diff options
Diffstat (limited to 'ipalib/plugins')
-rw-r--r-- | ipalib/plugins/host.py | 27 | ||||
-rw-r--r-- | ipalib/plugins/service.py | 21 | ||||
-rw-r--r-- | ipalib/plugins/user.py | 52 |
3 files changed, 98 insertions, 2 deletions
diff --git a/ipalib/plugins/host.py b/ipalib/plugins/host.py index f5871f81e..410b4bd12 100644 --- a/ipalib/plugins/host.py +++ b/ipalib/plugins/host.py @@ -28,11 +28,12 @@ from ipalib.plugins.baseldap import (LDAPQuery, LDAPObject, LDAPCreate, LDAPDelete, LDAPUpdate, LDAPSearch, LDAPRetrieve, LDAPAddMember, LDAPRemoveMember, host_is_master, - pkey_to_value, add_missing_object_class) + pkey_to_value, add_missing_object_class, + LDAPAddAttribute, LDAPRemoveAttribute) from ipalib.plugins.service import (split_principal, validate_certificate, set_certificate_attrs, ticket_flags_params, update_krbticketflags, set_kerberos_attrs, rename_ipaallowedtoperform_from_ldap, - rename_ipaallowedtoperform_to_ldap) + rename_ipaallowedtoperform_to_ldap, revoke_certs) from ipalib.plugins.dns import (dns_container_exists, _record_types, add_records_for_host_validation, add_records_for_host, get_reverse_zone) @@ -1246,3 +1247,25 @@ class host_disallow_create_keytab(LDAPRemoveMember): rename_ipaallowedtoperform_from_ldap(entry_attrs, options) rename_ipaallowedtoperform_from_ldap(failed, options) return (completed, dn) + + +@register() +class host_add_cert(LDAPAddAttribute): + __doc__ = _('Add certificates to host entry') + msg_summary = _('Added certificates to host "%(value)s"') + attribute = 'usercertificate' + + +@register() +class host_remove_cert(LDAPRemoveAttribute): + __doc__ = _('Remove certificates from host entry') + msg_summary = _('Removed certificates from host "%(value)s"') + attribute = 'usercertificate' + + def post_callback(self, ldap, dn, entry_attrs, *keys, **options): + assert isinstance(dn, DN) + + if 'usercertificate' in options: + revoke_certs(options['usercertificate'], self.log) + + return dn diff --git a/ipalib/plugins/service.py b/ipalib/plugins/service.py index 18d7b3e54..a5e10921b 100644 --- a/ipalib/plugins/service.py +++ b/ipalib/plugins/service.py @@ -861,3 +861,24 @@ class service_disable(LDAPQuery): value=pkey_to_value(keys[0], options), ) + +@register() +class service_add_cert(LDAPAddAttribute): + __doc__ = _('Add new certificates to a service') + msg_summary = _('Added certificates to service principal "%(value)s"') + attribute = 'usercertificate' + + +@register() +class service_remove_cert(LDAPRemoveAttribute): + __doc__ = _('Remove certificates from a service') + msg_summary = _('Removed certificates from service principal "%(value)s"') + attribute = 'usercertificate' + + def post_callback(self, ldap, dn, entry_attrs, *keys, **options): + assert isinstance(dn, DN) + + if 'usercertificate' in options: + revoke_certs(options['usercertificate'], self.log) + + return dn diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py index bc6989cce..9bd7bf7e5 100644 --- a/ipalib/plugins/user.py +++ b/ipalib/plugins/user.py @@ -1001,3 +1001,55 @@ class user_status(LDAPQuery): summary=unicode(_('Account disabled: %(disabled)s' % dict(disabled=disabled))), ) + + +@register() +class user_add_cert(LDAPAddAttribute): + __doc__ = _('Add one or more certificates to the user entry') + msg_summary = _('Added certificates to user "%(value)s"') + attribute = 'usercertificate' + + def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, + **options): + assert isinstance(dn, DN) + + new_attr_name = '%s;binary' % self.attribute + if self.attribute in entry_attrs: + entry_attrs[new_attr_name] = entry_attrs.pop(self.attribute) + + return dn + + def post_callback(self, ldap, dn, entry_attrs, *keys, **options): + assert isinstance(dn, DN) + + old_attr_name = '%s;binary' % self.attribute + if old_attr_name in entry_attrs: + entry_attrs[self.attribute] = entry_attrs.pop(old_attr_name) + + return dn + + +@register() +class user_remove_cert(LDAPRemoveAttribute): + __doc__ = _('Remove one or more certificates to the user entry') + msg_summary = _('Removed certificates from user "%(value)s"') + attribute = 'usercertificate' + + def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, + **options): + assert isinstance(dn, DN) + + new_attr_name = '%s;binary' % self.attribute + if self.attribute in entry_attrs: + entry_attrs[new_attr_name] = entry_attrs.pop(self.attribute) + + return dn + + def post_callback(self, ldap, dn, entry_attrs, *keys, **options): + assert isinstance(dn, DN) + + old_attr_name = '%s;binary' % self.attribute + if old_attr_name in entry_attrs: + entry_attrs[self.attribute] = entry_attrs.pop(old_attr_name) + + return dn |