In the UI we don't want to display Edit links unless someone can actually

edit things. We use the 'editors' group for this. This group itself grants
no permission other than displaying certain things in the UI.

In order to be in the editors group a user must be a member of a group that
is the source group in a delegation. The memberof plugin will do all the
hard work to be sure that a user's memberof contains cn=editors if they
are in a delegated group.

432874

3 files changed, 50 insertions, 4 deletions

diff --git a/ipa-admintools/ipa-adddelegation b/ipa-admintools/ipa-adddelegation
index b29c9671b..e2254fd2d 100644
--- a/ipa-admintools/ipa-adddelegation
+++ b/ipa-admintools/ipa-adddelegation
@@ -139,6 +139,14 @@ def main():
 
     client.update_entry(aci_entry)
 
+    # Now add to the editors group so they can make changes in the UI
+    try:
+        group = client.get_entry_by_cn("editors")
+        client.add_group_to_group(new_aci.source_group, group.dn)
+    except ipa.ipaerror.exception_for(ipa.ipaerror.LDAP_EMPTY_MODLIST):
+        # This is ok, ignore it
+        pass
+
     print "Delegation %s successfully added" % args[1]
     return 0
 
diff --git a/ipa-admintools/ipa-deldelegation b/ipa-admintools/ipa-deldelegation
index ac0ae798e..bc05b2837 100644
--- a/ipa-admintools/ipa-deldelegation
+++ b/ipa-admintools/ipa-deldelegation
@@ -51,12 +51,15 @@ def main():
         aci_str_list = [aci_str_list]
 
     acistr = None
+    aci_list = []
     for aci_str in aci_str_list:
         try:
             aci = ipa.aci.ACI(aci_str)
             if aci.name == args[1]:
                 acistr = aci_str
-                break
+                source_group = aci.source_group
+            else:
+                aci_list.append(aci)
         except SyntaxError:
             # ignore aci_str's that ACI can't parse
             pass
@@ -72,6 +75,18 @@ def main():
     aci_entry.setValue('aci', new_aci_str_list)
 
     client.update_entry(aci_entry)
+
+    last = True
+    # If this is the last delegation for a group, remove it from editors
+    for a in aci_list:
+        if source_group == a.source_group:
+            last = False
+            break
+
+    if last:
+        group = client.get_entry_by_cn("editors")
+        client.remove_member_from_group(source_group, group.dn)
+
     print "Delegation removed."
 
     return 0
diff --git a/ipa-admintools/ipa-moddelegation b/ipa-admintools/ipa-moddelegation
index 773c784df..61aab5e12 100644
--- a/ipa-admintools/ipa-moddelegation
+++ b/ipa-admintools/ipa-moddelegation
@@ -49,9 +49,9 @@ def main():
 
     if options.list:
         client = ipaclient.IPAClient()
-        list = client.get_all_attrs()
+        l = client.get_all_attrs()
 
-        for x in list:
+        for x in l:
             print x
         return 0
 
@@ -124,12 +124,15 @@ def main():
 
     old_aci = None
     acistr = None
+    aci_list = []
     for aci_str in aci_str_list:
         try:
             old_aci = ipa.aci.ACI(aci_str)
             if old_aci.name == args[1]:
                 acistr = aci_str
-                break
+                orig_group = old_aci.source_group
+            else:
+                aci_list.append(old_aci)
         except SyntaxError:
             # ignore aci_str's that ACI can't parse
             pass
@@ -162,6 +165,26 @@ def main():
 
     client.update_entry(aci_entry)
 
+    if options.source:
+        last = True
+        # If this is the last delegation for a group, remove it from editors
+        for a in aci_list:
+            if orig_group == a.source_group:
+                last = False
+                break
+
+        if last:
+            group = client.get_entry_by_cn("editors")
+            client.remove_member_from_group(orig_group, group.dn)
+
+        # Now add to the editors group so they can make changes in the UI
+        try:
+            group = client.get_entry_by_cn("editors")
+            client.add_group_to_group(new_aci.source_group, group.dn)
+        except ipa.ipaerror.exception_for(ipa.ipaerror.LDAP_EMPTY_MODLIST):
+            # This is ok, ignore it
+            pass
+
     print "Delegation %s successfully updated" % args[1]
     return 0