diff options
Diffstat (limited to 'ipalib/plugins')
| -rw-r--r-- | ipalib/plugins/hbac.py | 65 | ||||
| -rw-r--r-- | ipalib/plugins/hbacsvc.py | 103 | ||||
| -rw-r--r-- | ipalib/plugins/hbacsvcgroup.py | 144 |
3 files changed, 303 insertions, 9 deletions
diff --git a/ipalib/plugins/hbac.py b/ipalib/plugins/hbac.py index 7a76f72cc..1438ea955 100644 --- a/ipalib/plugins/hbac.py +++ b/ipalib/plugins/hbac.py @@ -34,16 +34,18 @@ class hbac(LDAPObject): object_name_plural = 'HBAC rules' object_class = ['ipaassociation', 'ipahbacrule'] default_attributes = [ - 'cn', 'accessruletype', 'ipaenabledflag', 'servicename', + 'cn', 'accessruletype', 'ipaenabledflag', 'accesstime', 'description', 'usercategory', 'hostcategory', - 'sourcehostcategory', 'ipaenabledflag', - + 'sourcehostcategory', 'servicecategory', 'ipaenabledflag', + 'memberuser', 'sourcehost', 'memberhost', 'memberservice', + 'memberhostgroup', ] uuid_attribute = 'ipauniqueid' attribute_members = { 'memberuser': ['user', 'group'], 'memberhost': ['host', 'hostgroup'], 'sourcehost': ['host', 'hostgroup'], + 'memberservice': ['hbacsvc', 'hbacsvcgroup'], } label = _('HBAC') @@ -60,12 +62,7 @@ class hbac(LDAPObject): label=_('Rule type'), values=(u'allow', u'deny'), ), - Str('servicename?', - cli_name='service', - label=_('Service name'), - doc=_('Name of service the rule applies to (e.g. ssh)'), - ), - # FIXME: {user,host,sourcehost}categories should expand in the future + # FIXME: {user,host,sourcehost,service}categories should expand in the future StrEnum('usercategory?', cli_name='usercat', label=_('User category'), @@ -84,6 +81,12 @@ class hbac(LDAPObject): doc=_('Source host category the rule applies to'), values=(u'all', ), ), + StrEnum('servicecategory?', + cli_name='servicecat', + label=_('Service category'), + doc=_('Service category the rule applies to'), + values=(u'all', ), + ), AccessTime('accesstime?', cli_name='time', label=_('Access time'), @@ -96,6 +99,30 @@ class hbac(LDAPObject): label=_('Enabled'), flags=['no_create', 'no_update', 'no_search'], ), + Str('memberuser_user?', + label=_('Users'), + flags=['no_create', 'no_update', 'no_search'], + ), + Str('memberhost_host?', + label=_('Hosts'), + flags=['no_create', 'no_update', 'no_search'], + ), + Str('memberhost_hostgroup?', + label=_('Host Groups'), + flags=['no_create', 'no_update', 'no_search'], + ), + Str('sourcehost_host?', + label=_('Source hosts'), + flags=['no_create', 'no_update', 'no_search'], + ), + Str('memberservice_service?', + label=_('Services'), + flags=['no_create', 'no_update', 'no_search'], + ), + Str('memberservice_servicegroup?', + label=_('Service Groups'), + flags=['no_create', 'no_update', 'no_search'], + ), ) def get_dn(self, *keys, **kwargs): @@ -351,3 +378,23 @@ class hbac_remove_sourcehost(LDAPRemoveMember): member_count_out = ('%i object removed.', '%i objects removed.') api.register(hbac_remove_sourcehost) + + +class hbac_add_service(LDAPAddMember): + """ + Add services affected by HBAC rule. + """ + member_attributes = ['memberservice'] + member_count_out = ('%i object added.', '%i objects added.') + +api.register(hbac_add_service) + + +class hbac_remove_service(LDAPRemoveMember): + """ + Remove source hosts and hostgroups affected by HBAC rule. + """ + member_attributes = ['memberservice'] + member_count_out = ('%i object removed.', '%i objects removed.') + +api.register(hbac_remove_service) diff --git a/ipalib/plugins/hbacsvc.py b/ipalib/plugins/hbacsvc.py new file mode 100644 index 000000000..a85d94019 --- /dev/null +++ b/ipalib/plugins/hbacsvc.py @@ -0,0 +1,103 @@ +# Authors: +# Rob Crittenden <rcritten@redhat.com> +# +# Copyright (C) 2010 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation; version 2 only +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +""" +HBAC Services +""" +import base64 + +from ipalib import api, errors +from ipalib import Str, Flag, Bytes +from ipalib.plugins.baseldap import * +from ipalib import x509 +from pyasn1.error import PyAsn1Error +from ipalib import _, ngettext + + +class hbacsvc(LDAPObject): + """ + HBAC Service object. + """ + container_dn = api.env.container_hbacservice + object_name = 'service' + object_name_plural = 'services' + object_class = [ + 'ipahbacservice', + ] + default_attributes = ['cn', 'description'] + + label = _('Services') + + takes_params = ( + Str('cn', + cli_name='service', + label=_('Service name'), + doc=_('HBAC Service'), + primary_key=True, + normalizer=lambda value: value.lower(), + ), + Str('description?', + cli_name='desc', + label=_('Description'), + doc=_('Description of service'), + ), + ) + +api.register(hbacsvc) + + +class hbacsvc_add(LDAPCreate): + """ + Add new HBAC service. + """ + msg_summary = _('Added service "%(value)s"') + +api.register(hbacsvc_add) + + +class hbacsvc_del(LDAPDelete): + """ + Delete an existing HBAC service. + """ + msg_summary = _('Deleted service "%(value)s"') + +api.register(hbacsvc_del) + + +class hbacsvc_mod(LDAPUpdate): + """ + Modify HBAC service. + """ + +api.register(hbacsvc_mod) + + +class hbacsvc_find(LDAPSearch): + """ + Search for HBAC services. + """ + +api.register(hbacsvc_find) + + +class hbacsvc_show(LDAPRetrieve): + """ + Display HBAC service. + """ + +api.register(hbacsvc_show) diff --git a/ipalib/plugins/hbacsvcgroup.py b/ipalib/plugins/hbacsvcgroup.py new file mode 100644 index 000000000..6e36f3a87 --- /dev/null +++ b/ipalib/plugins/hbacsvcgroup.py @@ -0,0 +1,144 @@ +# Authors: +# Rob Crittenden <rcritten@redhat.com> +# +# Copyright (C) 2010 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation; version 2 only +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +""" +HBAC Service Groups +""" + +from ipalib import api, errors +from ipalib.plugins.baseldap import * +from ipalib import _, ngettext + + +class hbacsvcgroup(LDAPObject): + """ + HBAC service group object. + """ + container_dn = api.env.container_hbacservicegroup + object_name = 'servicegroup' + object_name_plural = 'servicegroups' + object_class = ['ipahbacservicegroup'] + default_attributes = [ 'cn', 'description', 'member', 'memberof', ] + attribute_members = { + 'member': ['hbacsvc', 'hbacsvcgroup'], + 'memberof': ['hbacsvcgroup'], + } + + label = _('HBAC Service Groups') + + takes_params = ( + Str('cn', + cli_name='name', + label=_('Service group name'), + primary_key=True, + normalizer=lambda value: value.lower(), + ), + Str('description', + cli_name='desc', + label=_('Description'), + doc=_('HBAC service group description'), + ), + Str('member_service?', + label=_('Member services'), + flags=['no_create', 'no_update', 'no_search'], + ), + Str('member_servicegroup?', + label=_('Member service groups'), + flags=['no_create', 'no_update', 'no_search'], + ), + Str('memberof_servicegroup?', + label='Member of service groups', + flags=['no_create', 'no_update', 'no_search'], + ), + ) + + def get_dn(self, *keys, **kwargs): + try: + (dn, entry_attrs) = self.backend.find_entry_by_attr( + self.primary_key.name, keys[-1], self.object_class, [''], + self.container_dn + ) + except errors.NotFound: + dn = super(hbacsvcgroup, self).get_dn(*keys, **kwargs) + return dn + + def get_primary_key_from_dn(self, dn): + pkey = self.primary_key.name + (dn, entry_attrs) = self.backend.get_entry(dn, [pkey]) + try: + return entry_attrs[pkey][0] + except (KeyError, IndexError): + return '' + +api.register(hbacsvcgroup) + + +class hbacsvcgroup_add(LDAPCreate): + """ + Create new hbacsvcgroup. + """ + +api.register(hbacsvcgroup_add) + + +class hbacsvcgroup_del(LDAPDelete): + """ + Delete hbacsvcgroup. + """ + +api.register(hbacsvcgroup_del) + + +class hbacsvcgroup_mod(LDAPUpdate): + """ + Modify hbacsvcgroup. + """ + +api.register(hbacsvcgroup_mod) + + +class hbacsvcgroup_find(LDAPSearch): + """ + Search the groups. + """ + +api.register(hbacsvcgroup_find) + + +class hbacsvcgroup_show(LDAPRetrieve): + """ + Display hbacsvcgroup. + """ + +api.register(hbacsvcgroup_show) + + +class hbacsvcgroup_add_member(LDAPAddMember): + """ + Add members to hbacsvcgroup. + """ + +api.register(hbacsvcgroup_add_member) + + +class hbacsvcgroup_remove_member(LDAPRemoveMember): + """ + Remove members from hbacsvcgroup. + """ + +api.register(hbacsvcgroup_remove_member) |