17-2 Managed netgroups should be invisible https://fedorahosted.org/freeipa/ticket/963

2 files changed, 20 insertions, 1 deletions

diff --git a/API.txt b/API.txt
index 697acb289..557a0e80c 100644
--- a/API.txt
+++ b/API.txt
@@ -1561,7 +1561,7 @@ output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), 'User-friendly
 output: Output('result', <type 'dict'>, 'list of deletions that failed')
 output: Output('value', <type 'unicode'>, "The primary_key value of the entry, e.g. 'jdoe' for a user")
 command: netgroup_find
-args: 1,23,4
+args: 1,24,4
 arg: Str('criteria?')
 option: Str('cn', attribute=True, autofill=False, cli_name='name', label=Gettext('Netgroup name', domain='ipa', localedir=None), multivalue=False, normalizer=<lambda>, primary_key=True, query=True, required=False)
 option: Str('description', attribute=True, autofill=False, cli_name='desc', label=Gettext('Description', domain='ipa', localedir=None), multivalue=False, query=True, required=False)
@@ -1571,6 +1571,7 @@ option: StrEnum('usercategory', attribute=True, autofill=False, cli_name='userca
 option: StrEnum('hostcategory', attribute=True, autofill=False, cli_name='hostcat', label=Gettext('Host category', domain='ipa', localedir=None), multivalue=False, query=True, required=False, values=(u'all',))
 option: Int('timelimit?', autofill=False, flags=['no_display'], label=Gettext('Time Limit', domain='ipa', localedir=None), minvalue=0)
 option: Int('sizelimit?', autofill=False, flags=['no_display'], label=Gettext('Size Limit', domain='ipa', localedir=None), minvalue=0)
+option: Flag('private', autofill=True, cli_name='private', default=False,lag('private', autofill=True, cli_name='private', default=False, doc=Gettext('search for private groups', domain='ipa', localedir=None))
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui', flags=['no_output'])
 option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui', flags=['no_output'])
 option: Str('version?', exclude='webui', flags=['no_option', 'no_output'])
diff --git a/ipalib/plugins/netgroup.py b/ipalib/plugins/netgroup.py
index ad045eeb1..e89d8c8db 100644
--- a/ipalib/plugins/netgroup.py
+++ b/ipalib/plugins/netgroup.py
@@ -186,6 +186,24 @@ class netgroup_find(LDAPSearch):
         '%(count)d netgroup matched', '%(count)d netgroups matched'
     )
 
+    takes_options = LDAPSearch.takes_options + (
+        Flag('private',
+            cli_name='private',
+            doc=_('search for private groups'),
+        ),
+    )
+
+    def pre_callback(self, ldap, filter, attrs_list, base_dn, scope, *args, **options):
+        # Do not display private mepManagedEntry netgroups by default
+        # If looking for private groups, we need to omit the negation search filter
+
+        if not options['private']:
+            search_kw = self.args_options_2_entry(**options)
+            search_kw['objectclass'] = ['mepManagedEntry']
+            negation = ldap.make_filter(search_kw, rules=ldap.MATCH_NONE)
+            filter = ldap.combine_filters((negation, filter), rules='&')
+        return (filter, base_dn, scope)
+
 api.register(netgroup_find)