summaryrefslogtreecommitdiffstats
path: root/ipalib/plugins
diff options
context:
space:
mode:
authorTomas Babej <tbabej@redhat.com>2013-05-30 14:12:52 +0200
committerAlexander Bokovoy <abokovoy@redhat.com>2013-06-10 12:27:34 +0300
commitd2b943f08b6fd49b7adccbf6fa84e7d63d8f08b1 (patch)
tree0578886a8aeb5e5f180bde539a17af390eae5a2f /ipalib/plugins
parent11c0f0517f521cd36e407f6038e6eefdaf3441b3 (diff)
downloadfreeipa-d2b943f08b6fd49b7adccbf6fa84e7d63d8f08b1.tar.gz
freeipa-d2b943f08b6fd49b7adccbf6fa84e7d63d8f08b1.tar.xz
freeipa-d2b943f08b6fd49b7adccbf6fa84e7d63d8f08b1.zip
Extend idrange commands to support new range origin types
Following values of ipaRangeType attribute are supported and translated accordingly in the idrange commands: 'ipa-local': 'local domain range' 'ipa-ad-winsync': 'Active Directory winsync range' 'ipa-ad-trust': 'Active Directory domain range' 'ipa-ad-trust-posix': 'Active Directory trust range with POSIX attributes' 'ipa-ipa-trust': 'IPA trust range' Part of https://fedorahosted.org/freeipa/ticket/3647
Diffstat (limited to 'ipalib/plugins')
-rw-r--r--ipalib/plugins/idrange.py68
1 files changed, 54 insertions, 14 deletions
diff --git a/ipalib/plugins/idrange.py b/ipalib/plugins/idrange.py
index 73628795a..257730986 100644
--- a/ipalib/plugins/idrange.py
+++ b/ipalib/plugins/idrange.py
@@ -19,7 +19,7 @@
from ipalib.plugins.baseldap import (LDAPObject, LDAPCreate, LDAPDelete,
LDAPRetrieve, LDAPSearch, LDAPUpdate)
-from ipalib import api, Int, Str, DeprecatedParam, _, ngettext
+from ipalib import api, Int, Str, DeprecatedParam, StrEnum, _, ngettext
from ipalib import errors
from ipapython.dn import DN
@@ -168,6 +168,15 @@ class idrange(LDAPObject):
label = _('ID Ranges')
label_singular = _('ID Range')
+ range_types = {
+ u'ipa-local': unicode(_('local domain range')),
+ u'ipa-ad-winsync': unicode(_('Active Directory winsync range')),
+ u'ipa-ad-trust': unicode(_('Active Directory domain range')),
+ u'ipa-ad-trust-posix': unicode(_('Active Directory trust range with '
+ 'POSIX attributes')),
+ u'ipa-ipa-trust': unicode(_('IPA trust range')),
+ }
+
takes_params = (
Str('cn',
cli_name='name',
@@ -200,18 +209,23 @@ class idrange(LDAPObject):
flags=('no_search', 'virtual_attribute', 'no_update'),
label=_('Name of the trusted domain'),
),
- Str('iparangetype?',
+ StrEnum('iparangetype?',
label=_('Range type'),
- flags=['no_option'],
+ cli_name='type',
+ doc=(_('ID range type, one of {vals}'
+ .format(vals=', '.join(range_types.keys())))),
+ values=tuple(range_types.keys()),
+ flags=['no_update'],
)
)
def handle_iparangetype(self, entry_attrs, options, keep_objectclass=False):
- if not options.get('pkey_only', False):
- if 'ipatrustedaddomainrange' in entry_attrs.get('objectclass', []):
- entry_attrs['iparangetype'] = [unicode(_('Active Directory domain range'))]
- else:
- entry_attrs['iparangetype'] = [unicode(_(u'local domain range'))]
+ if not any((options.get('pkey_only', False),
+ options.get('raw', False))):
+ range_type = entry_attrs['iparangetype'][0]
+ entry_attrs['iparangetype'] = self.range_types.get(range_type, None)
+
+ # Remove the objectclass
if not keep_objectclass:
if not options.get('all', False) or options.get('pkey_only', False):
entry_attrs.pop('objectclass', None)
@@ -418,7 +432,21 @@ class idrange_add(LDAPCreate):
'not be found. Please specify the SID directly '
'using dom-sid option.'))
+ # ipaNTTrustedDomainSID attribute set, this is AD Trusted domain range
if is_set('ipanttrusteddomainsid'):
+ entry_attrs['objectclass'].append('ipatrustedaddomainrange')
+
+ # Default to ipa-ad-trust if no type set
+ if 'iparangetype' not in entry_attrs:
+ entry_attrs['iparangetype'] = u'ipa-ad-trust'
+
+ if entry_attrs['iparangetype'] not in (u'ipa-ad-trust',
+ u'ipa-ad-trust-posix'):
+ raise errors.ValidationError('ID Range setup',
+ error=_('IPA Range type must be one of ipa-ad-trust '
+ 'or ipa-ad-trust-posix when SID of the trusted '
+ 'domain is specified.'))
+
if is_set('ipasecondarybaserid'):
raise errors.ValidationError(name='ID Range setup',
error=_('Options dom-sid/dom-name and secondary-rid-base '
@@ -431,11 +459,24 @@ class idrange_add(LDAPCreate):
# Validate SID as the one of trusted domains
self.obj.validate_trusted_domain_sid(entry_attrs['ipanttrusteddomainsid'])
- # Finally, add trusted AD domain range object class
- entry_attrs['objectclass'].append('ipatrustedaddomainrange')
+ # ipaNTTrustedDomainSID attribute not set, this is local domain range
else:
- # secondary base rid must be set if and only if base rid is set
+ entry_attrs['objectclass'].append('ipadomainidrange')
+
+ # Default to ipa-local if no type set
+ if 'iparangetype' not in entry_attrs:
+ entry_attrs['iparangetype'] = 'ipa-local'
+
+ # TODO: can also be ipa-ad-winsync here?
+ if entry_attrs['iparangetype'] in (u'ipa-ad-trust',
+ u'ipa-ad-trust-posix'):
+ raise errors.ValidationError('ID Range setup',
+ error=_('IPA Range type must not be one of ipa-ad-trust '
+ 'or ipa-ad-trust-posix when SID of the trusted '
+ 'domain is not specified.'))
+
+ # secondary base rid must be set if and only if base rid is set
if is_set('ipasecondarybaserid') != is_set('ipabaserid'):
raise errors.ValidationError(name='ID Range setup',
error=_('Options secondary-rid-base and rid-base must '
@@ -451,13 +492,12 @@ class idrange_add(LDAPCreate):
error=_("Primary RID range and secondary RID range"
" cannot overlap"))
- entry_attrs['objectclass'].append('ipadomainidrange')
-
return dn
def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
assert isinstance(dn, DN)
- self.obj.handle_iparangetype(entry_attrs, options, keep_objectclass=True)
+ self.obj.handle_iparangetype(entry_attrs, options,
+ keep_objectclass=True)
return dn
class idrange_del(LDAPDelete):