ACI plugin supports prefixes

When more than one plugin produce ACIs, they share common namespace
of ACI name. This may lead to name collisions between the ACIs
from different plugins.

This patch introduces a mandatory "prefix" attribute for non-find
ACI operations which allow plugins to use their own prefixes
(i.e. namespaces) which is then used when a name of the ACI is
generated.

Permission, Delegation and Selfservice plugins has been updated
to use their own prefixes thus avoiding name collisions by using
their own namespaces. Default ACIs in LDIFs has been updated to
follow this new policy.

Permission plugin now uses its CN (=primary key) instead of
description in ACI names as Description may not be unique.

This change requires an IPA server reinstall since the default ACI
set has been changed.

https://fedorahosted.org/freeipa/ticket/764

1 files changed, 8 insertions, 1 deletions

diff --git a/ipalib/plugins/delegation.py b/ipalib/plugins/delegation.py
index 19d4c6da6..d5ff08a82 100644
--- a/ipalib/plugins/delegation.py
+++ b/ipalib/plugins/delegation.py
@@ -50,6 +50,8 @@ from ipalib import api, crud, errors
 from ipalib import output
 from ipalib import Object, Command
 
+ACI_PREFIX=u"delegation"
+
 def convert_delegation(ldap, aci):
     """
     memberOf is in filter but we want to pull out the group for easier
@@ -70,6 +72,7 @@ def convert_delegation(ldap, aci):
     aci['membergroup'] = entry_attrs['cn']
 
     del aci['filter']
+    del aci['aciprefix']     # do not include prefix in result
 
     return aci
 
@@ -81,7 +84,7 @@ def is_delegation(ldap, aciname):
     Return the result if it is a delegation ACI, adding a new attribute
     membergroup.
     """
-    result = api.Command['aci_show'](aciname)['result']
+    result = api.Command['aci_show'](aciname, aciprefix=ACI_PREFIX)['result']
     if 'filter' in result:
         result = convert_delegation(ldap, result)
     else:
@@ -157,6 +160,7 @@ class delegation_add(crud.Create):
         ldap = self.api.Backend.ldap2
         if not 'permissions' in kw:
             kw['permissions'] = (u'write',)
+        kw['aciprefix'] = ACI_PREFIX
         result = api.Command['aci_add'](aciname, **kw)['result']
         if 'filter' in result:
             result = convert_delegation(ldap, result)
@@ -180,6 +184,7 @@ class delegation_del(crud.Delete):
     def execute(self, aciname, **kw):
         ldap = self.api.Backend.ldap2
         is_delegation(ldap, aciname)
+        kw['aciprefix'] = ACI_PREFIX
         result = api.Command['aci_del'](aciname, **kw)
         return dict(
             result=True,
@@ -199,6 +204,7 @@ class delegation_mod(crud.Update):
     def execute(self, aciname, **kw):
         ldap = self.api.Backend.ldap2
         is_delegation(ldap, aciname)
+        kw['aciprefix'] = ACI_PREFIX
         result = api.Command['aci_mod'](aciname, **kw)['result']
         if 'filter' in result:
             result = convert_delegation(ldap, result)
@@ -221,6 +227,7 @@ class delegation_find(crud.Search):
 
     def execute(self, term, **kw):
         ldap = self.api.Backend.ldap2
+        kw['aciprefix'] = ACI_PREFIX
         acis = api.Command['aci_find'](term, **kw)['result']
         results = []
         for aci in acis: