We are really changing the kerberos principal key and not the password when

we do updates, so use the right terminology internally. Also fix the actual
field we update (and grant permission appropriately in delegations).

The DS password handles updating userPassword and any Samba passwords
as necessary.

438256

5 files changed, 45 insertions, 45 deletions

diff --git a/ipa-server/ipa-gui/ipagui/forms/delegate.py b/ipa-server/ipa-gui/ipagui/forms/delegate.py
index bb9134834..0c080b32a 100644
--- a/ipa-server/ipa-gui/ipagui/forms/delegate.py
+++ b/ipa-server/ipa-gui/ipagui/forms/delegate.py
@@ -29,7 +29,7 @@ aci_attrs = [
   UserFields.displayname,
   UserFields.initials,
   UserFields.uid,
-  UserFields.userpassword,
+  UserFields.krbprincipalkey,
   UserFields.uidnumber,
   UserFields.gidnumber,
   UserFields.homedirectory,
diff --git a/ipa-server/ipa-gui/ipagui/forms/user.py b/ipa-server/ipa-gui/ipagui/forms/user.py
index 439b3a34c..a149dc476 100644
--- a/ipa-server/ipa-gui/ipagui/forms/user.py
+++ b/ipa-server/ipa-gui/ipagui/forms/user.py
@@ -29,8 +29,8 @@ class UserFields(object):
     initials = widgets.TextField(name="initials", label="Initials")
 
     uid = widgets.TextField(name="uid", label="Login", attrs=dict(onchange="warnRDN(this.id)"))
-    userpassword = widgets.PasswordField(name="userpassword", label="Password")
-    userpassword_confirm = widgets.PasswordField(name="userpassword_confirm",
+    krbprincipalkey = widgets.PasswordField(name="krbprincipalkey", label="Password")
+    krbprincipalkey_confirm = widgets.PasswordField(name="krbprincipalkey_confirm",
             label="Confirm Password")
     uidnumber = widgets.TextField(name="uidnumber", label="UID")
     gidnumber = widgets.TextField(name="gidnumber", label="GID")
@@ -85,15 +85,15 @@ class UserFields(object):
 
 class UserNewValidator(validators.Schema):
     uid = validators.PlainText(not_empty=True)
-    userpassword = validators.String(not_empty=False)
-    userpassword_confirm = validators.String(not_empty=False)
+    krbprincipalkey = validators.String(not_empty=False)
+    krbprincipalkey_confirm = validators.String(not_empty=False)
     givenname = validators.String(not_empty=True)
     sn = validators.String(not_empty=True)
     cn = validators.ForEach(validators.String(not_empty=True))
     mail = validators.Email(not_empty=False)
 
     chained_validators = [
-      validators.FieldsMatch('userpassword', 'userpassword_confirm')
+      validators.FieldsMatch('krbprincipalkey', 'krbprincipalkey_confirm')
     ]
 
 
@@ -121,8 +121,8 @@ class UserNewForm(widgets.Form):
         super(UserNewForm,self).update_params(params)
 
 class UserEditValidator(validators.Schema):
-    userpassword = validators.String(not_empty=False)
-    userpassword_confirm = validators.String(not_empty=False)
+    krbprincipalkey = validators.String(not_empty=False)
+    krbprincipalkey_confirm = validators.String(not_empty=False)
     givenname = validators.String(not_empty=True)
     sn = validators.String(not_empty=True)
     cn = validators.ForEach(validators.String(not_empty=True))
@@ -137,7 +137,7 @@ class UserEditValidator(validators.Schema):
     ]
 
     chained_validators = [
-      validators.FieldsMatch('userpassword', 'userpassword_confirm')
+      validators.FieldsMatch('krbprincipalkey', 'krbprincipalkey_confirm')
     ]
 
 class UserEditForm(widgets.Form):
diff --git a/ipa-server/ipa-gui/ipagui/subcontrollers/user.py b/ipa-server/ipa-gui/ipagui/subcontrollers/user.py
index f20c423e7..6cb064902 100644
--- a/ipa-server/ipa-gui/ipagui/subcontrollers/user.py
+++ b/ipa-server/ipa-gui/ipagui/subcontrollers/user.py
@@ -264,9 +264,9 @@ class UserController(IPAController):
         #
         # Set the Password
         #
-        if kw.get('userpassword'):
+        if kw.get('krbprincipalkey'):
             try:
-                client.modifyPassword(user_dict['krbprincipalname'], "", kw.get('userpassword'))
+                client.modifyPassword(user_dict['krbprincipalname'], "", kw.get('krbprincipalkey'))
             except ipaerror.IPAError, e:
                 message = "User successfully created.<br />"
                 message += "There was an error setting the password.<br />"
@@ -357,8 +357,8 @@ class UserController(IPAController):
             user_dict = self.initialize_mv_fields(user_dict)
 
             # Edit shouldn't fill in the password field.
-            if user_dict.has_key('userpassword'):
-                del(user_dict['userpassword'])
+            if user_dict.has_key('krbprincipalkey'):
+                del(user_dict['krbprincipalkey'])
 
             user_dict['uid_hidden'] = user_dict.get('uid')
 
@@ -512,7 +512,7 @@ class UserController(IPAController):
             new_user.setValueNotEmpty('labeleduri', kw.get('labeleduri'))
 
             if kw.get('editprotected') == 'true':
-                if kw.get('userpassword'):
+                if kw.get('krbprincipalkey'):
                     password_change = True
                 new_user.setValueNotEmpty('uidnumber', str(kw.get('uidnumber')))
                 new_user.setValueNotEmpty('gidnumber', str(kw.get('gidnumber')))
@@ -547,7 +547,7 @@ class UserController(IPAController):
         #
         try:
             if password_change:
-                rv = client.modifyPassword(orig_user_dict['krbprincipalname'], "", kw.get('userpassword'))
+                rv = client.modifyPassword(orig_user_dict['krbprincipalname'], "", kw.get('krbprincipalkey'))
         except ipaerror.IPAError, e:
             turbogears.flash("User password change failed: " + str(e) + "<br/>" + e.detail[0]['desc'])
             return dict(form=user_edit_form, user=kw,
diff --git a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid
index e6d9b7d25..b2a3c39c5 100644
--- a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid
+++ b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid
@@ -54,8 +54,8 @@ from ipagui.helpers import ipahelper
 
   <script type="text/javascript">
     function toggleProtectedFields(checkbox) {
-      passwordField = document.getElementById('form_userpassword');
-      passwordConfirmField = document.getElementById('form_userpassword_confirm');
+      passwordField = document.getElementById('form_krbprincipalkey');
+      passwordConfirmField = document.getElementById('form_krbprincipalkey_confirm');
       uidField = document.getElementById('form_uid');
       uidnumberField = document.getElementById('form_uidnumber');
       gidnumberField = document.getElementById('form_gidnumber');
@@ -266,16 +266,16 @@ from ipagui.helpers import ipahelper
 
       <tr>
         <th valign="top">
-          <label class="fieldlabel" for="${user_fields.userpassword.field_id}"
-            py:content="user_fields.userpassword.label" />:
+          <label class="fieldlabel" for="${user_fields.krbprincipalkey.field_id}"
+            py:content="user_fields.krbprincipalkey.label" />:
         </th>
         <td valign="top">
-          <span py:replace="user_fields.userpassword.display(value_for(user_fields.userpassword))" />
-          <span py:if="tg.errors.get('userpassword')" class="fielderror"
-              py:content="tg.errors.get('userpassword')" />
+          <span py:replace="user_fields.krbprincipalkey.display(value_for(user_fields.krbprincipalkey))" />
+          <span py:if="tg.errors.get('krbprincipalkey')" class="fielderror"
+              py:content="tg.errors.get('krbprincipalkey')" />
 
           <script type="text/javascript">
-              document.getElementById('form_userpassword').disabled = true;
+              document.getElementById('form_krbprincipalkey').disabled = true;
           </script>
 
           <!-- 
@@ -286,7 +286,7 @@ from ipagui.helpers import ipahelper
                 {
                   method: 'get',
                   onSuccess: function(transport) {
-                    document.getElementById('form_userpassword').value =
+                    document.getElementById('form_krbprincipalkey').value =
                         transport.responseText;
                   }
                 });" />
@@ -294,10 +294,10 @@ from ipagui.helpers import ipahelper
           <input type="checkbox"
               onclick="togglePassword(this);"><span class="xsmall">edit</span></input>
           <script type="text/javascript">
-            document.getElementById('form_userpassword').style.display='none';
+            document.getElementById('form_krbprincipalkey').style.display='none';
 
             function togglePassword(checkbox) {
-              passwordField = document.getElementById('form_userpassword');
+              passwordField = document.getElementById('form_krbprincipalkey');
               passwordText = document.getElementById('password_text');
               passwordButton = document.getElementById('genpassword_button');
               if (checkbox.checked) {
@@ -317,17 +317,17 @@ from ipagui.helpers import ipahelper
 
       <tr>
         <th valign="top">
-          <label class="fieldlabel" for="${user_fields.userpassword_confirm.field_id}"
-            py:content="user_fields.userpassword_confirm.label" />:
+          <label class="fieldlabel" for="${user_fields.krbprincipalkey_confirm.field_id}"
+            py:content="user_fields.krbprincipalkey_confirm.label" />:
         </th>
         <td valign="top">
-          <span py:replace="user_fields.userpassword_confirm.display(
-               value_for(user_fields.userpassword_confirm))" />
-          <span py:if="tg.errors.get('userpassword_confirm')" class="fielderror"
-              py:content="tg.errors.get('userpassword_confirm')" />
+          <span py:replace="user_fields.krbprincipalkey_confirm.display(
+               value_for(user_fields.krbprincipalkey_confirm))" />
+          <span py:if="tg.errors.get('krbprincipalkey_confirm')" class="fielderror"
+              py:content="tg.errors.get('krbprincipalkey_confirm')" />
 
           <script type="text/javascript">
-              document.getElementById('form_userpassword_confirm').disabled = true;
+              document.getElementById('form_krbprincipalkey_confirm').disabled = true;
           </script>
         </td>
       </tr>
diff --git a/ipa-server/ipa-gui/ipagui/templates/usernewform.kid b/ipa-server/ipa-gui/ipagui/templates/usernewform.kid
index cc0bcf007..cd924a729 100644
--- a/ipa-server/ipa-gui/ipagui/templates/usernewform.kid
+++ b/ipa-server/ipa-gui/ipagui/templates/usernewform.kid
@@ -272,13 +272,13 @@ from ipagui.helpers import ipahelper
 
       <tr>
         <th>
-          <label class="fieldlabel" for="${user_fields.userpassword.field_id}"
-            py:content="user_fields.userpassword.label" />:
+          <label class="fieldlabel" for="${user_fields.krbprincipalkey.field_id}"
+            py:content="user_fields.krbprincipalkey.label" />:
         </th>
         <td>
-          <span py:replace="user_fields.userpassword.display(value_for(user_fields.userpassword))" />
-          <span py:if="tg.errors.get('userpassword')" class="fielderror"
-              py:content="tg.errors.get('userpassword')" />
+          <span py:replace="user_fields.krbprincipalkey.display(value_for(user_fields.krbprincipalkey))" />
+          <span py:if="tg.errors.get('krbprincipalkey')" class="fielderror"
+              py:content="tg.errors.get('krbprincipalkey')" />
 
           <!--
           <input type="button" value="Generate Password"
@@ -286,7 +286,7 @@ from ipagui.helpers import ipahelper
                 {
                   method: 'get',
                   onSuccess: function(transport) {
-                    document.getElementById('form_userpassword').value =
+                    document.getElementById('form_krbprincipalkey').value =
                         transport.responseText;
                   }
                 });" />
@@ -296,14 +296,14 @@ from ipagui.helpers import ipahelper
 
       <tr>
         <th>
-          <label class="fieldlabel" for="${user_fields.userpassword_confirm.field_id}"
-            py:content="user_fields.userpassword_confirm.label" />:
+          <label class="fieldlabel" for="${user_fields.krbprincipalkey_confirm.field_id}"
+            py:content="user_fields.krbprincipalkey_confirm.label" />:
         </th>
         <td>
-          <span py:replace="user_fields.userpassword_confirm.display(
-              value_for(user_fields.userpassword_confirm))" />
-          <span py:if="tg.errors.get('userpassword_confirm')" class="fielderror"
-              py:content="tg.errors.get('userpassword_confirm')" />
+          <span py:replace="user_fields.krbprincipalkey_confirm.display(
+              value_for(user_fields.krbprincipalkey_confirm))" />
+          <span py:if="tg.errors.get('krbprincipalkey_confirm')" class="fielderror"
+              py:content="tg.errors.get('krbprincipalkey_confirm')" />
         </td>
       </tr>