From 65a146cdca7c62301b5be978027a44d880424529 Mon Sep 17 00:00:00 2001 From: Martin Kosek Date: Fri, 21 Jan 2011 09:20:01 +0100 Subject: ACI plugin supports prefixes When more than one plugin produce ACIs, they share common namespace of ACI name. This may lead to name collisions between the ACIs from different plugins. This patch introduces a mandatory "prefix" attribute for non-find ACI operations which allow plugins to use their own prefixes (i.e. namespaces) which is then used when a name of the ACI is generated. Permission, Delegation and Selfservice plugins has been updated to use their own prefixes thus avoiding name collisions by using their own namespaces. Default ACIs in LDIFs has been updated to follow this new policy. Permission plugin now uses its CN (=primary key) instead of description in ACI names as Description may not be unique. This change requires an IPA server reinstall since the default ACI set has been changed. https://fedorahosted.org/freeipa/ticket/764 --- ipalib/plugins/delegation.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'ipalib/plugins/delegation.py') diff --git a/ipalib/plugins/delegation.py b/ipalib/plugins/delegation.py index 19d4c6da..d5ff08a8 100644 --- a/ipalib/plugins/delegation.py +++ b/ipalib/plugins/delegation.py @@ -50,6 +50,8 @@ from ipalib import api, crud, errors from ipalib import output from ipalib import Object, Command +ACI_PREFIX=u"delegation" + def convert_delegation(ldap, aci): """ memberOf is in filter but we want to pull out the group for easier @@ -70,6 +72,7 @@ def convert_delegation(ldap, aci): aci['membergroup'] = entry_attrs['cn'] del aci['filter'] + del aci['aciprefix'] # do not include prefix in result return aci @@ -81,7 +84,7 @@ def is_delegation(ldap, aciname): Return the result if it is a delegation ACI, adding a new attribute membergroup. """ - result = api.Command['aci_show'](aciname)['result'] + result = api.Command['aci_show'](aciname, aciprefix=ACI_PREFIX)['result'] if 'filter' in result: result = convert_delegation(ldap, result) else: @@ -157,6 +160,7 @@ class delegation_add(crud.Create): ldap = self.api.Backend.ldap2 if not 'permissions' in kw: kw['permissions'] = (u'write',) + kw['aciprefix'] = ACI_PREFIX result = api.Command['aci_add'](aciname, **kw)['result'] if 'filter' in result: result = convert_delegation(ldap, result) @@ -180,6 +184,7 @@ class delegation_del(crud.Delete): def execute(self, aciname, **kw): ldap = self.api.Backend.ldap2 is_delegation(ldap, aciname) + kw['aciprefix'] = ACI_PREFIX result = api.Command['aci_del'](aciname, **kw) return dict( result=True, @@ -199,6 +204,7 @@ class delegation_mod(crud.Update): def execute(self, aciname, **kw): ldap = self.api.Backend.ldap2 is_delegation(ldap, aciname) + kw['aciprefix'] = ACI_PREFIX result = api.Command['aci_mod'](aciname, **kw)['result'] if 'filter' in result: result = convert_delegation(ldap, result) @@ -221,6 +227,7 @@ class delegation_find(crud.Search): def execute(self, term, **kw): ldap = self.api.Backend.ldap2 + kw['aciprefix'] = ACI_PREFIX acis = api.Command['aci_find'](term, **kw)['result'] results = [] for aci in acis: -- cgit