SUDO Rule Search and Details Pages

The search and details pages for SUDO Rule have been added. Codes
that are shared with HBAC have been moved to rule.js.

The following methods were renamed for consistency:
 - ipa_details_load() -> ipa_details_refresh()
 - ipa_details_display() -> ipa_details_load()

The ipa_details_cache has been removed because the cache is now
stored in each widget.

The index.xhtml has been removed. All references to it has been
changed to index.html.

The Unselect All checkbox has been fixed. Unnecessary parameter
'container' has been removed.

The unit test has been updated and new test data has been added.

25 files changed, 1029 insertions, 549 deletions

diff --git a/install/conf/ipa.conf b/install/conf/ipa.conf
index d547b50d..0bc53548 100644
--- a/install/conf/ipa.conf
+++ b/install/conf/ipa.conf
@@ -7,7 +7,7 @@ ProxyRequests Off
 
 
 #We use xhtml, a file format that the browser validates
-DirectoryIndex index.xhtml
+DirectoryIndex index.html
 
 
 
diff --git a/install/static/Makefile.am b/install/static/Makefile.am
index 79549893..0e3effee 100644
--- a/install/static/Makefile.am
+++ b/install/static/Makefile.am
@@ -28,8 +28,10 @@ app_DATA =                              \
 	netgroup.js 			\
 	service.js 			\
 	serverconfig.js			\
+	sudorule.js			\
 	policy.js			\
 	search.js 			\
+	rule.js 			\
 	details.js 			\
 	entity.js 			\
 	webui.js 			\
diff --git a/install/static/add.js b/install/static/add.js
index 4325857f..d587b80d 100644
--- a/install/static/add.js
+++ b/install/static/add.js
@@ -41,7 +41,7 @@ function ipa_add_dialog(spec) {
                     var entity = IPA.get_entity(that.entity_name);
                     var facet = entity.get_facet('search');
                     var table = facet.table;
-                    table.refresh(that.container);
+                    table.refresh();
                     that.close();
                 }
             );
@@ -56,8 +56,8 @@ function ipa_add_dialog(spec) {
                     var entity = IPA.get_entity(that.entity_name);
                     var facet = entity.get_facet('search');
                     var table = facet.table;
-                    table.refresh(that.container);
-                    that.clear(that.container);
+                    table.refresh();
+                    that.clear();
                 }
             );
         });
diff --git a/install/static/associate.js b/install/static/associate.js
index 7dd81cae..f0239a44 100644
--- a/install/static/associate.js
+++ b/install/static/associate.js
@@ -257,7 +257,10 @@ function ipa_association_widget(spec) {
 
         that.superior_create(container);
 
-        var ul = $('.action-panel ul');
+        var entity_container = $('#' + that.entity_name);
+        var action_panel = $('.action-panel', entity_container);
+
+        var ul = $('ul', action_panel);
         var li = $('<li/>').appendTo(ul);
 
         // creating generic buttons for layout
@@ -324,11 +327,11 @@ function ipa_association_widget(spec) {
             'associator': that.associator,
             'method': that.add_method,
             'on_success': function() {
-                that.refresh(that.container);
+                that.refresh();
                 dialog.close();
             },
             'on_error': function() {
-                that.refresh(that.container);
+                that.refresh();
                 dialog.close();
             }
         });
@@ -360,11 +363,11 @@ function ipa_association_widget(spec) {
             'associator': that.associator,
             'method': that.delete_method,
             'on_success': function() {
-                that.refresh(that.container);
+                that.refresh();
                 dialog.close();
             },
             'on_error': function() {
-                that.refresh(that.container);
+                that.refresh();
                 dialog.close();
             }
         });
@@ -374,7 +377,7 @@ function ipa_association_widget(spec) {
         dialog.open(that.container);
     };
 
-    that.refresh = function(container) {
+    that.refresh = function() {
 
         function on_success(data, text_status, xhr) {
 
@@ -390,7 +393,7 @@ function ipa_association_widget(spec) {
 
             for (var i = 0; i<values.length; i++){
                 var record = that.get_record(data.result.result, i);
-                that.add_row(that.container, record);
+                that.add_row(record);
             }
         }
 
@@ -461,7 +464,9 @@ function ipa_association_facet(spec) {
 
     that.setup = function(container) {
 
-        var span = $('span[name=association]', container);
+        that.facet_setup(container);
+
+        var span = $('span[name=association]', that.container);
 
         that.table.setup(span);
         that.table.refresh();
diff --git a/install/static/certificate.js b/install/static/certificate.js
index 265568a0..449b8f17 100755
--- a/install/static/certificate.js
+++ b/install/static/certificate.js
@@ -482,7 +482,7 @@ function certificate_status_widget(spec) {
 
     that.setup = function(container) {
 
-        that.container = container;
+        that.widget_setup(container);
 
         that.valid = $('li.certificate-status-valid', that.container);
         that.revoked = $('li.certificate-status-revoked', that.container);
@@ -552,7 +552,7 @@ function certificate_status_widget(spec) {
         button.replaceWith(that.create_button);
     };
 
-    that.load = function(container, result) {
+    that.load = function(result) {
 
         that.result = result;
         that.pkey = that.get_entity_pkey(that.result);
diff --git a/install/static/details.js b/install/static/details.js
index f7afcece..9bf54a8f 100644
--- a/install/static/details.js
+++ b/install/static/details.js
@@ -24,8 +24,6 @@
 
 /* REQUIRES: ipa.js */
 
-var ipa_details_cache = {};
-
 IPA.is_field_writable = function(rights){
     if (!rights){
         alert('no right');
@@ -42,9 +40,15 @@ function ipa_details_field(spec) {
     that.load = spec.load || load;
     that.save = spec.save || save;
 
-    function load(container, result) {
-
+    function load(result) {
+        that.record = result;
         that.values = result[that.name];
+        that.reset();
+    }
+
+    that.set_values = function(values) {
+
+        if (!that.record) return;
 
         /* remove all <dd> tags i.e. all attribute values */
         $('dd', that.container).remove();
@@ -67,8 +71,8 @@ function ipa_details_field(spec) {
 
         var rights = 'rsc';
 
-        if (result.attributelevelrights){
-            rights = result.attributelevelrights[this.name] || rights ;
+        if (that.record.attributelevelrights){
+            rights = that.record.attributelevelrights[this.name] || rights ;
         }
 
         if (that.values) {
@@ -100,9 +104,9 @@ function ipa_details_field(spec) {
                 dd.appendTo(that.container);
             }
         }
-    }
+    };
 
-    function save(container) {
+    function save() {
         var values = [];
 
         $('dd', that.container).each(function () {
@@ -219,7 +223,7 @@ function ipa_details_section(spec){
 
     that.setup = function(container) {
 
-        this.container = container;
+        that.container = container;
 
         if (that.template) return;
 
@@ -245,7 +249,7 @@ function ipa_details_section(spec){
                         var field = fields[i];
                         var span = $('span[name='+field.name+']', this.container).first();
                         field.setup(span);
-                        field.load(span, result);
+                        field.load(result);
                     }
                 }
             );
@@ -255,7 +259,7 @@ function ipa_details_section(spec){
         for (var j=0; j<fields.length; j++) {
             var field = fields[j];
             var span = $('span[name='+field.name+']', this.container).first();
-            field.load(span, result);
+            field.load(result);
         }
     };
 
@@ -263,7 +267,7 @@ function ipa_details_section(spec){
         for (var i=0; i<that.fields.length; i++) {
             var field = that.fields[i];
             var span = $('span[name='+field.name+']', this.container).first();
-            field.reset(span);
+            field.reset();
         }
     };
 
@@ -362,7 +366,7 @@ function ipa_details_facet(spec) {
     that.load = spec.load || ipa_details_load;
     that.update = spec.update || ipa_details_update;
     that.reset = spec.reset || ipa_details_reset;
-    that.display = spec.display || ipa_details_display;
+    that.refresh = spec.refresh || ipa_details_refresh;
 
     that.sections = [];
     that.sections_by_name = {};
@@ -402,7 +406,13 @@ function ipa_details_facet(spec) {
         }
     };
 
+    that.get_primary_key = function() {
+        var pkey_name = IPA.metadata[that.entity_name].primary_key;
+        return that.record[pkey_name][0];
+    };
+
     that.details_facet_init = that.init;
+    that.details_facet_create = that.create;
 
     return that;
 }
@@ -431,60 +441,50 @@ function ipa_details_is_dirty() {
 
 function ipa_details_create(container)
 {
-    var facet = this;
+    var that = this;
 
     if (!container) {
         alert('ERROR: ipa_details_create: Missing container argument!');
         return;
     }
 
-    var entity_name = container.attr('id');
-    container.attr('title', entity_name);
-
+    container.attr('title', that.entity_name);
 
     var details = $('<div/>', {
         'class': 'content'
     }).appendTo(container);
 
+    var entity_container = $('#' + that.entity_name);
+    var action_panel = $('.action-panel', entity_container);
+
+    var ul = $('ul', action_panel);
     var buttons = $('<li/>', {
         'class': 'details-buttons'
-    }).prependTo($('.action-panel ul'));
-
-    buttons.append(ipa_button({
-        'label': 'Reset',
-        'icon': 'ui-icon-refresh',
-        'class': 'details-reset',
-        'click': function() {
-            facet.reset(container);
-            return false;
-        }
-    }));
+    }).prependTo(ul);
 
-    var pkey_name = IPA.metadata[facet.entity_name].primary_key;
+    $('<input/>', {
+        'type': 'text',
+        'name': 'reset'
+    }).appendTo(buttons);
 
-    buttons.append(ipa_button({
-        'label': 'Update',
-        'icon': 'ui-icon-check',
-        'class': 'details-update',
-        'click': function() {
-            facet.update(container, ipa_details_cache[facet.entity_name][pkey_name][0]);
-            return false;
-        }
-    }));
+    $('<input/>', {
+        'type': 'text',
+        'name': 'update'
+    }).appendTo(buttons);
 
     details.append('<br/>');
     details.append('<hr/>');
 
-    for (var i = 0; i < facet.sections.length; ++i) {
-        var section = facet.sections[i];
+    for (var i = 0; i < that.sections.length; ++i) {
+        var section = that.sections[i];
 
-        details.append($('<h2/>',{
-            click: function(){_h2_on_click(this)},
-            html:"&#8722; "+section.label
-        }));
+        $('<h2/>', {
+            'name': section.name,
+            'html':"&#8722; "+section.label
+        }).appendTo(details);
 
         var div = $('<div/>', {
-            'id': facet.entity_name+'-'+facet.name+'-'+section.name,
+            'id': that.entity_name+'-'+that.name+'-'+section.name,
             'class': 'details-section'
         }).appendTo(details);
 
@@ -498,19 +498,48 @@ function ipa_details_setup(container) {
 
     var that = this;
 
+    that.facet_setup(container);
+
+    var button = $('input[name=reset]', that.container);
+    that.reset_button = ipa_button({
+        'label': 'Reset',
+        'icon': 'ui-icon-refresh',
+        'class': 'details-reset',
+        'click': function() {
+            that.reset();
+            return false;
+        }
+    });
+    button.replaceWith(that.reset_button);
+
+    button = $('input[name=update]', that.container);
+    that.update_button = ipa_button({
+        'label': 'Update',
+        'icon': 'ui-icon-check',
+        'class': 'details-update',
+        'click': function() {
+            that.update();
+            return false;
+        }
+    });
+    button.replaceWith(that.update_button);
+
     for (var i = 0; i < that.sections.length; ++i) {
         var section = that.sections[i];
 
+        var header = $('h2[name='+section.name+']', that.container);
+        header.click(function(){ _h2_on_click(this) });
+
         var div = $(
             '#'+that.entity_name+'-'+that.name+'-'+section.name,
-            container
+            that.container
         );
 
         section.setup(div);
     }
 }
 
-function ipa_details_load(container) {
+function ipa_details_refresh() {
 
     var that = this;
     var entity = IPA.get_entity(that.entity_name);
@@ -519,17 +548,11 @@ function ipa_details_load(container) {
     if (!that.pkey && !entity.default_facet) return;
 
     function on_success(data, text_status, xhr) {
-        var result = data.result.result;
-
-        ipa_details_cache[that.entity_name] = $.extend(true, {}, result);
-        for (var i = 0; i < that.sections.length; ++i) {
-            var section = that.sections[i];
-            section.load(result);
-        }
+        that.load(data.result.result);
     }
 
     function on_failure(xhr, text_status, error_thrown) {
-        var details = $('.details', container).empty();
+        var details = $('.details', that.container).empty();
         details.append('<p>Error: '+error_thrown.name+'</p>');
         details.append('<p>'+error_thrown.title+'</p>');
         details.append('<p>'+error_thrown.message+'</p>');
@@ -543,10 +566,12 @@ function ipa_details_load(container) {
     );
 }
 
-function ipa_details_update(container, pkey, on_win, on_fail)
+function ipa_details_update(on_win, on_fail)
 {
-    var facet = this;
-    var entity_name = facet.entity_name;
+    var that = this;
+    var entity_name = that.entity_name;
+
+    var pkey = that.get_primary_key();
 
     function update_on_win(data, text_status, xhr) {
         if (on_win)
@@ -555,8 +580,7 @@ function ipa_details_update(container, pkey, on_win, on_fail)
             return;
 
         var result = data.result.result;
-        ipa_details_cache[entity_name] = $.extend(true, {}, result);
-        facet.display(result);
+        that.load(result);
     }
 
     function update_on_fail(xhr, text_status, error_thrown) {
@@ -571,16 +595,17 @@ function ipa_details_update(container, pkey, on_win, on_fail)
     var modlist = {'all': true, 'setattr': [], 'addattr': [], 'rights': true};
     var attrs_wo_option = {};
 
-    for (var i=0; i<facet.sections.length; i++) {
-        var section = facet.sections[i];
+    for (var i=0; i<that.sections.length; i++) {
+        var section = that.sections[i];
 
-        var div = $('#'+facet.entity_name+'-'+facet.name+'-'+section.name, container);
+        var div = $('#'+that.entity_name+'-'+that.name+'-'+section.name, that.container);
 
         for (var j=0; j<section.fields.length; j++) {
             var field = section.fields[j];
 
             var span = $('span[name='+field.name+']', div).first();
-            values = field.save(span);
+            values = field.save();
+            if (!values) continue;
 
             var param_info = ipa_get_param_info(entity_name, field.name);
             if (param_info) {
@@ -590,7 +615,7 @@ function ipa_details_update(container, pkey, on_win, on_fail)
                 }else if (values.length > 1){
                     modlist[field.name] = values;
                 } else if (param_info['multivalue']){
-                        modlist[field.name] = [];
+                    modlist[field.name] = [];
                 }
             } else {
                 if (values.length) attrs_wo_option[field.name] = values;
@@ -615,13 +640,14 @@ var _ipa_span_hint_template = '<span class="attrhint">Hint: D</span>';
 
 
 
-function ipa_details_display(result)
+function ipa_details_load(record)
 {
-    var facet = this;
+    var that = this;
+    that.record = record;
 
-    for (var i=0; i<facet.sections.length; i++) {
-        var section = facet.sections[i];
-        section.load(result);
+    for (var i=0; i<that.sections.length; i++) {
+        var section = that.sections[i];
+        section.load(record);
     }
 }
 
@@ -788,14 +814,9 @@ function _ipa_create_text_input(value, param_info, rights, index)
     return span;
 }
 
-function ipa_details_reset(container)
+function ipa_details_reset()
 {
     var that = this;
-    var entity_name = that.entity_name;
-
-    if (ipa_details_cache[entity_name]){
-        that.display(ipa_details_cache[entity_name]);
-    }
 
     for (var i=0; i<that.sections.length; i++) {
         var section = that.sections[i];
diff --git a/install/static/entity.js b/install/static/entity.js
index 3c0f1bba..d117d881 100644
--- a/install/static/entity.js
+++ b/install/static/entity.js
@@ -56,15 +56,20 @@ function ipa_facet(spec) {
     function init() {
     }
 
-    function create() {
+    function create(container) {
     }
 
-    function setup() {
+    function setup(container) {
+        that.container = container;
     }
 
     function load() {
     }
 
+    that.facet_init = that.init;
+    that.facet_create = that.create;
+    that.facet_setup = that.setup;
+
     return that;
 }
 
@@ -324,7 +329,7 @@ function ipa_entity_setup(container) {
     facet.create(container);
     container.children().last().addClass('client');
     facet.setup(container);
-    facet.load(container);
+    facet.refresh();
 }
 
 
diff --git a/install/static/hbac.js b/install/static/hbac.js
index 6b209dd7..f63a489e 100755
--- a/install/static/hbac.js
+++ b/install/static/hbac.js
@@ -26,8 +26,6 @@ function ipa_hbac() {
         'name': 'hbac'
     });
 
-    that.superior_init = that.superior('init');
-
     that.init = function() {
 
         var dialog = ipa_hbac_add_dialog({
@@ -49,7 +47,7 @@ function ipa_hbac() {
         });
         that.add_facet(facet);
 
-        that.superior_init();
+        that.entity_init();
     };
 
     return that;
@@ -63,11 +61,9 @@ function ipa_hbac_add_dialog(spec) {
 
     var that = ipa_add_dialog(spec);
 
-    that.superior_init = that.superior('init');
-
     that.init = function() {
 
-        that.superior_init();
+        that.add_dialog_init();
 
         that.add_field(ipa_text_widget({
             'name': 'cn',
@@ -91,10 +87,6 @@ function ipa_hbac_search_facet(spec) {
 
     var that = ipa_search_facet(spec);
 
-    that.superior_init = that.superior('init');
-    that.superior_create = that.superior('create');
-    that.superior_setup = that.superior('setup');
-
     that.init = function() {
 
         that.create_column({name:'cn', label:'Rule Name'});
@@ -104,16 +96,12 @@ function ipa_hbac_search_facet(spec) {
         that.create_column({name:'servicecategory', label:'Via Service'});
         that.create_column({name:'sourcehostcategory', label:'From'});
 
-        that.superior_init();
+        that.search_facet_init();
     };
 
     that.create = function(container) {
 
-        var that = this;
-
-
 /*
-
         // Not yet implemented
 
         var left_buttons = $('<span/>', {
@@ -127,9 +115,11 @@ function ipa_hbac_search_facet(spec) {
         left_buttons.append(ipa_button({
             'label': 'Cull Disabled Rules'
         }));
-
 */
-        var ul = $('.action-panel ul');
+        var entity_container = $('#' + that.entity_name);
+        var action_panel = $('.action-panel', entity_container);
+
+        var ul = $('ul', action_panel);
 
         $('<li/>', {
             title: 'hbacsvc',
@@ -153,7 +143,7 @@ function ipa_hbac_search_facet(spec) {
             }
         }).appendTo(ul);
 
-        that.superior_create(container);
+        that.search_facet_create(container);
 
         // TODO: replace with IPA.metadata[that.entity_name].label
         container.children().last().prepend(
@@ -171,10 +161,6 @@ function ipa_hbac_details_facet(spec) {
 
     var that = ipa_details_facet(spec);
 
-    that.superior_init = that.superior('init');
-    that.superior_create = that.superior('create');
-    that.superior_setup = that.superior('setup');
-
     that.init = function() {
 
         var section;
@@ -207,7 +193,7 @@ function ipa_hbac_details_facet(spec) {
             });
 
         } else {
-            section = ipa_hbac_details_tables_section({
+            section = ipa_rule_details_section({
                 'name': 'user',
                 'label': 'Who',
                 'text': 'Rule applies when access is requested by:',
@@ -228,12 +214,12 @@ function ipa_hbac_details_facet(spec) {
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-memberuser_user',
             'name': 'memberuser_user', 'label': 'Users', 'category': category,
-            'other_entity': 'user', 'add_method': 'add_user', 'delete_method': 'remove_user'
+            'other_entity': 'user', 'add_method': 'add_user', 'remove_method': 'remove_user'
         }));
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-memberuser_group',
             'name': 'memberuser_group', 'label': 'Groups', 'category': category,
-            'other_entity': 'group', 'add_method': 'add_user', 'delete_method': 'remove_user'
+            'other_entity': 'group', 'add_method': 'add_user', 'remove_method': 'remove_user'
         }));
 
         if (IPA.layout) {
@@ -244,7 +230,7 @@ function ipa_hbac_details_facet(spec) {
             });
 
         } else {
-            section = ipa_hbac_details_tables_section({
+            section = ipa_rule_details_section({
                 'name': 'host',
                 'label': 'Accessing',
                 'text': 'Rule applies when access is requested to:',
@@ -265,12 +251,12 @@ function ipa_hbac_details_facet(spec) {
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-memberhost_host',
             'name': 'memberhost_host', 'label': 'Hosts', 'category': category,
-            'other_entity': 'host', 'add_method': 'add_host', 'delete_method': 'remove_host'
+            'other_entity': 'host', 'add_method': 'add_host', 'remove_method': 'remove_host'
         }));
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-memberhost_hostgroup',
             'name': 'memberhost_hostgroup', 'label': 'Host Groups', 'category': category,
-            'other_entity': 'hostgroup', 'add_method': 'add_host', 'delete_method': 'remove_host'
+            'other_entity': 'hostgroup', 'add_method': 'add_host', 'remove_method': 'remove_host'
         }));
 
         if (IPA.layout) {
@@ -281,7 +267,7 @@ function ipa_hbac_details_facet(spec) {
             });
 
         } else {
-            section = ipa_hbac_details_tables_section({
+            section = ipa_rule_details_section({
                 'name': 'service',
                 'label': 'Via Service',
                 'text': 'Rule applies when access is requested via:',
@@ -302,12 +288,12 @@ function ipa_hbac_details_facet(spec) {
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-memberservice_hbacsvc',
             'name': 'memberservice_hbacsvc', 'label': 'Services', 'category': category,
-            'other_entity': 'hbacsvc', 'add_method': 'add_service', 'delete_method': 'remove_service'
+            'other_entity': 'hbacsvc', 'add_method': 'add_service', 'remove_method': 'remove_service'
         }));
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-memberservice_hbacsvcgroup',
             'name': 'memberservice_hbacsvcgroup', 'label': 'Service Groups', 'category': category,
-            'other_entity': 'hbacsvcgroup', 'add_method': 'add_service', 'delete_method': 'remove_service'
+            'other_entity': 'hbacsvcgroup', 'add_method': 'add_service', 'remove_method': 'remove_service'
         }));
 
         if (IPA.layout) {
@@ -318,7 +304,7 @@ function ipa_hbac_details_facet(spec) {
             });
 
         } else {
-            section = ipa_hbac_details_tables_section({
+            section = ipa_rule_details_section({
                 'name': 'sourcehost',
                 'label': 'From',
                 'text': 'Rule applies when access is being initiated from:',
@@ -339,12 +325,12 @@ function ipa_hbac_details_facet(spec) {
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-sourcehost_host',
             'name': 'sourcehost_host', 'label': 'Host', 'category': category,
-            'other_entity': 'host', 'add_method': 'add_sourcehost', 'delete_method': 'remove_sourcehost'
+            'other_entity': 'host', 'add_method': 'add_sourcehost', 'remove_method': 'remove_sourcehost'
         }));
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-sourcehost_hostgroup',
             'name': 'sourcehost_hostgroup', 'label': 'Host Groups', 'category': category,
-            'other_entity': 'hostgroup', 'add_method': 'add_sourcehost', 'delete_method': 'remove_sourcehost'
+            'other_entity': 'hostgroup', 'add_method': 'add_sourcehost', 'remove_method': 'remove_sourcehost'
         }));
 
         if (IPA.layout) {
@@ -360,7 +346,7 @@ function ipa_hbac_details_facet(spec) {
                 'label': 'When'
             });
 /*
-            section = ipa_hbac_details_tables_section({
+            section = ipa_rule_details_section({
                 'name': 'accesstime',
                 'label': 'When',
                 'text': 'Rule applies when access is being requested at:',
@@ -383,10 +369,10 @@ function ipa_hbac_details_facet(spec) {
             ]
         }));
 
-        that.superior_init();
+        that.details_facet_init();
     };
 
-    that.update = function(container) {
+    that.update = function() {
 
         var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
 
@@ -466,13 +452,13 @@ function ipa_hbac_details_facet(spec) {
         for (var i=0; i<that.sections.length; i++) {
             var section = that.sections[i];
 
-            var div = $('#'+that.entity_name+'-'+that.name+'-'+section.name, container);
+            var div = $('#'+that.entity_name+'-'+that.name+'-'+section.name, that.container);
 
             for (var j=0; j<section.fields.length; j++) {
                 var field = section.fields[j];
 
                 var span = $('span[name='+field.name+']', div).first();
-                var values = field.save(span);
+                var values = field.save();
 
                 var param_info = ipa_get_param_info(that.entity_name, field.name);
 
@@ -546,10 +532,10 @@ function ipa_hbac_details_facet(spec) {
 
         var batch = ipa_batch_command({
             'on_success': function success_handler(data, text_status, xhr) {
-                that.load(container);
+                that.refresh();
             },
             'on_error': function(xhr, text_status, error_thrown) {
-                that.load(container);
+                that.refresh();
             }
         });
 
@@ -566,7 +552,7 @@ function ipa_hbac_details_facet(spec) {
         if (enable_operation.execute) batch.add_command(enable_operation.command);
 
         if (!batch.args.length) {
-            that.load(container);
+            that.refresh();
             return;
         }
 
@@ -729,271 +715,58 @@ function ipa_hbac_details_general_section(spec){
     return that;
 }
 
-function ipa_hbac_details_tables_section(spec){
-
-    spec = spec || {};
-
-    var that = ipa_details_section(spec);
-
-    that.text = spec.text;
-    that.field_name = spec.field_name;
-    that.options = spec.options || [];
-    that.tables = spec.tables || [];
-    that.columns = spec.columns;
-
-    that.superior_setup = that.superior('setup');
-
-    that.create = function(container) {
-
-        if (that.template) return;
-
-        container.append(that.text);
-
-        var span = $('<span/>', { 'name': that.field_name }).appendTo(container);
-
-        for (var i=0; i<that.options.length; i++) {
-            var option = that.options[i];
-
-            $('<input/>', {
-                'type': 'radio',
-                'name': that.field_name,
-                'value': option.value
-            }).appendTo(span);
-
-            span.append(option.label);
-        }
-
-        span.append(' ');
-
-        $('<span/>', {
-            'name': 'undo',
-            'class': 'ui-state-highlight ui-corner-all',
-            'style': 'display: none;',
-            'html': 'undo'
-        }).appendTo(span);
-
-        span.append('<br/>');
-
-        for (var i=0; i<that.tables.length; i++) {
-            var table = that.tables[i];
-
-            var table_span = $('<span/>', { 'name': table.field_name }).appendTo(span);
-
-            var field = that.get_field(table.field_name);
-            field.create(table_span);
-        }
-    };
-
-    return that;
-}
-
 function ipa_hbac_association_widget(spec) {
 
     spec = spec || {};
 
-    var that = ipa_table_widget(spec);
+    var that = ipa_rule_association_widget(spec);
 
-    that.other_entity = spec.other_entity;
     that.category = spec.category;
 
-    that.add_method = spec.add_method;
-    that.delete_method = spec.delete_method;
-
-    that.superior_init = that.superior('init');
-    that.superior_create = that.superior('create');
-
-    that.init = function() {
-        // create a column if none defined
-        if (!that.columns.length) {
-            that.create_column({
-                'name': that.name,
-                'label': IPA.metadata[that.other_entity].label,
-                'primary_key': true
-            });
-        }
-
-        that.superior_init();
-    };
-
-    that.create = function(container) {
-
-        that.superior_create(container);
-
-        var buttons = $('span[name=buttons]', container);
-
-        $('<input/>', {
-            'type': 'button',
-            'name': 'remove',
-            'value': 'Remove '+that.label
-        }).appendTo(buttons);
-
-        $('<input/>', {
-            'type': 'button',
-            'name': 'add',
-            'value': 'Add '+that.label
-        }).appendTo(buttons);
-    };
-
-    that.setup = function(container) {
-
-        that.table_setup(container);
-
-        var button = $('input[name=remove]', that.table);
-        button.replaceWith(ipa_button({
-            'label': button.val(),
-            'icon': 'ui-icon-trash',
-            'click': function() { that.remove(that.container); }
-        }));
-
-        button = $('input[name=add]', that.table);
-        button.replaceWith(ipa_button({
-            'label': button.val(),
-            'icon': 'ui-icon-plus',
-            'click': function() { that.add(that.container) }
-        }));
-
-        var entity = IPA.get_entity(that.entity_name);
-        var association = entity.get_association(that.other_entity);
-
-        if (association && association.associator == 'serial') {
-            that.associator = serial_associator;
-        } else {
-            that.associator = bulk_associator;
-        }
-    };
-
-    that.load = function(container, result) {
-
-        that.values = result[that.name] || [];
-        that.hide_undo(that.container);
-        that.set_values(that.container, that.values);
-    };
-
-    that.set_values = function(container, values) {
-
-        that.tbody.empty();
-        for (var i=0; values && i<values.length; i++) {
-            var record = {};
-            record[that.name] = values[i];
-            that.add_row(that.container, record);
-        }
-    };
-
-    that.add = function(container) {
+    that.add = function(values, on_success, on_error) {
 
         var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
-        var label = IPA.metadata[that.other_entity].label;
-        var title = 'Add '+label+' to '+that.entity_name+' '+pkey;
 
-        var dialog = ipa_association_adder_dialog({
-            'title': title,
-            'entity_name': that.entity_name,
-            'pkey': pkey,
-            'other_entity': that.other_entity
+        var batch = ipa_batch_command({
+            'on_success': on_success,
+            'on_error': on_error
         });
 
-        dialog.add = function() {
-
-            var values = dialog.get_selected_values();
-
-            var batch = ipa_batch_command({
-                'on_success': function() {
-                    that.refresh(that.container);
-                    dialog.close();
-                },
-                'on_error': function() {
-                    that.refresh(that.container);
-                    dialog.close();
-                }
-            });
-
-            var command = ipa_command({
-                'method': that.entity_name+'_mod',
-                'args': [pkey],
-                'options': {'all': true, 'rights': true},
-                'on_success': function() {
-                    that.category.load(container, ['']);
-                }
-            });
-            command.set_option(that.category.name, '');
-            batch.add_command(command);
-
-            command = ipa_command({
-                'method': that.entity_name+'_'+that.add_method,
-                'args': [pkey]
-            });
-            command.set_option(that.other_entity, values.join(','));
-            batch.add_command(command);
-
-            batch.execute();
-        };
+        var command = ipa_command({
+            'method': that.entity_name+'_mod',
+            'args': [pkey],
+            'options': {'all': true, 'rights': true},
+            'on_success': function() {
+                that.category.load(['']);
+            }
+        });
+        command.set_option(that.category.name, '');
+        batch.add_command(command);
 
-        dialog.init();
+        command = ipa_command({
+            'method': that.entity_name+'_'+that.add_method,
+            'args': [pkey]
+        });
+        command.set_option(that.other_entity, values.join(','));
+        batch.add_command(command);
 
-        dialog.open(that.container);
+        batch.execute();
     };
 
-    that.remove = function(container) {
-
-        var selected_values = that.get_selected_values();
-
-        if (!selected_values.length) {
-            alert('Select '+that.label+' to be removed.');
-            return;
-        }
+    that.remove = function(values, on_success, on_error) {
 
         var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
-        var label = IPA.metadata[that.other_entity].label;
-        var title = 'Remove '+label+' from '+that.entity_name+' '+pkey;
 
-        var dialog = ipa_association_deleter_dialog({
-            'title': title,
-            'entity_name': that.entity_name,
-            'pkey': pkey,
-            'other_entity': that.other_entity,
-            'values': selected_values
+        var command = ipa_command({
+            'method': that.entity_name+'_'+that.remove_method,
+            'args': [pkey],
+            'on_success': on_success,
+            'on_error': on_error
         });
 
-        dialog.remove = function() {
-
-            var command = ipa_command({
-                'method': that.entity_name+'_'+that.delete_method,
-                'args': [pkey],
-                'on_success': function() {
-                    that.refresh(that.container);
-                    dialog.close();
-                },
-                'on_error': function() {
-                    that.refresh(that.container);
-                    dialog.close();
-                }
-            });
-
-            command.set_option(that.other_entity, selected_values.join(','));
-
-            command.execute();
-        };
-
-        dialog.init();
-
-        dialog.open(that.container);
-    };
-
-    that.refresh = function(container) {
-
-        function on_success(data, text_status, xhr) {
-            that.load(that.container, data.result.result);
-        }
+        command.set_option(that.other_entity, values.join(','));
 
-        function on_error(xhr, text_status, error_thrown) {
-            var summary = $('span[name=summary]', that.tfoot).empty();
-            summary.append('<p>Error: '+error_thrown.name+'</p>');
-            summary.append('<p>'+error_thrown.title+'</p>');
-            summary.append('<p>'+error_thrown.message+'</p>');
-        }
-
-        var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
-        ipa_cmd('show', [pkey], {'rights': true}, on_success, on_error, that.entity_name);
+        command.execute();
     };
 
     return that;
@@ -1008,10 +781,6 @@ function ipa_hbac_accesstime_widget(spec) {
     that.text = spec.text;
     that.options = spec.options || [];
 
-    that.superior_init = that.superior('init');
-    that.superior_create = that.superior('create');
-    that.superior_setup = that.superior('setup');
-
     that.init = function() {
 
         that.table = ipa_table_widget({
@@ -1025,12 +794,12 @@ function ipa_hbac_accesstime_widget(spec) {
             'primary_key': true
         });
 
-        that.superior_init();
+        that.widget_init();
     };
 
     that.create = function(container) {
 
-        that.superior_create(container);
+        that.widget_create(container);
 
         var span = $('<span/>', { 'name': 'text' }).appendTo(container);
 
@@ -1101,32 +870,31 @@ function ipa_hbac_accesstime_widget(spec) {
 
         var input = $('input[name="'+that.name+'"]', that.container);
         input.change(function() {
-            that.show_undo(that.container);
+            that.show_undo();
         });
 
-        var undo = that.get_undo(that.container);
+        var undo = that.get_undo();
         undo.click(function() {
-            that.reset(that.container);
+            that.reset();
         });
     };
 
-    that.save = function(container) {
+    that.save = function() {
         var value = $('input[name="'+that.name+'"]:checked', that.container).val();
         if (value == '') {
-            return that.table.save(that.container);
+            return that.table.save();
         } else {
             return [];
         }
     };
 
-    that.load = function(container, result) {
+    that.load = function(result) {
 
         that.values = result[that.name] || [];
-        that.set_values(that.container, that.values);
-        that.hide_undo(that.container);
+        that.reset();
     };
 
-    that.set_values = function(container, values) {
+    that.set_values = function(values) {
 
         that.set_radio_value(that.container, values && values.length ? '' : 'all');
 
@@ -1134,7 +902,7 @@ function ipa_hbac_accesstime_widget(spec) {
         for (var i=0; values && i<values.length; i++) {
             var record = {};
             record[that.name] = values[i];
-            that.table.add_row(that.container, record);
+            that.table.add_row(record);
         }
     };
 
@@ -1142,7 +910,7 @@ function ipa_hbac_accesstime_widget(spec) {
         $('input[name="'+that.name+'"][value="'+value+'"]', that.container).get(0).checked = true;
     };
 
-    that.add = function(container) {
+    that.add = function() {
 
         var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
         var title = 'Add '+that.label+' to '+that.entity_name+' '+pkey;
@@ -1195,17 +963,17 @@ function ipa_hbac_accesstime_widget(spec) {
         function add(on_success, on_error) {
 
             var field = dialog.get_field(that.name);
-            var value = field.save(dialog.container)[0];
+            var value = field.save()[0];
 
             var command = ipa_command({
                 'method': that.entity_name+'_add_'+that.name,
                 'args': [pkey],
                 'on_success': function() {
-                    that.refresh(that.container);
+                    that.refresh();
                     if (on_success) on_success();
                 },
                 'on_error': function() {
-                    that.refresh(that.container);
+                    that.refresh();
                     if (on_error) on_error();
                 }
             });
@@ -1217,7 +985,7 @@ function ipa_hbac_accesstime_widget(spec) {
 
         dialog.add_button('Add', function() {
             add(
-                function() { dialog.clear(dialog.container); }
+                function() { dialog.clear(); }
             );
         });
 
@@ -1237,7 +1005,7 @@ function ipa_hbac_accesstime_widget(spec) {
         dialog.open(that.container);
     };
 
-    that.remove = function(container) {
+    that.remove = function() {
 
         var values = that.table.get_selected_values();
 
@@ -1258,11 +1026,11 @@ function ipa_hbac_accesstime_widget(spec) {
 
             var batch = ipa_batch_command({
                 'on_success': function() {
-                    that.refresh(that.container);
+                    that.refresh();
                     dialog.close();
                 },
                 'on_error': function() {
-                    that.refresh(that.container);
+                    that.refresh();
                     dialog.close();
                 }
             });
@@ -1286,10 +1054,10 @@ function ipa_hbac_accesstime_widget(spec) {
         dialog.open(that.container);
     };
 
-    that.refresh = function(container) {
+    that.refresh = function() {
 
         function on_success(data, text_status, xhr) {
-            that.load(that.container, data.result.result);
+            that.load(data.result.result);
         }
 
         function on_error(xhr, text_status, error_thrown) {
diff --git a/install/static/hbacsvc.js b/install/static/hbacsvc.js
index 8f75addb..012c92a3 100755
--- a/install/static/hbacsvc.js
+++ b/install/static/hbacsvc.js
@@ -96,9 +96,10 @@ function ipa_hbacsvc_search_facet(spec) {
 
     that.create = function(container) {
 
-        var that = this;
+        var entity_container = $('#' + that.entity_name);
+        var action_panel = $('.action-panel', entity_container);
 
-        var ul = $('.action-panel ul');
+        var ul = $('ul', action_panel);
 
         $('<li/>', {
             title: 'hbac',
diff --git a/install/static/hbacsvcgroup.js b/install/static/hbacsvcgroup.js
index e6845b9b..30cb2c86 100755
--- a/install/static/hbacsvcgroup.js
+++ b/install/static/hbacsvcgroup.js
@@ -107,10 +107,10 @@ function ipa_hbacsvcgroup_search_facet(spec) {
 
     that.create = function(container) {
 
-        var that = this;
+        var entity_container = $('#' + that.entity_name);
+        var action_panel = $('.action-panel', entity_container);
 
-
-        var ul = $('.action-panel ul');
+        var ul = $('ul', action_panel);
 
         $('<li/>', {
             title: 'hbac',
diff --git a/install/static/host.js b/install/static/host.js
index a721dd21..93a4c273 100644
--- a/install/static/host.js
+++ b/install/static/host.js
@@ -233,7 +233,7 @@ function host_provisioning_status_widget(spec) {
 
     that.setup = function(container) {
 
-        that.container = container;
+        that.widget_setup(container);
 
         that.valid = $('li.key-status-valid', that.container);
         that.missing = $('li.key-status-missing', that.container);
@@ -299,7 +299,7 @@ function host_provisioning_status_widget(spec) {
         alert(that.otp.val());
     };
 
-    that.load = function(container, result) {
+    that.load = function(result) {
         that.result = result;
         var krblastpwdchange = result['krblastpwdchange'];
         set_status(krblastpwdchange ? 'valid' : 'missing');
diff --git a/install/static/index.html b/install/static/index.html
index 064dada5..643c076c 100644
--- a/install/static/index.html
+++ b/install/static/index.html
@@ -18,6 +18,7 @@
     <script type="text/javascript" src="associate.js"></script>
     <script type="text/javascript" src="entity.js"></script>
     <script type="text/javascript" src="navigation.js"></script>
+    <script type="text/javascript" src="rule.js"></script>
 
     <script type="text/javascript" src="certificate.js"></script>
     <script type="text/javascript" src="user.js"></script>
@@ -30,6 +31,7 @@
     <script type="text/javascript" src="netgroup.js"></script>
     <script type="text/javascript" src="service.js"></script>
     <script type="text/javascript" src="serverconfig.js"></script>
+    <script type="text/javascript" src="sudorule.js"></script>
     <script type="text/javascript" src="policy.js"></script>
 
 
diff --git a/install/static/policy.js b/install/static/policy.js
index c56e4d51..db60e10a 100644
--- a/install/static/policy.js
+++ b/install/static/policy.js
@@ -254,20 +254,20 @@ function ipa_records_facet(spec){
 
     function setup(container){
 
+        that.facet_setup(container);
+
         that.pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
         that.record = $.bbq.getState(that.entity_name + '-record', true) || '';
 
-        that.container = container;
-
-        container.attr('title', that.entity_name);
+        that.container.attr('title', that.entity_name);
 
         var h2 = $('<h2></h2>',{
             text: "Records for DNS Zone:" + that.pkey
-        }).appendTo(container);
+        }).appendTo(that.container);
 
 
         var div = $('<div class="search-controls"></div>')
-            .appendTo(container);
+            .appendTo(that.container);
 
         var control_span =$('<span class="record-filter"></span>').appendTo(div);
 
@@ -294,7 +294,7 @@ function ipa_records_facet(spec){
         ipa_button({
             'label': IPA.messages.button.find,
             'icon': 'ui-icon-search',
-            'click': function(){load(container)}
+            'click': function(){refresh()}
         }).appendTo(control_span);
 
         ipa_button({
@@ -314,7 +314,7 @@ function ipa_records_facet(spec){
 
         var records_results = $('<div/>', {
             'class': 'records-results'
-        }).appendTo(container);
+        }).appendTo(that.container);
 
         var records_table = $('<table/>', {
             'class': 'search-table'
@@ -338,7 +338,7 @@ function ipa_records_facet(spec){
         tr.append($('<th>Record Type</th>'));
         tr.append($('<th>Data</th>'));
 
-        load(container);
+        refresh();
     }
 
 
@@ -351,26 +351,26 @@ function ipa_records_facet(spec){
     }
 
     function  reload(){
-        load(that.container);
+        refresh();
     }
 
 
-    function  load(container){
+    function  refresh(){
 
         var options = {};
 
-        var resource_filter = container.find("#dns-record-resource-filter")
+        var resource_filter = that.container.find("#dns-record-resource-filter")
             .val();
         if (resource_filter){
             options.idnsname = resource_filter;
         }
 
-        var type_filter = container.find("#dns-record-type-filter").val();
+        var type_filter = that.container.find("#dns-record-type-filter").val();
         if (type_filter){
             options.type = type_filter;
         }
 
-        var data_filter = container.find("#dns-record-data-filter").val();
+        var data_filter = that.container.find("#dns-record-data-filter").val();
         if (data_filter){
             options.data = data_filter;
         }
@@ -449,7 +449,7 @@ function ipa_records_facet(spec){
 
     that.create = create;
     that.setup = setup;
-    that.load = load;
+    that.refresh = refresh;
 
     return that;
 }
diff --git a/install/static/rule.js b/install/static/rule.js
new file mode 100755
index 00000000..0fc91835
--- /dev/null
+++ b/install/static/rule.js
@@ -0,0 +1,246 @@
+/*  Authors:
+ *    Endi Sukma Dewata <edewata@redhat.com>
+ *
+ * Copyright (C) 2010 Red Hat
+ * see file 'COPYING' for use and warranty information
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; version 2 only
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+/* REQUIRES: ipa.js, details.js, search.js, add.js, entity.js */
+
+function ipa_rule_details_section(spec){
+
+    spec = spec || {};
+
+    var that = ipa_details_section(spec);
+
+    that.text = spec.text;
+    that.field_name = spec.field_name;
+    that.options = spec.options || [];
+    that.tables = spec.tables || [];
+    that.columns = spec.columns;
+
+    that.create = function(container) {
+
+        if (that.template) return;
+
+        if (that.text) container.append(that.text);
+
+        var span = $('<span/>', { 'name': that.field_name }).appendTo(container);
+
+        if (that.options.length) {
+            for (var i=0; i<that.options.length; i++) {
+                var option = that.options[i];
+
+                $('<input/>', {
+                    'type': 'radio',
+                    'name': that.field_name,
+                    'value': option.value
+                }).appendTo(span);
+
+                span.append(option.label);
+            }
+
+            span.append(' ');
+
+            $('<span/>', {
+                'name': 'undo',
+                'class': 'ui-state-highlight ui-corner-all',
+                'style': 'display: none;',
+                'html': 'undo'
+            }).appendTo(span);
+
+            span.append('<br/>');
+        }
+
+        for (var i=0; i<that.tables.length; i++) {
+            var table = that.tables[i];
+
+            var table_span = $('<span/>', { 'name': table.field_name }).appendTo(span);
+
+            var field = that.get_field(table.field_name);
+            field.create(table_span);
+        }
+    };
+
+    return that;
+}
+
+function ipa_rule_association_widget(spec) {
+
+    spec = spec || {};
+
+    var that = ipa_table_widget(spec);
+
+    that.other_entity = spec.other_entity;
+
+    that.add_method = spec.add_method;
+    that.remove_method = spec.remove_method;
+
+    that.init = function() {
+        // create a column if none defined
+        if (!that.columns.length) {
+            that.create_column({
+                'name': that.name,
+                'label': IPA.metadata[that.other_entity].label,
+                'primary_key': true
+            });
+        }
+
+        that.table_init();
+    };
+
+    that.create = function(container) {
+
+        that.table_create(container);
+
+        var buttons = $('span[name=buttons]', container);
+
+        $('<input/>', {
+            'type': 'button',
+            'name': 'remove',
+            'value': 'Remove '+that.label
+        }).appendTo(buttons);
+
+        $('<input/>', {
+            'type': 'button',
+            'name': 'add',
+            'value': 'Add '+that.label
+        }).appendTo(buttons);
+    };
+
+    that.setup = function(container) {
+
+        that.table_setup(container);
+
+        var button = $('input[name=remove]', that.table);
+        button.replaceWith(ipa_button({
+            'label': button.val(),
+            'icon': 'ui-icon-trash',
+            'click': function() { that.show_remove_dialog(); }
+        }));
+
+        button = $('input[name=add]', that.table);
+        button.replaceWith(ipa_button({
+            'label': button.val(),
+            'icon': 'ui-icon-plus',
+            'click': function() { that.show_add_dialog() }
+        }));
+
+        var entity = IPA.get_entity(that.entity_name);
+        var association = entity.get_association(that.other_entity);
+
+        if (association && association.associator == 'serial') {
+            that.associator = serial_associator;
+        } else {
+            that.associator = bulk_associator;
+        }
+    };
+
+    that.load = function(result) {
+        that.values = result[that.name] || [];
+        that.reset();
+    };
+
+    that.set_values = function(values) {
+
+        that.tbody.empty();
+        for (var i=0; values && i<values.length; i++) {
+            var record = {};
+            record[that.name] = values[i];
+            that.add_row(record);
+        }
+    };
+
+    that.show_add_dialog = function() {
+
+        var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
+        var label = IPA.metadata[that.other_entity].label;
+        var title = 'Add '+label+' to '+that.entity_name+' '+pkey;
+
+        var dialog = ipa_association_adder_dialog({
+            'title': title,
+            'entity_name': that.entity_name,
+            'pkey': pkey,
+            'other_entity': that.other_entity
+        });
+
+        dialog.add = function() {
+            that.add(
+                dialog.get_selected_values(),
+                function() {
+                    that.refresh();
+                    dialog.close();
+                },
+                function() {
+                    that.refresh();
+                    dialog.close();
+                }
+            );
+        };
+
+        dialog.init();
+
+        dialog.open(that.container);
+    };
+
+    that.add = function(values, on_success, on_error) {
+    };
+
+    that.show_remove_dialog = function() {
+
+        var selected_values = that.get_selected_values();
+
+        if (!selected_values.length) {
+            alert('Select '+that.label+' to be removed.');
+            return;
+        }
+
+        var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
+        var label = IPA.metadata[that.other_entity].label;
+        var title = 'Remove '+label+' from '+that.entity_name+' '+pkey;
+
+        var dialog = ipa_association_deleter_dialog({
+            'title': title,
+            'entity_name': that.entity_name,
+            'pkey': pkey,
+            'other_entity': that.other_entity,
+            'values': selected_values
+        });
+
+        dialog.remove = function() {
+            that.remove(
+                selected_values,
+                function() {
+                    that.refresh();
+                    dialog.close();
+                },
+                function() {
+                    that.refresh();
+                    dialog.close();
+                }
+            );
+        };
+
+        dialog.init();
+
+        dialog.open(that.container);
+    };
+
+    that.remove = function(values, on_success, on_error) {
+    };
+
+    return that;
+}
diff --git a/install/static/search.js b/install/static/search.js
index 8d0fc55c..91c6641b 100644
--- a/install/static/search.js
+++ b/install/static/search.js
@@ -37,7 +37,8 @@ function ipa_search_widget(spec) {
         }).appendTo(container);
 
         var search_filter = $('<span/>', {
-            'class': 'search-filter'
+            'class': 'search-filter',
+            'name': 'search-filter'
         }).appendTo(search_controls);
 
         this.filter = $('<input/>', {
@@ -45,28 +46,33 @@ function ipa_search_widget(spec) {
             'name': 'search-' + that.entity_name + '-filter'
         }).appendTo(search_filter);
 
-        ipa_button({
-            'label': IPA.messages.button.find,
-            'icon': 'ui-icon-search',
-            'click': function() { that.find(container); }
+        $('<input/>', {
+            'type': 'button',
+            'name': 'find',
+            'value': 'Find'
         }).appendTo(search_filter);
 
-        var li =         $('<li />', {
-            html: ipa_button({
-                'label': IPA.messages.button.remove,
-                'icon': 'ui-icon-trash',
-                'click': function() { that.remove(container); }
-            })});
-        li.append(
-            ipa_button({
-                'label': IPA.messages.button.add,
-                'icon': 'ui-icon-plus',
-                'click': function() { that.add(container); }
-            })
-        );
-        li.prependTo($('.action-panel ul'));
+        var entity_container = $('#' + that.entity_name);
+        var action_panel = $('.action-panel', entity_container);
+
+        var ul = $('ul', action_panel);
+        var li = $('<li/>').prependTo(ul);
 
-        search_controls.append('<span class="search-buttons"></span>');
+        var search_buttons = $('<span/>', {
+            'class': 'search-buttons'
+        }).appendTo(li);
+
+        $('<input/>', {
+            'type': 'button',
+            'name': 'remove',
+            'value': 'Remove'
+        }).appendTo(search_buttons);
+
+        $('<input/>', {
+            'type': 'button',
+            'name': 'add',
+            'value': 'Add'
+        }).appendTo(search_buttons);
 
         $('<div/>', {
             'class': 'search-results'
@@ -79,6 +85,36 @@ function ipa_search_widget(spec) {
 
         that.table_setup(container);
 
+        var search_filter = $('span[name=search-filter]', that.container);
+
+        var button = $('input[name=find]', search_filter);
+        that.find_button = ipa_button({
+            'label': IPA.messages.button.find,
+            'icon': 'ui-icon-search',
+            'click': function() { that.find(that.container); }
+        });
+        button.replaceWith(that.find_button);
+
+        var entity_container = $('#' + that.entity_name);
+        var action_panel = $('.action-panel', entity_container);
+        var search_buttons = $('.search-buttons', action_panel);
+
+        button = $('input[name=remove]', search_buttons);
+        that.remove_button = ipa_button({
+            'label': IPA.messages.button.remove,
+            'icon': 'ui-icon-trash',
+            'click': function() { that.remove(that.container); }
+        });
+        button.replaceWith(that.remove_button);
+
+        button = $('input[name=add]', search_buttons);
+        that.add_button = ipa_button({
+            'label': IPA.messages.button.add,
+            'icon': 'ui-icon-plus',
+            'click': function() { that.add(that.container); }
+        });
+        button.replaceWith(that.add_button);
+
         var filter = $.bbq.getState(that.entity_name + '-filter', true) || '';
         this.filter.val(filter);
     };
@@ -143,11 +179,11 @@ function ipa_search_widget(spec) {
 
             var batch = ipa_batch_command({
                 'on_success': function() {
-                    that.refresh(that.container);
+                    that.refresh();
                     dialog.close();
                 },
                 'on_error': function() {
-                    that.refresh(that.container);
+                    that.refresh();
                     dialog.close();
                 }
             });
@@ -168,7 +204,7 @@ function ipa_search_widget(spec) {
         dialog.open(that.container);
     };
 
-    that.refresh = function(container) {
+    that.refresh = function() {
 
         function on_success(data, text_status, xhr) {
 
@@ -177,7 +213,7 @@ function ipa_search_widget(spec) {
             var result = data.result.result;
             for (var i = 0; i<result.length; i++) {
                 var record = that.get_record(result[i], 0);
-                that.add_row(that.container, record);
+                that.add_row(record);
             }
 
             var summary = $('span[name=summary]', that.tfoot);
@@ -228,7 +264,7 @@ function ipa_search_facet(spec) {
     that.init = spec.init || init;
     that.create = spec.create || ipa_search_facet_create;
     that.setup = spec.setup || setup;
-    that.load = spec.load || load;
+    that.refresh = spec.refresh || refresh;
 
     that.columns = [];
     that.columns_by_name = {};
@@ -301,14 +337,14 @@ function ipa_search_facet(spec) {
     }
 
     function setup(container) {
-        var span = $('span[name=search]', container);
+        that.facet_setup(container);
+        var span = $('span[name=search]', that.container);
         that.table.setup(span);
     }
 
-    function load(container) {
+    function refresh() {
         that.filter = $.bbq.getState(that.entity_name + '-filter', true) || '';
-        var span = $('span[name=search]', container);
-        that.table.refresh(span);
+        that.table.refresh();
     }
 
     if (spec.columns) {
@@ -320,6 +356,7 @@ function ipa_search_facet(spec) {
     }
 
     that.search_facet_init = that.init;
+    that.search_facet_create = that.create;
 
     return that;
 }
diff --git a/install/static/service.js b/install/static/service.js
index cf8d2cea..229602dd 100644
--- a/install/static/service.js
+++ b/install/static/service.js
@@ -136,10 +136,10 @@ function ipa_service_add_dialog(spec) {
         var record = {};
 
         var field = that.get_field('service');
-        var service = field.save(that.container)[0];
+        var service = field.save()[0];
 
         field = that.get_field('host');
-        var host = field.save(that.container)[0];
+        var host = field.save()[0];
 
         record['krbprincipalname'] = service+'/'+host;
 
@@ -223,24 +223,28 @@ function ipa_service_details_facet(spec) {
     return that;
 }
 
-function service_service_load(container, result) {
+function service_service_load(result) {
 
-    $('dd', container).remove();
+    var that = this;
+
+    $('dd', that.container).remove();
 
     var dd = ipa_create_first_dd(this.name);
-    dd.appendTo(container);
+    dd.appendTo(that.container);
 
     var krbprincipalname = result['krbprincipalname'][0];
     var service = krbprincipalname.replace(/\/.*$/, '');
     dd.append(service);
 }
 
-function service_host_load(container, result) {
+function service_host_load(result) {
+
+    var that = this;
 
-    $('dd', container).remove();
+    $('dd', that.container).remove();
 
     var dd = ipa_create_first_dd(this.name);
-    dd.appendTo(container);
+    dd.appendTo(that.container);
 
     var krbprincipalname = result['krbprincipalname'][0];
     var host = krbprincipalname.replace(/^.*\//, '').replace(/@.*$/, '');
@@ -290,7 +294,7 @@ function service_provisioning_status_widget(spec) {
 
     that.setup = function(container) {
 
-        that.container = container;
+        that.widget_setup(container);
 
         that.valid = $('li.key-status-valid', that.container);
         that.missing = $('li.key-status-missing', that.container);
@@ -340,7 +344,7 @@ function service_provisioning_status_widget(spec) {
         return false;
     };
 
-    that.load = function(container, result) {
+    that.load = function(result) {
         that.result = result;
         var krblastpwdchange = result['krblastpwdchange'];
         set_status(krblastpwdchange ? 'valid' : 'missing');
diff --git a/install/static/sudorule.js b/install/static/sudorule.js
new file mode 100755
index 00000000..60cf4d3e
--- /dev/null
+++ b/install/static/sudorule.js
@@ -0,0 +1,261 @@
+/*  Authors:
+ *    Endi Sukma Dewata <edewata@redhat.com>
+ *
+ * Copyright (C) 2010 Red Hat
+ * see file 'COPYING' for use and warranty information
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; version 2 only
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+/* REQUIRES: ipa.js, details.js, search.js, add.js, entity.js */
+
+function ipa_sudorule() {
+
+    var that = ipa_entity({
+        'name': 'sudorule'
+    });
+
+    that.init = function() {
+
+        var dialog = ipa_sudorule_add_dialog({
+            'name': 'add',
+            'title': 'Add New Rule'
+        });
+        that.add_dialog(dialog);
+        dialog.init();
+
+        var facet = ipa_sudorule_search_facet({
+            'name': 'search',
+            'label': 'Search'
+        });
+        that.add_facet(facet);
+
+        facet = ipa_sudorule_details_facet({
+            'name': 'details',
+            'label': 'Details'
+        });
+        that.add_facet(facet);
+
+        that.entity_init();
+    };
+
+    return that;
+}
+
+IPA.add_entity(ipa_sudorule());
+
+function ipa_sudorule_add_dialog(spec) {
+
+    spec = spec || {};
+
+    var that = ipa_add_dialog(spec);
+
+    that.init = function() {
+
+        that.add_dialog_init();
+
+        that.add_field(ipa_text_widget({
+            'name': 'cn',
+            'label': 'Rule Name',
+            'undo': false
+        }));
+    };
+
+    return that;
+}
+
+function ipa_sudorule_search_facet(spec) {
+
+    spec = spec || {};
+
+    var that = ipa_search_facet(spec);
+
+    that.init = function() {
+
+        that.create_column({name:'cn', label:'Rule Name'});
+        that.create_column({name:'description', label:'Description'});
+        that.create_column({name:'cmdcategory', label:'Command category'});
+
+        that.search_facet_init();
+    };
+
+    that.create = function(container) {
+
+        that.search_facet_create(container);
+
+        // TODO: replace with IPA.metadata[that.entity_name].label
+        container.children().last().prepend(
+            $('<h2/>', { 'html': 'SUDO Rules' }));
+        container.children().last().prepend('<br/><br/>');
+
+    };
+
+    return that;
+}
+
+function ipa_sudorule_details_facet(spec) {
+
+    spec = spec || {};
+
+    var that = ipa_details_facet(spec);
+
+    that.init = function() {
+
+        var section = ipa_details_list_section({
+            'name': 'general',
+            'label': 'General'
+        });
+        that.add_section(section);
+
+        section.create_field({ 'name': 'cn', 'label': 'Name', 'read_only': true });
+        section.create_field({ 'name': 'description', 'label': 'Description' });
+        section.create_field({ 'name': 'cmdcategory', 'label': 'Command Category' });
+
+        section = ipa_rule_details_section({
+            'name': 'user',
+            'label': 'Who',
+            'field_name': 'memberuser',
+            'tables': [
+                { 'field_name': 'memberuser_user' },
+                { 'field_name': 'memberuser_group' }
+            ]
+        });
+        that.add_section(section);
+
+        section.add_field(ipa_sudorule_association_widget({
+            'id': that.entity_name+'-memberuser_user',
+            'name': 'memberuser_user', 'label': 'Users',
+            'other_entity': 'user', 'add_method': 'add_user', 'remove_method': 'remove_user'
+        }));
+        section.add_field(ipa_sudorule_association_widget({
+            'id': that.entity_name+'-memberuser_group',
+            'name': 'memberuser_group', 'label': 'Groups',
+            'other_entity': 'group', 'add_method': 'add_user', 'remove_method': 'remove_user'
+        }));
+
+        section = ipa_rule_details_section({
+            'name': 'host',
+            'label': 'Where',
+            'field_name': 'memberhost',
+            'tables': [
+                { 'field_name': 'memberhost_host' },
+                { 'field_name': 'memberhost_hostgroup' }
+            ]
+        });
+        that.add_section(section);
+
+        section.add_field(ipa_sudorule_association_widget({
+            'id': that.entity_name+'-memberhost_host',
+            'name': 'memberhost_host', 'label': 'Host',
+            'other_entity': 'host', 'add_method': 'add_host', 'remove_method': 'remove_host'
+        }));
+        section.add_field(ipa_sudorule_association_widget({
+            'id': that.entity_name+'-memberhost_hostgroup',
+            'name': 'memberhost_hostgroup', 'label': 'Groups',
+            'other_entity': 'hostgroup', 'add_method': 'add_host', 'remove_method': 'remove_host'
+        }));
+
+        section = ipa_rule_details_section({
+            'name': 'allow',
+            'label': 'Allow',
+            'field_name': 'memberallowcmd',
+            'tables': [
+                { 'field_name': 'memberallowcmd_sudocmd' },
+                { 'field_name': 'memberallowcmd_sudocmdgroup' }
+            ]
+        });
+        that.add_section(section);
+
+        section.add_field(ipa_sudorule_association_widget({
+            'id': that.entity_name+'-memberallowcmd_sudocmd',
+            'name': 'memberallowcmd_sudocmd', 'label': 'Command',
+            'other_entity': 'sudocmd', 'add_method': 'add_allow_command', 'remove_method': 'remove_allow_command'
+        }));
+        section.add_field(ipa_sudorule_association_widget({
+            'id': that.entity_name+'-memberallowcmd_sudocmdgroup',
+            'name': 'memberallowcmd_sudocmdgroup', 'label': 'Groups',
+            'other_entity': 'sudocmdgroup', 'add_method': 'add_allow_command', 'remove_method': 'remove_allow_command'
+        }));
+
+        section = ipa_rule_details_section({
+            'name': 'deny',
+            'label': 'Deny',
+            'field_name': 'memberdenycmd',
+            'tables': [
+                { 'field_name': 'memberdenycmd_sudocmd' },
+                { 'field_name': 'memberdenycmd_sudocmdgroup' }
+            ]
+        });
+        that.add_section(section);
+
+        section.add_field(ipa_sudorule_association_widget({
+            'id': that.entity_name+'-memberdenycmd_sudocmd',
+            'name': 'memberdenycmd_sudocmd', 'label': 'Command',
+            'other_entity': 'sudocmd', 'add_method': 'add_deny_command', 'remove_method': 'remove_deny_command'
+        }));
+        section.add_field(ipa_sudorule_association_widget({
+            'id': that.entity_name+'-memberdenycmd_sudocmdgroup',
+            'name': 'memberdenycmd_sudocmdgroup', 'label': 'Groups',
+            'other_entity': 'sudocmdgroup', 'add_method': 'add_deny_command', 'remove_method': 'remove_deny_command'
+        }));
+
+        that.details_facet_init();
+    };
+
+    return that;
+}
+
+function ipa_sudorule_association_widget(spec) {
+
+    spec = spec || {};
+
+    var that = ipa_rule_association_widget(spec);
+
+    that.add = function(values, on_success, on_error) {
+
+        var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
+
+        var command = ipa_command({
+            'method': that.entity_name+'_'+that.add_method,
+            'args': [pkey],
+            'on_success': on_success,
+            'on_error': on_error
+        });
+        command.set_option(that.other_entity, values.join(','));
+
+        command.execute();
+    };
+
+    that.remove = function(values, on_success, on_error) {
+
+        var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
+
+        var command = ipa_command({
+            'method': that.entity_name+'_'+that.remove_method,
+            'args': [pkey],
+            'on_success': on_success,
+            'on_error': on_error
+        });
+
+        command.set_option(that.other_entity, values.join(','));
+
+        command.execute();
+    };
+
+    that.save = function() {
+        return null;
+    };
+
+    return that;
+}
\ No newline at end of file
diff --git a/install/static/test/data/batch.json b/install/static/test/data/batch.json
index a8a5da0b..a38cd976 100644
--- a/install/static/test/data/batch.json
+++ b/install/static/test/data/batch.json
@@ -4099,7 +4099,38 @@
                 }
             },
             {
-                "error": "i18n_messages"
+                "error": null,
+                "messages": {
+                    "ajax": {
+                        "401": "Your kerberos ticket no longer valid.Please run KInit and then click 'retry'If this is your first time running the IPA Web UI<a href='/ipa/errors/ssbrowser.html'> Follow these directions</a> to configure your browser."
+                    },
+                    "button": {
+                        "add": "Add",
+                        "enroll": "Enroll",
+                        "find": "Find",
+                        "remove": "Delete",
+                        "reset": "Reset",
+                        "update": "Update"
+                    },
+                    "details": {
+                        "account": "Account Details",
+                        "contact": "Contact Details",
+                        "employee": "      Employee Information",
+                        "identity": "Identity Details",
+                        "mailing": "Mailing Address",
+                        "misc": "Misc. Information",
+                        "to_top": "Back to Top"
+                    },
+                    "login": {
+                        "header": "Logged In As"
+                    },
+                    "search": {
+                        "delete_confirm": "Do you really want to delete the selected entries?",
+                        "quick_links": "Quick Links",
+                        "select_all": "Select All",
+                        "unselect_all": "Unselect All"
+                    }
+                }
             },
             {
                 "count": 1,
diff --git a/install/static/test/data/sudorule_find.json b/install/static/test/data/sudorule_find.json
new file mode 100644
index 00000000..ff8474af
--- /dev/null
+++ b/install/static/test/data/sudorule_find.json
@@ -0,0 +1,17 @@
+{
+    "error": null,
+    "id": 0,
+    "result": {
+        "count": 1,
+        "result": [
+            {
+                "cn": [
+                    "test"
+                ],
+                "dn": "ipauniqueid=4fc57a02-f23311df-b268e50e-a3b3ef71,cn=sudorules,dc=dev,dc=example,dc=com"
+            }
+        ],
+        "summary": null,
+        "truncated": false
+    }
+}
diff --git a/install/static/test/data/sudorule_show.json b/install/static/test/data/sudorule_show.json
new file mode 100644
index 00000000..332caa2f
--- /dev/null
+++ b/install/static/test/data/sudorule_show.json
@@ -0,0 +1,72 @@
+{
+    "error": null,
+    "id": 0,
+    "result": {
+        "result": {
+            "attributelevelrights": {
+                "aci": "rscwo",
+                "cmdcategory": "rscwo",
+                "cn": "rscwo",
+                "description": "rscwo",
+                "externalhost": "rscwo",
+                "externaluser": "rscwo",
+                "hostcategory": "rscwo",
+                "hostmask": "rscwo",
+                "ipaenabledflag": "rscwo",
+                "ipasudoopt": "rscwo",
+                "ipasudorunas": "rscwo",
+                "ipasudorunasextgroup": "rscwo",
+                "ipasudorunasextuser": "rscwo",
+                "ipasudorunasgroup": "rscwo",
+                "ipasudorunasgroupcategory": "rscwo",
+                "ipasudorunasusercategory": "rscwo",
+                "ipauniqueid": "rsc",
+                "memberallowcmd": "rscwo",
+                "memberdenycmd": "rscwo",
+                "memberhost": "rscwo",
+                "memberuser": "rscwo",
+                "nsaccountlock": "rscwo",
+                "usercategory": "rscwo"
+            },
+            "cn": [
+                "test"
+            ],
+            "dn": "ipauniqueid=4fc57a02-f23311df-b268e50e-a3b3ef71,cn=sudorules,dc=dev,dc=example,dc=com",
+            "ipauniqueid": [
+                "4fc57a02-f23311df-b268e50e-a3b3ef71"
+            ],
+            "memberallowcmd_sudocmd": [
+                "/usr/bin/less"
+            ],
+            "memberallowcmd_sudocmdgroup": [
+                "group1"
+            ],
+            "memberdenycmd_sudocmd": [
+                "/usr/bin/more"
+            ],
+            "memberdenycmd_sudocmdgroup": [
+                "group1",
+                "group2"
+            ],
+            "memberhost_host": [
+                "dev.example.com"
+            ],
+            "memberhost_hostgroup": [
+                "production",
+                "staging"
+            ],
+            "memberuser_group": [
+                "editors"
+            ],
+            "memberuser_user": [
+                "test"
+            ],
+            "objectclass": [
+                "ipaassociation",
+                "ipasudorule"
+            ]
+        },
+        "summary": null,
+        "value": "test"
+    }
+}
diff --git a/install/static/test/details_tests.js b/install/static/test/details_tests.js
index 04738143..baa884e2 100644
--- a/install/static/test/details_tests.js
+++ b/install/static/test/details_tests.js
@@ -179,7 +179,7 @@ test("Testing details lifecycle: create, setup, load.", function(){
     var facet = entity.get_facet('details');
     facet.create(container);
     facet.setup(container);
-    facet.display(result);
+    facet.load(result);
 
     var contact = container.find('dl#contact.entryattrs');
 
@@ -211,10 +211,10 @@ test("Testing details lifecycle: create, setup, load.", function(){
 
     ok (load_manager_called, 'load manager called');
 
-    facet.update(container,
-                     'kfrog',
-                     function(){update_success_called = true},
-                     function(){update_failure_called = true});
+    facet.update(
+        function(){update_success_called = true},
+        function(){update_failure_called = true}
+    );
 
     ok (update_success_called,'update success called');
     ok (!update_failure_called,'update failure not called');
diff --git a/install/static/user.js b/install/static/user.js
index 2a9bc7d0..21619ec5 100644
--- a/install/static/user.js
+++ b/install/static/user.js
@@ -88,12 +88,14 @@ ipa_entity_set_association_definition('user', {
 /* ATTRIBUTE CALLBACKS */
 
 
-function user_status_load(container, result) {
+function user_status_load(result) {
 
-    $('dd', container).remove();
+    var that = this;
+
+    $('dd', that.container).remove();
 
     var dd = ipa_create_first_dd(this.name);
-    dd.appendTo(container);
+    dd.appendTo(that.container);
 
     var lock_field = 'nsaccountlock';
 
@@ -192,12 +194,14 @@ function resetpwd_on_click(){
     return false;
 }
 
-function user_password_load(container, result) {
+function user_password_load(result) {
+
+    var that = this;
 
-    $('dd', container).remove();
+    $('dd', that.container).remove();
 
     var dd = ipa_create_first_dd(this.name);
-    dd.appendTo(container);
+    dd.appendTo(that.container);
 
     var link = $('<a/>',{
         href:"jslink",
@@ -219,9 +223,11 @@ var states = [
     'PA', 'PR', 'RI', 'SC', 'SD', 'TN', 'TX', 'UT', 'VT', 'VI', 'VA',
     'WA', 'WV', 'WI', 'WY', ''
 ];
-function user_state_load(container, result) {
+function user_state_load(result) {
+
+    var that = this;
 
-    $('dd', container).remove();
+    $('dd', that.container).remove();
 
     //var next = dt.next();
     //next.css('clear', 'none');
@@ -229,7 +235,7 @@ function user_state_load(container, result) {
 
     var dd = ipa_create_first_dd(this.name);
     dd.append(select_temp);
-    dd.appendTo(container);
+    dd.appendTo(that.container);
 
     var sel = dd.children().first();
     for (var i = 0; i < states.length; ++i)
diff --git a/install/static/webui.js b/install/static/webui.js
index b588876a..17c08d8f 100644
--- a/install/static/webui.js
+++ b/install/static/webui.js
@@ -34,6 +34,7 @@ var admin_tab_set = [
     ]},
     {name:'policy', children:[
         {name:'hbac', setup: ipa_entity_setup},
+        {name:'sudorule', setup: ipa_entity_setup},
         {name:'dns', setup: ipa_entity_setup},
         {name:'automountlocation',  setup: ipa_entity_setup},
         {name:'pwpolicy', setup: ipa_entity_setup},
diff --git a/install/static/widget.js b/install/static/widget.js
index 6ed27dec..f6bc3d83 100755
--- a/install/static/widget.js
+++ b/install/static/widget.js
@@ -63,22 +63,22 @@ function ipa_widget(spec) {
     }
 
     function setup(container) {
-        this.container = container;
+        that.container = container;
     }
 
-    function load(container, result) {
+    function load(result) {
     }
 
-    function save(container) {
+    function save() {
         return [];
     }
 
-    function clear(container) {
+    function clear() {
     }
 
     that.is_dirty = function(container) {
         if (!that.values) return true;
-        var values = that.save(that.container);
+        var values = that.save();
         if (values.length != that.values.length) return true;
         for (var i=0; i<values.length; i++) {
             if (values[i] != that.values[i]) return true;
@@ -86,29 +86,33 @@ function ipa_widget(spec) {
         return false;
     };
 
-    that.set_values = function(container, values) {
+    that.set_values = function(values) {
     };
 
     that.reset = function(container) {
-        that.hide_undo(that.container);
-        that.set_values(that.container, that.values);
+        that.hide_undo();
+        that.set_values(that.values);
     };
 
-    that.get_undo = function(container) {
+    that.get_undo = function() {
         return $('span[name="undo"]', that.container);
     };
 
-    that.show_undo = function(container) {
-        var undo = that.get_undo(that.container);
+    that.show_undo = function() {
+        var undo = that.get_undo();
         undo.css('display', 'inline');
     };
 
-    that.hide_undo = function(container) {
-        var undo = that.get_undo(that.container);
+    that.hide_undo = function() {
+        var undo = that.get_undo();
         undo.css('display', 'none');
     };
 
+    that.refresh = function() {
+    };
+
     // methods that should be invoked by subclasses
+    that.widget_init = that.init;
     that.widget_create = that.create;
     that.widget_setup = that.setup;
 
@@ -146,16 +150,16 @@ function ipa_text_widget(spec) {
 
         var input = $('input[name="'+that.name+'"]', that.container);
         input.keyup(function() {
-            that.show_undo(that.container);
+            that.show_undo();
         });
 
-        var undo = that.get_undo(that.container);
+        var undo = that.get_undo();
         undo.click(function() {
-            that.reset(that.container);
+            that.reset();
         });
     };
 
-    that.load = function(container, result) {
+    that.load = function(result) {
 
         that.values = result[that.name] || [''];
 
@@ -168,12 +172,11 @@ function ipa_text_widget(spec) {
             input.replaceWith(label);
 
         } else {
-            that.set_values(that.container, that.values);
-            that.hide_undo(that.container);
+            that.reset();
         }
     };
 
-    that.save = function(container) {
+    that.save = function() {
         if (that.read_only) {
             return that.values;
         } else {
@@ -182,7 +185,7 @@ function ipa_text_widget(spec) {
         }
     };
 
-    that.set_values = function(container, values) {
+    that.set_values = function(values) {
         if (that.read_only) {
             $('label[name="'+that.name+'"]', that.container).val(values[0]);
         } else {
@@ -190,8 +193,8 @@ function ipa_text_widget(spec) {
         }
     };
 
-    that.clear = function(container) {
-        that.set_values(that.container, ['']);
+    that.clear = function() {
+        that.set_values(['']);
     };
 
     return that;
@@ -225,32 +228,31 @@ function ipa_checkbox_widget(spec) {
 
         var input = $('input[name="'+that.name+'"]', that.container);
         input.change(function() {
-            that.show_undo(that.container);
+            that.show_undo();
         });
 
-        var undo = that.get_undo(that.container);
+        var undo = that.get_undo();
         undo.click(function() {
-            that.reset(that.container);
+            that.reset();
         });
     };
 
-    that.load = function(container, result) {
+    that.load = function(result) {
         that.values = result[that.name] || [false];
-        that.set_values(that.container, that.values);
-        that.hide_undo(that.container);
+        that.reset();
     };
 
-    that.save = function(container) {
+    that.save = function() {
         var value = $('input[name="'+that.name+'"]', that.container).is(':checked');
         return [value];
     };
 
-    that.set_values = function(container, values) {
+    that.set_values = function(values) {
         var value = values && values.length ? values[0] : false;
         $('input[name="'+that.name+'"]', that.container).get(0).checked = value;
     };
 
-    that.clear = function(container) {
+    that.clear = function() {
         $('input[name="'+that.name+'"]', that.container).get(0).checked = false;
     };
 
@@ -269,31 +271,30 @@ function ipa_radio_widget(spec) {
 
         var input = $('input[name="'+that.name+'"]', that.container);
         input.change(function() {
-            that.show_undo(that.container);
+            that.show_undo();
         });
 
-        var undo = that.get_undo(that.container);
+        var undo = that.get_undo();
         undo.click(function() {
-            that.reset(that.container);
+            that.reset();
         });
     };
 
-    that.load = function(container, result) {
+    that.load = function(result) {
         that.values = result[that.name] || [''];
-        that.set_values(that.container, that.values);
-        that.hide_undo(that.container);
+        that.reset();
     };
 
-    that.save = function(container) {
+    that.save = function() {
         var value = $('input[name="'+that.name+'"]:checked', that.container).val();
         return [value];
     };
 
-    that.set_values = function(container, values) {
+    that.set_values = function(values) {
         $('input[name="'+that.name+'"][value="'+values[0]+'"]', that.container).get(0).checked = true;
     };
 
-    that.clear = function(container) {
+    that.clear = function() {
         $('input[name="'+that.name+'"]', that.container).get().checked = false;
     };
 
@@ -335,29 +336,28 @@ function ipa_textarea_widget(spec) {
             undo.css('display', 'inline');
         });
 
-        var undo = that.get_undo(that.container);
+        var undo = that.get_undo();
         undo.click(function() {
-            that.reset(that.container);
+            that.reset();
         });
     };
 
-    that.load = function(container, result) {
+    that.load = function(result) {
         that.values = result[that.name] || [''];
-        that.set_values(that.container, that.values);
-        that.hide_undo(that.container);
+        that.reset();
     };
 
-    that.save = function(container) {
+    that.save = function() {
         var value = $('textarea[name="'+that.name+'"]', that.container).val();
         return [value];
     };
 
-    that.set_values = function(container, values) {
+    that.set_values = function(values) {
         $('textarea[name="'+that.name+'"]', that.container).val(values[0]);
     };
 
-    that.clear = function(container) {
-        that.set_values(that.container, ['']);
+    that.clear = function() {
+        that.set_values(['']);
     };
 
     return that;
@@ -383,12 +383,11 @@ function ipa_button_widget(spec) {
         input.replaceWith(ipa_button({ 'label': that.label, 'click': that.click }));
     }
 
-    function load(container, result) {
+    function load(result) {
     }
 
-    function save(container) {
-        var values = [];
-        return values;
+    function save() {
+        return [];
     }
 
     return that;
@@ -547,7 +546,7 @@ function ipa_table_widget(spec) {
 
 
     that.select_changed = function(){
-    }
+    };
 
 
     that.setup = function(container) {
@@ -562,7 +561,7 @@ function ipa_table_widget(spec) {
         var select_all_checkbox = $('input[name=select]', that.thead);
         select_all_checkbox.attr('title', 'Select All');
 
-        select_all_checkbox.click(function() {
+        select_all_checkbox.change(function() {
             var checked = select_all_checkbox.is(':checked');
             select_all_checkbox.attr('title', checked ? 'Unselect All' : 'Select All');
             var checkboxes = $('input[name=select]', that.tbody).get();
@@ -577,7 +576,7 @@ function ipa_table_widget(spec) {
         that.row.detach();
     };
 
-    that.load = function(container, result) {
+    that.load = function(result) {
 
         that.tbody.empty();
 
@@ -586,11 +585,11 @@ function ipa_table_widget(spec) {
 
         for (var i=0; i<values.length; i++) {
             var record = that.get_record(result, i);
-            that.add_row(that.container, record);
+            that.add_row(record);
         }
     };
 
-    that.save = function(container) {
+    that.save = function() {
         var values = [];
 
         $('input[name="select"]', that.tbody).each(function() {
@@ -621,7 +620,7 @@ function ipa_table_widget(spec) {
         return record;
     };
 
-    that.add_row = function(container, record) {
+    that.add_row = function(record) {
 
         var tr = that.row.clone();
         tr.appendTo(that.tbody);
@@ -646,21 +645,21 @@ function ipa_table_widget(spec) {
         }
     };
 
-    that.refresh = function(container) {
+    that.refresh = function() {
 
         function on_success(data, text_status, xhr) {
-            that.load(that.container, data.result.result);
+            that.load(data.result.result);
         }
 
         function on_error(xhr, text_status, error_thrown) {
-            that.container.empty();
-            that.container.append('<p>Error: '+error_thrown.name+'</p>');
-            that.container.append('<p>'+error_thrown.title+'</p>');
-            that.container.append('<p>'+error_thrown.message+'</p>');
+            var summary = $('span[name=summary]', that.tfoot).empty();
+            summary.append('<p>Error: '+error_thrown.name+'</p>');
+            summary.append('<p>'+error_thrown.title+'</p>');
+            summary.append('<p>'+error_thrown.message+'</p>');
         }
 
         var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
-        ipa_cmd('show', [pkey], {'rights': true}, on_success, on_error, that.entity_name);
+        ipa_cmd('show', [pkey], {'all': true, 'rights': true}, on_success, on_error, that.entity_name);
     };
 
     if (spec.columns) {
@@ -670,6 +669,8 @@ function ipa_table_widget(spec) {
     }
 
     // methods that should be invoked by subclasses
+    that.table_init = that.init;
+    that.table_create = that.create;
     that.table_setup = that.setup;
 
     return that;
@@ -795,7 +796,7 @@ function ipa_dialog(spec) {
         var record = {};
         for (var i=0; i<that.fields.length; i++) {
             var field = that.fields[i];
-            var values = field.save(that.container);
+            var values = field.save();
             record[field.name] = values[0];
         }
         return record;
@@ -809,7 +810,7 @@ function ipa_dialog(spec) {
     that.clear = function() {
         for (var i=0; i<that.fields.length; i++) {
             var field = that.fields[i];
-            field.clear(that.container);
+            field.clear();
         }
     };
 
diff --git a/lite-server.py b/lite-server.py
index 2a83daee..5977a020 100755
--- a/lite-server.py
+++ b/lite-server.py
@@ -51,7 +51,7 @@ class KRBCheater(object):
 
 
 class WebUIApp(object):
-    INDEX_FILE = 'index.xhtml'
+    INDEX_FILE = 'index.html'
     EXTENSION_TO_MIME_MAP = {
         'xhtml': 'text/html',
         'html': 'text/html',