When getting members let user indicate what type of member they want.

The memberOf attribute includes members that are directly in the group
via the "member" attribute and those that are included as a result of
being in a group that is in the group.

The UI needs to be able to distinguish between the two.

438706

4 files changed, 77 insertions, 7 deletions

diff --git a/ipa-server/ipa-gui/ipagui/static/javascript/dynamicedit.js b/ipa-server/ipa-gui/ipagui/static/javascript/dynamicedit.js
index 4d73711e6..b670c457f 100644
--- a/ipa-server/ipa-gui/ipagui/static/javascript/dynamicedit.js
+++ b/ipa-server/ipa-gui/ipagui/static/javascript/dynamicedit.js
@@ -88,10 +88,23 @@ var dn_to_member_div_id = new Hash();
  */
 function renderMemberInfo(newdiv, info) {
   if (info.type == "user") {
+    bold = document.createElement('b');
+    bold.appendChild(document.createTextNode(
+      info.name + " " + info.descr + " "));
+    newdiv.appendChild(bold);
+  } else if (info.type == "iuser") {
     newdiv.appendChild(document.createTextNode(
       info.name + " " + info.descr + " "));
   } else if (info.type == "group") {
     ital = document.createElement('i');
+    bold = document.createElement('b');
+    ital.appendChild(bold);
+    bold.appendChild(document.createTextNode(
+      info.name + " " + 
+      info.descr + " "));
+    newdiv.appendChild(ital);
+  } else if (info.type == "igroup") {
+    ital = document.createElement('i');
     ital.appendChild(document.createTextNode(
       info.name + " " + 
       info.descr + " "));
diff --git a/ipa-server/ipa-gui/ipagui/subcontrollers/group.py b/ipa-server/ipa-gui/ipagui/subcontrollers/group.py
index 08ecf32ad..eac5cb0bd 100644
--- a/ipa-server/ipa-gui/ipagui/subcontrollers/group.py
+++ b/ipa-server/ipa-gui/ipagui/subcontrollers/group.py
@@ -208,7 +208,7 @@ class GroupController(IPAController):
             # convert members to users, for easier manipulation on the page
             #
 
-            members = client.group_members(group.dn, ['dn', 'givenname', 'sn', 'uid', 'cn'])
+            members = client.group_members(group.dn, ['dn', 'givenname', 'sn', 'uid', 'cn'], 1)
             members = members[1:]
             members.sort(self.sort_group_member)
 
@@ -216,6 +216,20 @@ class GroupController(IPAController):
             # (so we don't have to do this on each round trip)
             member_dicts = map(lambda member: member.toDict(), members)
 
+            indirect_members = client.group_members(group.dn, ['dn', 'givenname', 'sn', 'uid', 'cn'], 2)
+            indirect_members = indirect_members[1:]
+            indirect_members.sort(self.sort_group_member)
+
+            # add our own flag
+            for i in range(len(indirect_members)):
+                indirect_members[i].setValue('inherited', True)
+
+            # Map users into an array of dicts, which can be serialized
+            # (so we don't have to do this on each round trip)
+            indirect_members_dicts = map(lambda member: member.toDict(), indirect_members)
+
+            member_dicts = member_dicts + indirect_members_dicts
+
             # store a copy of the original group for the update later
             group_data = b64encode(dumps(group_dict))
             member_data = b64encode(dumps(member_dicts))
@@ -411,11 +425,26 @@ class GroupController(IPAController):
             # convert members to users, for display on the page
             #
 
-            members = client.group_members(group.dn, ['dn', 'givenname', 'sn', 'uid', 'cn'])
+            members = client.group_members(group.dn, ['dn', 'givenname', 'sn', 'uid', 'cn'], 1)
             members = members[1:]
             members.sort(self.sort_group_member)
             member_dicts = map(lambda member: member.toDict(), members)
 
+            indirect_members = client.group_members(group.dn, ['dn', 'givenname', 'sn', 'uid', 'cn'], 2)
+            indirect_members = indirect_members[1:]
+            indirect_members.sort(self.sort_group_member)
+
+            # add our own flag
+            for i in range(len(indirect_members)):
+                indirect_members[i].setValue('inherited', True)
+
+            # Map users into an array of dicts, which can be serialized
+            # (so we don't have to do this on each round trip)
+            indirect_members_dicts = map(lambda member: member.toDict(), indirect_members)
+
+            member_dicts = member_dicts + indirect_members_dicts
+            logging.info("%s" % member_dicts)
+
             return dict(group=group_dict, fields=ipagui.forms.group.GroupFields(),
                     members = member_dicts)
         except ipaerror.IPAError, e:
diff --git a/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
index 7f446b036..78f76b0a1 100644
--- a/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
+++ b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
@@ -158,15 +158,22 @@ from ipagui.helpers import ipahelper
           member_dn_esc = ipahelper.javascript_string_escape(member_dn)
 
           member_uid = member.get('uid')
+          member_inherited = member.get('inherited')
           if member_uid:
               member_name = "%s %s" % (member.get('givenName', ''),
                                      member.get('sn', ''))
               member_descr = "(%s)" % member.get('uid')
-              member_type = "user"
+              if member_inherited:
+                  member_type = "iuser"
+              else:
+                  member_type = "user"
           else:
               member_name = member.get('cn')
               member_descr = "[group]"
-              member_type = "group"
+              if member_inherited:
+                  member_type = "igroup"
+              else:
+                  member_type = "group"
           member_name_esc = ipahelper.javascript_string_escape(member_name)
           member_descr_esc = ipahelper.javascript_string_escape(member_descr)
           member_type_esc = ipahelper.javascript_string_escape(member_type)
@@ -178,7 +185,7 @@ from ipagui.helpers import ipahelper
                                                '${member_descr_esc}',
                                                '${member_type_esc}'));
           </script>
-          <a href="#" 
+          <a py:if="member_inherited != True" href="#" 
             onclick="removememberHandler(this, '${member_dn_esc}',
                          new MemberDisplayInfo('${member_name_esc}',
                                                '${member_descr_esc}',
diff --git a/ipa-server/ipa-gui/ipagui/templates/groupshow.kid b/ipa-server/ipa-gui/ipagui/templates/groupshow.kid
index 0ddb93851..d0ca6982a 100644
--- a/ipa-server/ipa-gui/ipagui/templates/groupshow.kid
+++ b/ipa-server/ipa-gui/ipagui/templates/groupshow.kid
@@ -73,10 +73,14 @@ from ipagui.helpers import userhelper
       <?python
 
       member_uid = member.get('uid')
+      member_inherited = member.get('inherited')
       if member_uid:
           member_cn = "%s %s" % (member.get('givenName', ''), member.get('sn', ''))
           member_desc = "(%s)" % member_uid
-          member_type = "user"
+          if member_inherited:
+              member_type = "iuser"
+          else:
+              member_type = "user"
           view_url = tg.url('/user/show', uid=member_uid)
       else:
           mem = member.get('cn')
@@ -84,14 +88,31 @@ from ipagui.helpers import userhelper
               mem = mem[0]
           member_cn = "%s" % mem
           member_desc = "[group]"
-          member_type = "group"
+          if member_inherited:
+              member_type = "igroup"
+          else:
+              member_type = "group"
           view_url = tg.url('/group/show', cn=member_cn)
       ?>
       <span py:if='member_type == "user"'>
+        <b>
+        <a href="${view_url}"
+          >${member_cn}</a> ${member_desc}
+        </b>
+      </span>
+      <span py:if='member_type == "iuser"'>
         <a href="${view_url}"
           >${member_cn}</a> ${member_desc}
       </span>
       <span py:if='member_type == "group"'>
+        <b>
+        <i>
+          <a href="${view_url}"
+            >${member_cn}</a> ${member_desc}
+        </i>
+        </b>
+      </span>
+      <span py:if='member_type == "igroup"'>
         <i>
           <a href="${view_url}"
             >${member_cn}</a> ${member_desc}