Add plugin framework to LDAP updates.

There are two reasons for the plugin framework:
1. To provide a way of doing manual/complex LDAP changes without having
   to keep extending ldapupdate.py (like we did with managed entries).
2. Allows for better control of restarts.

There are two types of plugins, preop and postop. A preop plugin runs
before any file-based updates are loaded. A postop plugin runs after
all file-based updates are applied.

A preop plugin may update LDAP directly or craft update entries to be
applied with the file-based updates.

Either a preop or postop plugin may attempt to restart the dirsrv instance.
The instance is only restartable if ipa-ldap-updater is being executed
as root. A warning is printed if a restart is requested for a non-root
user.

Plugins are not executed by default. This is so we can use ldapupdate
to apply simple updates in commands like ipa-nis-manage.

https://fedorahosted.org/freeipa/ticket/1789
https://fedorahosted.org/freeipa/ticket/1790
https://fedorahosted.org/freeipa/ticket/2032

4 files changed, 38 insertions, 10 deletions

diff --git a/install/tools/ipa-ldap-updater b/install/tools/ipa-ldap-updater
index 472495471..bd2233a94 100755
--- a/install/tools/ipa-ldap-updater
+++ b/install/tools/ipa-ldap-updater
@@ -33,6 +33,7 @@ try:
     from ipaserver.install.upgradeinstance import IPAUpgrade
     from ipapython import sysrestore
     import krbV
+    from ipalib import api
     from ipapython.ipa_log_manager import *
 except ImportError:
     print >> sys.stderr, """\
@@ -49,15 +50,19 @@ def parse_options():
     parser = IPAOptionParser(usage=usage, formatter=config.IPAFormatter())
 
     parser.add_option("-d", "--debug", action="store_true", dest="debug",
-                      help="Display debugging information about the update(s)")
+                      help="Display debugging information about the update(s)",
+                      default=False)
     parser.add_option("-t", "--test", action="store_true", dest="test",
-                      help="Run through the update without changing anything")
+                      help="Run through the update without changing anything",
+                      default=False)
     parser.add_option("-y", dest="password",
                       help="File containing the Directory Manager password")
     parser.add_option("-l", '--ldapi', action="store_true", dest="ldapi",
                       default=False, help="Connect to the LDAP server using the ldapi socket")
     parser.add_option("-u", '--upgrade', action="store_true", dest="upgrade",
                       default=False, help="Upgrade an installed server in offline mode")
+    parser.add_option("-p", '--plugins', action="store_true", dest="plugins",
+                      default=False, help="Execute update plugins. Always true when applying all update files.")
     parser.add_option("-W", '--password', action="store_true",
                       dest="ask_password",
                       help="Prompt for the Directory Manager password")
@@ -78,6 +83,7 @@ def get_dirman_password():
 def main():
     badsyntax = False
     upgradefailed = False
+    run_plugins = False
 
     safe_options, options, args = parse_options()
 
@@ -96,14 +102,30 @@ def main():
             if dirman_password is None:
                 sys.exit("\nDirectory Manager password required")
 
+    if options.upgrade:
+        standard_logging_setup('/var/log/ipaupgrade.log', verbose=True, debug=options.debug, filemode='a')
+    else:
+        standard_logging_setup(None, verbose=True, debug=options.debug)
+
+    cfg = dict (
+        in_server=True,
+        context='updates',
+        debug=options.debug,
+    )
+    api.bootstrap(**cfg)
+    api.finalize()
+
     files = []
     if len(args) > 0:
         files = args
 
+    if len(files) < 1:
+        run_plugins = True
+
+    updates = None
     if options.upgrade:
         if os.getegid() != 0:
             sys.exit('Upgrade can only be done as root')
-        standard_logging_setup('/var/log/ipaupgrade.log', verbose=True, debug=options.debug, filemode='a')
         root_logger.debug('%s was invoked with arguments %s and options: %s' % (sys.argv[0], args, safe_options))
         realm = krbV.default_context().default_realm
         upgrade = IPAUpgrade(realm, files, live_run=not options.test)
@@ -112,21 +134,24 @@ def main():
         badsyntax = upgrade.badsyntax
         upgradefailed = upgrade.upgradefailed
     else:
-        standard_logging_setup(None, verbose=True, debug=options.debug)
-        ld = LDAPUpdate(dm_password=dirman_password, sub_dict={}, live_run=not options.test, ldapi=options.ldapi)
+        ld = LDAPUpdate(dm_password=dirman_password, sub_dict={}, live_run=not options.test, ldapi=options.ldapi, plugins=options.plugins or run_plugins)
         if len(files) < 1:
             files = ld.get_all_files(UPDATES_DIR)
         modified = ld.update(files)
 
     if badsyntax:
+        root_logger.info('Bad syntax detected in upgrade file(s).')
         print 'Bad syntax detected in upgrade file(s).'
         return 1
     elif upgradefailed:
+        root_logger.info('IPA upgrade failed.')
         print 'IPA upgrade failed.'
         return 1
     elif modified and options.test:
+        root_logger.info('Update complete, changes to be made, test mode')
         return 2
     else:
+        root_logger.info('Update complete')
         return 0
 
 try:
diff --git a/install/tools/ipa-managed-entries b/install/tools/ipa-managed-entries
index 24ba0e760..f3473e2b0 100755
--- a/install/tools/ipa-managed-entries
+++ b/install/tools/ipa-managed-entries
@@ -130,12 +130,10 @@ def main():
         entries = conn.search_s(
             managed_entry_definitions_dn, ldap.SCOPE_SUBTREE, filter
             )
-        managed_entries = [entry.dn for entry in entries]
+        managed_entries = [entry.cn for entry in entries]
         if managed_entries:
             print "Available Managed Entry Definitions:"
             for managed_entry in managed_entries:
-                rdn = DN(managed_entry)
-                managed_entry = rdn[0].value
                 print managed_entry
         retval = 0
         sys.exit()
diff --git a/install/tools/man/ipa-ldap-updater.1 b/install/tools/man/ipa-ldap-updater.1
index d896a1bed..df8dfe650 100644
--- a/install/tools/man/ipa-ldap-updater.1
+++ b/install/tools/man/ipa-ldap-updater.1
@@ -83,8 +83,11 @@ File containing the Directory Manager password
 \fB\-l\fR, \fB\-\-ldapi\fR
 Connect to the LDAP server using the ldapi socket
 .TP
+\fB\-p\fR, \fB\-\-\-plugins\fR
+Execute update plugins as well as any update files. There is no way to execute only the plugins.
+.TP
 \fB\-u\fR, \fB\-\-\-upgrade\fR
-Upgrade an installed server in offline mode (implies \-\-ldapi)
+Upgrade an installed server in offline mode (implies \-\-ldapi and \-\-plugins)
 .TP
 \fB\-W\fR, \fB\-\-\-password\fR
 Prompt for the Directory Manager password
diff --git a/install/updates/20-user_private_groups.update b/install/updates/20-user_private_groups.update
index d54cc02d6..93b79b80a 100644
--- a/install/updates/20-user_private_groups.update
+++ b/install/updates/20-user_private_groups.update
@@ -16,9 +16,11 @@ default:mepMappedAttr: description: User private group for $$uid
 
 dn: cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,$SUFFIX
 default:objectclass: extensibleObject
-replace:originFilter:objectclass=posixAccount::(&(objectclass=posixAccount)(!(description=__no_upg__)))
 default:cn: UPG Definition
 default:originScope: cn=users,cn=accounts,$SUFFIX
 default:originFilter: objectclass=posixAccount
 default:managedBase: cn=groups,cn=accounts,$SUFFIX
 default:managedTemplate: cn=UPG Template,cn=Templates,cn=Managed Entries,cn=etc,$SUFFIX
+
+dn: cn=UPG Definition,cn=Definitions,cn=Managed Entries,cn=etc,$SUFFIX
+replace:originFilter: objectclass=posixAccount::(&(objectclass=posixAccount)(!(description=__no_upg__)))