Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 1 | import os |
| 2 | import base64 |
| 3 | from collections import defaultdict |
| 4 | from django.db.models import F, Q |
Scott Baker | 76a840e | 2015-02-11 21:38:09 -0800 | [diff] [blame] | 5 | from xos.config import Config |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 6 | from observer.openstacksyncstep import OpenStackSyncStep |
Sapan Bhatia | e6376de | 2015-05-13 15:51:03 +0200 | [diff] [blame] | 7 | from observer.syncstep import * |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 8 | from core.models.site import Controller, SitePrivilege |
| 9 | from core.models.user import User |
| 10 | from core.models.controlleruser import ControllerUser, ControllerSitePrivilege |
Tony Mack | 08f8288 | 2015-03-29 08:32:21 -0400 | [diff] [blame] | 11 | from util.logger import observer_logger as logger |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 12 | from observer.ansible import * |
Sapan Bhatia | 9028c9a | 2015-05-09 18:14:40 +0200 | [diff] [blame] | 13 | import json |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 14 | |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 15 | class SyncControllerSitePrivileges(OpenStackSyncStep): |
Sapan Bhatia | b3048aa | 2015-01-27 03:52:19 +0000 | [diff] [blame] | 16 | provides=[SitePrivilege] |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 17 | requested_interval=0 |
Sapan Bhatia | 99f4968 | 2015-01-29 20:58:25 +0000 | [diff] [blame] | 18 | observes=ControllerSitePrivilege |
Sapan Bhatia | 321b70e | 2015-08-19 12:20:47 -0400 | [diff] [blame] | 19 | playbook='sync_controller_users.yaml' |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 20 | |
Sapan Bhatia | 321b70e | 2015-08-19 12:20:47 -0400 | [diff] [blame] | 21 | def map_sync_inputs(self, controller_site_privilege): |
Sapan Bhatia | 9028c9a | 2015-05-09 18:14:40 +0200 | [diff] [blame] | 22 | controller_register = json.loads(controller_site_privilege.controller.backend_register) |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 23 | if not controller_site_privilege.controller.admin_user: |
| 24 | logger.info("controller %r has no admin_user, skipping" % controller_site_privilege.controller) |
| 25 | return |
| 26 | |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 27 | roles = [controller_site_privilege.site_privilege.role.role] |
| 28 | # setup user home site roles at controller |
| 29 | if not controller_site_privilege.site_privilege.user.site: |
| 30 | raise Exception('Siteless user %s'%controller_site_privilege.site_privilege.user.email) |
| 31 | else: |
| 32 | # look up tenant id for the user's site at the controller |
| 33 | #ctrl_site_deployments = SiteDeployment.objects.filter( |
| 34 | # site_deployment__site=controller_site_privilege.user.site, |
| 35 | # controller=controller_site_privilege.controller) |
| 36 | |
| 37 | #if ctrl_site_deployments: |
| 38 | # # need the correct tenant id for site at the controller |
| 39 | # tenant_id = ctrl_site_deployments[0].tenant_id |
| 40 | # tenant_name = ctrl_site_deployments[0].site_deployment.site.login_base |
| 41 | user_fields = { |
Tony Mack | 09a2f07 | 2015-09-14 00:53:39 +0000 | [diff] [blame] | 42 | 'endpoint':controller_site_privilege.controller.auth_url, |
| 43 | 'endpoint_v3': controller_site_privilege.controller.auth_url_v3, |
| 44 | 'domain': controller_site_privilege.controller.domain, |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 45 | 'name': controller_site_privilege.site_privilege.user.email, |
Tony Mack | 09a2f07 | 2015-09-14 00:53:39 +0000 | [diff] [blame] | 46 | 'email': controller_site_privilege.site_privilege.user.email, |
| 47 | 'password': controller_site_privilege.site_privilege.user.remote_password, |
| 48 | 'admin_user': controller_site_privilege.controller.admin_user, |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 49 | 'admin_password': controller_site_privilege.controller.admin_password, |
Tony Mack | 09a2f07 | 2015-09-14 00:53:39 +0000 | [diff] [blame] | 50 | 'ansible_tag':'%s@%s'%(controller_site_privilege.site_privilege.user.email.replace('@','-at-'),controller_site_privilege.controller.name), |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 51 | 'admin_tenant': controller_site_privilege.controller.admin_tenant, |
| 52 | 'roles':roles, |
| 53 | 'tenant':controller_site_privilege.site_privilege.site.login_base} |
| 54 | |
Sapan Bhatia | 321b70e | 2015-08-19 12:20:47 -0400 | [diff] [blame] | 55 | return user_fields |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 56 | |
Sapan Bhatia | 321b70e | 2015-08-19 12:20:47 -0400 | [diff] [blame] | 57 | def map_sync_outputs(self, controller_site_privilege, res): |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 58 | # results is an array in which each element corresponds to an |
| 59 | # "ok" string received per operation. If we get as many oks as |
| 60 | # the number of operations we issued, that means a grand success. |
| 61 | # Otherwise, the number of oks tell us which operation failed. |
Tony Mack | f3c17e1 | 2015-10-01 00:05:56 +0000 | [diff] [blame] | 62 | controller_site_privilege.role_id = res[0]['id'] |
Sapan Bhatia | b0464ba | 2015-01-23 16:21:57 +0000 | [diff] [blame] | 63 | controller_site_privilege.save() |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 64 | |
| 65 | def delete_record(self, controller_site_privilege): |
Sapan Bhatia | 9028c9a | 2015-05-09 18:14:40 +0200 | [diff] [blame] | 66 | controller_register = json.loads(controller_site_privilege.controller.backend_register) |
| 67 | if (controller_register.get('disabled',False)): |
Sapan Bhatia | e6376de | 2015-05-13 15:51:03 +0200 | [diff] [blame] | 68 | raise InnocuousException('Controller %s is disabled'%controller_site_privilege.controller.name) |
Sapan Bhatia | 9028c9a | 2015-05-09 18:14:40 +0200 | [diff] [blame] | 69 | |
Tony Mack | ffe6d8b | 2015-01-06 23:48:02 -0500 | [diff] [blame] | 70 | if controller_site_privilege.role_id: |
| 71 | driver = self.driver.admin_driver(controller=controller_site_privilege.controller) |
| 72 | user = ControllerUser.objects.get( |
| 73 | controller=controller_site_privilege.controller, |
| 74 | user=controller_site_privilege.site_privilege.user |
| 75 | ) |
| 76 | site = ControllerSite.objects.get( |
| 77 | controller=controller_site_privilege.controller, |
| 78 | user=controller_site_privilege.site_privilege.user |
| 79 | ) |
| 80 | driver.delete_user_role( |
| 81 | user.kuser_id, |
| 82 | site.tenant_id, |
| 83 | controller_site_privilege.site_prvilege.role.role |
| 84 | ) |