Add utility to lock user accounts. Remove lock capability from ipa-deluser

Fix bootstrap.ldif to add new Class of Service entries properly
Include some man pages that weren't being installed

6 files changed, 141 insertions, 25 deletions

diff --git a/ipa-admintools/Makefile b/ipa-admintools/Makefile
index f4ee40a6..9586e71c 100644
--- a/ipa-admintools/Makefile
+++ b/ipa-admintools/Makefile
@@ -12,6 +12,7 @@ install:
 	install -m 755 ipa-finduser $(SBINDIR)
 	install -m 755 ipa-usermod $(SBINDIR)
 	install -m 755 ipa-deluser $(SBINDIR)
+	install -m 755 ipa-lockuser $(SBINDIR)
 	install -m 755 ipa-addgroup $(SBINDIR)
 	install -m 755 ipa-delgroup $(SBINDIR)
 	install -m 755 ipa-findgroup $(SBINDIR)
diff --git a/ipa-admintools/ipa-deluser b/ipa-admintools/ipa-deluser
index 02ba5f13..79a52156 100644
--- a/ipa-admintools/ipa-deluser
+++ b/ipa-admintools/ipa-deluser
@@ -34,8 +34,6 @@ def usage():
 
 def parse_options():
     parser = OptionParser()
-    parser.add_option("-d", "--delete", action="store_true", dest="deluser",
-                      help="Delete the user, don't inactivate them.")
     parser.add_option("--usage", action="store_true",
                       help="Program usage")
 
@@ -50,21 +48,10 @@ def main():
     if len(args) != 2:
         usage()
 
-    msg = "inactivated"
     try:
         client = ipaclient.IPAClient()
-        if options.deluser:
-            ret = client.delete_user(args[1])
-            msg = "deleted"
-        else:
-            try:
-                ret = client.mark_user_inactive(args[1])
-            except ipa.ipaerror.exception_for(ipa.ipaerror.LDAP_EMPTY_MODLIST):
-                print "User is already marked inactive"
-                return 0
-            except:
-                raise
-            print args[1] + " successfully %s" % msg
+        ret = client.delete_user(args[1])
+        print args[1] + " successfully deleted"
     except xmlrpclib.Fault, fault:
         if fault.faultCode == errno.ECONNREFUSED:
             print "The IPA XML-RPC service is not responding."
diff --git a/ipa-admintools/ipa-lockuser b/ipa-admintools/ipa-lockuser
new file mode 100644
index 00000000..f5aaa37c
--- /dev/null
+++ b/ipa-admintools/ipa-lockuser
@@ -0,0 +1,93 @@
+#! /usr/bin/python -E
+# Authors: Rob Crittenden <rcritten@redhat.com>
+#
+# Copyright (C) 2007  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; version 2 only
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+#
+
+import sys
+from optparse import OptionParser
+import ipa
+import ipa.ipaclient as ipaclient
+import ipa.config
+import errno
+
+import xmlrpclib
+import kerberos
+
+def usage():
+    print "ipa-lockuser user"
+    sys.exit(1)
+
+def parse_options():
+    parser = OptionParser()
+    parser.add_option("-u", "--unlock", action="store_true", dest="unlock",
+                      help="Unlock a user's account")
+    parser.add_option("--usage", action="store_true",
+                      help="Program usage")
+
+    args = ipa.config.init_config(sys.argv)
+    options, args = parser.parse_args(args)
+
+    return options, args
+
+def main():
+    options, args = parse_options()
+
+    if len(args) != 2:
+        usage()
+
+    msg = "inactivated"
+    try:
+        client = ipaclient.IPAClient()
+        if options.unlock:
+            try:
+                ret = client.mark_user_active(args[1])
+                msg = "unlocked"
+            except ipa.ipaerror.exception_for(ipa.ipaerror.LDAP_EMPTY_MODLIST):
+                print "User is already marked active"
+                return 0
+            except:
+                raise
+        else:
+            try:
+                ret = client.mark_user_inactive(args[1])
+            except ipa.ipaerror.exception_for(ipa.ipaerror.LDAP_EMPTY_MODLIST):
+                print "User is already marked inactive"
+                return 0
+            except:
+                raise
+            print args[1] + " successfully %s" % msg
+    except xmlrpclib.Fault, fault:
+        if fault.faultCode == errno.ECONNREFUSED:
+            print "The IPA XML-RPC service is not responding."
+        else:
+            print fault.faultString
+        return 1
+    except kerberos.GSSError, e:
+        print "Could not initialize GSSAPI: %s/%s" % (e[0][0][0], e[0][1][0])
+        return 1
+    except xmlrpclib.ProtocolError, e:
+        print "Unable to connect to IPA server: %s" % (e.errmsg)
+        return 1
+    except ipa.ipaerror.IPAError, e:
+        print "%s" % (e.message)
+        return 1
+
+    return 0
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/ipa-admintools/man/Makefile b/ipa-admintools/man/Makefile
index ef70cd7d..19648f53 100644
--- a/ipa-admintools/man/Makefile
+++ b/ipa-admintools/man/Makefile
@@ -1,13 +1,18 @@
 MANDIR = $(DESTDIR)/usr/share/man
 
 MANFILES=\
+	ipa-adddelegation.1 \
 	ipa-addgroup.1 \
 	ipa-adduser.1 \
+	ipa-deldelegation.1 \
 	ipa-delgroup.1 \
 	ipa-deluser.1 \
 	ipa-findgroup.1 \
 	ipa-finduser.1 \
 	ipa-groupmod.1 \
+	ipa-listdelegation.1 \
+	ipa-lockuser.1 \
+	ipa-moddelegation.1 \
 	ipa-passwd.1 \
 	ipa-usermod.1
 
diff --git a/ipa-admintools/man/ipa-deluser.1 b/ipa-admintools/man/ipa-deluser.1
index 8d82dceb..c9665a09 100644
--- a/ipa-admintools/man/ipa-deluser.1
+++ b/ipa-admintools/man/ipa-deluser.1
@@ -19,20 +19,14 @@
 .\" 
 .TH "ipa-deluser" "1" "Oct 10 2007" "freeipa" ""
 .SH "NAME"
-ipa\-deluser \- Delete or inactivate a user
+ipa\-deluser \- Delete a user
 
 .SH "SYNOPSIS"
-ipa\-deluser [\fIOPTION\fR]... \fIuser\fR
+ipa\-deluser \fIuser\fR
 
 .SH "DESCRIPTION"
-Inactivates a user with login name \fIname\fR.
+Deletes a user with login name \fIname\fR.
 
-By default users are not completely removed. They are marked as inactive. Use the [\-d|\-\-delete] option to completely remove them.
-
-Users are automatically removed from groups when they are deleted. The are not when inactivated.
-.SH "OPTIONS"
-.TP 
-\fB\-d\fR, \fB\-\-delete
-Completely remove the user from the database. The default is to mark the user inactive.
+Users are automatically removed from groups when they are deleted.
 .SH "EXIT STATUS"
 The exit status is 0 on success, nonzero on error.
diff --git a/ipa-admintools/man/ipa-lockuser.1 b/ipa-admintools/man/ipa-lockuser.1
new file mode 100644
index 00000000..2a634781
--- /dev/null
+++ b/ipa-admintools/man/ipa-lockuser.1
@@ -0,0 +1,36 @@
+.\" A man page for ipa-lockuser
+.\" Copyright (C) 2007 Red Hat, Inc.
+.\" 
+.\" This is free software; you can redistribute it and/or modify it under
+.\" the terms of the GNU Library General Public License as published by
+.\" the Free Software Foundation; either version 2 of the License, or
+.\" (at your option) any later version.
+.\" 
+.\" This program is distributed in the hope that it will be useful, but
+.\" WITHOUT ANY WARRANTY; without even the implied warranty of
+.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+.\" General Public License for more details.
+.\" 
+.\" You should have received a copy of the GNU Library General Public
+.\" License along with this program; if not, write to the Free Software
+.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+.\" 
+.\" Author: Rob Crittenden <rcritten@redhat.com>
+.\" 
+.TH "ipa-lockuser" "1" "Oct 10 2007" "freeipa" ""
+.SH "NAME"
+ipa\-lockuser \- Lock or unlock a user account
+
+.SH "SYNOPSIS"
+ipa\-lockuser [\fIOPTION\fR]... \fIuser\fR
+
+.SH "DESCRIPTION"
+Locks a user account with login name \fIname\fR.
+
+Users are not removed from groups when their account is locked.
+.SH "OPTIONS"
+.TP 
+\fB\-u\fR, \fB\-\-unlock
+Unlock a user's account
+.SH "EXIT STATUS"
+The exit status is 0 on success, nonzero on error.