From ffae2ad7dbda36d1f3a3dd76215766cb5aadaccd Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Mon, 15 Jul 2019 08:28:02 +0800 Subject: [PATCH] fix: ldap sync domain may remove local usrs --- cmd/climc/shell/quotas.go | 2 +- pkg/keystone/driver/ldap/sync.go | 6 ++++++ pkg/keystone/models/groups.go | 8 ++++++++ pkg/keystone/models/users.go | 8 ++++++++ 4 files changed, 23 insertions(+), 1 deletion(-) diff --git a/cmd/climc/shell/quotas.go b/cmd/climc/shell/quotas.go index c7c8fa93dd..d43b8372cb 100644 --- a/cmd/climc/shell/quotas.go +++ b/cmd/climc/shell/quotas.go @@ -61,7 +61,7 @@ func init() { type QuotaSetOptions struct { Tenant string `help:"Tenant name or ID to set quota" json:"tenant,omitempty"` - ProjectDomain string `help:"Domain name or ID to set quota" json:"domain,omitempty"` + ProjectDomain string `help:"Domain name or ID to set quota" json:",omitempty"` Action string `help:"quota set action" choices:"add|reset|replace"` Cascade bool `help:"cascade set quota so that auto increment domain quota if total project quota exceeds parent domain quota"` QuotaBaseOptions diff --git a/pkg/keystone/driver/ldap/sync.go b/pkg/keystone/driver/ldap/sync.go index 46b577ba98..15ba7667a1 100644 --- a/pkg/keystone/driver/ldap/sync.go +++ b/pkg/keystone/driver/ldap/sync.go @@ -265,6 +265,9 @@ func (self *SLDAPDriver) syncUsers(ctx context.Context, cli *ldaputils.SLDAPClie return nil, errors.Wrap(err, "models.UserManager.FetchUserIdsInDomain") } for i := range deleteUsers { + if !deleteUsers[i].LinkedWithIdp(self.IdpId) { + continue + } err := deleteUsers[i].UnlinkIdp(self.IdpId) if err != nil { log.Errorf("deleteUser.UnlinkIdp error %s", err) @@ -381,6 +384,9 @@ func (self *SLDAPDriver) syncGroups(ctx context.Context, cli *ldaputils.SLDAPCli return errors.Wrap(err, "models.GroupManager.FetchGroupsInDomain") } for i := range deleteGroups { + if !deleteGroups[i].LinkedWithIdp(self.IdpId) { + continue + } err := deleteGroups[i].UnlinkIdp(self.IdpId) if err != nil { log.Errorf("deleteGroup.UnlinkIdp error %s", err) diff --git a/pkg/keystone/models/groups.go b/pkg/keystone/models/groups.go index 3d7265bb2a..088a6af088 100644 --- a/pkg/keystone/models/groups.go +++ b/pkg/keystone/models/groups.go @@ -252,6 +252,14 @@ func (group *SGroup) IsReadOnly() bool { return false } +func (group *SGroup) LinkedWithIdp(idpId string) bool { + idmap, _ := group.getIdmapping() + if idmap != nil && idmap.IdpId == idpId { + return true + } + return false +} + func (manager *SGroupManager) FetchCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, objs []db.IModel, fields stringutils2.SSortedStrings) []*jsonutils.JSONDict { rows := manager.SIdentityBaseResourceManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields) return expandIdpAttributes(rows, objs, fields, api.IdMappingEntityGroup) diff --git a/pkg/keystone/models/users.go b/pkg/keystone/models/users.go index 3038247d4b..da2849d42b 100644 --- a/pkg/keystone/models/users.go +++ b/pkg/keystone/models/users.go @@ -633,6 +633,14 @@ func (user *SUser) IsReadOnly() bool { return false } +func (user *SUser) LinkedWithIdp(idpId string) bool { + idmap, _ := user.getIdmapping() + if idmap != nil && idmap.IdpId == idpId { + return true + } + return false +} + func (manager *SUserManager) FetchCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, objs []db.IModel, fields stringutils2.SSortedStrings) []*jsonutils.JSONDict { rows := manager.SEnabledIdentityBaseResourceManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields) return expandIdpAttributes(rows, objs, fields, api.IdMappingEntityUser)