The « base » plugin is the main plugin of the MMC Python API. It features base operations like LDAP management (users, groups, etc), user authentication and provisioning.

The plugin configuration file is /etc/mmc/plugins/base.ini.

Like all MMC related configuration file, its file format is INI style. The file is made of sections, each one starting with a « [sectionname] » header. In each section options can be defined like this « option = value ».

For example:

        [section1]
        option1 = 1
        option2 = 2

        [section2]
        option1 = foo
        option2 = plop
      

All the passwords contained in MMC-related configuration files can be obfuscated using a base64 encoding. This is not a security feature, but at least somebody won't be able to read accidentally a password.

To obfuscate a password, for example the word "secret", you can use the Python interpreter:

      $ python -c 'print "secret".encode("base64")'
      c2VjcmV0

    

The base64-encoded password is the word "c2VjcmV0". Now to use it in a configuration file:

      [section]
      password = {base64}c2VjcmV0
    

The {base64} prefix warns the configuration parser that the following word is a base64-encoded word, and so needs to be decoded before being used.

Here are all the base.ini available sections

This section defines how the main LDAP is accessed, where are located the users organization units, etc.

This section defines where are located the backup tools. The backup tools are used when backuping a home directory or a SAMBA share from the MMC.

The hooks system allow you to run external script when doing some operations with the MMC.

The script will be run as root user, with as only argument the path to a temporary file containing the full LDIF export of the LDAP user. For the « adduser » and « changeuserpassword » hooks, the LDIF file will contain the userPassword attribute in cleartext.

The executable bit must be set on the script to run. The temporary LDIF file is removed once the script has been executed.

Here is a hook example written in BASH for « adduser »:

#!/bin/sh

# Get the uid of the new user
VALUE=`cat $1 | grep ^uid: | sed "s/uid: //"`
      
# Log new user event
echo "New user $VALUE created" >> /var/log/newuser.log

exit 0
    

The same hook, written in Python:

#!/usr/bin/python

import sys

# ldif is a Python package of the python-ldap extension
import ldif

LOGFILE="/var/log/newuser.log"

class MyParser(ldif.LDIFParser):

    def handle(self, dn, entry):
        uid = entry["uid"][0]
        f = file(LOGFILE, "a")
        f.write("New user %s created\n" % uid)
        f.close()

parser = MyParser(file(sys.argv[1]))
parser.parse()
    

This section allows to set default attributes to a user, or remove them, only at user creation.

Each option of this section is corresponding to the attribute you want to act on.

If you want to remove the « displayName » attribute of each newly added user:

      [userdefault]
      displayName = DELETE
    

Substitution is done on the value of an option if a string between '%' is found. For example, if you want that all new user have a default email address containing their uid:

      [userdefault]
      mail = %uid%@mandriva.com
    

If you want to add a value to a multi-valuated LDAP attribute, do this:

      [userdefault]
      objectClass = +corporateUser
    

Since version 1.1.0, you can add modifiers that interact with the substitution. This modifiers are put between square bracket at the beginning os the string to substitute.

For example, you want that all new created users have a default mail address made this way: « firstname.lastname@mandriva.com ». But your user firstname/lastname have accent marks, that are forbidden for email address. You do it like this:

      [userdefault]
      mail = [_/]%givenName%.%sn%@mandriva.com
    

The default configuration authenticates users using the LDAP directory specified in the [ldap] section.

But it is also possible to set up authentication using an external LDAP server.

        [authentication]
        method = baseldap
      

        [authentication_baseldap]
        authonly = root
      

        [authentication_externalldap]
        exclude = root
        ldapurl = ldap://192.168.0.1:389
        suffix = cn=Users,dc=adroot,dc=com
        bindname = cn=Administrator, cn=Users, dc=adroot, dc=com
        bindpasswd = s3cr3t
        filter = objectClass=*
        attr = cn
      

This feature allows to automatically create a user account if it does not already exist in the LDAP directory configured in the [ldap] section of the base plugin.

User provisioning is needed for example if an external LDAP is used to authenticate users. The users won't be able to log in to the MMC web interface even if their login and password are rights, because the local LDAP doesn't store thir accounts.

        [provisioning]
        method = externalldap
      

        [authentication]
        method = baseldap externalldap

        [authentication_externalldap]
        exclude = root
        ldapurl = ldap://192.168.0.1:389
        suffix = cn=Users,dc=adroot,dc=com
        bindname = cn=Administrator, cn=Users, dc=adroot, dc=com
        bindpasswd = s3cr3t
        filter = objectClass=*
        attr = cn

        [provisioning]
        method = externalldap
        
        [provisioning_externalldap]
        exclude = root
        ldap_uid = cn
        ldap_givenName = sn
        ldap_sn = sn