Allow nsaccountlock to be searched in user-find command

This patch provides the ability to search and find users who are
enabled/disabled in `ipa user-find` command without breaking API compatibility.

Reviewed-By: Martin Basti <mbasti@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>

3 files changed, 22 insertions, 6 deletions

diff --git a/API.txt b/API.txt
index 128d18405..3ebebabac 100644
--- a/API.txt
+++ b/API.txt
@@ -5764,7 +5764,7 @@ option: Str('manager?')
 option: Str('mobile*')
 option: Flag('no_members', autofill=True, default=False)
 option: Flag('noprivate', autofill=True, cli_name='noprivate', default=False)
-option: Bool('nsaccountlock?')
+option: Bool('nsaccountlock?', cli_name='disabled')
 option: Str('ou?', cli_name='orgunit')
 option: Str('pager*')
 option: Str('postalcode?')
@@ -5878,7 +5878,7 @@ option: Str('not_in_hbacrule*', cli_name='not_in_hbacrules')
 option: Str('not_in_netgroup*', cli_name='not_in_netgroups')
 option: Str('not_in_role*', cli_name='not_in_roles')
 option: Str('not_in_sudorule*', cli_name='not_in_sudorules')
-option: Bool('nsaccountlock?', autofill=False)
+option: Bool('nsaccountlock?', autofill=False, cli_name='disabled')
 option: Str('ou?', autofill=False, cli_name='orgunit')
 option: Str('pager*', autofill=False)
 option: Flag('pkey_only?', autofill=True, default=False)
@@ -5934,7 +5934,7 @@ option: Str('mail*', autofill=False, cli_name='email')
 option: Str('manager?', autofill=False)
 option: Str('mobile*', autofill=False)
 option: Flag('no_members', autofill=True, default=False)
-option: Bool('nsaccountlock?', autofill=False)
+option: Bool('nsaccountlock?', autofill=False, cli_name='disabled')
 option: Str('ou?', autofill=False, cli_name='orgunit')
 option: Str('pager*', autofill=False)
 option: Str('postalcode?', autofill=False)
diff --git a/VERSION.m4 b/VERSION.m4
index 36929eeca..8d6671847 100644
--- a/VERSION.m4
+++ b/VERSION.m4
@@ -73,8 +73,8 @@ define(IPA_DATA_VERSION, 20100614120000)
 #                                                      #
 ########################################################
 define(IPA_API_VERSION_MAJOR, 2)
-define(IPA_API_VERSION_MINOR, 217)
-# Last change: Add options to write lightweight CA cert or chain to file
+define(IPA_API_VERSION_MINOR, 218)
+# Last change: Remove no_option flag for nsaccountlock and add cli_name='disabled'
 
 
 ########################################################
diff --git a/ipaserver/plugins/user.py b/ipaserver/plugins/user.py
index 1ef71d2a5..88171cf40 100644
--- a/ipaserver/plugins/user.py
+++ b/ipaserver/plugins/user.py
@@ -370,8 +370,8 @@ class user(baseuser):
 
     takes_params = baseuser.takes_params + (
         Bool('nsaccountlock?',
+            cli_name=('disabled'),
             label=_('Account disabled'),
-            flags=['no_option'],
         ),
         Bool('preserved?',
             label=_('Preserved user'),
@@ -443,6 +443,14 @@ class user_add(baseuser_add):
         ),
     )
 
+    def get_options(self):
+        for option in super(user_add, self).get_options():
+            if option.name == "nsaccountlock":
+                flags = set(option.flags)
+                flags.add("no_option")
+                option = option.clone(flags=flags)
+            yield option
+
     def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
         delete_dn = self.obj.get_delete_dn(*keys, **options)
         try:
@@ -749,6 +757,14 @@ class user_mod(baseuser_mod):
 
     has_output_params = baseuser_mod.has_output_params + user_output_params
 
+    def get_options(self):
+        for option in super(user_mod, self).get_options():
+            if option.name == "nsaccountlock":
+                flags = set(option.flags)
+                flags.add("no_option")
+                option = option.clone(flags=flags)
+            yield option
+
     def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
         dn = self.obj.get_either_dn(*keys, **options)
         self.pre_common_callback(ldap, dn, entry_attrs, attrs_list, *keys,