Code cleanup of HBAC, Sudo rules

https://fedorahosted.org/freeipa/ticket/1515

6 files changed, 1030 insertions, 1191 deletions

diff --git a/install/ui/association.js b/install/ui/association.js
index 553966eb9..7db91ef9c 100644
--- a/install/ui/association.js
+++ b/install/ui/association.js
@@ -432,6 +432,7 @@ IPA.association_table_widget = function (spec) {
             $('.action-button', that.table).addClass('action-button-disabled');
             that.unselect_all();
         }
+        that.enabled = enabled;
     };
 
     that.select_changed = function() {
@@ -483,11 +484,13 @@ IPA.association_table_widget = function (spec) {
 
     that.load = function(result) {
         that.values = result[that.name] || [];
-        that.reset();
+        that.update();
         that.unselect_all();
     };
 
-    that.update = function() {
+    that.update = function(values) {
+
+        if(values) that.values = values;
 
         that.empty();
 
diff --git a/install/ui/field.js b/install/ui/field.js
index 850afceeb..2cba87864 100644
--- a/install/ui/field.js
+++ b/install/ui/field.js
@@ -577,6 +577,44 @@ IPA.link_field = function(spec) {
     return that;
 };
 
+IPA.enable_field = function(spec) {
+
+    spec = spec  || {};
+
+    var that = IPA.radio_field(spec);
+
+    that.enable_method = spec.enable_method || 'enable';
+    that.disable_method = spec.enable_method || 'disable';
+    that.enable_option = spec.enable_option || 'TRUE';
+
+    that.get_update_info = function() {
+
+        var info = IPA.update_info_builder.new_update_info();
+        if(that.test_dirty()) {
+            var values = that.save();
+            var method = that.disable_method;
+
+            if(values[0] === that.enable_option) {
+                method = that.enable_method;
+            }
+
+            var command = IPA.command({
+                entity: that.entity.name,
+                method: method,
+                args: that.entity.get_primary_key(),
+                options: {all: true, rights: true}
+            });
+
+
+            info.append_command(command, that.priority);
+        }
+
+        return info;
+    };
+
+    return that;
+};
+
 IPA.field_container = function(spec) {
 
     spec = spec || {};
@@ -686,3 +724,4 @@ IPA.field_factories['textarea'] = IPA.field;
 IPA.field_factories['entity_select'] = IPA.combobox_field;
 IPA.field_factories['combobox'] = IPA.combobox_field;
 IPA.field_factories['link'] = IPA.link_field;
+IPA.field_factories['enable'] = IPA.enable_field;
diff --git a/install/ui/hbac.js b/install/ui/hbac.js
index 31f789a84..cf13e459e 100644
--- a/install/ui/hbac.js
+++ b/install/ui/hbac.js
@@ -23,7 +23,11 @@
 
 /* REQUIRES: ipa.js, details.js, search.js, add.js, facet.js, entity.js */
 
-IPA.hbac = {};
+IPA.hbac = {
+    //priority of commands in details facet
+    remove_method_priority: IPA.config.default_priority - 1,
+    enable_priority: IPA.config.default_priority + 1
+};
 
 IPA.hbac.rule_entity = function(spec) {
 
@@ -40,7 +44,9 @@ IPA.hbac.rule_entity = function(spec) {
             ]
         }).
         details_facet({
-            factory: IPA.hbacrule_details_facet
+            factory: IPA.hbacrule_details_facet,
+            entity: that,
+            command_mode: 'info'
         }).
         adder_dialog({
             fields: [ 'cn' ]
@@ -70,7 +76,7 @@ IPA.hbac.service_entity = function(spec) {
                     fields: [
                         'cn',
                         {
-                            factory: IPA.textarea_widget,
+                            type: 'textarea',
                             name: 'description'
                         }
                     ]
@@ -105,7 +111,7 @@ IPA.hbac.service_entity = function(spec) {
             fields: [
                 'cn',
                 {
-                    factory: IPA.textarea_widget,
+                    type: 'textarea',
                     name: 'description'
                 }
             ]
@@ -135,7 +141,7 @@ IPA.hbac.service_group_entity = function(spec) {
                     fields: [
                         'cn',
                         {
-                            factory: IPA.textarea_widget,
+                            type: 'textarea',
                             name: 'description'
                         }
                     ]
@@ -169,7 +175,7 @@ IPA.hbac.service_group_entity = function(spec) {
             fields: [
                 'cn',
                 {
-                    factory: IPA.textarea_widget,
+                    type: 'textarea',
                     name: 'description'
                 }
             ]
@@ -181,395 +187,341 @@ IPA.hbac.service_group_entity = function(spec) {
 
 IPA.hbacrule_details_facet = function(spec) {
 
-    spec = spec || {};
-
-    var that = IPA.details_facet(spec);
+    var entity_name = spec.entity.name;
+
+    //
+    // General
+    //
+
+    spec.fields = [
+        {
+            name: 'cn',
+            read_only: true,
+            widget: 'general.cn'
+        },
+        {
+            type: 'textarea',
+            name: 'description',
+            widget: 'general.description'
+        },
+        {
+            type: 'enable',
+            name: 'ipaenabledflag',
+            priority: IPA.sudo.enable_priority,
+            widget: 'general.ipaenabledflag'
+        }
+    ];
 
-    function general_section(){
-        var section = IPA.details_table_section({
+    spec.widgets = [
+        {
+            type: 'details_table_section',
             name: 'general',
-            entity: that.entity,
-            label: IPA.messages.details.general
-        });
-
-        section.text({
-            name: 'cn'
-        });
-        section.textarea({
-            name: 'description'
-        });
-        section.radio({
-            name: 'ipaenabledflag',
-            options: [
-                { value: 'TRUE', label: IPA.get_message('true') },
-                { value: 'FALSE', label: IPA.get_message('false') }
+            label: IPA.messages.details.general,
+            widgets: [
+                {
+                    name: 'cn'
+                },
+                {
+                    type: 'textarea',
+                    name: 'description'
+                },
+                {
+                    type: 'enable',
+                    name: 'ipaenabledflag',
+                    options: [
+                        { value: 'TRUE', label: IPA.get_message('true') },
+                        { value: 'FALSE', label: IPA.get_message('false') }
+                    ]
+                }
             ]
-        });
-        return section;
-    }
-
+        }
+    ];
+
+    //
+    // Users
+    //
+
+    spec.fields.push(
+        {
+            type: 'radio',
+            name: 'usercategory',
+            widget: 'user.rule.usercategory'
+        },
+        {
+            type: 'rule_association_table',
+            name: 'memberuser_user',
+            widget: 'user.rule.memberuser_user',
+            priority: IPA.hbac.remove_method_priority
+        },
+        {
+            type: 'rule_association_table',
+            name: 'memberuser_group',
+            widget: 'user.rule.memberuser_group',
+            priority: IPA.hbac.remove_method_priority
+        }
+    );
 
-    function user_category_section(){
-        var section = IPA.rule_details_section({
+    spec.widgets.push(
+        {
+            factory: IPA.collapsible_section,
             name: 'user',
-            entity: that.entity,
             label: IPA.messages.objects.hbacrule.user,
-            field_name: 'usercategory',
-            options: [
-                { value: 'all', label: IPA.messages.objects.hbacrule.anyone },
-                { value: '',
-                  label: IPA.messages.objects.hbacrule.specified_users }
-            ],
-            tables: [
-                { field_name: 'memberuser_user' },
-                { field_name: 'memberuser_group' }
+            widgets: [
+                {
+                    factory: IPA.rule_details_widget,
+                    name: 'rule',
+                    radio_name: 'usercategory',
+                    options: [
+                        { value: 'all',
+                        label: IPA.messages.objects.hbacrule.anyone },
+                        { value: '',
+                        label: IPA.messages.objects.hbacrule.specified_users }
+                    ],
+                    tables: [
+                        { name: 'memberuser_user' },
+                        { name: 'memberuser_group' }
+                    ],
+                    widgets: [
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-memberuser_user',
+                            name: 'memberuser_user',
+                            add_method: 'add_user',
+                            remove_method: 'remove_user',
+                            add_title: IPA.messages.association.add.member,
+                            remove_title: IPA.messages.association.remove.member
+                        },
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-memberuser_group',
+                            name: 'memberuser_group',
+                            add_method: 'add_user',
+                            remove_method: 'remove_user',
+                            add_title: IPA.messages.association.add.member,
+                            remove_title: IPA.messages.association.remove.member
+                        }
+                    ]
+                }
             ]
-        });
+        }
+    );
+
+    //
+    // Hosts
+    //
+
+    spec.fields.push(
+        {
+            type: 'radio',
+            name: 'hostcategory',
+            widget: 'host.rule.hostcategory'
+        },
+        {
+            type: 'rule_association_table',
+            name: 'memberhost_host',
+            widget: 'host.rule.memberhost_host',
+            priority: IPA.hbac.remove_method_priority
+        },
+        {
+            type: 'rule_association_table',
+            name: 'memberhost_hostgroup',
+            widget: 'host.rule.memberhost_hostgroup',
+            priority: IPA.hbac.remove_method_priority
+        }
+    );
 
-        section.add_field(IPA.radio_widget({
-            name: 'usercategory'
-        }));
-        section.add_field(IPA.association_table_widget({
-            id: that.entity.name+'-memberuser_user',
-            name: 'memberuser_user',
-            entity: that.entity,
-            add_method: 'add_user',
-            remove_method: 'remove_user',
-            add_title: IPA.messages.association.add.member,
-            remove_title: IPA.messages.association.remove.member
-        }));
-        section.add_field(IPA.association_table_widget({
-            id: that.entity.name+'-memberuser_group',
-            name: 'memberuser_group',
-            entity: that.entity,
-            add_method: 'add_user',
-            remove_method: 'remove_user',
-            add_title: IPA.messages.association.add.member,
-            remove_title: IPA.messages.association.remove.member
-        }));
-        return section;
-    }
-
-    function hostcategory_section(){
-        var section = IPA.rule_details_section({
+    spec.widgets.push(
+        {
+            factory: IPA.collapsible_section,
             name: 'host',
             label: IPA.messages.objects.hbacrule.host,
-            entity: that.entity,
-            field_name: 'hostcategory',
-            options: [
-                { value: 'all', label: IPA.messages.objects.hbacrule.any_host },
-                { value: '',
-                  label: IPA.messages.objects.hbacrule.specified_hosts }
-            ],
-            tables: [
-                { field_name: 'memberhost_host' },
-                { field_name: 'memberhost_hostgroup' }
-        ]
-        });
-
-        section.add_field(IPA.radio_widget({
-            name: 'hostcategory'
-        }));
-        section.add_field(IPA.association_table_widget({
-            id: that.entity.name+'-memberhost_host',
-            name: 'memberhost_host',
-            entity: that.entity,
-            add_method: 'add_host',
-            remove_method: 'remove_host',
-            add_title: IPA.messages.association.add.member,
-            remove_title: IPA.messages.association.remove.member
-        }));
-        section.add_field(IPA.association_table_widget({
-            id: that.entity.name+'-memberhost_hostgroup',
-            name: 'memberhost_hostgroup',
-            entity: that.entity,
-            add_method: 'add_host',
-            remove_method: 'remove_host',
-            add_title: IPA.messages.association.add.member,
-            remove_title: IPA.messages.association.remove.member
-        }));
-        return section;
-    }
-
-    function servicecategory_section(){
-        var section = IPA.rule_details_section({
-            name: 'service',
-            entity: that.entity,
-            label: IPA.messages.objects.hbacrule.service,
-            field_name: 'servicecategory',
-            options: [
-                { value: 'all',
-                  label: IPA.messages.objects.hbacrule.any_service },
-                { value: '',
-                  label: IPA.messages.objects.hbacrule.specified_services }
-            ],
-            tables: [
-                { field_name: 'memberservice_hbacsvc' },
-                { field_name: 'memberservice_hbacsvcgroup' }
+            widgets: [
+                {
+                    factory: IPA.rule_details_widget,
+                    name: 'rule',
+                    radio_name: 'hostcategory',
+                    options: [
+                        {
+                            'value': 'all',
+                            'label': IPA.messages.objects.hbacrule.any_host
+                        },
+                        {
+                            'value': '',
+                            'label': IPA.messages.objects.hbacrule.specified_hosts
+                        }
+                    ],
+                    tables: [
+                        { 'name': 'memberhost_host' },
+                        { 'name': 'memberhost_hostgroup' }
+                    ],
+                    widgets: [
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-memberuser_user',
+                            name: 'memberhost_host',
+                            add_method: 'add_host',
+                            remove_method: 'remove_host',
+                            add_title: IPA.messages.association.add.member,
+                            remove_title: IPA.messages.association.remove.member
+                        },
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-memberuser_group',
+                            name: 'memberhost_hostgroup',
+                            add_method: 'add_host',
+                            remove_method: 'remove_host',
+                            add_title: IPA.messages.association.add.member,
+                            remove_title: IPA.messages.association.remove.member
+                        }
+                    ]
+                }
             ]
-        });
-
-        section.add_field(IPA.radio_widget({
-            name: 'servicecategory'
-        }));
-        section.add_field(IPA.association_table_widget({
-            id: that.entity.name+'-memberservice_hbacsvc',
+        }
+    );
+
+    //
+    // Service
+    //
+
+    spec.fields.push(
+        {
+            type: 'radio',
+            name: 'servicecategory',
+            widget: 'service.rule.servicecategory'
+        },
+        {
+            type: 'rule_association_table',
             name: 'memberservice_hbacsvc',
-            entity: that.entity,
-            add_method: 'add_service',
-            remove_method: 'remove_service',
-            add_title: IPA.messages.association.add.member,
-            remove_title: IPA.messages.association.remove.member
-        }));
-        section.add_field(IPA.association_table_widget({
-            id: that.entity.name+'-memberservice_hbacsvcgroup',
+            widget: 'service.rule.memberservice_hbacsvc',
+            priority: IPA.hbac.remove_method_priority
+        },
+        {
+            type: 'rule_association_table',
             name: 'memberservice_hbacsvcgroup',
-            entity: that.entity,
-            add_method: 'add_service',
-            remove_method: 'remove_service',
-            add_title: IPA.messages.association.add.member,
-            remove_title: IPA.messages.association.remove.member
-        }));
-        return section;
-    }
-
-    function sourcehostcategory_section(){
-        var section = IPA.rule_details_section({
-            name: 'sourcehost',
-            entity: that.entity,
-            label: IPA.messages.objects.hbacrule.sourcehost,
-            field_name: 'sourcehostcategory',
-            options: [
-                { value: 'all', label: IPA.messages.objects.hbacrule.any_host },
-                { value: '',
-                  label: IPA.messages.objects.hbacrule.specified_hosts }
-            ],
-            tables: [
-                { field_name: 'sourcehost_host' },
-                { field_name: 'sourcehost_hostgroup' }
-            ]
-        });
+            widget: 'service.rule.memberservice_hbacsvcgroup',
+            priority: IPA.hbac.remove_method_priority
+        }
+    );
 
-        section.add_field(IPA.radio_widget({
-            name: 'sourcehostcategory'
-        }));
-        section.add_field(IPA.association_table_widget({
-            id: that.entity.name+'-sourcehost_host',
+    spec.widgets.push(
+    {
+            factory: IPA.collapsible_section,
+            name: 'service',
+            label: IPA.messages.objects.hbacrule.service,
+            widgets: [
+                {
+                    factory: IPA.rule_details_widget,
+                    name: 'rule',
+                    radio_name: 'servicecategory',
+                    options: [
+                        { 'value': 'all', 'label': IPA.messages.objects.hbacrule.any_host },
+                        { 'value': '', 'label': IPA.messages.objects.hbacrule.specified_hosts }
+                    ],
+                    tables: [
+                        { 'name': 'memberservice_hbacsvc' },
+                        { 'name': 'memberservice_hbacsvcgroup' }
+                    ],
+                    widgets: [
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-memberuser_user',
+                            name: 'memberservice_hbacsvc',
+                            add_method: 'add_service',
+                            remove_method: 'remove_service',
+                            add_title: IPA.messages.association.add.member,
+                            remove_title: IPA.messages.association.remove.member
+                        },
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-memberuser_group',
+                            name: 'memberservice_hbacsvcgroup',
+                            add_method: 'add_service',
+                            remove_method: 'remove_service',
+                            add_title: IPA.messages.association.add.member,
+                            remove_title: IPA.messages.association.remove.member
+                        }
+                    ]
+                }
+            ]
+        }
+    );
+
+    //
+    // Source host
+    //
+
+    spec.fields.push(
+        {
+            type: 'radio',
+            name: 'sourcehostcategory',
+            widget: 'sourcehost.rule.sourcehostcategory'
+        },
+        {
+            type: 'rule_association_table',
             name: 'sourcehost_host',
-            entity: that.entity,
-            add_method: 'add_sourcehost',
-            remove_method: 'remove_sourcehost',
-            add_title: IPA.messages.association.add.sourcehost,
-            remove_title: IPA.messages.association.remove.sourcehost
-        }));
-        section.add_field(IPA.association_table_widget({
-            id: that.entity.name+'-sourcehost_hostgroup',
+            widget: 'sourcehost.rule.sourcehost_host',
+            priority: IPA.hbac.remove_method_priority
+        },
+        {
+            type: 'rule_association_table',
             name: 'sourcehost_hostgroup',
-            entity: that.entity,
-            add_method: 'add_sourcehost',
-            remove_method: 'remove_sourcehost',
-            add_title: IPA.messages.association.add.sourcehost,
-            remove_title: IPA.messages.association.remove.sourcehost
-        }));
-        return section;
-    }
-
-    that.update = function(on_success, on_error) {
-
-        var args = that.get_primary_key();
-
-        var modify_operation = {
-            'execute': false,
-            'command': IPA.command({
-                entity: that.entity.name,
-                method: 'mod',
-                args: args,
-                options: {all: true, rights: true}
-            })
-        };
-
-        var categories = {
-            'usercategory': {
-                'remove_values': false
-            },
-            'hostcategory': {
-                'remove_values': false
-            },
-            'servicecategory': {
-                'remove_values': false
-            },
-            'sourcehostcategory': {
-                'remove_values': false
-            }
-        };
-
-        var member_operations = {
-            'memberuser': {
-                'category': 'usercategory',
-                'has_values': false,
-                'command': IPA.command({
-                    entity: that.entity.name,
-                    method: 'remove_user',
-                    args: args,
-                    options: {all: true, rights: true}
-                })
-            },
-            'memberhost': {
-                'category': 'hostcategory',
-                'has_values': false,
-                'command': IPA.command({
-                    entity: that.entity.name,
-                    method: 'remove_host',
-                    args: args,
-                    options: {all: true, rights: true}
-                })
-            },
-            'memberservice': {
-                'category': 'servicecategory',
-                'has_values': false,
-                'command': IPA.command({
-                    entity: that.entity.name,
-                    method: 'remove_service',
-                    args: args,
-                    options: {all: true, rights: true}
-                })
-            },
-            'sourcehost': {
-                'category': 'sourcehostcategory',
-                'has_values': false,
-                'command': IPA.command({
-                    entity: that.entity.name,
-                    method: 'remove_sourcehost',
-                    args: args,
-                    options: {all: true, rights: true}
-                })
-            }
-        };
-
-        var enable_operation = {
-            'execute': false,
-            'command': IPA.command({
-                entity: that.entity.name,
-                method: 'enable',
-                args: args,
-                options: {all: true, rights: true}
-            })
-        };
-
-        var record = {};
-        that.save(record);
-
-        var sections = that.sections.values;
-        for (var i=0; i<sections.length; i++) {
-            var section = sections[i];
-
-            var section_fields = section.fields.values;
-            for (var j=0; j<section_fields.length; j++) {
-                var field = section_fields[j];
-
-                // association tables are never dirty, so call
-                // is_dirty() after checking table values
-
-                var values = record[field.name];
-                if (!values) continue;
-
-                var metadata = field.metadata;
-
-                // skip primary key
-                if (metadata && metadata.primary_key) continue;
-
-                var p = field.name.indexOf('_');
-                if (p >= 0) {
-                    // prepare command to remove members if needed
-                    var attribute = field.name.substring(0, p);
-                    var other_entity = field.name.substring(p+1);
-
-                    if (values.length) {
-                        member_operations[attribute].command.set_option(other_entity, values.join(','));
-                        member_operations[attribute].has_values = true;
-                    }
-                    continue;
-                }
-
-                // skip unchanged field
-                if (!field.is_dirty()) continue;
-
-                // check enable/disable
-                if (field.name == 'ipaenabledflag') {
-                    if (values[0] == 'FALSE') enable_operation.command.method = 'disable';
-                    enable_operation.execute = true;
-                    continue;
-                }
-
-                if (categories[field.name]) {
-                    if (values[0] == 'all') {
-                        categories[field.name].remove_values = true;
-                    }
-                }
-
-                if (metadata) {
-                    if (values.length == 1) {
-                        modify_operation.command.set_option(field.name, values[0]);
-                    } else if (field.join) {
-                        modify_operation.command.set_option(field.name, values.join(','));
-                    } else {
-                        modify_operation.command.set_option(field.name, values);
-                    }
-
-                } else {
-                    if (values.length) {
-                        modify_operation.command.set_option('setattr', field.name+'='+values[0]);
-                    } else {
-                        modify_operation.command.set_option('setattr', field.name+'=');
-                    }
-                    for (var l=1; l<values.length; l++) {
-                        modify_operation.command.set_option('addattr', field.name+'='+values[l]);
-                    }
-                }
-
-                modify_operation.execute = true;
-            }
+            widget: 'sourcehost.rule.sourcehost_hostgroup',
+            priority: IPA.hbac.remove_method_priority
         }
+    );
 
-        var batch = IPA.batch_command({
-            'name': 'hbac_details_update',
-            'on_success': function(data, text_status, xhr) {
-                that.refresh();
-                if (on_success) on_success.call(this, data, text_status, xhr);
-            },
-            'on_error': function(xhr, text_status, error_thrown) {
-                that.refresh();
-                if (on_error) on_error.call(this, xhr, text_status, error_thrown);
-            }
-        });
-
-        for (var member_attribute in member_operations) {
-            var member_operation = member_operations[member_attribute];
-            if (member_operation.has_values &&
-                categories[member_operation.category].remove_values) {
-                batch.add_command(member_operations[member_attribute].command);
-            }
+    spec.widgets.push(
+    {
+            factory: IPA.collapsible_section,
+            name: 'sourcehost',
+            label: IPA.messages.objects.hbacrule.sourcehost,
+            widgets: [
+                {
+                    factory: IPA.rule_details_widget,
+                    name: 'rule',
+                    radio_name: 'sourcehostcategory',
+                    options: [
+                        { 'value': 'all', 'label': IPA.messages.objects.hbacrule.any_host },
+                        { 'value': '', 'label': IPA.messages.objects.hbacrule.specified_hosts }
+                    ],
+                    tables: [
+                        { 'name': 'sourcehost_host' },
+                        { 'name': 'sourcehost_hostgroup' }
+                    ],
+                    widgets: [
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-memberuser_user',
+                            name: 'sourcehost_host',
+                            add_method: 'add_sourcehost',
+                            remove_method: 'remove_sourcehost',
+                            add_title: IPA.messages.association.add.sourcehost,
+                            remove_title: IPA.messages.association.remove.sourcehost
+                        },
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-memberuser_group',
+                            name: 'sourcehost_hostgroup',
+                            add_method: 'add_sourcehost',
+                            remove_method: 'remove_sourcehost',
+                            add_title: IPA.messages.association.add.sourcehost,
+                            remove_title: IPA.messages.association.remove.sourcehost
+                        }
+                    ]
+                }
+            ]
         }
+    );
 
+    var that = IPA.details_facet(spec);
 
-        if (modify_operation.execute) batch.add_command(modify_operation.command);
-        if (enable_operation.execute) batch.add_command(enable_operation.command);
-
-        if (!batch.commands.length) {
-            that.refresh();
-            return;
-        }
-
-        batch.execute();
+    that.on_update_success = function(data, text_status, xhr) {
+        that.refresh();
     };
 
-    /*initialization*/
-    that.add_section(general_section());
-    that.add_section(user_category_section());
-    that.add_section(hostcategory_section());
-    that.add_section(servicecategory_section());
-    that.add_section(sourcehostcategory_section());
-
+    that.on_update_error = function(xhr, text_status, error_thrown) {
+        that.refresh();
+    };
 
     return that;
 };
diff --git a/install/ui/rule.js b/install/ui/rule.js
index 9f8e23187..003785bcd 100644
--- a/install/ui/rule.js
+++ b/install/ui/rule.js
@@ -22,84 +22,187 @@
 
 /* REQUIRES: ipa.js, details.js, search.js, add.js, facet.js, entity.js */
 
-IPA.rule_details_section = function(spec) {
+IPA.rule_details_widget = function(spec) {
 
     spec = spec || {};
 
-    var that = IPA.details_section(spec);
+    var that = IPA.composite_widget(spec);
 
-    that.field_name = spec.field_name;
+    that.radio_name = spec.radio_name;
     that.options = spec.options || [];
     that.tables = spec.tables || [];
     that.columns = spec.columns;
 
-    that.create = function(container) {
+    that.init = function() {
 
-        that.container = container;
+        that.enable_radio = IPA.radio_widget({
+            name: that.radio_name,
+            options: that.options
+        });
+
+        that.widgets.add_widget(that.enable_radio);
+        that.enable_radio.value_changed.attach(that.on_enable_radio_changed);
+    };
+
+    that.on_enable_radio_changed = function(value) {
+        if(value.length > 0) {
+            var enabled = ('' === value[0]);
+            for (var i=0; i<that.tables.length; i++) {
+                var table = that.tables[i];
+
+                var table_widget = that.widgets.get_widget(table.name);
+                table_widget.set_enabled(enabled);
+            }
+        }
+    };
 
-        var field = that.fields.get_field(that.field_name);
-        var metadata = IPA.get_entity_param(that.entity.name, that.field_name);
+    that.create = function(container) {
 
-        container.append(metadata.doc+':');
+        that.container = container;
 
-        var span = $('<span/>', {
-            name: that.field_name,
-            title: metadata.doc,
+        //enable radios
+        var param_info = IPA.get_entity_param(that.entity.name, that.radio_name);
+        var title = param_info ? param_info.doc : that.radio_name;
+        var enable_radio_container = $('<div/>', {
+            name: that.radio_name,
+            title: title,
             'class': 'field'
         }).appendTo(container);
 
+        enable_radio_container.append(title+': ');
+        that.enable_radio.create(enable_radio_container);
 
+        //tables
+        for (var j=0; j<that.tables.length; j++) {
+            var table = that.tables[j];
 
-        function update_tables(value) {
-            var enabled = ('' === value);
-            for (var i=0; i<that.tables.length; i++) {
-                var table = that.tables[i];
+            var metadata = IPA.get_entity_param(that.entity.name, table.name);
 
-                var field = that.fields.get_field(table.field_name);
-                field.set_enabled(enabled);
-            }
+            var table_container = $('<div/>', {
+                name: table.name,
+                title: metadata ? metadata.doc : table.name,
+                'class': 'field'
+            }).appendTo(container);
+
+            var widget = that.widgets.get_widget(table.name);
+            widget.create(table_container);
         }
+    };
+
+    that.init();
+
+    return that;
+};
+
+
+IPA.rule_association_table_widget = function(spec) {
+
+    spec = spec || {};
+
+    var that = IPA.association_table_widget(spec);
+
+    that.external = spec.external;
+
+    that.enabled = spec.enabled !== undefined ? spec.enabled : true;
 
-        if (that.options.length) {
-            var category = that.fields.get_field(that.field_name);
-            category.options=that.options;
-            category.reset = function() {
-                category.widget_reset();
-                var values = category.save();
-                if (values.length === 0){
-                    return;
-                }
-                var value = values[0];
-                update_tables(value);
-            };
-            category.create(span);
-
-            var inputs = $('input[name='+that.field_name+']', container);
-            inputs.change(function() {
-                var input = $(this);
-                var value = input.val();
-                update_tables(value);
-            });
+    that.create_add_dialog = function() {
+
+        var entity_label = that.entity.metadata.label_singular;
+        var pkey = IPA.nav.get_state(that.entity.name+'-pkey');
+        var other_entity_label = IPA.metadata.objects[that.other_entity].label;
+
+        var title = that.add_title;
+        title = title.replace('${entity}', entity_label);
+        title = title.replace('${primary_key}', pkey);
+        title = title.replace('${other_entity}', other_entity_label);
+
+        return IPA.rule_association_adder_dialog({
+            title: title,
+            pkey: pkey,
+            other_entity: that.other_entity,
+            attribute_member: that.attribute_member,
+            entity: that.entity,
+            external: that.external,
+            exclude: that.values
+        });
+    };
+
+    return that;
+};
+
+IPA.rule_association_table_field = function(spec) {
+
+    spec = spec || {};
+
+    var that = IPA.field(spec);
+
+    that.load = function(result) {
+        that.values = result[that.name] || [];
+        if (that.external) {
+            var external_values = result[that.external] || [];
+            $.merge(that.values, external_values);
         }
 
+        that.widget.update(that.values);
+        that.widget.unselect_all();
+    };
 
+    that.get_update_info = function() {
 
-        for (var j=0; j<that.tables.length; j++) {
-            var table = that.tables[j];
+        var update_info = IPA.update_info_builder.new_update_info();
 
-            metadata = IPA.get_entity_param(that.entity.name, table.field_name);
+        //association_table_widget performs basic add and remove operation
+        //immediately. Rule association field test if its enabled and if not it
+        //performs delete operation.
 
-            var table_span = $('<span/>', {
-                name: table.field_name,
-                title: metadata ? metadata.doc : table.field_name,
-                'class': 'field'
-            }).appendTo(span);
+        if (!that.widget.enabled) {
+            var values = that.save();
 
-            field = that.fields.get_field(table.field_name);
-            field.create(table_span);
+            if (values.length > 0) { //no need to delete if has no values
+
+                var command = IPA.command({
+                    entity: that.entity.name,
+                    method: that.widget.remove_method,
+                    args: that.entity.get_primary_key(),
+                    options: {all: true, rights: true}
+                });
+
+                command.set_option(that.widget.other_entity, values.join(','));
+                update_info.append_command(command, that.priority);
+            }
         }
 
+        return update_info;
+    };
+
+    return that;
+};
+
+IPA.widget_factories['rule_association_table'] = IPA.rule_association_table_widget;
+IPA.field_factories['rule_association_table'] = IPA.rule_association_table_field;
 
+IPA.rule_association_adder_dialog = function(spec) {
+
+    spec = spec || {};
+
+    var that = IPA.association_adder_dialog(spec);
+
+    that.external = spec.external;
+
+    that.add = function() {
+        var rows = that.available_table.remove_selected_rows();
+        that.selected_table.add_rows(rows);
+
+        if (that.external) {
+            var pkey_name = IPA.metadata.objects[that.other_entity].primary_key;
+            var value = that.external_field.val();
+            if (!value) return;
+
+            var record = {};
+            record[pkey_name] = value;
+            that.selected_table.add_record(record);
+            that.external_field.val('');
+        }
     };
 
     return that;
diff --git a/install/ui/sudo.js b/install/ui/sudo.js
index 01bb3eed1..6e7aeca26 100644
--- a/install/ui/sudo.js
+++ b/install/ui/sudo.js
@@ -22,7 +22,11 @@
 
 /* REQUIRES: ipa.js, details.js, search.js, add.js, facet.js, entity.js */
 
-IPA.sudo = {};
+IPA.sudo = {
+    //priority of commands in details facet
+    remove_method_priority: IPA.config.default_priority - 1,
+    enable_priority: IPA.config.default_priority + 1
+};
 
 IPA.sudo.rule_entity = function(spec) {
 
@@ -38,7 +42,9 @@ IPA.sudo.rule_entity = function(spec) {
             ]
         }).
         details_facet({
-            factory: IPA.sudorule_details_facet
+            factory: IPA.sudorule_details_facet,
+            entity: that,
+            command_mode: 'info'
         }).
         adder_dialog({
             fields: [ 'cn' ]
@@ -68,7 +74,7 @@ IPA.sudo.command_entity = function(spec) {
                     fields: [
                         'sudocmd',
                         {
-                            factory: IPA.textarea_widget,
+                            type: 'textarea',
                             name: 'description'
                         }
                     ]
@@ -103,7 +109,7 @@ IPA.sudo.command_entity = function(spec) {
             fields: [
                 'sudocmd',
                 {
-                    factory: IPA.textarea_widget,
+                    type: 'textarea',
                     name: 'description'
                 }
             ]
@@ -133,7 +139,7 @@ IPA.sudo.command_group_entity = function(spec) {
                     fields: [
                         'cn',
                         {
-                            factory: IPA.textarea_widget,
+                            type: 'textarea',
                             name: 'description'
                         }
                     ]
@@ -167,7 +173,7 @@ IPA.sudo.command_group_entity = function(spec) {
             fields: [
                 'cn',
                 {
-                    factory: IPA.textarea_widget,
+                    type: 'textarea',
                     name: 'description'
                 }
             ]
@@ -179,34 +185,77 @@ IPA.sudo.command_group_entity = function(spec) {
 
 IPA.sudorule_details_facet = function(spec) {
 
-    spec = spec || {};
-
-    var that = IPA.details_facet(spec);
+    var entity_name = spec.entity.name;
+
+    //
+    // General
+    //
+
+    spec.fields = [
+        {
+            name: 'cn',
+            read_only: true,
+            widget: 'general.cn'
+        },
+        {
+            type: 'textarea',
+            name: 'description',
+            widget: 'general.description'
+        },
+        {
+            type: 'enable',
+            name: 'ipaenabledflag',
+            priority: IPA.sudo.enable_priority,
+            widget: 'general.ipaenabledflag'
+        }
+    ];
 
-    function general_section(){
-        var section = IPA.details_table_section({
+    spec.widgets = [
+        {
+            type: 'details_table_section',
             name: 'general',
             label: IPA.messages.details.general,
-            entity: that.entity,
-            facet: that
-        });
-
-        section.text({
-            name: 'cn'
-        });
-        section.textarea({
-            name: 'description'
-        });
-        section.radio({
-            name: 'ipaenabledflag',
-            options: [
-                { value: 'TRUE', label: IPA.get_message('true') },
-                { value: 'FALSE', label: IPA.get_message('false') }
+            widgets: [
+                {
+                    name: 'cn'
+                },
+                {
+                    type: 'textarea',
+                    name: 'description'
+                },
+                {
+                    type: 'enable',
+                    name: 'ipaenabledflag',
+                    options: [
+                        { value: 'TRUE', label: IPA.get_message('true') },
+                        { value: 'FALSE', label: IPA.get_message('false') }
+                    ]
+                }
             ]
-        });
-        return section;
-    }
+        }
+    ];
+
+    //
+    // Options
+    //
+
+    spec.fields.push.apply(spec.fields, [
+        {
+            name: 'ipasudoopt',
+            widget: 'options.ipasudoopt'
+        }
+    ]);
+
+    spec.widgets.push.apply(spec.widgets, [
+        {
+            factory: IPA.sudo.options_section,
+            name: 'options',
+            label: IPA.messages.objects.sudorule.options,
+            facet: that
+        }
+    ]);
 
+/*
     function options_section(){
         var section = IPA.sudo.options_section({
             name: 'options',
@@ -215,313 +264,388 @@ IPA.sudorule_details_facet = function(spec) {
             facet: that
         });
         return section;
-    }
-
-
-    function user_section(){
-        var section = IPA.rule_details_section({
-            name: 'user',
-            label: IPA.messages.objects.sudorule.user,
-            field_name: 'usercategory',
-            entity: that.entity,
-            options: [
-                { value: 'all',
-                  label: IPA.messages.objects.sudorule.anyone },
-                { value: '',
-                  label: IPA.messages.objects.sudorule.specified_users }
-            ],
-            tables: [
-                { field_name: 'memberuser_user' },
-                { field_name: 'memberuser_group' }
-            ]
-        });
-
-        section.add_field(IPA.radio_widget({
-            entity: that.entity,
-            name: 'usercategory'
-        }));
-        section.add_field(IPA.sudorule_association_table_widget({
-            id: that.entity.name+'-memberuser_user',
-            entity: that.entity,
+    }*/
+
+    //
+    // Users
+    //
+
+    spec.fields.push(
+        {
+            type: 'radio',
+            name: 'usercategory',
+            widget: 'user.rule.usercategory'
+        },
+        {
+            type: 'rule_association_table',
             name: 'memberuser_user',
-            add_method: 'add_user',
-            remove_method: 'remove_user',
-            external: 'externaluser',
-            add_title: IPA.messages.association.add.member,
-            remove_title: IPA.messages.association.remove.member
-        }));
-        section.add_field(IPA.sudorule_association_table_widget({
-            id: that.entity.name+'-memberuser_group',
-            entity: that.entity,
+            widget: 'user.rule.memberuser_user',
+            priority: IPA.sudo.remove_method_priority
+        },
+        {
+            type: 'rule_association_table',
             name: 'memberuser_group',
-            add_method: 'add_user',
-            remove_method: 'remove_user',
-            add_title: IPA.messages.association.add.member,
-            remove_title: IPA.messages.association.remove.member
-        }));
-        return section;
-    }
+            widget: 'user.rule.memberuser_group',
+            priority: IPA.sudo.remove_method_priority
+        }
+    );
 
-    function host_section(){
-        var section = IPA.rule_details_section({
-            name: 'host',
-            entity: that.entity,
-            label: IPA.messages.objects.sudorule.host,
-            field_name: 'hostcategory',
-            options: [
-                { 'value': 'all', 'label': IPA.messages.objects.sudorule.any_host },
-                { 'value': '', 'label': IPA.messages.objects.sudorule.specified_hosts }
-            ],
-            tables: [
-                { 'field_name': 'memberhost_host' },
-                { 'field_name': 'memberhost_hostgroup' }
+    spec.widgets.push(
+        {
+            factory: IPA.collapsible_section,
+            name: 'user',
+            label: IPA.messages.objects.sudorule.user,
+            widgets: [
+                {
+                    factory: IPA.rule_details_widget,
+                    name: 'rule',
+                    radio_name: 'usercategory',
+                    options: [
+                        {
+                            value: 'all',
+                            label: IPA.messages.objects.sudorule.anyone
+                        },
+                        {
+                            value: '',
+                            label: IPA.messages.objects.sudorule.specified_users
+                        }
+                    ],
+                    tables: [
+                        { name: 'memberuser_user' },
+                        { name: 'memberuser_group' }
+                    ],
+                    widgets: [
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-memberuser_user',
+                            name: 'memberuser_user',
+                            add_method: 'add_user',
+                            remove_method: 'remove_user',
+                            external: 'externaluser',
+                            add_title: IPA.messages.association.add.member,
+                            remove_title: IPA.messages.association.remove.member
+                        },
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-memberuser_group',
+                            name: 'memberuser_group',
+                            add_method: 'add_user',
+                            remove_method: 'remove_user',
+                            add_title: IPA.messages.association.add.member,
+                            remove_title: IPA.messages.association.remove.member
+                        }
+                    ]
+                }
             ]
-        });
-
-        section.add_field(IPA.radio_widget({
-            entity: that.entity,
-            name: 'hostcategory'
-        }));
-        section.add_field(IPA.sudorule_association_table_widget({
-            id: that.entity.name+'-memberhost_host',
-            entity: that.entity,
+        }
+    );
+
+    //
+    // Hosts
+    //
+
+    spec.fields.push(
+        {
+            type: 'radio',
+            name: 'hostcategory',
+            widget: 'host.rule.hostcategory'
+        },
+        {
+            type: 'rule_association_table',
             name: 'memberhost_host',
-            add_method: 'add_host',
-            remove_method: 'remove_host',
-            external: 'externalhost',
-            add_title: IPA.messages.association.add.member,
-            remove_title: IPA.messages.association.remove.member
-        }));
-        section.add_field(IPA.sudorule_association_table_widget({
-            id: that.entity.name+'-memberhost_hostgroup',
-            entity: that.entity,
+            widget: 'host.rule.memberhost_host',
+            priority: IPA.sudo.remove_method_priority
+        },
+        {
+            type: 'rule_association_table',
             name: 'memberhost_hostgroup',
-            add_method: 'add_host',
-            remove_method: 'remove_host',
-            add_title: IPA.messages.association.add.member,
-            remove_title: IPA.messages.association.remove.member
-        }));
-        return section;
-    }
-
-
-    that.update = function(on_success, on_error) {
-
-        var args = that.get_primary_key();
-
-        var modify_operation = {
-            'execute': false,
-            'command': IPA.command({
-                entity: that.entity.name,
-                method: 'mod',
-                args: args,
-                options: {all: true, rights: true}
-            })
-        };
-
-        var categories = {
-            'usercategory': {
-                'remove_values': false
-            },
-            'hostcategory': {
-                'remove_values': false
-            },
-            'cmdcategory': {
-                'remove_values': false
-            },
-            'ipasudorunasusercategory': {
-                'remove_values': false
-            },
-            'ipasudorunasgroupcategory': {
-                'remove_values': false
-            }
-        };
-
-        var member_operations = {
-            'memberuser': {
-                'category': 'usercategory',
-                'has_values': false,
-                'command': IPA.command({
-                    entity: that.entity.name,
-                    method: 'remove_user',
-                    args: args,
-                    options: {all: true, rights: true}
-                })
-            },
-            'memberhost': {
-                'category': 'hostcategory',
-                'has_values': false,
-                'command': IPA.command({
-                    entity: that.entity.name,
-                    method: 'remove_host',
-                    args: args,
-                    options: {all: true, rights: true}
-                })
-            },
-            'memberallowcmd': {
-                'category': 'cmdcategory',
-                'has_values': false,
-                'command': IPA.command({
-                    entity: that.entity.name,
-                    method: 'remove_allow_command',
-                    args: args,
-                    options: {all: true, rights: true}
-                })
-            },
-            'ipasudorunas': {
-                'category': 'ipasudorunasusercategory',
-                'has_values': false,
-                'command': IPA.command({
-                    entity: that.entity.name,
-                    method: 'remove_runasuser',
-                    args: args,
-                    options: {all: true, rights: true}
-                })
-            },
-            'ipasudorunasgroup': {
-                'category': 'ipasudorunasgroupcategory',
-                'has_values': false,
-                'command': IPA.command({
-                    entity: that.entity.name,
-                    method: 'remove_runasgroup',
-                    args: args,
-                    options: {all: true, rights: true}
-                })
-            }
-        };
-
-        var enable_operation = {
-            'execute': false,
-            'command': IPA.command({
-                entity: that.entity.name,
-                method: 'enable',
-                args: args,
-                options: {all: true, rights: true}
-            })
-        };
-
-        var record = {};
-        that.save(record);
-
-        var sections = that.sections.values;
-        for (var i=0; i<sections.length; i++) {
-            var section = sections[i];
-
-            var section_fields = section.fields.values;
-            for (var j=0; j<section_fields.length; j++) {
-                var field = section_fields[j];
-
-                // association tables are never dirty, so call
-                // is_dirty() after checking table values
-
-                var values = record[field.name];
-                if (!values) continue;
-
-                var metadata = field.metadata;
-
-                // skip primary key
-                if (metadata && metadata.primary_key) continue;
-
-                var p = field.name.indexOf('_');
-                if (p >= 0) {
-                    // prepare command to remove members if needed
-                    var attribute = field.name.substring(0, p);
-                    var other_entity = field.name.substring(p+1);
-
-                    if (member_operations[attribute] && values.length) {
-                        member_operations[attribute].command.set_option(other_entity, values.join(','));
-                        member_operations[attribute].has_values = true;
-                    }
-                    continue;
-                }
-
-                // skip unchanged field
-                if (!field.is_dirty()) continue;
-
-                // check enable/disable
-                if (field.name == 'ipaenabledflag') {
-                    if (values[0] == 'FALSE') enable_operation.command.method = 'disable';
-                    enable_operation.execute = true;
-                    continue;
-                }
-
+            widget: 'host.rule.memberhost_hostgroup',
+            priority: IPA.sudo.remove_method_priority
+        }
+    );
 
-                if (categories[field.name] && values[0] == 'all') {
-                    categories[field.name].remove_values = true;
+    spec.widgets.push(
+    {
+            factory: IPA.collapsible_section,
+            name: 'host',
+            label: IPA.messages.objects.sudorule.host,
+            widgets: [
+                {
+                    factory: IPA.rule_details_widget,
+                    name: 'rule',
+                    radio_name: 'hostcategory',
+                    options: [
+                        {
+                            'value': 'all',
+                            'label': IPA.messages.objects.sudorule.any_host
+                        },
+                        {
+                            'value': '',
+                            'label': IPA.messages.objects.sudorule.specified_hosts
+                        }
+                    ],
+                    tables: [
+                        { 'name': 'memberhost_host' },
+                        { 'name': 'memberhost_hostgroup' }
+                    ],
+                    widgets: [
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-memberuser_user',
+                            name: 'memberhost_host',
+                            add_method: 'add_host',
+                            remove_method: 'remove_host',
+                            external: 'externalhost',
+                            add_title: IPA.messages.association.add.member,
+                            remove_title: IPA.messages.association.remove.member
+                        },
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-memberuser_group',
+                            name: 'memberhost_hostgroup',
+                            add_method: 'add_host',
+                            remove_method: 'remove_host',
+                            add_title: IPA.messages.association.add.member,
+                            remove_title: IPA.messages.association.remove.member
+                        }
+                    ]
                 }
+            ]
+        }
+    );
 
-                if (metadata) {
-                    if (values.length == 1) {
-                        modify_operation.command.set_option(field.name, values[0]);
-                    } else if (field.join) {
-                        modify_operation.command.set_option(field.name, values.join(','));
-                    } else {
-                        modify_operation.command.set_option(field.name, values);
-                    }
+    //
+    // Run Commands
+    //
 
-                } else {
-                    if (values.length) {
-                        modify_operation.command.set_option('setattr', field.name+'='+values[0]);
-                    } else {
-                        modify_operation.command.set_option('setattr', field.name+'=');
-                    }
-                    for (var k=1; k<values.length; k++) {
-                        modify_operation.command.set_option('addattr', field.name+'='+values[k]);
-                    }
+    spec.fields.push(
+        {
+            type: 'radio',
+            name: 'cmdcategory',
+            widget: 'command.rule.cmdcategory'
+        },
+        {
+            type: 'rule_association_table',
+            name: 'memberallowcmd_sudocmd',
+            widget: 'command.rule.memberallowcmd_sudocmd',
+            priority: IPA.sudo.remove_method_priority
+        },
+        {
+            type: 'rule_association_table',
+            name: 'memberallowcmd_sudocmdgroup',
+            widget: 'command.rule.memberallowcmd_sudocmdgroup',
+            priority: IPA.sudo.remove_method_priority
+        },
+        {
+            type: 'rule_association_table',
+            name: 'memberdenycmd_sudocmd',
+            widget: 'command.memberdenycmd_sudocmd',
+            priority: IPA.sudo.remove_method_priority
+        },
+        {
+            type: 'rule_association_table',
+            name: 'memberdenycmd_sudocmdgroup',
+            widget: 'command.memberdenycmd_sudocmdgroup',
+            priority: IPA.sudo.remove_method_priority
+        }
+    );
+
+    spec.widgets.push(
+        {
+            factory: IPA.collapsible_section,
+            name: 'command',
+            label: IPA.messages.objects.sudorule.command,
+            widgets: [
+                {
+                    factory: IPA.header_widget,
+                    name: 'allow_header',
+                    text: IPA.messages.objects.sudorule.allow,
+                    description: IPA.messages.objects.sudorule.allow
+                },
+                {
+                    factory: IPA.rule_details_widget,
+                    name: 'rule',
+                    radio_name: 'cmdcategory',
+                    options: [
+                        {
+                            value: 'all',
+                            label: IPA.messages.objects.sudorule.anyone
+                        },
+                        {
+                            value: '',
+                            label: IPA.messages.objects.sudorule.specified_users
+                        }
+                    ],
+                    tables: [
+                        { name: 'memberallowcmd_sudocmd' },
+                        { name: 'memberallowcmd_sudocmdgroup' }
+                    ],
+                    widgets: [
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-memberallowcmd_sudocmd',
+                            name: 'memberallowcmd_sudocmd',
+                            add_method: 'add_allow_command',
+                            remove_method: 'remove_allow_command',
+                            add_title: IPA.messages.association.add.memberallowcmd,
+                            remove_title: IPA.messages.association.remove.memberallowcmd
+                        },
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-memberallowcmd_sudocmdgroup',
+                            name: 'memberallowcmd_sudocmdgroup',
+                            add_method: 'add_allow_command',
+                            remove_method: 'remove_allow_command',
+                            add_title: IPA.messages.association.add.memberallowcmd,
+                            remove_title: IPA.messages.association.remove.memberallowcmd
+                        }
+                    ]
+                },
+                {
+                    factory: IPA.header_widget,
+                    name: 'deny_header',
+                    text: IPA.messages.objects.sudorule.deny,
+                    description: IPA.messages.objects.sudorule.deny
+                },
+                {
+                    type: 'rule_association_table',
+                    id: entity_name+'-memberdenycmd_sudocmd',
+                    name: 'memberdenycmd_sudocmd',
+                    add_method: 'add_deny_command',
+                    remove_method: 'remove_deny_command',
+                    add_title: IPA.messages.association.add.memberdenycmd,
+                    remove_title: IPA.messages.association.remove.memberdenycmd
+                },
+                {
+                    type: 'rule_association_table',
+                    id: entity_name+'-memberdenycmd_sudocmdgroup',
+                    name: 'memberdenycmd_sudocmdgroup',
+                    add_method: 'add_deny_command',
+                    remove_method: 'remove_deny_command',
+                    add_title: IPA.messages.association.add.memberdenycmd,
+                    remove_title: IPA.messages.association.remove.memberdenycmd
                 }
-
-                modify_operation.execute = true;
-            }
+            ]
         }
+    );
 
-        var batch = IPA.batch_command({
-            'name': 'sudorule_details_update',
-            'on_success': function(data, text_status, xhr) {
-                that.refresh();
-                if (on_success) on_success.call(this, data, text_status, xhr);
-            },
-            'on_error': function(xhr, text_status, error_thrown) {
-                that.refresh();
-                if (on_error) on_error.call(this, xhr, text_status, error_thrown);
-            }
-        });
+    //
+    // As whom
+    //
 
-        for (var member_attribute in member_operations) {
-            var member_operation = member_operations[member_attribute];
-            if (member_operation.has_values &&
-                categories[member_operation.category].remove_values) {
-                batch.add_command(member_operation.command);
-            }
+    spec.fields.push(
+        {
+            type: 'radio',
+            name: 'ipasudorunasusercategory',
+            widget: 'runas.runas_users.ipasudorunasusercategory'
+        },
+        {
+            type: 'rule_association_table',
+            name: 'ipasudorunas_user',
+            widget: 'runas.runas_users.ipasudorunas_user',
+            priority: IPA.sudo.remove_method_priority
+        },
+        {
+            type: 'rule_association_table',
+            name: 'ipasudorunas_group',
+            widget: 'runas.runas_users.ipasudorunas_group',
+            priority: IPA.sudo.remove_method_priority
+        },
+        {
+            type: 'radio',
+            name: 'ipasudorunasgroupcategory',
+            widget: 'runas.runas_groups.ipasudorunasgroupcategory'
+        },
+        {
+            type: 'rule_association_table',
+            name: 'ipasudorunasgroup_group',
+            widget: 'runas.runas_groups.ipasudorunasgroup_group',
+            priority: IPA.sudo.remove_method_priority
         }
-
-        if (modify_operation.execute) batch.add_command(modify_operation.command);
-        if (enable_operation.execute) batch.add_command(enable_operation.command);
-
-        if (!batch.commands.length) {
-            that.refresh();
-            return;
+    );
+
+    spec.widgets.push(
+        {
+            factory: IPA.collapsible_section,
+            name: 'runas',
+            label: IPA.messages.objects.sudorule.runas,
+            widgets: [
+                {
+                    factory: IPA.rule_details_widget,
+                    name: 'runas_users',
+                    radio_name: 'ipasudorunasusercategory',
+                    options: [
+                        { value: 'all', label: IPA.messages.objects.sudorule.anyone },
+                        { value: '', label: IPA.messages.objects.sudorule.specified_users }
+                    ],
+                    tables: [
+                        { name: 'ipasudorunas_user' },
+                        { name: 'ipasudorunas_group' }
+                    ],
+                    widgets: [
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-runasruser_user',
+                            name: 'ipasudorunas_user',
+                            external: 'ipasudorunasextuser',
+                            add_method: 'add_runasuser',
+                            remove_method: 'remove_runasuser',
+                            add_title: IPA.messages.association.add.ipasudorunas,
+                            remove_title: IPA.messages.association.remove.ipasudorunas
+                        },
+                        {
+                            type: 'rule_association_table',
+                            id: entity_name+'-runasuser_group',
+                            name: 'ipasudorunas_group',
+                            add_method: 'add_runasuser',
+                            remove_method: 'remove_runasuser',
+                            add_title: IPA.messages.association.add.ipasudorunas,
+                            remove_title: IPA.messages.association.remove.ipasudorunas
+                        }
+                    ]
+                },
+                {
+                    factory: IPA.rule_details_widget,
+                    name: 'runas_groups',
+                    radio_name: 'ipasudorunasgroupcategory',
+                    options: [
+                        { value: 'all', label: IPA.messages.objects.sudorule.any_group },
+                        { value: '', label: IPA.messages.objects.sudorule.specified_groups }
+                    ],
+                    tables: [
+                        { name: 'ipasudorunasgroup_group' }
+                    ],
+                    widgets: [{
+                        type: 'rule_association_table',
+                        id: entity_name+'-runasgroup_group',
+                        name: 'ipasudorunasgroup_group',
+                        external: 'ipasudorunasextgroup',
+                        add_method: 'add_runasgroup',
+                        remove_method: 'remove_runasgroup',
+                        add_title: IPA.messages.association.add.ipasudorunasgroup,
+                        remove_title: IPA.messages.association.remove.ipasudorunasgroup
+                    }]
+                }
+            ]
         }
+    );
 
+    var that = IPA.details_facet(spec);
 
-        batch.execute();
+    var init = function() {
+        var options = that.widgets.get_widget('options');
+        options.facet = that;
     };
 
-    /*initialization*/
-    that.add_section(general_section());
-    that.add_section(options_section());
-    that.add_section(user_section());
-    that.add_section(host_section());
-    that.add_section(IPA.sudo.rule_details_command_section({
-        name: 'command',
-        entity: that.entity,
-        label: IPA.messages.objects.sudorule.command
-    }));
-    that.add_section(IPA.sudo.rule_details_runas_section({
-        name: 'runas',
-        entity: that.entity,
-        label: IPA.messages.objects.sudorule.runas
-    }));
+    that.on_update_success = function(data, text_status, xhr) {
+        that.refresh();
+    };
+
+    that.on_update_error = function(xhr, text_status, error_thrown) {
+        that.refresh();
+    };
 
+    init();
 
     return that;
 };
@@ -530,16 +654,15 @@ IPA.sudo.options_section = function(spec) {
 
     spec = spec || {};
 
-    var that = IPA.details_section(spec);
-
-    that.facet = spec.facet;
-
+    var that = IPA.collapsible_section(spec);
 
     function setup_table(){
-        that.table = that.add_field(IPA.table_widget({
+        that.table = IPA.table_widget({
             name: 'ipasudoopt',
             show_buttons: true
-        }));
+        });
+
+        that.widgets.add_widget(that.table);
 
         that.table.create_column({
             name: 'ipasudoopt',
@@ -590,6 +713,23 @@ IPA.sudo.options_section = function(spec) {
                 }
             }
         };
+
+        that.table.update = function(values) {
+
+            that.table.empty();
+
+            for (var i=0; i<values.length; i++) {
+                var value = values[i];
+                if(!value || value === '') continue;
+
+                var record = {
+                    ipasudoopt: values[i]
+                };
+                that.table.add_record(record);
+            }
+
+            that.table.unselect_all();
+        };
     }
 
     that.add_handler = function() {
@@ -632,18 +772,24 @@ IPA.sudo.options_section = function(spec) {
         title = title.replace('${entity}', label);
 
         var dialog = IPA.dialog({
-            title: title
+            title: title,
+            sections: [
+                {
+                    fields: [
+                        {
+                            name: 'ipasudoopt',
+                            label: label
+                        }
+                    ]
+                }
+            ]
         });
 
-        var ipasudoopt = dialog.add_field(IPA.text_widget({
-            name: 'ipasudoopt',
-            label: label
-        }));
-
         dialog.create_button({
             name: 'add',
             label: IPA.messages.buttons.add,
             click: function() {
+                var ipasudoopt = dialog.fields.get_field('ipasudoopt');
                 var value = ipasudoopt.save()[0];
 
                 var pkey = IPA.nav.get_state(that.entity.name+'-pkey');
@@ -656,11 +802,11 @@ IPA.sudo.options_section = function(spec) {
                         ipasudoopt: value
                     },
                     on_success: function(data) {
-                        that.load(data.result.result);
+                        that.table.load(data.result.result);
                         dialog.close();
                     },
                     on_error: function(data) {
-                        that.update();
+                        that.reload();
                         dialog.close();
                     }
                 });
@@ -713,15 +859,15 @@ IPA.sudo.options_section = function(spec) {
                     }
 
                     if(result) {
-                        that.load(result);
+                        that.table.load(result);
                     } else {
-                        that.update();
+                        that.reload();
                     }
 
                     dialog.close();
                 },
                 on_error: function(data) {
-                    that.update();
+                    that.reload();
                     dialog.close();
                 }
             });
@@ -744,13 +890,13 @@ IPA.sudo.options_section = function(spec) {
         dialog.open(that.container);
     };
 
-    that.update = function() {
+    that.reload = function() {
         var command = IPA.command({
             entity: that.facet.entity.name,
             method: 'show',
             args: that.facet.get_primary_key(true),
             on_success: function(data) {
-                that.load(data.result.result);
+                that.table.load(data.result.result);
             }
         });
 
@@ -763,441 +909,6 @@ IPA.sudo.options_section = function(spec) {
     return that;
 };
 
-
-
-IPA.sudo.rule_details_command_section = function(spec) {
-
-    spec = spec || {};
-
-    var that = IPA.details_section(spec);
-
-    function setup_fields(){
-        that.category = that.add_field(
-            IPA.radio_widget({
-                name: 'cmdcategory',
-                options:[
-                    {
-                        value:'all',
-                        label:IPA.messages.objects.sudorule.any_command
-                    },
-                    {
-                        value:'',
-                        label:IPA.messages.objects.sudorule.specified_commands
-                    }
-                ]
-            }));
-
-        that.add_field(IPA.association_table_widget({
-            id: that.entity.name+'-memberallowcmd_sudocmd',
-            name: 'memberallowcmd_sudocmd',
-            entity: that.entity,
-            add_method: 'add_allow_command',
-            remove_method: 'remove_allow_command',
-            add_title: IPA.messages.association.add.memberallowcmd,
-            remove_title: IPA.messages.association.remove.memberallowcmd
-        }));
-        that.add_field(IPA.association_table_widget({
-            id: that.entity.name+'-memberallowcmd_sudocmdgroup',
-            name: 'memberallowcmd_sudocmdgroup',
-            entity: that.entity,
-            add_method: 'add_allow_command',
-            remove_method: 'remove_allow_command',
-            add_title: IPA.messages.association.add.memberallowcmd,
-            remove_title: IPA.messages.association.remove.memberallowcmd
-        }));
-
-        that.add_field(IPA.association_table_widget({
-            id: that.entity.name+'-memberdenycmd_sudocmd',
-            name: 'memberdenycmd_sudocmd',
-            entity: that.entity,
-            add_method: 'add_deny_command',
-            remove_method: 'remove_deny_command',
-            add_title: IPA.messages.association.add.memberdenycmd,
-            remove_title: IPA.messages.association.remove.memberdenycmd
-        }));
-        that.add_field(IPA.association_table_widget({
-            id: that.entity.name+'-memberdenycmd_sudocmdgroup',
-            name: 'memberdenycmd_sudocmdgroup',
-            entity: that.entity,
-            add_method: 'add_deny_command',
-            remove_method: 'remove_deny_command',
-            add_title: IPA.messages.association.add.memberdenycmd,
-            remove_title: IPA.messages.association.remove.memberdenycmd
-        }));
-    }
-
-    that.create = function(container) {
-
-        that.container = container;
-
-        var field = that.fields.get_field('cmdcategory');
-        var metadata = IPA.get_entity_param(that.entity.name, 'cmdcategory');
-
-        var span = $('<span/>', {
-            name: 'cmdcategory',
-            title: metadata.doc,
-            'class': 'field'
-        }).appendTo(container);
-
-        $('<h3/>', {
-            text: IPA.messages.objects.sudorule.allow,
-            title: IPA.messages.objects.sudorule.allow
-        }).appendTo(span);
-
-        span.append(metadata.doc+": ");
-
-        that.category.create(span);
-
-        metadata = IPA.get_entity_param(
-            that.entity.name, 'memberallowcmd_sudocmd');
-
-        var table_span = $('<span/>', {
-            name: 'memberallowcmd_sudocmd',
-            title: metadata ? metadata.doc : 'memberallowcmd_sudocmd',
-            'class': 'field'
-        }).appendTo(span);
-
-        field = that.fields.get_field('memberallowcmd_sudocmd');
-        field.create(table_span);
-
-        metadata = IPA.get_entity_param(
-            that.entity.name, 'memberallowcmd_sudocmdgroup');
-
-        table_span = $('<span/>', {
-            name: 'memberallowcmd_sudocmdgroup',
-            title: metadata ? metadata.doc : 'memberallowcmd_sudocmdgroup',
-            'class': 'field'
-        }).appendTo(span);
-
-        field = that.fields.get_field('memberallowcmd_sudocmdgroup');
-        field.create(table_span);
-
-        $('<h3/>', {
-            text: IPA.messages.objects.sudorule.deny,
-            title: IPA.messages.objects.sudorule.deny
-        }).appendTo(span);
-
-        metadata = IPA.get_entity_param(
-            that.entity.name, 'memberdenycmd_sudocmd');
-
-        table_span = $('<span/>', {
-            name: 'memberdenycmd_sudocmd',
-            title: metadata ? metadata.doc : 'memberdenycmd_sudocmd',
-            'class': 'field'
-        }).appendTo(span);
-
-        field = that.fields.get_field('memberdenycmd_sudocmd');
-        field.create(table_span);
-
-        metadata = IPA.get_entity_param(
-            that.entity.name, 'memberdenycmd_sudocmdgroup');
-
-        table_span = $('<span/>', {
-            name: 'memberdenycmd_sudocmdgroup',
-            title: metadata ? metadata.doc : 'memberdenycmd_sudocmdgroup',
-            'class': 'field'
-        }).appendTo(span);
-
-        field = that.fields.get_field('memberdenycmd_sudocmdgroup');
-        field.create(table_span);
-
-        function update_tables(value) {
-
-            var enabled = ('' === value);
-
-            var field = that.fields.get_field('memberallowcmd_sudocmd');
-            field.set_enabled(enabled);
-
-            field = that.fields.get_field('memberallowcmd_sudocmdgroup');
-            field.set_enabled(enabled);
-        }
-
-        var cmdcategory = that.fields.get_field('cmdcategory');
-        cmdcategory.reset = function() {
-            cmdcategory.widget_reset();
-            var values = cmdcategory.save();
-            if (values.length === 0) return;
-            var value = values[0];
-            update_tables(value);
-        };
-
-        var inputs = $('input[name=cmdcategory]', container);
-        inputs.change(function() {
-            var input = $(this);
-            var value = input.val();
-            update_tables(value);
-        });
-    };
-
-    /*initialization*/
-    setup_fields();
-
-    return that;
-};
-
-
-IPA.sudo.rule_details_runas_section = function(spec) {
-
-    spec = spec || {};
-
-    var that = IPA.details_section(spec);
-
-    function add_extra_fields(){
-        that.add_field(
-            IPA.radio_widget({
-                name: 'ipasudorunasusercategory',
-                options:[
-                    {
-                        value:'all',
-                        label:IPA.messages.objects.sudorule.anyone},
-                    {
-                        value:'',
-                        label:IPA.messages.objects.sudorule.specified_users
-                    }
-                ]
-            }));
-
-        that.add_field(IPA.sudorule_association_table_widget({
-            id: that.entity.name+'-runasruser_user',
-            name: 'ipasudorunas_user',
-            entity: that.entity,
-            external: 'ipasudorunasextuser',
-            add_method: 'add_runasuser',
-            remove_method: 'remove_runasuser',
-            add_title: IPA.messages.association.add.ipasudorunas,
-            remove_title: IPA.messages.association.remove.ipasudorunas
-        }));
-        that.add_field(IPA.sudorule_association_table_widget({
-            id: that.entity.name+'-runasuser_group',
-            name: 'ipasudorunas_group',
-            entity: that.entity,
-            add_method: 'add_runasuser',
-            remove_method: 'remove_runasuser',
-            add_title: IPA.messages.association.add.ipasudorunas,
-            remove_title: IPA.messages.association.remove.ipasudorunas
-        }));
-
-        that.add_field(
-            IPA.radio_widget({
-                name: 'ipasudorunasgroupcategory',
-                options:[
-                    {
-                        value:'all',
-                        label:IPA.messages.objects.sudorule.any_group
-                    },
-                    {
-                        value:'',
-                        label:IPA.messages.objects.sudorule.specified_groups
-                    }
-                ]
-            }));
-
-        that.add_field(IPA.sudorule_association_table_widget({
-            id: that.entity.name+'-runasgroup_group',
-            name: 'ipasudorunasgroup_group',
-            entity: that.entity,
-            external: 'ipasudorunasextgroup',
-            add_method: 'add_runasgroup',
-            remove_method: 'remove_runasgroup',
-            add_title: IPA.messages.association.add.ipasudorunasgroup,
-            remove_title: IPA.messages.association.remove.ipasudorunasgroup
-        }));
-    }
-
-    that.create = function(container) {
-        that.container = container;
-
-        var field = that.fields.get_field('ipasudorunasusercategory');
-        var metadata = IPA.get_entity_param(
-            that.entity.name, 'ipasudorunasusercategory');
-
-        var span = $('<span/>', {
-            name: 'ipasudorunasusercategory',
-            title: metadata.doc,
-            'class': 'field'
-        }).appendTo(container);
-        span.append(metadata.doc+": ");
-        field.create(span);
-        span.append('<br/>');
-
-        metadata = IPA.get_entity_param(that.entity.name, 'ipasudorunas_user');
-
-        var table_span = $('<span/>', {
-            name: 'ipasudorunas_user',
-            title: metadata ? metadata.doc : 'ipasudorunas_user',
-            'class': 'field'
-        }).appendTo(span);
-
-        field = that.fields.get_field('ipasudorunas_user');
-        field.create(table_span);
-
-        metadata = IPA.get_entity_param(that.entity.name, 'ipasudorunas_group');
-
-        table_span = $('<span/>', {
-            name: 'ipasudorunas_group',
-            title: metadata ? metadata.doc : 'ipasudorunas_group',
-            'class': 'field'
-        }).appendTo(span);
-
-        field = that.fields.get_field('ipasudorunas_group');
-        field.create(table_span);
-
-        field = that.fields.get_field('ipasudorunasgroupcategory');
-        metadata = IPA.get_entity_param(
-            that.entity.name, 'ipasudorunasgroupcategory');
-
-        span = $('<span/>', {
-            name: 'ipasudorunasgroupcategory',
-            title: metadata.doc,
-            'class': 'field'
-        }).appendTo(container);
-
-        span.append(metadata.doc+": ");
-        field.create(span);
-        span.append('<br/>');
-
-        metadata = IPA.get_entity_param(
-            that.entity.name, 'ipasudorunasgroup_group');
-
-        table_span = $('<span/>', {
-            name: 'ipasudorunasgroup_group',
-            title: metadata ? metadata.doc : 'ipasudorunasgroup_group',
-            'class': 'field'
-        }).appendTo(span);
-
-        field = that.fields.get_field('ipasudorunasgroup_group');
-        field.create(table_span);
-
-        function user_update_tables(value) {
-
-            var enabled = ('' === value);
-
-            var field = that.fields.get_field('ipasudorunas_user');
-            field.set_enabled(enabled);
-
-            field = that.fields.get_field('ipasudorunas_group');
-            field.set_enabled(enabled);
-        }
-
-        var user_category = that.fields.get_field('ipasudorunasusercategory');
-        user_category.reset = function() {
-            user_category.widget_reset();
-            var values = user_category.save();
-            if (values.length === 0) return;
-            var value = values[0];
-            user_update_tables(value);
-        };
-
-        var user_inputs = $('input[name=ipasudorunasusercategory]', container);
-        user_inputs.change(function() {
-            var input = $(this);
-            var value = input.val();
-            user_update_tables(value);
-        });
-
-        function group_update_tables(value) {
-
-            var enabled = ('' === value);
-
-            var field = that.fields.get_field('ipasudorunasgroup_group');
-            field.set_enabled(enabled);
-        }
-
-        var group_category = that.fields.get_field('ipasudorunasgroupcategory');
-        group_category.reset = function() {
-            group_category.widget_reset();
-            var values = group_category.save();
-            if (values.length === 0) return;
-            var value = values[0];
-            group_update_tables(value);
-        };
-
-        var group_inputs = $('input[name=ipasudorunasgroupcategory]', container);
-        group_inputs.change(function() {
-            var input = $(this);
-            var value = input.val();
-            group_update_tables(value);
-        });
-    };
-
-    /*initialization*/
-    add_extra_fields();
-
-    return that;
-};
-
-
-IPA.sudorule_association_table_widget = function(spec) {
-
-    spec = spec || {};
-
-    var that = IPA.association_table_widget(spec);
-
-    that.external = spec.external;
-
-    that.create_add_dialog = function() {
-
-        var entity_label = that.entity.metadata.label_singular;
-        var pkey = IPA.nav.get_state(that.entity.name+'-pkey');
-        var other_entity_label = IPA.metadata.objects[that.other_entity].label;
-
-        var title = that.add_title;
-        title = title.replace('${entity}', entity_label);
-        title = title.replace('${primary_key}', pkey);
-        title = title.replace('${other_entity}', other_entity_label);
-
-        return IPA.sudo.rule_association_adder_dialog({
-            title: title,
-            pkey: pkey,
-            other_entity: that.other_entity,
-            attribute_member: that.attribute_member,
-            entity: that.entity,
-            external: that.external,
-            exclude: that.values
-        });
-    };
-
-    that.load = function(result) {
-        that.values = result[that.name] || [];
-        if (that.external) {
-            var external_values = result[that.external] || [];
-            $.merge(that.values, external_values);
-        }
-        that.reset();
-        that.unselect_all();
-    };
-
-    return that;
-};
-
-
-IPA.sudo.rule_association_adder_dialog = function(spec) {
-
-    spec = spec || {};
-
-    var that = IPA.association_adder_dialog(spec);
-
-    that.external = spec.external;
-
-    that.add = function() {
-        var rows = that.available_table.remove_selected_rows();
-        that.selected_table.add_rows(rows);
-
-        if (that.external) {
-            var pkey_name = IPA.metadata.objects[that.other_entity].primary_key;
-            var value = that.external_field.val();
-            if (!value) return;
-
-            var record = {};
-            record[pkey_name] = value;
-            that.selected_table.add_record(record);
-            that.external_field.val('');
-        }
-    };
-
-    return that;
-};
-
 IPA.register('sudorule', IPA.sudo.rule_entity);
 IPA.register('sudocmd', IPA.sudo.command_entity);
 IPA.register('sudocmdgroup', IPA.sudo.command_group_entity);
diff --git a/install/ui/widget.js b/install/ui/widget.js
index e62139510..49e655455 100644
--- a/install/ui/widget.js
+++ b/install/ui/widget.js
@@ -1951,6 +1951,36 @@ IPA.details_table_section_nc = function(spec) {
     return that;
 };
 
+IPA.enable_widget = function(spec) {
+
+    spec = spec  || {};
+
+    var that = IPA.radio_widget(spec);
+
+    return that;
+};
+
+
+IPA.header_widget = function(spec) {
+
+    spec = spec || {};
+
+    var that = IPA.widget(spec);
+
+    that.level = spec.level || 3;
+    that.text = spec.text;
+    that.description = spec.description;
+
+    that.create = function(container) {
+        container.append($('<h'+that.level+' />', {
+            text: that.text,
+            title: that.description
+        }));
+    };
+
+    return that;
+};
+
 IPA.observer = function(spec) {
 
     var that = {};
@@ -2151,3 +2181,4 @@ IPA.widget_factories['combobox'] = IPA.combobox_widget;
 IPA.widget_factories['link'] = IPA.link_widget;
 IPA.widget_factories['details_table_section'] = IPA.details_table_section;
 IPA.widget_factories['details_table_section_nc'] = IPA.details_table_section_nc;
+IPA.widget_factories['enable'] = IPA.enable_widget;