From 557b2605503738f25d9c89e8b51d1832b24d5636 Mon Sep 17 00:00:00 2001 From: John Dennis Date: Mon, 3 Sep 2012 18:05:17 +0200 Subject: ipa user-find --manager does not find matches The manager LDAP attribute is a dn pointing inside the user container. When passed on the command it is typically a bare user uid. The search filter will only succeed if the bare uid is converted to a full dn because that is what is stored in the value for the manager attribute. The search failure is solved by calling _normalize_manager() which does the conversion to a dn (if not already a dn). It feels like this type of conversion should be performed in the pre callback which allows one to modify the filter. But when the pre callback is invoked it's complex string with the manager attribute already inserted. This is because the LDAPSearch.execute() method processes the options dict and constructs a filter component for each key/value in the options dict prior to invoking the pre callback. If we wanted to modify the manager value in the filter in the pre callback we would have to decompose the filter string, perform dn checking and then reassemble the filter. It's much cleaner to perform the dn operations on the manager value before it gets embedded into what otherwise might be a very complex filter. This is the reason why the normalization is perfored in the execute method as opposed to the pre callback. Other classes do similar things in their execute methods as opposed to their callbacks's, selinuxusermap_find is one example. Patch also introduces new unit test to verify. https://fedorahosted.org/freeipa/ticket/2264 --- ipalib/plugins/user.py | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'ipalib/plugins') diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py index 529699f9a..6a7f53fde 100644 --- a/ipalib/plugins/user.py +++ b/ipalib/plugins/user.py @@ -628,6 +628,13 @@ class user_find(LDAPSearch): ), ) + def execute(self, *args, **options): + # assure the manager attr is a dn, not just a bare uid + manager = options.get('manager') + if manager is not None: + options['manager'] = self.obj._normalize_manager(manager) + return super(user_find, self).execute(self, *args, **options) + def pre_callback(self, ldap, filter, attrs_list, base_dn, scope, *keys, **options): assert isinstance(base_dn, DN) if options.get('whoami'): -- cgit