diff options
author | Jan Cholasta <jcholast@redhat.com> | 2016-04-28 10:30:05 +0200 |
---|---|---|
committer | Jan Cholasta <jcholast@redhat.com> | 2016-06-03 09:00:34 +0200 |
commit | 6e44557b601f769d23ee74555a72e8b5cc62c0c9 (patch) | |
tree | eedd3e054b0709341b9f58c190ea54f999f7d13a /ipaserver/plugins/virtual.py | |
parent | ec841e5d7ab29d08de294b3fa863a631cd50e30a (diff) | |
download | freeipa-6e44557b601f769d23ee74555a72e8b5cc62c0c9.tar.gz freeipa-6e44557b601f769d23ee74555a72e8b5cc62c0c9.tar.xz freeipa-6e44557b601f769d23ee74555a72e8b5cc62c0c9.zip |
ipalib: move server-side plugins to ipaserver
Move the remaining plugin code from ipalib.plugins to ipaserver.plugins.
Remove the now unused ipalib.plugins package.
https://fedorahosted.org/freeipa/ticket/4739
Reviewed-By: David Kupka <dkupka@redhat.com>
Diffstat (limited to 'ipaserver/plugins/virtual.py')
-rw-r--r-- | ipaserver/plugins/virtual.py | 68 |
1 files changed, 68 insertions, 0 deletions
diff --git a/ipaserver/plugins/virtual.py b/ipaserver/plugins/virtual.py new file mode 100644 index 000000000..2ba69f651 --- /dev/null +++ b/ipaserver/plugins/virtual.py @@ -0,0 +1,68 @@ +# Authors: +# Rob Crittenden <rcritten@redhat.com> +# +# Copyright (C) 2009 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + +""" +Base classes for non-LDAP backend plugins. +""" +from ipalib import Command +from ipalib import errors +from ipapython.dn import DN +from ipalib.text import _ + +class VirtualCommand(Command): + """ + A command that doesn't use the LDAP backend but wants to use the + LDAP access control system to make authorization decisions. + + The class variable operation is the commonName attribute of the + entry to be tested against. + + In advance, you need to create an entry of the form: + cn=<operation>, api.env.container_virtual, api.env.basedn + + Ex. + cn=request certificate, cn=virtual operations,cn=etc, dc=example, dc=com + """ + operation = None + + def check_access(self, operation=None): + """ + Perform an LDAP query to determine authorization. + + This should be executed before any actual work is done. + """ + if self.operation is None and operation is None: + raise errors.ACIError(info=_('operation not defined')) + + if operation is None: + operation = self.operation + + ldap = self.api.Backend.ldap2 + self.log.debug("IPA: virtual verify %s" % operation) + + operationdn = DN(('cn', operation), self.api.env.container_virtual, self.api.env.basedn) + + try: + if not ldap.can_write(operationdn, "objectclass"): + raise errors.ACIError( + info=_('not allowed to perform operation: %s') % operation) + except errors.NotFound: + raise errors.ACIError(info=_('No such virtual command')) + + return True |