Convert --setattr values for attributes marked no_update

Attribute Patrams marked no_update never get cloned to Update commands,
and thus never receive the `attribute` flag. This makes their `encode`
method a no-op, which meant they don't get properly encoded when used
with --setattr, making the --setattr fail.

Introduce a `force` argument to encode, which overrides checking
for the attribute flag. Use this in set/add/delattr normalization,
where we know we are dealing with attributes.

https://fedorahosted.org/freeipa/ticket/2616

ipalib/parameters.py

@@ -895,7 +895,7 @@ class Param(ReadOnly):
                     rule=rule,
                 )
 
-    def encode(self, value):
+    def encode(self, value, force=False):
         """
         Encode Python native type value to chosen backend format. Encoding is
         applied for parameters representing actual attributes (attribute=True).
@@ -909,8 +909,10 @@ class Param(ReadOnly):
         `Param._encode()`.
 
         :param value: Encoded value
+        :param force: If set to true, encoding takes place even for Params
+            not marked as attribute
         """
-        if not self.attribute: #pylint: disable=E1101
+        if not self.attribute and not force: #pylint: disable=E1101
             return value
         if self.encoder is not None: #pylint: disable=E1101
             return self.encoder(value) #pylint: disable=E1101

ipalib/plugins/baseldap.py

@@ -937,7 +937,12 @@ last, after all sets and adds."""),
                     raise errors.ValidationError(name=attr, error=err.error)
                 except errors.ConversionError, err:
                     raise errors.ConversionError(name=attr, error=err.error)
-                value = param.encode(value)
+                # FIXME: We use `force` when encoding because we know this is
+                # an attribute, even if it does not have the `attribute` flag
+                # set. This happens with no_update attributes, which are
+                # not cloned to Update commands. This cloning is where the flag
+                # gets set.
+                value = param.encode(value, force=True)
                 entry_attrs[attr] = value
             else:
                 # unknown attribute: remove duplicite and invalid values

tests/test_xmlrpc/test_attr.py

@@ -433,7 +433,7 @@ class test_attr(Declarative):
             command=(
                 'user_mod', [user1], dict(
                     addattr=u'nsaccountlock=FaLsE',
-                    delattr=u'nsaccountlock=True')
+                    delattr=u'nsaccountlock=TRUE')
             ),
             expected=dict(
                 result=dict(

tests/test_xmlrpc/test_hbac_plugin.py

@@ -430,6 +430,27 @@ class test_hbac(XMLRPC_test):
          # FIXME: Should this be 'enabled' or 'TRUE'?
         assert_attr_equal(entry, 'ipaenabledflag', 'TRUE')
 
+    def test_ea_hbacrule_disable_setattr(self):
+        """
+        Test disabling HBAC rule using setattr
+        """
+        command_result = api.Command['hbacrule_mod'](
+            self.rule_name, setattr=u'ipaenabledflag=false')
+        assert command_result['result']['ipaenabledflag'] == (u'FALSE',)
+        entry = api.Command['hbacrule_show'](self.rule_name)['result']
+        assert_attr_equal(entry, 'ipaenabledflag', 'FALSE')
+
+    def test_eb_hbacrule_enable_setattr(self):
+        """
+        Test enabling HBAC rule using setattr
+        """
+        command_result = api.Command['hbacrule_mod'](
+            self.rule_name, setattr=u'ipaenabledflag=1')
+        assert command_result['result']['ipaenabledflag'] == (u'TRUE',)
+        # check it's really enabled
+        entry = api.Command['hbacrule_show'](self.rule_name)['result']
+        assert_attr_equal(entry, 'ipaenabledflag', 'TRUE')
+
     @raises(errors.MutuallyExclusiveError)
     def test_f_hbacrule_exclusiveuser(self):
         """