diff options
author | Rob Crittenden <rcrit@ipa.greyoak.com> | 2008-08-15 13:08:29 -0400 |
---|---|---|
committer | Rob Crittenden <rcrit@ipa.greyoak.com> | 2008-08-20 17:39:46 -0400 |
commit | e9bde984e0aa1f1b03dee5f916daed783a64c025 (patch) | |
tree | 15a8ea7bbe519860597df92af7d00ffaac16e96b /ipa-admintools | |
parent | 0c6aeee6f136577508e65e57135f770ee172b13b (diff) | |
download | freeipa-e9bde984e0aa1f1b03dee5f916daed783a64c025.tar.gz freeipa-e9bde984e0aa1f1b03dee5f916daed783a64c025.tar.xz freeipa-e9bde984e0aa1f1b03dee5f916daed783a64c025.zip |
Add tool to manage IPA Search and User policy
448624, 448625
Diffstat (limited to 'ipa-admintools')
-rw-r--r-- | ipa-admintools/Makefile | 1 | ||||
-rw-r--r-- | ipa-admintools/ipa-defaultoptions | 186 | ||||
-rw-r--r-- | ipa-admintools/man/Makefile | 3 | ||||
-rw-r--r-- | ipa-admintools/man/ipa-defaultoptions.1 | 65 |
4 files changed, 254 insertions, 1 deletions
diff --git a/ipa-admintools/Makefile b/ipa-admintools/Makefile index 4a76cc8b1..b107fd7ba 100644 --- a/ipa-admintools/Makefile +++ b/ipa-admintools/Makefile @@ -26,6 +26,7 @@ install: install -m 755 ipa-deldelegation $(SBINDIR) install -m 755 ipa-listdelegation $(SBINDIR) install -m 755 ipa-moddelegation $(SBINDIR) + install -m 755 ipa-defaultoptions $(SBINDIR) @for subdir in $(SUBDIRS); do \ (cd $$subdir && $(MAKE) $@) || exit 1; \ diff --git a/ipa-admintools/ipa-defaultoptions b/ipa-admintools/ipa-defaultoptions new file mode 100644 index 000000000..5d9c49042 --- /dev/null +++ b/ipa-admintools/ipa-defaultoptions @@ -0,0 +1,186 @@ +#! /usr/bin/python -E +# Authors: Rob Crittenden <rcritten@redhat.com> +# +# Copyright (C) 2008 Red Hat +# see file 'COPYING' for use and warranty information +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation; version 2 only +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA +# +import sys +try: + from optparse import OptionParser + import ipa + import ipa.entity + import ipa.ipaclient as ipaclient + import ipa.config + + import xmlrpclib + import kerberos + import errno + import validate + import socket +except ImportError: + print >> sys.stderr, """\ +There was a problem importing one of the required Python modules. The +error was: + + %s +""" % sys.exc_value + sys.exit(1) + +def usage(): + print "ipa-defaultoptions [--maxusername number] [--homedir directory] [--defaultshell shell] [--defaultgroup group] [--emaildomain domain] [--searchtimelimit number] [--searchrecordslimit number] [--usersearch fields] [--groupsearch fields] [-v|--verbose]" + print "ipa-defaultoptions --show" + sys.exit(1) + +def parse_options(): + parser = OptionParser() + parser.add_option("--maxusername", dest="maxusername", + help="Max. Length of a username") + parser.add_option("--homedir", dest="homedir", + help="Default location of home directories") + parser.add_option("--defaultshell", dest="defaultshell", + help="Default shell for new users") + parser.add_option("--defaultgroup", dest="defaultgroup", + help="Default group for new users") + parser.add_option("--emaildomain", dest="emaildomain", + help="Default e-mail domain") + parser.add_option("--searchtimelimit", dest="searchtimelimit", + help="Max. amount of time (sec.) for a search (-1 is unlimited)") + parser.add_option("--searchrecordslimit", dest="searchrecordslimit", + help="Max. number of records to search (-1 is unlimited)") + parser.add_option("--usersearch", dest="usersearch", + help="A comma-separated list of fields to search when searching for users") + parser.add_option("--groupsearch", dest="groupsearch", + help="A comma-separated list of fields to search when searching for groups") + parser.add_option("--show", dest="show", action="store_true", + help="Show the current configuration") + parser.add_option("--usage", action="store_true", + help="Program usage") + parser.add_option("-v", "--verbose", action="store_true", dest="verbose", + help="Verbose output of the XML-RPC connection") + + args = ipa.config.init_config(sys.argv) + options, args = parser.parse_args(args) + + return options, args + +def show_config(client): + policy = client.get_ipa_config() + print "Search Configuration" + print " Search Time Limit (sec.): %s" % policy.getValues('ipaSearchTimeLimit') + print " Search Records Limit: %s" % policy.getValues('ipaSearchRecordsLimit') + print " User Search Fields: %s" % policy.getValues('ipaUserSearchFields') + print " Group Search Fields: %s" % policy.getValues('ipaGroupSearchFields') + + print "" + + print "User Settings" + print " Max. Username Length: %s" % policy.getValues('ipaMaxUsernameLength') + print " Root for Home Directories: %s" % policy.getValues('ipaHomesRootDir') + print " Default Shell: %s" % policy.getValues('ipaDefaultLoginShell') + print " Default User Group: %s" % policy.getValues('ipaDefaultPrimaryGroup') + print "Default E-mail Domain: %s" % policy.getValues('ipaDefaultEmailDomain') + +def update_policy(client, options): + if not options.maxusername and not options.homedir and not options.defaultshell and not options.defaultgroup and not options.emaildomain and not options.searchtimelimit and not options.searchrecordslimit and not options.usersearch and not options.groupsearch: + usage() + + current = client.get_ipa_config() + + new = ipa.entity.Entity(current.toDict()) + + try: + if options.maxusername: + validate.is_integer(options.maxusername, min=1) + new.setValue('ipamaxusernamelength', options.maxusername) + if options.homedir: + validate.is_string(options.homedir) + new.setValue('ipahomesrootdir', options.homedir) + if options.defaultshell: + validate.is_string(options.defaultshell) + new.setValue('ipadefaultloginshell', options.history) + if options.defaultgroup: + new.setValue('ipadefaultprimarygroup', options.defaultgroup) + if options.emaildomain: + new.setValue('ipadefaultemaildomain', options.emaildomain) + if options.searchtimelimit: + validate.is_integer(options.searchtimelimit, min=-1) + new.setValue('ipasearchtimelimit', options.searchtimelimit) + if options.searchrecordslimit: + validate.is_integer(options.searchrecordslimit, min=-1) + new.setValue('ipasearchrecordslimit', options.searchrecordslimit) + if options.usersearch: + new.setValue('ipausersearchfields', options.usersearch) + if options.groupsearch: + new.setValue('ipagroupsearchfields', options.groupsearch) + except validate.VdtTypeError, e: + print "%s" % str(e) + return 1 + except validate.VdtValueTooSmallError, e: + print "%s" % str(e) + return 1 + + client.update_ipa_config(new) + + if options.usersearch or options.groupsearch: + print "WARNING: Be sure that the attributes in User and Group search are indexed in the Directory Server or you may suffer a performance loss." + +def main(): + options, args = parse_options() + + if options.usage: + usage() + + client = ipaclient.IPAClient(verbose=options.verbose) + + if options.show: + show_config(client) + return 0 + + if update_policy(client, options): + return 1 + + print "Update successful." + + return 0 + +try: + if __name__ == "__main__": + sys.exit(main()) +except SystemExit, e: + sys.exit(e) +except KeyboardInterrupt, e: + sys.exit(1) +except xmlrpclib.Fault, fault: + if fault.faultCode == errno.ECONNREFUSED: + print "The IPA XML-RPC service is not responding." + else: + print fault.faultString + sys.exit(1) +except kerberos.GSSError, e: + print "Could not initialize GSSAPI: %s/%s" % (e[0][0], e[0][1]) + sys.exit(1) +except xmlrpclib.ProtocolError, e: + print "Unable to connect to IPA server: %s" % (e.errmsg) + sys.exit(1) +except ipa.ipaerror.IPAError, e: + print "%s" % (e.message) + sys.exit(1) +except socket.error, e: + print e[1] + print "Re-run with -v flag for more details." +except Exception, e: + print "%s" % str(e) + sys.exit(1) diff --git a/ipa-admintools/man/Makefile b/ipa-admintools/man/Makefile index c2750a1b6..506dbb43b 100644 --- a/ipa-admintools/man/Makefile +++ b/ipa-admintools/man/Makefile @@ -18,7 +18,8 @@ MANFILES=\ ipa-moddelegation.1 \ ipa-passwd.1 \ ipa-pwpolicy.1 \ - ipa-moduser.1 + ipa-moduser.1 \ + ipa-defaultoptions.1 all: ; diff --git a/ipa-admintools/man/ipa-defaultoptions.1 b/ipa-admintools/man/ipa-defaultoptions.1 new file mode 100644 index 000000000..f58588fe1 --- /dev/null +++ b/ipa-admintools/man/ipa-defaultoptions.1 @@ -0,0 +1,65 @@ +.\" A man page for ipa-defaultoptions +.\" Copyright (C) 2008 Red Hat, Inc. +.\" +.\" This is free software; you can redistribute it and/or modify it under +.\" the terms of the GNU Library General Public License as published by +.\" the Free Software Foundation; version 2 only +.\" +.\" This program is distributed in the hope that it will be useful, but +.\" WITHOUT ANY WARRANTY; without even the implied warranty of +.\" MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +.\" General Public License for more details. +.\" +.\" You should have received a copy of the GNU Library General Public +.\" License along with this program; if not, write to the Free Software +.\" Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +.\" +.\" Author: Rob Crittenden <rcritten@redhat.com> +.\" +.TH "ipa-defaultoptions" "1" "Jul 14 2008" "freeipa" "" +.SH "NAME" +ipa\-defaultoptions \- Display or modify the IPA Search and User Policies +.SH "SYNOPSIS" +ipa\-defaultoptions [\-\-maxusername number] [\-\-homedir directory] [\-\-defaultshell shell] [\-\-defaultgroup group] [\-\-emaildomain domain] [\-\-searchtimelimit number] [\-\-searchrecordslimit number] [\-\-usersearch fields] [\-\-groupsearch fields] [\-v|\-\-verbose] +ipa\-defaultoptions \-\-show +.SH "DESCRIPTION" +Displays or updates the IPA Search and User Policy. + +.SH "OPTIONS" +.TP +\fB\-\-maxusername\fR=\fIMAXUSERNAME\fR +Max. Length of a username +.TP +\fB\-\-homedir\fR=\fIHOMEDIR\fR +Default location of home directories +.TP +\fB\-\-defaultshell\fR=\fIDEFAULTSHELL\fR +Default shell for new users +.TP +\fB\-\-defaultgroup\fR=\fIDEFAULTGROUP\fR +Default group for new users +.TP +\fB\-\-emaildomain\fR=\fIEMAILDOMAIN\fR +Default e\-mail domain +.TP +\fB\-\-searchtimelimit\fR=\fISEARCHTIMELIMIT\fR +Max. amount of time (sec.) for a search (-1 for unlimited) +.TP +\fB\-\-searchrecordslimit\fR=\fISEARCHRECORDSLIMIT\fR +Max. number of records to search (-1 for unlimited) +.TP +\fB\-\-usersearch\fR=\fIUSERSEARCH\fR +A comma\-separated list of fields to search when +searching for users +.TP +\fB\-\-groupsearch\fR=\fIGROUPSEARCH\fR +A comma\-separated list of fields to search when +searching for groups +.TP +\fB\-\-show\fR +Display the current password policy. +.TP +\fB\-v\fR, \fB\-\-verbose\fR +Display the XML\-RPC request and response for more verbose debugging output +.SH "EXIT STATUS" +The exit status is 0 on success, nonzero on error. |