update-dept-acls

#!/bin/bash

AccessACL=Open

# We need adname, and this is the most direct way to get it.
PATH=$PATH:/shared/ucl/apps/rcps-cluster-scripts

set -o errexit \
    -o nounset \
    -o pipefail

function check_commands_avail() {
    for c in "$@"; do
        command -v "$c" >/dev/null || (printf "%s: error: needs command '%s' which is not available\n" "$0" "$c" >&2; exit 1)
    done
}

check_commands_avail \
    qconf \
    sort \
    cut \
    tr \
    adname \
    getent \
    comm \
    grep \
    xargs 

function tslog() {
    printf "[%s] %s\n" "$(date -Iseconds)" "$*" >&2
}

function ol_qconf() {
    SGE_SINGLE_LINE=1 qconf "$@"
}

function fail_if_insufficient_perms() {
    # This isn't a hard check because qconf does that. If you override LOGNAME, it's your mess.
    if ! qconf -so -sm \
            | grep "$LOGNAME" >/dev/null;
    then
        echo "Error: insufficient privileges to run the commands in this script." >&2
        exit 1
    fi
}

function get_users_from_acl() {
    if [[ "$#" -ne 1 ]]; then
        tslog "error: wrong number of args to get_users_from_acl"
        return 1
    fi

    if ! ol_qconf -sul | grep "$1" >/dev/null; then
        echo "Error: ACL $1 does not exist or cannot be found." >&2
        return 1
    fi

    ol_qconf -su "$1" \
        | grep entries \
        | cut -f 2 -d ' ' \
        | tr ',' '\n' \
        | sort
}

function get_users_from_department() {
    if [[ "$#" -ne 1 ]]; then
        tslog "error: wrong number of args to get_users_from_department"
        return 1
    fi

    adname -o name -f department "$1" \
        | cut -f 2 -d ' ' \
        | sort
}

function get_users_from_adgroup() {
    if [[ "$#" -ne 1 ]]; then
        tslog "error: wrong number of args to get_users_from_adgroup"
        return 1
    fi

    local group_dn
    group_dn="$(get_dn_for_adgroup "$1")"

    adname -o name -f memberOf "$group_dn" \
       | cut -f 2 -d ' ' \
       | sort
}

function get_dn_for_adgroup() {
    if [[ "$#" -ne 1 ]]; then
        tslog "error: wrong number of args to get_dn_for_adgroup"
        return 1
    fi

    adname -o dn "$1" \
       | cut -f 2 -d ' '
}

function get_users_from_local_group() {
    if [[ "$#" -ne 1 ]]; then
        tslog "error: wrong number of args to get_users_from_local_group"
        return 1
    fi

    getent group "$1" \
        | cut -f 4 -d : \
        | tr ',' '\n'
}

function header_tee() {
    if [[ "$#" -ne 1 ]]; then
        tslog "error: wrong number of args to header_tee"
        return 1
    fi

    printf "# This file was autogenerated:\n# user: %s\n# host: %s\n# date: %s\n# cmdl: %s\n# Modifications will be overwritten.\n#\n" \
        "$LOGNAME" \
        "$(hostname -f)" \
        "$(date -Iseconds)" \
        "$0" >"$1"

    tee -a "$1"
}

function pipe_users_to_acl() {
    if [[ "$#" -ne 1 ]]; then
        tslog "error: wrong number of args to pipe_users_to_acl"
        return 1
    fi

    list="$(tr '\n' ',')"
    list="${list%,}"
    if [[ "$list" != "" ]]; then
        qconf -au "$list" "$1"
    else
        tslog "no new users to add to ACL: $1"
    fi
}

function wipe_acl() {
    if [[ "$#" -ne 1 ]]; then
        tslog "error: wrong number of args to wipe_acl"
        return 1
    fi

    csv_list="$(get_users_from_acl "$1" | tr '\n' ',')"
    csv_list="${csv_list%,}"
    qconf -du "$csv_list" "$1"
}

function expand_spec() {
    if [[ "$#" -ne 1 ]]; then
        tslog "error: wrong number of args to expand_spec"
        return 1
    fi

    if [[ -z "${1:-}" ]]; then
        return 0
    fi

    for label in ${1//,/ }; do
        if [[ "${label:0:1}" == "%" ]]; then
            printf "# Spec: '%s' (local group)\n" "$label"
            get_users_from_local_group "${label:1}" \
                | intersect_with_acl "$AccessACL"
        elif [[ "${label:0:1}" == "@" ]]; then
            printf "# Spec: '%s' (AD group)\n" "$label"
            get_users_from_adgroup "${label:1}" \
                | intersect_with_acl "$AccessACL"
        elif [[ "${label:0:1}" == "^" ]]; then \
            printf "# Spec: '%s' (SGE ACL)\n" "$label"
            get_users_from_acl "${label:1}" \
                | intersect_with_acl "$AccessACL"
        elif [[ "${label:0:1}" == "=" ]]; then \
            real_dept="$(base64 -d <<<"${label:1}")"
            printf "# Spec: '%s' (AD department: $real_dept)\n" "$label"
            get_users_from_department "$real_dept" \
                | intersect_with_acl "$AccessACL"
        else
            printf "# Spec: '%s' (literal user)\n" "$label"
            echo "$label"
        fi
    done
}

function intersect_with_acl() {
    if [[ "$#" -ne 1 ]]; then
        tslog "error: wrong number of args to intersect_with_acl"
        return 1
    fi

    sort -u \
        | comm -1 -2 - <(get_users_from_acl "$1")
}

function subtract_acl() {
    if [[ "$#" -ne 1 ]]; then
        tslog "error: wrong number of args to subtract_acl"
        return 1
    fi

    sort -u \
        | comm -2 -3 - <(get_users_from_acl "$1")
}


function main() {
    fail_if_insufficient_perms

    tslog "starting..."
    for input_file in "$@"; do
        tslog "reading $input_file..."
        mapfile -t input_lines <"$input_file"

        local -i blank_lines=0
        local -i not_blank_lines=0

        for input_line in "${input_lines[@]}"; do
            # Skip blank or comment lines
            if [[ -z "${input_line// /}" ]] || \
               [[ "${input_line:0:1}" == "#" ]];
            then
                blank_lines+=1
                continue
            fi

            not_blank_lines+=1
            tslog "parsing line: $input_line"

            # Pop off the four chunks of the line:
            # file label, dept name, ACL name, extras
            local dept_label="${input_line%%:*}"
            local input_line="${input_line#*:}"

            local dept_acl_name="${input_line%%:*}"
            local input_line="${input_line#*:}"

            local dept_spec="${input_line}"
           

            # Expand out the spec into the actual users (and spec comments)
            local expanded_spec
            local es_num_users
            local es_distinct
            expanded_spec="$(expand_spec "$dept_spec")"
            es_num_users="$(echo "$expanded_spec" | grep -v -c '^#')"
            es_distinct="$(echo "$expanded_spec" | sort -u | grep -v -c '^#')"

            tslog "expanded spec to $es_num_users users ($es_distinct distinct)"

            if [[ "$skip_text_list_gen" == "false" ]]; then
                if [[ "$dept_label" == "" ]]; then
                    tslog "no listfile label, skipping listfile generation"
                else
                    tslog "writing to text file: ${dept_label}_users.txt"
                    echo "$expanded_spec" \
                        | header_tee "${path_for_text_files}/${dept_label}_users.txt" >/dev/null
                fi
            else
                tslog "skipping text user list generation"
            fi

            if [[ "$skip_adding_users_to_sge" == "false" ]]; then
                if [[ "$dept_acl_name" == "" ]]; then
                    tslog "no ACL name, skipping ACL step"
                else
                    if [[ "$wipe_acls_first" == "true" ]]; then
                        tslog "removing all users from ACL: $dept_acl_name"
                        wipe_acl "$dept_acl_name"
                    fi
                    tslog "adding to ACL: ${dept_acl_name}"
                    echo "$expanded_spec" \
                        | grep -v '^#' \
                        | sort -u \
                        | subtract_acl "${dept_acl_name}" \
                        | pipe_users_to_acl "${dept_acl_name}"
                fi
            else
                tslog "skipping SGE ACL changes"
            fi
        done
        tslog "finished file, $not_blank_lines lines parsed, $blank_lines empty lines skipped."
    done
    tslog "finished."
}

help_message="
usage: update-dept-acls [<flags>] <file>

A script to update ACLs and generate userlists for systems.

Flags:
  -h, --help                   Show this help.
  -x                           Print documented example input file.
  -o, --outdir=\"DIR\"           Directory to put userlist files into. [./]
  -s, --skip-text              Skip generating text userlists.
  -n, --no-sge                 Skip adding users to SGE ACLs with qconf.
                               (Both skip options can be used together.)
  -w, --wipe-acls              Delete all users in the SGE ACLs before adding.
      --only-def-funcs         Skip all execution, only define internal functions.
                               (Used for testing.)
"

documented_example_input_file='# Format goes:
# Text File Label:
#                 SGE ACL:
#                         Comma separated specs.
#
# Specs can be specified using either literal users or via special initial characters:
#   % -- local (getent) groups by leading with %
#   @ -- AD groups
#   ^ -- existing SGE ACLs
#   = -- base64-encoded AD department names (avoid if possible, departments are finicky and unreliable)
#
# And you can put comments with leading # as first character of line.
# All specs are intersected with the full list of users.
# Text file label and SGE ACL field can both be empty.

economics:Economics:@economics-all,%ccsprci,%ccsprcop,ccspapp,=RGVwdCBvZiBFY29ub21pY3MK
biosciences:Bioscientists:@biosci-all

'


function show_help_and_exit() {
    printf "%s" "$help_message"
    exit "${1:-0}"
}

function show_example_and_exit() {
    printf "%s" "$documented_example_input_file"
    exit 0
}

canonical_args="$(
/usr/bin/getopt \
    -n update-dept-acls \
    -l "help,outdir:,skip-text,no-sge,wipe-acls,only-def-funcs" \
    -o "ho:snxw" \
    -- \
    "$@"
)"

eval set -- "$canonical_args"

# Defaults
skip_adding_users_to_sge="false"
skip_text_list_gen="false"
path_for_text_files="./"
wipe_acls_first="false"
only_def_funcs="false"

while true ; do
    case "$1" in
        -h|--help) show_help_and_exit 0; shift ;;
        -o|--outdir) path_for_text_files="$2"; shift 2 ;;
        -n|--no-sge) skip_adding_users_to_sge="true"; shift ;;
        -s|--skip-text) skip_text_list_gen="true"; shift ;;
        -w|--wipe-acls) wipe_acls_first="true"; shift ;;
        --only-def-funcs) only_def_funcs="true"; shift ;;
        -x) show_example_and_exit; shift ;;
        --) shift ; break ;;
        *) tslog "error: invalid argument '$1'"; exit 1 ;;
    esac
done

if [[ "$#" -eq 0 ]] && \
   [[ "$only_def_funcs" == "false" ]]; then
    show_help_and_exit 1
fi

if [[ "$only_def_funcs" == "false" ]]; then
    main "$@"
fi