Skip to content

Commit c46df84

Browse files
ryannewingtonryannewington
committed
1 parent 53d8f3c commit c46df84

File tree

1 file changed

+143
-0
lines changed

1 file changed

+143
-0
lines changed

‎ConfigurationFiles/Kerberos/kerberos.xml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<sshma:Lithnet.SshMA xmlns:sshma="http://lithnet.local/Lithnet.SshMA.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
3+
4+
<ma-capabilities>
5+
<delta-import>true</delta-import>
6+
<object-update-mode>AttributeUpdate</object-update-mode>
7+
<delete-add-as-replace>false</delete-add-as-replace>
8+
<object-rename-allowed>true</object-rename-allowed>
9+
</ma-capabilities>
10+
11+
<schema>
12+
<schema-attributes>
13+
<schema-attribute name="accountName" multivalued="false" type ="string" operation="ImportExport"/>
14+
<schema-attribute name="expiryDate" multivalued="false" type="string" operation="ExportOnly"/>
15+
<schema-attribute name="accountDisabled" multivalued="false" type="boolean" operation="ExportOnly"/>
16+
</schema-attributes>
17+
18+
<schema-objects>
19+
<schema-object object-class="user">
20+
<dn-format>{accountName}</dn-format>
21+
<attributes>
22+
<attribute>accountName</attribute>
23+
<attribute>expiryDate</attribute>
24+
<attribute>accountDisabled</attribute>
25+
</attributes>
26+
</schema-object>
27+
</schema-objects>
28+
</schema>
29+
30+
<global-operations>
31+
<global-operation xsi:type="sshma:global-operation-ImportFullStart">
32+
<commands>
33+
<command>/usr/kerberos/sbin/kadmin -p svc-fim -k -q list_principals > /home/svc-fim/deltas/lastrun.sshma</command>
34+
</commands>
35+
</global-operation>
36+
<global-operation xsi:type="sshma:global-operation-ImportDeltaEnd">
37+
<commands>
38+
<command>/usr/kerberos/sbin/kadmin -p svc-fim -k -q list_principals > /home/svc-fim/deltas/lastrun.sshma</command>
39+
</commands>
40+
</global-operation>
41+
<!--
42+
<global-operation xsi:type="sshma:global-operation-ImportFullEnd"/>
43+
<global-operation xsi:type="sshma:global-operation-ImportDeltaStart"/>
44+
<global-operation xsi:type="sshma:global-operation-ExportStart"/>
45+
<global-operation xsi:type="sshma:global-operation-ExportEnd"/>
46+
<global-operation xsi:type="sshma:global-operation-PasswordStart"/>
47+
<global-operation xsi:type="sshma:global-operation-PasswordEnd"/>-->
48+
</global-operations>
49+
50+
<object-operations object-class="user">
51+
<object-operation xsi:type="sshma:object-operation-ImportFull">
52+
<commands>
53+
<command result-has-objects="true" success-codes="0">cat /home/svc-fim/deltas/lastrun.sshma</command>
54+
</commands>
55+
<import-mapping>
56+
<object-extract><![CDATA[^(?<accountName>.*?)@.*$]]></object-extract>
57+
<object-filters>
58+
<object-filter attribute="accountName" operator="Equals">svc-fim</object-filter>
59+
<!--<object-filter attribute="accountName" operator="NotEquals">rnew0001</object-filter>
60+
<object-filter attribute="accountName" operator="NotEquals">testuser1</object-filter>-->
61+
<object-filter attribute="accountName" operator="NotContains">rnew</object-filter>
62+
</object-filters>
63+
</import-mapping>
64+
</object-operation>
65+
66+
<object-operation xsi:type="sshma:object-operation-ImportDelta">
67+
<commands>
68+
<command result-has-objects="true" success-codes="0">/home/svc-fim/dev/fim_kerberos_delta/delta_maker.py</command>
69+
</commands>
70+
<import-mapping>
71+
<object-extract><![CDATA[^(?<changeType>.*?):(?<accountName>.*?)@.*$]]></object-extract>
72+
<object-filters>
73+
<object-filter attribute="accountName" operator="Equals">svc-fim</object-filter>
74+
</object-filters>
75+
<modification-type-mappings capture-group-name="changeType" unexpected-modification-type-action="ignore">
76+
<modification-type-add>add</modification-type-add>
77+
<modification-type-replace>replace</modification-type-replace>
78+
<modification-type-delete>delete</modification-type-delete>
79+
</modification-type-mappings>
80+
</import-mapping>
81+
</object-operation>
82+
83+
<object-operation xsi:type="sshma:object-operation-ExportAdd">
84+
<commands>
85+
<command rule-id="AccountDisabledIsTrue">/usr/kerberos/sbin/kadmin -p svc-fim -k -q "add_principal [-expire {expiryDate} ]-randkey -allow_tix {dn}"</command>
86+
<command rule-id="AccountDisabledIsFalse">/usr/kerberos/sbin/kadmin -p svc-fim -k -q "add_principal [-expire {expiryDate} ]-randkey +allow_tix {dn}"</command>
87+
<command rule-id="AccountDisabledIsNotPresent">/usr/kerberos/sbin/kadmin -p svc-fim -k -q "add_principal [-expire {expiryDate} ]-randkey {dn}"</command>
88+
</commands>
89+
</object-operation>
90+
91+
<object-operation xsi:type="sshma:object-operation-ExportModify">
92+
<commands>
93+
<command rule-id="AccountDisabledIsTrue">/usr/kerberos/sbin/kadmin -p svc-fim -k -q "modify_principal -allow_tix {dn}"</command>
94+
<command rule-id="AccountDisabledIsFalse">/usr/kerberos/sbin/kadmin -p svc-fim -k -q "modify_principal +allow_tix {dn}"</command>
95+
<command rule-id="ExpiryDateHasChanged">/usr/kerberos/sbin/kadmin -p svc-fim -k -q "modify_principal -expire \"{expiryDate}\" {dn}"</command>
96+
<command rule-id="AccountNameHasChanged">/usr/kerberos/sbin/kadmin -p svc-fim -k -q "delete_principal -force {dn}"</command>
97+
<command rule-id="AccountNameHasChanged">/usr/kerberos/sbin/kadmin -p svc-fim -k -q "add_principal -randkey {accountName}"</command>
98+
</commands>
99+
</object-operation>
100+
101+
<object-operation xsi:type="sshma:object-operation-ExportDelete">
102+
<commands>
103+
<command>/usr/kerberos/sbin/kadmin -p svc-fim -k -q "delete_principal -force {dn}"</command>
104+
</commands>
105+
</object-operation>
106+
107+
<object-operation xsi:type="sshma:object-operation-PasswordSet">
108+
<commands>
109+
<async-command>
110+
<!--
111+
<send-when expect="$ " timeout="5">echo /usr/kerberos/sbin/kadmin -p svc-fim -k</send-when>
112+
<send-when expect="$ " timeout="5">echo cpw {dn}</send-when>
113+
<send-when expect="$ " timeout="5">echo {newpassword}</send-when>
114+
<send-when expect="$ " timeout="5">echo {newpassword}</send-when>
115+
<success-when expect="$ " timeout="5"/>
116+
-->
117+
<send-when expect="$ " timeout="5">/usr/kerberos/sbin/kadmin -p svc-fim -k</send-when>
118+
<send-when expect="kadmin: " timeout="5">cpw {dn}</send-when>
119+
<send-when expect="Enter password for principal &quot;{dn}&quot;: " timeout="5">{newpassword}</send-when>
120+
<send-when expect="Re-enter password for principal &quot;{dn}&quot;: " timeout="5">{newpassword}</send-when>
121+
<success-when expect="Password for &quot;{dn}@CC.MONASH.EDU.AU&quot; changed." timeout="5"/>
122+
</async-command>
123+
<!--<command>/usr/kerberos/sbin/kadmin -p svc-fim -k -q "cpw -pw {newpassword} {dn}"</command>-->
124+
</commands>
125+
</object-operation>
126+
</object-operations>
127+
128+
<rules>
129+
<rule-group xsi:type="sshma:rule-group" id="AccountDisabledIsTrue" operator="And">
130+
<rule-ref rule-id="AccountDisabledIsPresent"/>
131+
<rule xsi:type="sshma:rule-SingleValuedAttributeValueRule" id="AccountIsDisabled" attribute="accountDisabled" operator="Equals" value="true"/>
132+
</rule-group>
133+
<rule-group xsi:type="sshma:rule-group" id="AccountDisabledIsFalse" operator="And">
134+
<rule-ref rule-id="AccountDisabledIsPresent"/>
135+
<rule xsi:type="sshma:rule-SingleValuedAttributeValueRule" id="AccountIsEnabled" attribute="accountDisabled" operator="Equals" value="false"/>
136+
</rule-group>
137+
<rule xsi:type="sshma:rule-AttributePresenceRule" id="AccountDisabledIsPresent" attribute="accountDisabled" operator="IsPresent"/>
138+
<rule xsi:type="sshma:rule-AttributePresenceRule" id="AccountDisabledIsNotPresent" attribute="accountDisabled" operator="NotPresent"/>
139+
<rule xsi:type="sshma:rule-AttributeChangeRule" id="AccountNameHasChanged" attribute="accountName" triggers="Update"/>
140+
<rule xsi:type="sshma:rule-AttributeChangeRule" id="ExpiryDateHasChanged" attribute="expiryDate" triggers="Add,Update"/>
141+
</rules>
142+
143+
</sshma:Lithnet.SshMA>

0 commit comments

Comments
 (0)