Code cleanup

This patch removes two files which seem to be long obsoleted and not
used any more.

2 files changed, 0 insertions, 893 deletions

diff --git a/ipaserver/plugins/ldapapi.py b/ipaserver/plugins/ldapapi.py
deleted file mode 100644
index 1ef84579..00000000
--- a/ipaserver/plugins/ldapapi.py
+++ /dev/null
@@ -1,445 +0,0 @@
-# Authors:
-#   Rob Crittenden <rcritten@redhat.com>
-#   Jason Gerard DeRose <jderose@redhat.com>
-#
-# Copyright (C) 2008  Red Hat
-# see file 'COPYING' for use and warranty information
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-"""
-Backend plugin for LDAP.
-
-This wraps the python-ldap bindings.
-"""
-
-import ldap as _ldap
-from ipalib import api
-from ipalib import errors
-from ipalib.crud import CrudBackend
-from ipaserver import servercore, ipaldap
-import krbV
-
-
-class ldap(CrudBackend):
-    """
-    LDAP backend plugin.
-    """
-
-    def __init__(self):
-        self.dn = _ldap.dn
-        super(ldap, self).__init__()
-
-    def create_connection(self, ccache):
-        if ccache is None:
-            raise errors.CCacheError()
-        conn = ipaldap.IPAdmin(self.env.ldap_host, self.env.ldap_port)
-        principal = krbV.CCache(
-            name=ccache, context=krbV.default_context()
-        ).principal().name
-        conn.set_krbccache(ccache, principal)
-        return conn
-
-    def destroy_connection(self):
-        self.conn.unbind_s()
-
-    def make_user_dn(self, uid):
-        """
-        Construct user dn from uid.
-        """
-        return 'uid=%s,%s,%s' % (
-            self.dn.escape_dn_chars(uid),
-            self.api.env.container_user,
-            self.api.env.basedn,
-        )
-
-    def make_group_dn(self, cn):
-        """
-        Construct group dn from cn.
-        """
-        return 'cn=%s,%s,%s' % (
-            self.dn.escape_dn_chars(cn),
-            self.api.env.container_group,
-            self.api.env.basedn,
-        )
-
-    def make_hostgroup_dn(self, cn):
-        """
-        Construct group of hosts dn from cn.
-        """
-        return 'cn=%s,%s,%s' % (
-            self.dn.escape_dn_chars(cn),
-            self.api.env.container_hostgroup,
-            self.api.env.basedn,
-        )
-
-    def make_taskgroup_dn(self, cn):
-        """
-        Construct group of tasks dn from cn.
-        """
-        return 'cn=%s,%s,%s' % (
-            self.dn.escape_dn_chars(cn),
-            self.api.env.container_taskgroup,
-            self.api.env.basedn,
-        )
-
-    def make_service_dn(self, principal):
-        """
-        Construct service principal dn from principal name
-        """
-        return 'krbprincipalname=%s,%s,%s' % (
-            self.dn.escape_dn_chars(principal),
-            self.api.env.container_service,
-            self.api.env.basedn,
-        )
-
-    def make_host_dn(self, hostname):
-        """
-        Construct host dn from hostname
-        """
-        return 'fqdn=%s,%s,%s' % (
-            self.dn.escape_dn_chars(hostname),
-            self.api.env.container_host,
-            self.api.env.basedn,
-        )
-
-    def make_application_dn(self, appname):
-        """
-        Construct application dn from cn.
-        """
-        return 'cn=%s,%s,%s' % (
-            self.dn.escape_dn_chars(appname),
-            self.api.env.container_applications,
-            self.api.env.basedn,
-        )
-
-    def make_policytemplate_dn(self, appname, uuid):
-        """
-        Construct policytemplate dn from appname
-        """
-        return 'ipaUniqueID=%s,%s' % (
-            self.dn.escape_dn_chars(uuid),
-            self.make_application_dn(appname),
-        )
-
-    def make_role_application_dn(self, appname):
-        """
-        Construct application role container from appname
-        """
-        return 'cn=%s,%s,%s' % (
-            self.dn.escape_dn_chars(appname),
-            self.api.env.container_roles,
-            self.api.env.basedn,
-        )
-
-    def make_role_policytemplate_dn(self, appname, uuid):
-        """
-        Construct policytemplate dn from uuid and appname
-        """
-        return 'ipaUniqueID=%s,cn=templates,%s' % (
-            self.dn.escape_dn_chars(uuid),
-            self.make_role_application_dn(appname),
-        )
-
-    def make_policygroup_dn(self, uuid):
-        """
-        Construct policygroup dn from uuid
-        """
-        return 'ipaUniqueID=%s,%s,%s' % (
-            self.dn.escape_dn_chars(uuid),
-            self.api.env.container_policygroups,
-            self.api.env.basedn,
-        )
-
-    def make_policy_dn(self, uuid, polgroup_uuid):
-        """
-        Construct policy dn from uuid of policy and its policygroup
-        """
-        return 'ipaUniqueID=%s,%s' % (
-            self.dn.escape_dn_chars(uuid),
-            self.make_policygroup_dn(polgroup_uuid),
-        )
-
-    def make_policy_blob_dn(self, blob_uuid, policy_uuid, polgroup_uuid):
-        """
-        Construct policy blob dn from uuids of its policy and policygroup
-        objects
-        """
-        return 'ipaUniqueID=%s,%s' % (
-            self.dn.escape_dn_chars(blob_uuid),
-            self.make_policy_dn(policy_uuid, polgroup_uuid),
-        )
-
-    def make_policylink_dn(self, uuid):
-        """
-        Construct policy link dn from uuid
-        """
-        return 'ipaUniqueID=%s,%s,%s' % (
-            self.dn.escape_dn_chars(uuid),
-            self.api.env.container_policylinks,
-            self.api.env.basedn,
-        )
-
-    def get_object_type(self, attribute):
-        """
-        Based on attribute, make an educated guess as to the type of
-        object we're looking for.
-        """
-        attribute = attribute.lower()
-        object_type = None
-        if attribute == "uid": # User
-            object_type = "posixAccount"
-        elif attribute == "cn": # Group
-            object_type = "ipaUserGroup"
-        elif attribute == "krbprincipalname": # Service
-            object_type = "krbPrincipal"
-
-        return object_type
-
-    def find_entry_dn(self, key_attribute, primary_key, object_type=None, base=None):
-        """
-        Find an existing entry's dn from an attribute
-        """
-        key_attribute = key_attribute.lower()
-        if not object_type:
-            object_type = self.get_object_type(key_attribute)
-        if not object_type:
-            return None
-
-        search_filter = "(&(objectclass=%s)(%s=%s))" % (
-            object_type,
-            key_attribute,
-            self.dn.escape_dn_chars(primary_key)
-        )
-
-        if not base:
-            base = self.api.env.container_accounts
-
-        search_base = "%s, %s" % (base, self.api.env.basedn)
-
-        entry = servercore.get_sub_entry(search_base, search_filter, ['dn', 'objectclass'])
-
-        return entry.get('dn')
-
-    def get_base_entry(self, searchbase, searchfilter, attrs):
-        return servercore.get_base_entry(searchbase, searchfilter, attrs)
-
-    def get_sub_entry(self, searchbase, searchfilter, attrs):
-        return servercore.get_sub_entry(searchbase, searchfilter, attrs)
-
-    def get_one_entry(self, searchbase, searchfilter, attrs):
-        return servercore.get_one_entry(searchbase, searchfilter, attrs)
-
-    def get_ipa_config(self):
-        """Return a dictionary of the IPA configuration"""
-        return servercore.get_ipa_config()
-
-    def mark_entry_active(self, dn):
-        return servercore.mark_entry_active(dn)
-
-    def mark_entry_inactive(self, dn):
-        return servercore.mark_entry_inactive(dn)
-
-    def _generate_search_filters(self, **kw):
-        """Generates a search filter based on a list of words and a list
-           of fields to search against.
-
-           Returns a tuple of two filters: (exact_match, partial_match)
-        """
-
-        # construct search pattern for a single word
-        # (|(f1=word)(f2=word)...)
-        exact_pattern = "(|"
-        for field in kw.keys():
-            exact_pattern += "(%s=%s)" % (field, kw[field])
-        exact_pattern += ")"
-
-        sub_pattern = "(|"
-        for field in kw.keys():
-            sub_pattern += "(%s=*%s*)" % (field, kw[field])
-        sub_pattern += ")"
-
-        # construct the giant match for all words
-        exact_match_filter = "(&" + exact_pattern + ")"
-        partial_match_filter = "(|" + sub_pattern + ")"
-
-        return (exact_match_filter, partial_match_filter)
-
-    def _get_scope(self, scope_str):
-        scope_dict = {'one'     : _ldap.SCOPE_ONELEVEL,
-                      'subtree' : _ldap.SCOPE_SUBTREE,
-                      'base'    : _ldap.SCOPE_BASE }
-        return scope_dict.get(scope_str, _ldap.SCOPE_SUBTREE)
-
-    def modify_password(self, dn, **kw):
-        return servercore.modify_password(dn, kw.get('oldpass', ''), kw.get('newpass'))
-
-    def add_member_to_group(self, memberdn, groupdn, memberattr='member'):
-        """
-        Add a new member to a group.
-
-        :param memberdn: the DN of the member to add
-        :param groupdn: the DN of the group to add a member to
-        """
-        return servercore.add_member_to_group(memberdn, groupdn, memberattr)
-
-    def remove_member_from_group(self, memberdn, groupdn, memberattr='member'):
-        """
-        Remove a new member from a group.
-
-        :param memberdn: the DN of the member to remove
-        :param groupdn: the DN of the group to remove a member from
-        """
-        return servercore.remove_member_from_group(memberdn, groupdn, memberattr)
-
-    # The CRUD operations
-
-    def strip_none(self, kw):
-        """
-        Remove any None values present in the LDAP attribute dict.
-        """
-        for (key, value) in kw.iteritems():
-            if value is None:
-                continue
-            if type(value) in (list, tuple):
-                value = filter(
-                    lambda v: type(v) in (str, unicode, bool, int, float),
-                    value
-                )
-                if len(value) > 0:
-                    yield (key, value)
-            else:
-                assert type(value) in (str, unicode, bool, int, float)
-                yield (key, value)
-
-    def create(self, **kw):
-        if servercore.entry_exists(kw['dn']):
-            raise errors.DuplicateEntry
-        kw = dict(self.strip_none(kw))
-
-        entry = ipaldap.Entry(kw['dn'])
-
-        # dn isn't allowed to be in the entry itself
-        del kw['dn']
-
-        # Fill in our new entry
-        for k in kw:
-            entry.setValues(k, kw[k])
-
-        servercore.add_entry(entry)
-        return self.retrieve(entry.dn)
-
-    def retrieve(self, dn, attributes=None):
-        return servercore.get_entry_by_dn(dn, attributes)
-
-    def update(self, dn, **kw):
-        result = self.retrieve(dn, ["*"] + kw.keys())
-
-        entry = ipaldap.Entry((dn, servercore.convert_scalar_values(result)))
-        start_keys = kw.keys()
-        kw = dict(self.strip_none(kw))
-        end_keys = kw.keys()
-        removed_keys = list(set(start_keys) - set(end_keys))
-        for k in kw:
-            entry.setValues(k, kw[k])
-
-        for k in removed_keys:
-            entry.delAttr(k)
-
-        servercore.update_entry(entry.toDict(), removed_keys)
-
-        return self.retrieve(dn)
-
-    def delete(self, dn):
-        return servercore.delete_entry(dn)
-
-    def search(self, **kw):
-        objectclass = kw.get('objectclass')
-        sfilter = kw.get('filter')
-        attributes = kw.get('attributes')
-        base = kw.get('base')
-        scope = kw.get('scope')
-        exactonly = kw.get('exactonly', None)
-        if attributes:
-            del kw['attributes']
-        else:
-            attributes = ['*']
-        if objectclass:
-            del kw['objectclass']
-        if base:
-            del kw['base']
-        if sfilter:
-            del kw['filter']
-        if scope:
-            del kw['scope']
-        if exactonly is not None:
-            del kw['exactonly']
-        if kw:
-            (exact_match_filter, partial_match_filter) = self._generate_search_filters(**kw)
-        else:
-            (exact_match_filter, partial_match_filter) = ('', '')
-        if objectclass:
-            exact_match_filter = '(&(objectClass=%s)%s)' % (objectclass, exact_match_filter)
-            partial_match_filter = '(&(objectClass=%s)%s)' % (objectclass, partial_match_filter)
-        else:
-            exact_match_filter = '(&(objectClass=*)%s)' % exact_match_filter
-            partial_match_filter = '(&(objectClass=*)%s)' % partial_match_filter
-        if sfilter:
-            exact_match_filter = '(%s%s)' % (sfilter, exact_match_filter)
-            partial_match_filter = '(%s%s)' % (sfilter, partial_match_filter)
-
-        search_scope = self._get_scope(scope)
-
-        if not base:
-            base = self.api.env.container_accounts
-
-        search_base = '%s,%s' % (base, self.api.env.basedn)
-        try:
-            exact_results = servercore.search(search_base,
-                    exact_match_filter, attributes, scope=search_scope)
-        except errors.NotFound:
-            exact_results = [0]
-
-        if not exactonly:
-            try:
-                partial_results = servercore.search(search_base,
-                        partial_match_filter, attributes, scope=search_scope)
-            except errors.NotFound:
-                partial_results = [0]
-        else:
-            partial_results = [0]
-
-        exact_counter = exact_results[0]
-        partial_counter = partial_results[0]
-
-        exact_results = exact_results[1:]
-        partial_results = partial_results[1:]
-
-        # Remove exact matches from the partial_match list
-        exact_dns = set(map(lambda e: e.get('dn'), exact_results))
-        partial_results = filter(lambda e: e.get('dn') not in exact_dns,
-                                 partial_results)
-
-        if (exact_counter == -1) or (partial_counter == -1):
-            counter = -1
-        else:
-            counter = len(exact_results) + len(partial_results)
-
-        results = [counter]
-        for r in exact_results + partial_results:
-            results.append(r)
-
-        return results
-
-api.register(ldap)
diff --git a/ipaserver/servercore.py b/ipaserver/servercore.py
deleted file mode 100644
index 66af1161..00000000
--- a/ipaserver/servercore.py
+++ /dev/null
@@ -1,448 +0,0 @@
-# Authors: Rob Crittenden <rcritten@redhat.com>
-#
-# Copyright (C) 2007  Red Hat
-# see file 'COPYING' for use and warranty information
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-#
-
-import ldap
-from ipalib.request import context
-from ipaserver import ipaldap
-from ipalib import errors
-from ipalib import api
-
-def convert_entry(ent):
-    entry = dict(ent.data)
-    entry['dn'] = ent.dn
-    # For now convert single entry lists to a string for the ui.
-    # TODO: we need to deal with multi-values better
-    for key,value in entry.iteritems():
-        if isinstance(value,list) or isinstance(value,tuple):
-            if len(value) == 0:
-                entry[key] = ''
-            elif len(value) == 1:
-                entry[key] = value[0]
-    return entry
-
-def convert_scalar_values(orig_dict):
-    """LDAP update dicts expect all values to be a list (except for dn).
-       This method converts single entries to a list."""
-    new_dict={}
-    for (k,v) in orig_dict.iteritems():
-        if not isinstance(v, list) and k != 'dn':
-            v = [v]
-        new_dict[k] = v
-
-    return new_dict
-
-def generate_match_filters(search_fields, criteria_words):
-    """Generates a search filter based on a list of words and a list
-       of fields to search against.
-
-       Returns a tuple of two filters: (exact_match, partial_match)"""
-
-    # construct search pattern for a single word
-    # (|(f1=word)(f2=word)...)
-    search_pattern = "(|"
-    for field in search_fields:
-        search_pattern += "(" + field + "=%(match)s)"
-    search_pattern += ")"
-    gen_search_pattern = lambda word: search_pattern % {'match':word}
-
-    # construct the giant match for all words
-    exact_match_filter = "(&"
-    partial_match_filter = "(|"
-    for word in criteria_words:
-        exact_match_filter += gen_search_pattern(word)
-        partial_match_filter += gen_search_pattern("*%s*" % word)
-    exact_match_filter += ")"
-    partial_match_filter += ")"
-
-    return (exact_match_filter, partial_match_filter)
-
-# TODO: rethink the get_entry vs get_list API calls.
-#       they currently restrict the data coming back without
-#       restricting scope.  For now adding a get_base/sub_entry()
-#       calls, but the API isn't great.
-def get_entry (base, scope, searchfilter, sattrs=None):
-    """Get a specific entry (with a parametized scope).
-       Return as a dict of values.
-       Multi-valued fields are represented as lists.
-    """
-    ent=""
-
-    ent = context.ldap.conn.getEntry(base, scope, searchfilter, sattrs)
-
-    return convert_entry(ent)
-
-def get_base_entry (base, searchfilter, sattrs=None):
-    """Get a specific entry (with a scope of BASE).
-       Return as a dict of values.
-       Multi-valued fields are represented as lists.
-    """
-    return get_entry(base, ldap.SCOPE_BASE, searchfilter, sattrs)
-
-def get_sub_entry (base, searchfilter, sattrs=None):
-    """Get a specific entry (with a scope of SUB).
-       Return as a dict of values.
-       Multi-valued fields are represented as lists.
-    """
-    return get_entry(base, ldap.SCOPE_SUBTREE, searchfilter, sattrs)
-
-def get_one_entry (base, searchfilter, sattrs=None):
-    """Get the children of an entry (with a scope of ONE).
-       Return as a list of dict of values.
-       Multi-valued fields are represented as lists.
-    """
-    return get_list(base, searchfilter, sattrs, ldap.SCOPE_ONELEVEL)
-
-def get_list (base, searchfilter, sattrs=None, scope=ldap.SCOPE_SUBTREE):
-    """Gets a list of entries. Each is converted to a dict of values.
-       Multi-valued fields are represented as lists.
-    """
-    entries = []
-
-    entries = context.ldap.conn.getList(base, scope, searchfilter, sattrs)
-
-    return map(convert_entry, entries)
-
-def has_nsaccountlock(dn):
-    """Check to see if an entry has the nsaccountlock attribute.
-       This attribute is provided by the Class of Service plugin so
-       doing a search isn't enough. It is provided by the two
-       entries cn=inactivated and cn=activated. So if the entry has
-       the attribute and isn't in either cn=activated or cn=inactivated
-       then the attribute must be in the entry itself.
-
-       Returns True or False
-    """
-    # First get the entry. If it doesn't have nsaccountlock at all we
-    # can exit early.
-    entry = get_entry_by_dn(dn, ['dn', 'nsaccountlock', 'memberof'])
-    if not entry.get('nsaccountlock'):
-        return False
-
-    # Now look to see if they are in activated or inactivated
-    # entry is a member
-    memberof = entry.get('memberof')
-    if isinstance(memberof, basestring):
-        memberof = [memberof]
-    for m in memberof:
-        inactivated = m.find("cn=inactivated")
-        activated = m.find("cn=activated")
-        # if they are in either group that means that the nsaccountlock
-        # value comes from there, otherwise it must be in this entry.
-        if inactivated >= 0 or activated >= 0:
-            return False
-
-    return True
-
-# General searches
-
-def get_entry_by_dn (dn, sattrs=None):
-    """Get a specific entry. Return as a dict of values.
-       Multi-valued fields are represented as lists.
-    """
-    searchfilter = "(objectClass=*)"
-    api.log.info("IPA: get_entry_by_dn '%s'" % dn)
-    return get_base_entry(dn, searchfilter, sattrs)
-
-def get_entry_by_cn (cn, sattrs):
-    """Get a specific entry by cn. Return as a dict of values.
-       Multi-valued fields are represented as lists.
-    """
-    api.log.info("IPA: get_entry_by_cn '%s'" % cn)
-#    cn = self.__safe_filter(cn)
-    searchfilter = "(cn=%s)" % cn
-    return get_sub_entry("cn=accounts," + api.env.basedn, searchfilter, sattrs)
-
-# User support
-
-def entry_exists(dn):
-    """Return True if the entry exists, False otherwise."""
-    try:
-        get_base_entry(dn, "objectclass=*", ['dn','objectclass'])
-        return True
-    except errors.NotFound:
-        return False
-
-def get_user_by_uid (uid, sattrs):
-    """Get a specific user's entry. Return as a dict of values.
-       Multi-valued fields are represented as lists.
-    """
-
-    if not isinstance(uid,basestring) or len(uid) == 0:
-        raise SyntaxError("uid is not a string")
-#        raise ipaerror.gen_exception(ipaerror.INPUT_INVALID_PARAMETER)
-    if sattrs is not None and not isinstance(sattrs,list):
-        raise SyntaxError("sattrs is not a list")
-#        raise ipaerror.gen_exception(ipaerror.INPUT_INVALID_PARAMETER)
-    api.log.info("IPA: get_user_by_uid '%s'" % uid)
-#    uid = self.__safe_filter(uid)
-    searchfilter = "(uid=" + uid + ")"
-    return get_sub_entry("cn=accounts," + api.env.basedn, searchfilter, sattrs)
-
-def uid_too_long(uid):
-    """Verify that the new uid is within the limits we set. This is a
-       very narrow test.
-
-       Returns True if it is longer than allowed
-               False otherwise
-    """
-    if not isinstance(uid,basestring) or len(uid) == 0:
-        # It is bad, but not too long
-        return False
-    api.log.debug("IPA: __uid_too_long(%s)" % uid)
-    try:
-        config = get_ipa_config()
-        maxlen = int(config.get('ipamaxusernamelength', 0))
-        if maxlen > 0 and len(uid) > maxlen:
-            return True
-    except Exception, e:
-        api.log.debug("There was a problem " + str(e))
-        pass
-
-    return False
-
-def update_entry (entry, remove_keys=[]):
-    """Update an LDAP entry
-
-       entry is a dict
-       remove_keys is a list of attributes to remove from this entry
-
-       This refreshes the record from LDAP in order to obtain the list of
-       attributes that has changed. It only retrieves the attributes that
-       are in the update so attributes aren't inadvertantly lost.
-    """
-    assert type(remove_keys) is list
-    attrs = entry.keys()
-    o = get_base_entry(entry['dn'], "objectclass=*", attrs + remove_keys)
-    oldentry = convert_scalar_values(o)
-    newentry = convert_scalar_values(entry)
-
-    # Should be able to get this from either the old or new entry
-    # but just in case someone has decided to try changing it, use the
-    # original
-    try:
-        moddn = oldentry['dn']
-    except KeyError, e:
-        # FIXME: return a missing DN error message
-        raise e
-
-    return context.ldap.conn.updateEntry(moddn, oldentry, newentry)
-
-def add_entry(entry):
-    """Add a new entry"""
-    return context.ldap.conn.addEntry(entry)
-
-def delete_entry(dn):
-    """Remove an entry"""
-    return context.ldap.conn.deleteEntry(dn)
-
-# FIXME, get time and search limit from cn=ipaconfig
-def search(base, filter, attributes, timelimit=1, sizelimit=3000, scope=ldap.SCOPE_SUBTREE):
-    """Perform an LDAP query"""
-    try:
-        timelimit = float(timelimit)
-        results = context.ldap.conn.getListAsync(base, scope,
-            filter, attributes, 0, None, None, timelimit, sizelimit)
-    except ldap.NO_SUCH_OBJECT:
-        raise errors.NotFound(reason=filter)
-
-    counter = results[0]
-    entries = [counter]
-    for r in results[1:]:
-        entries.append(convert_entry(r))
-
-    return entries
-
-def uniq_list(x):
-    """Return a unique list, preserving order and ignoring case"""
-    myset = {}
-    return [myset.setdefault(e.lower(),e) for e in x if e.lower() not in myset]
-
-def get_schema():
-    """Retrieves the current LDAP schema from the LDAP server."""
-
-    schema_entry = get_base_entry("", "objectclass=*", ['dn','subschemasubentry'])
-    schema_cn = schema_entry.get('subschemasubentry')
-    schema = get_base_entry(schema_cn, "objectclass=*", ['*'])
-
-    return schema
-
-def get_objectclasses():
-    """Returns a list of available objectclasses that the LDAP
-       server supports. This parses out the syntax, attributes, etc
-       and JUST returns a lower-case list of the names."""
-
-    schema = get_schema()
-
-    objectclasses = schema.get('objectclasses')
-
-    # Convert this list into something more readable
-    result = []
-    for i in range(len(objectclasses)):
-        oc = objectclasses[i].lower().split(" ")
-        result.append(oc[3].replace("'",""))
-
-    return result
-
-def get_ipa_config():
-    """Retrieve the IPA configuration"""
-    searchfilter = "cn=ipaconfig"
-    try:
-        config = get_sub_entry("cn=etc," + api.env.basedn, searchfilter)
-    except ldap.NO_SUCH_OBJECT:
-        # FIXME
-        raise errors.NotFound(reason="IPA configuration cannot be loaded")
-
-    return config
-
-def modify_password(dn, oldpass, newpass):
-    return context.ldap.conn.modifyPassword(dn, oldpass, newpass)
-
-def mark_entry_active (dn):
-    """Mark an entry as active in LDAP."""
-
-    # This can be tricky. The entry itself can be marked inactive
-    # by being in the inactivated group. It can also be inactivated by
-    # being the member of an inactive group.
-    #
-    # First we try to remove the entry from the inactivated group. Then
-    # if it is still inactive we have to add it to the activated group
-    # which will override the group membership.
-
-    res = ""
-    # First, check the entry status
-    entry = get_entry_by_dn(dn, ['dn', 'nsAccountlock'])
-
-    if entry.get('nsaccountlock', 'false').lower() == "false":
-        api.log.debug("IPA: already active")
-        raise errors.AlreadyActive()
-
-    if has_nsaccountlock(dn):
-        api.log.debug("IPA: appears to have the nsaccountlock attribute")
-        raise errors.HasNSAccountLock()
-
-    group = get_entry_by_cn("inactivated", None)
-    try:
-        remove_member_from_group(entry.get('dn'), group.get('dn'))
-    except errors.NotGroupMember:
-        # Perhaps the user is there as a result of group membership
-        pass
-
-    # Now they aren't a member of inactivated directly, what is the status
-    # now?
-    entry = get_entry_by_dn(dn, ['dn', 'nsAccountlock'])
-
-    if entry.get('nsaccountlock', 'false').lower() == "false":
-        # great, we're done
-        api.log.debug("IPA: removing from inactivated did it.")
-        return True
-
-    # So still inactive, add them to activated
-    group = get_entry_by_cn("activated", None)
-    res = add_member_to_group(dn, group.get('dn'))
-    api.log.debug("IPA: added to activated.")
-
-    return res
-
-def mark_entry_inactive (dn):
-    """Mark an entry as inactive in LDAP."""
-
-    entry = get_entry_by_dn(dn, ['dn', 'nsAccountlock', 'memberOf'])
-
-    if entry.get('nsaccountlock', 'false').lower() == "true":
-        api.log.debug("IPA: already marked as inactive")
-        raise errors.AlreadyInactive()
-
-    if has_nsaccountlock(dn):
-        api.log.debug("IPA: appears to have the nsaccountlock attribute")
-        raise errors.HasNSAccountLock()
-
-    # First see if they are in the activated group as this will override
-    # the our inactivation.
-    group = get_entry_by_cn("activated", None)
-    try:
-        remove_member_from_group(dn, group.get('dn'))
-    except errors.NotGroupMember:
-        # this is fine, they may not be explicitly in this group
-        pass
-
-    # Now add them to inactivated
-    group = get_entry_by_cn("inactivated", None)
-    res = add_member_to_group(dn, group.get('dn'))
-
-    return res
-
-def add_member_to_group(member_dn, group_dn, memberattr='member'):
-    """
-    Add a member to an existing group.
-    """
-    api.log.info("IPA: add_member_to_group '%s' to '%s'" % (member_dn, group_dn))
-    if member_dn.lower() == group_dn.lower():
-        # You can't add a group to itself
-        raise errors.RecursiveGroup()
-
-    group = get_entry_by_dn(group_dn, None)
-    if group is None:
-        raise errors.NotFound(reason="cannot find group %s" % group_dn)
-
-    # check to make sure member_dn exists
-    member_entry = get_base_entry(member_dn, "(objectClass=*)", ['dn','objectclass'])
-    if not member_entry:
-        raise errors.NotFound(reason="cannot find member %s" % member_dn)
-
-    # Add the new member to the group member attribute
-    members = group.get(memberattr, [])
-    if isinstance(members, basestring):
-        members = [members]
-    members.append(member_dn)
-    group[memberattr] = members
-
-    return update_entry(group)
-
-def remove_member_from_group(member_dn, group_dn, memberattr='member'):
-    """Remove a member_dn from an existing group."""
-
-    group = get_entry_by_dn(group_dn, None)
-    if group is None:
-        raise errors.NotFound(reason="cannot find group %s" % group_dn)
-    """
-    if group.get('cn') == "admins":
-        member = get_entry_by_dn(member_dn, ['dn','uid'])
-        if member.get('uid') == "admin":
-            raise ipaerror.gen_exception(ipaerror.INPUT_ADMIN_REQUIRED_IN_ADMINS)
-    """
-    api.log.info("IPA: remove_member_from_group '%s' from '%s'" % (member_dn, group_dn))
-
-    members = group.get(memberattr, False)
-    if not members:
-        raise errors.NotGroupMember()
-
-    if isinstance(members,basestring):
-        members = [members]
-    for i in range(len(members)):
-        members[i] = ipaldap.IPAdmin.normalizeDN(members[i])
-    try:
-        members.remove(member_dn)
-    except ValueError:
-        raise errors.NotGroupMember()
-    except Exception, e:
-        raise e
-
-    group[memberattr] = members
-
-    return update_entry(group)