Enable group inactivation by using the Class of Service plugin.

This adds 2 new groups: activated and inactivated.

If you, or a group you are a member of, is in inactivated then you are too.

If you, or a group you are a member of, is in the activated group, then you
are too.

In a fight between activated and inactivated, activated wins.

The DNs for doing this matching is case and white space sensitive.

The goal is to never have to actually set nsAccountLock in a user directly
but move them between these groups.

We need to decide where in the CLI this will happen. Right it is split
between ipa-deluser and ipa-usermod. To inactivate groups for now just
add the group to inactivate or active.

1 files changed, 17 insertions, 9 deletions

diff --git a/ipa-server/ipa-gui/ipagui/subcontrollers/user.py b/ipa-server/ipa-gui/ipagui/subcontrollers/user.py
index 579379c4..39343b59 100644
--- a/ipa-server/ipa-gui/ipagui/subcontrollers/user.py
+++ b/ipa-server/ipa-gui/ipagui/subcontrollers/user.py
@@ -197,14 +197,14 @@ class UserController(IPAController):
             new_user.setValue('carlicense', kw.get('carlicense'))
             new_user.setValue('labeleduri', kw.get('labeleduri'))
 
-            if kw.get('nsAccountLock'):
-                new_user.setValue('nsAccountLock', 'true')
-
             for custom_field in user_new_form.custom_fields:
                 new_user.setValue(custom_field.name,
                                   kw.get(custom_field.name, ''))
 
             rv = client.add_user(new_user)
+
+            if kw.get('nsAccountLock'):
+                client.mark_user_inactive(kw.get('uid'))
         except ipaerror.exception_for(ipaerror.LDAP_DUPLICATE):
             turbogears.flash("User with login '%s' already exists" %
                     kw.get('uid'))
@@ -482,12 +482,6 @@ class UserController(IPAController):
             new_user.setValue('carlicense', kw.get('carlicense'))
             new_user.setValue('labeleduri', kw.get('labeleduri'))
 
-
-            if kw.get('nsAccountLock'):
-                new_user.setValue('nsAccountLock', 'true')
-            else:
-                new_user.setValue('nsAccountLock', None)
-
             if kw.get('editprotected') == 'true':
                 if kw.get('userpassword'):
                     password_change = True
@@ -572,6 +566,20 @@ class UserController(IPAController):
                         user_groups=user_groups_dicts,
                         tg_template='ipagui.templates.useredit')
 
+        if kw.get('nsAccountLock') == '':
+            kw['nsAccountLock'] = "false"
+
+        try:
+            if kw.get('nsAccountLock') == "false" and new_user.getValues('nsaccountlock') == "true":
+                client.mark_user_active(kw.get('uid'))
+            elif kw.get('nsAccountLock') == "true" and new_user.nsaccountlock != "true":
+                client.mark_user_inactive(kw.get('uid'))
+        except ipaerror.IPAError, e:
+            turbogears.flash("User status change failed: " + str(e) + "<br/>" + e.detail[0]['desc'])
+            return dict(form=user_edit_form, user=kw,
+                        user_groups=user_groups_dicts,
+                        tg_template='ipagui.templates.useredit')
+
         turbogears.flash("%s updated!" % kw['uid'])
         raise turbogears.redirect('/user/show', uid=kw['uid'])