summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--ipa-admintools/Makefile2
-rw-r--r--ipa-admintools/ipa-adduser3
-rw-r--r--ipa-admintools/ipa-deluser66
-rw-r--r--ipa-admintools/ipa-finduser3
-rw-r--r--ipa-admintools/ipa-usermod3
-rw-r--r--ipa-python/ipaclient.py33
-rw-r--r--ipa-python/rpcclient.py30
-rw-r--r--ipa-server/ipaserver/ipaldap.py24
-rw-r--r--ipa-server/xmlrpc-server/funcs.py61
-rw-r--r--ipa-server/xmlrpc-server/ipaxmlrpc.py1
10 files changed, 211 insertions, 15 deletions
diff --git a/ipa-admintools/Makefile b/ipa-admintools/Makefile
index e0fd405ab..69bf18537 100644
--- a/ipa-admintools/Makefile
+++ b/ipa-admintools/Makefile
@@ -5,6 +5,8 @@ all: ;
install:
install -m 755 ipa-adduser $(SBINDIR)
install -m 755 ipa-finduser $(SBINDIR)
+ install -m 755 ipa-usermod $(SBINDIR)
+ install -m 755 ipa-deluser $(SBINDIR)
clean:
rm -f *~ *.pyc
diff --git a/ipa-admintools/ipa-adduser b/ipa-admintools/ipa-adduser
index af922833d..64c94e1d0 100644
--- a/ipa-admintools/ipa-adduser
+++ b/ipa-admintools/ipa-adduser
@@ -83,6 +83,9 @@ def main():
except kerberos.GSSError, e:
print "Could not initialize GSSAPI: %s/%s" % (e[0][0][0], e[0][1][0])
return 1
+ except xmlrpclib.ProtocolError, e:
+ print "Unable to connect to IPA server: %s" % (e.errmsg)
+ return 1
return 0
diff --git a/ipa-admintools/ipa-deluser b/ipa-admintools/ipa-deluser
new file mode 100644
index 000000000..c6d5a8d77
--- /dev/null
+++ b/ipa-admintools/ipa-deluser
@@ -0,0 +1,66 @@
+#! /usr/bin/python -E
+# Authors: Rob Crittenden <rcritten@redhat.com>
+#
+# Copyright (C) 2007 Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; version 2 only
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+#
+
+import sys
+from optparse import OptionParser
+import ipa
+import ipa.ipaclient as ipaclient
+import ipa.config
+
+import xmlrpclib
+import kerberos
+
+def usage():
+ print "ipa-adduser user"
+ sys.exit(1)
+
+def parse_options():
+ parser = OptionParser()
+ parser.add_option("--usage", action="store_true",
+ help="Program usage")
+
+ args = ipa.config.init_config(sys.argv)
+ options, args = parser.parse_args(args)
+
+ return options, args
+
+def main():
+ options, args = parse_options()
+
+ if len(args) != 2:
+ usage()
+
+ try:
+ client = ipaclient.IPAClient()
+ client.mark_user_deleted(args[1])
+ print args[1] + " successfully deleted"
+ except xmlrpclib.Fault, f:
+ print f.faultString
+ return 1
+ except kerberos.GSSError, e:
+ print "Could not initialize GSSAPI: %s/%s" % (e[0][0][0], e[0][1][0])
+ return 1
+ except xmlrpclib.ProtocolError, e:
+ print "Unable to connect to IPA server: %s" % (e.errmsg)
+ return 1
+
+ return 0
+
+main()
diff --git a/ipa-admintools/ipa-finduser b/ipa-admintools/ipa-finduser
index b16c19d99..4b1651c0b 100644
--- a/ipa-admintools/ipa-finduser
+++ b/ipa-admintools/ipa-finduser
@@ -71,6 +71,9 @@ def main():
except kerberos.GSSError, e:
print "Could not initialize GSSAPI: %s/%s" % (e[0][0][0], e[0][1][0])
return 1
+ except xmlrpclib.ProtocolError, e:
+ print "Unable to connect to IPA server: %s" % (e.errmsg)
+ return 1
return 0
diff --git a/ipa-admintools/ipa-usermod b/ipa-admintools/ipa-usermod
index d2aff4abf..33d35d21a 100644
--- a/ipa-admintools/ipa-usermod
+++ b/ipa-admintools/ipa-usermod
@@ -76,6 +76,9 @@ def main():
except kerberos.GSSError, e:
print "Could not initialize GSSAPI: %s/%s" % (e[0][0][0], e[0][1][0])
return 1
+ except xmlrpclib.ProtocolError, e:
+ print "Unable to connect to IPA server: %s" % (e.errmsg)
+ return 1
return 0
diff --git a/ipa-python/ipaclient.py b/ipa-python/ipaclient.py
index 626e0a111..783c7ec85 100644
--- a/ipa-python/ipaclient.py
+++ b/ipa-python/ipaclient.py
@@ -41,14 +41,19 @@ class IPAClient:
self.transport = rpcclient.RPCClient()
def set_principal(self,princ):
+ """Set the name of the principal that will be used for
+ LDAP proxy authentication"""
if self.local:
self.transport.set_principal(princ)
- def get_user(self,uid):
- result = self.transport.get_user(uid)
+ def get_user(self,uid,sattrs=None):
+ """Get a specific user by uid. If sattrs is set then only those
+ attributes will be returned."""
+ result = self.transport.get_user(uid,sattrs)
return user.User(result)
def add_user(self,user):
+ """Add a user. user is a dict of attribute/value pairs"""
realm = config.config.get_realm()
@@ -73,32 +78,48 @@ class IPAClient:
return result
def get_all_users(self):
+ """Get as a list of User objects all users in the directory"""
result = self.transport.get_all_users()
all_users = []
for (attrs) in result:
- if attrs is not None:
- all_users.append(user.User(attrs))
+ if attrs is not None:
+ all_users.append(user.User(attrs))
return all_users
def get_add_schema(self):
+ """Prototype for the GUI. Specify in the directory fields to
+ be displayed and what data to get for new users."""
result = self.transport.get_add_schema()
return result
def find_users(self, criteria, sattrs=None):
+ """Find users whose uid matches the criteria. Wildcards are
+ acceptable. Returns a list of User objects."""
result = self.transport.find_users(criteria, sattrs)
users = []
for (attrs) in result:
- if attrs is not None:
- users.append(user.User(attrs))
+ if attrs is not None:
+ users.append(user.User(attrs))
return users
def update_user(self,olduser,newuser):
+ """Update a user entry. olduser is a dict of attribute/value pairs
+ of the original entry. newuser is a dict of attribute/value pairs
+ of the new entry."""
realm = config.config.get_realm()
result = self.transport.update_user(olduser,newuser)
return result
+
+ def mark_user_deleted(self,uid):
+ """Set a user as inactive by uid."""
+
+ realm = config.config.get_realm()
+
+ result = self.transport.mark_user_deleted(uid)
+ return result
diff --git a/ipa-python/rpcclient.py b/ipa-python/rpcclient.py
index abff0f8fa..477b4e3cf 100644
--- a/ipa-python/rpcclient.py
+++ b/ipa-python/rpcclient.py
@@ -39,9 +39,12 @@ class RPCClient:
ipa.config.init_config()
def server_url(self):
+ """Build the XML-RPC server URL from our configuration"""
return "http://" + config.config.get_server() + "/ipa"
def setup_server(self):
+ """Create our XML-RPC server connection using kerberos
+ authentication"""
return xmlrpclib.ServerProxy(self.server_url(), KerbTransport())
def convert_entry(self,ent):
@@ -63,11 +66,15 @@ class RPCClient:
return user
- def get_user(self,username):
- """Get a specific user"""
+ def get_user(self,username,sattrs=None):
+ """Get a specific user. If sattrs is not None then only those
+ attributes will be returned. The result is a dict."""
server = self.setup_server()
try:
- result = server.get_user(username)
+ if sattrs is not None:
+ result = server.get_user(username,sattrs)
+ else:
+ result = server.get_user(username)
except xmlrpclib.Fault, fault:
raise xmlrpclib.Fault(fault.faultCode, fault.faultString)
except socket.error, (value, msg):
@@ -76,7 +83,9 @@ class RPCClient:
return result
def add_user(self,user):
- """Add a new user"""
+ """Add a new user. Takes as input a dict where the key is the
+ attribute name and the value is either a string or in the case
+ of a multi-valued field a list of values"""
server = self.setup_server()
try:
@@ -147,3 +156,16 @@ class RPCClient:
raise xmlrpclib.Fault(value, msg)
return result
+
+ def mark_user_deleted(self,uid):
+ """Mark a user as deleted/inactive"""
+ server = self.setup_server()
+
+ try:
+ result = server.mark_user_deleted(uid)
+ except xmlrpclib.Fault, fault:
+ raise xmlrpclib.Fault(fault.faultCode, fault.faultString)
+ except socket.error, (value, msg):
+ raise xmlrpclib.Fault(value, msg)
+
+ return result
diff --git a/ipa-server/ipaserver/ipaldap.py b/ipa-server/ipaserver/ipaldap.py
index 08113b4c8..936dd662b 100644
--- a/ipa-server/ipaserver/ipaldap.py
+++ b/ipa-server/ipaserver/ipaldap.py
@@ -321,8 +321,28 @@ class IPAdmin(SimpleLDAPObject):
try:
self.set_option(ldap.OPT_SERVER_CONTROLS, sctrl)
self.modify_s(dn, modlist)
- except ldap.ALREADY_EXISTS:
- raise ldap.ALREADY_EXISTS
+ except ldap.LDAPError, e:
+ raise e
+ return "Success"
+
+ def inactivateEntry(self,dn,has_key):
+ """Rather than deleting entries we mark them as inactive.
+ has_key defines whether the entry already has nsAccountlock
+ set so we can determine which type of mod operation to run."""
+
+ sctrl = self.__get_server_controls__()
+ modlist=[]
+
+ if has_key == True:
+ operation = ldap.MOD_REPLACE
+ else:
+ operation = ldap.MOD_ADD
+
+ modlist.append((operation, "nsAccountlock", "true"))
+
+ try:
+ self.set_option(ldap.OPT_SERVER_CONTROLS, sctrl)
+ self.modify_s(dn, modlist)
except ldap.LDAPError, e:
raise e
return "Success"
diff --git a/ipa-server/xmlrpc-server/funcs.py b/ipa-server/xmlrpc-server/funcs.py
index 358f04f2a..ec099badc 100644
--- a/ipa-server/xmlrpc-server/funcs.py
+++ b/ipa-server/xmlrpc-server/funcs.py
@@ -125,12 +125,28 @@ class IPAServer:
return user
- def get_user (self, username, opts=None):
+ def get_user (self, args, sattrs=None, opts=None):
"""Get a specific user's entry. Return as a dict of values.
Multi-valued fields are represented as lists.
"""
global _LDAPPool
ent=""
+
+ # The XML-RPC server marshals the arguments into one variable
+ # while the direct caller has them separate. So do a little
+ # bit of gymnastics to figure things out. There has to be a
+ # better way, so FIXME
+ if isinstance(args,tuple):
+ opts = sattrs
+ if len(args) == 2:
+ username = args[0]
+ sattrs = args[1]
+ else:
+ username = args
+ sattrs = None
+ else:
+ username = args
+
if opts:
self.set_principal(opts['remoteuser'])
if (isinstance(username, tuple)):
@@ -146,7 +162,7 @@ class IPAServer:
filter = "(uid=" + username + ")"
try:
m1 = _LDAPPool.getConn(self.host,self.port,self.bindca,self.bindcert,self.bindkey,dn)
- ent = m1.getEntry(self.basedn, self.scope, filter, None)
+ ent = m1.getEntry(self.basedn, self.scope, filter, sattrs)
_LDAPPool.releaseConn(m1)
except ldap.LDAPError, e:
raise xmlrpclib.Fault(1, e)
@@ -156,7 +172,10 @@ class IPAServer:
return self.convert_entry(ent)
def add_user (self, user, user_container="ou=users,ou=default",opts=None):
- """Add a user in LDAP"""
+ """Add a user in LDAP. Takes as input a dict where the key is the
+ attribute name and the value is either a string or in the case
+ of a multi-valued field a list of values. user_container sets
+ where in the tree the user is placed."""
global _LDAPPool
if (isinstance(user, tuple)):
user = user[0]
@@ -372,3 +391,39 @@ class IPAServer:
return res
except ldap.LDAPError, e:
raise xmlrpclib.Fault(1, str(e))
+
+ def mark_user_deleted (self, args, opts=None):
+ """Mark a user as inactive in LDAP. We aren't actually deleting
+ users here, just making it so they can't log in, etc."""
+ global _LDAPPool
+
+ uid = args[0]
+
+ if opts:
+ self.set_principal(opts['remoteuser'])
+
+ try:
+ proxydn = self.get_dn_from_principal(self.princ)
+ except ldap.LDAPError, e:
+ raise xmlrpclib.Fault(1, e)
+ except ipaserver.ipaldap.NoSuchEntryError:
+ raise xmlrpclib.Fault(2, "No such user")
+
+ try:
+ user = self.get_user(uid, ['dn', 'nsAccountlock'], opts)
+ except ldap.LDAPError, e:
+ raise xmlrpclib.Fault(1, str(e))
+
+ # Are we doing an add or replace operation?
+ if user.has_key('nsaccountlock'):
+ has_key = True
+ else:
+ has_key = False
+
+ try:
+ m1 = _LDAPPool.getConn(self.host,self.port,self.bindca,self.bindcert,self.bindkey,proxydn)
+ res = m1.inactivateEntry(user['dn'], has_key)
+ _LDAPPool.releaseConn(m1)
+ return res
+ except ldap.LDAPError, e:
+ raise xmlrpclib.Fault(1, str(e))
diff --git a/ipa-server/xmlrpc-server/ipaxmlrpc.py b/ipa-server/xmlrpc-server/ipaxmlrpc.py
index 7d8529d28..03340ca5f 100644
--- a/ipa-server/xmlrpc-server/ipaxmlrpc.py
+++ b/ipa-server/xmlrpc-server/ipaxmlrpc.py
@@ -285,6 +285,7 @@ def handler(req, profiling=False):
h.register_function(f.get_all_users)
h.register_function(f.find_users)
h.register_function(f.update_user)
+ h.register_function(f.mark_user_deleted)
h.handle_request(req)
finally:
pass