2012-06-13 13:58:54 -05:00
|
|
|
# Authors:
|
|
|
|
# Sumit Bose <sbose@redhat.com>
|
|
|
|
#
|
|
|
|
# Copyright (C) 2012 Red Hat
|
|
|
|
# see file 'COPYING' for use and warranty information
|
|
|
|
#
|
|
|
|
# This program is free software; you can redistribute it and/or modify
|
|
|
|
# it under the terms of the GNU General Public License as published by
|
|
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
|
|
# (at your option) any later version.
|
|
|
|
#
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
2015-09-11 06:43:28 -05:00
|
|
|
import six
|
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
from ipalib.plugable import Registry
|
2016-04-20 08:41:34 -05:00
|
|
|
from .baseldap import (LDAPObject, LDAPCreate, LDAPDelete,
|
2013-05-29 08:15:19 -05:00
|
|
|
LDAPRetrieve, LDAPSearch, LDAPUpdate)
|
2019-03-27 12:26:36 -05:00
|
|
|
from ipalib import api, Int, Str, StrEnum, _, ngettext, messages
|
2012-06-13 13:58:54 -05:00
|
|
|
from ipalib import errors
|
2019-03-27 12:26:36 -05:00
|
|
|
from ipaplatform import services
|
2012-08-08 06:45:55 -05:00
|
|
|
from ipapython.dn import DN
|
2012-06-13 13:58:54 -05:00
|
|
|
|
2015-09-11 06:43:28 -05:00
|
|
|
if six.PY3:
|
|
|
|
unicode = str
|
|
|
|
|
2020-06-03 04:47:41 -05:00
|
|
|
if api.env.in_server:
|
2012-09-19 11:09:22 -05:00
|
|
|
try:
|
|
|
|
import ipaserver.dcerpc
|
|
|
|
_dcerpc_bindings_installed = True
|
|
|
|
except ImportError:
|
|
|
|
_dcerpc_bindings_installed = False
|
2016-07-29 09:46:09 -05:00
|
|
|
else:
|
|
|
|
_dcerpc_bindings_installed = False
|
|
|
|
|
2012-06-13 13:58:54 -05:00
|
|
|
|
2022-08-22 03:30:10 -05:00
|
|
|
ID_RANGE_VS_DNA_WARNING = _("""-------
|
2015-08-07 08:44:57 -05:00
|
|
|
WARNING:
|
|
|
|
|
|
|
|
DNA plugin in 389-ds will allocate IDs based on the ranges configured for the
|
|
|
|
local domain. Currently the DNA plugin *cannot* be reconfigured itself based
|
|
|
|
on the local ranges set via this family of commands.
|
|
|
|
|
|
|
|
Manual configuration change has to be done in the DNA plugin configuration for
|
|
|
|
the new local range. Specifically, The dnaNextRange attribute of 'cn=Posix
|
|
|
|
IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config' has to be
|
|
|
|
modified to match the new range.
|
2022-08-22 03:30:10 -05:00
|
|
|
|
|
|
|
-------
|
2018-06-20 04:13:08 -05:00
|
|
|
""")
|
2015-08-07 08:44:57 -05:00
|
|
|
|
2012-06-13 13:58:54 -05:00
|
|
|
__doc__ = _("""
|
2012-08-13 10:07:37 -05:00
|
|
|
ID ranges
|
|
|
|
|
|
|
|
Manage ID ranges used to map Posix IDs to SIDs and back.
|
|
|
|
|
|
|
|
There are two type of ID ranges which are both handled by this utility:
|
|
|
|
|
|
|
|
- the ID ranges of the local domain
|
|
|
|
- the ID ranges of trusted remote domains
|
|
|
|
|
|
|
|
Both types have the following attributes in common:
|
|
|
|
|
|
|
|
- base-id: the first ID of the Posix ID range
|
|
|
|
- range-size: the size of the range
|
|
|
|
|
|
|
|
With those two attributes a range object can reserve the Posix IDs starting
|
|
|
|
with base-id up to but not including base-id+range-size exclusively.
|
|
|
|
|
|
|
|
Additionally an ID range of the local domain may set
|
|
|
|
- rid-base: the first RID(*) of the corresponding RID range
|
|
|
|
- secondary-rid-base: first RID of the secondary RID range
|
|
|
|
|
|
|
|
and an ID range of a trusted domain must set
|
|
|
|
- rid-base: the first RID of the corresponding RID range
|
2013-02-04 07:33:53 -06:00
|
|
|
- sid: domain SID of the trusted domain
|
2012-08-13 10:07:37 -05:00
|
|
|
|
2021-04-14 10:34:37 -05:00
|
|
|
and an ID range of a trusted domain may set
|
|
|
|
- auto-private-groups: [true|false|hybrid] automatic creation of private groups
|
|
|
|
|
2012-08-13 10:07:37 -05:00
|
|
|
|
|
|
|
|
|
|
|
EXAMPLE: Add a new ID range for a trusted domain
|
|
|
|
|
|
|
|
Since there might be more than one trusted domain the domain SID must be given
|
|
|
|
while creating the ID range.
|
|
|
|
|
2012-09-20 03:26:17 -05:00
|
|
|
ipa idrange-add --base-id=1200000 --range-size=200000 --rid-base=0 \\
|
|
|
|
--dom-sid=S-1-5-21-123-456-789 trusted_dom_range
|
2012-08-13 10:07:37 -05:00
|
|
|
|
|
|
|
This ID range is then used by the IPA server and the SSSD IPA provider to
|
|
|
|
assign Posix UIDs to users from the trusted domain.
|
|
|
|
|
2017-04-29 15:31:54 -05:00
|
|
|
If e.g. a range for a trusted domain is configured with the following values:
|
2012-08-13 10:07:37 -05:00
|
|
|
base-id = 1200000
|
|
|
|
range-size = 200000
|
|
|
|
rid-base = 0
|
|
|
|
the RIDs 0 to 199999 are mapped to the Posix ID from 1200000 to 13999999. So
|
|
|
|
RID 1000 <-> Posix ID 1201000
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
EXAMPLE: Add a new ID range for the local domain
|
|
|
|
|
|
|
|
To create an ID range for the local domain it is not necessary to specify a
|
|
|
|
domain SID. But since it is possible that a user and a group can have the same
|
|
|
|
value as Posix ID a second RID interval is needed to handle conflicts.
|
|
|
|
|
2012-09-20 03:26:17 -05:00
|
|
|
ipa idrange-add --base-id=1200000 --range-size=200000 --rid-base=1000 \\
|
|
|
|
--secondary-rid-base=1000000 local_range
|
2012-08-13 10:07:37 -05:00
|
|
|
|
|
|
|
The data from the ID ranges of the local domain are used by the IPA server
|
|
|
|
internally to assign SIDs to IPA users and groups. The SID will then be stored
|
|
|
|
in the user or group objects.
|
|
|
|
|
|
|
|
If e.g. the ID range for the local domain is configured with the values from
|
|
|
|
the example above then a new user with the UID 1200007 will get the RID 1007.
|
|
|
|
If this RID is already used by a group the RID will be 1000007. This can only
|
|
|
|
happen if a user or a group object was created with a fixed ID because the
|
|
|
|
automatic assignment will not assign the same ID twice. Since there are only
|
|
|
|
users and groups sharing the same ID namespace it is sufficient to have only
|
|
|
|
one fallback range to handle conflicts.
|
|
|
|
|
|
|
|
To find the Posix ID for a given RID from the local domain it has to be
|
|
|
|
checked first if the RID falls in the primary or secondary RID range and
|
|
|
|
the rid-base or the secondary-rid-base has to be subtracted, respectively,
|
|
|
|
and the base-id has to be added to get the Posix ID.
|
|
|
|
|
|
|
|
Typically the creation of ID ranges happens behind the scenes and this CLI
|
|
|
|
must not be used at all. The ID range for the local domain will be created
|
|
|
|
during installation or upgrade from an older version. The ID range for a
|
2012-09-16 11:35:56 -05:00
|
|
|
trusted domain will be created together with the trust by 'ipa trust-add ...'.
|
2012-08-13 10:07:37 -05:00
|
|
|
|
|
|
|
USE CASES:
|
|
|
|
|
|
|
|
Add an ID range from a transitively trusted domain
|
|
|
|
|
|
|
|
If the trusted domain (A) trusts another domain (B) as well and this trust
|
|
|
|
is transitive 'ipa trust-add domain-A' will only create a range for
|
|
|
|
domain A. The ID range for domain B must be added manually.
|
|
|
|
|
|
|
|
Add an additional ID range for the local domain
|
|
|
|
|
|
|
|
If the ID range of the local domain is exhausted, i.e. no new IDs can be
|
|
|
|
assigned to Posix users or groups by the DNA plugin, a new range has to be
|
2012-09-16 11:35:56 -05:00
|
|
|
created to allow new users and groups to be added. (Currently there is no
|
2012-08-13 10:07:37 -05:00
|
|
|
connection between this range CLI and the DNA plugin, but a future version
|
|
|
|
might be able to modify the configuration of the DNS plugin as well)
|
|
|
|
|
|
|
|
In general it is not necessary to modify or delete ID ranges. If there is no
|
|
|
|
other way to achieve a certain configuration than to modify or delete an ID
|
|
|
|
range it should be done with great care. Because UIDs are stored in the file
|
|
|
|
system and are used for access control it might be possible that users are
|
|
|
|
allowed to access files of other users if an ID range got deleted and reused
|
|
|
|
for a different domain.
|
|
|
|
|
|
|
|
(*) The RID is typically the last integer of a user or group SID which follows
|
|
|
|
the domain SID. E.g. if the domain SID is S-1-5-21-123-456-789 and a user from
|
2019-12-09 03:01:49 -06:00
|
|
|
this domain has the SID S-1-5-21-123-456-789-1010 then 1010 is the RID of the
|
2012-08-13 10:07:37 -05:00
|
|
|
user. RIDs are unique in a domain, 32bit values and are used for users and
|
|
|
|
groups.
|
2012-10-10 02:03:40 -05:00
|
|
|
|
2018-06-20 04:13:08 -05:00
|
|
|
""") + ID_RANGE_VS_DNA_WARNING
|
2012-06-13 13:58:54 -05:00
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
register = Registry()
|
2013-06-10 03:45:04 -05:00
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2012-08-23 07:17:34 -05:00
|
|
|
class idrange(LDAPObject):
|
2012-06-13 13:58:54 -05:00
|
|
|
"""
|
|
|
|
Range object.
|
|
|
|
"""
|
|
|
|
|
|
|
|
range_type = ('domain', 'ad', 'ipa')
|
|
|
|
container_dn = api.env.container_ranges
|
|
|
|
object_name = ('range')
|
|
|
|
object_name_plural = ('ranges')
|
|
|
|
object_class = ['ipaIDrange']
|
2014-03-26 10:29:16 -05:00
|
|
|
permission_filter_objectclasses = ['ipaidrange']
|
2012-06-13 13:58:54 -05:00
|
|
|
possible_objectclasses = ['ipadomainidrange', 'ipatrustedaddomainrange']
|
|
|
|
default_attributes = ['cn', 'ipabaseid', 'ipaidrangesize', 'ipabaserid',
|
|
|
|
'ipasecondarybaserid', 'ipanttrusteddomainsid',
|
2021-04-14 10:34:37 -05:00
|
|
|
'iparangetype', 'ipaautoprivategroups']
|
2014-03-26 10:29:16 -05:00
|
|
|
managed_permissions = {
|
|
|
|
'System: Read ID Ranges': {
|
|
|
|
'replaces_global_anonymous_aci': True,
|
|
|
|
'ipapermbindruletype': 'all',
|
|
|
|
'ipapermright': {'read', 'search', 'compare'},
|
|
|
|
'ipapermdefaultattr': {
|
|
|
|
'cn', 'objectclass',
|
|
|
|
'ipabaseid', 'ipaidrangesize', 'iparangetype',
|
|
|
|
'ipabaserid', 'ipasecondarybaserid', 'ipanttrusteddomainsid',
|
2021-04-14 10:34:37 -05:00
|
|
|
'ipaautoprivategroups',
|
2014-03-26 10:29:16 -05:00
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
2012-06-13 13:58:54 -05:00
|
|
|
|
2012-08-23 07:17:34 -05:00
|
|
|
label = _('ID Ranges')
|
|
|
|
label_singular = _('ID Range')
|
2012-06-13 13:58:54 -05:00
|
|
|
|
2014-06-16 10:33:12 -05:00
|
|
|
# The commented range types are planned but not yet supported
|
2013-05-30 07:12:52 -05:00
|
|
|
range_types = {
|
|
|
|
u'ipa-local': unicode(_('local domain range')),
|
2021-03-19 05:48:38 -05:00
|
|
|
# u'ipa-local-subid': unicode(_('local domain subid range')),
|
2014-06-16 10:33:12 -05:00
|
|
|
# u'ipa-ad-winsync': unicode(_('Active Directory winsync range')),
|
2013-05-30 07:12:52 -05:00
|
|
|
u'ipa-ad-trust': unicode(_('Active Directory domain range')),
|
|
|
|
u'ipa-ad-trust-posix': unicode(_('Active Directory trust range with '
|
|
|
|
'POSIX attributes')),
|
2014-06-16 10:33:12 -05:00
|
|
|
# u'ipa-ipa-trust': unicode(_('IPA trust range')),
|
2013-05-30 07:12:52 -05:00
|
|
|
}
|
|
|
|
|
2012-06-13 13:58:54 -05:00
|
|
|
takes_params = (
|
|
|
|
Str('cn',
|
|
|
|
cli_name='name',
|
|
|
|
label=_('Range name'),
|
|
|
|
primary_key=True,
|
|
|
|
),
|
|
|
|
Int('ipabaseid',
|
|
|
|
cli_name='base_id',
|
|
|
|
label=_("First Posix ID of the range"),
|
2021-03-19 05:48:38 -05:00
|
|
|
minvalue=1,
|
|
|
|
maxvalue=Int.MAX_UINT32
|
2012-06-13 13:58:54 -05:00
|
|
|
),
|
|
|
|
Int('ipaidrangesize',
|
|
|
|
cli_name='range_size',
|
|
|
|
label=_("Number of IDs in the range"),
|
2021-03-19 05:48:38 -05:00
|
|
|
minvalue=1,
|
|
|
|
maxvalue=Int.MAX_UINT32
|
2012-06-13 13:58:54 -05:00
|
|
|
),
|
2012-09-05 06:21:04 -05:00
|
|
|
Int('ipabaserid?',
|
2012-06-13 13:58:54 -05:00
|
|
|
cli_name='rid_base',
|
|
|
|
label=_('First RID of the corresponding RID range'),
|
|
|
|
),
|
|
|
|
Int('ipasecondarybaserid?',
|
|
|
|
cli_name='secondary_rid_base',
|
|
|
|
label=_('First RID of the secondary RID range'),
|
|
|
|
),
|
|
|
|
Str('ipanttrusteddomainsid?',
|
|
|
|
cli_name='dom_sid',
|
2013-05-29 08:15:19 -05:00
|
|
|
flags=('no_update',),
|
2012-06-13 13:58:54 -05:00
|
|
|
label=_('Domain SID of the trusted domain'),
|
|
|
|
),
|
2013-02-04 07:33:53 -06:00
|
|
|
Str('ipanttrusteddomainname?',
|
|
|
|
cli_name='dom_name',
|
2013-05-29 08:15:19 -05:00
|
|
|
flags=('no_search', 'virtual_attribute', 'no_update'),
|
2013-02-04 07:33:53 -06:00
|
|
|
label=_('Name of the trusted domain'),
|
2018-02-14 09:59:50 -06:00
|
|
|
),
|
2013-05-30 07:12:52 -05:00
|
|
|
StrEnum('iparangetype?',
|
2018-02-14 09:59:50 -06:00
|
|
|
label=_('Range type'),
|
|
|
|
cli_name='type',
|
2018-06-20 04:13:08 -05:00
|
|
|
doc=_('ID range type, one of allowed values'),
|
2018-02-14 09:59:50 -06:00
|
|
|
values=sorted(range_types),
|
|
|
|
flags=['no_update'],
|
2021-04-14 10:34:37 -05:00
|
|
|
),
|
|
|
|
StrEnum('ipaautoprivategroups?',
|
|
|
|
label=_('Auto private groups'),
|
|
|
|
cli_name='auto_private_groups',
|
|
|
|
doc=_('Auto creation of private groups, one of allowed values'),
|
|
|
|
values=(u'true', u'false', u'hybrid'),
|
|
|
|
),
|
2012-06-13 13:58:54 -05:00
|
|
|
)
|
|
|
|
|
2018-02-14 09:59:50 -06:00
|
|
|
def handle_iparangetype(self, entry_attrs, options,
|
|
|
|
keep_objectclass=False):
|
2013-05-30 07:12:52 -05:00
|
|
|
if not any((options.get('pkey_only', False),
|
|
|
|
options.get('raw', False))):
|
|
|
|
range_type = entry_attrs['iparangetype'][0]
|
2014-10-15 06:42:30 -05:00
|
|
|
entry_attrs['iparangetyperaw'] = [range_type]
|
2013-06-11 06:07:06 -05:00
|
|
|
entry_attrs['iparangetype'] = [self.range_types.get(range_type, None)]
|
2013-05-30 07:12:52 -05:00
|
|
|
|
|
|
|
# Remove the objectclass
|
2012-07-11 07:09:17 -05:00
|
|
|
if not keep_objectclass:
|
|
|
|
if not options.get('all', False) or options.get('pkey_only', False):
|
|
|
|
entry_attrs.pop('objectclass', None)
|
|
|
|
|
2014-10-13 07:57:45 -05:00
|
|
|
def handle_ipabaserid(self, entry_attrs, options):
|
|
|
|
if any((options.get('pkey_only', False), options.get('raw', False))):
|
|
|
|
return
|
|
|
|
if entry_attrs['iparangetype'][0] == u'ipa-ad-trust-posix':
|
|
|
|
entry_attrs.pop('ipabaserid', None)
|
|
|
|
|
2013-06-10 03:45:04 -05:00
|
|
|
def check_ids_in_modified_range(self, old_base, old_size, new_base,
|
|
|
|
new_size):
|
2012-09-05 05:28:42 -05:00
|
|
|
if new_base is None and new_size is None:
|
|
|
|
# nothing to check
|
|
|
|
return
|
|
|
|
if new_base is None:
|
|
|
|
new_base = old_base
|
|
|
|
if new_size is None:
|
|
|
|
new_size = old_size
|
|
|
|
old_interval = (old_base, old_base + old_size - 1)
|
|
|
|
new_interval = (new_base, new_base + new_size - 1)
|
|
|
|
checked_intervals = []
|
|
|
|
low_diff = new_interval[0] - old_interval[0]
|
|
|
|
if low_diff > 0:
|
2013-06-10 03:45:04 -05:00
|
|
|
checked_intervals.append((old_interval[0],
|
|
|
|
min(old_interval[1], new_interval[0] - 1)))
|
2012-09-05 05:28:42 -05:00
|
|
|
high_diff = old_interval[1] - new_interval[1]
|
|
|
|
if high_diff > 0:
|
2013-06-10 03:45:04 -05:00
|
|
|
checked_intervals.append((max(old_interval[0], new_interval[1] + 1),
|
|
|
|
old_interval[1]))
|
2012-09-05 05:28:42 -05:00
|
|
|
|
|
|
|
if not checked_intervals:
|
|
|
|
# range is equal or covers the entire old range, nothing to check
|
|
|
|
return
|
|
|
|
|
|
|
|
ldap = self.backend
|
|
|
|
id_filter_base = ["(objectclass=posixAccount)",
|
|
|
|
"(objectclass=posixGroup)",
|
|
|
|
"(objectclass=ipaIDObject)"]
|
|
|
|
id_filter_ids = []
|
|
|
|
|
|
|
|
for id_low, id_high in checked_intervals:
|
|
|
|
id_filter_ids.append("(&(uidNumber>=%(low)d)(uidNumber<=%(high)d))"
|
|
|
|
% dict(low=id_low, high=id_high))
|
|
|
|
id_filter_ids.append("(&(gidNumber>=%(low)d)(gidNumber<=%(high)d))"
|
|
|
|
% dict(low=id_low, high=id_high))
|
|
|
|
id_filter = ldap.combine_filters(
|
|
|
|
[ldap.combine_filters(id_filter_base, "|"),
|
|
|
|
ldap.combine_filters(id_filter_ids, "|")],
|
|
|
|
"&")
|
|
|
|
|
|
|
|
try:
|
2016-10-04 13:02:32 -05:00
|
|
|
ldap.find_entries(filter=id_filter,
|
2012-09-05 05:28:42 -05:00
|
|
|
attrs_list=['uid', 'cn'],
|
|
|
|
base_dn=DN(api.env.container_accounts, api.env.basedn))
|
|
|
|
except errors.NotFound:
|
|
|
|
# no objects in this range found, allow the command
|
|
|
|
pass
|
|
|
|
else:
|
|
|
|
raise errors.ValidationError(name="ipabaseid,ipaidrangesize",
|
|
|
|
error=_('range modification leaving objects with ID out '
|
|
|
|
'of the defined range is not allowed'))
|
|
|
|
|
2013-02-04 07:33:53 -06:00
|
|
|
def get_domain_validator(self):
|
2012-09-19 11:09:22 -05:00
|
|
|
if not _dcerpc_bindings_installed:
|
2013-02-04 07:33:53 -06:00
|
|
|
raise errors.NotFound(reason=_('Cannot perform SID validation '
|
|
|
|
'without Samba 4 support installed. Make sure you have '
|
|
|
|
'installed server-trust-ad sub-package of IPA on the server'))
|
|
|
|
|
2023-11-29 04:13:55 -06:00
|
|
|
# pylint: disable=used-before-assignment
|
2012-09-19 11:09:22 -05:00
|
|
|
domain_validator = ipaserver.dcerpc.DomainValidator(self.api)
|
2023-11-29 04:13:55 -06:00
|
|
|
# pylint: enable=used-before-assignment
|
2013-02-04 07:33:53 -06:00
|
|
|
|
2012-09-19 11:09:22 -05:00
|
|
|
if not domain_validator.is_configured():
|
2013-02-04 07:33:53 -06:00
|
|
|
raise errors.NotFound(reason=_('Cross-realm trusts are not '
|
|
|
|
'configured. Make sure you have run ipa-adtrust-install '
|
|
|
|
'on the IPA server first'))
|
|
|
|
|
|
|
|
return domain_validator
|
|
|
|
|
|
|
|
def validate_trusted_domain_sid(self, sid):
|
|
|
|
|
|
|
|
domain_validator = self.get_domain_validator()
|
|
|
|
|
2013-03-06 05:17:28 -06:00
|
|
|
if not domain_validator.is_trusted_domain_sid_valid(sid):
|
2012-09-19 11:09:22 -05:00
|
|
|
raise errors.ValidationError(name='domain SID',
|
2013-02-04 07:33:53 -06:00
|
|
|
error=_('SID is not recognized as a valid SID for a '
|
|
|
|
'trusted domain'))
|
|
|
|
|
|
|
|
def get_trusted_domain_sid_from_name(self, name):
|
|
|
|
""" Returns unicode string representation for given trusted domain name
|
|
|
|
or None if SID forthe given trusted domain name could not be found."""
|
|
|
|
|
|
|
|
domain_validator = self.get_domain_validator()
|
|
|
|
|
|
|
|
sid = domain_validator.get_sid_from_domain_name(name)
|
|
|
|
|
|
|
|
if sid is not None:
|
|
|
|
sid = unicode(sid)
|
|
|
|
|
|
|
|
return sid
|
2012-09-19 11:09:22 -05:00
|
|
|
|
2012-10-26 06:43:05 -05:00
|
|
|
# checks that primary and secondary rid ranges do not overlap
|
|
|
|
def are_rid_ranges_overlapping(self, rid_base, secondary_rid_base, size):
|
|
|
|
|
|
|
|
# if any of these is None, the check does not apply
|
|
|
|
if any(attr is None for attr in (rid_base, secondary_rid_base, size)):
|
|
|
|
return False
|
|
|
|
|
|
|
|
# sort the bases
|
|
|
|
if rid_base > secondary_rid_base:
|
|
|
|
rid_base, secondary_rid_base = secondary_rid_base, rid_base
|
|
|
|
|
|
|
|
# rid_base is now <= secondary_rid_base,
|
|
|
|
# so the following check is sufficient
|
|
|
|
if rid_base + size <= secondary_rid_base:
|
|
|
|
return False
|
|
|
|
else:
|
|
|
|
return True
|
|
|
|
|
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2012-08-23 07:17:34 -05:00
|
|
|
class idrange_add(LDAPCreate):
|
2012-08-13 10:07:37 -05:00
|
|
|
__doc__ = _("""
|
|
|
|
Add new ID range.
|
|
|
|
|
|
|
|
To add a new ID range you always have to specify
|
|
|
|
|
|
|
|
--base-id
|
|
|
|
--range-size
|
|
|
|
|
|
|
|
Additionally
|
|
|
|
|
|
|
|
--rid-base
|
2012-09-16 11:35:56 -05:00
|
|
|
--secondary-rid-base
|
2012-08-13 10:07:37 -05:00
|
|
|
|
|
|
|
may be given for a new ID range for the local domain while
|
|
|
|
|
2021-04-14 10:34:37 -05:00
|
|
|
--auto-private-groups
|
|
|
|
|
|
|
|
may be given for a new ID range for a trusted AD domain and
|
|
|
|
|
2013-06-10 17:57:08 -05:00
|
|
|
--rid-base
|
2012-08-13 10:07:37 -05:00
|
|
|
--dom-sid
|
|
|
|
|
|
|
|
must be given to add a new range for a trusted AD domain.
|
2012-10-10 02:03:40 -05:00
|
|
|
|
2018-06-20 04:13:08 -05:00
|
|
|
""") + ID_RANGE_VS_DNA_WARNING
|
2012-06-13 13:58:54 -05:00
|
|
|
|
|
|
|
msg_summary = _('Added ID range "%(value)s"')
|
|
|
|
|
|
|
|
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
|
Use DN objects instead of strings
* Convert every string specifying a DN into a DN object
* Every place a dn was manipulated in some fashion it was replaced by
the use of DN operators
* Add new DNParam parameter type for parameters which are DN's
* DN objects are used 100% of the time throughout the entire data
pipeline whenever something is logically a dn.
* Many classes now enforce DN usage for their attributes which are
dn's. This is implmented via ipautil.dn_attribute_property(). The
only permitted types for a class attribute specified to be a DN are
either None or a DN object.
* Require that every place a dn is used it must be a DN object.
This translates into lot of::
assert isinstance(dn, DN)
sprinkled through out the code. Maintaining these asserts is
valuable to preserve DN type enforcement. The asserts can be
disabled in production.
The goal of 100% DN usage 100% of the time has been realized, these
asserts are meant to preserve that.
The asserts also proved valuable in detecting functions which did
not obey their function signatures, such as the baseldap pre and
post callbacks.
* Moved ipalib.dn to ipapython.dn because DN class is shared with all
components, not just the server which uses ipalib.
* All API's now accept DN's natively, no need to convert to str (or
unicode).
* Removed ipalib.encoder and encode/decode decorators. Type conversion
is now explicitly performed in each IPASimpleLDAPObject method which
emulates a ldap.SimpleLDAPObject method.
* Entity & Entry classes now utilize DN's
* Removed __getattr__ in Entity & Entity clases. There were two
problems with it. It presented synthetic Python object attributes
based on the current LDAP data it contained. There is no way to
validate synthetic attributes using code checkers, you can't search
the code to find LDAP attribute accesses (because synthetic
attriutes look like Python attributes instead of LDAP data) and
error handling is circumscribed. Secondly __getattr__ was hiding
Python internal methods which broke class semantics.
* Replace use of methods inherited from ldap.SimpleLDAPObject via
IPAdmin class with IPAdmin methods. Directly using inherited methods
was causing us to bypass IPA logic. Mostly this meant replacing the
use of search_s() with getEntry() or getList(). Similarly direct
access of the LDAP data in classes using IPAdmin were replaced with
calls to getValue() or getValues().
* Objects returned by ldap2.find_entries() are now compatible with
either the python-ldap access methodology or the Entity/Entry access
methodology.
* All ldap operations now funnel through the common
IPASimpleLDAPObject giving us a single location where we interface
to python-ldap and perform conversions.
* The above 4 modifications means we've greatly reduced the
proliferation of multiple inconsistent ways to perform LDAP
operations. We are well on the way to having a single API in IPA for
doing LDAP (a long range goal).
* All certificate subject bases are now DN's
* DN objects were enhanced thusly:
- find, rfind, index, rindex, replace and insert methods were added
- AVA, RDN and DN classes were refactored in immutable and mutable
variants, the mutable variants are EditableAVA, EditableRDN and
EditableDN. By default we use the immutable variants preserving
important semantics. To edit a DN cast it to an EditableDN and
cast it back to DN when done editing. These issues are fully
described in other documentation.
- first_key_match was removed
- DN equalty comparison permits comparison to a basestring
* Fixed ldapupdate to work with DN's. This work included:
- Enhance test_updates.py to do more checking after applying
update. Add test for update_from_dict(). Convert code to use
unittest classes.
- Consolidated duplicate code.
- Moved code which should have been in the class into the class.
- Fix the handling of the 'deleteentry' update action. It's no longer
necessary to supply fake attributes to make it work. Detect case
where subsequent update applies a change to entry previously marked
for deletetion. General clean-up and simplification of the
'deleteentry' logic.
- Rewrote a couple of functions to be clearer and more Pythonic.
- Added documentation on the data structure being used.
- Simplfy the use of update_from_dict()
* Removed all usage of get_schema() which was being called prior to
accessing the .schema attribute of an object. If a class is using
internal lazy loading as an optimization it's not right to require
users of the interface to be aware of internal
optimization's. schema is now a property and when the schema
property is accessed it calls a private internal method to perform
the lazy loading.
* Added SchemaCache class to cache the schema's from individual
servers. This was done because of the observation we talk to
different LDAP servers, each of which may have it's own
schema. Previously we globally cached the schema from the first
server we connected to and returned that schema in all contexts. The
cache includes controls to invalidate it thus forcing a schema
refresh.
* Schema caching is now senstive to the run time context. During
install and upgrade the schema can change leading to errors due to
out-of-date cached schema. The schema cache is refreshed in these
contexts.
* We are aware of the LDAP syntax of all LDAP attributes. Every
attribute returned from an LDAP operation is passed through a
central table look-up based on it's LDAP syntax. The table key is
the LDAP syntax it's value is a Python callable that returns a
Python object matching the LDAP syntax. There are a handful of LDAP
attributes whose syntax is historically incorrect
(e.g. DistguishedNames that are defined as DirectoryStrings). The
table driven conversion mechanism is augmented with a table of
hard coded exceptions.
Currently only the following conversions occur via the table:
- dn's are converted to DN objects
- binary objects are converted to Python str objects (IPA
convention).
- everything else is converted to unicode using UTF-8 decoding (IPA
convention).
However, now that the table driven conversion mechanism is in place
it would be trivial to do things such as converting attributes
which have LDAP integer syntax into a Python integer, etc.
* Expected values in the unit tests which are a DN no longer need to
use lambda expressions to promote the returned value to a DN for
equality comparison. The return value is automatically promoted to
a DN. The lambda expressions have been removed making the code much
simpler and easier to read.
* Add class level logging to a number of classes which did not support
logging, less need for use of root_logger.
* Remove ipaserver/conn.py, it was unused.
* Consolidated duplicate code wherever it was found.
* Fixed many places that used string concatenation to form a new
string rather than string formatting operators. This is necessary
because string formatting converts it's arguments to a string prior
to building the result string. You can't concatenate a string and a
non-string.
* Simplify logic in rename_managed plugin. Use DN operators to edit
dn's.
* The live version of ipa-ldap-updater did not generate a log file.
The offline version did, now both do.
https://fedorahosted.org/freeipa/ticket/1670
https://fedorahosted.org/freeipa/ticket/1671
https://fedorahosted.org/freeipa/ticket/1672
https://fedorahosted.org/freeipa/ticket/1673
https://fedorahosted.org/freeipa/ticket/1674
https://fedorahosted.org/freeipa/ticket/1392
https://fedorahosted.org/freeipa/ticket/2872
2012-05-13 06:36:35 -05:00
|
|
|
assert isinstance(dn, DN)
|
2012-06-13 13:58:54 -05:00
|
|
|
|
2022-12-19 10:01:45 -06:00
|
|
|
def is_set(x):
|
|
|
|
return entry_attrs.get(x) is not None
|
2012-10-26 06:43:05 -05:00
|
|
|
|
2013-02-04 07:33:53 -06:00
|
|
|
# This needs to stay in options since there is no
|
|
|
|
# ipanttrusteddomainname attribute in LDAP
|
2017-03-28 09:02:45 -05:00
|
|
|
if options.get('ipanttrusteddomainname'):
|
2013-02-04 07:33:53 -06:00
|
|
|
if is_set('ipanttrusteddomainsid'):
|
|
|
|
raise errors.ValidationError(name='ID Range setup',
|
|
|
|
error=_('Options dom-sid and dom-name '
|
|
|
|
'cannot be used together'))
|
|
|
|
|
|
|
|
sid = self.obj.get_trusted_domain_sid_from_name(
|
|
|
|
options['ipanttrusteddomainname'])
|
|
|
|
|
|
|
|
if sid is not None:
|
|
|
|
entry_attrs['ipanttrusteddomainsid'] = sid
|
|
|
|
else:
|
2018-03-12 09:53:36 -05:00
|
|
|
raise errors.ValidationError(
|
|
|
|
name='ID Range setup',
|
|
|
|
error=_('Specified trusted domain name could not be '
|
|
|
|
'found.'))
|
2013-02-04 07:33:53 -06:00
|
|
|
|
2013-05-30 07:12:52 -05:00
|
|
|
# ipaNTTrustedDomainSID attribute set, this is AD Trusted domain range
|
2012-10-26 06:43:05 -05:00
|
|
|
if is_set('ipanttrusteddomainsid'):
|
2013-05-30 07:12:52 -05:00
|
|
|
entry_attrs['objectclass'].append('ipatrustedaddomainrange')
|
|
|
|
|
|
|
|
# Default to ipa-ad-trust if no type set
|
2013-06-25 07:25:44 -05:00
|
|
|
if not is_set('iparangetype'):
|
2013-05-30 07:12:52 -05:00
|
|
|
entry_attrs['iparangetype'] = u'ipa-ad-trust'
|
|
|
|
|
2014-10-13 07:57:45 -05:00
|
|
|
if entry_attrs['iparangetype'] == u'ipa-ad-trust':
|
|
|
|
if not is_set('ipabaserid'):
|
|
|
|
raise errors.ValidationError(
|
|
|
|
name='ID Range setup',
|
|
|
|
error=_('Options dom-sid/dom-name and rid-base must '
|
|
|
|
'be used together')
|
|
|
|
)
|
|
|
|
elif entry_attrs['iparangetype'] == u'ipa-ad-trust-posix':
|
|
|
|
if is_set('ipabaserid') and entry_attrs['ipabaserid'] != 0:
|
|
|
|
raise errors.ValidationError(
|
|
|
|
name='ID Range setup',
|
|
|
|
error=_('Option rid-base must not be used when IPA '
|
|
|
|
'range type is ipa-ad-trust-posix')
|
|
|
|
)
|
|
|
|
else:
|
|
|
|
entry_attrs['ipabaserid'] = 0
|
|
|
|
else:
|
2013-06-25 07:25:44 -05:00
|
|
|
raise errors.ValidationError(name='ID Range setup',
|
2013-05-30 07:12:52 -05:00
|
|
|
error=_('IPA Range type must be one of ipa-ad-trust '
|
|
|
|
'or ipa-ad-trust-posix when SID of the trusted '
|
2014-10-13 07:57:45 -05:00
|
|
|
'domain is specified'))
|
2013-05-30 07:12:52 -05:00
|
|
|
|
2012-10-26 06:43:05 -05:00
|
|
|
if is_set('ipasecondarybaserid'):
|
2012-09-19 11:09:22 -05:00
|
|
|
raise errors.ValidationError(name='ID Range setup',
|
2013-02-04 07:33:53 -06:00
|
|
|
error=_('Options dom-sid/dom-name and secondary-rid-base '
|
|
|
|
'cannot be used together'))
|
2012-09-05 06:21:04 -05:00
|
|
|
|
2012-09-19 11:09:22 -05:00
|
|
|
# Validate SID as the one of trusted domains
|
2013-06-10 03:45:04 -05:00
|
|
|
self.obj.validate_trusted_domain_sid(
|
|
|
|
entry_attrs['ipanttrusteddomainsid'])
|
2012-10-26 06:43:05 -05:00
|
|
|
|
2013-05-30 07:12:52 -05:00
|
|
|
# ipaNTTrustedDomainSID attribute not set, this is local domain range
|
2012-06-13 13:58:54 -05:00
|
|
|
else:
|
2013-05-30 07:12:52 -05:00
|
|
|
entry_attrs['objectclass'].append('ipadomainidrange')
|
|
|
|
|
|
|
|
# Default to ipa-local if no type set
|
|
|
|
if 'iparangetype' not in entry_attrs:
|
|
|
|
entry_attrs['iparangetype'] = 'ipa-local'
|
|
|
|
|
|
|
|
# TODO: can also be ipa-ad-winsync here?
|
|
|
|
if entry_attrs['iparangetype'] in (u'ipa-ad-trust',
|
|
|
|
u'ipa-ad-trust-posix'):
|
2013-07-12 10:12:07 -05:00
|
|
|
raise errors.ValidationError(name='ID Range setup',
|
2013-05-30 07:12:52 -05:00
|
|
|
error=_('IPA Range type must not be one of ipa-ad-trust '
|
|
|
|
'or ipa-ad-trust-posix when SID of the trusted '
|
|
|
|
'domain is not specified.'))
|
|
|
|
|
2021-04-14 10:34:37 -05:00
|
|
|
# auto private group is possible only for ad trusts
|
|
|
|
if is_set('ipaautoprivategroups') and \
|
|
|
|
entry_attrs['iparangetype'] not in (u'ipa-ad-trust',
|
|
|
|
u'ipa-ad-trust-posix'):
|
|
|
|
raise errors.ValidationError(
|
|
|
|
name='ID Range setup',
|
|
|
|
error=_('IPA Range type must be one of ipa-ad-trust '
|
|
|
|
'or ipa-ad-trust-posix when '
|
|
|
|
'auto-private-groups is specified'))
|
|
|
|
|
2013-05-30 07:12:52 -05:00
|
|
|
# secondary base rid must be set if and only if base rid is set
|
2012-10-26 06:43:05 -05:00
|
|
|
if is_set('ipasecondarybaserid') != is_set('ipabaserid'):
|
2012-09-19 11:09:22 -05:00
|
|
|
raise errors.ValidationError(name='ID Range setup',
|
2013-02-04 07:33:53 -06:00
|
|
|
error=_('Options secondary-rid-base and rid-base must '
|
2012-09-05 06:21:04 -05:00
|
|
|
'be used together'))
|
|
|
|
|
2012-12-21 04:34:37 -06:00
|
|
|
# and they must not overlap
|
2012-10-26 06:43:05 -05:00
|
|
|
if is_set('ipabaserid') and is_set('ipasecondarybaserid'):
|
|
|
|
if self.obj.are_rid_ranges_overlapping(
|
|
|
|
entry_attrs['ipabaserid'],
|
|
|
|
entry_attrs['ipasecondarybaserid'],
|
|
|
|
entry_attrs['ipaidrangesize']):
|
2013-05-09 07:47:29 -05:00
|
|
|
raise errors.ValidationError(name='ID Range setup',
|
|
|
|
error=_("Primary RID range and secondary RID range"
|
|
|
|
" cannot overlap"))
|
2012-10-26 06:43:05 -05:00
|
|
|
|
2013-06-10 17:57:08 -05:00
|
|
|
# rid-base and secondary-rid-base must be set if
|
|
|
|
# ipa-adtrust-install has been run on the system
|
|
|
|
adtrust_is_enabled = api.Command['adtrust_is_enabled']()['result']
|
|
|
|
|
|
|
|
if adtrust_is_enabled and not (
|
|
|
|
is_set('ipabaserid') and is_set('ipasecondarybaserid')):
|
|
|
|
raise errors.ValidationError(
|
|
|
|
name='ID Range setup',
|
|
|
|
error=_(
|
|
|
|
'You must specify both rid-base and '
|
|
|
|
'secondary-rid-base options, because '
|
|
|
|
'ipa-adtrust-install has already been run.'
|
|
|
|
)
|
|
|
|
)
|
2012-06-13 13:58:54 -05:00
|
|
|
return dn
|
|
|
|
|
2012-07-11 07:09:17 -05:00
|
|
|
def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
|
Use DN objects instead of strings
* Convert every string specifying a DN into a DN object
* Every place a dn was manipulated in some fashion it was replaced by
the use of DN operators
* Add new DNParam parameter type for parameters which are DN's
* DN objects are used 100% of the time throughout the entire data
pipeline whenever something is logically a dn.
* Many classes now enforce DN usage for their attributes which are
dn's. This is implmented via ipautil.dn_attribute_property(). The
only permitted types for a class attribute specified to be a DN are
either None or a DN object.
* Require that every place a dn is used it must be a DN object.
This translates into lot of::
assert isinstance(dn, DN)
sprinkled through out the code. Maintaining these asserts is
valuable to preserve DN type enforcement. The asserts can be
disabled in production.
The goal of 100% DN usage 100% of the time has been realized, these
asserts are meant to preserve that.
The asserts also proved valuable in detecting functions which did
not obey their function signatures, such as the baseldap pre and
post callbacks.
* Moved ipalib.dn to ipapython.dn because DN class is shared with all
components, not just the server which uses ipalib.
* All API's now accept DN's natively, no need to convert to str (or
unicode).
* Removed ipalib.encoder and encode/decode decorators. Type conversion
is now explicitly performed in each IPASimpleLDAPObject method which
emulates a ldap.SimpleLDAPObject method.
* Entity & Entry classes now utilize DN's
* Removed __getattr__ in Entity & Entity clases. There were two
problems with it. It presented synthetic Python object attributes
based on the current LDAP data it contained. There is no way to
validate synthetic attributes using code checkers, you can't search
the code to find LDAP attribute accesses (because synthetic
attriutes look like Python attributes instead of LDAP data) and
error handling is circumscribed. Secondly __getattr__ was hiding
Python internal methods which broke class semantics.
* Replace use of methods inherited from ldap.SimpleLDAPObject via
IPAdmin class with IPAdmin methods. Directly using inherited methods
was causing us to bypass IPA logic. Mostly this meant replacing the
use of search_s() with getEntry() or getList(). Similarly direct
access of the LDAP data in classes using IPAdmin were replaced with
calls to getValue() or getValues().
* Objects returned by ldap2.find_entries() are now compatible with
either the python-ldap access methodology or the Entity/Entry access
methodology.
* All ldap operations now funnel through the common
IPASimpleLDAPObject giving us a single location where we interface
to python-ldap and perform conversions.
* The above 4 modifications means we've greatly reduced the
proliferation of multiple inconsistent ways to perform LDAP
operations. We are well on the way to having a single API in IPA for
doing LDAP (a long range goal).
* All certificate subject bases are now DN's
* DN objects were enhanced thusly:
- find, rfind, index, rindex, replace and insert methods were added
- AVA, RDN and DN classes were refactored in immutable and mutable
variants, the mutable variants are EditableAVA, EditableRDN and
EditableDN. By default we use the immutable variants preserving
important semantics. To edit a DN cast it to an EditableDN and
cast it back to DN when done editing. These issues are fully
described in other documentation.
- first_key_match was removed
- DN equalty comparison permits comparison to a basestring
* Fixed ldapupdate to work with DN's. This work included:
- Enhance test_updates.py to do more checking after applying
update. Add test for update_from_dict(). Convert code to use
unittest classes.
- Consolidated duplicate code.
- Moved code which should have been in the class into the class.
- Fix the handling of the 'deleteentry' update action. It's no longer
necessary to supply fake attributes to make it work. Detect case
where subsequent update applies a change to entry previously marked
for deletetion. General clean-up and simplification of the
'deleteentry' logic.
- Rewrote a couple of functions to be clearer and more Pythonic.
- Added documentation on the data structure being used.
- Simplfy the use of update_from_dict()
* Removed all usage of get_schema() which was being called prior to
accessing the .schema attribute of an object. If a class is using
internal lazy loading as an optimization it's not right to require
users of the interface to be aware of internal
optimization's. schema is now a property and when the schema
property is accessed it calls a private internal method to perform
the lazy loading.
* Added SchemaCache class to cache the schema's from individual
servers. This was done because of the observation we talk to
different LDAP servers, each of which may have it's own
schema. Previously we globally cached the schema from the first
server we connected to and returned that schema in all contexts. The
cache includes controls to invalidate it thus forcing a schema
refresh.
* Schema caching is now senstive to the run time context. During
install and upgrade the schema can change leading to errors due to
out-of-date cached schema. The schema cache is refreshed in these
contexts.
* We are aware of the LDAP syntax of all LDAP attributes. Every
attribute returned from an LDAP operation is passed through a
central table look-up based on it's LDAP syntax. The table key is
the LDAP syntax it's value is a Python callable that returns a
Python object matching the LDAP syntax. There are a handful of LDAP
attributes whose syntax is historically incorrect
(e.g. DistguishedNames that are defined as DirectoryStrings). The
table driven conversion mechanism is augmented with a table of
hard coded exceptions.
Currently only the following conversions occur via the table:
- dn's are converted to DN objects
- binary objects are converted to Python str objects (IPA
convention).
- everything else is converted to unicode using UTF-8 decoding (IPA
convention).
However, now that the table driven conversion mechanism is in place
it would be trivial to do things such as converting attributes
which have LDAP integer syntax into a Python integer, etc.
* Expected values in the unit tests which are a DN no longer need to
use lambda expressions to promote the returned value to a DN for
equality comparison. The return value is automatically promoted to
a DN. The lambda expressions have been removed making the code much
simpler and easier to read.
* Add class level logging to a number of classes which did not support
logging, less need for use of root_logger.
* Remove ipaserver/conn.py, it was unused.
* Consolidated duplicate code wherever it was found.
* Fixed many places that used string concatenation to form a new
string rather than string formatting operators. This is necessary
because string formatting converts it's arguments to a string prior
to building the result string. You can't concatenate a string and a
non-string.
* Simplify logic in rename_managed plugin. Use DN operators to edit
dn's.
* The live version of ipa-ldap-updater did not generate a log file.
The offline version did, now both do.
https://fedorahosted.org/freeipa/ticket/1670
https://fedorahosted.org/freeipa/ticket/1671
https://fedorahosted.org/freeipa/ticket/1672
https://fedorahosted.org/freeipa/ticket/1673
https://fedorahosted.org/freeipa/ticket/1674
https://fedorahosted.org/freeipa/ticket/1392
https://fedorahosted.org/freeipa/ticket/2872
2012-05-13 06:36:35 -05:00
|
|
|
assert isinstance(dn, DN)
|
2014-10-13 07:57:45 -05:00
|
|
|
self.obj.handle_ipabaserid(entry_attrs, options)
|
2013-05-30 07:12:52 -05:00
|
|
|
self.obj.handle_iparangetype(entry_attrs, options,
|
|
|
|
keep_objectclass=True)
|
2024-03-21 01:41:07 -05:00
|
|
|
|
|
|
|
if entry_attrs.single_value.get('iparangetype') in (
|
|
|
|
'ipa-local', self.obj.range_types.get('ipa-local', None)):
|
|
|
|
self.add_message(
|
|
|
|
messages.ServiceRestartRequired(
|
|
|
|
service=services.knownservices.dirsrv.service_instance(""),
|
|
|
|
server=_('<all IPA servers>')
|
|
|
|
)
|
2024-03-19 07:29:24 -05:00
|
|
|
)
|
2012-07-11 07:09:17 -05:00
|
|
|
return dn
|
|
|
|
|
2013-06-10 03:45:04 -05:00
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2012-08-23 07:17:34 -05:00
|
|
|
class idrange_del(LDAPDelete):
|
2012-06-13 13:58:54 -05:00
|
|
|
__doc__ = _('Delete an ID range.')
|
|
|
|
|
|
|
|
msg_summary = _('Deleted ID range "%(value)s"')
|
|
|
|
|
2012-09-05 05:28:42 -05:00
|
|
|
def pre_callback(self, ldap, dn, *keys, **options):
|
|
|
|
try:
|
2013-10-31 11:54:21 -05:00
|
|
|
old_attrs = ldap.get_entry(dn, ['ipabaseid',
|
|
|
|
'ipaidrangesize',
|
2024-03-21 01:41:07 -05:00
|
|
|
'ipanttrusteddomainsid',
|
|
|
|
'iparangetype'])
|
2012-09-05 05:28:42 -05:00
|
|
|
except errors.NotFound:
|
2018-01-03 05:11:15 -06:00
|
|
|
raise self.obj.handle_not_found(*keys)
|
2012-09-05 05:28:42 -05:00
|
|
|
|
2013-05-15 08:37:15 -05:00
|
|
|
# Check whether we leave any object with id in deleted range
|
2012-09-05 05:28:42 -05:00
|
|
|
old_base_id = int(old_attrs.get('ipabaseid', [0])[0])
|
|
|
|
old_range_size = int(old_attrs.get('ipaidrangesize', [0])[0])
|
|
|
|
self.obj.check_ids_in_modified_range(
|
|
|
|
old_base_id, old_range_size, 0, 0)
|
2013-05-15 08:37:15 -05:00
|
|
|
|
|
|
|
# Check whether the range does not belong to the active trust
|
|
|
|
range_sid = old_attrs.get('ipanttrusteddomainsid')
|
|
|
|
|
|
|
|
if range_sid is not None:
|
2014-03-13 06:36:17 -05:00
|
|
|
# Search for trusted domain with SID specified in the ID range entry
|
2013-05-15 08:37:15 -05:00
|
|
|
range_sid = range_sid[0]
|
2014-03-13 06:36:17 -05:00
|
|
|
domain_filter=('(&(objectclass=ipaNTTrustedDomain)'
|
|
|
|
'(ipanttrusteddomainsid=%s))' % range_sid)
|
|
|
|
|
|
|
|
try:
|
2016-10-04 13:02:32 -05:00
|
|
|
trust_domains, _truncated = ldap.find_entries(
|
2014-03-13 06:36:17 -05:00
|
|
|
base_dn=DN(api.env.container_trusts, api.env.basedn),
|
|
|
|
filter=domain_filter)
|
|
|
|
except errors.NotFound:
|
|
|
|
pass
|
|
|
|
else:
|
|
|
|
# If there's an entry, it means that there's active domain
|
|
|
|
# of a trust that this range belongs to, so raise a
|
|
|
|
# DependentEntry error
|
2013-05-15 08:37:15 -05:00
|
|
|
raise errors.DependentEntry(
|
2014-03-13 06:36:17 -05:00
|
|
|
label='Active Trust domain',
|
2013-05-15 08:37:15 -05:00
|
|
|
key=keys[0],
|
2014-03-13 06:36:17 -05:00
|
|
|
dependent=trust_domains[0].dn[0].value)
|
|
|
|
|
2024-03-21 01:41:07 -05:00
|
|
|
self.add_message(
|
|
|
|
messages.ServiceRestartRequired(
|
|
|
|
service=services.knownservices['sssd'].systemd_name,
|
|
|
|
server=_('<all IPA servers>')
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
|
|
|
if old_attrs.single_value.get('iparangetype') == 'ipa-local':
|
|
|
|
self.add_message(
|
|
|
|
messages.ServiceRestartRequired(
|
|
|
|
service=services.knownservices.dirsrv.service_instance(""),
|
|
|
|
server=_('<all IPA servers>')
|
|
|
|
)
|
|
|
|
)
|
2013-05-15 08:37:15 -05:00
|
|
|
|
2012-09-05 05:28:42 -05:00
|
|
|
return dn
|
|
|
|
|
2013-06-10 03:45:04 -05:00
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2012-08-23 07:17:34 -05:00
|
|
|
class idrange_find(LDAPSearch):
|
2012-06-13 13:58:54 -05:00
|
|
|
__doc__ = _('Search for ranges.')
|
|
|
|
|
|
|
|
msg_summary = ngettext(
|
|
|
|
'%(count)d range matched', '%(count)d ranges matched', 0
|
|
|
|
)
|
|
|
|
|
|
|
|
# Since all range types are stored within separate containers under
|
|
|
|
# 'cn=ranges,cn=etc' search can be done on a one-level scope
|
2013-06-10 03:45:04 -05:00
|
|
|
def pre_callback(self, ldap, filters, attrs_list, base_dn, scope, *args,
|
|
|
|
**options):
|
Use DN objects instead of strings
* Convert every string specifying a DN into a DN object
* Every place a dn was manipulated in some fashion it was replaced by
the use of DN operators
* Add new DNParam parameter type for parameters which are DN's
* DN objects are used 100% of the time throughout the entire data
pipeline whenever something is logically a dn.
* Many classes now enforce DN usage for their attributes which are
dn's. This is implmented via ipautil.dn_attribute_property(). The
only permitted types for a class attribute specified to be a DN are
either None or a DN object.
* Require that every place a dn is used it must be a DN object.
This translates into lot of::
assert isinstance(dn, DN)
sprinkled through out the code. Maintaining these asserts is
valuable to preserve DN type enforcement. The asserts can be
disabled in production.
The goal of 100% DN usage 100% of the time has been realized, these
asserts are meant to preserve that.
The asserts also proved valuable in detecting functions which did
not obey their function signatures, such as the baseldap pre and
post callbacks.
* Moved ipalib.dn to ipapython.dn because DN class is shared with all
components, not just the server which uses ipalib.
* All API's now accept DN's natively, no need to convert to str (or
unicode).
* Removed ipalib.encoder and encode/decode decorators. Type conversion
is now explicitly performed in each IPASimpleLDAPObject method which
emulates a ldap.SimpleLDAPObject method.
* Entity & Entry classes now utilize DN's
* Removed __getattr__ in Entity & Entity clases. There were two
problems with it. It presented synthetic Python object attributes
based on the current LDAP data it contained. There is no way to
validate synthetic attributes using code checkers, you can't search
the code to find LDAP attribute accesses (because synthetic
attriutes look like Python attributes instead of LDAP data) and
error handling is circumscribed. Secondly __getattr__ was hiding
Python internal methods which broke class semantics.
* Replace use of methods inherited from ldap.SimpleLDAPObject via
IPAdmin class with IPAdmin methods. Directly using inherited methods
was causing us to bypass IPA logic. Mostly this meant replacing the
use of search_s() with getEntry() or getList(). Similarly direct
access of the LDAP data in classes using IPAdmin were replaced with
calls to getValue() or getValues().
* Objects returned by ldap2.find_entries() are now compatible with
either the python-ldap access methodology or the Entity/Entry access
methodology.
* All ldap operations now funnel through the common
IPASimpleLDAPObject giving us a single location where we interface
to python-ldap and perform conversions.
* The above 4 modifications means we've greatly reduced the
proliferation of multiple inconsistent ways to perform LDAP
operations. We are well on the way to having a single API in IPA for
doing LDAP (a long range goal).
* All certificate subject bases are now DN's
* DN objects were enhanced thusly:
- find, rfind, index, rindex, replace and insert methods were added
- AVA, RDN and DN classes were refactored in immutable and mutable
variants, the mutable variants are EditableAVA, EditableRDN and
EditableDN. By default we use the immutable variants preserving
important semantics. To edit a DN cast it to an EditableDN and
cast it back to DN when done editing. These issues are fully
described in other documentation.
- first_key_match was removed
- DN equalty comparison permits comparison to a basestring
* Fixed ldapupdate to work with DN's. This work included:
- Enhance test_updates.py to do more checking after applying
update. Add test for update_from_dict(). Convert code to use
unittest classes.
- Consolidated duplicate code.
- Moved code which should have been in the class into the class.
- Fix the handling of the 'deleteentry' update action. It's no longer
necessary to supply fake attributes to make it work. Detect case
where subsequent update applies a change to entry previously marked
for deletetion. General clean-up and simplification of the
'deleteentry' logic.
- Rewrote a couple of functions to be clearer and more Pythonic.
- Added documentation on the data structure being used.
- Simplfy the use of update_from_dict()
* Removed all usage of get_schema() which was being called prior to
accessing the .schema attribute of an object. If a class is using
internal lazy loading as an optimization it's not right to require
users of the interface to be aware of internal
optimization's. schema is now a property and when the schema
property is accessed it calls a private internal method to perform
the lazy loading.
* Added SchemaCache class to cache the schema's from individual
servers. This was done because of the observation we talk to
different LDAP servers, each of which may have it's own
schema. Previously we globally cached the schema from the first
server we connected to and returned that schema in all contexts. The
cache includes controls to invalidate it thus forcing a schema
refresh.
* Schema caching is now senstive to the run time context. During
install and upgrade the schema can change leading to errors due to
out-of-date cached schema. The schema cache is refreshed in these
contexts.
* We are aware of the LDAP syntax of all LDAP attributes. Every
attribute returned from an LDAP operation is passed through a
central table look-up based on it's LDAP syntax. The table key is
the LDAP syntax it's value is a Python callable that returns a
Python object matching the LDAP syntax. There are a handful of LDAP
attributes whose syntax is historically incorrect
(e.g. DistguishedNames that are defined as DirectoryStrings). The
table driven conversion mechanism is augmented with a table of
hard coded exceptions.
Currently only the following conversions occur via the table:
- dn's are converted to DN objects
- binary objects are converted to Python str objects (IPA
convention).
- everything else is converted to unicode using UTF-8 decoding (IPA
convention).
However, now that the table driven conversion mechanism is in place
it would be trivial to do things such as converting attributes
which have LDAP integer syntax into a Python integer, etc.
* Expected values in the unit tests which are a DN no longer need to
use lambda expressions to promote the returned value to a DN for
equality comparison. The return value is automatically promoted to
a DN. The lambda expressions have been removed making the code much
simpler and easier to read.
* Add class level logging to a number of classes which did not support
logging, less need for use of root_logger.
* Remove ipaserver/conn.py, it was unused.
* Consolidated duplicate code wherever it was found.
* Fixed many places that used string concatenation to form a new
string rather than string formatting operators. This is necessary
because string formatting converts it's arguments to a string prior
to building the result string. You can't concatenate a string and a
non-string.
* Simplify logic in rename_managed plugin. Use DN operators to edit
dn's.
* The live version of ipa-ldap-updater did not generate a log file.
The offline version did, now both do.
https://fedorahosted.org/freeipa/ticket/1670
https://fedorahosted.org/freeipa/ticket/1671
https://fedorahosted.org/freeipa/ticket/1672
https://fedorahosted.org/freeipa/ticket/1673
https://fedorahosted.org/freeipa/ticket/1674
https://fedorahosted.org/freeipa/ticket/1392
https://fedorahosted.org/freeipa/ticket/2872
2012-05-13 06:36:35 -05:00
|
|
|
assert isinstance(base_dn, DN)
|
2012-07-11 07:09:17 -05:00
|
|
|
attrs_list.append('objectclass')
|
2012-06-13 13:58:54 -05:00
|
|
|
return (filters, base_dn, ldap.SCOPE_ONELEVEL)
|
|
|
|
|
2012-07-11 07:09:17 -05:00
|
|
|
def post_callback(self, ldap, entries, truncated, *args, **options):
|
2013-10-31 11:54:21 -05:00
|
|
|
for entry in entries:
|
2014-10-13 07:57:45 -05:00
|
|
|
self.obj.handle_ipabaserid(entry, options)
|
2012-07-11 07:09:17 -05:00
|
|
|
self.obj.handle_iparangetype(entry, options)
|
|
|
|
return truncated
|
|
|
|
|
2013-06-10 03:45:04 -05:00
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2012-08-23 07:17:34 -05:00
|
|
|
class idrange_show(LDAPRetrieve):
|
2012-06-13 13:58:54 -05:00
|
|
|
__doc__ = _('Display information about a range.')
|
|
|
|
|
|
|
|
def pre_callback(self, ldap, dn, attrs_list, *keys, **options):
|
Use DN objects instead of strings
* Convert every string specifying a DN into a DN object
* Every place a dn was manipulated in some fashion it was replaced by
the use of DN operators
* Add new DNParam parameter type for parameters which are DN's
* DN objects are used 100% of the time throughout the entire data
pipeline whenever something is logically a dn.
* Many classes now enforce DN usage for their attributes which are
dn's. This is implmented via ipautil.dn_attribute_property(). The
only permitted types for a class attribute specified to be a DN are
either None or a DN object.
* Require that every place a dn is used it must be a DN object.
This translates into lot of::
assert isinstance(dn, DN)
sprinkled through out the code. Maintaining these asserts is
valuable to preserve DN type enforcement. The asserts can be
disabled in production.
The goal of 100% DN usage 100% of the time has been realized, these
asserts are meant to preserve that.
The asserts also proved valuable in detecting functions which did
not obey their function signatures, such as the baseldap pre and
post callbacks.
* Moved ipalib.dn to ipapython.dn because DN class is shared with all
components, not just the server which uses ipalib.
* All API's now accept DN's natively, no need to convert to str (or
unicode).
* Removed ipalib.encoder and encode/decode decorators. Type conversion
is now explicitly performed in each IPASimpleLDAPObject method which
emulates a ldap.SimpleLDAPObject method.
* Entity & Entry classes now utilize DN's
* Removed __getattr__ in Entity & Entity clases. There were two
problems with it. It presented synthetic Python object attributes
based on the current LDAP data it contained. There is no way to
validate synthetic attributes using code checkers, you can't search
the code to find LDAP attribute accesses (because synthetic
attriutes look like Python attributes instead of LDAP data) and
error handling is circumscribed. Secondly __getattr__ was hiding
Python internal methods which broke class semantics.
* Replace use of methods inherited from ldap.SimpleLDAPObject via
IPAdmin class with IPAdmin methods. Directly using inherited methods
was causing us to bypass IPA logic. Mostly this meant replacing the
use of search_s() with getEntry() or getList(). Similarly direct
access of the LDAP data in classes using IPAdmin were replaced with
calls to getValue() or getValues().
* Objects returned by ldap2.find_entries() are now compatible with
either the python-ldap access methodology or the Entity/Entry access
methodology.
* All ldap operations now funnel through the common
IPASimpleLDAPObject giving us a single location where we interface
to python-ldap and perform conversions.
* The above 4 modifications means we've greatly reduced the
proliferation of multiple inconsistent ways to perform LDAP
operations. We are well on the way to having a single API in IPA for
doing LDAP (a long range goal).
* All certificate subject bases are now DN's
* DN objects were enhanced thusly:
- find, rfind, index, rindex, replace and insert methods were added
- AVA, RDN and DN classes were refactored in immutable and mutable
variants, the mutable variants are EditableAVA, EditableRDN and
EditableDN. By default we use the immutable variants preserving
important semantics. To edit a DN cast it to an EditableDN and
cast it back to DN when done editing. These issues are fully
described in other documentation.
- first_key_match was removed
- DN equalty comparison permits comparison to a basestring
* Fixed ldapupdate to work with DN's. This work included:
- Enhance test_updates.py to do more checking after applying
update. Add test for update_from_dict(). Convert code to use
unittest classes.
- Consolidated duplicate code.
- Moved code which should have been in the class into the class.
- Fix the handling of the 'deleteentry' update action. It's no longer
necessary to supply fake attributes to make it work. Detect case
where subsequent update applies a change to entry previously marked
for deletetion. General clean-up and simplification of the
'deleteentry' logic.
- Rewrote a couple of functions to be clearer and more Pythonic.
- Added documentation on the data structure being used.
- Simplfy the use of update_from_dict()
* Removed all usage of get_schema() which was being called prior to
accessing the .schema attribute of an object. If a class is using
internal lazy loading as an optimization it's not right to require
users of the interface to be aware of internal
optimization's. schema is now a property and when the schema
property is accessed it calls a private internal method to perform
the lazy loading.
* Added SchemaCache class to cache the schema's from individual
servers. This was done because of the observation we talk to
different LDAP servers, each of which may have it's own
schema. Previously we globally cached the schema from the first
server we connected to and returned that schema in all contexts. The
cache includes controls to invalidate it thus forcing a schema
refresh.
* Schema caching is now senstive to the run time context. During
install and upgrade the schema can change leading to errors due to
out-of-date cached schema. The schema cache is refreshed in these
contexts.
* We are aware of the LDAP syntax of all LDAP attributes. Every
attribute returned from an LDAP operation is passed through a
central table look-up based on it's LDAP syntax. The table key is
the LDAP syntax it's value is a Python callable that returns a
Python object matching the LDAP syntax. There are a handful of LDAP
attributes whose syntax is historically incorrect
(e.g. DistguishedNames that are defined as DirectoryStrings). The
table driven conversion mechanism is augmented with a table of
hard coded exceptions.
Currently only the following conversions occur via the table:
- dn's are converted to DN objects
- binary objects are converted to Python str objects (IPA
convention).
- everything else is converted to unicode using UTF-8 decoding (IPA
convention).
However, now that the table driven conversion mechanism is in place
it would be trivial to do things such as converting attributes
which have LDAP integer syntax into a Python integer, etc.
* Expected values in the unit tests which are a DN no longer need to
use lambda expressions to promote the returned value to a DN for
equality comparison. The return value is automatically promoted to
a DN. The lambda expressions have been removed making the code much
simpler and easier to read.
* Add class level logging to a number of classes which did not support
logging, less need for use of root_logger.
* Remove ipaserver/conn.py, it was unused.
* Consolidated duplicate code wherever it was found.
* Fixed many places that used string concatenation to form a new
string rather than string formatting operators. This is necessary
because string formatting converts it's arguments to a string prior
to building the result string. You can't concatenate a string and a
non-string.
* Simplify logic in rename_managed plugin. Use DN operators to edit
dn's.
* The live version of ipa-ldap-updater did not generate a log file.
The offline version did, now both do.
https://fedorahosted.org/freeipa/ticket/1670
https://fedorahosted.org/freeipa/ticket/1671
https://fedorahosted.org/freeipa/ticket/1672
https://fedorahosted.org/freeipa/ticket/1673
https://fedorahosted.org/freeipa/ticket/1674
https://fedorahosted.org/freeipa/ticket/1392
https://fedorahosted.org/freeipa/ticket/2872
2012-05-13 06:36:35 -05:00
|
|
|
assert isinstance(dn, DN)
|
2012-06-13 13:58:54 -05:00
|
|
|
attrs_list.append('objectclass')
|
|
|
|
return dn
|
|
|
|
|
|
|
|
def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
|
Use DN objects instead of strings
* Convert every string specifying a DN into a DN object
* Every place a dn was manipulated in some fashion it was replaced by
the use of DN operators
* Add new DNParam parameter type for parameters which are DN's
* DN objects are used 100% of the time throughout the entire data
pipeline whenever something is logically a dn.
* Many classes now enforce DN usage for their attributes which are
dn's. This is implmented via ipautil.dn_attribute_property(). The
only permitted types for a class attribute specified to be a DN are
either None or a DN object.
* Require that every place a dn is used it must be a DN object.
This translates into lot of::
assert isinstance(dn, DN)
sprinkled through out the code. Maintaining these asserts is
valuable to preserve DN type enforcement. The asserts can be
disabled in production.
The goal of 100% DN usage 100% of the time has been realized, these
asserts are meant to preserve that.
The asserts also proved valuable in detecting functions which did
not obey their function signatures, such as the baseldap pre and
post callbacks.
* Moved ipalib.dn to ipapython.dn because DN class is shared with all
components, not just the server which uses ipalib.
* All API's now accept DN's natively, no need to convert to str (or
unicode).
* Removed ipalib.encoder and encode/decode decorators. Type conversion
is now explicitly performed in each IPASimpleLDAPObject method which
emulates a ldap.SimpleLDAPObject method.
* Entity & Entry classes now utilize DN's
* Removed __getattr__ in Entity & Entity clases. There were two
problems with it. It presented synthetic Python object attributes
based on the current LDAP data it contained. There is no way to
validate synthetic attributes using code checkers, you can't search
the code to find LDAP attribute accesses (because synthetic
attriutes look like Python attributes instead of LDAP data) and
error handling is circumscribed. Secondly __getattr__ was hiding
Python internal methods which broke class semantics.
* Replace use of methods inherited from ldap.SimpleLDAPObject via
IPAdmin class with IPAdmin methods. Directly using inherited methods
was causing us to bypass IPA logic. Mostly this meant replacing the
use of search_s() with getEntry() or getList(). Similarly direct
access of the LDAP data in classes using IPAdmin were replaced with
calls to getValue() or getValues().
* Objects returned by ldap2.find_entries() are now compatible with
either the python-ldap access methodology or the Entity/Entry access
methodology.
* All ldap operations now funnel through the common
IPASimpleLDAPObject giving us a single location where we interface
to python-ldap and perform conversions.
* The above 4 modifications means we've greatly reduced the
proliferation of multiple inconsistent ways to perform LDAP
operations. We are well on the way to having a single API in IPA for
doing LDAP (a long range goal).
* All certificate subject bases are now DN's
* DN objects were enhanced thusly:
- find, rfind, index, rindex, replace and insert methods were added
- AVA, RDN and DN classes were refactored in immutable and mutable
variants, the mutable variants are EditableAVA, EditableRDN and
EditableDN. By default we use the immutable variants preserving
important semantics. To edit a DN cast it to an EditableDN and
cast it back to DN when done editing. These issues are fully
described in other documentation.
- first_key_match was removed
- DN equalty comparison permits comparison to a basestring
* Fixed ldapupdate to work with DN's. This work included:
- Enhance test_updates.py to do more checking after applying
update. Add test for update_from_dict(). Convert code to use
unittest classes.
- Consolidated duplicate code.
- Moved code which should have been in the class into the class.
- Fix the handling of the 'deleteentry' update action. It's no longer
necessary to supply fake attributes to make it work. Detect case
where subsequent update applies a change to entry previously marked
for deletetion. General clean-up and simplification of the
'deleteentry' logic.
- Rewrote a couple of functions to be clearer and more Pythonic.
- Added documentation on the data structure being used.
- Simplfy the use of update_from_dict()
* Removed all usage of get_schema() which was being called prior to
accessing the .schema attribute of an object. If a class is using
internal lazy loading as an optimization it's not right to require
users of the interface to be aware of internal
optimization's. schema is now a property and when the schema
property is accessed it calls a private internal method to perform
the lazy loading.
* Added SchemaCache class to cache the schema's from individual
servers. This was done because of the observation we talk to
different LDAP servers, each of which may have it's own
schema. Previously we globally cached the schema from the first
server we connected to and returned that schema in all contexts. The
cache includes controls to invalidate it thus forcing a schema
refresh.
* Schema caching is now senstive to the run time context. During
install and upgrade the schema can change leading to errors due to
out-of-date cached schema. The schema cache is refreshed in these
contexts.
* We are aware of the LDAP syntax of all LDAP attributes. Every
attribute returned from an LDAP operation is passed through a
central table look-up based on it's LDAP syntax. The table key is
the LDAP syntax it's value is a Python callable that returns a
Python object matching the LDAP syntax. There are a handful of LDAP
attributes whose syntax is historically incorrect
(e.g. DistguishedNames that are defined as DirectoryStrings). The
table driven conversion mechanism is augmented with a table of
hard coded exceptions.
Currently only the following conversions occur via the table:
- dn's are converted to DN objects
- binary objects are converted to Python str objects (IPA
convention).
- everything else is converted to unicode using UTF-8 decoding (IPA
convention).
However, now that the table driven conversion mechanism is in place
it would be trivial to do things such as converting attributes
which have LDAP integer syntax into a Python integer, etc.
* Expected values in the unit tests which are a DN no longer need to
use lambda expressions to promote the returned value to a DN for
equality comparison. The return value is automatically promoted to
a DN. The lambda expressions have been removed making the code much
simpler and easier to read.
* Add class level logging to a number of classes which did not support
logging, less need for use of root_logger.
* Remove ipaserver/conn.py, it was unused.
* Consolidated duplicate code wherever it was found.
* Fixed many places that used string concatenation to form a new
string rather than string formatting operators. This is necessary
because string formatting converts it's arguments to a string prior
to building the result string. You can't concatenate a string and a
non-string.
* Simplify logic in rename_managed plugin. Use DN operators to edit
dn's.
* The live version of ipa-ldap-updater did not generate a log file.
The offline version did, now both do.
https://fedorahosted.org/freeipa/ticket/1670
https://fedorahosted.org/freeipa/ticket/1671
https://fedorahosted.org/freeipa/ticket/1672
https://fedorahosted.org/freeipa/ticket/1673
https://fedorahosted.org/freeipa/ticket/1674
https://fedorahosted.org/freeipa/ticket/1392
https://fedorahosted.org/freeipa/ticket/2872
2012-05-13 06:36:35 -05:00
|
|
|
assert isinstance(dn, DN)
|
2014-10-13 07:57:45 -05:00
|
|
|
self.obj.handle_ipabaserid(entry_attrs, options)
|
2012-07-11 07:09:17 -05:00
|
|
|
self.obj.handle_iparangetype(entry_attrs, options)
|
|
|
|
return dn
|
|
|
|
|
2013-06-10 03:45:04 -05:00
|
|
|
|
2014-06-10 10:27:51 -05:00
|
|
|
@register()
|
2012-08-23 07:17:34 -05:00
|
|
|
class idrange_mod(LDAPUpdate):
|
2015-08-07 08:44:57 -05:00
|
|
|
__doc__ = _("""Modify ID range.
|
|
|
|
|
2018-06-20 04:13:08 -05:00
|
|
|
""") + ID_RANGE_VS_DNA_WARNING
|
2012-07-11 07:09:17 -05:00
|
|
|
|
|
|
|
msg_summary = _('Modified ID range "%(value)s"')
|
|
|
|
|
2013-05-29 08:15:19 -05:00
|
|
|
takes_options = LDAPUpdate.takes_options + (
|
2016-06-02 08:58:43 -05:00
|
|
|
Str(
|
|
|
|
'ipanttrusteddomainsid?',
|
|
|
|
deprecated=True,
|
|
|
|
cli_name='dom_sid',
|
|
|
|
flags=('no_update', 'no_option'),
|
|
|
|
label=_('Domain SID of the trusted domain'),
|
|
|
|
autofill=False,
|
|
|
|
),
|
|
|
|
Str(
|
|
|
|
'ipanttrusteddomainname?',
|
|
|
|
deprecated=True,
|
|
|
|
cli_name='dom_name',
|
|
|
|
flags=('no_search', 'virtual_attribute', 'no_update', 'no_option'),
|
|
|
|
label=_('Name of the trusted domain'),
|
|
|
|
autofill=False,
|
|
|
|
),
|
2013-05-29 08:15:19 -05:00
|
|
|
)
|
|
|
|
|
2012-07-11 07:09:17 -05:00
|
|
|
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
|
Use DN objects instead of strings
* Convert every string specifying a DN into a DN object
* Every place a dn was manipulated in some fashion it was replaced by
the use of DN operators
* Add new DNParam parameter type for parameters which are DN's
* DN objects are used 100% of the time throughout the entire data
pipeline whenever something is logically a dn.
* Many classes now enforce DN usage for their attributes which are
dn's. This is implmented via ipautil.dn_attribute_property(). The
only permitted types for a class attribute specified to be a DN are
either None or a DN object.
* Require that every place a dn is used it must be a DN object.
This translates into lot of::
assert isinstance(dn, DN)
sprinkled through out the code. Maintaining these asserts is
valuable to preserve DN type enforcement. The asserts can be
disabled in production.
The goal of 100% DN usage 100% of the time has been realized, these
asserts are meant to preserve that.
The asserts also proved valuable in detecting functions which did
not obey their function signatures, such as the baseldap pre and
post callbacks.
* Moved ipalib.dn to ipapython.dn because DN class is shared with all
components, not just the server which uses ipalib.
* All API's now accept DN's natively, no need to convert to str (or
unicode).
* Removed ipalib.encoder and encode/decode decorators. Type conversion
is now explicitly performed in each IPASimpleLDAPObject method which
emulates a ldap.SimpleLDAPObject method.
* Entity & Entry classes now utilize DN's
* Removed __getattr__ in Entity & Entity clases. There were two
problems with it. It presented synthetic Python object attributes
based on the current LDAP data it contained. There is no way to
validate synthetic attributes using code checkers, you can't search
the code to find LDAP attribute accesses (because synthetic
attriutes look like Python attributes instead of LDAP data) and
error handling is circumscribed. Secondly __getattr__ was hiding
Python internal methods which broke class semantics.
* Replace use of methods inherited from ldap.SimpleLDAPObject via
IPAdmin class with IPAdmin methods. Directly using inherited methods
was causing us to bypass IPA logic. Mostly this meant replacing the
use of search_s() with getEntry() or getList(). Similarly direct
access of the LDAP data in classes using IPAdmin were replaced with
calls to getValue() or getValues().
* Objects returned by ldap2.find_entries() are now compatible with
either the python-ldap access methodology or the Entity/Entry access
methodology.
* All ldap operations now funnel through the common
IPASimpleLDAPObject giving us a single location where we interface
to python-ldap and perform conversions.
* The above 4 modifications means we've greatly reduced the
proliferation of multiple inconsistent ways to perform LDAP
operations. We are well on the way to having a single API in IPA for
doing LDAP (a long range goal).
* All certificate subject bases are now DN's
* DN objects were enhanced thusly:
- find, rfind, index, rindex, replace and insert methods were added
- AVA, RDN and DN classes were refactored in immutable and mutable
variants, the mutable variants are EditableAVA, EditableRDN and
EditableDN. By default we use the immutable variants preserving
important semantics. To edit a DN cast it to an EditableDN and
cast it back to DN when done editing. These issues are fully
described in other documentation.
- first_key_match was removed
- DN equalty comparison permits comparison to a basestring
* Fixed ldapupdate to work with DN's. This work included:
- Enhance test_updates.py to do more checking after applying
update. Add test for update_from_dict(). Convert code to use
unittest classes.
- Consolidated duplicate code.
- Moved code which should have been in the class into the class.
- Fix the handling of the 'deleteentry' update action. It's no longer
necessary to supply fake attributes to make it work. Detect case
where subsequent update applies a change to entry previously marked
for deletetion. General clean-up and simplification of the
'deleteentry' logic.
- Rewrote a couple of functions to be clearer and more Pythonic.
- Added documentation on the data structure being used.
- Simplfy the use of update_from_dict()
* Removed all usage of get_schema() which was being called prior to
accessing the .schema attribute of an object. If a class is using
internal lazy loading as an optimization it's not right to require
users of the interface to be aware of internal
optimization's. schema is now a property and when the schema
property is accessed it calls a private internal method to perform
the lazy loading.
* Added SchemaCache class to cache the schema's from individual
servers. This was done because of the observation we talk to
different LDAP servers, each of which may have it's own
schema. Previously we globally cached the schema from the first
server we connected to and returned that schema in all contexts. The
cache includes controls to invalidate it thus forcing a schema
refresh.
* Schema caching is now senstive to the run time context. During
install and upgrade the schema can change leading to errors due to
out-of-date cached schema. The schema cache is refreshed in these
contexts.
* We are aware of the LDAP syntax of all LDAP attributes. Every
attribute returned from an LDAP operation is passed through a
central table look-up based on it's LDAP syntax. The table key is
the LDAP syntax it's value is a Python callable that returns a
Python object matching the LDAP syntax. There are a handful of LDAP
attributes whose syntax is historically incorrect
(e.g. DistguishedNames that are defined as DirectoryStrings). The
table driven conversion mechanism is augmented with a table of
hard coded exceptions.
Currently only the following conversions occur via the table:
- dn's are converted to DN objects
- binary objects are converted to Python str objects (IPA
convention).
- everything else is converted to unicode using UTF-8 decoding (IPA
convention).
However, now that the table driven conversion mechanism is in place
it would be trivial to do things such as converting attributes
which have LDAP integer syntax into a Python integer, etc.
* Expected values in the unit tests which are a DN no longer need to
use lambda expressions to promote the returned value to a DN for
equality comparison. The return value is automatically promoted to
a DN. The lambda expressions have been removed making the code much
simpler and easier to read.
* Add class level logging to a number of classes which did not support
logging, less need for use of root_logger.
* Remove ipaserver/conn.py, it was unused.
* Consolidated duplicate code wherever it was found.
* Fixed many places that used string concatenation to form a new
string rather than string formatting operators. This is necessary
because string formatting converts it's arguments to a string prior
to building the result string. You can't concatenate a string and a
non-string.
* Simplify logic in rename_managed plugin. Use DN operators to edit
dn's.
* The live version of ipa-ldap-updater did not generate a log file.
The offline version did, now both do.
https://fedorahosted.org/freeipa/ticket/1670
https://fedorahosted.org/freeipa/ticket/1671
https://fedorahosted.org/freeipa/ticket/1672
https://fedorahosted.org/freeipa/ticket/1673
https://fedorahosted.org/freeipa/ticket/1674
https://fedorahosted.org/freeipa/ticket/1392
https://fedorahosted.org/freeipa/ticket/2872
2012-05-13 06:36:35 -05:00
|
|
|
assert isinstance(dn, DN)
|
2012-07-11 07:09:17 -05:00
|
|
|
attrs_list.append('objectclass')
|
2012-09-05 05:28:42 -05:00
|
|
|
|
2012-12-21 04:34:37 -06:00
|
|
|
try:
|
2013-10-31 11:54:21 -05:00
|
|
|
old_attrs = ldap.get_entry(dn, ['*'])
|
2012-12-21 04:34:37 -06:00
|
|
|
except errors.NotFound:
|
2018-01-03 05:11:15 -06:00
|
|
|
raise self.obj.handle_not_found(*keys)
|
2012-12-21 04:34:37 -06:00
|
|
|
|
2021-03-19 05:48:38 -05:00
|
|
|
if (
|
|
|
|
old_attrs['iparangetype'][0] in {'ipa-local', 'ipa-local-subid'}
|
|
|
|
or old_attrs['cn'][0] == f'{self.api.env.realm}_subid_range'
|
|
|
|
):
|
2015-08-07 08:44:57 -05:00
|
|
|
raise errors.ExecutionError(
|
|
|
|
message=_('This command can not be used to change ID '
|
|
|
|
'allocation for local IPA domain. Run '
|
|
|
|
'`ipa help idrange` for more information')
|
|
|
|
)
|
|
|
|
|
2022-12-19 10:01:45 -06:00
|
|
|
def is_set(x):
|
|
|
|
return entry_attrs.get(x) is not None
|
|
|
|
|
|
|
|
def in_updated_attrs(x):
|
|
|
|
return is_set(x) or (
|
|
|
|
x not in entry_attrs and old_attrs.get(x) is not None
|
|
|
|
)
|
2012-10-26 06:43:05 -05:00
|
|
|
|
2013-02-04 07:33:53 -06:00
|
|
|
# This needs to stay in options since there is no
|
|
|
|
# ipanttrusteddomainname attribute in LDAP
|
|
|
|
if 'ipanttrusteddomainname' in options:
|
|
|
|
if is_set('ipanttrusteddomainsid'):
|
|
|
|
raise errors.ValidationError(name='ID Range setup',
|
|
|
|
error=_('Options dom-sid and dom-name '
|
|
|
|
'cannot be used together'))
|
|
|
|
|
|
|
|
sid = self.obj.get_trusted_domain_sid_from_name(
|
|
|
|
options['ipanttrusteddomainname'])
|
|
|
|
|
2012-12-21 04:34:37 -06:00
|
|
|
# we translate the name into sid so further validation can rely
|
|
|
|
# on ipanttrusteddomainsid attribute only
|
2013-02-04 07:33:53 -06:00
|
|
|
if sid is not None:
|
|
|
|
entry_attrs['ipanttrusteddomainsid'] = sid
|
|
|
|
else:
|
|
|
|
raise errors.ValidationError(name='ID Range setup',
|
|
|
|
error=_('SID for the specified trusted domain name could '
|
|
|
|
'not be found. Please specify the SID directly '
|
|
|
|
'using dom-sid option.'))
|
|
|
|
|
2012-12-21 04:34:37 -06:00
|
|
|
if in_updated_attrs('ipanttrusteddomainsid'):
|
|
|
|
if in_updated_attrs('ipasecondarybaserid'):
|
|
|
|
raise errors.ValidationError(name='ID Range setup',
|
|
|
|
error=_('Options dom-sid and secondary-rid-base cannot '
|
|
|
|
'be used together'))
|
2014-10-13 07:57:45 -05:00
|
|
|
range_type = old_attrs['iparangetype'][0]
|
|
|
|
if range_type == u'ipa-ad-trust':
|
|
|
|
if not in_updated_attrs('ipabaserid'):
|
|
|
|
raise errors.ValidationError(
|
|
|
|
name='ID Range setup',
|
|
|
|
error=_('Options dom-sid and rid-base must '
|
|
|
|
'be used together'))
|
|
|
|
elif (range_type == u'ipa-ad-trust-posix' and
|
|
|
|
'ipabaserid' in entry_attrs):
|
|
|
|
if entry_attrs['ipabaserid'] is None:
|
|
|
|
entry_attrs['ipabaserid'] = 0
|
|
|
|
elif entry_attrs['ipabaserid'] != 0:
|
|
|
|
raise errors.ValidationError(
|
|
|
|
name='ID Range setup',
|
|
|
|
error=_('Option rid-base must not be used when IPA '
|
|
|
|
'range type is ipa-ad-trust-posix')
|
|
|
|
)
|
2012-12-21 04:34:37 -06:00
|
|
|
|
|
|
|
if is_set('ipanttrusteddomainsid'):
|
|
|
|
# Validate SID as the one of trusted domains
|
|
|
|
# perform this check only if the attribute was changed
|
|
|
|
self.obj.validate_trusted_domain_sid(
|
|
|
|
entry_attrs['ipanttrusteddomainsid'])
|
2013-02-20 03:50:36 -06:00
|
|
|
|
2013-06-10 03:45:04 -05:00
|
|
|
# Add trusted AD domain range object class, if it wasn't there
|
2020-04-30 08:12:34 -05:00
|
|
|
if 'ipatrustedaddomainrange' not in old_attrs['objectclass']:
|
2013-02-20 03:50:36 -06:00
|
|
|
entry_attrs['objectclass'].append('ipatrustedaddomainrange')
|
|
|
|
|
2012-12-21 04:34:37 -06:00
|
|
|
else:
|
|
|
|
# secondary base rid must be set if and only if base rid is set
|
|
|
|
if in_updated_attrs('ipasecondarybaserid') !=\
|
|
|
|
in_updated_attrs('ipabaserid'):
|
|
|
|
raise errors.ValidationError(name='ID Range setup',
|
|
|
|
error=_('Options secondary-rid-base and rid-base must '
|
|
|
|
'be used together'))
|
2012-09-19 11:09:22 -05:00
|
|
|
|
2012-10-26 06:43:05 -05:00
|
|
|
# ensure that primary and secondary rid ranges do not overlap
|
2012-12-21 04:34:37 -06:00
|
|
|
if all(in_updated_attrs(base)
|
|
|
|
for base in ('ipabaserid', 'ipasecondarybaserid')):
|
2012-10-26 06:43:05 -05:00
|
|
|
|
|
|
|
# make sure we are working with updated attributes
|
2012-12-21 04:34:37 -06:00
|
|
|
rid_range_attributes = ('ipabaserid', 'ipasecondarybaserid',
|
|
|
|
'ipaidrangesize')
|
2012-10-26 06:43:05 -05:00
|
|
|
updated_values = dict()
|
|
|
|
|
|
|
|
for attr in rid_range_attributes:
|
|
|
|
if is_set(attr):
|
|
|
|
updated_values[attr] = entry_attrs[attr]
|
|
|
|
else:
|
|
|
|
updated_values[attr] = int(old_attrs[attr][0])
|
|
|
|
|
|
|
|
if self.obj.are_rid_ranges_overlapping(
|
|
|
|
updated_values['ipabaserid'],
|
|
|
|
updated_values['ipasecondarybaserid'],
|
|
|
|
updated_values['ipaidrangesize']):
|
|
|
|
raise errors.ValidationError(name='ID Range setup',
|
|
|
|
error=_("Primary RID range and secondary RID range"
|
|
|
|
" cannot overlap"))
|
|
|
|
|
2012-12-21 04:34:37 -06:00
|
|
|
# check whether ids are in modified range
|
2012-09-05 05:28:42 -05:00
|
|
|
old_base_id = int(old_attrs.get('ipabaseid', [0])[0])
|
|
|
|
old_range_size = int(old_attrs.get('ipaidrangesize', [0])[0])
|
|
|
|
new_base_id = entry_attrs.get('ipabaseid')
|
2012-12-21 04:34:37 -06:00
|
|
|
|
2012-09-05 05:28:42 -05:00
|
|
|
if new_base_id is not None:
|
|
|
|
new_base_id = int(new_base_id)
|
2012-12-21 04:34:37 -06:00
|
|
|
|
2012-09-05 05:28:42 -05:00
|
|
|
new_range_size = entry_attrs.get('ipaidrangesize')
|
2012-12-21 04:34:37 -06:00
|
|
|
|
2012-09-05 05:28:42 -05:00
|
|
|
if new_range_size is not None:
|
|
|
|
new_range_size = int(new_range_size)
|
2012-12-21 04:34:37 -06:00
|
|
|
|
2012-09-05 05:28:42 -05:00
|
|
|
self.obj.check_ids_in_modified_range(old_base_id, old_range_size,
|
|
|
|
new_base_id, new_range_size)
|
|
|
|
|
2012-07-11 07:09:17 -05:00
|
|
|
return dn
|
|
|
|
|
|
|
|
def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
|
Use DN objects instead of strings
* Convert every string specifying a DN into a DN object
* Every place a dn was manipulated in some fashion it was replaced by
the use of DN operators
* Add new DNParam parameter type for parameters which are DN's
* DN objects are used 100% of the time throughout the entire data
pipeline whenever something is logically a dn.
* Many classes now enforce DN usage for their attributes which are
dn's. This is implmented via ipautil.dn_attribute_property(). The
only permitted types for a class attribute specified to be a DN are
either None or a DN object.
* Require that every place a dn is used it must be a DN object.
This translates into lot of::
assert isinstance(dn, DN)
sprinkled through out the code. Maintaining these asserts is
valuable to preserve DN type enforcement. The asserts can be
disabled in production.
The goal of 100% DN usage 100% of the time has been realized, these
asserts are meant to preserve that.
The asserts also proved valuable in detecting functions which did
not obey their function signatures, such as the baseldap pre and
post callbacks.
* Moved ipalib.dn to ipapython.dn because DN class is shared with all
components, not just the server which uses ipalib.
* All API's now accept DN's natively, no need to convert to str (or
unicode).
* Removed ipalib.encoder and encode/decode decorators. Type conversion
is now explicitly performed in each IPASimpleLDAPObject method which
emulates a ldap.SimpleLDAPObject method.
* Entity & Entry classes now utilize DN's
* Removed __getattr__ in Entity & Entity clases. There were two
problems with it. It presented synthetic Python object attributes
based on the current LDAP data it contained. There is no way to
validate synthetic attributes using code checkers, you can't search
the code to find LDAP attribute accesses (because synthetic
attriutes look like Python attributes instead of LDAP data) and
error handling is circumscribed. Secondly __getattr__ was hiding
Python internal methods which broke class semantics.
* Replace use of methods inherited from ldap.SimpleLDAPObject via
IPAdmin class with IPAdmin methods. Directly using inherited methods
was causing us to bypass IPA logic. Mostly this meant replacing the
use of search_s() with getEntry() or getList(). Similarly direct
access of the LDAP data in classes using IPAdmin were replaced with
calls to getValue() or getValues().
* Objects returned by ldap2.find_entries() are now compatible with
either the python-ldap access methodology or the Entity/Entry access
methodology.
* All ldap operations now funnel through the common
IPASimpleLDAPObject giving us a single location where we interface
to python-ldap and perform conversions.
* The above 4 modifications means we've greatly reduced the
proliferation of multiple inconsistent ways to perform LDAP
operations. We are well on the way to having a single API in IPA for
doing LDAP (a long range goal).
* All certificate subject bases are now DN's
* DN objects were enhanced thusly:
- find, rfind, index, rindex, replace and insert methods were added
- AVA, RDN and DN classes were refactored in immutable and mutable
variants, the mutable variants are EditableAVA, EditableRDN and
EditableDN. By default we use the immutable variants preserving
important semantics. To edit a DN cast it to an EditableDN and
cast it back to DN when done editing. These issues are fully
described in other documentation.
- first_key_match was removed
- DN equalty comparison permits comparison to a basestring
* Fixed ldapupdate to work with DN's. This work included:
- Enhance test_updates.py to do more checking after applying
update. Add test for update_from_dict(). Convert code to use
unittest classes.
- Consolidated duplicate code.
- Moved code which should have been in the class into the class.
- Fix the handling of the 'deleteentry' update action. It's no longer
necessary to supply fake attributes to make it work. Detect case
where subsequent update applies a change to entry previously marked
for deletetion. General clean-up and simplification of the
'deleteentry' logic.
- Rewrote a couple of functions to be clearer and more Pythonic.
- Added documentation on the data structure being used.
- Simplfy the use of update_from_dict()
* Removed all usage of get_schema() which was being called prior to
accessing the .schema attribute of an object. If a class is using
internal lazy loading as an optimization it's not right to require
users of the interface to be aware of internal
optimization's. schema is now a property and when the schema
property is accessed it calls a private internal method to perform
the lazy loading.
* Added SchemaCache class to cache the schema's from individual
servers. This was done because of the observation we talk to
different LDAP servers, each of which may have it's own
schema. Previously we globally cached the schema from the first
server we connected to and returned that schema in all contexts. The
cache includes controls to invalidate it thus forcing a schema
refresh.
* Schema caching is now senstive to the run time context. During
install and upgrade the schema can change leading to errors due to
out-of-date cached schema. The schema cache is refreshed in these
contexts.
* We are aware of the LDAP syntax of all LDAP attributes. Every
attribute returned from an LDAP operation is passed through a
central table look-up based on it's LDAP syntax. The table key is
the LDAP syntax it's value is a Python callable that returns a
Python object matching the LDAP syntax. There are a handful of LDAP
attributes whose syntax is historically incorrect
(e.g. DistguishedNames that are defined as DirectoryStrings). The
table driven conversion mechanism is augmented with a table of
hard coded exceptions.
Currently only the following conversions occur via the table:
- dn's are converted to DN objects
- binary objects are converted to Python str objects (IPA
convention).
- everything else is converted to unicode using UTF-8 decoding (IPA
convention).
However, now that the table driven conversion mechanism is in place
it would be trivial to do things such as converting attributes
which have LDAP integer syntax into a Python integer, etc.
* Expected values in the unit tests which are a DN no longer need to
use lambda expressions to promote the returned value to a DN for
equality comparison. The return value is automatically promoted to
a DN. The lambda expressions have been removed making the code much
simpler and easier to read.
* Add class level logging to a number of classes which did not support
logging, less need for use of root_logger.
* Remove ipaserver/conn.py, it was unused.
* Consolidated duplicate code wherever it was found.
* Fixed many places that used string concatenation to form a new
string rather than string formatting operators. This is necessary
because string formatting converts it's arguments to a string prior
to building the result string. You can't concatenate a string and a
non-string.
* Simplify logic in rename_managed plugin. Use DN operators to edit
dn's.
* The live version of ipa-ldap-updater did not generate a log file.
The offline version did, now both do.
https://fedorahosted.org/freeipa/ticket/1670
https://fedorahosted.org/freeipa/ticket/1671
https://fedorahosted.org/freeipa/ticket/1672
https://fedorahosted.org/freeipa/ticket/1673
https://fedorahosted.org/freeipa/ticket/1674
https://fedorahosted.org/freeipa/ticket/1392
https://fedorahosted.org/freeipa/ticket/2872
2012-05-13 06:36:35 -05:00
|
|
|
assert isinstance(dn, DN)
|
2014-10-13 07:57:45 -05:00
|
|
|
self.obj.handle_ipabaserid(entry_attrs, options)
|
2012-07-11 07:09:17 -05:00
|
|
|
self.obj.handle_iparangetype(entry_attrs, options)
|
2024-03-21 01:41:07 -05:00
|
|
|
|
|
|
|
if entry_attrs.single_value.get('iparangetype') in (
|
|
|
|
'ipa-local', self.obj.range_types.get('ipa-local', None)):
|
|
|
|
self.add_message(
|
|
|
|
messages.ServiceRestartRequired(
|
|
|
|
service=services.knownservices.dirsrv.service_instance(""),
|
|
|
|
server=_('<all IPA servers>')
|
|
|
|
)
|
|
|
|
)
|
|
|
|
|
2019-03-27 12:26:36 -05:00
|
|
|
self.add_message(
|
|
|
|
messages.ServiceRestartRequired(
|
|
|
|
service=services.knownservices['sssd'].systemd_name,
|
2024-03-21 01:41:07 -05:00
|
|
|
server=_('<all IPA servers>')
|
2019-03-27 12:26:36 -05:00
|
|
|
)
|
|
|
|
)
|
2012-06-13 13:58:54 -05:00
|
|
|
return dn
|