summaryrefslogtreecommitdiffstats
path: root/ipaserver
diff options
context:
space:
mode:
authorRob Crittenden <rcritten@redhat.com>2011-02-19 23:09:03 -0500
committerRob Crittenden <rcritten@redhat.com>2011-02-21 11:21:23 -0500
commit2f82112bb3fdb02801fb1cb71c169dc77786cf39 (patch)
tree03b8786b987b45777713259f799063e4a72921f8 /ipaserver
parent18be4ebec317ad3e4d3b5684f506cadba8cdb837 (diff)
downloadfreeipa-2f82112bb3fdb02801fb1cb71c169dc77786cf39.tar.gz
freeipa-2f82112bb3fdb02801fb1cb71c169dc77786cf39.tar.xz
freeipa-2f82112bb3fdb02801fb1cb71c169dc77786cf39.zip
Add handling for indirect memberof other entries.
This creates a new custom attribute, memberofindirect_[plugin]. Using this you can tell the difference between being an actual memberof another entry and being a memberof as the result if inheritence. This is particularly useful when trying to remove members of an entry, you can only remove direct members. I had to add a couple of short sleep calls to make things work a little better. The memberof plugin runs as a postop and we have no way of knowing when it has done its work. If we don't pause we may show some stale data that memberof hasn't updated yet. .3 seconds is an arbitrary choice. ticket 966
Diffstat (limited to 'ipaserver')
-rw-r--r--ipaserver/plugins/ldap2.py71
1 files changed, 71 insertions, 0 deletions
diff --git a/ipaserver/plugins/ldap2.py b/ipaserver/plugins/ldap2.py
index 00d3a4be4..d1e31f5e6 100644
--- a/ipaserver/plugins/ldap2.py
+++ b/ipaserver/plugins/ldap2.py
@@ -32,6 +32,7 @@ import socket
import string
import shutil
import tempfile
+import time
import krbV
import ldap as _ldap
@@ -583,6 +584,21 @@ class ldap2(CrudBackend, Encoder):
time_limit=time_limit, size_limit=size_limit, normalize=normalize)
if len(indirect) > 0:
r[1]['memberindirect'] = indirect
+ if attrs_list and ('memberofindirect' in attrs_list or '*' in attrs_list):
+ for r in res:
+ if 'memberof' in r[1]:
+ memberof = r[1]['memberof']
+ del r[1]['memberof']
+ elif 'memberOf' in r[1]:
+ memberof = r[1]['memberOf']
+ del r[1]['memberOf']
+ else:
+ continue
+ (direct, indirect) = self.get_memberof(r[0], memberof, time_limit=time_limit, size_limit=size_limit, normalize=normalize)
+ if len(direct) > 0:
+ r[1]['memberof'] = direct
+ if len(indirect) > 0:
+ r[1]['memberofindirect'] = indirect
return (res, truncated)
@@ -745,6 +761,7 @@ class ldap2(CrudBackend, Encoder):
raise errors.EmptyModlist()
try:
self.conn.rename_s(dn, new_rdn, delold=int(del_old))
+ time.sleep(.3) # Give memberOf plugin a chance to work
except _ldap.LDAPError, e:
_handle_errors(e, **{})
@@ -942,6 +959,60 @@ class ldap2(CrudBackend, Encoder):
return entries
+ def get_memberof(self, entry_dn, memberof, time_limit=None, size_limit=None, normalize=True):
+ """
+ Examine the objects that an entry is a member of and determine if they
+ are a direct or indirect member of that group.
+
+ entry_dn: dn of the entry we want the direct/indirect members of
+ memberof: the memberOf attribute for entry_dn
+
+ Returns two memberof lists: (direct, indirect)
+ """
+
+ if not type(memberof) in (list, tuple):
+ return ([], [])
+ if len(memberof) == 0:
+ return ([], [])
+
+ attr_list = ["dn", "memberof"]
+ searchfilter = "(|(member=%s)(memberhost=%s)(memberuser=%s))" % (
+ entry_dn, entry_dn, entry_dn)
+
+ # We have to do three searches because netgroups and pbac are not
+ # within the accounts container.
+ try:
+ (results, truncated) = self.find_entries(searchfilter, attr_list,
+ api.env.container_accounts, time_limit=time_limit,
+ size_limit=size_limit, normalize=normalize)
+ except errors.NotFound:
+ results = []
+ try:
+ (netresults, truncated) = self.find_entries(searchfilter, attr_list,
+ api.env.container_netgroup, time_limit=time_limit,
+ size_limit=size_limit, normalize=normalize)
+ except errors.NotFound:
+ netresults = []
+ results = results + netresults
+ try:
+ (pbacresults, truncated) = self.find_entries(searchfilter,
+ attr_list, 'cn=pbac,%s' % api.env.basedn,
+ time_limit=time_limit, size_limit=size_limit,
+ normalize=normalize)
+ except errors.NotFound:
+ pbacresults = []
+ results = results + pbacresults
+
+ direct = []
+ indirect = []
+ for m in memberof:
+ indirect.append(m.lower())
+ for r in results:
+ direct.append(r[0])
+ indirect.remove(r[0].lower())
+
+ return (direct, indirect)
+
def set_entry_active(self, dn, active):
"""Mark entry active/inactive."""
assert isinstance(active, bool)