#!/bin/bash
# Zimbra to Samba/LDAP user replication script
# (c) Copyright Agileware Pty Ltd. All rights reserved. http://agileware.net
# http://www.gnu.org/licenses/gpl-2.0.txt
 
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
 
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
 
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
#Never create these accounts - security precaution
BLACKLIST_ACCOUNTS="`cat /etc/passwd | awk -F: '{print $1}'`";
 
#Default password for new accounts, change this to suit
DEFAULT_PASSWD='AABBccddee';
 
LOGFILE="/var/log/zimbra-samba-ldap.log";
echo "Starting" >> $LOGFILE;
 
#use zmaccts and extract only the email address from the result
ZIMBRA_ACCOUNTS="`su - zimbra --command=/opt/zimbra/bin/zmaccts | grep '@' | grep 'active' | awk '{print $1}'`";
SAMBA_ACCOUNTS="`smbldap-userlist`";
 
for ZIMBRA_ACCOUNT in $ZIMBRA_ACCOUNTS; do
  echo "$ZIMBRA_ACCOUNT : checking" >> $LOGFILE;
  # Construct account name - remove @. Might be a bit dodgy - but faster than a zmprov call for existing SAMBA accounts
  USER_NAME=${ZIMBRA_ACCOUNT%@*};
  echo "Checking $USER_NAME";
  BLASCKLIST_ACCOUNT_TRUE=`echo "$BLACKLIST_ACCOUNTS" | grep -ic "$USER_NAME"`;
  if [ $BLASCKLIST_ACCOUNT_TRUE -eq 0 ]; then
  SAMBA_ACCOUNT_EXISTS=`echo "$SAMBA_ACCOUNTS" | grep -ic "$USER_NAME"`;
 
  # Remove this line to delete any previously created accounts. Debugging only.
  # smbldap-userdel "$USER_NAME";
 
  # See if the SAMBA account exists, if not then get all attributes and create it
  if [ $SAMBA_ACCOUNT_EXISTS -eq 0 ]; then
    echo "$ZIMBRA_ACCOUNT : No samba account exists" >> $LOGFILE;
 
    # Get all attributes for this account, slow as zmprov has to initiate
    ZIMBRA_ACCOUNT_DETAILS="`su - zimbra --command='/opt/zimbra/bin/zmprov ga '$ZIMBRA_ACCOUNT''`";
    IS_SYSTEM_ACCOUNT=`echo "$ZIMBRA_ACCOUNT_DETAILS" | grep 'zimbraIsSystemResource'`;
 
    # Skip the Wiki, Ham, Spam or other type of system accounts
    if [ -z "$IS_SYSTEM_ACCOUNT" ]; then
      echo "$ZIMBRA_ACCOUNT : Adding samba account" >> $LOGFILE;
      #USER_NAME=`echo "$ZIMBRA_ACCOUNT_DETAILS" | grep 'uid' | awk '{print $2}'`;
      USER_DISPLAYNAME=`echo "$ZIMBRA_ACCOUNT_DETAILS" | grep 'displayName' | awk '{print $2}'`;
      USER_FIRSTNAME=`echo "$ZIMBRA_ACCOUNT_DETAILS" | grep 'givenName' | awk '{print $2}'`;
      USER_SURNAME=`echo "$ZIMBRA_ACCOUNT_DETAILS" | grep 'sn' | awk '{print $2}'`;
      USER_EMAIL=$ZIMBRA_ACCOUNT;
 
      # Set new accounts options so that user can change password (A) and must change password (B)
      smbldap-useradd -m -A 1 -B 1 -a -M "$USER_EMAIL" -N "$USER_FIRSTNAME" -S "$USER_SURNAME" "$USER_NAME";
 
      # -M '$USER_EMAIL' option (email address) will raise this error:
      # failed to add entry: objectClass: value 0 invalid per syntax at /usr/sbin/smbldap-useradd line 516.
      # Solution requires the "misc.schema" to be included for localMailRecipient attribute.
      # See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505914
 
      echo "$ZIMBRA_ACCOUNT : Set default samba passwd" >> $LOGFILE;
      # Set a default Samba password
      # User forced to change the password on next login
      # Reference: http://www.opensubscriber.com/message/samba@lists.samba.org/1683978.html
 
      echo -n -e "$DEFAULT_PASSWD\n$DEFAULT_PASSWD" | smbldap-passwd "$USER_NAME";
      echo "$ZIMBRA_ACCOUNT : Samba account created" >> $LOGFILE;
    else
      echo "$ZIMBRA_ACCOUNT : Is system account. Skipping." >> $LOGFILE;
    fi
  else
    echo "$ZIMBRA_ACCOUNT : Samba account exists. Skipping." >> $LOGFILE;
  fi
  else
   echo "$ZIMBRA_ACCOUNT : Blacklisted account. Skipping." >> $LOGFILE;
  fi   
done;
 
echo "Completed" >> $LOGFILE;
 
#Check log for errors
if [ -f $LOGFILE ]; then
  ERROR=`grep -ic 'error' $LOGFILE`;
fi
 
if [ $ERROR -eq 0 ]; then
  # Completed OK if no errors in the log
  echo "No errors.";
else
  # Report that we failed
  echo "Errors.";
fi