mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-26 16:16:31 -06:00
idviews: Add ipaOriginalUid
For slapi-nis plugin, we need to cache the original uid value of the user in the override object. Part of: https://fedorahosted.org/freeipa/ticket/3979 Reviewed-By: Petr Viktorin <pviktori@redhat.com> Reviewed-By: Petr Vobornik <pvoborni@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
This commit is contained in:
Tomas Babej
Martin Kosek
parent
8fb0e3a2b4
commit
277b762d36
2
ACI.txt
2
ACI.txt
@ -121,7 +121,7 @@ aci: (targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:S
|
||||
dn: cn=views,cn=accounts,dc=ipa,dc=example
|
||||
aci: (targetattr = "cn || createtimestamp || description || entryusn || gidnumber || ipaanchoruuid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaGroupOverride)")(version 3.0;acl "permission:System: Read Group ID Overrides";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=views,cn=accounts,dc=ipa,dc=example
|
||||
aci: (targetattr = "createtimestamp || description || entryusn || homedirectory || ipaanchoruuid || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaUserOverride)")(version 3.0;acl "permission:System: Read User ID Overrides";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
aci: (targetattr = "createtimestamp || description || entryusn || homedirectory || ipaanchoruuid || ipaoriginaluid || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaUserOverride)")(version 3.0;acl "permission:System: Read User ID Overrides";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=ranges,cn=etc,dc=ipa,dc=example
|
||||
aci: (targetattr = "cn || createtimestamp || entryusn || ipabaseid || ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || ipasecondarybaserid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidrange)")(version 3.0;acl "permission:System: Read ID Ranges";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=views,cn=accounts,dc=ipa,dc=example
|
||||
|
||||
9
API.txt
9
API.txt
@ -2104,13 +2104,14 @@ output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDA
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
output: PrimaryKey('value', None, None)
|
||||
command: idoverrideuser_add
|
||||
args: 2,9,3
|
||||
args: 2,10,3
|
||||
arg: Str('idviewcn', cli_name='idview', multivalue=False, primary_key=True, query=True, required=True)
|
||||
arg: Str('ipaanchoruuid', attribute=True, cli_name='anchor', multivalue=False, primary_key=True, required=True)
|
||||
option: Str('addattr*', cli_name='addattr', exclude='webui')
|
||||
option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
|
||||
option: Str('description', attribute=True, cli_name='desc', multivalue=False, required=True)
|
||||
option: Str('homedirectory', attribute=True, cli_name='homedir', multivalue=False, required=False)
|
||||
option: Str('ipaoriginaluid', attribute=True, cli_name='ipaoriginaluid', multivalue=False, required=False)
|
||||
option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')
|
||||
option: Str('setattr*', cli_name='setattr', exclude='webui')
|
||||
option: Str('uid', attribute=True, cli_name='login', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$', required=False)
|
||||
@ -2129,13 +2130,14 @@ output: Output('result', <type 'dict'>, None)
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
output: ListOfPrimaryKeys('value', None, None)
|
||||
command: idoverrideuser_find
|
||||
args: 2,11,4
|
||||
args: 2,12,4
|
||||
arg: Str('idviewcn', cli_name='idview', multivalue=False, primary_key=True, query=True, required=True)
|
||||
arg: Str('criteria?', noextrawhitespace=False)
|
||||
option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
|
||||
option: Str('description', attribute=True, autofill=False, cli_name='desc', multivalue=False, query=True, required=False)
|
||||
option: Str('homedirectory', attribute=True, autofill=False, cli_name='homedir', multivalue=False, query=True, required=False)
|
||||
option: Str('ipaanchoruuid', attribute=True, autofill=False, cli_name='anchor', multivalue=False, primary_key=True, query=True, required=False)
|
||||
option: Str('ipaoriginaluid', attribute=True, autofill=False, cli_name='ipaoriginaluid', multivalue=False, query=True, required=False)
|
||||
option: Flag('pkey_only?', autofill=True, default=False)
|
||||
option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')
|
||||
option: Int('sizelimit?', autofill=False, minvalue=0)
|
||||
@ -2148,7 +2150,7 @@ output: ListOfEntries('result', (<type 'list'>, <type 'tuple'>), Gettext('A list
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
output: Output('truncated', <type 'bool'>, None)
|
||||
command: idoverrideuser_mod
|
||||
args: 2,12,3
|
||||
args: 2,13,3
|
||||
arg: Str('idviewcn', cli_name='idview', multivalue=False, primary_key=True, query=True, required=True)
|
||||
arg: Str('ipaanchoruuid', attribute=True, cli_name='anchor', multivalue=False, primary_key=True, query=True, required=True)
|
||||
option: Str('addattr*', cli_name='addattr', exclude='webui')
|
||||
@ -2156,6 +2158,7 @@ option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui
|
||||
option: Str('delattr*', cli_name='delattr', exclude='webui')
|
||||
option: Str('description', attribute=True, autofill=False, cli_name='desc', multivalue=False, required=False)
|
||||
option: Str('homedirectory', attribute=True, autofill=False, cli_name='homedir', multivalue=False, required=False)
|
||||
option: Str('ipaoriginaluid', attribute=True, autofill=False, cli_name='ipaoriginaluid', multivalue=False, required=False)
|
||||
option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')
|
||||
option: Str('rename', cli_name='rename', multivalue=False, primary_key=True, required=False)
|
||||
option: Flag('rights', autofill=True, default=False)
|
||||
|
||||
@ -1,6 +1,7 @@
|
||||
dn: cn=schema
|
||||
attributeTypes: (2.16.840.1.113730.3.8.11.62 NAME 'ipaAnchorUUID' DESC 'Unique Anchor Identifier' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'IPA v4')
|
||||
attributeTypes: (2.16.840.1.113730.3.8.11.63 NAME 'ipaOriginalUid' DESC 'Original UID of overriden user' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'IPA v4')
|
||||
objectClasses: (2.16.840.1.113730.3.8.12.29 NAME 'ipaIDView' SUP nsContainer STRUCTURAL MAY ( description ) X-ORIGIN 'IPA v4' )
|
||||
objectClasses: (2.16.840.1.113730.3.8.12.30 NAME 'ipaOverrideAnchor' SUP top STRUCTURAL MUST ( ipaAnchorUUID ) MAY ( description ) X-ORIGIN 'IPA v4' )
|
||||
objectClasses: (2.16.840.1.113730.3.8.12.31 NAME 'ipaUserOverride' DESC 'Override for User Attributes' SUP ipaOverrideAnchor STRUCTURAL MAY ( uid $ uidNumber $ gidNumber $ homeDirectory $ loginShell $ gecos ) X-ORIGIN 'IPA v4' )
|
||||
objectClasses: (2.16.840.1.113730.3.8.12.31 NAME 'ipaUserOverride' DESC 'Override for User Attributes' SUP ipaOverrideAnchor STRUCTURAL MAY ( uid $ uidNumber $ gidNumber $ homeDirectory $ loginShell $ gecos $ ipaOriginalUid ) X-ORIGIN 'IPA v4' )
|
||||
objectClasses: (2.16.840.1.113730.3.8.12.32 NAME 'ipaGroupOverride' DESC 'Override for Group Attributes' SUP ipaOverrideAnchor STRUCTURAL MAY ( gidNumber $ cn ) X-ORIGIN 'IPA v4' )
|
||||
|
||||
@ -583,14 +583,14 @@ class idoverrideuser(baseidoverride):
|
||||
'ipapermright': {'read', 'search', 'compare'},
|
||||
'ipapermdefaultattr': {
|
||||
'objectClass', 'ipaAnchorUUID', 'uidNumber', 'description',
|
||||
'homeDirectory', 'uid',
|
||||
'homeDirectory', 'uid', 'ipaOriginalUid',
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
object_class = baseidoverride.object_class + ['ipaUserOverride']
|
||||
default_attributes = baseidoverride.default_attributes + [
|
||||
'homeDirectory', 'uidNumber', 'uid',
|
||||
'homeDirectory', 'uidNumber', 'uid', 'ipaOriginalUid',
|
||||
]
|
||||
|
||||
takes_params = baseidoverride.takes_params + (
|
||||
@ -612,10 +612,20 @@ class idoverrideuser(baseidoverride):
|
||||
cli_name='homedir',
|
||||
label=_('Home directory'),
|
||||
),
|
||||
Str('ipaoriginaluid?',
|
||||
flags=['no_option', 'no_output']
|
||||
),
|
||||
)
|
||||
|
||||
override_object = 'user'
|
||||
|
||||
def update_original_uid_reference(self, entry_attrs):
|
||||
anchor = entry_attrs.single_value.get('ipaanchoruuid')
|
||||
original_uid = resolve_anchor_to_object_name(self.backend,
|
||||
self.override_object,
|
||||
anchor)
|
||||
entry_attrs['ipaOriginalUid'] = original_uid
|
||||
|
||||
|
||||
@register()
|
||||
class idoverridegroup(baseidoverride):
|
||||
@ -669,6 +679,14 @@ class idoverrideuser_add(baseidoverride_add):
|
||||
__doc__ = _('Add a new User ID override.')
|
||||
msg_summary = _('Added User ID override "%(value)s"')
|
||||
|
||||
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
|
||||
dn = super(idoverrideuser_add, self).pre_callback(ldap, dn,
|
||||
entry_attrs, attrs_list, *keys, **options)
|
||||
|
||||
# Update the ipaOriginalUid
|
||||
self.obj.update_original_uid_reference(entry_attrs)
|
||||
return dn
|
||||
|
||||
|
||||
@register()
|
||||
class idoverrideuser_del(baseidoverride_del):
|
||||
@ -681,6 +699,15 @@ class idoverrideuser_mod(baseidoverride_mod):
|
||||
__doc__ = _('Modify an User ID override.')
|
||||
msg_summary = _('Modified an User ID override "%(value)s"')
|
||||
|
||||
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
|
||||
dn = super(idoverrideuser_mod, self).pre_callback(ldap, dn,
|
||||
entry_attrs, attrs_list, *keys, **options)
|
||||
|
||||
# Update the ipaOriginalUid
|
||||
self.obj.set_anchoruuid_from_dn(dn, entry_attrs)
|
||||
self.obj.update_original_uid_reference(entry_attrs)
|
||||
return dn
|
||||
|
||||
|
||||
@register()
|
||||
class idoverrideuser_find(baseidoverride_find):
|
||||
|
||||
Loading…
Reference in New Issue
Block a user