ud-generate: Add an extra output file called all-users.json

[mirror/userdir-ldap.git] / ud-generate

diff --git a/ud-generate b/ud-generate
index 6e4cf4d..02b3794 100755 (executable)
--- a/ud-generate
+++ b/ud-generate
@@ -36,6 +36,13 @@ try:
    from cStringIO import StringIO
 except ImportError:
    from StringIO import StringIO
    from cStringIO import StringIO
 except ImportError:
    from StringIO import StringIO

+try:
+   import simplejson as json
+except ImportError:
+   import json
+   if not '__author__' in json.__dict__:
+      sys.stderr.write("Warning: This is probably the wrong json module.  We want python 2.6's json\n")
+      sys.stderr.write("module, or simplejson on pytyon 2.5.  Let's see if/how stuff blows up.\n")

 
 global Allowed
 global CurrentHost
 
 global Allowed
 global CurrentHost


@@ -44,9 +51,7 @@ if os.getuid() == 0:
    sys.stderr.write("You should probably not run ud-generate as root.\n")
    sys.exit(1)
 
    sys.stderr.write("You should probably not run ud-generate as root.\n")
    sys.exit(1)
 

-PasswdAttrs = None

 DebianUsers = None
 DebianUsers = None

-DisabledUsers = []

 GroupIDMap = {}
 SubGroupMap = {}
 Allowed = None
 GroupIDMap = {}
 SubGroupMap = {}
 Allowed = None


@@ -91,19 +96,17 @@ def DoLink(From, To, File):
       pass
    posix.link(From + File, To + File)
 
       pass
    posix.link(From + File, To + File)
 

-def IsRetired(DnRecord):
+def IsRetired(account):

    """
    Looks for accountStatus in the LDAP record and tries to
    match it against one of the known retired statuses
    """
 
    """
    Looks for accountStatus in the LDAP record and tries to
    match it against one of the known retired statuses
    """
 

-   status = GetAttr(DnRecord, "accountStatus", None)
-   if status is None:
-      return False
+   status = account['accountStatus']

 
    line = status.split()
    status = line[0]
 
    line = status.split()
    status = line[0]

-   
+

    if status == "inactive":
       return True
 
    if status == "inactive":
       return True
 


@@ -122,32 +125,25 @@ def IsRetired(DnRecord):
 
    return False
 
 
    return False
 

-def IsGidDebian(x):
-   try:
-      return int(GetAttr(x, "gidNumber", 0)) == 800
-   except ValueError:
-      return False
+#def IsGidDebian(account):
+#   return account['gidNumber'] == 800

 
 # See if this user is in the group list
 
 # See if this user is in the group list

-def IsInGroup(DnRecord):
+def IsInGroup(account):

   if Allowed is None:
      return True
 
   # See if the primary group is in the list
   if Allowed is None:
      return True
 
   # See if the primary group is in the list

-  if Allowed.has_key(GetAttr(DnRecord, "gidNumber")) != 0:
-     return True
+  if str(account['gidNumber']) in Allowed: return True

 
   # Check the host based ACL
 
   # Check the host based ACL

-  if DnRecord[1].has_key("allowedHost") != 0:
-     if CurrentHost in DnRecord[1]["allowedHost"]:
-        return True
+  if 'allowedHost' in account and CurrentHost in account['allowedHost']: return True

 
   # See if there are supplementary groups
 
   # See if there are supplementary groups

-  if DnRecord[1].has_key("supplementaryGid") == 0:
-     return False
+  if not 'supplementaryGid' in account: return False

 
   supgroups=[]
 
   supgroups=[]

-  addGroups(supgroups, DnRecord[1]["supplementaryGid"], GetAttr(DnRecord, "uid"))
+  addGroups(supgroups, account['supplementaryGid'], account['uid'])

   for g in supgroups:
      if Allowed.has_key(g):
         return True
   for g in supgroups:
      if Allowed.has_key(g):
         return True


@@ -176,37 +172,34 @@ def Done(File, F, Fdb):
       os.rename(File + ".tdb.tmp", File + ".tdb")
 
 # Generate the password list
       os.rename(File + ".tdb.tmp", File + ".tdb")
 
 # Generate the password list

-def GenPasswd(File, HomePrefix, PwdMarker):
+def GenPasswd(accounts, File, HomePrefix, PwdMarker):

    F = None
    try:
       F = open(File + ".tdb.tmp", "w")
    F = None
    try:
       F = open(File + ".tdb.tmp", "w")

-     
+

       userlist = {}
       userlist = {}

-      # Fetch all the users
-      global PasswdAttrs
-     
-      I = 0
-      for x in PasswdAttrs:
-         if x[1].has_key("uidNumber") == 0 or not IsInGroup(x):
-            continue
-     
+      i = 0
+      for a in accounts:
+         if not IsInGroup(a): continue
+

          # Do not let people try to buffer overflow some busted passwd parser.
          # Do not let people try to buffer overflow some busted passwd parser.

-         if len(GetAttr(x, "gecos")) > 100 or len(GetAttr(x, "loginShell")) > 50:
-            continue
-     
-         userlist[GetAttr(x, "uid")] = int(GetAttr(x, "gidNumber"))
-         Line = "%s:%s:%s:%s:%s:%s%s:%s" % (GetAttr(x, "uid"),\
-                 PwdMarker,\
-                 GetAttr(x, "uidNumber"), GetAttr(x, "gidNumber"),\
-                 GetAttr(x, "gecos"), HomePrefix, GetAttr(x, "uid"),\
-                 GetAttr(x, "loginShell"))
-     
-         Line = Sanitize(Line) + "\n"
-         F.write("0%u %s" % (I, Line))
-         F.write(".%s %s" % (GetAttr(x, "uid"), Line))
-         F.write("=%s %s" % (GetAttr(x, "uidNumber"), Line))
-         I = I + 1
-  
+         if len(a['gecos']) > 100 or len(a['loginShell']) > 50: continue
+
+         userlist[a['uid']] = a['gidNumber']
+         line = "%s:%s:%d:%d:%s:%s%s:%s" % (
+                 a['uid'],
+                 PwdMarker,
+                 a['uidNumber'],
+                 a['gidNumber'],
+                 a['gecos'],
+                 HomePrefix, a['uid'],
+                 a['loginShell'])
+         line = Sanitize(line) + "\n"
+         F.write("0%u %s" % (i, line))
+         F.write(".%s %s" % (a['uid'], line))
+         F.write("=%d %s" % (a['uidNumber'], line))
+         i = i + 1
+

    # Oops, something unspeakable happened.
    except:
       Die(File, None, F)
    # Oops, something unspeakable happened.
    except:
       Die(File, None, F)


@@ -216,46 +209,58 @@ def GenPasswd(File, HomePrefix, PwdMarker):
    # Return the list of users so we know which keys to export
    return userlist
 
    # Return the list of users so we know which keys to export
    return userlist
 

+def GenAllUsers(accounts, file):
+   f = None
+   try:
+      OldMask = os.umask(0022)
+      f = open(file + ".tmp", "w", 0644)
+      os.umask(OldMask)
+
+      all = []
+      for a in accounts:
+         all.append( { 'uid': a['uid'],
+                       'uidNumber': a['uidNumber'],
+                       'active': a.pw_active() and a.shadow_active() } )
+      json.dump(all, f)
+
+   # Oops, something unspeakable happened.
+   except:
+      Die(file, f, None)
+      raise
+   Done(file, f, None)
+

 # Generate the shadow list
 # Generate the shadow list

-def GenShadow(File):
+def GenShadow(accounts, File):

    F = None
    try:
       OldMask = os.umask(0077)
       F = open(File + ".tdb.tmp", "w", 0600)
       os.umask(OldMask)
    F = None
    try:
       OldMask = os.umask(0077)
       F = open(File + ".tdb.tmp", "w", 0600)
       os.umask(OldMask)

-     
-      # Fetch all the users
-      global PasswdAttrs
-     
-      I = 0
-      for x in PasswdAttrs:
-         if x[1].has_key("uidNumber") == 0 or not IsInGroup(x):
-            continue
-     
-         Pass = GetAttr(x, "userPassword")
-         if Pass[0:7] != "{crypt}" or len(Pass) > 50:
-            Pass = '*'
-         else:
-            Pass = Pass[7:]
-     
+
+      i = 0
+      for a in accounts:
+         Pass = '*'
+         if not IsInGroup(a): continue
+

          # If the account is locked, mark it as such in shadow
          # See Debian Bug #308229 for why we set it to 1 instead of 0
          # If the account is locked, mark it as such in shadow
          # See Debian Bug #308229 for why we set it to 1 instead of 0

-         if (GetAttr(x, "userPassword").find("*LK*") != -1) \
-             or GetAttr(x, "userPassword").startswith("!"):
-            ShadowExpire = '1'
-         else:
-            ShadowExpire = GetAttr(x, "shadowExpire")
-     
-         Line = "%s:%s:%s:%s:%s:%s:%s:%s:" % (GetAttr(x, "uid"),\
-                 Pass, GetAttr(x, "shadowLastChange"),\
-                 GetAttr(x, "shadowMin"), GetAttr(x, "shadowMax"),\
-                 GetAttr(x, "shadowWarning"), GetAttr(x, "shadowInactive"),\
-                 ShadowExpire)
-         Line = Sanitize(Line) + "\n"
-         F.write("0%u %s" % (I, Line))
-         F.write(".%s %s" % (GetAttr(x, "uid"), Line))
-         I = I + 1
-  
+         if not a.pw_active():     ShadowExpire = '1'
+         elif 'shadowExpire' in a: ShadowExpire = str(a['shadowExpire'])
+         else:                     ShadowExpire = ''
+
+         values = []
+         values.append(a['uid'])
+         values.append(a.get_password())
+         for key in 'shadowLastChange', 'shadowMin', 'shadowMax', 'shadowWarning', 'shadowInactive':
+            if key in a: values.append(a[key])
+            else:        values.append('')
+         values.append(ShadowExpire)
+         line = ':'.join(values)+':'
+         line = Sanitize(line) + "\n"
+         F.write("0%u %s" % (i, line))
+         F.write(".%s %s" % (a['uid'], line))
+         i = i + 1
+

    # Oops, something unspeakable happened.
    except:
       Die(File, None, F)
    # Oops, something unspeakable happened.
    except:
       Die(File, None, F)


@@ -263,23 +268,19 @@ def GenShadow(File):
    Done(File, None, F)
 
 # Generate the sudo passwd file
    Done(File, None, F)
 
 # Generate the sudo passwd file

-def GenShadowSudo(File, untrusted):
+def GenShadowSudo(accounts, File, untrusted):

    F = None
    try:
       OldMask = os.umask(0077)
       F = open(File + ".tmp", "w", 0600)
       os.umask(OldMask)
    F = None
    try:
       OldMask = os.umask(0077)
       F = open(File + ".tmp", "w", 0600)
       os.umask(OldMask)

-     
-      # Fetch all the users
-      global PasswdAttrs
-     
-      for x in PasswdAttrs:
+
+      for a in accounts:

          Pass = '*'
          Pass = '*'

-         if x[1].has_key("uidNumber") == 0 or not IsInGroup(x):
-            continue
+         if not IsInGroup(a): continue

      
      

-         if x[1].has_key('sudoPassword'):
-            for entry in x[1]['sudoPassword']:
+         if 'sudoPassword' in a:
+            for entry in a['sudoPassword']:

                Match = re.compile('^('+UUID_FORMAT+') (confirmed:[0-9a-f]{40}|unconfirmed) ([a-z0-9.,*]+) ([^ ]+)$').match(entry)
                if Match == None:
                   continue
                Match = re.compile('^('+UUID_FORMAT+') (confirmed:[0-9a-f]{40}|unconfirmed) ([a-z0-9.,*]+) ([^ ]+)$').match(entry)
                if Match == None:
                   continue


@@ -288,7 +289,7 @@ def GenShadowSudo(File, untrusted):
                hosts = Match.group(3)
                cryptedpass = Match.group(4)
      
                hosts = Match.group(3)
                cryptedpass = Match.group(4)
      

-               if status != 'confirmed:'+make_passwd_hmac('password-is-confirmed', 'sudo', x[1]['uid'][0], uuid, hosts, cryptedpass):
+               if status != 'confirmed:'+make_passwd_hmac('password-is-confirmed', 'sudo', a['uid'], uuid, hosts, cryptedpass):

                   continue
                for_all = hosts == "*"
                for_this_host = CurrentHost in hosts.split(',')
                   continue
                for_all = hosts == "*"
                for_this_host = CurrentHost in hosts.split(',')


@@ -303,7 +304,7 @@ def GenShadowSudo(File, untrusted):
             if len(Pass) > 50:
                Pass = '*'
      
             if len(Pass) > 50:
                Pass = '*'
      

-         Line = "%s:%s" % (GetAttr(x, "uid"), Pass)
+         Line = "%s:%s" % (a['uid'], Pass)

          Line = Sanitize(Line) + "\n"
          F.write("%s" % (Line))
   
          Line = Sanitize(Line) + "\n"
          F.write("%s" % (Line))
   


@@ -314,31 +315,24 @@ def GenShadowSudo(File, untrusted):
    Done(File, F, None)
 
 # Generate the shadow list
    Done(File, F, None)
 
 # Generate the shadow list

-def GenSSHShadow():
+def GenSSHShadow(accounts):

    # Fetch all the users
    userfiles = []
 
    # Fetch all the users
    userfiles = []
 

-   global PasswdAttrs
-

    safe_rmtree(os.path.join(GlobalDir, 'userkeys'))
    safe_makedirs(os.path.join(GlobalDir, 'userkeys'))
 
    safe_rmtree(os.path.join(GlobalDir, 'userkeys'))
    safe_makedirs(os.path.join(GlobalDir, 'userkeys'))
 

-   for x in PasswdAttrs:
-
-      if x[1].has_key("uidNumber") == 0 or \
-         x[1].has_key("sshRSAAuthKey") == 0:
-         continue
+   for a in accounts:
+      if not 'sshRSAAuthKey' in a: continue

 
 

-      User = GetAttr(x, "uid")

       F = None
       F = None

-

       try:
          OldMask = os.umask(0077)
       try:
          OldMask = os.umask(0077)

-         File = os.path.join(GlobalDir, 'userkeys', User)
+         File = os.path.join(GlobalDir, 'userkeys', a['uid'])

          F = open(File + ".tmp", "w", 0600)
          os.umask(OldMask)
 
          F = open(File + ".tmp", "w", 0600)
          os.umask(OldMask)
 

-         for I in x[1]["sshRSAAuthKey"]:
+         for I in a['sshRSAAuthKey']:

             MultipleLine = "%s" % I
             MultipleLine = Sanitize(MultipleLine) + "\n"
             F.write(MultipleLine)
             MultipleLine = "%s" % I
             MultipleLine = Sanitize(MultipleLine) + "\n"
             F.write(MultipleLine)


@@ -442,7 +436,7 @@ def addGroups(existingGroups, newGroups, uid):
          addGroups(existingGroups, SubGroupMap[group], uid)
 
 # Generate the group list
          addGroups(existingGroups, SubGroupMap[group], uid)
 
 # Generate the group list

-def GenGroup(File):
+def GenGroup(accounts, File):

    grouprevmap = {}
    F = None
    try:
    grouprevmap = {}
    F = None
    try:


@@ -453,25 +447,18 @@ def GenGroup(File):
       for x in GroupIDMap.keys():
          GroupMap[x] = []
       GroupHasPrimaryMembers = {}
       for x in GroupIDMap.keys():
          GroupMap[x] = []
       GroupHasPrimaryMembers = {}

-     
-      # Fetch all the users
-      global PasswdAttrs
-     
+

       # Sort them into a list of groups having a set of users
       # Sort them into a list of groups having a set of users

-      for x in PasswdAttrs:
-         uid = GetAttr(x, "uid")
-         if 'gidNumber' in x[1]:
-            GroupHasPrimaryMembers[ int(x[1]["gidNumber"][0]) ] = True
-         if x[1].has_key("uidNumber") == 0 or not IsInGroup(x):
-            continue
-         if x[1].has_key("supplementaryGid") == 0:
-            continue
-     
+      for a in accounts:
+         GroupHasPrimaryMembers[ a['gidNumber'] ] = True
+         if not IsInGroup(a): continue
+         if not 'supplementaryGid' in a: continue
+

          supgroups=[]
          supgroups=[]

-         addGroups(supgroups, x[1]["supplementaryGid"], uid)
+         addGroups(supgroups, a['supplementaryGid'], a['uid'])

          for g in supgroups:
          for g in supgroups:

-            GroupMap[g].append(uid)
-     
+            GroupMap[g].append(a['uid'])
+

       # Output the group file.
       J = 0
       for x in GroupMap.keys():
       # Output the group file.
       J = 0
       for x in GroupMap.keys():


@@ -502,52 +489,43 @@ def GenGroup(File):
   
    return grouprevmap
 
   
    return grouprevmap
 

-def CheckForward():
-   global PasswdAttrs
-   for x in PasswdAttrs:
-      if x[1].has_key("emailForward") == 0:
-         continue
-   
-      if not IsInGroup(x):
-         x[1].pop("emailForward")
-         continue
+def CheckForward(accounts):
+   for a in accounts:
+      if not 'emailForward' in a: continue

 
 

-      # Do not allow people to try to buffer overflow busted parsers
-      if len(GetAttr(x, "emailForward")) > 200:
-         x[1].pop("emailForward")
-         continue

 
 

+      delete = False
+
+      if not IsInGroup(a): delete = True
+      # Do not allow people to try to buffer overflow busted parsers
+      elif len(a['emailForward']) > 200: delete = True

       # Check the forwarding address
       # Check the forwarding address

-      if EmailCheck.match(GetAttr(x, "emailForward")) == None:
-         x[1].pop("emailForward")
+      elif EmailCheck.match(a['emailForward']) is None: delete = True
+
+      if delete:
+         a.delete_mailforward()

 
 # Generate the email forwarding list
 
 # Generate the email forwarding list

-def GenForward(File):
+def GenForward(accounts, File):

    F = None
    try:
       OldMask = os.umask(0022)
       F = open(File + ".tmp", "w", 0644)
       os.umask(OldMask)
    F = None
    try:
       OldMask = os.umask(0022)
       F = open(File + ".tmp", "w", 0644)
       os.umask(OldMask)

-     
-      # Fetch all the users
-      global PasswdAttrs
-     
-      # Write out the email address for each user
-      for x in PasswdAttrs:
-         if x[1].has_key("emailForward") == 0:
-            continue
-     
-         Line = "%s: %s" % (GetAttr(x, "uid"), GetAttr(x, "emailForward"))
+
+      for a in accounts:
+         if not 'emailForward' in a: continue
+         Line = "%s: %s" % (a['uid'], a['emailForward'])

          Line = Sanitize(Line) + "\n"
          F.write(Line)
          Line = Sanitize(Line) + "\n"
          F.write(Line)

-  
+

    # Oops, something unspeakable happened.
    except:
       Die(File, F, None)
       raise
    Done(File, F, None)
 
    # Oops, something unspeakable happened.
    except:
       Die(File, F, None)
       raise
    Done(File, F, None)
 

-def GenCDB(File, Users, Key):
+def GenCDB(accounts, File, key):

    Fdb = None
    try:
       OldMask = os.umask(0022)
    Fdb = None
    try:
       OldMask = os.umask(0022)


@@ -555,12 +533,11 @@ def GenCDB(File, Users, Key):
       os.umask(OldMask)
 
       # Write out the email address for each user
       os.umask(OldMask)
 
       # Write out the email address for each user

-      for x in Users:
-         if not Key in x[1]:
-            continue
-         Value = GetAttr(x, Key)
-         User = GetAttr(x, "uid")
-         Fdb.write("+%d,%d:%s->%s\n" % (len(User), len(Value), User, Value))
+      for a in accounts:
+         if not key in a: continue
+         value = a[key]
+         user = a['uid']
+         Fdb.write("+%d,%d:%s->%s\n" % (len(user), len(value), user, value))

 
       Fdb.write("\n")
    # Oops, something unspeakable happened.
 
       Fdb.write("\n")
    # Oops, something unspeakable happened.


@@ -571,17 +548,13 @@ def GenCDB(File, Users, Key):
       raise "cdbmake gave an error"
 
 # Generate the anon XEarth marker file
       raise "cdbmake gave an error"
 
 # Generate the anon XEarth marker file

-def GenMarkers(File):
+def GenMarkers(accounts, File):

    F = None
    try:
       F = open(File + ".tmp", "w")
    F = None
    try:
       F = open(File + ".tmp", "w")

-     
-      # Fetch all the users
-      global PasswdAttrs
-     
+

       # Write out the position for each user
       # Write out the position for each user

-      for x in PasswdAttrs:
-         a = UDLdap.Account(x[0], x[1])
+      for a in accounts:

          if not ('latitude' in a and 'longitude' in a): continue
          try:
             Line = "%8s %8s \"\""%(a.latitude_dec(True), a.longitude_dec(True))
          if not ('latitude' in a and 'longitude' in a): continue
          try:
             Line = "%8s %8s \"\""%(a.latitude_dec(True), a.longitude_dec(True))


@@ -597,17 +570,13 @@ def GenMarkers(File):
    Done(File, F, None)
 
 # Generate the debian-private subscription list
    Done(File, F, None)
 
 # Generate the debian-private subscription list

-def GenPrivate(File):
+def GenPrivate(accounts, File):

    F = None
    try:
       F = open(File + ".tmp", "w")
    F = None
    try:
       F = open(File + ".tmp", "w")

-     
-      # Fetch all the users
-      global DebianDDUsers
-     
+

       # Write out the position for each user
       # Write out the position for each user

-      for x in DebianDDUsers:
-         a = UDLdap.Account(x[0], x[1])
+      for a in accounts:

          if not a.is_active_user(): continue
          if not 'privateSub' in a: continue
          try:
          if not a.is_active_user(): continue
          if not 'privateSub' in a: continue
          try:


@@ -624,21 +593,17 @@ def GenPrivate(File):
    Done(File, F, None)
 
 # Generate a list of locked accounts
    Done(File, F, None)
 
 # Generate a list of locked accounts

-def GenDisabledAccounts(File):
+def GenDisabledAccounts(accounts, File):

    F = None
    try:
       F = open(File + ".tmp", "w")
    F = None
    try:
       F = open(File + ".tmp", "w")

-     
+      disabled_accounts = []
+

       # Fetch all the users
       # Fetch all the users

-      global PasswdAttrs
-      global DisabledUsers
-     
-      I = 0
-      for x in PasswdAttrs:
-         a = UDLdap.Account(x[0], x[1])
+      for a in accounts:

          if a.pw_active(): continue
          Line = "%s:%s" % (a['uid'], "Account is locked")
          if a.pw_active(): continue
          Line = "%s:%s" % (a['uid'], "Account is locked")

-         DisabledUsers.append(x)
+         disabled_accounts.append(a)

          F.write(Sanitize(Line) + "\n")
 
    # Oops, something unspeakable happened.
          F.write(Sanitize(Line) + "\n")
 
    # Oops, something unspeakable happened.


@@ -646,23 +611,20 @@ def GenDisabledAccounts(File):
       Die(File, F, None)
       raise
    Done(File, F, None)
       Die(File, F, None)
       raise
    Done(File, F, None)

+   return disabled_accounts

 
 # Generate the list of local addresses that refuse all mail
 
 # Generate the list of local addresses that refuse all mail

-def GenMailDisable(File):
+def GenMailDisable(accounts, File):

    F = None
    try:
       F = open(File + ".tmp", "w")
    F = None
    try:
       F = open(File + ".tmp", "w")

-     
-      # Fetch all the users
-      global PasswdAttrs
-     
-      for x in PasswdAttrs:
-         a = UDLdap.Account(x[0], x[1])
+
+      for a in accounts:

          if not 'mailDisableMessage' in a: continue
          Line = "%s: %s"%(a['uid'], a['mailDisableMessage'])
          Line = Sanitize(Line) + "\n"
          F.write(Line)
          if not 'mailDisableMessage' in a: continue
          Line = "%s: %s"%(a['uid'], a['mailDisableMessage'])
          Line = Sanitize(Line) + "\n"
          F.write(Line)

-  
+

    # Oops, something unspeakable happened.
    except:
       Die(File, F, None)
    # Oops, something unspeakable happened.
    except:
       Die(File, F, None)


@@ -670,16 +632,12 @@ def GenMailDisable(File):
    Done(File, F, None)
 
 # Generate a list of uids that should have boolean affects applied
    Done(File, F, None)
 
 # Generate a list of uids that should have boolean affects applied

-def GenMailBool(File, key):
+def GenMailBool(accounts, File, key):

    F = None
    try:
       F = open(File + ".tmp", "w")
    F = None
    try:
       F = open(File + ".tmp", "w")

-     
-      # Fetch all the users
-      global PasswdAttrs
-     
-      for x in PasswdAttrs:
-         a = UDLdap.Account(x[0], x[1])
+
+      for a in accounts:

          if not key in a: continue
          if not a[key] == 'TRUE': continue
          Line = "%s"%(a['uid'])
          if not key in a: continue
          if not a[key] == 'TRUE': continue
          Line = "%s"%(a['uid'])


@@ -693,82 +651,50 @@ def GenMailBool(File, key):
    Done(File, F, None)
 
 # Generate a list of hosts for RBL or whitelist purposes.
    Done(File, F, None)
 
 # Generate a list of hosts for RBL or whitelist purposes.

-def GenMailList(File, Key):
+def GenMailList(accounts, File, key):

    F = None
    try:
       F = open(File + ".tmp", "w")
    F = None
    try:
       F = open(File + ".tmp", "w")

-     
-      # Fetch all the users
-      global PasswdAttrs
-     
-      for x in PasswdAttrs:
-         Reason = None
-     
-         if x[1].has_key(Key) == 0:
-            continue
-     
-         try:
-            found = 0
-            Line = None
-            for z in x[1][Key]:
-                if Key == "mailWhitelist":
-                   if re.match('^[-\w.]+(/[\d]+)?$', z) == None:
-                      continue
-                else:
-                   if re.match('^[-\w.]+$', z) == None:
-                      continue
-                if found == 0:
-                   found = 1
-                   Line = GetAttr(x, "uid")
-                else:
-                    Line += " "
-                Line += ": " + z
-                if Key == "mailRHSBL":
-                   Line += "/$sender_address_domain"
-     
-            if Line != None:
-               Line = Sanitize(Line) + "\n"
-               F.write(Line)
-         except:
-            pass
-  
+
+      if key == "mailWhitelist": validregex = re.compile('^[-\w.]+(/[\d]+)?$')
+      else:                      validregex = re.compile('^[-\w.]+$')
+
+      for a in accounts:
+         if not key in a: continue
+
+         filtered = filter(lambda z: validregex.match(z), a[key])
+         if len(filtered) == 0: continue
+         if key == "mailRHSBL": filtered = map(lambda z: z+"/$sender_address_domain", filtered)
+         line = a['uid'] + ': ' + ' : '.join(filtered)
+         line = Sanitize(line) + "\n"
+         F.write(line)
+

    # Oops, something unspeakable happened.
    except:
       Die(File, F, None)
       raise
    Done(File, F, None)
 
    # Oops, something unspeakable happened.
    except:
       Die(File, F, None)
       raise
    Done(File, F, None)
 

-def isRoleAccount(pwEntry):
-   if not pwEntry.has_key("objectClass"):
-      raise "pwEntry has no objectClass"
-   oc =  pwEntry['objectClass']
-   try:
-      i = oc.index('debianRoleAccount')
-      return True
-   except ValueError:
-      return False
+def isRoleAccount(account):
+   return 'debianRoleAccount' in account['objectClass']

 
 # Generate the DNS Zone file
 
 # Generate the DNS Zone file

-def GenDNS(File):
+def GenDNS(accounts, File):

    F = None
    try:
       F = open(File + ".tmp", "w")
    F = None
    try:
       F = open(File + ".tmp", "w")

-     
+

       # Fetch all the users
       # Fetch all the users

-      global PasswdAttrs

       RRs = {}
       RRs = {}

-     
+

       # Write out the zone file entry for each user
       # Write out the zone file entry for each user

-      for x in PasswdAttrs:
-         if x[1].has_key("dnsZoneEntry") == 0:
-            continue
-     
-         # If the account has no PGP key, do not write it
-         if x[1].has_key("keyFingerPrint") == 0 and not isRoleAccount(x[1]):
-            continue
+      for a in accounts:
+         if not 'dnsZoneEntry' in a: continue
+         if not a.is_active_user() and not isRoleAccount(a): continue
+

          try:
          try:

-            F.write("; %s\n"%(EmailAddress(x)))
-            for z in x[1]["dnsZoneEntry"]:
+            F.write("; %s\n"%(a.email_address()))
+            for z in a["dnsZoneEntry"]:

                Split = z.lower().split()
                if Split[1].lower() == 'in':
                   for y in range(0, len(Split)):
                Split = z.lower().split()
                if Split[1].lower() == 'in':
                   for y in range(0, len(Split)):


@@ -784,8 +710,8 @@ def GenDNS(File):
                   # Write some identification information
                   if not RRs.has_key(Host):
                      if Split[2].lower() in ["a", "aaaa"]:
                   # Write some identification information
                   if not RRs.has_key(Host):
                      if Split[2].lower() in ["a", "aaaa"]:

-                        Line = "%s IN TXT \"%s\"\n"%(Split[0], EmailAddress(x))
-                        for y in x[1]["keyFingerPrint"]:
+                        Line = "%s IN TXT \"%s\"\n"%(Split[0], a.email_address())
+                        for y in a["keyFingerPrint"]:

                            Line = Line + "%s IN TXT \"PGP %s\"\n"%(Split[0], FormatPGPKey(y))
                            F.write(Line)
                         RRs[Host] = 1
                            Line = Line + "%s IN TXT \"PGP %s\"\n"%(Split[0], FormatPGPKey(y))
                            F.write(Line)
                         RRs[Host] = 1


@@ -794,8 +720,10 @@ def GenDNS(File):
                   F.write(Line)
      
             F.write("\n")
                   F.write(Line)
      
             F.write("\n")

-         except:
-            F.write("; Errors\n")
+         except Exception, e:
+            F.write("; Errors:\n")
+            for line in str(e).split("\n"):
+               F.write("; %s\n"%(line))

             pass
   
    # Oops, something unspeakable happened.
             pass
   
    # Oops, something unspeakable happened.


@@ -902,24 +830,18 @@ def GenZoneRecords(File):
    Done(File, F, None)
 
 # Generate the BSMTP file
    Done(File, F, None)
 
 # Generate the BSMTP file

-def GenBSMTP(File, HomePrefix):
+def GenBSMTP(accounts, File, HomePrefix):

    F = None
    try:
       F = open(File + ".tmp", "w")
      
    F = None
    try:
       F = open(File + ".tmp", "w")
      

-      # Fetch all the users
-      global PasswdAttrs
-     

       # Write out the zone file entry for each user
       # Write out the zone file entry for each user

-      for x in PasswdAttrs:
-         if x[1].has_key("dnsZoneEntry") == 0:
-            continue
-     
-         # If the account has no PGP key, do not write it
-         if x[1].has_key("keyFingerPrint") == 0:
-            continue
+      for a in accounts:
+         if not 'dnsZoneEntry' in a: continue
+         if not a.is_active_user(): continue
+

          try:
          try:

-            for z in x[1]["dnsZoneEntry"]:
+            for z in a["dnsZoneEntry"]:

                Split = z.lower().split()
                if Split[1].lower() == 'in':
                   for y in range(0, len(Split)):
                Split = z.lower().split()
                if Split[1].lower() == 'in':
                   for y in range(0, len(Split)):


@@ -930,7 +852,7 @@ def GenBSMTP(File, HomePrefix):
                   Host = Split[0] + DNSZone
                   if BSMTPCheck.match(Line) != None:
                       F.write("%s: user=%s group=Debian file=%s%s/bsmtp/%s\n"%(Host,
                   Host = Split[0] + DNSZone
                   if BSMTPCheck.match(Line) != None:
                       F.write("%s: user=%s group=Debian file=%s%s/bsmtp/%s\n"%(Host,

-                                  GetAttr(x, "uid"), HomePrefix, GetAttr(x, "uid"), Host))
+                                  a['uid'], HomePrefix, a['uid'], Host))

      
          except:
             F.write("; Errors\n")
      
          except:
             F.write("; Errors\n")


@@ -1073,7 +995,7 @@ for x in Attrs:
       SubGroupMap.setdefault(x[1]["gid"][0], []).extend(x[1]["subGroup"])
 
 # Fetch all the users
       SubGroupMap.setdefault(x[1]["gid"][0], []).extend(x[1]["subGroup"])
 
 # Fetch all the users

-PasswdAttrs = l.search_s(BaseDn, ldap.SCOPE_ONELEVEL, "(&(uid=*)(!(uidNumber=0)))",\
+passwd_attrs = l.search_s(BaseDn, ldap.SCOPE_ONELEVEL, "(&(uid=*)(!(uidNumber=0)))",\

                 ["uid", "uidNumber", "gidNumber", "supplementaryGid",\
                  "gecos", "loginShell", "userPassword", "shadowLastChange",\
                  "shadowMin", "shadowMax", "shadowWarning", "shadowInactive",
                 ["uid", "uidNumber", "gidNumber", "supplementaryGid",\
                  "gecos", "loginShell", "userPassword", "shadowLastChange",\
                  "shadowMin", "shadowMax", "shadowWarning", "shadowInactive",


@@ -1084,10 +1006,10 @@ PasswdAttrs = l.search_s(BaseDn, ldap.SCOPE_ONELEVEL, "(&(uid=*)(!(uidNumber=0))
                  "mailWhitelist", "sudoPassword", "objectClass", "accountStatus",\
                  "mailContentInspectionAction"])
 
                  "mailWhitelist", "sudoPassword", "objectClass", "accountStatus",\
                  "mailContentInspectionAction"])
 

-if PasswdAttrs is None:
+if passwd_attrs is None:

    raise UDEmptyList, "No Users"
    raise UDEmptyList, "No Users"

-
-PasswdAttrs.sort(lambda x, y: cmp((GetAttr(x, "uid")).lower(), (GetAttr(y, "uid")).lower()))
+accounts = map(lambda x: UDLdap.Account(x[0], x[1]), passwd_attrs)
+accounts.sort(lambda x,y: cmp(x['uid'].lower(), y['uid'].lower()))

 
 # Fetch all the hosts
 HostAttrs    = l.search_s(HostBaseDn, ldap.SCOPE_ONELEVEL, "objectClass=debianServer",\
 
 # Fetch all the hosts
 HostAttrs    = l.search_s(HostBaseDn, ldap.SCOPE_ONELEVEL, "objectClass=debianServer",\


@@ -1105,32 +1027,33 @@ if 'UD_GENERATEDIR' in os.environ:
 
 # Generate global things
 GlobalDir = GenerateDir + "/"
 
 # Generate global things
 GlobalDir = GenerateDir + "/"

-GenDisabledAccounts(GlobalDir + "disabled-accounts")
+accounts_disabled = GenDisabledAccounts(accounts, GlobalDir + "disabled-accounts")

 
 

-PasswdAttrs = filter(lambda x: not IsRetired(x), PasswdAttrs)
-DebianDDUsers = filter(lambda x: IsGidDebian(x), PasswdAttrs)
+accounts = filter(lambda x: not IsRetired(x), accounts)
+#accounts_DDs = filter(lambda x: IsGidDebian(x), accounts)

 
 

-CheckForward()
+CheckForward(accounts)

 
 

-GenMailDisable(GlobalDir + "mail-disable")
-GenCDB(GlobalDir + "mail-forward.cdb", PasswdAttrs, 'emailForward')
-GenCDB(GlobalDir + "mail-contentinspectionaction.cdb", PasswdAttrs, 'mailContentInspectionAction')
-GenPrivate(GlobalDir + "debian-private")
+GenMailDisable(accounts, GlobalDir + "mail-disable")
+GenCDB(accounts, GlobalDir + "mail-forward.cdb", 'emailForward')
+GenCDB(accounts, GlobalDir + "mail-contentinspectionaction.cdb", 'mailContentInspectionAction')
+GenPrivate(accounts, GlobalDir + "debian-private")

 GenSSHKnown(GlobalDir+"authorized_keys", 'authorized_keys')
 GenSSHKnown(GlobalDir+"authorized_keys", 'authorized_keys')

-GenMailBool(GlobalDir + "mail-greylist", "mailGreylisting")
-GenMailBool(GlobalDir + "mail-callout", "mailCallout")
-GenMailList(GlobalDir + "mail-rbl", "mailRBL")
-GenMailList(GlobalDir + "mail-rhsbl", "mailRHSBL")
-GenMailList(GlobalDir + "mail-whitelist", "mailWhitelist")
+GenMailBool(accounts, GlobalDir + "mail-greylist", "mailGreylisting")
+GenMailBool(accounts, GlobalDir + "mail-callout", "mailCallout")
+GenMailList(accounts, GlobalDir + "mail-rbl", "mailRBL")
+GenMailList(accounts, GlobalDir + "mail-rhsbl", "mailRHSBL")
+GenMailList(accounts, GlobalDir + "mail-whitelist", "mailWhitelist")

 GenKeyrings(GlobalDir)
 
 # Compatibility.
 GenKeyrings(GlobalDir)
 
 # Compatibility.

-GenForward(GlobalDir + "forward-alias")
+GenForward(accounts, GlobalDir + "forward-alias")

 
 

-PasswdAttrs = filter(lambda x: not x in DisabledUsers, PasswdAttrs)
+GenAllUsers(accounts, 'all-accounts.json')
+accounts = filter(lambda a: not a in accounts_disabled, accounts)

 
 

-SSHFiles = GenSSHShadow()
-GenMarkers(GlobalDir + "markers")
+SSHFiles = GenSSHShadow(accounts)
+GenMarkers(accounts, GlobalDir + "markers")

 GenSSHKnown(GlobalDir + "ssh_known_hosts")
 GenHosts(GlobalDir + "debianhosts")
 
 GenSSHKnown(GlobalDir + "ssh_known_hosts")
 GenHosts(GlobalDir + "debianhosts")
 


@@ -1171,19 +1094,19 @@ for host in HostAttrs:
 
    sys.stdout.flush()
    if 'NOPASSWD' in ExtraList:
 
    sys.stdout.flush()
    if 'NOPASSWD' in ExtraList:

-      userlist = GenPasswd(OutDir + "passwd", HomePrefix, "*")
+      userlist = GenPasswd(accounts, OutDir + "passwd", HomePrefix, "*")

    else:
    else:

-      userlist = GenPasswd(OutDir + "passwd", HomePrefix, "x")
+      userlist = GenPasswd(accounts, OutDir + "passwd", HomePrefix, "x")

    sys.stdout.flush()
    sys.stdout.flush()

-   grouprevmap = GenGroup(OutDir + "group")
-   GenShadowSudo(OutDir + "sudo-passwd", ('UNTRUSTED' in ExtraList) or ('NOPASSWD' in ExtraList))
+   grouprevmap = GenGroup(accounts, OutDir + "group")
+   GenShadowSudo(accounts, OutDir + "sudo-passwd", ('UNTRUSTED' in ExtraList) or ('NOPASSWD' in ExtraList))

 
    # Now we know who we're allowing on the machine, export
    # the relevant ssh keys
    GenSSHtarballs(userlist, SSHFiles, grouprevmap, os.path.join(OutDir, 'ssh-keys.tar.gz'))
 
    if not 'NOPASSWD' in ExtraList:
 
    # Now we know who we're allowing on the machine, export
    # the relevant ssh keys
    GenSSHtarballs(userlist, SSHFiles, grouprevmap, os.path.join(OutDir, 'ssh-keys.tar.gz'))
 
    if not 'NOPASSWD' in ExtraList:

-      GenShadow(OutDir + "shadow")
+      GenShadow(accounts, OutDir + "shadow")

 
    # Link in global things
    if not 'NOMARKERS' in ExtraList:
 
    # Link in global things
    if not 'NOMARKERS' in ExtraList:


@@ -1196,22 +1119,23 @@ for host in HostAttrs:
    DoLink(GlobalDir, OutDir, "mail-rbl")
    DoLink(GlobalDir, OutDir, "mail-rhsbl")
    DoLink(GlobalDir, OutDir, "mail-whitelist")
    DoLink(GlobalDir, OutDir, "mail-rbl")
    DoLink(GlobalDir, OutDir, "mail-rhsbl")
    DoLink(GlobalDir, OutDir, "mail-whitelist")

-   GenCDB(OutDir + "user-forward.cdb", filter(lambda x: IsInGroup(x), PasswdAttrs), 'emailForward')
-   GenCDB(OutDir + "batv-tokens.cdb", filter(lambda x: IsInGroup(x), PasswdAttrs), 'bATVToken')
-   GenCDB(OutDir + "default-mail-options.cdb", filter(lambda x: IsInGroup(x), PasswdAttrs), 'mailDefaultOptions')
+   DoLink(GlobalDir, OutDir, "all-accounts.json")
+   GenCDB(filter(lambda x: IsInGroup(x), accounts), OutDir + "user-forward.cdb", 'emailForward')
+   GenCDB(filter(lambda x: IsInGroup(x), accounts), OutDir + "batv-tokens.cdb", 'bATVToken')
+   GenCDB(filter(lambda x: IsInGroup(x), accounts), OutDir + "default-mail-options.cdb", 'mailDefaultOptions')

 
    # Compatibility.
    DoLink(GlobalDir, OutDir, "forward-alias")
 
    if 'DNS' in ExtraList:
 
    # Compatibility.
    DoLink(GlobalDir, OutDir, "forward-alias")
 
    if 'DNS' in ExtraList:

-      GenDNS(OutDir + "dns-zone")
+      GenDNS(accounts, OutDir + "dns-zone")

       GenZoneRecords(OutDir + "dns-sshfp")
 
    if 'AUTHKEYS' in ExtraList:
       DoLink(GlobalDir, OutDir, "authorized_keys")
 
    if 'BSMTP' in ExtraList:
       GenZoneRecords(OutDir + "dns-sshfp")
 
    if 'AUTHKEYS' in ExtraList:
       DoLink(GlobalDir, OutDir, "authorized_keys")
 
    if 'BSMTP' in ExtraList:

-      GenBSMTP(OutDir + "bsmtp", HomePrefix)
+      GenBSMTP(accounts, OutDir + "bsmtp", HomePrefix)

 
    if 'PRIVATE' in ExtraList:
       DoLink(GlobalDir, OutDir, "debian-private")
 
    if 'PRIVATE' in ExtraList:
       DoLink(GlobalDir, OutDir, "debian-private")