ipalib: introduce Principal parameter

This patch introduces a separate Principal parameter that allows the framework
to syntactically validate incoming/outcoming principals by using a single
shared codebase.

https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>

2 files changed, 43 insertions, 0 deletions

diff --git a/ipalib/parameters.py b/ipalib/parameters.py
index a08113460..1581b7dca 100644
--- a/ipalib/parameters.py
+++ b/ipalib/parameters.py
@@ -115,9 +115,11 @@ from ipalib.errors import PasswordMismatch, Base64DecodeError
 from ipalib.constants import TYPE_ERROR, CALLABLE_ERROR, LDAP_GENERALIZED_TIME_FORMAT
 from ipalib.text import Gettext, FixMe
 from ipalib.util import json_serialize, validate_idna_domain
+from ipapython import kerberos
 from ipapython.dn import DN
 from ipapython.dnsutil import DNSName
 
+
 def _is_null(value):
     return not value and value != 0 # NOTE: False == 0
 
@@ -1970,3 +1972,38 @@ class Dict(Param):
 
     type = dict
     type_error = _("must be dictionary")
+
+
+class Principal(Param):
+    """
+    Kerberos principal name
+    """
+
+    type = kerberos.Principal
+    type_error = _('must be Kerberos principal')
+    kwargs = Param.kwargs + (
+        ('require_service', bool, False),
+    )
+
+    @property
+    def allowed_types(self):
+        return (self.type, unicode)
+
+    def _convert_scalar(self, value, index=None):
+        if isinstance(value, unicode):
+            try:
+                value = kerberos.Principal(value)
+            except ValueError:
+                raise ConversionError(
+                    name=self.get_param_name(),
+                    error=_("Malformed principal: '%(value)s'") % dict(
+                        value=value))
+
+        return super(Principal, self)._convert_scalar(value)
+
+    def _rule_require_service(self, _, value):
+        if self.require_service and not value.is_service:
+            raise ValidationError(
+                name=self.get_param_name(),
+                error=_("Service principal is required")
+            )
diff --git a/ipalib/rpc.py b/ipalib/rpc.py
index a549f0226..1c002895e 100644
--- a/ipalib/rpc.py
+++ b/ipalib/rpc.py
@@ -66,6 +66,7 @@ from ipalib.krb_utils import KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN, KRB5KRB_AP_ERR_TKT
                              KRB5_FCC_PERM, KRB5_FCC_NOFILE, KRB5_CC_FORMAT, \
                              KRB5_REALM_CANT_RESOLVE, KRB5_CC_NOTFOUND, get_principal
 from ipapython.dn import DN
+from ipapython.kerberos import Principal
 from ipalib.capabilities import VERSION_WITHOUT_CAPABILITIES
 from ipalib import api
 
@@ -194,6 +195,9 @@ def xml_wrap(value, version):
         else:
             return unicode(value)
 
+    if isinstance(value, Principal):
+        return unicode(value)
+
     assert type(value) in (unicode, float, bool, type(None)) + six.integer_types
     return value
 
@@ -316,6 +320,8 @@ def json_encode_binary(val, version):
             return {'__dns_name__': unicode(val)}
         else:
             return unicode(val)
+    elif isinstance(val, Principal):
+        return unicode(val)
     else:
         return val