Implement the password policy UI and finish IPA policy UI

This includes a default password policy
Custom fields are now read from LDAP. The format is a list of
  dicts with keys: label, field, required.
The LDAP-based configuration now specifies:
    ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title
    ipaGroupSearchFields: cn,description
    ipaSearchTimeLimit: 2
    ipaSearchRecordsLimit: 0
    ipaCustomFields:
    ipaHomesRootDir: /home
    ipaDefaultLoginShell: /bin/sh
    ipaDefaultPrimaryGroup: ipausers
    ipaMaxUsernameLength: 8
    ipaPwdExpAdvNotify: 4
This could use some optimization.

1 files changed, 105 insertions, 25 deletions

diff --git a/ipa-server/ipa-gui/ipagui/templates/ipapolicyeditform.kid b/ipa-server/ipa-gui/ipagui/templates/ipapolicyeditform.kid
index bcdef8c27..106657636 100644
--- a/ipa-server/ipa-gui/ipagui/templates/ipapolicyeditform.kid
+++ b/ipa-server/ipa-gui/ipagui/templates/ipapolicyeditform.kid
@@ -24,12 +24,42 @@ from ipagui.helpers import ipahelper
     <table class="formtable" cellpadding="2" cellspacing="0" border="0">
         <tr>
           <th>
-            <label class="fieldlabel" py:content="ipapolicy_fields.searchlimit.label" />:
+            <label class="fieldlabel" py:content="ipapolicy_fields.ipasearchtimelimit.label" />:
           </th>
         <td>
-          <span py:replace="ipapolicy_fields.searchlimit.display(value_for(ipapolicy_fields.searchlimit))" />
-          <span py:if="tg.errors.get('searchlimit')" class="fielderror"
-              py:content="tg.errors.get('searchlimit')" />
+          <span py:replace="ipapolicy_fields.ipasearchtimelimit.display(value_for(ipapolicy_fields.ipasearchtimelimit))" />
+          <span py:if="tg.errors.get('ipasearchtimelimit')" class="fielderror"
+              py:content="tg.errors.get('ipasearchtimelimit')" />
+        </td>
+        </tr>
+        <tr>
+          <th>
+            <label class="fieldlabel" py:content="ipapolicy_fields.ipasearchrecordslimit.label" />:
+          </th>
+        <td>
+          <span py:replace="ipapolicy_fields.ipasearchrecordslimit.display(value_for(ipapolicy_fields.ipasearchrecordslimit))" />
+          <span py:if="tg.errors.get('ipasearchrecordslimit')" class="fielderror"
+              py:content="tg.errors.get('ipasearchrecordslimit')" />
+        </td>
+        </tr>
+        <tr>
+          <th>
+            <label class="fieldlabel" py:content="ipapolicy_fields.ipausersearchfields.label" />:
+          </th>
+        <td>
+          <span py:replace="ipapolicy_fields.ipausersearchfields.display(value_for(ipapolicy_fields.ipausersearchfields))" />
+          <span py:if="tg.errors.get('ipausersearchfields')" class="fielderror"
+              py:content="tg.errors.get('ipausersearchfields')" />
+        </td>
+        </tr>
+        <tr>
+          <th>
+            <label class="fieldlabel" py:content="ipapolicy_fields.ipagroupsearchfields.label" />:
+          </th>
+        <td>
+          <span py:replace="ipapolicy_fields.ipagroupsearchfields.display(value_for(ipapolicy_fields.ipagroupsearchfields))" />
+          <span py:if="tg.errors.get('ipagroupsearchfields')" class="fielderror"
+              py:content="tg.errors.get('ipagroupsearchfields')" />
         </td>
         </tr>
     </table>
@@ -38,56 +68,106 @@ from ipagui.helpers import ipahelper
     <table class="formtable" cellpadding="2" cellspacing="0" border="0">
         <tr>
           <th>
-            <label class="fieldlabel" py:content="ipapolicy_fields.passwordnotif.label" />:
+            <label class="fieldlabel" py:content="ipapolicy_fields.ipapwdexpadvnotify.label" />:
+          </th>
+          <td>
+          <span py:replace="ipapolicy_fields.ipapwdexpadvnotify.display(value_for(ipapolicy_fields.ipapwdexpadvnotify))" />
+          <span py:if="tg.errors.get('ipapwdexpadvnotify')" class="fielderror"
+              py:content="tg.errors.get('ipapwdexpadvnotify')" />
+          </td>
+        </tr>
+        <tr>
+          <th>
+            <label class="fieldlabel" py:content="ipapolicy_fields.krbminpwdlife.label" />:
           </th>
           <td>
-          <span py:replace="ipapolicy_fields.passwordnotif.display(value_for(ipapolicy_fields.passwordnotif))" />
-          <span py:if="tg.errors.get('passwordnotif')" class="fielderror"
-              py:content="tg.errors.get('passwordnotif')" />
+          <span py:replace="ipapolicy_fields.krbminpwdlife.display(value_for(ipapolicy_fields.krbminpwdlife))" />
+          <span py:if="tg.errors.get('krbminpwdlife')" class="fielderror"
+              py:content="tg.errors.get('krbminpwdlife')" />
+          </td>
+        </tr>
+        <tr>
+          <th>
+            <label class="fieldlabel" py:content="ipapolicy_fields.krbmaxpwdlife.label" />:
+          </th>
+          <td>
+          <span py:replace="ipapolicy_fields.krbmaxpwdlife.display(value_for(ipapolicy_fields.krbmaxpwdlife))" />
+          <span py:if="tg.errors.get('krbmaxpwdlife')" class="fielderror"
+              py:content="tg.errors.get('krbmaxpwdlife')" />
+          </td>
+        </tr>
+        <tr>
+          <th>
+            <label class="fieldlabel" py:content="ipapolicy_fields.krbpwdmindiffchars.label" />:
+          </th>
+          <td>
+          <span py:replace="ipapolicy_fields.krbpwdmindiffchars.display(value_for(ipapolicy_fields.krbpwdmindiffchars))" />
+          <span py:if="tg.errors.get('krbpwdmindiffchars')" class="fielderror"
+              py:content="tg.errors.get('krbpwdmindiffchars')" />
+          </td>
+        </tr>
+        <tr>
+          <th>
+            <label class="fieldlabel" py:content="ipapolicy_fields.krbpwdminlength.label" />:
+          </th>
+          <td>
+          <span py:replace="ipapolicy_fields.krbpwdminlength.display(value_for(ipapolicy_fields.krbpwdminlength))" />
+          <span py:if="tg.errors.get('krbpwdminlength')" class="fielderror"
+              py:content="tg.errors.get('krbpwdminlength')" />
+          </td>
+        </tr>
+        <tr>
+          <th>
+            <label class="fieldlabel" py:content="ipapolicy_fields.krbpwdhistorylength.label" />:
+          </th>
+          <td>
+          <span py:replace="ipapolicy_fields.krbpwdhistorylength.display(value_for(ipapolicy_fields.krbpwdhistorylength))" />
+          <span py:if="tg.errors.get('krbpwdhistorylength')" class="fielderror"
+              py:content="tg.errors.get('krbpwdhistorylength')" />
           </td>
         </tr>
     </table>
 
-    <h2 class="formsection">Password Policy</h2>
+    <h2 class="formsection">User Settings</h2>
     <table class="formtable" cellpadding="2" cellspacing="0" border="0">
         <tr>
           <th>
-            <label class="fieldlabel" py:content="ipapolicy_fields.maxuidlength.label" />:
+            <label class="fieldlabel" py:content="ipapolicy_fields.ipamaxusernamelength.label" />:
           </th>
           <td>
-          <span py:replace="ipapolicy_fields.maxuidlength.display(value_for(ipapolicy_fields.maxuidlength))" />
-          <span py:if="tg.errors.get('maxuidlength')" class="fielderror"
-              py:content="tg.errors.get('maxuidlength')" />
+          <span py:replace="ipapolicy_fields.ipamaxusernamelength.display(value_for(ipapolicy_fields.ipamaxusernamelength))" />
+          <span py:if="tg.errors.get('ipamaxusernamelength')" class="fielderror"
+              py:content="tg.errors.get('ipamaxusernamelength')" />
           </td>
         </tr>
         <tr>
           <th>
-            <label class="fieldlabel" py:content="ipapolicy_fields.homedir.label" />:
+            <label class="fieldlabel" py:content="ipapolicy_fields.ipahomesrootdir.label" />:
           </th>
           <td>
-          <span py:replace="ipapolicy_fields.homedir.display(value_for(ipapolicy_fields.homedir))" />
-          <span py:if="tg.errors.get('homedir')" class="fielderror"
-              py:content="tg.errors.get('homedir')" />
+          <span py:replace="ipapolicy_fields.ipahomesrootdir.display(value_for(ipapolicy_fields.ipahomesrootdir))" />
+          <span py:if="tg.errors.get('ipahomesrootdir')" class="fielderror"
+              py:content="tg.errors.get('ipahomesrootdir')" />
           </td>
         </tr>
         <tr>
           <th>
-            <label class="fieldlabel" py:content="ipapolicy_fields.defaultshell.label" />:
+            <label class="fieldlabel" py:content="ipapolicy_fields.ipadefaultloginshell.label" />:
           </th>
           <td>
-          <span py:replace="ipapolicy_fields.defaultshell.display(value_for(ipapolicy_fields.defaultshell))" />
-          <span py:if="tg.errors.get('defaultshell')" class="fielderror"
-              py:content="tg.errors.get('defaultshell')" />
+          <span py:replace="ipapolicy_fields.ipadefaultloginshell.display(value_for(ipapolicy_fields.ipadefaultloginshell))" />
+          <span py:if="tg.errors.get('ipadefaultloginshell')" class="fielderror"
+              py:content="tg.errors.get('ipadefaultloginshell')" />
           </td>
         </tr>
         <tr>
           <th>
-            <label class="fieldlabel" py:content="ipapolicy_fields.defaultgroup.label" />:
+            <label class="fieldlabel" py:content="ipapolicy_fields.ipadefaultprimarygroup.label" />:
           </th>
           <td>
-          <span py:replace="ipapolicy_fields.defaultgroup.display(value_for(ipapolicy_fields.defaultgroup))" />
-          <span py:if="tg.errors.get('defaultgroup')" class="fielderror"
-              py:content="tg.errors.get('defaultgroup')" />
+          <span py:replace="ipapolicy_fields.ipadefaultprimarygroup.display(value_for(ipapolicy_fields.ipadefaultprimarygroup))" />
+          <span py:if="tg.errors.get('ipadefaultprimarygroup')" class="fielderror"
+              py:content="tg.errors.get('ipadefaultprimarygroup')" />
           </td>
         </tr>
     </table>