summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTomas Babej <tbabej@redhat.com>2014-09-22 12:58:05 +0200
committerTomas Babej <tbabej@redhat.com>2014-09-22 13:49:32 +0200
commit69a45676042c30a92b2586889663080900005b8d (patch)
tree761a84e21e199f36375ec692a4562f85f13bcada
parenta3853771c0acf321d738ec0c20594fa3f505b12c (diff)
downloadfreeipa-69a45676042c30a92b2586889663080900005b8d.zip
freeipa-69a45676042c30a92b2586889663080900005b8d.tar.gz
freeipa-69a45676042c30a92b2586889663080900005b8d.tar.xz
idviews: Handle Default Trust View properly in the framework
-rw-r--r--ipalib/plugins/idviews.py28
1 files changed, 28 insertions, 0 deletions
diff --git a/ipalib/plugins/idviews.py b/ipalib/plugins/idviews.py
index d28272c..f72b8cc 100644
--- a/ipalib/plugins/idviews.py
+++ b/ipalib/plugins/idviews.py
@@ -97,6 +97,13 @@ class idview_del(LDAPDelete):
__doc__ = _('Delete an ID View.')
msg_summary = _('Deleted ID View "%(value)s"')
+ def pre_callback(self, ldap, dn, *keys, **options):
+ if "Default Trust View" in keys:
+ raise errors.ValidationError(
+ name=_('Protected ID View'),
+ error=_('Default Trust View cannot be deleted')
+ )
+
@register()
class idview_mod(LDAPUpdate):
@@ -521,6 +528,16 @@ class baseidoverride(LDAPObject):
)
entry_attrs.single_value['ipaanchoruuid'] = object_name
+ def prohibit_ipa_users_in_default_view(self, dn, entry_attrs):
+ # Check if parent object is Default Trust View, if so, prohibit
+ # adding overrides for IPA objects
+
+ if dn[1].value == 'Default Trust View':
+ if dn[0].value.startswith(IPA_ANCHOR_PREFIX):
+ raise errors.ValidationError(
+ name=_('ID View'),
+ error=_('Default Trust View cannot contain IPA users')
+ )
class baseidoverride_add(LDAPCreate):
__doc__ = _('Add a new ID override.')
@@ -528,6 +545,7 @@ class baseidoverride_add(LDAPCreate):
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
self.obj.set_anchoruuid_from_dn(dn, entry_attrs)
+ self.obj.prohibit_ipa_users_in_default_view(dn, entry_attrs)
return dn
def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
@@ -544,6 +562,16 @@ class baseidoverride_mod(LDAPUpdate):
__doc__ = _('Modify an ID override.')
msg_summary = _('Modified an ID override "%(value)s"')
+ def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
+ if 'rename' in options:
+ raise errors.ValidationError(
+ name=_('ID override'),
+ error=_('ID overrides cannot be renamed')
+ )
+
+ self.obj.prohibit_ipa_users_in_default_view(dn, entry_attrs)
+ return dn
+
def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
self.obj.convert_anchor_to_human_readable_form(entry_attrs, **options)
return dn