Add plugin framework to LDAP updates.

There are two reasons for the plugin framework:
1. To provide a way of doing manual/complex LDAP changes without having
   to keep extending ldapupdate.py (like we did with managed entries).
2. Allows for better control of restarts.

There are two types of plugins, preop and postop. A preop plugin runs
before any file-based updates are loaded. A postop plugin runs after
all file-based updates are applied.

A preop plugin may update LDAP directly or craft update entries to be
applied with the file-based updates.

Either a preop or postop plugin may attempt to restart the dirsrv instance.
The instance is only restartable if ipa-ldap-updater is being executed
as root. A warning is printed if a restart is requested for a non-root
user.

Plugins are not executed by default. This is so we can use ldapupdate
to apply simple updates in commands like ipa-nis-manage.

https://fedorahosted.org/freeipa/ticket/1789
https://fedorahosted.org/freeipa/ticket/1790
https://fedorahosted.org/freeipa/ticket/2032

1 files changed, 42 insertions, 2 deletions

diff --git a/ipalib/frontend.py b/ipalib/frontend.py
index 3dc30daee..2ab457c3d 100644
--- a/ipalib/frontend.py
+++ b/ipalib/frontend.py
@@ -30,7 +30,7 @@ from util import make_repr
 from output import Output, Entry, ListOfEntries
 from text import _, ngettext
 
-from errors import ZeroArgumentError, MaxArgumentError, OverlapError, RequiresRoot, VersionError, RequirementError
+from errors import ZeroArgumentError, MaxArgumentError, OverlapError, RequiresRoot, VersionError, RequirementError, ValidationError
 from errors import InvocationError
 from constants import TYPE_ERROR
 from ipapython.version import API_VERSION
@@ -557,7 +557,11 @@ class Command(HasParam):
                 # None means "delete this attribute"
                 value = None
             if attr in self.params:
-                value = self.params[attr](value)
+                try:
+                    value = self.params[attr](value)
+                except ValidationError, err:
+                    (name, error) = str(err.strerror).split(':')
+                    raise ValidationError(name=attr, error=error)
             if append and attr in newdict:
                 if type(value) in (tuple,):
                     newdict[attr] += list(value)
@@ -1334,3 +1338,39 @@ class Property(Attribute):
                 attr = getattr(self, name)
                 if is_rule(attr):
                     yield attr
+
+class Updater(Method):
+    """
+    An LDAP update with an associated object (always update).
+
+    All plugins that subclass from `Updater` will be automatically available
+    as a server update function.
+
+    Plugins that subclass from Updater are registered in the ``api.Updater``
+    namespace. For example:
+
+    >>> from ipalib import create_api
+    >>> api = create_api()
+    >>> class my(Object):
+    ...     pass
+    ...
+    >>> api.register(my)
+    >>> class my_update(Updater):
+    ...     pass
+    ...
+    >>> api.register(my_update)
+    >>> api.finalize()
+    >>> list(api.Updater)
+    ['my_update']
+    >>> api.Updater.my_update # doctest:+ELLIPSIS
+    ipalib.frontend.my_update()
+    """
+    def __init__(self):
+        super(Updater, self).__init__()
+
+    def __call__(self, **options):
+        self.debug(
+            'raw: %s', self.name
+        )
+
+        return self.execute(**options)