From 7486ead6c910d13ae4d7cbae6fae738ce2bf47eb Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Tue, 26 Oct 2010 14:31:00 -0400 Subject: Don't allow managed groups to have group password policy. UPG cannot have members and we use memberOf in class of service to determine which policy to apply. ticket 160 --- ipalib/plugins/pwpolicy.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'ipalib/plugins/pwpolicy.py') diff --git a/ipalib/plugins/pwpolicy.py b/ipalib/plugins/pwpolicy.py index 5e81631f..89347361 100644 --- a/ipalib/plugins/pwpolicy.py +++ b/ipalib/plugins/pwpolicy.py @@ -115,7 +115,10 @@ class cosentry_add(LDAPCreate): def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options): # check for existence of the group - self.api.Command.group_show(keys[-1]) + result = self.api.Command.group_show(keys[-1], all=True)['result'] + oc = map(lambda x:x.lower(),result['objectclass']) + if 'mepmanagedentry' in oc: + raise errors.ManagedPolicyError() self.obj.check_priority_uniqueness(*keys, **options) del entry_attrs['cn'] return dn -- cgit