Validate attributes in permission-add

When adding or modifying permission with both type and attributes
specified, check whether the attributes are allowed for specified type.
In case of disallowed attributes raises the ObjectclassViolation
exception.

New tests were also added to the unit-tests.

https://fedorahosted.org/freeipa/ticket/2293

1 files changed, 65 insertions, 0 deletions

diff --git a/tests/test_xmlrpc/test_permission_plugin.py b/tests/test_xmlrpc/test_permission_plugin.py
index e8e6bebcd..68a3cebf9 100644
--- a/tests/test_xmlrpc/test_permission_plugin.py
+++ b/tests/test_xmlrpc/test_permission_plugin.py
@@ -124,6 +124,71 @@ class test_permission(Declarative):
 
 
         dict(
+            desc='Try to create %r with invalid attribute \'ipaclientversion\'' % permission2,
+            command=(
+                'permission_add', [permission2], dict(
+                     type=u'user',
+                     permissions=u'write',
+                     attrs=u'ipaclientversion',
+                ),
+            ),
+            expected=errors.ObjectclassViolation(info=u'attribute(s) \"ipaclientversion\" not allowed'),
+        ),
+
+
+        dict(
+            desc='Add allowed attribute \'cn\' to %r' % permission1,
+            command=(
+                'permission_mod', [permission1], dict(
+                     attrs=u'cn',
+                )
+            ),
+            expected=dict(
+                value=permission1,
+                summary=u'Modified permission "%s"' % permission1,
+                result=dict(
+                    dn=lambda x: DN(x) == permission1_dn,
+                    cn=[permission1],
+                    type=u'user',
+                    permissions=[u'write'],
+                    attrs=[u'cn'],
+                ),
+            ),
+        ),
+
+
+        dict(
+            desc='Try to modify %r with invalid attribute \'ipaclientversion\'' % permission1,
+            command=(
+                'permission_mod', [permission1], dict(
+                     attrs=u'ipaclientversion',
+                ),
+            ),
+            expected=errors.ObjectclassViolation(info=u'attribute(s) \"ipaclientversion\" not allowed'),
+        ),
+
+
+        dict(
+            desc='Unset attribute \'cn\' of %r' % permission1,
+            command=(
+                'permission_mod', [permission1], dict(
+                     attrs=None,
+                )
+            ),
+            expected=dict(
+                value=permission1,
+                summary=u'Modified permission "%s"' % permission1,
+                result=dict(
+                    dn=lambda x: DN(x) == permission1_dn,
+                    cn=[permission1],
+                    type=u'user',
+                    permissions=[u'write'],
+                ),
+            ),
+        ),
+
+
+        dict(
             desc='Create %r' % privilege1,
             command=('privilege_add', [privilege1],
                 dict(description=u'privilege desc. 1')