# 
# Install LDAP Settings.
#
####################################################################
# Patrick Finnegan 19/09/2005.  V1. 
####################################################################

#-------------------------------------------------------------------------------
# Get List LDAP Registries. 
#-------------------------------------------------------------------------------

proc getLDAPUserRegistryId {} {

   global AdminConfig 

   puts "\n## List Registry Details ##\n" 

   # Note: IBM advise that there can only be one ldap server per cell.

   if { [ catch { $AdminConfig list LDAPUserRegistry } r ] == 0 } {

       set LDAPUserRegistryId $r

       foreach e $r {

          puts [ format "\n%-10s %-50s\n"  "Registry:" $e  ]

          catch { $AdminConfig showAttribute $e baseDN           } r
	  puts [ format "%-5s %-20s %-50s"  " " baseDN $r ]
          catch { $AdminConfig showAttribute $e bindDN           } r
	  puts [ format "%-5s %-20s %-50s"  " " bindDN $r ]
          catch { $AdminConfig showAttribute $e bindPassword     } r
	  puts [ format "%-5s %-20s %-50s"  " " bindPassword $r ]
          catch { $AdminConfig showAttribute $e hosts            } hosts
	  puts [ format "%-5s %-20s %-50s"  " " hosts $hosts ]
          catch { $AdminConfig showAttribute $e ignoreCase       } r
	  puts [ format "%-5s %-20s %-50s"  " " ignoreCase $r ]
          catch { $AdminConfig showAttribute $e limit            } r
	  puts [ format "%-5s %-20s %-50s"  " " limit $r ]
          catch { $AdminConfig showAttribute $e monitorInterval  } r
	  puts [ format "%-5s %-20s %-50s"  " " monitorInterval $r ]
          catch { $AdminConfig showAttribute $e properties       } r
	  puts [ format "%-5s %-20s %-50s"  " " properties $r ]
          catch { $AdminConfig showAttribute $e realm            } r
	  puts [ format "%-5s %-20s %-50s"  " " realm $r ]
          catch { $AdminConfig showAttribute $e type             } r
	  puts [ format "%-5s %-20s %-50s"  " " type $r  ]
          catch { $AdminConfig showAttribute $e reuseConnection  } r
	  puts [ format "%-5s %-20s %-50s"  " " reuseConnection $r ]
          catch { $AdminConfig showAttribute $e searchTimeout    } r
	  puts [ format "%-5s %-20s %-50s"  " " searchTimeout $r ]
          catch { $AdminConfig showAttribute $e serverId         } r
	  puts [ format "%-5s %-20s %-50s"  " " serverId $r ]
          catch { $AdminConfig showAttribute $e serverPassword   } r
	  puts [ format "%-5s %-20s %-50s"  " " serverPassword $r ]
          catch { $AdminConfig showAttribute $e sslConfig        } r
	  puts [ format "%-5s %-20s %-50s"  " " sslConfig $r ]
          catch { $AdminConfig showAttribute $e sslEnabled       } r
	  puts [ format "%-5s %-20s %-50s\n"  " " sslEnabled $r ]

          catch { $AdminConfig showAttribute $e searchFilter     } LDAPSearchFilterId
	  puts [ format "%-5s %-20s %-50s"  " " LDAPSearchFilterId $LDAPSearchFilterId ]

	  catch { getLDAPSearchFilter $LDAPSearchFilterId } r

          lappend hostList $hosts 
    
       }	      

    } else {
 
        puts "\nproblem accessing LDAP user registry ID.\n"
        puts $r 
        puts "************************************\n"
        return -code error $r

    }

   lappend registryList $LDAPUserRegistryId 

   return [ list $registryList $hostList $LDAPSearchFilterId ]

}

#-------------------------------------------------------------------------------
# For existing LDAP server get search filter details.  
#-------------------------------------------------------------------------------

proc getLDAPSearchFilter { LDAPSearchFilterId } {

   global AdminConfig 

   puts "\n## List Ldap Search Filter ##\n" 

   foreach e $LDAPSearchFilterId {

      catch { $AdminConfig showAttribute $LDAPSearchFilterId certificateFilter } r
      puts [ format "%-5s %-20s %-50s"  " " certificateFilter $r ]
      catch { $AdminConfig showAttribute $LDAPSearchFilterId certificateMapMode} r
      puts [ format "%-5s %-20s %-50s"  " " certificateMapMode $r ]
      catch { $AdminConfig showAttribute $LDAPSearchFilterId groupFilter } r
      puts [ format "%-5s %-20s %-50s"  " " groupFilter $r ]
      catch { $AdminConfig showAttribute $LDAPSearchFilterId groupIdMap } r
      puts [ format "%-5s %-20s %-50s"  " " groupIdMap $r ]
      catch { $AdminConfig showAttribute $LDAPSearchFilterId groupMemberIdMap } r
      puts [ format "%-5s %-20s %-50s"  " " groupMemberIdMap $r ]
      catch { $AdminConfig showAttribute $LDAPSearchFilterId userFilter } r
      puts [ format "%-5s %-20s %-50s"  " " userFilter $r ]
      catch { $AdminConfig showAttribute $LDAPSearchFilterId userIdMap } r
      puts [ format "%-5s %-20s %-50s"  " " userIdMap $r ]

   }	      

}

#-------------------------------------------------------------------------------
# Delete any existing ldap host server definitions before defining a new one. 
#-------------------------------------------------------------------------------

proc deleteHosts { hosts } {

   global AdminConfig 

   puts "\n## Delete Existing Hosts ##\n" 

   # delete existing ldap host server ids or host modification will duplicate ids. 
   # extract host sublist from list 

   set hosts [ join $hosts ]

   foreach hostId $hosts {

      if { [ catch { $AdminConfig remove $hostId } r ] == 0 } {

	   puts  [ format "%-5s %-20s %-50s" " "  "Removed hostId"  $hostId ]
	   return $r

	   } else {

	   puts "\nproblem removing host $hostId. \n"
	   puts $r 
	   puts "************************************\n"
	   return -code error $r

      }
   }
}

#-------------------------------------------------------------------------------
# setup attribute values for LDAPUserRegistry using LDAPUserRegistry ConfigId
#-------------------------------------------------------------------------------

proc doLDAPUserRegistry { ldapServer   \
                          ldapServerId \
                          ldapPassword \
                          ldapPort     \
                          domainHostname \
                          baseDN \
                          LDAPUserRegistryId \
                          LDAPSearchFilterId } {

   global AdminConfig 

   puts "\n## Modify LDAP Registry Details ##\n" 

   set serverId        [ list serverId        $ldapServerId          ]
   set serverPassword  [ list serverPassword  $ldapPassword          ]
   set realm           [ list realm           $ldapServer:$ldapPort  ]
   set type            [ list type            {CUSTOM}               ]
   set baseDN          [ list baseDN          $baseDN                ]
   set reuseConnection [ list reuseConnection true                   ]
   set ignoreCase      [ list ignoreCase      true                   ]

   set host            [ list host $ldapServer     ]
   set port            [ list port $ldapPort       ]
   set hostsList       [ list [ list $host $port ] ]
   set hosts           [ list hosts $hostsList     ]

   set attrs [ list $serverId        \
                    $serverPassword  \
                    $realm           \
                    $type            \
                    $baseDN          \
                    $reuseConnection \
                    $ignoreCase      \
                    $hosts     
	     ]

   puts " ATTRS = $attrs"

   if { [ catch { $AdminConfig modify $LDAPUserRegistryId $attrs } r ] == 0 } {

       return $r

       } else {

       puts "\nproblem updating LDAP $LDAPUserRegistryId. \n"
       puts $r 
       puts "************************************\n"
       return -code error $r

   }

}

#-------------------------------------------------------------------------------
# setup attribute values for LDAPSearchFilterId using LDAPSearchFilterId ConfigId
#-------------------------------------------------------------------------------

proc modifyLDAPSearchFilterId { certificateMapMode \
				groupFilter \
				groupIdMap  \
				groupMemberIdMap \
				userFilter \
				userIdMap  \
				LDAPSearchFilterId } {

   global AdminConfig 

   puts "\n## Modify LDAP Filter Details ##\n" 

   # ldap mappings are [listed] to avoid special character quoting problems.

   set  certificateMapMode  [ list  certificateMapMode  [ join $certificateMapMode ] ]
   set  groupFilter         [ list  groupFilter         [ join $groupFilter        ] ]
   set  groupIdMap          [ list  groupIdMap          [ join $groupIdMap         ] ]
   set  groupMemberIdMap    [ list  groupMemberIdMap    [ join $groupMemberIdMap   ] ]
   set  userFilter          [ list  userFilter          [ join $userFilter         ] ]
   set  userIdMap           [ list  userIdMap           [ join $userIdMap          ] ]

   set attrs [ list $certificateMapMode \
                    $groupFilter        \
                    $groupIdMap         \
                    $groupMemberIdMap   \
                    $userFilter         \
                    $userIdMap          
	     ]

   if { [ catch { $AdminConfig modify $LDAPSearchFilterId $attrs } r ] == 0 } {

       return $r

       } else {

       puts "\nproblem updating LDAP $LDAPSearchFilterId. \n"
       puts $r 
       puts "************************************\n"
       return -code error $r

   }

}

####################################################################
# Main Control.
####################################################################

puts "\n argc = $argc \n"

if {$argc < 5} {
        return -code error "error - no arguments supplied.  Supply server name"
        puts "no arguments"
}

# if the ldap search mappings contain system characters [ list ] mappings.

set ldapServer           [ lindex $argv 0 ]
set ldapServerId         [ lindex $argv 1 ]
set ldapPassword         [ lindex $argv 2 ]
set ldapPort             [ lindex $argv 3 ]
set domainHostname       [ lindex $argv 4 ]
set baseDN               [ lindex $argv 5 ]

set certificateMapMode "EXACT_DN"
set groupFilter "(&(|(|(objectclass=groupOfNames)(objectclass=groupOfUniqueNames)(objectclass=top))(objectclass=groupOfURLs))(cn=%v))"
set groupIdMap "*:cn"
set groupMemberIdMap "groupOfNames:member;groupOfUniqueNames:uniqueMember"
set userFilter "(&(cn=%v)(|(objectclass=ABC)(objectclass=DEF)(objectclass=person)))"
set userIdMap "*.cn"

set nodeName [ $AdminControl getNode ]
set cellName [ $AdminControl getCell ]

puts "ldapServer      =  $ldapServer     "
puts "ldapServerId    =  $ldapServerId   "
puts "ldapPassword    =  $ldapPassword   "
puts "ldapPort        =  $ldapPort       "
puts "domainHostname  =  $domainHostname "
puts "baseDN          =  $baseDN         "
puts "nodeName        =  $nodeName       "
puts "cellName        =  $cellName       "

puts "certificateMapMode =  $certificateMapMode "
puts "groupFilter        =  $groupFilter        "
puts "groupIdMap         =  $groupIdMap         "
puts "groupMemberIdMap   =  $groupMemberIdMap   "
puts "userFilter         =  $userFilter         "
puts "userIdMap          =  $userIdMap          "

#######################################################################
# If the ldap server host definition already exists do not delete because it may be in use by some of the installed applications. Modify instead.
#######################################################################

if { [ catch { getLDAPUserRegistryId } r ] == 0 } {

    puts "\n Registry $r \n"

    set LDAPUserRegistryId [ lindex [ lindex $r 0 ] 0 ] 
    set hostList           [ lindex $r 1 ] 
    set LDAPSearchFilterId [ lindex $r 2 ] 

} else {
        return -code error $r 
}

# if the host list contains no elements or only null elements skip delete.

#puts "\n hostlist = $hostList \n" 

if { [ lindex [ eval join $hostList ] 0 ] == "" }  {
   puts "\nno hosts\n"
   set continue true 
} else {
    if { [ catch { deleteHosts $hostList } r ] == 0 } {
	 set continue true 
	 } else {
	 return -code error $r
    }
}

if { [ catch { doLDAPUserRegistry $ldapServer         \
                                  $ldapServerId       \
                                  $ldapPassword       \
                                  $ldapPort           \
                                  $domainHostname     \
                                  $baseDN             \
                                  $LDAPUserRegistryId \
                                  $LDAPSearchFilterId   \
} r ] == 0 } {

    if { [ catch { modifyLDAPSearchFilterId $certificateMapMode \
	                                    $groupFilter \
	                                    $groupIdMap \
	                                    $groupMemberIdMap \
	                                    $userFilter \
	                                    $userIdMap \
                                            $LDAPSearchFilterId } r ] == 0 } {

	puts "\n## Admin Config Save ##\n"
	catch { $AdminConfig save } r
	puts $r

    } else {
	    return -code error $r 
    }

} else {
        return -code error $r 
}

####################################################################
# List servers to verify install.
####################################################################

if { [ catch { getLDAPUserRegistryId } r ] == 0 } {
    set continue true
} else {
        return -code error $r 
}