Package: cloudshell-user-sync
cloudshell-user-syncA CLI tool to Sync LDAP / Active Directory Groups with Cloudshell groups.
This package will pull LDAP data, compare state of cloudshell group, and add/remove users to sync the groups.Recommended to run job with OS level scheduler such asWindows Task SchedulerorLinux Cron Job.Important NotesThis package does NOT import/create users from LDAP - only syncs already imported users across groups.Users are NOT deleted from system during sync - only add/remove to group action performed.Users must be
firstmanually importedorauto-imported on loginto a default group.Non-imported cloudshell users will NOT be evicted from a synced group.This tool only aims to manage the imported ldap users.Groups can be hybrid with "regular" users.This tool can be configured to manage only a subset of cloudshell groups.If possible, to improve performance of LDAP search, place target ldap users together under common root in LDAP Tree.This will allow to set a lower base
rootDistinguished Nameto allow quicker ldap searches.Note that LDAP groups and users are not necessarily in same location of ldap tree. The Base DN must be where the
users are not the groups.InstallationInstall with pip or download from Github releasespip install cloudshell-user-syncRecommended to install into dedicatedvenvmkdir user-sync-venv
cd user-sync-venv
venv .
cd Scripts
activate
pip install cloudshell-user-syncCommandsCommands:
  config      View or Set Config - Pass no params to view config
  credential  Set Credentials For Cloudshell and LDAP           
  mapping     Set LDAP group --> Cloudshell Groups Mapping      
  run         Pull LDAP Data and sync to Cloudshell
  version     Display CLI versionBasic UsageConfigure venv and install packageconfigure credentials (stored in OS specific credential manager)set config values for target cloudshell serverSet config values for target LDAP serverset LDAP -> Cloudshell Group MappingsDo manual sync run to testConfigure scheduled task to run automaticallyConfigure CredentialsSet Cloudshell Credentialusersync credential admin admin --target cloudshellSet LDAP Credentialusersync credential CN=Administrator,CN=Users,DC=samplecorp,DC=example,DC=com LDAP_DN_Password --target ldapLDAP User is the
fullDistinguished NameTo find DN can useAD ExplorerorLDAP ExplorerSet Config ValuesCredentials must be set through CLI to be stored in credential manager.
The other values can be set directly in file or optionally in CLIDefault Config Path:Windows: C:\ProgramData\QualiSystems\CloudshellUserSync\ldap_config.jsonLinux: /opt/CloudshellUserSync/ldap_config.jsonView current config state by runningusersync config:{"service_config":{"job_frequency_seconds":30,"log_level":"DEBUG"},"cloudshell_details":{"user":"admin","password":"************","server":"192.168.85.114","domain":"Global"},"ldap_details":{"user_dn":"CN=Administrator,CN=Users,DC=testcorp,DC=example,DC=com","password":"************","server":"192.168.85.115","base_dn":"DC=testcorp,DC=example,DC=com"},"ldap_mappings":[{"ldap_dn":"CN=testgroup,DC=testcorp,DC=example,DC=com","cloudshell_groups":["QA"]}]}CLI Set config actions follows the pattern:usersync config <target> <key> <value>Set cloudshell server details:usersync config cloudshell server localhostSet LDAP details:usersync config ldap server 10.0.0.7
usersync config ldap base_dn DC=samplecorp,DC=example,DC=combase_dn is where the ldap search will start fromFilter scheme used is:(&(objectClass=user)(memberOf=<GROUP_DN>))Set LDAP mappingsCan map one LDAP source group to multiple cloudshell groups (ie a list)View only mapping config:usersync mappingSet mapping follows pattern:usersync mapping <LDAP_GROUP_DN> --csgroups <CSGROUP1>,<CSGROUP2>,<CSGROUP3>sample:usersync mapping CN=nattigroup,DC=natticorp,DC=example,DC=com --csgroups <CSGROUP1>,<CSGROUP2>,<CSGROUP3>Configure Scheduled TaskTo set command to run automatically with OS level scheduler.Get path to "usersync.exe" executable installed in venv and schedule theruncommandpath-to-usersync.exe runWindows Scheduled TaskConfigure Task Scheduler according
toarticleLinux Cron JobConfigure according toarticleService creationRun scheduler uses the schedule module to run job infinitely at configured frequency.Set the job frequency seconds in configconfigure therunschedulercommand intonssmorsystemdAlternatively, for windows, see the pythonutil installscript optionusersync.exe will be installed inside python/Scripts of python environmentRunscheduler command (give full path to exe)usersync.exe runschedulerLogsBoth manual runs and scheduled runs log to the same rotating log file.Windows:C:\ProgramData\QualiSystems\CloudshellUserSync\Logs\UserSync.logLinux:/opt/CloudshellUserSync/Logs/UserSync.logDependenciescloudshell-automation-apito update cloudshell groupsLDAP3for pulling source LDAP/AD dataScheduleas cross-platform cron-like schedulerKeyringto store credentials in OSDacitefor json to dataclass conversionPywin32- windows service installer util scriptLicenseFree Software: MIT License