create_shared.py

#!/usr/bin/env python3
import argparse
import boxsdk
import kadmin
import logging
import logging.handlers
import mcommunity
import os
import re
import string
import yaml

from boxsdk.object.collaboration import CollaborationRole
from datetime import datetime
from datetime import timedelta
from secrets import choice
from subprocess import check_output as cmd
from subprocess import CalledProcessError
from subprocess import STDOUT

devnull = open(os.devnull, 'w')


class SharedAccount:

    def __init__(self, args, config):
        self.__dict__.update(args)
        self.config = config
        self.logger = logging.getLogger(__name__)
        self.create_extra_attr()

    def create_box(self):
        try:
            self.logger.info(
                'Creating Box account',
                extra={'entity': self.account}
            )
            auth = boxsdk.JWTAuth.from_settings_file(
                self.config['box']['auth_file']
            )
            boxClient = boxsdk.Client(auth)
        except IOError as e:
            self.logger.error(e, extra={'entity': self.account})
            exit(2)
        except boxsdk.exception.BoxAPIException as e:
            self.logger.error(e, extra={'entity': self.account})
            exit(2)

        try:
            if len(self.full_name) > 50:
                self.logger.warning(
                    'Full name attribute for user exceeds limit. Truncating.',
                    extra={'entity': self.account}
                )
            boxAccount = boxClient.create_user(
                name=self.full_name[:50],
                login=self.email,
                space_amount=-1,
                tracking_codes=[{
                    'name': 'account_type',
                    'value': 'shared'
                }]
            )
        except boxsdk.exception.BoxAPIException as e:
            if e.status in [409, 403]:
                self.logger.info(
                    e.message,
                    extra={'entity': self.account}
                )
                return
            else:
                self.logger.error(e, extra={'entity': self.account})
                return

        try:
            boxAccount.update_info({'is_sync_enabled': False})

            self.shared_box_folder = boxClient.as_user(
                boxAccount
            ).folder(
                0
            ).create_subfolder(
                self.full_name
            )

            self.box_text = '''
Box-Specific Information:
 - The ability to use Box Sync with shared accounts is disabled by default,
but allowed in certain circumstances; if you need this, please reply to this
message to discuss. Syncing the shared folder in your individual account is
always allowed.

 - Files placed in shared account folders are owned by the shared account.

 - To learn more about using your shared account, visit the Shared U-M Box
Accounts section of the M+Box support site.

(http://www.itcs.umich.edu/storage/box/shared-accounts.php)

'''
            if self.secure:
                self.shared_box_folder.update_info({
                    'can_non_owners_invite': False,
                    'allowed_shared_link_access_levels': ['collaborators']
                })
                self.box_text += '''
 - Settings appropriate for sensitive data have been applied to this folder.
'''

            self.upload_box_info_file()

            for owner in self.owners:
                search = boxClient.users(filter_term=owner)
                for _ in search:
                    login = _['login'].split('@')[0].lower()
                    if owner.lower() == login:
                        try:
                            self.shared_box_folder.collaborate(
                                _,
                                CollaborationRole.CO_OWNER
                            )
                        except boxsdk.exception.BoxAPIException as e:
                            self.logger.warning(
                                'Unable to add {} as Box collaborator'.format(
                                    _
                                 ),
                                extra={'entity': self.account}
                            )
                        break
        except boxsdk.exception.BoxAPIException as e:
            self.logger.error(e, extra={'entity': self.account})

    def upload_box_info_file(self):
        try:
            readme = '{}/{}-{}'.format(
                self.config['general']['data_dir'],
                self.account,
                'README.txt'
            )
            with open(readme, 'w+') as stream:
                content = '''
The folder "{}" is owned by the shared account "{}".

The initial co-owners on this folder are based on the owners listed on the
request form at the time this folder was created.

The co-owners and members will NOT be kept in sync with MCommunity.

f you have any questions please contact the ITS Service Center:

http://its.umich.edu/help/'''.format(self.full_name, self.email)
                stream.write(content)
            self.shared_box_folder.upload(readme)
            os.remove(readme)
        except IOError as e:
            self.logger.error(e, extra={'entity': self.account})
        except boxsdk.exception.BoxAPIException as e:
            self.logger.error(e, extra={'entity': self.account})

    def create_google(self):
        try:
            self.logger.info(
                'Creating Google account',
                extra={'entity': self.account}
            )
            cmd([
                self.config['google']['gam_command'],
                'create',
                'user',
                self.account,
                'firstname',
                self.first_name,
                'lastname',
                self.last_name,
                'password',
                self.password,
                'org',
                'Department accounts'
            ], stderr=devnull)
        except CalledProcessError as e:
            if e.returncode == 144:
                self.logger.info(
                    'Invalid data provided to Google account creation call',
                    extra={'entity': self.account}
                )
            elif e.returncode == 153:
                self.logger.info(
                    'Account already exists in Google',
                    extra={'entity': self.account}
                )
            else:
                self.logger.error(e, extra={'entity': self.account})

        self.google_text = '''
Google-Specific Information:
- For information on using this account, please check the following URL:

https://documentation.its.umich.edu/node/339/
'''

    def set_up_mcommunity_group(self):
        client = mcommunity.Client(self.config['mcommunity'])
        controllerCn = client._create_entity_ldap(
            self.config['mcommunity']['api_control_group']
        )
        ext_addr = self.account.lower() + '@go.itd.umich.edu'
        needs_update = False
        try:
            self.logger.info(
                'Checking Mcommunity for associated group',
                extra={'entity': self.account}
            )
            client.fetch_group(self.account)
        except ValueError as e:
            self.logger.info(e, extra={'entity': self.account})
            exit(2)
        except Exception as e:
            self.logger.info(e, extra={'entity': self.account})

        if hasattr(client, 'group_data'):
            self.logger.info(
                'Found associated MCommunity group',
                extra={'entity': self.account}
            )
            for owner in self.owners:
                ownerDn = client._create_entity_ldap(owner).lower()
                if ownerDn not in client.group_data['ownerDn']:
                    needs_update = True
                    break

            if self.service in ['google', 'both']:
                if type(client.group_data['memberExternalRaw']) is list:
                    if ext_addr not in client.group_data['memberExternalRaw']:
                        needs_update = True
                else:
                    needs_update = True

            if needs_update:
                self.logger.info(
                    'Mcommunity group needs updating',
                    extra={'entity': self.account}
                )
                if controllerCn not in client.group_data['ownerDn']:
                    if not self.take_group_ownership(self.account):
                        self.logger.error(
                            'Failed to obtain group ownership',
                            extra={'entity': self.account}
                        )
                        exit(2)
                    client.fetch_group(self.account)
            else:
                self.logger.info(
                    'Mcommunity group does not need an update',
                    extra={'entity': self.account}
                )
                return
        else:
            try:
                if len(self.owners) == 0:
                    self.logger.error(
                        'No owners provided for new MCommunity group.',
                        extra={'entity': self.account}
                    )
                    exit(2)
                self.logger.info(
                    'Reserving new Mcommunity group',
                    extra={'entity': self.account}
                )
                client.reserve_group(self.account)
                self.logger.info(
                    'Fetching new Mcommunity group',
                    extra={'entity': self.account}
                )
                client.fetch_group(self.account)
            except Exception as e:
                self.logger.info(e, extra={'entity': self.account})
                exit(2)

        try:
            self.logger.info(
                'Adding Mcommunity group alias',
                extra={'entity': self.account}
            )
            client.update_group_aliases(self.group_alias)
        except Exception as e:
            self.logger.warning(e, extra={'entity': self.account})

        try:
            self.logger.info(
                'Updating Mcommunity group membership',
                extra={'entity': self.account}
            )
            if self.service in ['google', 'both']:
                client.add_group_members(ext_addr)
            client.remove_group_members(
                self.config['mcommunity']['api_control_group']
            )
            client.update_group_members()
            self.logger.info(
                'Updating Mcommunity group ownership',
                extra={'entity': self.account}
            )
            client.add_group_owners(self.owners)
            client.remove_group_owners(
                self.config['mcommunity']['api_control_group']
            )
            client.update_group_owners()
        except Exception as e:
            self.logger.warning(e, extra={'entity': self.account})

    def take_group_ownership(self, group):
        input('Add api controller as group owner, then press enter.')
        return True

    def set_kerberos_password(self):
        try:
            self.logger.info(
                'Creating kerberos principal',
                extra={'entity': self.account}
            )
            admin = '{}@{}'.format(
                self.config['kerberos']['admin'],
                self.config['kerberos']['realm'].upper()
            )
            kadm = kadmin.init_with_keytab(
                admin,
                self.config['kerberos']['keytab']
            )
            kadm.ank(
                '{}@{}'.format(
                    self.account,
                    self.config['kerberos']['realm'].upper()
                ),
                self.password
            )
        except kadmin.KAdminError as e:
            self.logger.warning(e, extra={'entity': self.account})

    def upload_and_share_password(self):
        passFilePath = '{}/{}-passwd.txt'.format(
            self.config['general']['data_dir'],
            self.account
        )
        exp_time = datetime.today() + timedelta(days=10)
        with open(passFilePath, 'w') as passwordFile:
            passwordFile.write('''
For security, this file will expire automatically on {}. Please store
this password somewhere safe. ITS has best practice recommendations for
doing so at the following URL:

https://safecomputing.umich.edu/protect-yourself/manage-your-passwords

The password for your requested shared account is:

{}
'''.format(exp_time.strftime('%Y-%m-%d'), self.password))

        upload_output = cmd([
            self.config['google']['gam_command'],
            'user',
            self.config['google']['admin_account'],
            'add',
            'drivefile',
            'localfile',
            passFilePath,
            'parentname',
            'Shared Account Passwords'
        ], stderr=devnull)
        file_id = re.search(
            r'.*\((.*)\)',
            upload_output.decode('UTF-8')
        ).groups()[0]

        for owner in self.owners:
            try:
                whatis = cmd([
                    self.config['google']['gam_command'],
                    'whatis',
                    owner
                ], stderr=STDOUT)
            except CalledProcessError:
                self.logger.warning(
                    '{} does not seem to exist in Google.'.format(owner),
                    extra={'entity': self.account}
                )
                continue

            if b'is a user' in whatis:
                entity_type = 'user'
            elif b'is a group' in whatis:
                entity_type = 'group'

            try:
                cmd([
                    self.config['google']['gam_command'],
                    'user',
                    self.config['google']['admin_account'],
                    'add',
                    'drivefileacl',
                    file_id,
                    entity_type,
                    owner,
                    'role',
                    'reader'
                ], stderr=STDOUT)
            except CalledProcessError:
                self.logger.warning(
                    'Unable to share password with {}'.format(owner),
                    extra={'entity': self.account}
                )
                continue

        os.remove(passFilePath)
        return file_id

    def create_extra_attr(self):
        if self.first_name and self.last_name:
            self.full_name = '{} {}'.format(
                self.first_name,
                self.last_name
            )
        else:
            split = re.split(r'[\-\_\.\s]+', self.account)
            if len(split) == 1:
                self.logger.error(
                    'Cannot create first and last name from given account.'
                    ' Rerun script specifying first and last names.',
                    extra={'entity': self.account}
                )
                exit(2)
            self.first_name = ' '.join(split[:len(split)//2]).title()
            self.last_name = ' '.join(split[len(split)//2:]).title()
            self.full_name = '{} {}'.format(
                self.first_name,
                self.last_name
            )

        self.account = re.sub(r'[^\w-]', '.', self.account).lower().strip()
        self.group_alias = re.sub(
            r'[^\w-]',
            ' ',
            self.full_name
        ).replace('_', ' ').strip()
        self.email = '{}@{}'.format(
            self.account,
            self.config['google']['domain']
        )


def main():
    helptext = '''examples:
        collab-create-shared -a collab-testing -p pass12word -o mlkjr moliere
        collab-create-shared -a collab-testing -f collab -l testing -t google
            -p pass12word -o mlkjr moliere -s
        collab-create-shared --account collab-testing --password pass12word
            --owners mlkjr moliere
        collab-create-shared --acount collab-testing --password pass12word
            --owners mlkdir moliere --first_name collab --last_name testing
            --type box --secure

        Note: If first and last names are not provided, they will be set
            automatically using common delimiters
        '''

    parser = argparse.ArgumentParser(
        description='Creates shared accounts in collab services',
        epilog=helptext,
        formatter_class=argparse.RawDescriptionHelpFormatter
    )
    parser.add_argument(
        '--account',
        '-a',
        help='The account name to use.',
        required=True
    )
    parser.add_argument(
        '--password',
        '-p',
        help='The password to use for the account',
    )
    parser.add_argument(
        '--owners',
        '-o',
        help='Uniqname(s) of shared account owner(s)',
        nargs='+',
        default={}
    )
    parser.add_argument(
        '--service',
        '-s',
        help='The type of account(s) to create',
        choices=[
            'google',
            'box',
            'both'
        ],
        default='both'
    )
    parser.add_argument(
        '--first_name',
        '-f',
        help='The first name to use for the account',
    )
    parser.add_argument(
        '--last_name',
        '-l',
        help='The last name to use for the account',
    )
    parser.add_argument(
        '--secure',
        help='Secure the account for sensitive data',
        action='store_true'
    )
    parser.add_argument(
        '--config',
        '-c',
        help='The CAK config to use for Google operations',
        default='/etc/collab-admin-kit.yml'
    )
    args = parser.parse_args()

    # Open the CAK Config
    with open(args.config) as stream:
        config = yaml.load(stream, Loader=yaml.BaseLoader)

    # Get the root logger and set the debug level
    logger = logging.getLogger(__name__)
    logger.setLevel(logging.INFO)

    # Create a syslog handler, set format, and associate.
    sh = logging.handlers.SysLogHandler(
        address='/dev/log',
        facility=config['general']['log_facility']
    )
    formatter = logging.Formatter(config['general']['log_format'])
    sh.setFormatter(formatter)
    logger.addHandler(sh)

    # Create a console handler, set format, and associate.
    ch = logging.StreamHandler()
    formatter = logging.Formatter(
        config['general']['console_format'],
        config['general']['date_format']
    )
    ch.setFormatter(formatter)
    logger.addHandler(ch)

    if not args.password:
        pool = string.ascii_letters + string.digits + '!@#$%&*'
        args.password = ''.join(choice(pool) for i in range(12))

    sa = SharedAccount(vars(args), config)
    sa.set_up_mcommunity_group()
    sa.set_kerberos_password()
    if sa.service in ['box', 'both']:
        sa.create_box()
    if sa.service in ['google', 'both']:
        sa.create_google()
    pass_file_id = sa.upload_and_share_password()

    header_text = '''
Hello,

Your request has been completed. The password for your shared account
can be found at the following link:

https://docs.google.com/a/{}/file/d/{}

We recommend using a Chrome incognito window or separate browser to log
into your shared account. Please see below for more information about the
shared account created per your request:

General Account Information:
- Display Name: {}
- Username: {}
- Email Address: {}
'''.format(
        config['google']['domain'],
        pass_file_id,
        sa.full_name,
        sa.account,
        sa.email,
    )

    footer_text = '''
Single-Sign On is used for both Box and Google, and the method of changing
the password is the same for both. For information on changing the password,
please check the documentation found here:

https://documentation.its.umich.edu/node/339/#password

I will be closing this ticket now, as your request has been completed, but
feel free to reply back to this email if you have any questions or concerns
about your new account and the ticket will be re-opened.
'''

    print(
        '========== CANNED TEXT ==========',
        header_text,
        sa.box_text if hasattr(sa, 'box_text') else '',
        sa.google_text if hasattr(sa, 'google_text') else '',
        footer_text
    )


if __name__ == '__main__':
    main()