diff options
Diffstat (limited to 'ipa-admintools/ipa-adddelegation')
| -rw-r--r-- | ipa-admintools/ipa-adddelegation | 201 |
1 files changed, 201 insertions, 0 deletions
diff --git a/ipa-admintools/ipa-adddelegation b/ipa-admintools/ipa-adddelegation new file mode 100644 index 00000000..4493390f --- /dev/null +++ b/ipa-admintools/ipa-adddelegation @@ -0,0 +1,201 @@ +#! /usr/bin/python -E +# Authors: Rob Crittenden <rcritten@redhat.com> +# +# Copyright (C) 2007 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation; version 2 only +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# +import sys +try: + from optparse import OptionParser + import ipa + import ipa.user + import ipa.ipaclient as ipaclient + import ipa.config + import ipa.aci + import ipa.ipaadminutil as ipaadminutil + import ipa.ipautil as ipautil + + import xmlrpclib + import kerberos + import krbV + import ldap + import errno + import socket +except ImportError: + print >> sys.stderr, """\ +There was a problem importing one of the required Python modules. The +error was: + + %s +""" % sys.exc_value + sys.exit(1) + +def parse_options(): + usage = "%prog -l|--list\n" + usage += "%prog -a|--attributes attr1,attr2,..,attrn -s|--source STRING -t|--target STRING [-v|--verbose] name" + parser = OptionParser(usage=usage, formatter=ipa.config.IPAFormatter()) + parser.add_option("-a", "--attributes", dest="attributes", + help="The attributes the source group may change in the target group") + parser.add_option("-s", "--source", dest="source", + help="The source group name") + parser.add_option("-t", "--target", dest="target", + help="The target group name") + parser.add_option("-l", "--list", dest="list", action="store_true", + help="List common attributes (this is not an exhaustive list)") + parser.add_option("-v", "--verbose", action="store_true", dest="verbose", + help="Verbose output of the XML-RPC connection") + + ipa.config.add_standard_options(parser) + options, args = parser.parse_args() + + if options.list: + ipa.config.verify_args(parser, args) + else: + ipa.config.verify_args(parser, args, "name") + if not options.attributes or not options.source or not options.target: + parser.error("need attributes and both source and target groups") + + ipa.config.init_config(options) + + return options, args + +def main(): + + options, args = parse_options() + + if options.list: + client = ipaclient.IPAClient(verbose=options.verbose) + l = client.get_all_attrs() + + for x in l: + print x + return 0 + + client = ipaclient.IPAClient(verbose=options.verbose) + + source_grp = client.find_groups(options.source) + counter = source_grp[0] + source_grp = source_grp[1:] + groupindex = -1 + if counter == 0: + print "No entries found for %s" % options.source + return 2 + elif counter == -1: + print "These results are truncated." + print "Please refine your search and try again." + return 3 + + if counter > 1: + print "\nMultiple entries for the source group found." + groupindex = ipaadminutil.select_group(counter, source_grp) + if groupindex == "q": + return 0 + + if groupindex >= 0: + source_grp = [source_grp[groupindex]] + + target_grp = client.find_groups(options.target) + counter = target_grp[0] + target_grp = target_grp[1:] + groupindex = -1 + if counter == 0: + print "No entries found for %s" % options.target + return 2 + elif counter == -1: + print "These results are truncated." + print "Please refine your search and try again." + return 3 + + if counter > 1: + print "\nMultiple entries for the target group found." + groupindex = ipaadminutil.select_group(counter, target_grp) + if groupindex == "q": + return 0 + + if groupindex >= 0: + target_grp = [target_grp[groupindex]] + + attr_list = options.attributes.split(',') + + new_aci = ipa.aci.ACI() + new_aci.name = args[0] + new_aci.source_group = source_grp[0].dn + new_aci.dest_group = target_grp[0].dn + new_aci.attrs = attr_list + + aci_entry = client.get_aci_entry(['*', 'aci']) + + # Look for an existing ACI of the same name + aci_str_list = aci_entry.getValues('aci') + if aci_str_list is None: + aci_str_list = [] + if not(isinstance(aci_str_list,list) or isinstance(aci_str_list,tuple)): + aci_str_list = [aci_str_list] + + for aci_str in aci_str_list: + try: + old_aci = ipa.aci.ACI(aci_str) + if old_aci.name == new_aci.name: + print "A delegation of that name already exists" + return 2 + except SyntaxError: + # ignore aci_str's that ACI can't parse + pass + + aci_entry = client.get_aci_entry(['dn']) + aci_entry.setValue('aci', new_aci.export_to_string()) + + client.update_entry(aci_entry) + + # Now add to the editors group so they can make changes in the UI + try: + group = client.get_entry_by_cn("editors") + client.add_group_to_group(new_aci.source_group, group.dn) + except ipa.ipaerror.exception_for(ipa.ipaerror.LDAP_EMPTY_MODLIST): + # This is ok, ignore it + pass + + print "Delegation %s successfully added" % args[0] + return 0 + +try: + if __name__ == "__main__": + sys.exit(main()) +except SystemExit, e: + sys.exit(e) +except KeyboardInterrupt, e: + sys.exit(1) +except xmlrpclib.Fault, fault: + if fault.faultCode == errno.ECONNREFUSED: + print "The IPA XML-RPC service is not responding." + else: + print fault.faultString + sys.exit(1) +except kerberos.GSSError, e: + print "Could not initialize GSSAPI: %s/%s" % (ipautil.get_gsserror(e)) + sys.exit(1) +except xmlrpclib.ProtocolError, e: + print "Unable to connect to IPA server: %s" % (e.errmsg) + sys.exit(1) +except ipa.ipaerror.IPAError, e: + print "%s" % (e.message) + sys.exit(1) +except socket.error, e: + print e[1] + print "Re-run with -v flag for more details." +except Exception, e: + print "%s" % str(e) + sys.exit(1) |