.tolower(id_start_tls) == "true"
        else
          # true for SSSD by default, if not overriden by ldap_id_use_start_tls
          @ldap_tls = true
        end

        # replace nss_base_passwd with ldap_user_search_base (if it is set)
        user_base = Convert.to_string(
          SCR.Read(Builtins.add(domain, "ldap_user_search_base"))
        )
        @nss_base_passwd = user_base if user_base != nil
        group_base = Convert.to_string(
          SCR.Read(Builtins.add(domain, "ldap_group_search_base"))
        )
        @nss_base_group = group_base if group_base != nil
      end
      @sssd_with_krb = true if @krb5_realm != "" && @krb5_kdcip != ""

      # Now check if previous configuration of LDAP server didn't proposed
      # some better values:
      if Stage.cont
        if Ops.greater_than(Builtins.size(@initial_defaults), 0)
          Builtins.y2milestone("using values defined externaly")
          old_s = @old_server
          old_d = @old_base_dn
          old_m = @old_member_attribute
          Set(@initial_defaults)
          @old_server = old_s
          @old_base_dn = old_d
          @old_member_attribute = old_m
        end
      end

      if @member_attribute == ""
        @member_attribute = "member"
        @modified = true
      end

      true
    end

### - (`String`) ReadConfigModules

Read configuration moduels from LDAP server

Returns:

- (`String`) —

  error message

    1762
    1763
    1764
    1765
    1766
    1767
    1768
    1769
    1770
    1771
    1772
    1773
    1774
    1775
    1776
    1777
    1778
    1779
    1780
    1781
    1782
    1783
    1784
    1785
    1786
    1787
    # File '../../src/modules/Ldap.rb', line 1762

    def ReadConfigModules
      @config_modules = {}
      modules = Convert.to_map(
        SCR.Read(
          path(".ldap.search"),
          {
            "base_dn"      => @base_config_dn,
            "filter"       => "objectClass=suseModuleConfiguration",
            "attrs"        => [],
            "scope"        => 1, # one - deeper searches would have problems with
            # constructing the dn
            "map"          => true,
            "not_found_ok" => true
          }
        )
      )
      return LDAPError() if modules == nil
      @config_modules = Builtins.mapmap(
        Convert.convert(
          modules,
          :from => "map",
          :to   => "map <string, map <string, any>>"
        )
      ) { |dn, mod| { dn => AddMissingAttributes(mod) } }
      ""
    end

### - (`Array`) ReadDN(base, search_filter)

Searches for DN's of all objects defined by filter in given base (“sub”)

Parameters:

- base (`String`) —

  search base

- search_filter (`String`) —

  if filter is empty, “objectClass=*” is used

Returns:

- (`Array`) —

  of DN's (list of strings)

    2004
    2005
    2006
    2007
    2008
    2009
    2010
    2011
    2012
    2013
    2014
    2015
    2016
    2017
    2018
    2019
    2020
    2021
    2022
    2023
    2024
    2025
    # File '../../src/modules/Ldap.rb', line 2004

    def ReadDN(base, search_filter)
      all = Convert.convert(
        SCR.Read(
          path(".ldap.search"),
          {
            "base_dn"   => base,
            "filter"    => search_filter,
            "attrs"     => ["cn"], # not necessary, just not read all values
            "attrsOnly" => true,
            "scope"     => 2,
            "dn_only"   => true
          }
        ),
        :from => "any",
        :to   => "list <string>"
      )
      if all == nil
        LDAPErrorMessage("read", LDAPError())
        return []
      end
      deep_copy(all)
    end

### - (`Object`) ReadKrb5Conf

For sssd, some kerberos values are needed

    615
    616
    617
    618
    619
    620
    621
    622
    623
    624
    625
    626
    627
    628
    629
    630
    631
    632
    633
    634
    635
    636
    637
    638
    # File '../../src/modules/Ldap.rb', line 615

    def ReadKrb5Conf
      realm = Convert.convert(
        SCR.Read(path(".etc.krb5_conf.v.libdefaults.default_realm")),
        :from => "any",
        :to   => "list <string>"
      )
      realm = [] if realm == nil
      @krb5_realm = Ops.get(realm, 0, "")

      kdcs = Convert.convert(
        SCR.Read(
          Builtins.add(
            Builtins.add(path(".etc.krb5_conf.v"), @krb5_realm),
            "kdc"
          )
        ),
        :from => "any",
        :to   => "list <string>"
      )
      kdcs = [] if kdcs == nil
      @krb5_kdcip = Builtins.mergestring(kdcs, ",")

      true
    end

### - (`Object`) ReadLdapConfEntries(entry)

Read multi-valued entry from /etc/ldap.conf file

Parameters:

- entry (`String`) —

  entry name

Returns:

- entry value

    663
    664
    665
    666
    667
    668
    669
    670
    671
    672
    673
    674
    # File '../../src/modules/Ldap.rb', line 663

    def ReadLdapConfEntries(entry)
      ret = SCR.Read(
        Builtins.add(path(".etc.ldap_conf.v.\"/etc/ldap.conf\""), entry)
      )
      if ret == nil
        return []
      elsif Ops.is_list?(ret)
        return Convert.convert(ret, :from => "any", :to => "list <string>")
      else
        return [Builtins.sformat("%1", ret)]
      end
    end

### - (`Object`) ReadLdapConfEntry(entry, defvalue)

Read single entry from /etc/ldap.conf file

Parameters:

- entry (`String`) —

  entry name

- defvalue (`String`) —

  default value if entry is not present

Returns:

- entry value

    645
    646
    647
    648
    649
    650
    651
    652
    653
    654
    655
    656
    657
    658
    # File '../../src/modules/Ldap.rb', line 645

    def ReadLdapConfEntry(entry, defvalue)
      value = defvalue
      ret = SCR.Read(
        Builtins.add(path(".etc.ldap_conf.v.\"/etc/ldap.conf\""), entry)
      )
      if ret == nil
        value = defvalue
      elsif Ops.is_list?(ret)
        value = Ops.get_string(Convert.to_list(ret), 0, defvalue)
      else
        value = Builtins.sformat("%1", ret)
      end
      value
    end

### - (`Object`) ReadLdapHosts

Read values of LDAP hosts from ldap.conf get them from 'uri' or 'host' values

    756
    757
    758
    759
    760
    761
    762
    763
    764
    765
    # File '../../src/modules/Ldap.rb', line 756

    def ReadLdapHosts
      ret = ""
      uri = ReadLdapConfEntry("uri", "")
      if uri == ""
        ret = ReadLdapConfEntry("host", "")
      else
        ret = uri2servers(uri)
      end
      ret
    end

### - (`String`) ReadTemplates

Read object templates from LDAP server

Returns:

- (`String`) —

  error message

    1729
    1730
    1731
    1732
    1733
    1734
    1735
    1736
    1737
    1738
    1739
    1740
    1741
    1742
    1743
    1744
    1745
    1746
    1747
    1748
    1749
    1750
    1751
    1752
    1753
    1754
    1755
    1756
    1757
    1758
    # File '../../src/modules/Ldap.rb', line 1729

    def ReadTemplates
      @templates = {}
      all = Convert.to_map(
        SCR.Read(
          path(".ldap.search"),
          {
            "base_dn"      => @base_config_dn,
            "filter"       => "objectClass=suseObjectTemplate",
            "attrs"        => [],
            "scope"        => 2, # sub: all templates under config DN
            "map"          => true,
            "not_found_ok" => true
          }
        )
      )
      return LDAPError() if all == nil
      # create a helper map of default values inside ...
      @templates = Builtins.mapmap(
        Convert.convert(
          all,
          :from => "map",
          :to   => "map <string, map <string, any>>"
        )
      ) do |dn, templ|
        template = ConvertDefaultValues(templ)
        template = AddMissingAttributes(template)
        { dn => template }
      end
      ""
    end

### - (`Object`) RestartSSHD(restart)

Set the value of restart_sshd (= restart sshd during write)

    3330
    3331
    3332
    3333
    3334
    # File '../../src/modules/Ldap.rb', line 3330

    def RestartSSHD(restart)
      @restart_sshd = restart

      nil
    end

### - (`void`) Set(settings)

This method returns an undefined value.

Only set variables, without checking anything

    401
    402
    403
    404
    405
    406
    407
    408
    409
    410
    411
    412
    413
    414
    415
    416
    417
    418
    419
    420
    421
    422
    423
    424
    425
    426
    427
    428
    429
    430
    431
    432
    433
    434
    435
    436
    437
    438
    439
    440
    441
    442
    443
    444
    445
    446
    447
    448
    449
    450
    451
    452
    453
    454
    455
    456
    457
    458
    459
    460
    # File '../../src/modules/Ldap.rb', line 401

    def Set(settings)
      settings = deep_copy(settings)
      @start = Ops.get_boolean(settings, "start_ldap", false)
      @server = Ops.get_string(settings, "ldap_server", "")
      # leaving "ldap_domain" for backward compatibility
      @base_dn = Ops.get_string(settings, "ldap_domain", "")
      @ldap_tls = Ops.get_boolean(settings, "ldap_tls", false)
      @pam_password = Ops.get_string(settings, "pam_password", "exop")
      @bind_dn = Ops.get_string(settings, "bind_dn", "")
      @file_server = Ops.get_boolean(settings, "file_server", false)
      @base_config_dn = Ops.get_string(settings, "base_config_dn", "")
      @nss_base_passwd = Ops.get_string(settings, "nss_base_passwd", "")
      @nss_base_shadow = Ops.get_string(settings, "nss_base_passwd", "")
      @nss_base_group = Ops.get_string(settings, "nss_base_group", "")
      @member_attribute = Ops.get_string(settings, "member_attribute", "member")
      @create_ldap = Ops.get_boolean(settings, "create_ldap", false)
      @login_enabled = Ops.get_boolean(settings, "login_enabled", true)
      @_start_autofs = Ops.get_boolean(settings, "start_autofs", false)
      @tls_cacertdir = Ops.get_string(settings, "tls_cacertdir", "")
      @tls_cacertfile = Ops.get_string(settings, "tls_cacertfile", "")
      @tls_checkpeer = Ops.get_string(settings, "tls_checkpeer", "yes")
      @mkhomedir = Ops.get_boolean(settings, "mkhomedir", @mkhomedir)
      @sssd = Ops.get_boolean(settings, "sssd", @sssd)
      @sssd_ldap_schema = Ops.get_string(
        settings,
        "sssd_ldap_schema",
        @sssd_ldap_schema
      )
      @sssd_enumerate = Ops.get_boolean(
        settings,
        "sssd_enumerate",
        @sssd_enumerate
      )
      @sssd_cache_credentials = Ops.get_boolean(
        settings,
        "sssd_cache_credentials",
        @sssd_cache_credentials
      )
      @sssd_with_krb = Ops.get_boolean(
        settings,
        "sssd_with_krb",
        @sssd_with_krb
      )
      @krb5_realm = Ops.get_string(settings, "krb5_realm", @krb5_realm)
      @krb5_kdcip = Ops.get_string(settings, "krb5_kdcip", @krb5_kdcip)
      if @_start_autofs
        @required_packages = Convert.convert(
          Builtins.union(@required_packages, ["autofs"]),
          :from => "list",
          :to   => "list <string>"
        )
      end

      @old_base_dn = @base_dn
      @old_server = @server
      @old_member_attribute = @member_attribute
      @modified = true
      @openldap_modified = true
      nil
    end

### - (`Object`) SetAnonymous(anon)

Set the value of 'anonymous' variable (= bind without password)

Parameters:

- anon (`Boolean`) —

  new value

    3315
    3316
    3317
    3318
    3319
    # File '../../src/modules/Ldap.rb', line 3315

    def SetAnonymous(anon)
      @anonymous = anon

      nil
    end

### - (`Object`) SetBaseDN(new_base_dn)

Set new LDAP base DN

Parameters:

- new_base_dn (`String`) —

  a new base DN

    344
    345
    346
    347
    348
    349
    # File '../../src/modules/Ldap.rb', line 344

    def SetBaseDN(new_base_dn)
      @base_dn = new_base_dn
      @base_dn_changed = true if @base_dn != @old_base_dn && @old_base_dn != ""

      nil
    end

### - (`Object`) SetBindPassword(pass)

Set the value of bind_pass variable

Parameters:

- pass (`String`) —

  new password valure

    3307
    3308
    3309
    3310
    3311
    # File '../../src/modules/Ldap.rb', line 3307

    def SetBindPassword(pass)
      @bind_pass = pass

      nil
    end

### - (`Object`) SetDefaults(settings)

Set the defualt values, which should replace the ones from Read () Used during instalation, when we want to do a reasonable proposal

    358
    359
    360
    361
    362
    363
    # File '../../src/modules/Ldap.rb', line 358

    def SetDefaults(settings)
      settings = deep_copy(settings)
      Builtins.y2milestone("using initial defaults: %1", settings)
      @initial_defaults = Builtins.eval(settings)
      true
    end

### - (`Object`) SetDomain(new_domain)

obsolete, use SetBaseDN

    352
    353
    354
    # File '../../src/modules/Ldap.rb', line 352

    def SetDomain(new_domain)
      SetBaseDN(new_domain)
    end

### - (`Object`) SetGUI(gui)

Set the value of 'use_gui' variable (= show error popups)

Parameters:

- gui (`Boolean`) —

  new value

    3323
    3324
    3325
    3326
    3327
    # File '../../src/modules/Ldap.rb', line 3323

    def SetGUI(gui)
      @use_gui = gui

      nil
    end

### - (`Object`) SetReadSettings(read)

set the value of read_settings variable which means, do not read some settings from system

    367
    368
    369
    370
    # File '../../src/modules/Ldap.rb', line 367

    def SetReadSettings(read)
      @read_settings = read
      @read_settings
    end

### - (`Object`) ShortSummary

returns html formated configuration summary (shorter than Summary)

Returns:

- summary

    565
    566
    567
    568
    569
    570
    571
    572
    573
    574
    575
    576
    577
    578
    579
    580
    581
    582
    583
    584
    585
    586
    587
    588
    589
    590
    591
    592
    593
    594
    595
    596
    597
    598
    599
    600
    601
    602
    603
    604
    605
    606
    607
    608
    609
    610
    # File '../../src/modules/Ldap.rb', line 565

    def ShortSummary
      nc = Summary.NotConfigured
      summary = ""
      # summary text
      summary = Ops.add(
        Ops.add(
          Builtins.sformat(
            _("<b>Servers</b>:%1<br>"),
            @server != "" ? @server : nc
          ),
          # summary text
          Builtins.sformat(
            _("<b>Base DN</b>:%1<br>"),
            @base_dn != "" ? @base_dn : nc
          )
        ),
        # summary text (yes/no follows)
        Builtins.sformat(
          _("<b>Client Enabled</b>:%1"),
          @start ?
            # summary (client enabled?)
            _("Yes") :
            # summary (client enabled?)
            _("No")
        )
      )
      if @_start_autofs
        # summary
        summary = Ops.add(Ops.add(summary, "<br>"), _("Automounter Configured"))
      end
      if @ldap_tls
        # summary
        summary = Ops.add(
          Ops.add(summary, "<br>"),
          _("LDAP TLS/SSL Configured")
        )
      end
      if @start && @sssd
        # summary
        summary = Ops.add(
          Ops.add(summary, "<br>"),
          _("System Security Services Daemon (SSSD) Set")
        )
      end
      summary
    end

### - (`Object`) SingleValued(attr)

Check if attribute allowes only single or multiple value

Parameters:

- attr (`String`) —

  attribute name

Returns:

- answer

    1547
    1548
    1549
    1550
    1551
    1552
    1553
    1554
    1555
    1556
    1557
    # File '../../src/modules/Ldap.rb', line 1547

    def SingleValued(attr)
      attr = Builtins.tolower(attr)
      if !Builtins.haskey(@attr_types, attr)
        attr_type = Convert.to_map(
          SCR.Read(path(".ldap.schema.at"), { "name" => attr })
        )
        attr_type = {} if attr_type == nil
        Ops.set(@attr_types, attr, attr_type)
      end
      Ops.get_boolean(@attr_types, [attr, "single"], false)
    end

### - (`Object`) Summary

Summary() returns html formated configuration summary

Returns:

- summary

    520
    521
    522
    523
    524
    525
    526
    527
    528
    529
    530
    531
    532
    533
    534
    535
    536
    537
    538
    539
    540
    541
    542
    543
    544
    545
    546
    547
    548
    549
    550
    551
    552
    553
    554
    555
    556
    557
    558
    559
    560
    561
    # File '../../src/modules/Ldap.rb', line 520

    def Summary
      summary = ""
      # summary item
      summary = Summary.AddHeader(summary, _("LDAP Client Enabled"))
      # summary (is LDAP enabled?)
      summary = Summary.AddLine(
        summary,
        @start ? _("Yes") : Summary.NotConfigured
      )
      # summary item
      summary = Summary.AddHeader(summary, _("LDAP Domain"))
      summary = Summary.AddLine(
        summary,
        @base_dn != "" ? @base_dn : Summary.NotConfigured
      )
      # summary item
      summary = Summary.AddHeader(summary, _("LDAP Server"))
      summary = Summary.AddLine(
        summary,
        @server != "" ? @server : Summary.NotConfigured
      )
      # summary item
      summary = Summary.AddHeader(summary, _("LDAP TLS/SSL"))
      # summary (use TLS?)
      summary = Summary.AddLine(
        summary,
        @ldap_tls ? _("Yes") : Summary.NotConfigured
      )

      # summary item
      summary = Summary.AddHeader(
        summary,
        _("System Security Services Daemon (SSSD) Set")
      )
      # summary (SSSD Set?)
      summary = Summary.AddLine(
        summary,
        @sssd && @start ? _("Yes") : Summary.NotConfigured
      )

      summary
    end

### - (`Object`) uri2servers(uri)

convert list of uri's to list of hosts

    740
    741
    742
    743
    744
    745
    746
    747
    748
    749
    750
    751
    752
    # File '../../src/modules/Ldap.rb', line 740

    def uri2servers(uri)
      Builtins.mergestring(
        Builtins.maplist(Builtins.splitstring(uri, " \t")) do |u|
          url = URL.Parse(u)
          h = Ops.get_string(url, "host", "")
          if Ops.get_string(url, "port", "") != ""
            h = Builtins.sformat("%1:%2", h, Ops.get_string(url, "port", ""))
          end
          h
        end,
        " "
      )
    end

### - (`Symbol`) Write(abort)

Saves LDAP configuration.

Parameters:

- abort (`Proc`) —

  block for abort

Returns:

- (`Symbol`)

    2798
    2799
    2800
    2801
    2802
    2803
    2804
    2805
    2806
    2807
    2808
    2809
    2810
    2811
    2812
    2813
    2814
    2815
    2816
    2817
    2818
    2819
    2820
    2821
    2822
    2823
    2824
    2825
    2826
    2827
    2828
    2829
    2830
    2831
    2832
    2833
    2834
    2835
    2836
    2837
    2838
    2839
    2840
    2841
    2842
    2843
    2844
    2845
    2846
    2847
    2848
    2849
    2850
    2851
    2852
    2853
    2854
    2855
    2856
    2857
    2858
    2859
    2860
    2861
    2862
    2863
    2864
    2865
    2866
    2867
    2868
    2869
    2870
    2871
    2872
    2873
    2874
    2875
    2876
    2877
    2878
    2879
    2880
    2881
    2882
    2883
    2884
    2885
    2886
    2887
    2888
    2889
    2890
    2891
    2892
    2893
    2894
    2895
    2896
    2897
    2898
    2899
    2900
    2901
    2902
    2903
    2904
    2905
    2906
    2907
    2908
    2909
    2910
    2911
    2912
    2913
    2914
    2915
    2916
    2917
    2918
    2919
    2920
    2921
    2922
    2923
    2924
    2925
    2926
    2927
    2928
    2929
    2930
    2931
    2932
    2933
    2934
    2935
    2936
    2937
    2938
    2939
    2940
    2941
    2942
    2943
    2944
    2945
    2946
    2947
    2948
    2949
    2950
    2951
    2952
    2953
    2954
    2955
    2956
    2957
    2958
    2959
    2960
    2961
    2962
    2963
    2964
    2965
    2966
    2967
    2968
    2969
    2970
    2971
    2972
    2973
    2974
    2975
    2976
    2977
    2978
    2979
    2980
    2981
    2982
    2983
    2984
    2985
    2986
    2987
    2988
    2989
    2990
    2991
    2992
    2993
    2994
    2995
    2996
    2997
    2998
    2999
    3000
    3001
    3002
    3003
    3004
    3005
    3006
    3007
    3008
    3009
    3010
    3011
    3012
    3013
    3014
    3015
    3016
    3017
    3018
    3019
    3020
    3021
    3022
    3023
    3024
    3025
    3026
    3027
    3028
    3029
    3030
    3031
    3032
    3033
    3034
    3035
    3036
    3037
    3038
    3039
    3040
    3041
    3042
    3043
    3044
    3045
    3046
    3047
    3048
    3049
    3050
    3051
    3052
    3053
    3054
    3055
    3056
    3057
    3058
    3059
    3060
    3061
    3062
    3063
    3064
    3065
    3066
    3067
    3068
    3069
    3070
    3071
    3072
    3073
    3074
    3075
    3076
    3077
    3078
    3079
    3080
    3081
    3082
    3083
    3084
    3085
    3086
    3087
    3088
    3089
    3090
    3091
    3092
    3093
    3094
    3095
    3096
    3097
    3098
    3099
    3100
    3101
    3102
    3103
    3104
    3105
    3106
    3107
    3108
    3109
    3110
    3111
    3112
    3113
    3114
    3115
    3116
    3117
    3118
    3119
    3120
    3121
    3122
    3123
    3124
    3125
    3126
    3127
    3128
    3129
    3130
    3131
    3132
    3133
    3134
    3135
    3136
    3137
    3138
    3139
    3140
    3141
    3142
    3143
    3144
    3145
    3146
    3147
    3148
    3149
    3150
    3151
    3152
    3153
    3154
    3155
    3156
    3157
    3158
    3159
    3160
    3161
    3162
    3163
    3164
    3165
    3166
    3167
    3168
    3169
    3170
    3171
    3172
    3173
    3174
    3175
    3176
    3177
    3178
    3179
    3180
    3181
    3182
    3183
    3184
    3185
    3186
    3187
    3188
    3189
    3190
    3191
    3192
    3193
    3194
    3195
    3196
    3197
    3198
    3199
    3200
    3201
    3202
    3203
    3204
    3205
    3206
    3207
    3208
    3209
    3210
    3211
    3212
    3213
    3214
    3215
    3216
    3217
    3218
    3219
    3220
    3221
    3222
    3223
    3224
    3225
    3226
    3227
    3228
    3229
    # File '../../src/modules/Ldap.rb', line 2798

    def Write(abort)
      abort = deep_copy(abort)
      # progress caption
      caption = _("Writing LDAP Configuration...")
      no_of_steps = 4

      Progress.New(
        caption,
        " ",
        no_of_steps,
        [
          # progress stage label
          _("Stop services"),
          # progress stage label
          _("Update configuration files"),
          # progress stage label
          _("Start services"),
          # progress stage label
          _("Update configuration in LDAP directory")
        ],
        [
          # progress step label
          _("Stopping services..."),
          # progress step label
          _("Updating configuration files..."),
          # progress step label
          _("Starting services..."),
          # progress step label
          _("Updating configuration in LDAP directory..."),
          # final progress step label
          _("Finished")
        ],
        ""
      )

      # -------------------- stop services
      Progress.NextStage
      return :abort if Builtins.eval(abort)

      # initialize 'oes' value when Read was not called (bnc#670288)
      CheckOES() if Mode.autoinst

      ypbind_running = false

      if !@write_only
        ypbind_running = Service.Status("ypbind") == 0
        Service.Stop("ypbind")
      elsif @write_only && Mode.autoinst
        # Read existing nsswitch in autoinstallation mode
        Builtins.foreach(["passwd", "group", "passwd_compat", "group_compat"]) do |db|
          Ops.set(@nsswitch, db, Nsswitch.ReadDb(db))
        end
      end

      # -------------------- update config files
      Progress.NextStage
      return :abort if Builtins.eval(abort)

      if @modified
        # update ldap.conf
        WriteLdapConfEntry("host", nil)
        uri = Builtins.mergestring(
          Builtins.maplist(Builtins.splitstring(@server, " \t")) do |u|
            Ops.add("ldap://", u)
          end,
          " "
        )
        WriteLdapConfEntry("uri", uri)
        WriteLdapConfEntry("base", @base_dn)

        if @member_attribute != @old_member_attribute
          WriteLdapConfEntries(
            "nss_map_attribute",
            ["uniqueMember", @member_attribute]
          )
        end

        WriteOpenLdapConf()

        if @ldap_tls
          WriteLdapConfEntry("ssl", "start_tls")
        else
          WriteLdapConfEntry("ssl", "no")
        end

        WriteLdapConfEntry(
          "tls_cacertdir",
          @tls_cacertdir == "" ? nil : @tls_cacertdir
        )
        WriteLdapConfEntry(
          "tls_cacertfile",
          @tls_cacertfile == "" ? nil : @tls_cacertfile
        )

        Pam.Set("mkhomedir", @mkhomedir)

        WriteLdapConfEntry("pam_password", @pam_password)

        # see bugs #suse37665 (pam_filter necessary), #118779 (not always)
        if ReadLdapConfEntry("pam_filter", "") == ""
          AddLdapConfEntry("pam_filter", "objectClass=posixAccount")
        end

        if @sssd
          WriteSSSDConfig()
        else
          # save the user and group bases
          @user_base = @base_dn
          @group_base = @base_dn

          WriteLdapConfEntry(
            "nss_base_passwd",
            @nss_base_passwd != @base_dn && @nss_base_passwd != "" ? @nss_base_passwd : nil
          )
          WriteLdapConfEntry(
            "nss_base_shadow",
            @nss_base_shadow != @base_dn && @nss_base_shadow != "" ? @nss_base_shadow : nil
          )
          WriteLdapConfEntry(
            "nss_base_group",
            @nss_base_group != @base_dn && @nss_base_group != "" ? @nss_base_group : nil
          )
        end

        # default value is 'yes'
        WriteLdapConfEntry(
          "tls_checkpeer",
          @tls_checkpeer == "yes" ? nil : @tls_checkpeer
        )
        WriteNscdCache(@start && @sssd)
      end
      if @start # ldap used for authentocation
        # ---------- correct pam_password value for Novell eDirectory
        if @pam_password != "nds" && @expert_ui
          CheckNDS() if !@nds_checked && !Mode.autoinst
          @pam_password = "nds" if @nds
          WriteLdapConfEntry("pam_password", @pam_password)
        end

        if !@oes
          if @sssd
            Pam.Add("sss")
            # Add "sss" to the passwd and group databases in nsswitch.conf

            Builtins.foreach(["passwd", "group"]) do |db|
              # replace 'ldap' with sss
              Ops.set(
                @nsswitch,
                db,
                Builtins.filter(Ops.get_list(@nsswitch, db, [])) do |v|
                  v != "ldap"
                end
              )
              Ops.set(
                @nsswitch,
                db,
                Builtins.union(Ops.get_list(@nsswitch, db, []), ["sss"])
              )
              Nsswitch.WriteDb(
                db,
                Convert.convert(
                  Ops.get(@nsswitch, db) { ["sss"] },
                  :from => "any",
                  :to   => "list <string>"
                )
              )
              # remove 'ldap' from _compat entries
              new_db = Ops.add(db, "_compat")
              Ops.set(
                @nsswitch,
                new_db,
                Builtins.filter(Ops.get_list(@nsswitch, new_db, [])) do |v|
                  v != "ldap"
                end
              )
              Nsswitch.WriteDb(new_db, Ops.get_list(@nsswitch, new_db, []))
            end
            # remove ldap entries from ldap-only db's
            Builtins.foreach(["services", "netgroup", "aliases"]) do |db|
              db_l = Builtins.filter(Nsswitch.ReadDb(db)) { |v| v != "ldap" }
              db_l = ["files"] if db_l == []
              Nsswitch.WriteDb(db, db_l)
            end

            if Pam.Enabled("krb5")
              Builtins.y2milestone(
                "configuring 'sss', so 'krb5' will be removed"
              )
              Pam.Remove("ldap-account_only")
              Pam.Remove("krb5")
            end
            Pam.Remove("ldap")
          else
            # pam settigs
            if Pam.Enabled("krb5")
              # If kerberos is used for authentication we configure
              # pam_ldap in a way that we use only the account checking.
              # Other configuration would mess up password changing
              Pam.Add("ldap-account_only")
            else
              Pam.Add("ldap")
            end
            # sss was removed, using pam_ldap (bnc#680184)
            Pam.Remove("sss") if Pam.Enabled("sss")

            # modify sources in /etc/nsswitch.conf
            Nsswitch.WriteDb("passwd", ["compat"])
            Nsswitch.WriteDb(
              "passwd_compat",
              Convert.convert(
                Builtins.union(
                  Ops.get_list(@nsswitch, "passwd_compat", []),
                  ["ldap"]
                ),
                :from => "list",
                :to   => "list <string>"
              )
            )

            Builtins.foreach(["services", "netgroup", "aliases"]) do |db|
              Nsswitch.WriteDb(db, ["files", "ldap"])
            end

            if Builtins.contains(Ops.get_list(@nsswitch, "group", []), "compat") &&
                Builtins.contains(
                  Ops.get_list(@nsswitch, "group_compat", []),
                  "ldap"
                )
              Builtins.y2milestone("group_compat present, not changing")
            else
              Nsswitch.WriteDb("group", ["files", "ldap"])
            end
          end

          Nsswitch.Write
        end
        Autologin.Write(@write_only)
      elsif !@oes # ldap is not used
        Builtins.foreach(["passwd", "group"]) do |db|
          new_db = Ops.add(db, "_compat")
          Ops.set(
            @nsswitch,
            db,
            Builtins.filter(Ops.get_list(@nsswitch, db, [])) do |v|
              v != "ldap" && v != "sss"
            end
          )
          if Ops.get_list(@nsswitch, db, []) == [] ||
              Ops.get_list(@nsswitch, db, []) == ["files"]
            Ops.set(@nsswitch, db, ["compat"])
          end
          Ops.set(
            @nsswitch,
            new_db,
            Builtins.filter(Ops.get_list(@nsswitch, new_db, [])) do |v|
              v != "ldap" && v != "sss"
            end
          )
          Nsswitch.WriteDb(
            db,
            Convert.convert(
              Ops.get(@nsswitch, db) { ["compat"] },
              :from => "any",
              :to   => "list <string>"
            )
          )
          Nsswitch.WriteDb(new_db, Ops.get_list(@nsswitch, new_db, []))
        end
        Builtins.foreach(["services", "netgroup", "aliases"]) do |db|
          db_l = Builtins.filter(Nsswitch.ReadDb(db)) do |v|
            v != "ldap" && v != "sss"
          end
          db_l = ["files"] if db_l == []
          Nsswitch.WriteDb(db, db_l)
        end

        Nsswitch.Write

        if Pam.Enabled("ldap")
          Pam.Remove("ldap")
        elsif Pam.Enabled("ldap-account_only")
          Pam.Remove("ldap-account_only")
        end
        Pam.Remove("sss") if Pam.Enabled("sss")
      end

      # write the changes in /etc/ldap.conf and /etc/openldap/ldap.conf now
      if !SCR.Write(path(".etc.ldap_conf"), nil)
        Builtins.y2error("error writing ldap.conf file")
      end
      SCR.UnmountAgent(path(".etc.ldap_conf")) if Stage.cont

      # write sysconfig values
      SCR.Write(
        path(".sysconfig.ldap.FILE_SERVER"),
        @file_server ? "yes" : "no"
      )

      SCR.Write(path(".sysconfig.ldap.BASE_CONFIG_DN"), @base_config_dn)

      SCR.Write(path(".sysconfig.ldap.BIND_DN"), @bind_dn)

      # write the changes in /etc/sysconfig/ldap now
      if !SCR.Write(path(".sysconfig.ldap"), nil)
        Builtins.y2error("error writing /etc/sysconfig/ldap")
      end

      if @_autofs_allowed
        if Nsswitch.WriteAutofs(@start && @_start_autofs, "ldap")
          if @_start_autofs
            Service.Adjust("autofs", "enable")
          else
            Service.Adjust("autofs", "disable")
          end
        end
      end

      WritePlusLine(@login_enabled) if @start && !@sssd

      # -------------------- start services
      Progress.NextStage
      return :abort if Builtins.eval(abort)

      if !@write_only
        if @sssd && @start
          # enable the sssd daemon to be started at bootup
          Service.Adjust("sssd", "enable")
          if Service.Status("sssd") == 0
            Service.Restart("sssd")
          else
            Service.Start("sssd")
          end
        else
          Service.Stop("sssd")
          Service.Adjust("sssd", "disable")
        end

        if Package.Installed("nscd") && @modified
          SCR.Execute(path(".target.bash"), "/usr/sbin/nscd -i passwd")
          SCR.Execute(path(".target.bash"), "/usr/sbin/nscd -i group")
          Service.RunInitScript("nscd", "try-restart")
        end

        if Package.Installed("zmd") && Service.Status("novell-zmd") == 0
          Service.RunInitScript("novell-zmd", "try-restart")
        end

        Service.Restart("ypbind") if ypbind_running

        Service.Restart("sshd") if @restart_sshd

        if @_autofs_allowed
          Service.Stop("autofs")

          Service.Start("autofs") if @_start_autofs
        end
        # after finish of 2nd stage, restart running services (bnc#395402)
        if @start && Stage.cont
          services = []
          Builtins.foreach(["dbus", "haldaemon"]) do |service|
            if Service.Status(service) == 0
              services = Builtins.add(services, service)
            end
          end
          if Ops.greater_than(Builtins.size(services), 0)
            Builtins.y2milestone("services %1 will be restarted", services)
            SCR.Write(
              path(".target.string"),
              Ops.add(Directory.vardir, "/restart_services"),
              Ops.add(Builtins.mergestring(services, "\n"), "\n")
            )
          end
        end
      elsif @sssd
        # enable the sssd daemon to be started at bootup
        Service.Adjust("sssd", @start ? "enable" : "disable")
      end

      # -------------------- write settings to LDAP
      Progress.NextStage
      return :abort if Builtins.eval(abort)

      # ------------------------------ create the LDAP configuration (#40484)
      ldap_ok = true
      if @create_ldap && !Mode.autoinst
        ldap_ok = CreateDefaultLDAPConfiguration()
      end

      if @ldap_modified && ldap_ok
        CheckOrderOfCreation()

        if WriteLDAP(@templates) && WriteLDAP(@config_modules)
          @ldap_modified = false
        end
      end

      # final stage
      Progress.NextStage

      # unbind is done in agent destructor
      # ldap-client can be called more times from users module so we
      # will have to know it is necessary to bind again
      @bound = false
      if @modified
        @ldap_initialized = false
        @old_server = @server
        @old_base_dn = @base_dn
      end
      if @ldap_modified
        @config_modules = {}
        @templates = {}
      end

      # now clear the initial default values, so next time Read will read
      # real values
      if Stage.cont && Ops.greater_than(Builtins.size(@initial_defaults), 0)
        first_s = GetFirstServer(@server)
        if @start && ldap_ok &&
            @base_dn == Ops.get_string(@initial_defaults, "ldap_domain", "") &&
            (first_s == Ops.get_string(@initial_defaults, "ldap_server", "") ||
              DNS.IsHostLocal(first_s))
          @initial_defaults_used = true
          Builtins.y2milestone("initial defaults were used")
        end
        @initial_defaults = {}
      end

      :next
    end

### - (`Object`) WriteLDAP(objects)

Writes map of objects to LDAP. Ask for password, when needed and shows the error message when necessary.

Returns:

- success

    2198
    2199
    2200
    2201
    2202
    2203
    2204
    2205
    2206
    2207
    2208
    2209
    2210
    2211
    2212
    2213
    2214
    2215
    2216
    2217
    # File '../../src/modules/Ldap.rb', line 2198

    def WriteLDAP(objects)
      objects = deep_copy(objects)
      error = {}
      @bind_pass = LDAPAskAndBind(false) if @anonymous || @bind_pass == nil
      # nil means "canceled"
      if @bind_pass != nil
        error = WriteToLDAP(objects)
        if error != {}
          msg = Ops.get_string(error, "msg", "")
          if Ops.get_string(error, "server_msg", "") != ""
            msg = Ops.add(
              Ops.add(msg, "\n"),
              Ops.get_string(error, "server_msg", "")
            )
          end
          LDAPErrorMessage("write", msg)
        end
      end
      error == {} && @bind_pass != nil
    end

### - (`Object`) WriteLdapConfEntries(entry, value)

Write (possibly multi valued) entry to /etc/ldap.conf in /etc/ldap.conf should be written as "entry attr1 attr2" WriteLdapConfEntries ("nss_map_attribute", ["uniquemember", "member"])

Examples:

to write “nss_map_attribute uniquemember member”, call

Parameters:

- entry (`String`) —

  name

- value (`Array<String>`) —

  it is of type [attr1, attr2],

    694
    695
    696
    697
    698
    699
    700
    701
    702
    703
    704
    705
    706
    707
    708
    709
    710
    711
    712
    713
    714
    # File '../../src/modules/Ldap.rb', line 694

    def WriteLdapConfEntries(entry, value)
      value = deep_copy(value)
      current = ReadLdapConfEntries(entry)
      values = []
      Builtins.foreach(current) do |val|
        lval = Builtins.splitstring(val, " \t")
        if Builtins.tolower(Ops.get_string(lval, 0, "")) !=
            Builtins.tolower(Ops.get(value, 0, ""))
          values = Builtins.add(values, val)
        else
          values = Builtins.add(values, Builtins.mergestring(value, " "))
        end
      end
      values = [Builtins.mergestring(value, " ")] if Builtins.size(current) == 0
      SCR.Write(
        Builtins.add(path(".etc.ldap_conf.v.\"/etc/ldap.conf\""), entry),
        values
      )

      nil
    end

### - (`Object`) WriteLdapConfEntry(entry, value)

Write (single valued) entry to /etc/ldap.conf

Parameters:

- entry (`String`) —

  name

- value; (`String`) —

  if value is nil, entry will be removed

    679
    680
    681
    682
    683
    684
    685
    686
    # File '../../src/modules/Ldap.rb', line 679

    def WriteLdapConfEntry(entry, value)
      SCR.Write(
        Builtins.add(path(".etc.ldap_conf.v.\"/etc/ldap.conf\""), entry),
        value == nil ? nil : [value]
      )

      nil
    end

### - (`Object`) WriteNow

wrapper for Write, without abort block

    3232
    3233
    3234
    3235
    3236
    3237
    3238
    3239
    3240
    3241
    3242
    3243
    3244
    3245
    3246
    3247
    3248
    3249
    3250
    3251
    3252
    3253
    3254
    3255
    3256
    3257
    3258
    3259
    3260
    3261
    3262
    3263
    # File '../../src/modules/Ldap.rb', line 3232

    def WriteNow
      abort = lambda { false }

      needed_packages = @sssd ? @sssd_packages : @pam_nss_packages
      if @sssd_with_krb
        needed_packages = Convert.convert(
          Builtins.union(needed_packages, @kerberos_packages),
          :from => "list",
          :to   => "list <string>"
        )
      end

      if @_start_autofs && !Package.Installed("autofs")
        needed_packages = Builtins.add(needed_packages, "autofs")
      end

      if @start && !Package.InstalledAll(needed_packages)
        if !Package.InstallAll(needed_packages)
          Report.Error(Message.FailedToInstallPackages)
        end
        @start = false
        @_start_autofs = false
      end
      # during CLI call nss_base_* are not edited: adapt them to new base DN
      if @old_base_dn != @base_dn && @nss_base_passwd == @old_base_dn
        @nss_base_passwd = @base_dn
        @nss_base_shadow = @base_dn
        @nss_base_group = @base_dn
      end

      Write(abort) == :next
    end

### - (`Object`) WriteNscdCache(start_sssd)

Adpat passwd and group cache in /etc/nscd.conf Caching should be disabled with sssd on

Parameters:

- start_sssd (`Boolean`) —

  if sssd will be started

    2769
    2770
    2771
    2772
    2773
    2774
    2775
    2776
    2777
    2778
    2779
    2780
    2781
    2782
    2783
    2784
    2785
    2786
    2787
    2788
    2789
    2790
    2791
    2792
    2793
    # File '../../src/modules/Ldap.rb', line 2769

    def WriteNscdCache(start_sssd)
      enable_cache = Convert.convert(
        SCR.Read(path(".etc.nscd_conf.v.enable-cache")),
        :from => "any",
        :to   => "list <string>"
      )
      enable_cache = Builtins.maplist(enable_cache) do |sect|
        l = Builtins.filter(Builtins.splitstring(sect, " \t")) do |part|
          part != ""
        end
        if Ops.get(l, 0, "") == "passwd" || Ops.get(l, 0, "") == "group"
          next Builtins.sformat(
            "%1\t\t%2",
            Ops.get(l, 0, ""),
            start_sssd ? "no" : "yes"
          )
        end
        sect
      end
      return false if enable_cache == [] || enable_cache == nil
      ret = SCR.Write(path(".etc.nscd_conf.v.enable-cache"), enable_cache)
      # ensure the changes are written
      ret = ret && SCR.Write(path(".etc.nscd_conf"), nil)
      ret
    end

### - (`Object`) WriteOpenLdapConf

Modify also /etc/openldap/ldap.conf for the use of ldap client utilities (like ldapsearch)

Returns:

- modified?

    2222
    2223
    2224
    2225
    2226
    2227
    2228
    2229
    2230
    2231
    2232
    2233
    2234
    2235
    2236
    2237
    2238
    2239
    2240
    2241
    2242
    2243
    2244
    2245
    2246
    2247
    2248
    2249
    2250
    2251
    2252
    2253
    2254
    2255
    2256
    2257
    2258
    2259
    2260
    2261
    2262
    2263
    2264
    2265
    2266
    2267
    2268
    2269
    2270
    2271
    2272
    2273
    2274
    2275
    2276
    2277
    2278
    2279
    2280
    2281
    2282
    2283
    2284
    2285
    2286
    2287
    2288
    2289
    2290
    2291
    2292
    2293
    2294
    2295
    2296
    2297
    2298
    2299
    # File '../../src/modules/Ldap.rb', line 2222

    def WriteOpenLdapConf
      write_openldap_conf = @openldap_modified

      return false if !Package.Installed("openldap2-client")

      out = Convert.to_map(
        SCR.Execute(path(".target.bash_output"), "/bin/rpm -V openldap2-client")
      )

      open_host = []
      open_uri = Convert.to_list(
        SCR.Read(path(".etc.ldap_conf.v.\"/etc/openldap/ldap.conf\".uri"))
      )
      if open_uri == []
        open_uri = Convert.to_list(
          SCR.Read(path(".etc.ldap_conf.v.\"/etc/openldap/ldap.conf\".URI"))
        )
      end
      if open_uri == []
        open_host = Convert.to_list(
          SCR.Read(path(".etc.ldap_conf.v.\"/etc/openldap/ldap.conf\".host"))
        )
      else
        open_host = [uri2servers(Ops.get_string(open_uri, 0, ""))]
      end
      open_base = Convert.to_list(
        SCR.Read(path(".etc.ldap_conf.v.\"/etc/openldap/ldap.conf\".base"))
      )

      # if the config file was not modified by user yet
      if !Builtins.issubstring(
          Ops.get_string(out, "stdout", ""),
          "/etc/openldap/ldap.conf"
        )
        write_openldap_conf = true
      # if there are same values as in /etc/ldap.conf
      elsif @old_server == Ops.get_string(open_host, 0, "") &&
          @old_base_dn == Ops.get_string(open_base, 0, "")
        write_openldap_conf = true
      end

      if write_openldap_conf
        # update ldap.conf
        SCR.Write(
          path(".etc.ldap_conf.v.\"/etc/openldap/ldap.conf\".host"),
          nil
        )

        uri = Builtins.mergestring(
          Builtins.maplist(Builtins.splitstring(@server, " \t")) do |u|
            Ops.add("ldap://", u)
          end,
          " "
        )

        SCR.Write(
          path(".etc.ldap_conf.v.\"/etc/openldap/ldap.conf\".uri"),
          [uri]
        )

        SCR.Write(
          path(".etc.ldap_conf.v.\"/etc/openldap/ldap.conf\".base"),
          [@base_dn]
        )

        SCR.Write(
          path(".etc.ldap_conf.v.\"/etc/openldap/ldap.conf\".TLS_CACERTDIR"),
          @tls_cacertdir == "" ? nil : [@tls_cacertdir]
        )
        SCR.Write(
          path(".etc.ldap_conf.v.\"/etc/openldap/ldap.conf\".TLS_CACERT"),
          @tls_cacertfile == "" ? nil : [@tls_cacertfile]
        )

        Builtins.y2milestone("file /etc/openldap/ldap.conf was modified")
      end
      write_openldap_conf
    end

### - (`Object`) WritePlusLine(login)

If a file does not + entry, add it.

Parameters:

- is —

  login allowed?

Returns:

- success?

    2421
    2422
    2423
    2424
    2425
    2426
    2427
    2428
    2429
    2430
    2431
    2432
    2433
    2434
    2435
    2436
    2437
    2438
    2439
    2440
    2441
    2442
    2443
    2444
    2445
    2446
    2447
    2448
    2449
    2450
    2451
    2452
    2453
    2454
    2455
    2456
    2457
    2458
    2459
    2460
    2461
    2462
    2463
    2464
    2465
    2466
    2467
    2468
    2469
    2470
    2471
    2472
    2473
    2474
    2475
    2476
    2477
    2478
    2479
    2480
    2481
    2482
    2483
    2484
    2485
    2486
    2487
    2488
    2489
    2490
    2491
    2492
    2493
    2494
    2495
    # File '../../src/modules/Ldap.rb', line 2421

    def WritePlusLine(login)
      file = "/etc/passwd"
      what = "+::::::"
      what = "+::::::/sbin/nologin" if !login

      if !@passwd_read
        if !Convert.to_boolean(
            SCR.Execute(path(".passwd.init"), { "base_directory" => "/etc" })
          )
          Builtins.y2error("error: %1", SCR.Read(path(".passwd.error")))
          return false
        else
          @passwd_read = true
          @plus_lines_passwd = Convert.convert(
            SCR.Read(path(".passwd.passwd.pluslines")),
            :from => "any",
            :to   => "list <string>"
          )
        end
      end

      plus_lines = deep_copy(@plus_lines_passwd)

      if !Builtins.contains(plus_lines, what)
        plus_lines = Builtins.maplist(plus_lines) do |plus_line|
          next what if !login && plus_line == "+::::::"
          if login && Builtins.issubstring(plus_line, ":/sbin/nologin")
            next what
          end
          plus_line
        end
        if !Builtins.contains(plus_lines, what)
          plus_lines = Builtins.add(plus_lines, what)
        end

        if SCR.Write(path(".passwd.passwd.pluslines"), plus_lines)
          SCR.Execute(
            path(".target.bash"),
            Builtins.sformat("/bin/cp %1 %1.YaST2save", file)
          )
          # empty map as a parameter means "use data you have read"
          if !SCR.Write(path(".passwd.users"), {})
            Report.Error(Message.ErrorWritingFile(file))
            return false
          end
        end
      end

      file = "/etc/shadow"
      what = "+"
      plus_lines = Convert.convert(
        SCR.Read(path(".passwd.shadow.pluslines")),
        :from => "any",
        :to   => "list <string>"
      )

      if !Builtins.contains(plus_lines, what) &&
          !Builtins.contains(plus_lines, "+::::::::")
        plus_lines = Builtins.add(plus_lines, what)

        if SCR.Write(path(".passwd.shadow.pluslines"), plus_lines)
          SCR.Execute(
            path(".target.bash"),
            Builtins.sformat("/bin/cp %1 %1.YaST2save", file)
          )
          # empty map as a parameter means "use data you have read"
          if !SCR.Write(path(".passwd.shadow"), {})
            Report.Error(Message.ErrorWritingFile(file))
            return false
          end
        end
      end

      nil
    end

### - (`Object`) WriteSSSDConfig

Write updated /etc/sssd/sssd.conf file

    2302
    2303
    2304
    2305
    2306
    2307
    2308
    2309
    2310
    2311
    2312
    2313
    2314
    2315
    2316
    2317
    2318
    2319
    2320
    2321
    2322
    2323
    2324
    2325
    2326
    2327
    2328
    2329
    2330
    2331
    2332
    2333
    2334
    2335
    2336
    2337
    2338
    2339
    2340
    2341
    2342
    2343
    2344
    2345
    2346
    2347
    2348
    2349
    2350
    2351
    2352
    2353
    2354
    2355
    2356
    2357
    2358
    2359
    2360
    2361
    2362
    2363
    2364
    2365
    2366
    2367
    2368
    2369
    2370
    2371
    2372
    2373
    2374
    2375
    2376
    2377
    2378
    2379
    2380
    2381
    2382
    2383
    2384
    2385
    2386
    2387
    2388
    2389
    2390
    2391
    2392
    2393
    2394
    2395
    2396
    2397
    2398
    2399
    2400
    2401
    2402
    2403
    2404
    2405
    2406
    2407
    2408
    2409
    2410
    2411
    2412
    2413
    2414
    2415
    2416
    # File '../../src/modules/Ldap.rb', line 2302

    def WriteSSSDConfig
      if !FileUtils.Exists("/etc/sssd/sssd.conf")
        Builtins.y2warning(
          "file /etc/sssd/sssd.conf does not exists: not writing"
        )
        return false
      end

      sections = SCR.Dir(path(".etc.sssd_conf.section"))

      SCR.Write(path(".etc.sssd_conf.v.sssd.domains"), "default")

      # "The "services" setting should have the value "nss, pam"
      SCR.Write(path(".etc.sssd_conf.v.sssd.services"), "nss,pam")

      # " Make sure that "filter_groups" and "filter_users" in the "[nss]" section contains "root".
      f_g = Convert.to_string(
        SCR.Read(path(".etc.sssd_conf.v.nss.filter_groups"))
      )
      f_g = "" if f_g == nil
      l = Convert.convert(
        Builtins.union(Builtins.splitstring(f_g, ","), ["root"]),
        :from => "list",
        :to   => "list <string>"
      )
      SCR.Write(
        path(".etc.sssd_conf.v.nss.filter_groups"),
        Builtins.mergestring(l, ",")
      )

      f_u = Convert.to_string(
        SCR.Read(path(".etc.sssd_conf.v.nss.filter_users"))
      )
      f_u = "" if f_u == nil
      l = Convert.convert(
        Builtins.union(Builtins.splitstring(f_u, ","), ["root"]),
        :from => "list",
        :to   => "list <string>"
      )
      SCR.Write(
        path(".etc.sssd_conf.v.nss.filter_users"),
        Builtins.mergestring(l, ",")
      )

      domain = Builtins.add(path(".etc.sssd_conf.v"), "domain/default")

      uri = Builtins.mergestring(
        Builtins.maplist(Builtins.splitstring(@server, " \t")) do |s|
          Builtins.sformat("ldap://%1", s)
        end,
        ","
      )
      SCR.Write(Builtins.add(domain, "ldap_uri"), uri)
      SCR.Write(Builtins.add(domain, "ldap_search_base"), @base_dn)
      SCR.Write(Builtins.add(domain, "ldap_schema"), @sssd_ldap_schema)
      SCR.Write(Builtins.add(domain, "id_provider"), "ldap")
      SCR.Write(Builtins.add(domain, "ldap_user_uuid"), "entryuuid")
      SCR.Write(Builtins.add(domain, "ldap_group_uuid"), "entryuuid")

      SCR.Write(
        Builtins.add(domain, "ldap_id_use_start_tls"),
        @ldap_tls ? "True" : "False"
      )
      SCR.Write(
        Builtins.add(domain, "enumerate"),
        @sssd_enumerate ? "True" : "False"
      )
      SCR.Write(
        Builtins.add(domain, "cache_credentials"),
        @sssd_cache_credentials ? "True" : "False"
      )
      SCR.Write(
        Builtins.add(domain, "ldap_tls_cacertdir"),
        @tls_cacertdir == "" ? nil : @tls_cacertdir
      )
      SCR.Write(
        Builtins.add(domain, "ldap_tls_cacert"),
        @tls_cacertfile == "" ? nil : @tls_cacertfile
      )

      # remove the keys if their value is same as default (base_dn)
      SCR.Write(
        Builtins.add(domain, "ldap_user_search_base"),
        @nss_base_passwd != @base_dn && @nss_base_passwd != "" ? @nss_base_passwd : nil
      )
      SCR.Write(
        Builtins.add(domain, "ldap_group_search_base"),
        @nss_base_group != @base_dn && @nss_base_group != "" ? @nss_base_group : nil
      )

      if !Builtins.contains(sections, "domain/default")
        SCR.Write(
          Builtins.add(path(".etc.sssd_conf.section_comment"), "domain/default"),
          "\n# Section created by YaST\n"
        )
      end

      # In a mixed Kerberos/LDAP setup the following changes are needed in the [domain/default] section:
      if @sssd_with_krb
        SCR.Write(Builtins.add(domain, "auth_provider"), "krb5")
        SCR.Write(Builtins.add(domain, "chpass_provider"), "krb5")

        SCR.Write(Builtins.add(domain, "krb5_realm"), @krb5_realm)
        SCR.Write(Builtins.add(domain, "krb5_kdcip"), @krb5_kdcip)
      else
        SCR.Write(Builtins.add(domain, "chpass_provider"), "ldap")
        SCR.Write(Builtins.add(domain, "auth_provider"), "ldap")
      end

      if !SCR.Write(path(".etc.sssd_conf"), nil)
        Builtins.y2error("error writing ldap.conf file")
      end
      true
    end

### - (`Object`) WriteToLDAP(objects)

Writes map of objects to LDAP $[ DN: (map) attribute_values]

Examples:

TODO

Parameters:

- objects (`Hash`) —

  map of objects to write. It is in the form:

Returns:

- error map (empty on success)

    2127
    2128
    2129
    2130
    2131
    2132
    2133
    2134
    2135
    2136
    2137
    2138
    2139
    2140
    2141
    2142
    2143
    2144
    2145
    2146
    2147
    2148
    2149
    2150
    2151
    2152
    2153
    2154
    2155
    2156
    2157
    2158
    2159
    2160
    2161
    2162
    2163
    2164
    2165
    2166
    2167
    2168
    2169
    2170
    2171
    2172
    2173
    2174
    2175
    2176
    2177
    2178
    2179
    2180
    2181
    2182
    2183
    2184
    2185
    2186
    2187
    2188
    2189
    2190
    2191
    2192
    2193
    # File '../../src/modules/Ldap.rb', line 2127

    def WriteToLDAP(objects)
      objects = deep_copy(objects)
      ret = {}
      Builtins.foreach(
        Convert.convert(objects, :from => "map", :to => "map <string, map>")
      ) do |dn, object|
        next if ret != {}
        action = Ops.get_string(object, "modified", "")
        if action != ""
          object = Builtins.remove(object, "modified")
        else
          next
        end
        # convert the default values back to the LDAP format
        if Builtins.haskey(object, "default_values")
          Ops.set(
            object,
            "suseDefaultValue",
            Builtins.maplist(Ops.get_map(object, "default_values", {})) do |key, val|
              Builtins.sformat("%1=%2", key, val)
            end
          )
          object = Builtins.remove(object, "default_values")
        end
        if action == "added"
          if !SCR.Write(path(".ldap.add"), { "dn" => dn }, object)
            ret = LDAPErrorMap()
          end
        end
        if action == "edited"
          if !SCR.Write(
              path(".ldap.modify"),
              { "dn" => dn, "check_attrs" => true },
              object
            )
            ret = LDAPErrorMap()
          end
        end
        if action == "renamed"
          arg_map = {
            "dn"          => Ops.get_string(object, "old_dn", dn),
            "check_attrs" => true
          }
          if Builtins.tolower(dn) !=
              Builtins.tolower(Ops.get_string(object, "old_dn", dn))
            Ops.set(arg_map, "new_dn", dn)
            Ops.set(arg_map, "deleteOldRDN", true)
            Ops.set(arg_map, "subtree", true)
          end
          if Builtins.haskey(object, "old_dn")
            object = Builtins.remove(object, "old_dn")
          end
          if !SCR.Write(path(".ldap.modify"), arg_map, object)
            ret = LDAPErrorMap()
          end
        end
        if action == "deleted"
          if Ops.get_string(object, "old_dn", dn) != dn
            dn = Ops.get_string(object, "old_dn", dn)
          end
          if !SCR.Write(path(".ldap.delete"), { "dn" => dn })
            ret = LDAPErrorMap()
          end
        end
      end
      deep_copy(ret)
    end