frontend: perform argument value validation only on server

Do not validate values of command arguments on the client and let the
server handle validation.

This will make the client more lightweight by not having it to carry
validation code and metadata with itself for the price of increasing
network traffic in case the validation fails.

Types of the arguments are still validated on both the client and the
server.

https://fedorahosted.org/freeipa/ticket/4739

Reviewed-By: David Kupka <dkupka@redhat.com>

1 files changed, 8 insertions, 2 deletions

diff --git a/ipalib/plugins/baseldap.py b/ipalib/plugins/baseldap.py
index 4f90291cb..6fd1c394b 100644
--- a/ipalib/plugins/baseldap.py
+++ b/ipalib/plugins/baseldap.py
@@ -346,7 +346,12 @@ def add_external_pre_callback(membertype, ldap, dn, keys, options):
         if membertype == 'host':
             validator = validate_host
         else:
-            validator = api.Object[membertype].primary_key
+            param = api.Object[membertype].primary_key
+
+            def validator(value):
+                value = param(value)
+                param.validate(value)
+
         for value in options[membertype]:
             try:
                 validator(value)
@@ -1100,7 +1105,8 @@ last, after all sets and adds."""),
                         raise errors.OnlyOneValueAllowed(attr=attr)
                 # validate, convert and encode params
                 try:
-                   value = param(value)
+                    value = param(value)
+                    param.validate(value)
                 except errors.ValidationError as err:
                     raise errors.ValidationError(name=attr, error=err.error)
                 except errors.ConversionError as err: