#encoding: utf-8
#!/bin/bash

user=`whoami`
localPwd="$( cd "$( dirname "$0"   )" && pwd   )"
logFile="$localPwd/install.log"
dateNow=`date '+%Y-%m-%d %H:%M:%S'`
dateFlag=`date '+%Y%m%d%H%M%S'`
ldap_server=`hostname`
ldap_ip=`hostname -i`
node_list=$localPwd/ip.list
domain=HADOOP.COM
dc1=`echo $domain|awk -F . '{print $1}'`
dc2=`echo $domain|awk -F . '{print $2}'`
dc1=${dc1,,}
dc2=${dc2,,}

sudoCmd=""
[ "$user" != "root" ] && sudoCmd="sudo " && echo "非root用户，使用免密sudo命令执行。"

function echo_info {
  echo -e "\e[32m`printf '%-20s' "[install_ldap]"`\e[0m - $1"
  echo "$dateNow INFO [install_ldap] $1" >> $logFile
}
function echo_warn {
  echo -e "\e[31m`printf '%-20s' "[install_ldap]"`\e[0m - $1"
  echo "$dateNow WARN [install_ldap] $1" >> $logFile
}

function backup_file {
  [ -f $i ] && $sudoCmd \cp $i $i.bak.$dateFlag
}

function main() {
  echo_info "install openldap openldap-clients openldap-devel compat-openldap openldap-servers krb5-server-ldap"
  $sudoCmd yum install openldap openldap-clients openldap-devel compat-openldap openldap-servers krb5-server-ldap -y 2>&1 >>$logFile
	[ $? -ne 0 ] && echo_warn "安装失败，请检查yum配置." && exit 1
  echo_info "生成LADP数据库配置"
  [ -f /var/lib/ldap/DB_CONFIG ] && $sudoCmd \cp /var/lib/ldap/DB_CONFIG /var/lib/ldap/DB_CONFIG.bak.$dateFlag
  $sudoCmd \cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG && $sudoCmd chown -R ldap.ldap /var/lib/ldap
  [ -f /etc/openldap/schema/kerberos.schema ] && $sudoCmd \cp /etc/openldap/schema/kerberos.schema /etc/openldap/schema/kerberos.schema.bak.$dateFlag
  $sudoCmd \cp /usr/share/doc/krb5-server-ldap-1.15.1/kerberos.schema /etc/openldap/schema/

  echo_info "生成slapd配置文件"
  $sudoCmd cat > /etc/openldap/slapd.conf <<EOF
include /etc/openldap/schema/corba.schema
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/duaconf.schema
include /etc/openldap/schema/dyngroup.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/java.schema
include /etc/openldap/schema/kerberos.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/openldap.schema
include /etc/openldap/schema/pmi.schema
include /etc/openldap/schema/ppolicy.schema
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
EOF

  echo_info "初始化配置"
  $sudoCmd slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
  $sudoCmd chown -R ldap:ldap /etc/openldap/slapd.d && $sudoCmd chmod -R 700 /etc/openldap/slapd.d

  echo_info "启动ldap后台进程"
  $sudoCmd rm -f /etc/openldap/slapd.d/cn\=config/cn\=schema/cn\=\{1\}core.ldif
  $sudoCmd rpm -e cyrus-sasl-sql
  $sudoCmd rpm -e cyrus-sasl-ldap
  $sudoCmd systemctl start slapd && $sudoCmd systemctl enable slapd

  echo_info "创建ldap服务的kdc凭证"
  $sudoCmd kadmin.local -q "addprinc -pw ldapadmin@1298 ldapadmin@${domain}"
  $sudoCmd kadmin.local -q "addprinc -randkey ldap/${ldap_server}@${domain}"
  $sudoCmd kadmin.local -q "ktadd -k /etc/openldap/ldap.keytab ldap/${ldap_server}@${domain}"
  $sudoCmd chown ldap:ldap /etc/openldap/ldap.keytab && $sudoCmd chmod 640 /etc/openldap/ldap.keytab

  echo_info "增加kerberos配置 /etc/sysconfig/slapd"
  $sudoCmd cat > /etc/sysconfig/slapd <<EOF
SLAPD_URLS="ldapi:/// ldap:///"
KRB5_KTNAME="FILE:/etc/openldap/ldap.keytab"
EOF
  
  echo_info "初始化ldap数据库，密码Ldapadmin@1298"
  root_pass=`slappasswd -s Ldapadmin@1298`
  $sudoCmd mkdir -p $localPwd/ldap_ldif
  $sudoCmd cat > $localPwd/ldap_ldif/change.ldif <<EOF
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=${dc1},dc=${dc2}

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: uid=ldapadmin,ou=people,dc=${dc1},dc=${dc2}

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: ${root_pass}

dn: olcDatabase={2}hdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to dn.base="" by * read
olcAccess: {1}to * by dn="uid=ldapadmin,ou=people,dc=${dc1},dc=${dc2}" write by * read

dn: cn=config
changetype: modify
add: olcAuthzRegexp
olcAuthzRegexp: uid=([^,]*),cn=GSSAPI,cn=auth uid=\$1,ou=people,dc=${dc1},dc=${dc2}
EOF

  echo_info "初始化ldap"
  ldapmodify -c -Y EXTERNAL -H ldapi:/// -f $localPwd/ldap_ldif/change.ldif
  [ $? -ne 0 ] && echo_warn "初始化ldap失败." && exit 1

  echo_info "初始化ldapadmin"
  $sudoCmd cat > $localPwd/ldap_ldif/ldapadmin.ldif <<EOF
dn: dc=${dc1},dc=${dc2}
objectClass: top
objectClass: dcObject
objectclass: organization
o: ${dc1} ${dc2}
dc: ${dc1}

dn: ou=people,dc=${dc1},dc=${dc2}
objectclass: organizationalUnit
ou: people
description: Users

dn: ou=group,dc=${dc1},dc=${dc2}
objectClass: organizationalUnit
ou: group

dn: uid=ldapadmin,ou=people,dc=${dc1},dc=${dc2}
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: LDAP admin account
uid: ldapadmin
sn: ldapadmin
uidNumber: 2001
gidNumber: 2002
homeDirectory: /home/ldapadmin
loginShell: /bin/bash
EOF
  $sudoCmd ldapadd -c -x -D "uid=ldapadmin,ou=people,dc=${dc1},dc=${dc2}" -w Ldapadmin@1298 -f $localPwd/ldap_ldif/ldapadmin.ldif
  [ $? -ne 0 ] && echo_warn "ldapadmin创建失败" && exit 1


  echo_info "导入系统用户"
  $sudoCmd yum install migrationtools -y
  $sudoCmd sed -i "/^\$DEFAULT_MAIL_DOMAIN/c \$DEFAULT_MAIL_DOMAIN = \"$domain\";" /usr/share/migrationtools/migrate_common.ph
  $sudoCmd sed -i "/^\$DEFAULT_BASE/c \$DEFAULT_BASE = \"dc=${dc1},dc=${dc2}\";" /usr/share/migrationtools/migrate_common.ph
  $sudoCmd /usr/share/migrationtools/migrate_base.pl > $localPwd/ldap_ldif/base.ldif
  $sudoCmd sed -i "/^dn: dc=hadoop,dc=com/,+4d" $localPwd/ldap_ldif/base.ldif
  $sudoCmd sed -i "/^dn: ou=People,dc=hadoop,dc=com/,+4d" $localPwd/ldap_ldif/base.ldif
  $sudoCmd sed -i "/^dn: ou=Group,dc=hadoop,dc=com/,+4d" $localPwd/ldap_ldif/base.ldif
  $sudoCmd ldapadd -x -D "uid=ldapadmin,ou=people,dc=hadoop,dc=com" -w Ldapadmin@1298 -f $localPwd/ldap_ldif/base.ldif
  [ $? -ne 0 ] && echo_warn "导入用户失败" && exit 1
 
  $sudoCmd sed -f ldap_user.sed /etc/passwd > $localPwd/ldap_ldif/user.list
  $sudoCmd /usr/share/migrationtools/migrate_passwd.pl $localPwd/ldap_ldif/user.list $localPwd/ldap_ldif/user.ldif
  $sudoCmd ldapadd -x -D "uid=ldapadmin,ou=people,dc=hadoop,dc=com" -w Ldapadmin@1298 -f $localPwd/ldap_ldif/user.ldif
  
  $sudoCmd sed -f ldap_group.sed /etc/group > $localPwd/ldap_ldif/group.list
  $sudoCmd /usr/share/migrationtools/migrate_group.pl $localPwd/ldap_ldif/group.list $localPwd/ldap_ldif/group.ldif
  $sudoCmd ldapadd -x -D "uid=ldapadmin,ou=people,dc=hadoop,dc=com" -w Ldapadmin@1298 -f $localPwd/ldap_ldif/group.ldif
  [ $? -ne 0 ] && echo_warn "导入用户组失败" && exit 1


  echo_info "部署客户端，IP列表:`cat $node_list|tr '\n' ' '`"
  for i in `cat $node_list`;do
    ssh $i "$sudoCmd yum install openldap-clients nss-pam-ldapd -y"
    [ $? -ne 0 ] && echo_warn "$i:安装客户端失败"
  done

  echo_info "创建ldap客户端配置文件/etc/openldap/ldap.conf"
  $sudoCmd \cp /etc/openldap/ldap.conf $localPwd/ldap_ldif/ldap.conf
  sed -i "/^URI/d" $localPwd/ldap_ldif/ldap.conf
  sed -i "\$a URI ldap://${ldap_ip}/" $localPwd/ldap_ldif/ldap.conf
  sed -i "/^BASE/d" $localPwd/ldap_ldif/ldap.conf
  sed -i "\$a BASE dc=${dc1},dc=${dc2}" $localPwd/ldap_ldif/ldap.conf
  for i in `cat $node_list`;do
    rsync -a $localPwd/ldap_ldif/ldap.conf $i:/etc/openldap/ldap.conf
  done
  
  echo_info "更新客户端的系统用户配置"
  for i in `cat $node_list`;do
    ssh $i "authconfig-tui --enableldap --enableldapauth --ldapserver=\"ldap://$ldap_ip/\"  --ldapbasedn=\"dc=${dc1},dc=${dc2}\" --kickstart"
    echo_info "校验ldap配置，节点：$i"
    ssh $i "id ldapadmin"
    [ $? -ne 0 ] && echo_warn "$i:ldap用户访问测试失败"
  done

  echo_info "安装信息汇总："
	echo_info "Ldap server：$ldap_server"
	echo_info "Ldap 管理员用户：ldapadmin"
	echo_info "Ldap 管理员密码：Ldapadmin@1298"
	echo_info "Ldap 客户端节点：`cat $node_list|tr '\n' ' '`"
  echo_info "End."
}
main
