Stop exporting information about retired developers

[mirror/userdir-ldap.git] / ud-generate

diff --git a/ud-generate b/ud-generate
index dfb3b3c..bbddc2f 100755 (executable)
--- a/ud-generate
+++ b/ud-generate
@@ -33,6 +33,7 @@ global Allowed;
 global CurrentHost;
 
 PasswdAttrs = None;
+disabledusers = []
 GroupIDMap = {};
 SubGroupMap = {};
 Allowed = None;
@@ -72,6 +73,31 @@ def DoLink(From,To,File):
    except: pass;
    posix.link(From+File,To+File);
 
+def IsRetired(DnRecord):
+   """
+   Looks for accountStatus in the LDAP record and tries to
+   match it against one of the known retired statuses
+   """
+
+   status = GetAttr(DnRecord,"accountStatus", None)
+   if status is None:
+      return False
+
+   if status.find("inactive") != -1:
+      return True
+
+   if status.find("memorial") != -1:
+      return True
+
+   if status.find("retiring") != -1:
+      line = status.split()
+      # We'll give them a few extra days over what we said
+      age = 6 * 31 * 24 * 60 * 60
+      if (time.time() - time.mktime(time.strptime(line[1], "%Y-%m-%d")) > (age):
+            return True
+
+   return False
+
 # See if this user is in the group list
 def IsInGroup(DnRecord):
   if Allowed == None:
@@ -130,6 +156,9 @@ def GenPasswd(l,File,HomePrefix,PwdMarker):
 
    I = 0;
    for x in PasswdAttrs:
+      if IsRetired(x):
+         continue
+
       if x[1].has_key("uidNumber") == 0 or IsInGroup(x) == 0:
          continue;
 
@@ -174,6 +203,9 @@ def GenShadow(l,File):
 
    I = 0;
    for x in PasswdAttrs:
+      if IsRetired(x):
+         continue
+
       if x[1].has_key("uidNumber") == 0 or IsInGroup(x) == 0:
          continue;
 
@@ -221,6 +253,9 @@ def GenShadowSudo(l,File, untrusted):
       raise "No Users";
 
    for x in PasswdAttrs:
+      if IsRetired(x):
+         continue
+
       Pass = '*'
       if x[1].has_key("uidNumber") == 0 or IsInGroup(x) == 0:
          continue;
@@ -274,6 +309,9 @@ def GenSSHShadow(l):
    safe_makedirs(os.path.join(GlobalDir, 'userkeys'))
 
    for x in PasswdAttrs:
+      if IsRetired(x):
+         continue
+
       # If the account is locked, do not write it.
       # This is a partial stop-gap. The ssh also needs to change this
       # to ignore ~/.ssh/authorized* files.
@@ -451,6 +489,9 @@ def GenForward(l,File):
 
    # Write out the email address for each user
    for x in PasswdAttrs:
+      if IsRetired(x):
+         continue
+
       if x[1].has_key("emailForward") == 0 or IsInGroup(x) == 0:
          continue;
 
@@ -485,6 +526,9 @@ def GenAllForward(l,File):
 
    # Write out the email address for each user
    for x in PasswdAttrs:
+      if IsRetired(x):
+         continue
+
       if x[1].has_key("emailForward") == 0:
          continue;
 
@@ -520,6 +564,9 @@ def GenMarkers(l,File):
 
    # Write out the position for each user
    for x in PasswdAttrs:
+      if IsRetired(x):
+         continue
+
       if x[1].has_key("latitude") == 0 or x[1].has_key("longitude") == 0:
          continue;
       try:
@@ -548,6 +595,9 @@ def GenPrivate(l,File):
 
    # Write out the position for each user
    for x in PasswdAttrs:
+      if IsRetired(x):
+         continue
+
       if x[1].has_key("privateSub") == 0:
          continue;
 
@@ -585,6 +635,7 @@ def GenDisabledAccounts(l,File):
 
    # Fetch all the users
    global PasswdAttrs;
+   global disabledusers
    if PasswdAttrs == None:
       raise "No Users";
 
@@ -604,6 +655,8 @@ def GenDisabledAccounts(l,File):
       if Line != "":
          F.write(Sanitize(Line) + "\n")
 
+      disabledusers.append(x)
+
   # Oops, something unspeakable happened.
   except:
    Die(File,F,None);
@@ -622,6 +675,9 @@ def GenMailDisable(l,File):
       raise "No Users";
 
    for x in PasswdAttrs:
+      if IsRetired(x):
+         continue
+
       Reason = None
 
       if x[1].has_key("mailDisableMessage"):
@@ -658,6 +714,9 @@ def GenMailBool(l,File,Key):
       raise "No Users";
 
    for x in PasswdAttrs:
+      if IsRetired(x):
+         continue
+
       Reason = None
 
       if x[1].has_key(Key) == 0:
@@ -695,6 +754,9 @@ def GenMailList(l,File,Key):
       raise "No Users";
 
    for x in PasswdAttrs:
+      if IsRetired(x):
+         continue
+
       Reason = None
 
       if x[1].has_key(Key) == 0:
@@ -735,6 +797,16 @@ def GenMailList(l,File,Key):
    raise;
   Done(File,F,None);
 
+def isRoleAccount(pwEntry):
+   if not pwEntry.has_key("objectClass"):
+      raise "pwEntry has no objectClass"
+   oc =  pwEntry['objectClass']
+   try:
+      i = oc.index('debianRoleAccount')
+      return True
+   except ValueError:
+      return False
+
 # Generate the DNS Zone file
 def GenDNS(l,File,HomePrefix):
   F = None;
@@ -752,7 +824,7 @@ def GenDNS(l,File,HomePrefix):
          continue;
 
       # If the account has no PGP key, do not write it
-      if x[1].has_key("keyFingerPrint") == 0:
+      if x[1].has_key("keyFingerPrint") == 0 and not isRoleAccount(x[1]):
          continue;
       try:
          F.write("; %s\n"%(EmailAddress(x)));
@@ -879,9 +951,10 @@ def HostToIP(Host):
         except socket.gaierror, (code):
             if code[0] != -2: raise
         IPAdresses = []
-        for addr in IPAdressesT:
-            if addr[0] == socket.AF_INET: IPAdresses += [addr[1], "::ffff:"+addr[1]]
-            else: IPAdresses += [addr[1]]
+        if not IPAdressesT is None:
+            for addr in IPAdressesT:
+               if addr[0] == socket.AF_INET: IPAdresses += [addr[1], "::ffff:"+addr[1]]
+               else: IPAdresses += [addr[1]]
         HostToIPCache[Host] = IPAdresses
     return HostToIPCache[Host]
 
@@ -1015,7 +1088,7 @@ PasswdAttrs = l.search_s(BaseDn,ldap.SCOPE_ONELEVEL,"uid=*",\
                  "allowedHost","sshRSAAuthKey","dnsZoneEntry","cn","sn",\
                  "keyFingerPrint","privateSub","mailDisableMessage",\
                  "mailGreylisting","mailCallout","mailRBL","mailRHSBL",\
-                 "mailWhitelist", "sudoPassword"]);
+                 "mailWhitelist", "sudoPassword", "objectClass", "accountStatus"]);
 # Fetch all the hosts
 HostAttrs    = l.search_s(HostBaseDn,ldap.SCOPE_ONELEVEL,"sshRSAHostKey=*",\
                 ["hostname","sshRSAHostKey","purpose"]);
@@ -1047,6 +1120,8 @@ GenKeyrings(l,GlobalDir);
 # Compatibility.
 GenForward(l,GlobalDir+"forward-alias");
 
+PasswdAttrs = filter(lambda x: not x in disabledusers, PasswdAttrs)
+
 while(1):
    Line = F.readline();
    if Line == "":