Add option to only prompt once for passwords, use in entitle_register

A Password param always prompted to confirm the entered password.
This doesn't make sense if you want to prompt for a password to another
system like we do with entitlements. This adds a new boolean option to
control the Password prompt parameter.

https://fedorahosted.org/freeipa/ticket/1695

API.txt

@@ -885,7 +885,7 @@ arg: Str('username', label=Gettext('Username', domain='ipa', localedir=None))
 option: Str('addattr*', validate_add_attribute, cli_name='addattr', exclude='webui')
 option: Str('setattr*', validate_set_attribute, cli_name='setattr', exclude='webui')
 option: Str('ipaentitlementid?', flags=['no_create', 'no_update'], label='UUID')
-option: Password('password', label=Gettext('Password', domain='ipa', localedir=None))
+option: Password('password', confirm=False, label=Gettext('Password', domain='ipa', localedir=None))
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui', flags=['no_output'])
 option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui', flags=['no_output'])
 option: Str('version?', exclude='webui', flags=['no_option', 'no_output'])

ipalib/cli.py

@@ -536,7 +536,7 @@ class textui(backend.Backend):
 
         If Default parameter is not None, user can enter an empty input instead
         of Yes/No answer. Value passed to Default is returned in that case.
-        
+
         If Default parameter is None, user is asked for Yes/No answer until
         a correct answer is provided. Answer is then returned.
 
@@ -568,7 +568,7 @@ class textui(backend.Backend):
             elif default is not None and data == u'':
                 return default
 
-    def prompt_password(self, label):
+    def prompt_password(self, label, confirm=True):
         """
         Prompt user for a password or read it in via stdin depending
         on whether there is a tty or not.
@@ -577,6 +577,8 @@ class textui(backend.Backend):
             if sys.stdin.isatty():
                 while True:
                     pw1 = getpass.getpass(u'%s: ' % unicode(label))
+                    if not confirm:
+                        return self.decode(pw1)
                     pw2 = getpass.getpass(
                         unicode(_('Enter %(label)s again to verify: ') % dict(label=label))
                     )
@@ -1050,7 +1052,7 @@ class cli(backend.Executioner):
                 (param.alwaysask and honor_alwaysask) or self.env.prompt_all:
                 if param.password:
                     kw[param.name] = self.Backend.textui.prompt_password(
-                        param.label
+                        param.label, param.confirm
                     )
                 elif param.autofill:
                     kw[param.name] = param.get_default(**kw)
@@ -1070,7 +1072,7 @@ class cli(backend.Executioner):
                             error = e.error
             elif param.password and kw.get(param.name, False) is True:
                 kw[param.name] = self.Backend.textui.prompt_password(
-                    param.label
+                    param.label, param.confirm
                 )
 
         for callback in getattr(cmd, 'INTERACTIVE_PROMPT_CALLBACKS', []):

ipalib/parameters.py

@@ -1369,6 +1369,10 @@ class Password(Str):
     A parameter for passwords (stored in the ``unicode`` type).
     """
 
+    kwargs = Str.kwargs + (
+        ('confirm', bool, True),
+    )
+
     def _convert_scalar(self, value, index=None):
         if isinstance(value, (tuple, list)) and len(value) == 2:
             (p1, p2) = value

ipalib/plugins/entitle.py

@@ -494,6 +494,7 @@ class entitle_register(LDAPCreate):
         Password('password',
             label=_('Password'),
             doc=_('Registration password'),
+            confirm=False,
         ),
     )