Convert nsaccountlock to always work as bool towards Python code

https://fedorahosted.org/freeipa/ticket/1259

Python code will see nsaccountlock as bool. JavaScript code will also see it as bool.

This allows native boolean operations with the lock field. Passes both CLI and WebUI tests.

2 files changed, 18 insertions, 13 deletions

diff --git a/ipalib/parameters.py b/ipalib/parameters.py
index 75981e960..da3b05cf7 100644
--- a/ipalib/parameters.py
+++ b/ipalib/parameters.py
@@ -904,8 +904,8 @@ class Bool(Param):
     # FIXME: This my quick hack to get some UI stuff working, change these defaults
     #   --jderose 2009-08-28
     kwargs = Param.kwargs + (
-        ('truths', frozenset, frozenset([1, u'1', u'true', u'TRUE'])),
-        ('falsehoods', frozenset, frozenset([0, u'0', u'false', u'FALSE'])),
+        ('truths', frozenset, frozenset([1, u'1', True, u'true', u'TRUE'])),
+        ('falsehoods', frozenset, frozenset([0, u'0', False, u'false', u'FALSE'])),
     )
 
     def _convert_scalar(self, value, index=None):
diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py
index 105814d5f..f0ee8f5b8 100644
--- a/ipalib/plugins/user.py
+++ b/ipalib/plugins/user.py
@@ -69,11 +69,19 @@ NO_UPG_MAGIC = '__no_upg__'
 
 def validate_nsaccountlock(entry_attrs):
     if 'nsaccountlock' in entry_attrs:
-        if not isinstance(entry_attrs['nsaccountlock'], basestring):
-            raise errors.OnlyOneValueAllowed(attr='nsaccountlock')
-        if entry_attrs['nsaccountlock'].lower() not in ('true','false'):
-            raise errors.ValidationError(name='nsaccountlock', error='must be TRUE or FALSE')
-
+        nsaccountlock = entry_attrs['nsaccountlock']
+        if not isinstance(nsaccountlock, (bool, Bool)):
+            if not isinstance(nsaccountlock, basestring):
+                raise errors.OnlyOneValueAllowed(attr='nsaccountlock')
+            if nsaccountlock.lower() not in ('true','false'):
+                raise errors.ValidationError(name='nsaccountlock', error='must be TRUE or FALSE')
+
+def convert_nsaccountlock(entry_attrs):
+    if not 'nsaccountlock' in entry_attrs:
+        entry_attrs['nsaccountlock'] = False
+    else:
+        nsaccountlock = Bool('temp')
+        entry_attrs['nsaccountlock'] = nsaccountlock.convert(entry_attrs['nsaccountlock'][0])
 
 class user(LDAPObject):
     """
@@ -428,8 +436,7 @@ class user_mod(LDAPUpdate):
         return dn
 
     def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
-        if not 'nsaccountlock' in entry_attrs:
-            entry_attrs['nsaccountlock'] = [u'False']
+        convert_nsaccountlock(entry_attrs)
         self.obj._convert_manager(entry_attrs, **options)
         return dn
 
@@ -460,8 +467,7 @@ class user_find(LDAPSearch):
         for entry in entries:
             (dn, attrs) = entry
             self.obj._convert_manager(attrs, **options)
-            if not 'nsaccountlock' in attrs:
-                attrs['nsaccountlock'] = [u'False']
+            convert_nsaccountlock(attrs)
 
     msg_summary = ngettext(
         '%(count)d user matched', '%(count)d users matched', 0
@@ -475,8 +481,7 @@ class user_show(LDAPRetrieve):
     Display information about a user.
     """
     def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
-        if not 'nsaccountlock' in entry_attrs:
-            entry_attrs['nsaccountlock'] = [u'False']
+        convert_nsaccountlock(entry_attrs)
         self.obj._convert_manager(entry_attrs, **options)
         return dn