Package: ethz-iam-webservice
ETHZ IAM WebserviceManage users, groups and various services of the ETH Identity and Access Management system (IAM).Command Line InterfaceWhen installing this module, theiamcommand is also installed. Thebasic parameters which are always needed– otherwise they will be asked interactivley – are:$iam-uadmin-username--passwordMY-SECRET-PASSWORDYou can also set these environment variables instead:$exportIAM_USERNAME=admin-username
$exportIAM_PASSWORD=MY-SECRET-PASSWORDGroup CLI$iamgroup--help# get extensive help text# create new group$iamgroup--newid-test-test-01--ag"ID SIS"-d'some test description'-tAD-tLDAPou=AGRL
$iamgroup<group-name># info about a group$iamgroup<group-name>-auser1-auser2# add new users$iamgroup<group-name>-ruser3-ruser4# remove usersUser CLIGet info about a user, as well as granting/revoking a service or setting its password:$iamuser--help
$iamuserusername
$iamuserusername--grant-serviceLDAPS,-gMailbox
$iamuserusername--revoke-serviceLDAPS,-rMailbox
$iamuserusername--set-password[-sLDAPS[-sMailbox]][--service-password$trengGehe1m]$iamuserusername--init-password# sets a random initial password for the userPersonGet info about a person (identity) and its users. You might either provide a username, a NPID or a email address.$iamperson--help
$iampersonusername
$iampersonsome.person@ethz.ch
$iamperson123445GuestCreate guests. For the new guest a new username will automatically be generated. This user gets LDAP and VPN service granted. Because by policy the VPN password needs to differ from the other passwords, the result will present the two initial passwords that are set shortly after creating the guest.CLI$iamguestget<username>
$iamguestnew--help
$iamguestnew-ffirstname-llastname-mfirst.last@unknown.org-d"my test guest"-hhost_username-a"Admingroup Name"{"firstName":"first","lastName":"last","mail ":"first.last@unknown.org","host ":"host_username","respAdminRole ":"Admingroup Name","description":"my test guest","dateOfBirth":"16.06.2000","guestTechnicalContact":"somebody@ethz.ch","notification":"To guest and host","hostOrg":"06006","startDate":"16.06.2021","endDate":"16.06.2022","username":"flast","npid":"3210159","init_ldap_password":"xxxxxxx",}Default values:--technicalContact / -cwill default to the email address of the host--notification / -nwill default to «gh», meaningguest andhost will be notified when a guest account expires.--startDate / -sis today.--endDate / -eis today + 1 year--dateOfBirth / -bis today's date in year 2000Extend guest. After a year, you might want to extend the validity of your guest by another year or by a specific number of months$iamguestextend<username># will extend the guest by 1 year$iamguestextend<username>-m6# extend it by today+6 months$iamguestextend<username>-e1.4.2022# extend it until April 1st. 2022$iamguestextend<username>-e2022-04-01# same thing, different date formatAPI SynopsisLoginimport ethz_iam_webservice
import getpass

e = ethz_iam_webservice.login('admin4iam', getpass.getpass())Personperson = e.get_person('name@example.com')
person = e.get_person('some_username')
person = e.get_person(123456)             # npid (internal Person identifier)

person.usernames                          # an array of dicts of usernames
person.data                               # raw webservice response
person.firstname
person.lastname
person.email
# etc.User and Servicesuser = person.new_user('username', 'password', 'description')
user = e.get_user('username')
user.services                             # an array of dicts of services

user.grant_service("LDAPS")
user.grant_service("Active Directory")
user.grant_service("Mailbox")
user.grant_service("WLAN_VPN")

user.revoke_service("LDAPS")

user.delete()
user.add_to_group('groupname')
user.remove_from_group('groupname')Mailbox Serviceget service informationgs = user.get_service("Mailbox")
gs.data
{
  "sn": "Lastname",
  "givenName": "Firstname",
  "displayName": "neumond",
  "description": "this acccount is for creating moons",
  "mail": "neumond@ethz.ch",
  "isHidden": "false",
  "noMailReceive": "false",
  "quota": "5GB",
  "homeDrive": null,
  "homeDirectory": "\\\\\\\\d.ethz.ch\\\\users\\\\all\\\\neumond",
  "profilePath": "\\\\\\\\d.ethz.ch\\\\users\\\\all\\\\neumond\\\\%pafs",
  "unixHomeDirectory": "unixHomeDirectory",
  "loginShell": "/bin/bash",
  "primaryGroup": "Domain Users",
  "unifiedMessagingTask": null,
  "telephoneNumber": null,
  "proxyAddresses": [
    "SMTP:neumond@ethz.ch",
    "smtp:neumond@intern.ethz.ch"
  ]
}set a email-forward, descriptiongs.forward_address = 'neumond@example.com'
gs.description = 'some new description'
gs.save()Group and Group Membersget single group- returns a Group object or throws a ValueError if group is not foundgroup = e.new_group(
    name        = 'group-name',
    description = 'something meaningful',
    admingroup  = 'ID SIS',              # responsible admin group
    targets     = ['AD', 'LDAPS'],       # please specify at least one target system
    members     = ['user1', 'user2']
)

group = e.get_group('groupname')
group = e.get_group(123456)              # gidNumber
group.data                               # all data received from webservice
group.members                            # returns array of usernames or group-names
group.gidNumber
group.<attribute>add/remove group membersgroup.add_members('some', 'new', 'members')
group.set_members('just', 'these')
group.del_members('remove', 'these', 'members')search for groups- Result is always a list of groups or an empty listgroups = e.get_groups(agroup='ID SIS')
groups = e.get_groups(name='starts_with*')
groups = e.get_groups(agroup='ID SIS', name='starts_with*')Mailinglistsml = e.get_mailinglist('ID.SIS.SSDM')
ml = e.get_mailinglist('sis@id.ethz.ch')
ml.name
ml.mail
ml.gidNumber
ml.groupType
ml.displayName
...

ml.members        # returns all (direct) members of that list
ml.add_members('user1', 'user2')
ml.del_members('user3, 'user4')See alsoFAQ