Add plugin framework to LDAP updates.

There are two reasons for the plugin framework:
1. To provide a way of doing manual/complex LDAP changes without having
   to keep extending ldapupdate.py (like we did with managed entries).
2. Allows for better control of restarts.

There are two types of plugins, preop and postop. A preop plugin runs
before any file-based updates are loaded. A postop plugin runs after
all file-based updates are applied.

A preop plugin may update LDAP directly or craft update entries to be
applied with the file-based updates.

Either a preop or postop plugin may attempt to restart the dirsrv instance.
The instance is only restartable if ipa-ldap-updater is being executed
as root. A warning is printed if a restart is requested for a non-root
user.

Plugins are not executed by default. This is so we can use ldapupdate
to apply simple updates in commands like ipa-nis-manage.

https://fedorahosted.org/freeipa/ticket/1789
https://fedorahosted.org/freeipa/ticket/1790
https://fedorahosted.org/freeipa/ticket/2032

3 files changed, 58 insertions, 5 deletions

diff --git a/ipalib/__init__.py b/ipalib/__init__.py
index 04896465..c54717bf 100644
--- a/ipalib/__init__.py
+++ b/ipalib/__init__.py
@@ -875,7 +875,7 @@ freeIPA.org:
 import os
 import plugable
 from backend import Backend
-from frontend import Command, LocalOrRemote
+from frontend import Command, LocalOrRemote, Updater
 from frontend import Object, Method, Property
 from crud import Create, Retrieve, Update, Delete, Search
 from parameters import DefaultFrom, Bool, Flag, Int, Float, Bytes, Str, IA5Str, Password,List
@@ -907,7 +907,7 @@ def create_api(mode='dummy'):
 
         - `backend.Backend`
     """
-    api = plugable.API(Command, Object, Method, Property, Backend)
+    api = plugable.API(Command, Object, Method, Property, Backend, Updater)
     if mode is not None:
         api.env.mode = mode
     assert mode != 'production'
diff --git a/ipalib/frontend.py b/ipalib/frontend.py
index 3dc30dae..2ab457c3 100644
--- a/ipalib/frontend.py
+++ b/ipalib/frontend.py
@@ -30,7 +30,7 @@ from util import make_repr
 from output import Output, Entry, ListOfEntries
 from text import _, ngettext
 
-from errors import ZeroArgumentError, MaxArgumentError, OverlapError, RequiresRoot, VersionError, RequirementError
+from errors import ZeroArgumentError, MaxArgumentError, OverlapError, RequiresRoot, VersionError, RequirementError, ValidationError
 from errors import InvocationError
 from constants import TYPE_ERROR
 from ipapython.version import API_VERSION
@@ -557,7 +557,11 @@ class Command(HasParam):
                 # None means "delete this attribute"
                 value = None
             if attr in self.params:
-                value = self.params[attr](value)
+                try:
+                    value = self.params[attr](value)
+                except ValidationError, err:
+                    (name, error) = str(err.strerror).split(':')
+                    raise ValidationError(name=attr, error=error)
             if append and attr in newdict:
                 if type(value) in (tuple,):
                     newdict[attr] += list(value)
@@ -1334,3 +1338,39 @@ class Property(Attribute):
                 attr = getattr(self, name)
                 if is_rule(attr):
                     yield attr
+
+class Updater(Method):
+    """
+    An LDAP update with an associated object (always update).
+
+    All plugins that subclass from `Updater` will be automatically available
+    as a server update function.
+
+    Plugins that subclass from Updater are registered in the ``api.Updater``
+    namespace. For example:
+
+    >>> from ipalib import create_api
+    >>> api = create_api()
+    >>> class my(Object):
+    ...     pass
+    ...
+    >>> api.register(my)
+    >>> class my_update(Updater):
+    ...     pass
+    ...
+    >>> api.register(my_update)
+    >>> api.finalize()
+    >>> list(api.Updater)
+    ['my_update']
+    >>> api.Updater.my_update # doctest:+ELLIPSIS
+    ipalib.frontend.my_update()
+    """
+    def __init__(self):
+        super(Updater, self).__init__()
+
+    def __call__(self, **options):
+        self.debug(
+            'raw: %s', self.name
+        )
+
+        return self.execute(**options)
diff --git a/ipalib/plugable.py b/ipalib/plugable.py
index d8b07c1e..2da361e5 100644
--- a/ipalib/plugable.py
+++ b/ipalib/plugable.py
@@ -594,16 +594,29 @@ class API(DictProxy):
         self.import_plugins('ipalib')
         if self.env.in_server:
             self.import_plugins('ipaserver')
+        if self.env.context in ('installer', 'updates'):
+            self.import_plugins('ipaserver/install/plugins')
 
     # FIXME: This method has no unit test
     def import_plugins(self, package):
         """
         Import modules in ``plugins`` sub-package of ``package``.
         """
+        package = package.replace(os.path.sep, '.')
         subpackage = '%s.plugins' % package
         try:
             parent = __import__(package)
-            plugins = __import__(subpackage).plugins
+            parts = package.split('.')[1:]
+            if parts:
+                for part in parts:
+                    if part == 'plugins':
+                        plugins = subpackage.plugins
+                        subpackage = plugins.__name__
+                        break
+                    subpackage = parent.__getattribute__(part)
+                    parent = subpackage
+            else:
+                plugins = __import__(subpackage).plugins
         except ImportError, e:
             self.log.error(
                 'cannot import plugins sub-package %s: %s', subpackage, e