diff options
author | Rob Crittenden <rcritten@redhat.com> | 2007-11-12 23:11:55 -0500 |
---|---|---|
committer | Rob Crittenden <rcritten@redhat.com> | 2007-11-12 23:11:55 -0500 |
commit | cd489f0a73bcdb2583a5f69defb08ea45278c05a (patch) | |
tree | b516d7c8a22ce10ae04dde73ab78c1368303f2de | |
parent | 99b84bfd01e0b3f4e9e69ea7c2912545bef0d71a (diff) | |
download | freeipa-cd489f0a73bcdb2583a5f69defb08ea45278c05a.tar.gz freeipa-cd489f0a73bcdb2583a5f69defb08ea45278c05a.tar.xz freeipa-cd489f0a73bcdb2583a5f69defb08ea45278c05a.zip |
Allow a user or group to change an attribute in its RDN
Add secretary to the list of indexes otherwise RDN changing could be slow
Port --addattr, --setattr and --delattr from usermod to groupmod
-rw-r--r-- | ipa-admintools/ipa-groupmod | 67 | ||||
-rw-r--r-- | ipa-admintools/ipa-usermod | 6 | ||||
-rw-r--r-- | ipa-admintools/man/ipa-groupmod.1 | 12 | ||||
-rw-r--r-- | ipa-admintools/man/ipa-usermod.1 | 16 | ||||
-rw-r--r-- | ipa-server/ipa-install/share/indeces.ldif | 8 | ||||
-rw-r--r-- | ipa-server/ipaserver/ipaldap.py | 17 | ||||
-rw-r--r-- | ipa-server/xmlrpc-server/funcs.py | 88 |
7 files changed, 195 insertions, 19 deletions
diff --git a/ipa-admintools/ipa-groupmod b/ipa-admintools/ipa-groupmod index 4d8dd4d5e..9145d19da 100644 --- a/ipa-admintools/ipa-groupmod +++ b/ipa-admintools/ipa-groupmod @@ -31,10 +31,13 @@ import kerberos import ldap def usage(): - print "ipa-groupmod [-a] [-r] user group" - print "ipa-groupmod [-d|--desc description STRING] group" + print "ipa-groupmod [-a|--add] [-r|--remove] user group" + print "ipa-groupmod [-d|--desc description STRING] [--addattr attribute=value] [--delattr attribute] [--setattr attribute=value] group" sys.exit(1) +def set_add_usage(which): + print "%s option usage: --%s NAME=VALUE" % (which, which) + def parse_options(): parser = OptionParser() parser.add_option("-a", "--add", dest="add", action="store_true", @@ -43,13 +46,22 @@ def parse_options(): help="Remove a user from the group") parser.add_option("-d", "--description", dest="desc", help="Modify the description of the group") + parser.add_option("--addattr", dest="addattr", + help="Adds an attribute or values to that attribute, attr=value", + action="append") + parser.add_option("--delattr", dest="delattr", + help="Remove an attribute", action="append") + parser.add_option("--setattr", dest="setattr", + help="Set an attribute, dropping any existing values that may exist", + action="append") parser.add_option("--usage", action="store_true", help="Program usage") args = ipa.config.init_config(sys.argv) options, args = parser.parse_args(args) - if (not options.add and not options.remove) and (not options.desc): + if (not options.add and not options.remove) and (not options.desc and + not options.addattr and not options.delattr and not options.setattr): usage() return options, args @@ -69,7 +81,7 @@ def main(): if (options.add or options.remove) and (len(args) != 3): usage() - if (options.desc and (len(args) != 2)): + elif ((options.desc or options.addattr or options.delattr or options.setattr) and (len(args) != 2)): usage() try: @@ -78,19 +90,54 @@ def main(): group = get_group(client, args[2]) if group is None: return 1 - client.add_user_to_group(args[1], group.dn) - print args[1] + " successfully added to " + args[2] + users = args[1].split(',') + for user in users: + client.add_user_to_group(user, group.dn) + print user + " successfully added to " + args[2] elif options.remove: group = get_group(client, args[2]) if group is None: return 1 - client.remove_user_from_group(args[1], group.dn) - print args[1] + " successfully removed" - elif options.desc: + users = args[1].split(',') + for user in users: + client.remove_user_from_group(user, group.dn) + print user + " successfully removed" + else: group = get_group(client, args[1]) if group is None: return 1 - group.setValue('description', options.desc) + + if options.desc: + group.setValue('description', options.desc) + + if options.delattr: + for d in options.delattr: + # doesn't truly delete the attribute but does null out the value + group.setValue(d, '') + + if options.setattr: + for s in options.setattr: + s = s.split('=') + if len(s) != 2: + set_add_usage("set") + sys.exit(1) + (attr,value) = s + group.setValue(attr, value) + + if options.addattr: + for a in options.addattr: + a = a.split('=') + if len(a) != 2: + set_add_usage("add") + sys.exit(1) + (attr,value) = a + cvalue = group.getValue(attr) + if cvalue: + if isinstance(cvalue,str): + cvalue = [cvalue] + value = cvalue + [value] + group.setValue(attr, value) + client.update_group(group) print args[1] + " successfully updated" except xmlrpclib.Fault, f: diff --git a/ipa-admintools/ipa-usermod b/ipa-admintools/ipa-usermod index c220b3f7d..50e86661d 100644 --- a/ipa-admintools/ipa-usermod +++ b/ipa-admintools/ipa-usermod @@ -49,12 +49,12 @@ def parse_options(): help="User's last name") parser.add_option("-s", "--shell", dest="shell", help="Set user's login shell to shell") - parser.add_option("--add", dest="addattr", + parser.add_option("--addattr", dest="addattr", help="Adds an attribute or values to that attribute, attr=value", action="append") - parser.add_option("--del", dest="delattr", + parser.add_option("--delattr", dest="delattr", help="Remove an attribute", action="append") - parser.add_option("--set", dest="setattr", + parser.add_option("--setattr", dest="setattr", help="Set an attribute, dropping any existing values that may exist", action="append") parser.add_option("-M", "--mailAddress", dest="mail", diff --git a/ipa-admintools/man/ipa-groupmod.1 b/ipa-admintools/man/ipa-groupmod.1 index 5b9925468..5d107de2f 100644 --- a/ipa-admintools/man/ipa-groupmod.1 +++ b/ipa-admintools/man/ipa-groupmod.1 @@ -37,5 +37,17 @@ Modify the description of the group .TP \fB\-r\fR, \fB\-\-remove\fR=\fIuser1,user2,...usern\fR Remove one or more users from the group + +.TP +\fB\-\-addattr\fR=\fIattr=value\fR +Add a new attribute, or value to an existing attribute + +.TP +\fB\-\-delattr\fR=\fIattr=value\fR +Remove an attribute and all values + +.TP +\fB\-\-setattr\fR=\fIattr=value\fR +Set an attribute to a new value, removing all old ones .SH "EXIT STATUS" The exit status is 0 on success, nonzero on error. diff --git a/ipa-admintools/man/ipa-usermod.1 b/ipa-admintools/man/ipa-usermod.1 index 760e6d057..43c74e450 100644 --- a/ipa-admintools/man/ipa-usermod.1 +++ b/ipa-admintools/man/ipa-usermod.1 @@ -21,10 +21,10 @@ .SH "NAME" ipa\-usermod \- Modify a user .SH "SYNOPSIS" -ipa\-usermod [\fIOPTION\fR]... \fIgroup\fR +ipa\-usermod [\fIOPTION\fR]... \fIname\fR .SH "DESCRIPTION" -Updates the members or description of \fIgroup\fR. +Updates the user \fIname\fR. .SH "OPTIONS" .TP \fB\-a\fR, \fB\-\-add\fR=\fIuser1,user2,...usern\fR @@ -37,5 +37,17 @@ Modify the description of the group .TP \fB\-r\fR, \fB\-\-remove\fR=\fIuser1,user2,...usern\fR Remove one or more users from the group + +.TP +\fB\-\-addattr\fR=\fIattr=value\fR +Add a new attribute, or value to an existing attribute + +.TP +\fB\-\-delattr\fR=\fIattr=value\fR +Remove an attribute and all values + +.TP +\fB\-\-setattr\fR=\fIattr=value\fR +Set an attribute to a new value, removing all old ones .SH "EXIT STATUS" The exit status is 0 on success, nonzero on error. diff --git a/ipa-server/ipa-install/share/indeces.ldif b/ipa-server/ipa-install/share/indeces.ldif index 11dc3c0ec..31cbc30ab 100644 --- a/ipa-server/ipa-install/share/indeces.ldif +++ b/ipa-server/ipa-install/share/indeces.ldif @@ -42,6 +42,14 @@ cn:manager nsSystemIndex:false nsIndexType:eq +dn: cn=secretary,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config +changetype: add +objectClass:top +objectClass:nsIndex +cn:secretary +nsSystemIndex:false +nsIndexType:eq + dn: cn=displayname,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config changetype: add objectClass:top diff --git a/ipa-server/ipaserver/ipaldap.py b/ipa-server/ipaserver/ipaldap.py index 69f040eb5..d319869dc 100644 --- a/ipa-server/ipaserver/ipaldap.py +++ b/ipa-server/ipaserver/ipaldap.py @@ -377,6 +377,23 @@ class IPAdmin(SimpleLDAPObject): raise ipaerror.gen_exception(ipaerror.LDAP_DATABASE_ERROR, None, e) return "Success" + def updateRDN(self, dn, newrdn): + """Wrap the modrdn function.""" + + sctrl = self.__get_server_controls__() + + if dn == newrdn: + # no need to report an error + return "Success" + + try: + if sctrl is not None: + self.set_option(ldap.OPT_SERVER_CONTROLS, sctrl) + self.modrdn_s(dn, newrdn, delold=1) + except ldap.LDAPError, e: + raise ipaerror.gen_exception(ipaerror.LDAP_DATABASE_ERROR, None, e) + return "Success" + def updateEntry(self,dn,olduser,newuser): """This wraps the mod function. It assumes that the entry is already populated with all of the desired objectclasses and attributes""" diff --git a/ipa-server/xmlrpc-server/funcs.py b/ipa-server/xmlrpc-server/funcs.py index a45124525..5ae901ee4 100644 --- a/ipa-server/xmlrpc-server/funcs.py +++ b/ipa-server/xmlrpc-server/funcs.py @@ -604,8 +604,40 @@ class IPAServer: return new_dict def update_user (self, oldentry, newentry, opts=None): - """Thin wrapper around update_entry""" - return self.update_entry(oldentry, newentry, opts) + """Wrapper around update_entry with user-specific handling. + + If you want to change the RDN of a user you must use + this function. update_entry will fail. + """ + + newrdn = 0 + + if oldentry.get('uid') != newentry.get('uid'): + # RDN change + conn = self.getConnection(opts) + try: + res = conn.updateRDN(oldentry.get('dn'), "uid=" + newentry.get('uid')) + newdn = oldentry.get('dn') + newdn = newdn.replace("uid=%s" % oldentry.get('uid'), "uid=%s" % newentry.get('uid')) + + # Now fix up the dns and uids so they aren't seen as having + # changed. + oldentry['dn'] = newdn + newentry['dn'] = newdn + oldentry['uid'] = newentry['uid'] + newrdn = 1 + finally: + self.releaseConnection(conn) + + try: + rv = self.update_entry(oldentry, newentry, opts) + return rv + except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST): + # This means that there was just an rdn change, nothing else. + if newrdn == 1: + return "Success" + else: + raise def mark_user_deleted (self, uid, opts=None): """Mark a user as inactive in LDAP. We aren't actually deleting @@ -1005,8 +1037,56 @@ class IPAServer: return failed def update_group (self, oldentry, newentry, opts=None): - """Thin wrapper around update_entry""" - return self.update_entry(oldentry, newentry, opts) + """Wrapper around update_entry with group-specific handling. + + If you want to change the RDN of a group you must use + this function. update_entry will fail. + """ + + newrdn = 0 + + oldcn=oldentry.get('cn') + newcn=newentry.get('cn') + if isinstance(oldcn, str): + oldcn = [oldcn] + if isinstance(newcn, str): + newcn = [newcn] + + oldcn.sort() + newcn.sort() + if oldcn != newcn: + # RDN change + conn = self.getConnection(opts) + try: + res = conn.updateRDN(oldentry.get('dn'), "cn=" + newcn[0]) + newdn = oldentry.get('dn') + + # Ick. Need to find the exact cn used in the old DN so we'll + # walk the list of cns and skip the obviously bad ones: + for c in oldentry.get('dn').split("cn="): + if c and c != "groups" and not c.startswith("accounts"): + newdn = newdn.replace("cn=%s" % c, "uid=%s" % newentry.get('cn')[0]) + break + + # Now fix up the dns and cns so they aren't seen as having + # changed. + oldentry['dn'] = newdn + newentry['dn'] = newdn + oldentry['cn'] = newentry['cn'] + newrdn = 1 + finally: + self.releaseConnection(conn) + + try: + rv = self.update_entry(oldentry, newentry, opts) + return rv + except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST): + if newrdn == 1: + # This means that there was just the rdn change, no other + # attributes + return "Success" + else: + raise def delete_group (self, group_dn, opts=None): """Delete a group |