Make ipaconfigstring modifiable by users.

Convert from a freeform string into a enumeration.

Only values currently allowed are AllowLMhash and AllowNThash.

To add more than one value on the command-line either specify
--ipaconfigstring multiple times or add the values comma-separated.

https://fedorahosted.org/freeipa/ticket/1433

3 files changed, 9 insertions, 6 deletions

diff --git a/API.txt b/API.txt
index d031039a..9605d1a0 100644
--- a/API.txt
+++ b/API.txt
@@ -445,7 +445,7 @@ args: 1,0,1
 arg: Str('request_id')
 output: Output('result', None, None)
 command: config_mod
-args: 0,22,3
+args: 0,23,3
 option: Int('ipamaxusernamelength', attribute=True, autofill=False, cli_name='maxusername', minvalue=1, multivalue=False, required=False)
 option: IA5Str('ipahomesrootdir', attribute=True, autofill=False, cli_name='homedirectory', multivalue=False, required=False)
 option: Str('ipadefaultloginshell', attribute=True, autofill=False, cli_name='defaultshell', multivalue=False, required=False)
@@ -459,6 +459,7 @@ option: Bool('ipamigrationenabled', attribute=True, autofill=False, cli_name='en
 option: Str('ipagroupobjectclasses', attribute=True, autofill=False, cli_name='groupobjectclasses', csv=True, multivalue=True, required=False)
 option: Str('ipauserobjectclasses', attribute=True, autofill=False, cli_name='userobjectclasses', csv=True, multivalue=True, required=False)
 option: Int('ipapwdexpadvnotify', attribute=True, autofill=False, cli_name='pwdexpnotify', minvalue=0, multivalue=False, required=False)
+option: StrEnum('ipaconfigstring', attribute=True, autofill=False, cli_name='ipaconfigstring', csv=True, multivalue=True, required=False, values=(u'AllowLMhash', u'AllowNThash'))
 option: Str('ipaselinuxusermaporder', attribute=True, autofill=False, cli_name='ipaselinuxusermaporder', multivalue=False, required=False)
 option: Str('ipaselinuxusermapdefault', attribute=True, autofill=False, cli_name='ipaselinuxusermapdefault', multivalue=False, required=False)
 option: Str('setattr*', cli_name='setattr', exclude='webui')
diff --git a/VERSION b/VERSION
index 58695f9a..785acef3 100644
--- a/VERSION
+++ b/VERSION
@@ -79,4 +79,4 @@ IPA_DATA_VERSION=20100614120000
 #                                                      #
 ########################################################
 IPA_API_VERSION_MAJOR=2
-IPA_API_VERSION_MINOR=24
+IPA_API_VERSION_MINOR=25
diff --git a/ipalib/plugins/config.py b/ipalib/plugins/config.py
index 0c238ac9..1455771d 100644
--- a/ipalib/plugins/config.py
+++ b/ipalib/plugins/config.py
@@ -19,7 +19,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from ipalib import api
-from ipalib import Bool, Int, Str, IA5Str
+from ipalib import Bool, Int, Str, IA5Str, StrEnum
 from ipalib.plugins.baseldap import *
 from ipalib import _
 from ipalib.errors import ValidationError
@@ -89,7 +89,8 @@ class config(LDAPObject):
         'ipadefaultprimarygroup', 'ipadefaultemaildomain', 'ipasearchtimelimit',
         'ipasearchrecordslimit', 'ipausersearchfields', 'ipagroupsearchfields',
         'ipamigrationenabled', 'ipacertificatesubjectbase',
-        'ipapwdexpadvnotify', 'ipaselinuxusermaporder', 'ipaselinuxusermapdefault',
+        'ipapwdexpadvnotify', 'ipaselinuxusermaporder',
+        'ipaselinuxusermapdefault', 'ipaconfigstring',
     ]
 
     label = _('Configuration')
@@ -172,11 +173,12 @@ class config(LDAPObject):
             doc=_('Number of days\'s notice of impending password expiration'),
             minvalue=0,
         ),
-        Str('ipaconfigstring?',
+        StrEnum('ipaconfigstring*',
             cli_name='ipaconfigstring',
             label=_('Password plugin features'),
             doc=_('Extra hashes to generate in password plug-in'),
-            flags=['no_update'],
+            values=(u'AllowLMhash', u'AllowNThash'),
+            csv=True,
         ),
         Str('ipaselinuxusermaporder?',
             label=_('SELinux user map order'),