ldap

#!/bin/bash

#####################################################################################
#
# The MIT License (MIT)
#
# Copyright (c) 2015-2017 Jules Kerssemakers / Deutsches Krebsforschungszentrum Heidelberg (DKFZ)
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
# of the Software, and to permit persons to whom the Software is furnished to do so,
# subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
# INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
# PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
# COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
# OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#
#####################################################################################


# This script provides a simple wrapper around `ldapsearch`
# You can just enter your filter query (e.g. 'cn=drwho'), and the script
# will handle all the extra bind parameters that LDAP requires
# (loaded from a config file)


# Load the secrets such as password and hostname from somewhere not-in-git
source "${XDG_CONFIG_HOME:-"$HOME"/.config}/ldap-summary.conf"

# actual search
# followed by sed one-liner that rejoins lines broken by the ldap 80-char line limit
# followed by awk to do some layout and base64 decoding
ldapsearch -u -LLL \
  -h "$JK_LDAPHOST" -w "$JK_LDAPPASSWORD" \
  -D "$JK_BINDDN" -b "$JK_SEARCHBASE" \
  -x \
  "($1)" cn displayName memberOf member description mail uidNumber gidNumber pwdLastSet lastLogonTimestamp accountExpires telephoneNumber \
  | sed -zr -e "s/\r?\n //g"  -e "s/\r?\n# refldap:.+\r?\n//g" \
  | awk --posix -F'( {2,}|,|:)' -- '
    function base_64_decode(encoded) {
       "echo "encoded" | base64 -d" | getline decoded
       return decoded
    }
    function print_formatted_membership(membership_type, cn, ou, whole_line) {
        gsub("^member(Of)?: ", "", whole_line);
        printf("%-8s:%-28s %-18s full DN: %s\n",
              membership_type, cn, ou, whole_line);

    }
    function parse_ldap_timestamp(ldap_timestamp) {
        if (ldap_timestamp == 0) { return "N/A" }
        # port of https://stackoverflow.com/questions/4647169/how-to-convert-ldap-timestamp-to-unix-timestamp
        win_secs = int(ldap_timestamp / 10000000) # divide by 10 000 000 to get seconds from 100-nanosecond resolution
        unix_timestamp = win_secs - 11644473600   # 1.1.1600 (win epoch) -> 1.1.1970 (linux epoch) difference in seconds
        # posix compatibility: use system `date` utility instead of gawk-only strftime;
        # \047 = escape code for single-quote, to not interrupt top-level bash-quoting
        "date \047+%Y-%m-%d %H:%M:%S\047 --date=@" unix_timestamp | getline formatted_date
        return formatted_date;
    }
    /^member(Of)?:/                { print_formatted_membership($1, $2, $3, $0); next };
    /^(displayName|description)::/ { print $1 ": " base_64_decode($3);           next };
    /^(lastLogonTimestamp|pwdLastSet|accountExpires)/ {
                                     print $1 ": " parse_ldap_timestamp($2);     next };
                                   { print };
    '