From 1967aafa3985fa87e02ae372164abe2524d9bd65 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Fri, 16 Nov 2007 12:59:32 -0500 Subject: Implement the password policy UI and finish IPA policy UI This includes a default password policy Custom fields are now read from LDAP. The format is a list of dicts with keys: label, field, required. The LDAP-based configuration now specifies: ipaUserSearchFields: uid,givenName,sn,telephoneNumber,ou,title ipaGroupSearchFields: cn,description ipaSearchTimeLimit: 2 ipaSearchRecordsLimit: 0 ipaCustomFields: ipaHomesRootDir: /home ipaDefaultLoginShell: /bin/sh ipaDefaultPrimaryGroup: ipausers ipaMaxUsernameLength: 8 ipaPwdExpAdvNotify: 4 This could use some optimization. --- ipa-python/rpcclient.py | 73 +++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 65 insertions(+), 8 deletions(-) (limited to 'ipa-python/rpcclient.py') diff --git a/ipa-python/rpcclient.py b/ipa-python/rpcclient.py index 871c3725..c4ca2ff3 100644 --- a/ipa-python/rpcclient.py +++ b/ipa-python/rpcclient.py @@ -218,23 +218,32 @@ class RPCClient: return ipautil.unwrap_binary_data(result) - def get_add_schema(self): - """Get the list of attributes we need to ask when adding a new - user. - """ + def get_custom_fields(self): + """Get custom user fields.""" server = self.setup_server() - # FIXME: Hardcoded and designed for the TurboGears GUI. Do we want - # this for the CLI as well? try: - result = server.get_add_schema() + result = server.get_custom_fields() except xmlrpclib.Fault, fault: raise ipaerror.gen_exception(fault.faultCode, fault.faultString) except socket.error, (value, msg): raise xmlrpclib.Fault(value, msg) return ipautil.unwrap_binary_data(result) - + + def set_custom_fields(self, schema): + """Set custom user fields.""" + server = self.setup_server() + + try: + result = server.set_custom_fields(schema) + except xmlrpclib.Fault, fault: + raise ipaerror.gen_exception(fault.faultCode, fault.faultString) + except socket.error, (value, msg): + raise xmlrpclib.Fault(value, msg) + + return ipautil.unwrap_binary_data(result) + def get_all_users (self): """Return a list containing a User object for each existing user.""" @@ -591,3 +600,51 @@ class RPCClient: raise xmlrpclib.Fault(value, msg) return ipautil.unwrap_binary_data(result) + + def get_ipa_config(self): + """Get the IPA configuration""" + server = self.setup_server() + try: + result = server.get_ipa_config() + except xmlrpclib.Fault, fault: + raise ipaerror.gen_exception(fault.faultCode, fault.faultString) + except socket.error, (value, msg): + raise xmlrpclib.Fault(value, msg) + + return ipautil.unwrap_binary_data(result) + + def update_ipa_config(self, oldconfig, newconfig): + """Update the IPA configuration""" + server = self.setup_server() + try: + result = server.update_ipa_config(oldconfig, newconfig) + except xmlrpclib.Fault, fault: + raise ipaerror.gen_exception(fault.faultCode, fault.faultString) + except socket.error, (value, msg): + raise xmlrpclib.Fault(value, msg) + + return ipautil.unwrap_binary_data(result) + + def get_password_policy(self): + """Get the IPA password policy""" + server = self.setup_server() + try: + result = server.get_password_policy() + except xmlrpclib.Fault, fault: + raise ipaerror.gen_exception(fault.faultCode, fault.faultString) + except socket.error, (value, msg): + raise xmlrpclib.Fault(value, msg) + + return ipautil.unwrap_binary_data(result) + + def update_password_policy(self, oldpolicy, newpolicy): + """Update the IPA password policy""" + server = self.setup_server() + try: + result = server.update_password_policy(oldpolicy, newpolicy) + except xmlrpclib.Fault, fault: + raise ipaerror.gen_exception(fault.faultCode, fault.faultString) + except socket.error, (value, msg): + raise xmlrpclib.Fault(value, msg) + + return ipautil.unwrap_binary_data(result) -- cgit From f42f1f44c81e15ac9ecbc6684cbc4dfc9395fd42 Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Tue, 20 Nov 2007 22:45:29 -0500 Subject: Enable group inactivation by using the Class of Service plugin. This adds 2 new groups: activated and inactivated. If you, or a group you are a member of, is in inactivated then you are too. If you, or a group you are a member of, is in the activated group, then you are too. In a fight between activated and inactivated, activated wins. The DNs for doing this matching is case and white space sensitive. The goal is to never have to actually set nsAccountLock in a user directly but move them between these groups. We need to decide where in the CLI this will happen. Right it is split between ipa-deluser and ipa-usermod. To inactivate groups for now just add the group to inactivate or active. --- ipa-python/rpcclient.py | 48 +++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 45 insertions(+), 3 deletions(-) (limited to 'ipa-python/rpcclient.py') diff --git a/ipa-python/rpcclient.py b/ipa-python/rpcclient.py index c4ca2ff3..d4c3dcc8 100644 --- a/ipa-python/rpcclient.py +++ b/ipa-python/rpcclient.py @@ -318,12 +318,12 @@ class RPCClient: return result - def mark_user_deleted(self,uid): - """Mark a user as deleted/inactive""" + def mark_user_active(self,uid): + """Mark a user as active""" server = self.setup_server() try: - result = server.mark_user_deleted(uid) + result = server.mark_user_active(uid) except xmlrpclib.Fault, fault: raise ipaerror.gen_exception(fault.faultCode, fault.faultString) except socket.error, (value, msg): @@ -331,6 +331,20 @@ class RPCClient: return ipautil.unwrap_binary_data(result) + def mark_user_inactive(self,uid): + """Mark a user as inactive""" + server = self.setup_server() + + try: + result = server.mark_user_inactive(uid) + except xmlrpclib.Fault, fault: + raise ipaerror.gen_exception(fault.faultCode, fault.faultString) + except socket.error, (value, msg): + raise xmlrpclib.Fault(value, msg) + + return ipautil.unwrap_binary_data(result) + + # Group support def get_groups_by_member(self,member_dn,sattrs=None): @@ -601,6 +615,34 @@ class RPCClient: return ipautil.unwrap_binary_data(result) + def mark_group_active(self,cn): + """Mark a group as active""" + server = self.setup_server() + + try: + result = server.mark_group_active(cn) + except xmlrpclib.Fault, fault: + raise ipaerror.gen_exception(fault.faultCode, fault.faultString) + except socket.error, (value, msg): + raise xmlrpclib.Fault(value, msg) + + return ipautil.unwrap_binary_data(result) + + def mark_group_inactive(self,cn): + """Mark a group as inactive""" + server = self.setup_server() + + try: + result = server.mark_group_inactive(cn) + except xmlrpclib.Fault, fault: + raise ipaerror.gen_exception(fault.faultCode, fault.faultString) + except socket.error, (value, msg): + raise xmlrpclib.Fault(value, msg) + + return ipautil.unwrap_binary_data(result) + +# Configuration support + def get_ipa_config(self): """Get the IPA configuration""" server = self.setup_server() -- cgit From edc7af1446af451ea5ed44420cceb05059a7b973 Mon Sep 17 00:00:00 2001 From: Karl MacMillan Date: Wed, 21 Nov 2007 23:28:25 -0500 Subject: Add xml-rpc interface for getting keytabs. Warning: this lacks any sort of authorization. --- ipa-python/rpcclient.py | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) (limited to 'ipa-python/rpcclient.py') diff --git a/ipa-python/rpcclient.py b/ipa-python/rpcclient.py index d4c3dcc8..d7ff9740 100644 --- a/ipa-python/rpcclient.py +++ b/ipa-python/rpcclient.py @@ -690,3 +690,27 @@ class RPCClient: raise xmlrpclib.Fault(value, msg) return ipautil.unwrap_binary_data(result) + + def add_service_principal(self, princ_name): + server = self.setup_server() + + try: + result = server.add_service_principal(princ_name) + except xmlrpclib.Fault, fault: + raise ipaerror.gen_exception(fault.faultCode, fault.faultString) + except socket.error, (value, msg): + raise xmlrpclib.Fault(value, msg) + + return ipautil.unwrap_binary_data(result) + + def get_keytab(self, princ_name): + server = self.setup_server() + + try: + result = server.get_keytab(princ_name) + except xmlrpclib.Fault, fault: + raise ipaerror.gen_exception(fault.faultCode, fault.faultString) + except socket.error, (value, msg): + raise xmlrpclib.Fault(value, msg) + + return ipautil.unwrap_binary_data(result) -- cgit