summaryrefslogtreecommitdiffstats
path: root/ipaclient/remote_plugins/2_156/trust.py
diff options
context:
space:
mode:
Diffstat (limited to 'ipaclient/remote_plugins/2_156/trust.py')
-rw-r--r--ipaclient/remote_plugins/2_156/trust.py1264
1 files changed, 1264 insertions, 0 deletions
diff --git a/ipaclient/remote_plugins/2_156/trust.py b/ipaclient/remote_plugins/2_156/trust.py
new file mode 100644
index 000000000..369ffcd18
--- /dev/null
+++ b/ipaclient/remote_plugins/2_156/trust.py
@@ -0,0 +1,1264 @@
+#
+# Copyright (C) 2016 FreeIPA Contributors see COPYING for license
+#
+
+# pylint: disable=unused-import
+import six
+
+from . import Command, Method, Object
+from ipalib import api, parameters, output
+from ipalib.parameters import DefaultFrom
+from ipalib.plugable import Registry
+from ipalib.text import _
+from ipapython.dn import DN
+from ipapython.dnsutil import DNSName
+
+if six.PY3:
+ unicode = str
+
+__doc__ = _("""
+Cross-realm trusts
+
+Manage trust relationship between IPA and Active Directory domains.
+
+In order to allow users from a remote domain to access resources in IPA
+domain, trust relationship needs to be established. Currently IPA supports
+only trusts between IPA and Active Directory domains under control of Windows
+Server 2008 or later, with functional level 2008 or later.
+
+Please note that DNS on both IPA and Active Directory domain sides should be
+configured properly to discover each other. Trust relationship relies on
+ability to discover special resources in the other domain via DNS records.
+
+Examples:
+
+1. Establish cross-realm trust with Active Directory using AD administrator
+ credentials:
+
+ ipa trust-add --type=ad <ad.domain> --admin <AD domain administrator> --password
+
+2. List all existing trust relationships:
+
+ ipa trust-find
+
+3. Show details of the specific trust relationship:
+
+ ipa trust-show <ad.domain>
+
+4. Delete existing trust relationship:
+
+ ipa trust-del <ad.domain>
+
+Once trust relationship is established, remote users will need to be mapped
+to local POSIX groups in order to actually use IPA resources. The mapping should
+be done via use of external membership of non-POSIX group and then this group
+should be included into one of local POSIX groups.
+
+Example:
+
+1. Create group for the trusted domain admins' mapping and their local POSIX group:
+
+ ipa group-add --desc='<ad.domain> admins external map' ad_admins_external --external
+ ipa group-add --desc='<ad.domain> admins' ad_admins
+
+2. Add security identifier of Domain Admins of the <ad.domain> to the ad_admins_external
+ group:
+
+ ipa group-add-member ad_admins_external --external 'AD\Domain Admins'
+
+3. Allow members of ad_admins_external group to be associated with ad_admins POSIX group:
+
+ ipa group-add-member ad_admins --groups ad_admins_external
+
+4. List members of external members of ad_admins_external group to see their SIDs:
+
+ ipa group-show ad_admins_external
+
+
+GLOBAL TRUST CONFIGURATION
+
+When IPA AD trust subpackage is installed and ipa-adtrust-install is run,
+a local domain configuration (SID, GUID, NetBIOS name) is generated. These
+identifiers are then used when communicating with a trusted domain of the
+particular type.
+
+1. Show global trust configuration for Active Directory type of trusts:
+
+ ipa trustconfig-show --type ad
+
+2. Modify global configuration for all trusts of Active Directory type and set
+ a different fallback primary group (fallback primary group GID is used as
+ a primary user GID if user authenticating to IPA domain does not have any other
+ primary GID already set):
+
+ ipa trustconfig-mod --type ad --fallback-primary-group "alternative AD group"
+
+3. Change primary fallback group back to default hidden group (any group with
+ posixGroup object class is allowed):
+
+ ipa trustconfig-mod --type ad --fallback-primary-group "Default SMB Group"
+""")
+
+register = Registry()
+
+
+@register()
+class trust(Object):
+ takes_params = (
+ parameters.Str(
+ 'cn',
+ primary_key=True,
+ label=_(u'Realm name'),
+ ),
+ parameters.Str(
+ 'ipantflatname',
+ label=_(u'Domain NetBIOS name'),
+ ),
+ parameters.Str(
+ 'ipanttrusteddomainsid',
+ label=_(u'Domain Security Identifier'),
+ ),
+ parameters.Str(
+ 'ipantsidblacklistincoming',
+ required=False,
+ multivalue=True,
+ label=_(u'SID blacklist incoming'),
+ ),
+ parameters.Str(
+ 'ipantsidblacklistoutgoing',
+ required=False,
+ multivalue=True,
+ label=_(u'SID blacklist outgoing'),
+ ),
+ )
+
+
+@register()
+class trustconfig(Object):
+ takes_params = (
+ parameters.Str(
+ 'cn',
+ label=_(u'Domain'),
+ ),
+ parameters.Str(
+ 'ipantsecurityidentifier',
+ label=_(u'Security Identifier'),
+ ),
+ parameters.Str(
+ 'ipantflatname',
+ label=_(u'NetBIOS name'),
+ ),
+ parameters.Str(
+ 'ipantdomainguid',
+ label=_(u'Domain GUID'),
+ ),
+ parameters.Str(
+ 'ipantfallbackprimarygroup',
+ label=_(u'Fallback primary group'),
+ ),
+ )
+
+
+@register()
+class trustdomain(Object):
+ takes_params = (
+ parameters.Str(
+ 'cn',
+ primary_key=True,
+ label=_(u'Domain name'),
+ ),
+ parameters.Str(
+ 'ipantflatname',
+ required=False,
+ label=_(u'Domain NetBIOS name'),
+ ),
+ parameters.Str(
+ 'ipanttrusteddomainsid',
+ required=False,
+ label=_(u'Domain Security Identifier'),
+ ),
+ parameters.Str(
+ 'ipanttrustpartner',
+ required=False,
+ label=_(u'Trusted domain partner'),
+ ),
+ )
+
+
+@register()
+class adtrust_is_enabled(Command):
+ __doc__ = _("Determine whether ipa-adtrust-install has been run on this system")
+
+ NO_CLI = True
+
+ takes_options = (
+ )
+ has_output = (
+ output.Output(
+ 'result',
+ ),
+ )
+
+
+@register()
+class compat_is_enabled(Command):
+ __doc__ = _("Determine whether Schema Compatibility plugin is configured to serve trusted domain users and groups")
+
+ NO_CLI = True
+
+ takes_options = (
+ )
+ has_output = (
+ output.Output(
+ 'result',
+ ),
+ )
+
+
+@register()
+class sidgen_was_run(Command):
+ __doc__ = _("Determine whether ipa-adtrust-install has been run with sidgen task")
+
+ NO_CLI = True
+
+ takes_options = (
+ )
+ has_output = (
+ output.Output(
+ 'result',
+ ),
+ )
+
+
+@register()
+class trust_add(Method):
+ __doc__ = _("""
+Add new trust to use.
+
+This command establishes trust relationship to another domain
+which becomes 'trusted'. As result, users of the trusted domain
+may access resources of this domain.
+
+Only trusts to Active Directory domains are supported right now.
+
+The command can be safely run multiple times against the same domain,
+this will cause change to trust relationship credentials on both
+sides.
+ """)
+
+ takes_args = (
+ parameters.Str(
+ 'cn',
+ cli_name='realm',
+ label=_(u'Realm name'),
+ ),
+ )
+ takes_options = (
+ parameters.Str(
+ 'setattr',
+ required=False,
+ multivalue=True,
+ doc=_(u'Set an attribute to a name/value pair. Format is attr=value.\nFor multi-valued attributes, the command replaces the values already present.'),
+ exclude=('webui',),
+ ),
+ parameters.Str(
+ 'addattr',
+ required=False,
+ multivalue=True,
+ doc=_(u'Add an attribute/value pair. Format is attr=value. The attribute\nmust be part of the schema.'),
+ exclude=('webui',),
+ ),
+ parameters.Str(
+ 'trust_type',
+ cli_name='type',
+ cli_metavar="['ad']",
+ label=_(u'Trust type (ad for Active Directory, default)'),
+ default=u'ad',
+ autofill=True,
+ ),
+ parameters.Str(
+ 'realm_admin',
+ required=False,
+ cli_name='admin',
+ label=_(u'Active Directory domain administrator'),
+ ),
+ parameters.Password(
+ 'realm_passwd',
+ required=False,
+ cli_name='password',
+ label=_(u"Active Directory domain administrator's password"),
+ ),
+ parameters.Str(
+ 'realm_server',
+ required=False,
+ cli_name='server',
+ label=_(u'Domain controller for the Active Directory domain (optional)'),
+ ),
+ parameters.Password(
+ 'trust_secret',
+ required=False,
+ label=_(u'Shared secret for the trust'),
+ ),
+ parameters.Int(
+ 'base_id',
+ required=False,
+ label=_(u'First Posix ID of the range reserved for the trusted domain'),
+ ),
+ parameters.Int(
+ 'range_size',
+ required=False,
+ label=_(u'Size of the ID range reserved for the trusted domain'),
+ ),
+ parameters.Str(
+ 'range_type',
+ required=False,
+ cli_metavar="['ipa-ad-trust-posix', 'ipa-ad-trust']",
+ label=_(u'Range type'),
+ doc=_(u'Type of trusted domain ID range, one of ipa-ad-trust-posix, ipa-ad-trust'),
+ ),
+ parameters.Bool(
+ 'bidirectional',
+ required=False,
+ cli_name='two_way',
+ label=_(u'Two-way trust'),
+ doc=_(u'Establish bi-directional trust. By default trust is inbound one-way only.'),
+ default=False,
+ ),
+ parameters.Flag(
+ 'all',
+ doc=_(u'Retrieve and print all attributes from the server. Affects command output.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'raw',
+ doc=_(u'Print entries as stored on the server. Only affects output format.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ )
+ has_output = (
+ output.Output(
+ 'summary',
+ (unicode, type(None)),
+ doc=_(u'User-friendly description of action performed'),
+ ),
+ output.Entry(
+ 'result',
+ ),
+ output.PrimaryKey(
+ 'value',
+ doc=_(u"The primary_key value of the entry, e.g. 'jdoe' for a user"),
+ ),
+ )
+
+
+@register()
+class trust_del(Method):
+ __doc__ = _("Delete a trust.")
+
+ takes_args = (
+ parameters.Str(
+ 'cn',
+ multivalue=True,
+ cli_name='realm',
+ label=_(u'Realm name'),
+ ),
+ )
+ takes_options = (
+ parameters.Flag(
+ 'continue',
+ doc=_(u"Continuous mode: Don't stop on errors."),
+ default=False,
+ autofill=True,
+ ),
+ )
+ has_output = (
+ output.Output(
+ 'summary',
+ (unicode, type(None)),
+ doc=_(u'User-friendly description of action performed'),
+ ),
+ output.Output(
+ 'result',
+ dict,
+ doc=_(u'List of deletions that failed'),
+ ),
+ output.ListOfPrimaryKeys(
+ 'value',
+ ),
+ )
+
+
+@register()
+class trust_fetch_domains(Method):
+ __doc__ = _("Refresh list of the domains associated with the trust")
+
+ takes_args = (
+ parameters.Str(
+ 'cn',
+ cli_name='realm',
+ label=_(u'Realm name'),
+ ),
+ )
+ takes_options = (
+ parameters.Flag(
+ 'rights',
+ label=_(u'Rights'),
+ doc=_(u'Display the access rights of this entry (requires --all). See ipa man page for details.'),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Str(
+ 'realm_server',
+ required=False,
+ cli_name='server',
+ label=_(u'Domain controller for the Active Directory domain (optional)'),
+ ),
+ parameters.Flag(
+ 'all',
+ doc=_(u'Retrieve and print all attributes from the server. Affects command output.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'raw',
+ doc=_(u'Print entries as stored on the server. Only affects output format.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ )
+ has_output = (
+ output.Output(
+ 'summary',
+ (unicode, type(None)),
+ doc=_(u'User-friendly description of action performed'),
+ ),
+ output.ListOfEntries(
+ 'result',
+ ),
+ output.Output(
+ 'count',
+ int,
+ doc=_(u'Number of entries returned'),
+ ),
+ output.Output(
+ 'truncated',
+ bool,
+ doc=_(u'True if not all results were returned'),
+ ),
+ )
+
+
+@register()
+class trust_find(Method):
+ __doc__ = _("Search for trusts.")
+
+ takes_args = (
+ parameters.Str(
+ 'criteria',
+ required=False,
+ doc=_(u'A string searched in all relevant object attributes'),
+ ),
+ )
+ takes_options = (
+ parameters.Str(
+ 'cn',
+ required=False,
+ cli_name='realm',
+ label=_(u'Realm name'),
+ ),
+ parameters.Str(
+ 'ipantflatname',
+ required=False,
+ cli_name='flat_name',
+ label=_(u'Domain NetBIOS name'),
+ ),
+ parameters.Str(
+ 'ipanttrusteddomainsid',
+ required=False,
+ cli_name='sid',
+ label=_(u'Domain Security Identifier'),
+ ),
+ parameters.Str(
+ 'ipantsidblacklistincoming',
+ required=False,
+ multivalue=True,
+ cli_name='sid_blacklist_incoming',
+ label=_(u'SID blacklist incoming'),
+ ),
+ parameters.Str(
+ 'ipantsidblacklistoutgoing',
+ required=False,
+ multivalue=True,
+ cli_name='sid_blacklist_outgoing',
+ label=_(u'SID blacklist outgoing'),
+ ),
+ parameters.Int(
+ 'timelimit',
+ required=False,
+ label=_(u'Time Limit'),
+ doc=_(u'Time limit of search in seconds (0 is unlimited)'),
+ ),
+ parameters.Int(
+ 'sizelimit',
+ required=False,
+ label=_(u'Size Limit'),
+ doc=_(u'Maximum number of entries returned (0 is unlimited)'),
+ ),
+ parameters.Flag(
+ 'all',
+ doc=_(u'Retrieve and print all attributes from the server. Affects command output.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'raw',
+ doc=_(u'Print entries as stored on the server. Only affects output format.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'pkey_only',
+ required=False,
+ label=_(u'Primary key only'),
+ doc=_(u'Results should contain primary key attribute only ("realm")'),
+ default=False,
+ autofill=True,
+ ),
+ )
+ has_output = (
+ output.Output(
+ 'summary',
+ (unicode, type(None)),
+ doc=_(u'User-friendly description of action performed'),
+ ),
+ output.ListOfEntries(
+ 'result',
+ ),
+ output.Output(
+ 'count',
+ int,
+ doc=_(u'Number of entries returned'),
+ ),
+ output.Output(
+ 'truncated',
+ bool,
+ doc=_(u'True if not all results were returned'),
+ ),
+ )
+
+
+@register()
+class trust_mod(Method):
+ __doc__ = _("""
+Modify a trust (for future use).
+
+ Currently only the default option to modify the LDAP attributes is
+ available. More specific options will be added in coming releases.
+ """)
+
+ takes_args = (
+ parameters.Str(
+ 'cn',
+ cli_name='realm',
+ label=_(u'Realm name'),
+ ),
+ )
+ takes_options = (
+ parameters.Str(
+ 'ipantsidblacklistincoming',
+ required=False,
+ multivalue=True,
+ cli_name='sid_blacklist_incoming',
+ label=_(u'SID blacklist incoming'),
+ ),
+ parameters.Str(
+ 'ipantsidblacklistoutgoing',
+ required=False,
+ multivalue=True,
+ cli_name='sid_blacklist_outgoing',
+ label=_(u'SID blacklist outgoing'),
+ ),
+ parameters.Str(
+ 'setattr',
+ required=False,
+ multivalue=True,
+ doc=_(u'Set an attribute to a name/value pair. Format is attr=value.\nFor multi-valued attributes, the command replaces the values already present.'),
+ exclude=('webui',),
+ ),
+ parameters.Str(
+ 'addattr',
+ required=False,
+ multivalue=True,
+ doc=_(u'Add an attribute/value pair. Format is attr=value. The attribute\nmust be part of the schema.'),
+ exclude=('webui',),
+ ),
+ parameters.Str(
+ 'delattr',
+ required=False,
+ multivalue=True,
+ doc=_(u'Delete an attribute/value pair. The option will be evaluated\nlast, after all sets and adds.'),
+ exclude=('webui',),
+ ),
+ parameters.Flag(
+ 'rights',
+ label=_(u'Rights'),
+ doc=_(u'Display the access rights of this entry (requires --all). See ipa man page for details.'),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'all',
+ doc=_(u'Retrieve and print all attributes from the server. Affects command output.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'raw',
+ doc=_(u'Print entries as stored on the server. Only affects output format.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ )
+ has_output = (
+ output.Output(
+ 'summary',
+ (unicode, type(None)),
+ doc=_(u'User-friendly description of action performed'),
+ ),
+ output.Entry(
+ 'result',
+ ),
+ output.PrimaryKey(
+ 'value',
+ doc=_(u"The primary_key value of the entry, e.g. 'jdoe' for a user"),
+ ),
+ )
+
+
+@register()
+class trust_resolve(Command):
+ __doc__ = _("Resolve security identifiers of users and groups in trusted domains")
+
+ NO_CLI = True
+
+ takes_options = (
+ parameters.Str(
+ 'sids',
+ multivalue=True,
+ label=_(u'Security Identifiers (SIDs)'),
+ ),
+ parameters.Flag(
+ 'all',
+ doc=_(u'Retrieve and print all attributes from the server. Affects command output.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'raw',
+ doc=_(u'Print entries as stored on the server. Only affects output format.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ )
+ has_output = (
+ output.ListOfEntries(
+ 'result',
+ ),
+ )
+
+
+@register()
+class trust_show(Method):
+ __doc__ = _("Display information about a trust.")
+
+ takes_args = (
+ parameters.Str(
+ 'cn',
+ cli_name='realm',
+ label=_(u'Realm name'),
+ ),
+ )
+ takes_options = (
+ parameters.Flag(
+ 'rights',
+ label=_(u'Rights'),
+ doc=_(u'Display the access rights of this entry (requires --all). See ipa man page for details.'),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'all',
+ doc=_(u'Retrieve and print all attributes from the server. Affects command output.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'raw',
+ doc=_(u'Print entries as stored on the server. Only affects output format.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ )
+ has_output = (
+ output.Output(
+ 'summary',
+ (unicode, type(None)),
+ doc=_(u'User-friendly description of action performed'),
+ ),
+ output.Entry(
+ 'result',
+ ),
+ output.PrimaryKey(
+ 'value',
+ doc=_(u"The primary_key value of the entry, e.g. 'jdoe' for a user"),
+ ),
+ )
+
+
+@register()
+class trustconfig_mod(Method):
+ __doc__ = _("Modify global trust configuration.")
+
+ takes_options = (
+ parameters.Str(
+ 'ipantfallbackprimarygroup',
+ required=False,
+ cli_name='fallback_primary_group',
+ label=_(u'Fallback primary group'),
+ ),
+ parameters.Str(
+ 'setattr',
+ required=False,
+ multivalue=True,
+ doc=_(u'Set an attribute to a name/value pair. Format is attr=value.\nFor multi-valued attributes, the command replaces the values already present.'),
+ exclude=('webui',),
+ ),
+ parameters.Str(
+ 'addattr',
+ required=False,
+ multivalue=True,
+ doc=_(u'Add an attribute/value pair. Format is attr=value. The attribute\nmust be part of the schema.'),
+ exclude=('webui',),
+ ),
+ parameters.Str(
+ 'delattr',
+ required=False,
+ multivalue=True,
+ doc=_(u'Delete an attribute/value pair. The option will be evaluated\nlast, after all sets and adds.'),
+ exclude=('webui',),
+ ),
+ parameters.Flag(
+ 'rights',
+ label=_(u'Rights'),
+ doc=_(u'Display the access rights of this entry (requires --all). See ipa man page for details.'),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Str(
+ 'trust_type',
+ cli_name='type',
+ cli_metavar="['ad']",
+ label=_(u'Trust type (ad for Active Directory, default)'),
+ default=u'ad',
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'all',
+ doc=_(u'Retrieve and print all attributes from the server. Affects command output.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'raw',
+ doc=_(u'Print entries as stored on the server. Only affects output format.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ )
+ has_output = (
+ output.Output(
+ 'summary',
+ (unicode, type(None)),
+ doc=_(u'User-friendly description of action performed'),
+ ),
+ output.Entry(
+ 'result',
+ ),
+ output.PrimaryKey(
+ 'value',
+ doc=_(u"The primary_key value of the entry, e.g. 'jdoe' for a user"),
+ ),
+ )
+
+
+@register()
+class trustconfig_show(Method):
+ __doc__ = _("Show global trust configuration.")
+
+ takes_options = (
+ parameters.Flag(
+ 'rights',
+ label=_(u'Rights'),
+ doc=_(u'Display the access rights of this entry (requires --all). See ipa man page for details.'),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Str(
+ 'trust_type',
+ cli_name='type',
+ cli_metavar="['ad']",
+ label=_(u'Trust type (ad for Active Directory, default)'),
+ default=u'ad',
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'all',
+ doc=_(u'Retrieve and print all attributes from the server. Affects command output.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'raw',
+ doc=_(u'Print entries as stored on the server. Only affects output format.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ )
+ has_output = (
+ output.Output(
+ 'summary',
+ (unicode, type(None)),
+ doc=_(u'User-friendly description of action performed'),
+ ),
+ output.Entry(
+ 'result',
+ ),
+ output.PrimaryKey(
+ 'value',
+ doc=_(u"The primary_key value of the entry, e.g. 'jdoe' for a user"),
+ ),
+ )
+
+
+@register()
+class trustdomain_add(Method):
+ __doc__ = _("Allow access from the trusted domain")
+
+ NO_CLI = True
+
+ takes_args = (
+ parameters.Str(
+ 'trustcn',
+ cli_name='trust',
+ label=_(u'Realm name'),
+ ),
+ parameters.Str(
+ 'cn',
+ cli_name='domain',
+ label=_(u'Domain name'),
+ ),
+ )
+ takes_options = (
+ parameters.Str(
+ 'ipantflatname',
+ required=False,
+ cli_name='flat_name',
+ label=_(u'Domain NetBIOS name'),
+ ),
+ parameters.Str(
+ 'ipanttrusteddomainsid',
+ required=False,
+ cli_name='sid',
+ label=_(u'Domain Security Identifier'),
+ ),
+ parameters.Str(
+ 'ipanttrustpartner',
+ required=False,
+ label=_(u'Trusted domain partner'),
+ exclude=('cli', 'webui'),
+ ),
+ parameters.Str(
+ 'setattr',
+ required=False,
+ multivalue=True,
+ doc=_(u'Set an attribute to a name/value pair. Format is attr=value.\nFor multi-valued attributes, the command replaces the values already present.'),
+ exclude=('webui',),
+ ),
+ parameters.Str(
+ 'addattr',
+ required=False,
+ multivalue=True,
+ doc=_(u'Add an attribute/value pair. Format is attr=value. The attribute\nmust be part of the schema.'),
+ exclude=('webui',),
+ ),
+ parameters.Str(
+ 'trust_type',
+ cli_name='type',
+ cli_metavar="['ad']",
+ label=_(u'Trust type (ad for Active Directory, default)'),
+ default=u'ad',
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'all',
+ doc=_(u'Retrieve and print all attributes from the server. Affects command output.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'raw',
+ doc=_(u'Print entries as stored on the server. Only affects output format.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ )
+ has_output = (
+ output.Output(
+ 'summary',
+ (unicode, type(None)),
+ doc=_(u'User-friendly description of action performed'),
+ ),
+ output.Entry(
+ 'result',
+ ),
+ output.PrimaryKey(
+ 'value',
+ doc=_(u"The primary_key value of the entry, e.g. 'jdoe' for a user"),
+ ),
+ )
+
+
+@register()
+class trustdomain_del(Method):
+ __doc__ = _("Remove infromation about the domain associated with the trust.")
+
+ takes_args = (
+ parameters.Str(
+ 'trustcn',
+ cli_name='trust',
+ label=_(u'Realm name'),
+ ),
+ parameters.Str(
+ 'cn',
+ multivalue=True,
+ cli_name='domain',
+ label=_(u'Domain name'),
+ ),
+ )
+ takes_options = (
+ parameters.Flag(
+ 'continue',
+ doc=_(u"Continuous mode: Don't stop on errors."),
+ default=False,
+ autofill=True,
+ ),
+ )
+ has_output = (
+ output.Output(
+ 'summary',
+ (unicode, type(None)),
+ doc=_(u'User-friendly description of action performed'),
+ ),
+ output.Output(
+ 'result',
+ dict,
+ doc=_(u'List of deletions that failed'),
+ ),
+ output.ListOfPrimaryKeys(
+ 'value',
+ ),
+ )
+
+
+@register()
+class trustdomain_disable(Method):
+ __doc__ = _("Disable use of IPA resources by the domain of the trust")
+
+ takes_args = (
+ parameters.Str(
+ 'trustcn',
+ cli_name='trust',
+ label=_(u'Realm name'),
+ ),
+ parameters.Str(
+ 'cn',
+ cli_name='domain',
+ label=_(u'Domain name'),
+ ),
+ )
+ takes_options = (
+ )
+ has_output = (
+ output.Output(
+ 'summary',
+ (unicode, type(None)),
+ doc=_(u'User-friendly description of action performed'),
+ ),
+ output.Output(
+ 'result',
+ bool,
+ doc=_(u'True means the operation was successful'),
+ ),
+ output.PrimaryKey(
+ 'value',
+ doc=_(u"The primary_key value of the entry, e.g. 'jdoe' for a user"),
+ ),
+ )
+
+
+@register()
+class trustdomain_enable(Method):
+ __doc__ = _("Allow use of IPA resources by the domain of the trust")
+
+ takes_args = (
+ parameters.Str(
+ 'trustcn',
+ cli_name='trust',
+ label=_(u'Realm name'),
+ ),
+ parameters.Str(
+ 'cn',
+ cli_name='domain',
+ label=_(u'Domain name'),
+ ),
+ )
+ takes_options = (
+ )
+ has_output = (
+ output.Output(
+ 'summary',
+ (unicode, type(None)),
+ doc=_(u'User-friendly description of action performed'),
+ ),
+ output.Output(
+ 'result',
+ bool,
+ doc=_(u'True means the operation was successful'),
+ ),
+ output.PrimaryKey(
+ 'value',
+ doc=_(u"The primary_key value of the entry, e.g. 'jdoe' for a user"),
+ ),
+ )
+
+
+@register()
+class trustdomain_find(Method):
+ __doc__ = _("Search domains of the trust")
+
+ takes_args = (
+ parameters.Str(
+ 'trustcn',
+ cli_name='trust',
+ label=_(u'Realm name'),
+ ),
+ parameters.Str(
+ 'criteria',
+ required=False,
+ doc=_(u'A string searched in all relevant object attributes'),
+ ),
+ )
+ takes_options = (
+ parameters.Str(
+ 'cn',
+ required=False,
+ cli_name='domain',
+ label=_(u'Domain name'),
+ ),
+ parameters.Str(
+ 'ipantflatname',
+ required=False,
+ cli_name='flat_name',
+ label=_(u'Domain NetBIOS name'),
+ ),
+ parameters.Str(
+ 'ipanttrusteddomainsid',
+ required=False,
+ cli_name='sid',
+ label=_(u'Domain Security Identifier'),
+ ),
+ parameters.Str(
+ 'ipanttrustpartner',
+ required=False,
+ label=_(u'Trusted domain partner'),
+ exclude=('cli', 'webui'),
+ ),
+ parameters.Int(
+ 'timelimit',
+ required=False,
+ label=_(u'Time Limit'),
+ doc=_(u'Time limit of search in seconds (0 is unlimited)'),
+ ),
+ parameters.Int(
+ 'sizelimit',
+ required=False,
+ label=_(u'Size Limit'),
+ doc=_(u'Maximum number of entries returned (0 is unlimited)'),
+ ),
+ parameters.Flag(
+ 'all',
+ doc=_(u'Retrieve and print all attributes from the server. Affects command output.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'raw',
+ doc=_(u'Print entries as stored on the server. Only affects output format.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'pkey_only',
+ required=False,
+ label=_(u'Primary key only'),
+ doc=_(u'Results should contain primary key attribute only ("domain")'),
+ default=False,
+ autofill=True,
+ ),
+ )
+ has_output = (
+ output.Output(
+ 'summary',
+ (unicode, type(None)),
+ doc=_(u'User-friendly description of action performed'),
+ ),
+ output.ListOfEntries(
+ 'result',
+ ),
+ output.Output(
+ 'count',
+ int,
+ doc=_(u'Number of entries returned'),
+ ),
+ output.Output(
+ 'truncated',
+ bool,
+ doc=_(u'True if not all results were returned'),
+ ),
+ )
+
+
+@register()
+class trustdomain_mod(Method):
+ __doc__ = _("Modify trustdomain of the trust")
+
+ NO_CLI = True
+
+ takes_args = (
+ parameters.Str(
+ 'trustcn',
+ cli_name='trust',
+ label=_(u'Realm name'),
+ ),
+ parameters.Str(
+ 'cn',
+ cli_name='domain',
+ label=_(u'Domain name'),
+ ),
+ )
+ takes_options = (
+ parameters.Str(
+ 'ipantflatname',
+ required=False,
+ cli_name='flat_name',
+ label=_(u'Domain NetBIOS name'),
+ ),
+ parameters.Str(
+ 'ipanttrusteddomainsid',
+ required=False,
+ cli_name='sid',
+ label=_(u'Domain Security Identifier'),
+ ),
+ parameters.Str(
+ 'ipanttrustpartner',
+ required=False,
+ label=_(u'Trusted domain partner'),
+ exclude=('cli', 'webui'),
+ ),
+ parameters.Str(
+ 'setattr',
+ required=False,
+ multivalue=True,
+ doc=_(u'Set an attribute to a name/value pair. Format is attr=value.\nFor multi-valued attributes, the command replaces the values already present.'),
+ exclude=('webui',),
+ ),
+ parameters.Str(
+ 'addattr',
+ required=False,
+ multivalue=True,
+ doc=_(u'Add an attribute/value pair. Format is attr=value. The attribute\nmust be part of the schema.'),
+ exclude=('webui',),
+ ),
+ parameters.Str(
+ 'delattr',
+ required=False,
+ multivalue=True,
+ doc=_(u'Delete an attribute/value pair. The option will be evaluated\nlast, after all sets and adds.'),
+ exclude=('webui',),
+ ),
+ parameters.Flag(
+ 'rights',
+ label=_(u'Rights'),
+ doc=_(u'Display the access rights of this entry (requires --all). See ipa man page for details.'),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Str(
+ 'trust_type',
+ cli_name='type',
+ cli_metavar="['ad']",
+ label=_(u'Trust type (ad for Active Directory, default)'),
+ default=u'ad',
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'all',
+ doc=_(u'Retrieve and print all attributes from the server. Affects command output.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ parameters.Flag(
+ 'raw',
+ doc=_(u'Print entries as stored on the server. Only affects output format.'),
+ exclude=('webui',),
+ default=False,
+ autofill=True,
+ ),
+ )
+ has_output = (
+ output.Output(
+ 'summary',
+ (unicode, type(None)),
+ doc=_(u'User-friendly description of action performed'),
+ ),
+ output.Entry(
+ 'result',
+ ),
+ output.PrimaryKey(
+ 'value',
+ doc=_(u"The primary_key value of the entry, e.g. 'jdoe' for a user"),
+ ),
+ )