Fix returning effective rights for password policy.

This also returns the rights for cospriority if the policy is for a group.

ticket 449

ipalib/plugins/baseldap.py

@@ -151,7 +151,7 @@ def get_attributes(attrs):
 
 def get_effective_rights(ldap, dn, attrs=None):
     if attrs is None:
-        attrs = ['*', 'nsaccountlock']
+        attrs = ['*', 'nsaccountlock', 'cospriority']
     rights = ldap.get_effective_rights(dn, attrs)
     rdict = {}
     if 'attributelevelrights' in rights[1]:

ipalib/plugins/pwpolicy.py

@@ -401,7 +401,7 @@ class pwpolicy_show(LDAPRetrieve):
     """
     Display information about password policy.
     """
-    takes_options = (
+    takes_options = LDAPRetrieve.takes_options + (
         Str('user?',
             label=_('User'),
             doc=_('Display effective policy for a specific user'),
@@ -428,6 +428,10 @@ class pwpolicy_show(LDAPRetrieve):
                         entry_attrs['cospriority'] = cos_entry['cospriority']
                 except errors.NotFound:
                     pass
+        if options.get('rights', False) and options.get('all', False) and \
+            keys[-1] is not None:
+            cos_entry = self.api.Command.cosentry_show(keys[-1], rights=True, all=True)['result']
+            entry_attrs['attributelevelrights']['cospriority'] = cos_entry['attributelevelrights']['cospriority']
         self.obj.convert_time_for_output(entry_attrs, **options)
         return dn