Initial import

3 files changed, 808 insertions, 0 deletions

diff --git a/Backend.py b/Backend.py
new file mode 100644
index 0000000..6dc5497
--- /dev/null
+++ b/Backend.py
@@ -0,0 +1,393 @@
+#!/usr/bin/env python
+
+from __future__ import with_statement
+import sys, os, time, re
+import threading, mutex
+import SocketServer, StringIO
+import ldap, ldif
+
+debug = 0
+
+OPERATIONS_ERROR 		= 0x01
+PROTOCOL_ERROR			= 0x02
+TIMELIMIT_EXCEEDED		= 0x03
+SIZELIMIT_EXCEEDED		= 0x04
+COMPARE_FALSE			= 0x05
+COMPARE_TRUE			= 0x06
+AUTH_METHOD_NOT_SUPPORTED	= 0x07
+STRONG_AUTH_NOT_SUPPORTED	= 0x07
+STRONG_AUTH_REQUIRED		= 0x08
+STRONGER_AUTH_REQUIRED		= 0x08
+PARTIAL_RESULTS			= 0x09
+ADMINLIMIT_EXCEEDED		= 0x0b
+CONFIDENTIALITY_REQUIRED	= 0x0d
+SASL_BIND_IN_PROGRESS		= 0x0e
+NO_SUCH_ATTRIBUTE		= 0x10
+UNDEFINED_TYPE			= 0x11
+INAPPROPRIATE_MATCHING		= 0x12
+CONSTRAINT_VIOLATION		= 0x13
+TYPE_OR_VALUE_EXISTS		= 0x14
+INVALID_SYNTAX			= 0x15
+NO_SUCH_OBJECT			= 0x20
+ALIAS_PROBLEM			= 0x21
+INVALID_DN_SYNTAX		= 0x22
+IS_LEAF				= 0x23
+ALIAS_DEREF_PROBLEM		= 0x24
+X_PROXY_AUTHZ_FAILURE		= 0x2F
+INAPPROPRIATE_AUTH		= 0x30
+INVALID_CREDENTIALS		= 0x31
+INSUFFICIENT_ACCESS		= 0x32
+BUSY				= 0x33
+UNAVAILABLE			= 0x34
+UNWILLING_TO_PERFORM		= 0x35
+LOOP_DETECT			= 0x36
+NAMING_VIOLATION		= 0x40
+OBJECT_CLASS_VIOLATION		= 0x41
+NOT_ALLOWED_ON_NONLEAF		= 0x42
+NOT_ALLOWED_ON_RDN		= 0x43
+ALREADY_EXISTS			= 0x44
+NO_OBJECT_CLASS_MODS		= 0x45
+RESULTS_TOO_LARGE		= 0x46
+AFFECTS_MULTIPLE_DSAS		= 0x47
+OTHER_ERROR			= 0x50
+
+def split_argument(line):
+	parts = line.strip().split(':', 2)
+	name = parts[0].strip()
+	value = ""
+	if len(parts) == 2:
+		value = parts[1].strip()
+	return (name, value)
+
+
+class Parser(ldif.LDIFParser):
+	def __init__(self, input):
+		ldif.LDIFParser.__init__(self, input)
+		self.dn = None
+		self.entry = None
+	def handle(self, dn, entry):
+		if self.entry is None:
+			self.dn = dn
+			self.entry = entry
+
+
+class Database:
+	def __init__(self, suffix):
+		self.suffix = suffix
+		self.binddn = None
+		self.remote = None
+		self.mutex = threading.Lock()
+
+	# Overridable to handle specific command
+	def add(self, dn, entry):
+		raise VirtualError, (UNWILLING_TO_PERFORM, "Add not implemented")
+	def bind(self, dn, args):
+		raise VirtualError, (UNWILLING_TO_PERFORM, "Bind not implemented")
+	def compare(self, dn, entry):
+		raise VirtualError, (UNWILLING_TO_PERFORM, "Compare not implemented")
+	def delete(self, dn, args):
+		raise VirtualError, (UNWILLING_TO_PERFORM, "Delete not implemented")
+	def modify(self, dn, modlist):
+		raise VirtualError, (UNWILLING_TO_PERFORM, "Modify not implemented")
+	def modrdn(self, dn, args):
+		raise VirtualError, (UNWILLING_TO_PERFORM, "ModRDN not implemented")
+	def search(self, dn, args):
+		raise VirtualError, (UNWILLING_TO_PERFORM, "Search not implemented")
+
+	# Overridable to handle all processing
+	def process(self, command, dn, block):
+		try:
+
+			# This we handle specially
+			if command == "MODIFY":
+				return self.process_modify_internal(dn, block)
+
+			# This we handle specially
+			elif command == "ADD":
+				return self.process_add_internal(dn, block)
+
+			# All the rest we split up, multiple args go into arrays
+			args = Arguments()
+			while True:
+				line = block.readline()
+				if len(line) == 0:
+					break
+				(name, value) = split_argument(line)
+				args.add(name, value)
+
+			if command == "BIND":
+				self.bind(dn, args)
+			elif command == "COMPARE":
+				result = self.compare(dn, args)
+				return (result, "", None)
+			elif command == "DELETE":
+				self.delete(dn, args)
+			elif command == "MODIFY":
+				self.modify(dn, args)
+			elif command == "MODRDN":
+				self.modrdn(dn, args)
+			elif command == "SEARCH":
+				return self.process_search_internal(dn, args)
+			elif command == "UNBIND":
+				assert False # should have been handled in caller
+			else:
+				return UNWILLING_TO_PERFORM, "Unsupported operation %s" % command
+
+			return (0, "", [])
+
+		except Error, ex:
+			return (ex.code, ex.info, None)
+
+	def process_locked(self, command, dn, block, binddn, remote):
+		with self.mutex:
+			self.binddn = binddn
+			self.remote = remote
+			result = self.process(command, dn, block)
+		return result
+
+	def process_add_internal(self, dn, block):
+		parser = Parser(block)
+		parser.parse()
+		self.add(dn, parser.entry)
+		return (0, "", [])
+
+
+	def process_compare_intersal(self, dn, block):
+		parser = Parser(block)
+		parser.parse()
+		result = self.compare(dn, parser.entry)
+		return (result, "", [])
+
+
+	def process_search_internal(self, dn, args):
+		results = []
+		data = self.search(args["base"] or dn, args)
+		for (dn, entry) in data:
+			result = StringIO.StringIO()
+			writer = ldif.LDIFWriter(result)
+			writer.unparse(dn, entry)
+			results.append(result.getvalue())
+		return (0, "", results)
+
+
+	def process_modify_internal(self, dn, block):
+
+		op = None
+		attr = None
+		batch = 0
+		mods = []
+
+		while True:
+			line = block.readline()
+			if len(line) == 0:
+				break
+			line = line.strip()
+
+			# A break between different mods
+			if line == "-":
+
+				# Latch batch was empty, delete/replace all
+				if batch == 0:
+					if op == ldap.MOD_DELETE:
+						mods.append((op, attr, None))
+					elif op == ldap.MOD_REPLACE:
+						mods.append((op, attr, None))
+
+				batch = 0
+				op = None
+				attr = None
+				continue
+
+			# The current line
+			(name, value) = split_argument(line)
+
+			# Don't have a mod type yet
+			if op is None:
+				attr = value
+				if name == "add":
+					op = ldap.MOD_ADD
+				elif name == "replace":
+					op = ldap.MOD_REPLACE
+				elif name == "delete":
+					op = ldap.MOD_DELETE
+				else:
+					op = None
+
+			# Have a op, add values
+			elif name == attr:
+				assert attr is not None
+				mods.append((op, attr, value))
+				batch += 1
+
+		print mods
+		self.modify(dn, mods)
+		return (0, "", [])
+
+
+class Error(Exception):
+	"""Exception to be returned to server"""
+
+	def __init__(self, code = OPERATIONS_ERROR, info = ""):
+		self.code = code
+		self.info = info
+
+	def __str__(self):
+		return "%d: %s" % (self.code, self.info)
+
+class Arguments:
+	def __init__(self):
+		self.dict = {}
+	def add(self, name, value):
+		if self.dict.has_key(name):
+			if type(self.dict[name]) != type([]):
+				self.dict[name] = [self.dict[name]]
+				self.dict[name].append(value)
+			else:
+				self.dict[name] = value
+
+		self.dict[name] = value
+	def __getitem__(self, name):
+		if self.dict.has_key(name):
+			return self.dict[name]
+		return None
+	def __len__(self):
+		return len(self.dict)
+
+class Connection(SocketServer.BaseRequestHandler):
+
+	def __init__(self, request, client_address, server):
+		server.unique += 1
+		self.identifier = server.unique
+		self.block_regex = re.compile("\r?\n[ \t]*\r?\n")
+		SocketServer.BaseRequestHandler.__init__(self, request, client_address, server)
+
+	def trace(self, message):
+		global debug
+		if debug:
+			prefix = "%04d " % self.identifier
+			lines = message.split("\n")
+			print >> sys.stderr, prefix + lines[0]
+			print >> sys.stderr, "\n".join([prefix + "*** " + line for line in lines[1:]])
+
+	def handle(self):
+
+		self.trace("CONNECTED")
+
+		req = self.request
+		req.setblocking(1)
+		req.settimeout(None)
+
+		extra = ""
+		block = None
+		while True:
+			data = extra + req.recv(1024)
+
+			# End of connection
+			if len(data) == 0:
+				break
+
+			parts = self.block_regex.split(data)
+			if len(parts) > 1:
+				block = unicode(parts[0], "utf-8", "strict")
+				break
+			extra = parts[0]
+
+		if block:
+			self.trace("REQUEST\n%s\n" % block)
+			self.handle_block(req, StringIO.StringIO(block))
+
+		self.trace("DISCONNECTING")
+		self.request.close()
+
+	def handle_block(self, req, block):
+
+		line = block.readline()
+		command = line.strip()
+
+		# Disconnect immediately on certain occasions
+		if not command:
+			return False
+		elif command == "UNBIND":
+			return False
+
+		suffixes = []
+		binddn = None
+		remote = None
+		ssf = None
+		msgid = None
+		dn = None
+
+		while True:
+			off = block.tell()
+
+			line = block.readline()
+			(name, value) = split_argument(line)
+
+			if name == "suffix":
+				suffixes.append(value)
+			elif name == "msgid" and msgid is None:
+				msgid = value
+			elif name == "dn" and dn is None:
+				dn = value.lower()
+			elif name == "binddn" and binddn is None:
+				binddn = value.lower()
+			elif name == "peername" and remote is None:
+				remote = value
+			elif name == "ssf" and ssf is None:
+				ssf = value
+			else: # Return this line and continue
+				block.seek(off)
+				break
+
+		code = 0
+		info = ""
+		data = None
+
+		if len(suffixes) == 0:
+			code = OPERATIONS_ERROR
+			info = "No suffix specified"
+		elif len(suffixes) > 1:
+			code = OPERATIONS_ERROR
+			info = "Multiple suffixes not supported"
+		else:
+			database = self.server.find_database(suffixes[0])
+			(code, info, data) = database.process_locked(command, dn, block, binddn, remote)
+
+		if data:
+			for dat in data:
+				self.trace("DATA\n%s\n" % dat)
+				req.sendall(dat.strip("\n") + "\n\n")
+
+		result = "RESULT"
+		if info:
+			result += "\ninfo: %s" % info
+		# BUG: Current OpenLDAP always wants code last
+		result += "\ncode: %d" % code
+		self.trace("RESPONSE\n%s" % result.strip("\n"))
+		req.sendall(result)
+
+		return True
+
+
+class Server(SocketServer.ThreadingMixIn, SocketServer.UnixStreamServer):
+	daemon_threads = True
+	allow_reuse_address = True
+
+	def __init__(self, address, DatabaseClass, debug = False):
+		if (os.path.exists(address)):
+			os.unlink(address)
+		SocketServer.UnixStreamServer.__init__(self, address, Connection)
+		self.DatabaseClass = DatabaseClass
+		self.__databases = {}
+		self.unique = 0
+
+	def find_database(self, suffix):
+		suffix = suffix.lower()
+		if self.__databases.has_key(suffix):
+			database = self.__databases[suffix]
+		else:
+			database = self.DatabaseClass(suffix)
+			self.__databases[suffix] = database
+		return database
+
+
diff --git a/Pivot.py b/Pivot.py
new file mode 100644
index 0000000..28cea92
--- /dev/null
+++ b/Pivot.py
@@ -0,0 +1,397 @@
+#!/usr/bin/env python
+
+import ldap, ldap.dn, ldap.filter
+import Backend, sets
+
+HOST = "ldap://localhost:3890"
+BINDDN = "cn=root,dc=fam"
+PASSWORD = "barn"
+BASE = "dc=fam"
+REF_ATTRIBUTE = "member"
+KEY_ATTRIBUTE = "uid"
+TAG_ATTRIBUTE = "memberOf"
+
+OBJECT_CLASS = "groupOfNames"
+DN_ATTRIBUTE = "cn"
+
+# hasSubordinates: TRUE
+
+SCOPE_BASE = "0"
+SCOPE_ONE = "1"
+SCOPE_SUB = "2"
+
+class Storage:
+	def __init__(self, url):
+		self.url = url
+		self.ldap = None
+
+	def __connect(self, force = False):
+		if self.ldap:
+			if not force:
+				return
+			self.ldap.unbind()
+		self.ldap = ldap.initialize(self.url)
+		try:
+			self.ldap.simple_bind_s(BINDDN, PASSWORD)
+		except ldap.LDAPError, ex:
+			raise Backend.Error(Backend.OPERATIONS_ERROR,
+			                    "Couldn't do internal authenticate: %s" % ex.args[0]["desc"])
+
+	def read(self, dn, filtstr = "(objectClass=*)", attrs = None, retries = 1):
+		try:
+			self.__connect()
+			results = self.ldap.search_s(dn, ldap.SCOPE_BASE, filtstr, attrs, 0)
+
+			if not results:
+				return None
+			(dn, entry) = results[0]
+			return entry
+
+		except ldap.SERVER_DOWN, ex:
+			if retries <= 0:
+				raise sys.exc_type, sys.exc_value, sys.exc_traceback
+			self.__connect(True)
+			return self.read(dn, filtstr, attrs, retries - 1)
+
+	def search(self, base, filtstr, attrs = [], retries = 1):
+		try:
+			self.__connect()
+			return self.ldap.search_s(base, ldap.SCOPE_SUBTREE, filtstr, attrs, 0)
+
+		except ldap.SERVER_DOWN, ex:
+			if retries <= 0:
+				raise sys.exc_type, sys.exc_value, sys.exc_traceback
+			self.__connect(True)
+			return self.search(base, filtstr, attrs, retries - 1)
+
+	def modify(self, dn, mods, retries = 1):
+		try:
+			self.__connect()
+			self.ldap.modify_s(dn, mods)
+
+		except ldap.SERVER_DOWN, ex:
+			if retries <= 0:
+				raise sys.exc_type, sys.exc_value, sys.exc_traceback
+			self.__connect(True)
+			self.modify(dn, mods, retries - 1)
+
+
+class Static:
+    def __init__(self, func):
+        self.__call__ = func
+
+class Tags:
+	def __init__(self, database, tags):
+		self.database = database
+		self.tags = tags
+
+	def __refresh(self, force = False):
+		if not force and self.tags is not None:
+			return
+		try:
+			results = self.database.storage.search(BASE, "(%s=*)" % TAG_ATTRIBUTE, [TAG_ATTRIBUTE])
+
+			tags = { }
+			for (dn, entry) in results:
+				for attr in entry.values():
+					for value in attr:
+						tags[value] = DN_ATTRIBUTE
+			self.tags = tags
+
+		except ldap.LDAPError, ex:
+			raise Backend.Error(Backend.OPERATIONS_ERROR,
+			                    "Couldn't search ldap for keys: %s" % ex.args[0]["desc"])
+
+	def __len__(self):
+		self.__refresh()
+		return len(self.tags)
+	def __getitem__(self, k):
+		self.__refresh()
+		return self.tags[k]
+	def __setitem__(self, k):
+		assert False
+	def __delitem__(self, k):
+		assert False
+	def __contains__(self, k):
+		self.__refresh()
+		return k in self.tags
+	def __iter__(self):
+		self.__refresh()
+		return iter(self.tags)
+	def items(self):
+		self.__refresh()
+		return self.tags.items()
+
+
+	def from_dn(dn):
+		try:
+			parsed = ldap.dn.str2dn(dn)
+		except ValueError:
+			raise Backend.Error(Backend.Error.PROTOCOL_ERROR, "invalid dn: %s" % dn)
+		return Tags.from_parsed_dn(parsed)
+	from_dn = Static(from_dn)
+
+	def from_parsed_dn(parsed):
+		tags = { }
+		for (typ, val, num) in parsed[0]:
+			tags[val] = typ
+		return Tags(None, tags)
+	from_parsed_dn = Static(from_parsed_dn)
+
+	def from_database(database):
+		return Tags(database, None)
+	from_database = Static(from_database)
+
+
+def is_parsed_dn_parent (dn, parent):
+	if len(dn) <= len(parent):
+		return False
+	# Go backwards and validate each parent
+	for i in range(-1, -1 - len(parent)):
+		print i, dn[i], parent[i]
+		if dn[i] != parent[i]:
+			return False
+	return True
+
+class Database(Backend.Database):
+	def __init__(self, suffix):
+		Backend.Database.__init__(self, suffix)
+		self.storage = Storage(HOST)
+		try:
+			self.suffix_dn = ldap.dn.str2dn(self.suffix)
+		except ValueError:
+			raise Backend.Error(Backend.Error.PROTOCOL_ERROR, "invalid suffix dn")
+
+	def __search_tag_keys(self, tags):
+
+		if not len(tags):
+			return []
+
+		# Build up a filter
+		filter = [ldap.filter.filter_format("(%s=%s)", (TAG_ATTRIBUTE, tag)) for tag in tags]
+		if len(filter) > 1:
+			filter = "(&" + "".join(filter) + ")"
+		else:
+			filter = filter[0]
+
+		try:
+			# Search for all those guys
+			results = self.storage.search(BASE, filter, [ KEY_ATTRIBUTE ])
+
+		except ldap.LDAPError, ex:
+			raise Backend.Error(Backend.OPERATIONS_ERROR,
+			                    "Couldn't search ldap for tags: %s" % ex.args[0]["desc"])
+
+		return [entry[KEY_ATTRIBUTE][0] for (dn, entry) in results if entry[KEY_ATTRIBUTE]]
+
+
+	def __search_key_dns(self, key):
+
+		# Build up a filter
+		filter = ldap.filter.filter_format("(%s=%s)", (KEY_ATTRIBUTE, key))
+
+		try:
+			# Do the actual search
+			results = self.storage.search(BASE, filter)
+
+		except ldap.LDAPError, ex:
+			raise Backend.Error(Backend.OPERATIONS_ERROR,
+			                    "Couldn't search ldap for keys: %s" % ex.args[0]["desc"])
+
+		return [dn for (dn, entry) in results if dn]
+
+
+	def __build_root_entry(self, tags, any_attrs = True):
+		attrs = {
+			"objectClass" : [ "top" ],
+			"hasSubordinates" : [  ]
+		}
+
+		for (typ, val, num) in self.suffix_dn[0]:
+			if not attrs.has_key(typ):
+				attrs[typ] = [ ]
+			attrs[typ].append(val)
+
+		# Note that we don't access 'tags' unless attributes requested
+		if any_attrs:
+			attrs["hasSubordinates"].append(tags and "FALSE" or "TRUE")
+
+		return (self.suffix, attrs)
+
+
+	def __build_pivot_entry(self, tags, any_attrs = True):
+		attrs = {
+			REF_ATTRIBUTE : [ ],
+			"objectClass" : [ OBJECT_CLASS ],
+			"hasSubordinates" : [ "FALSE" ]
+		}
+
+		# Build up a DN, and relevant attrs
+		rdn = []
+		for tag, typ in tags.items():
+			rdn.append((typ, tag, 1))
+			if not attrs.has_key(typ):
+				attrs[typ] = [ ]
+			attrs[typ].append(tag)
+		dn = [ rdn ]
+		dn.extend(self.suffix_dn)
+		dn = ldap.dn.dn2str(dn)
+
+		# Get out all the attributes
+		if any_attrs:
+			for key in self.__search_tag_keys(tags):
+				attrs[REF_ATTRIBUTE].append(key)
+
+		return (dn, attrs)
+
+
+
+	def __limit_results(self, args, results):
+		# TODO: Support sizelimit
+		# TODO: Support a filter
+
+		# Only return the attribute names?
+		if args["attrsonly"] == "1":
+			for (dn, attrs) in results:
+				for attr in attrs:
+					attrs[attr] = [ "" ]
+
+		# Only return these attributes?
+		which = args["attrs"]
+		if which != "all" and which != "*" and which != "+":
+			which = which.split(" ")
+			for (dn, attrs) in results:
+				for attr in attrs.keys():
+					if attr not in which:
+						del attrs[attr]
+
+
+	def search(self, dn, args):
+		results = []
+
+		try:
+			parsed = ldap.dn.str2dn(dn)
+		except:
+			raise Backend.Error(Backend.PROTOCOL_ERROR, "Invalid dn in search: %s" % dn)
+
+		# Arguments sent
+		scope = args["scope"] or SCOPE_BASE
+		any_attrs = len(args["attrs"].strip()) > 0
+
+		# Start at the root
+		if parsed == self.suffix_dn:
+			tags = Tags.from_database(self)
+			if scope == SCOPE_BASE or scope == SCOPE_SUB:
+				results.append(self.__build_root_entry(tags, any_attrs))
+			if scope == SCOPE_ONE or scope == SCOPE_SUB:
+				# Process each tag individually, by default
+				for (tag, typ) in tags.items():
+					results.append(self.__build_pivot_entry({ tag : typ }, any_attrs))
+
+		# Start at a tag
+		elif is_parsed_dn_parent (parsed, self.suffix_dn):
+			tags = Tags.from_parsed_dn(parsed)
+			if scope == SCOPE_BASE or scope == SCOPE_SUB:
+				results.append(self.__build_pivot_entry(tags, any_attrs))
+
+		# We don't have that base
+		else:
+			raise Backend.Error(Backend.NO_SUCH_OBJECT, "DN '%s' does not exist" % dn)
+
+		self.__limit_results(args, results)
+		return results
+
+
+	def __build_key_mods(self, key, tags, op, mods):
+		dns = self.__search_key_dns(key)
+		if not dns:
+			raise Backend.Error(Backend.CONSTRAINT_VIOLATION,
+			                    "Cannot find an entry for %s '%s'" % (KEY_ATTRIBUTE, key))
+		for dn in dns:
+			if not mods.has_key(dn):
+				mods[dn] = (key, [])
+			for tag in tags:
+				mods[dn][1].append((op, TAG_ATTRIBUTE, tag))
+
+	def modify(self, dn, mods):
+
+		try:
+			parsed = ldap.dn.str2dn(dn)
+		except:
+			raise Backend.Error(Backend.PROTOCOL_ERROR, "Invalid dn in modify: %s" % dn)
+
+		if dn == self.suffix:
+			raise Backend.Error(Backend.INSUFFICIENT_ACCESS,
+			                    "Cannot modify root dn of pivot area: %s" % dn)
+
+		if not is_parsed_dn_parent (parsed, self.suffix_dn):
+			raise Backend.Error(Backend.NO_SUCH_OBJECT,
+			                    "DN '%s' does not exist" % dn)
+
+		tags = Tags.from_parsed_dn(parsed)
+
+		add_keys = sets.Set()
+		remove_keys = sets.Set()
+		remove_all = False
+
+		# Parse out all the adds and removes
+		for (op, attr, value) in mods:
+
+			if attr != REF_ATTRIBUTE:
+				raise Backend.Error(Backend.CONSTRAINT_VIOLATION,
+						    "Cannot modify '%s' attribute" % attr)
+
+			if op == ldap.MOD_ADD:
+				if value:
+					add_keys.add(value)
+			elif op == ldap.MOD_REPLACE:
+				remove_all = True
+				if value:
+					add_keys.add(value)
+			elif op == ldap.MOD_DELETE:
+				if value:
+					remove_keys.add(value)
+				else:
+					remove_all = True
+			else:
+				continue
+
+		# Remove all of the ref attribute
+		if remove_all:
+			for key in self.__search_tag_keys (tags):
+				remove_keys.add(key)
+
+		# Make them all unique, and non conflicting
+		for key in add_keys.copy():
+			if key in remove_keys:
+				remove_keys.remove(key)
+				add_keys.remove(key)
+
+		# Change them to DNs, and build mods objects for each dn
+		keys_and_mods_by_dn = { }
+		for key in add_keys:
+			self.__build_key_mods(key, tags, ldap.MOD_ADD, keys_and_mods_by_dn)
+		for key in remove_keys:
+			self.__build_key_mods(key, tags, ldap.MOD_DELETE, keys_and_mods_by_dn)
+
+
+		# Now perform the actual actions, combining errors
+		errors = []
+		for (dn, (key, mod)) in keys_and_mods_by_dn.items():
+			try:
+				print dn, mod
+				self.storage.modify(dn, mod)
+			except (ldap.TYPE_OR_VALUE_EXISTS, ldap.NO_SUCH_ATTRIBUTE):
+				continue
+			except ldap.NO_SUCH_OBJECT:
+				errors.append(key)
+			except ldap.LDAPError, ex:
+				raise Backend.Error(Backend.OPERATIONS_ERROR,
+				                    "Couldn't perform one of the modifications: %s" % ex.args[0]["desc"])
+
+		# Send back errors
+		if errors:
+			raise Backend.Error(Backend.CONSTRAINT_VIOLATION,
+			                    "Couldn't change %s for %s" % (KEY_ATTRIBUTE, ", ".join(errors)))
+
+
diff --git a/slapd-pivot.py b/slapd-pivot.py
new file mode 100644
index 0000000..7eb1dab
--- /dev/null
+++ b/slapd-pivot.py
@@ -0,0 +1,18 @@
+#!/usr/bin/env python
+
+import sys
+import Backend, Pivot
+
+def run_server():
+	Backend.debug = True
+	server = Backend.Server("/tmp/pivot-slapd.sock", Pivot.Database)
+
+	try:
+		server.serve_forever()
+	except KeyboardInterrupt:
+		sys.exit(0)
+
+
+if __name__ == '__main__':
+	run_server()
+