From 1522f9855639fbe98c9b611f0cad8c409a1698f6 Mon Sep 17 00:00:00 2001
From: James Valleroy <jvalleroy@mailbox.org>
Date: Sat, 24 Jun 2023 18:53:24 -0400
Subject: [PATCH] users: Add diagnostics check for nslcd config

Tests:

- Change the values of uri, base, and sasl_mech in /etc/nslcd.conf.
  Confirm that the diagnostics are failing.

- Change the values back to the original. Confirm that the diagnostics
  are passed.

- Remove the uri, base, and sasl_mech lines from /etc/nslcd.conf.
  Confirm that the diagnostics are failing.

Signed-off-by: James Valleroy <jvalleroy@mailbox.org>
[sunil: Use augeas Nslcd lens]
Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Sunil Mohan Adapa <sunil@medhas.org>
---
 plinth/modules/users/__init__.py   | 18 ++++++++++++++++++
 plinth/modules/users/privileged.py | 17 +++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/plinth/modules/users/__init__.py b/plinth/modules/users/__init__.py
index 6dc4a186d..54532680d 100644
--- a/plinth/modules/users/__init__.py
+++ b/plinth/modules/users/__init__.py
@@ -90,6 +90,11 @@ class UsersApp(app_module.App):
         results.append(_diagnose_ldap_entry('ou=people'))
         results.append(_diagnose_ldap_entry('ou=groups'))
 
+        config = privileged.get_nslcd_config()
+        results.append(_diagnose_nslcd_config(config, 'uri', 'ldapi:///'))
+        results.append(_diagnose_nslcd_config(config, 'base', 'dc=thisbox'))
+        results.append(_diagnose_nslcd_config(config, 'sasl_mech', 'EXTERNAL'))
+
         return results
 
     def setup(self, old_version):
@@ -119,6 +124,19 @@ def _diagnose_ldap_entry(search_item):
     return [testname, result]
 
 
+def _diagnose_nslcd_config(config, key, value):
+    """Diagnose that nslcd has a configuration."""
+    try:
+        result = 'passed' if config[key] == value else 'failed'
+    except KeyError:
+        result = 'failed'
+
+    template = _('Check nslcd config "{key} {value}"')
+    testname = format_lazy(template, key=key, value=value)
+
+    return [testname, result]
+
+
 def get_last_admin_user():
     """If there is only one admin user return its name else return None."""
     admin_users = privileged.get_group_users('admin')
diff --git a/plinth/modules/users/privileged.py b/plinth/modules/users/privileged.py
index 099e24c44..7483474b1 100644
--- a/plinth/modules/users/privileged.py
+++ b/plinth/modules/users/privileged.py
@@ -178,6 +178,23 @@ def _configure_ldapscripts():
     aug.save()
 
 
+@privileged
+def get_nslcd_config():
+    """Get nslcd configuration for diagnostics."""
+    nslcd_conf = '/etc/nslcd.conf'
+    aug = augeas.Augeas(flags=augeas.Augeas.NO_LOAD +
+                        augeas.Augeas.NO_MODL_AUTOLOAD)
+    aug.transform('Nslcd', nslcd_conf)
+    aug.set('/augeas/context', '/files' + nslcd_conf)
+    aug.load()
+
+    return {
+        'uri': aug.get('uri/1'),
+        'base': aug.get('base'),
+        'sasl_mech': aug.get('sasl_mech')
+    }
+
+
 def _get_samba_users():
     """Get users from the Samba user database."""
     # 'pdbedit -L' is better for listing users but is installed only with samba