ACI plugin supports prefixes

When more than one plugin produce ACIs, they share common namespace
of ACI name. This may lead to name collisions between the ACIs
from different plugins.

This patch introduces a mandatory "prefix" attribute for non-find
ACI operations which allow plugins to use their own prefixes
(i.e. namespaces) which is then used when a name of the ACI is
generated.

Permission, Delegation and Selfservice plugins has been updated
to use their own prefixes thus avoiding name collisions by using
their own namespaces. Default ACIs in LDIFs has been updated to
follow this new policy.

Permission plugin now uses its CN (=primary key) instead of
description in ACI names as Description may not be unique.

This change requires an IPA server reinstall since the default ACI
set has been changed.

https://fedorahosted.org/freeipa/ticket/764

1 files changed, 15 insertions, 1 deletions

diff --git a/ipalib/plugins/selfservice.py b/ipalib/plugins/selfservice.py
index adf6acb79..557304241 100644
--- a/ipalib/plugins/selfservice.py
+++ b/ipalib/plugins/selfservice.py
@@ -50,6 +50,8 @@ from ipalib import api, crud, errors
 from ipalib import output
 from ipalib import Object, Command
 
+ACI_PREFIX=u"selfservice"
+
 def is_selfservice(aciname):
     """
     Determine if the ACI is a Self-Service ACI and raise an exception if it
@@ -57,7 +59,7 @@ def is_selfservice(aciname):
 
     Return the result if it is a self-service ACI.
     """
-    result = api.Command['aci_show'](aciname)['result']
+    result = api.Command['aci_show'](aciname, aciprefix=ACI_PREFIX)['result']
     if 'selfaci' not in result or result['selfaci'] == False:
         raise errors.NotFound(reason=_('Self-service permission \'%(permission)s\' not found') % dict(permission=aciname))
     return result
@@ -119,7 +121,9 @@ class selfservice_add(crud.Create):
         if not 'permissions' in kw:
             kw['permissions'] = (u'write',)
         kw['selfaci'] = True
+        kw['aciprefix'] = ACI_PREFIX
         result = api.Command['aci_add'](aciname, **kw)['result']
+        del result['aciprefix']     # do not include prefix in result
 
         return dict(
             result=result,
@@ -139,7 +143,9 @@ class selfservice_del(crud.Delete):
 
     def execute(self, aciname, **kw):
         is_selfservice(aciname)
+        kw['aciprefix'] = ACI_PREFIX
         result = api.Command['aci_del'](aciname, **kw)
+
         return dict(
             result=True,
             value=aciname,
@@ -159,7 +165,10 @@ class selfservice_mod(crud.Update):
         is_selfservice(aciname)
         if 'attrs' in kw and kw['attrs'] is None:
             raise errors.RequirementError(name='attrs')
+
+        kw['aciprefix'] = ACI_PREFIX
         result = api.Command['aci_mod'](aciname, **kw)['result']
+        del result['aciprefix']     # do not include prefix in result
         return dict(
             result=result,
             value=aciname,
@@ -179,8 +188,12 @@ class selfservice_find(crud.Search):
 
     def execute(self, term, **kw):
         kw['selfaci'] = True
+        kw['aciprefix'] = ACI_PREFIX
         result = api.Command['aci_find'](term, **kw)['result']
 
+        for aci in result:
+            del aci['aciprefix']     # do not include prefix in result
+
         return dict(
             result=result,
             count=len(result),
@@ -202,6 +215,7 @@ class selfservice_show(crud.Retrieve):
 
     def execute(self, aciname, **kw):
         result = is_selfservice(aciname)
+        del result['aciprefix']     # do not include prefix in result
         return dict(
             result=result,
             value=aciname,