IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-07-29 15:55:47 -05:00
Code Issues Packages Projects Releases Wiki Activity

Terminology improvements: use block list

Browse Source 
Some places have to use the old name because it's part of the stable API
or stable LDAP attributes.

See: https://tools.ietf.org/id/draft-knodel-terminology-01.html
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Christian Heimes
2020-06-23 10:16:29 +02:00
committed by Florence Blanc-Renaud
parent 3ce816ba77
commit 3ec1b77f6a
11 changed files with 111 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ipaserver/plugins/internal.py
+1 -1
View File
@@ -1514,7 +1514,7 @@ class i18n_messages(Command):
"account": _("Account"),
"add": _("Add trust"),
"admin_account": _("Administrative account"),
"blacklists": _("SID blacklists"),
"blocklists": _("SID blocklists"),
"details": _("Trust Settings"),
"domain": _("Domain"),
"establish_using": _("Establish using"),
ipaserver/plugins/migration.py
+23 -19
View File
@@ -183,8 +183,8 @@ def _create_kerberos_principals(ldap, pkey, entry_attrs, failed):
def _pre_migrate_user(ldap, pkey, dn, entry_attrs, failed, config, ctx, **kwargs):
assert isinstance(dn, DN)
attr_blacklist = ['krbprincipalkey','memberofindirect','memberindirect']
attr_blacklist.extend(kwargs.get('attr_blacklist', []))
attr_blocklist = ['krbprincipalkey','memberofindirect','memberindirect']
attr_blocklist.extend(kwargs.get('attr_blocklist', []))
ds_ldap = ctx['ds_ldap']
search_bases = kwargs.get('search_bases', None)
valid_gids = kwargs['valid_gids']
@@ -239,12 +239,12 @@ def _pre_migrate_user(ldap, pkey, dn, entry_attrs, failed, config, ctx, **kwargs
entry_attrs.setdefault('loginshell', default_shell)
# do not migrate all attributes
for attr in attr_blacklist:
for attr in attr_blocklist:
entry_attrs.pop(attr, None)
# do not migrate all object classes
if 'objectclass' in entry_attrs:
for object_class in kwargs.get('oc_blacklist', []):
for object_class in kwargs.get('oc_blocklist', []):
try:
entry_attrs['objectclass'].remove(object_class)
except ValueError: # object class not present
@@ -408,8 +408,8 @@ def _pre_migrate_group(ldap, pkey, dn, entry_attrs, failed, config, ctx, **kwarg
entry_attrs['member'] = new_members
assert isinstance(dn, DN)
attr_blacklist = ['memberofindirect','memberindirect']
attr_blacklist.extend(kwargs.get('attr_blacklist', []))
attr_blocklist = ['memberofindirect','memberindirect']
attr_blocklist.extend(kwargs.get('attr_blocklist', []))
schema = kwargs.get('schema', None)
entry_attrs['ipauniqueid'] = 'autogenerate'
@@ -426,12 +426,12 @@ def _pre_migrate_group(ldap, pkey, dn, entry_attrs, failed, config, ctx, **kwarg
raise ValueError('Schema %s not supported' % schema)
# do not migrate all attributes
for attr in attr_blacklist:
for attr in attr_blocklist:
entry_attrs.pop(attr, None)
# do not migrate all object classes
if 'objectclass' in entry_attrs:
for object_class in kwargs.get('oc_blacklist', []):
for object_class in kwargs.get('oc_blocklist', []):
try:
entry_attrs['objectclass'].remove(object_class)
except ValueError: # object class not present
@@ -505,8 +505,8 @@ class migrate_ds(Command):
'user': {
'filter_template' : '(&(|%s)(uid=*))',
'oc_option' : 'userobjectclass',
'oc_blacklist_option' : 'userignoreobjectclass',
'attr_blacklist_option' : 'userignoreattribute',
'oc_blocklist_option' : 'userignoreobjectclass',
'attr_blocklist_option' : 'userignoreattribute',
'pre_callback' : _pre_migrate_user,
'post_callback' : _post_migrate_user,
'exc_callback' : None
@@ -514,8 +514,8 @@ class migrate_ds(Command):
'group': {
'filter_template' : '(&(|%s)(cn=*))',
'oc_option' : 'groupobjectclass',
'oc_blacklist_option' : 'groupignoreobjectclass',
'attr_blacklist_option' : 'groupignoreattribute',
'oc_blocklist_option' : 'groupignoreobjectclass',
'attr_blocklist_option' : 'groupignoreattribute',
'pre_callback' : _pre_migrate_group,
'post_callback' : None,
'exc_callback' : _group_exc_callback,
@@ -782,13 +782,17 @@ migration process might be incomplete\n''')
ldap_obj.name, self.truncated_err_msg
)
blacklists = {}
for blacklist in ('oc_blacklist', 'attr_blacklist'):
blacklist_option = self.migrate_objects[ldap_obj_name][blacklist+'_option']
if blacklist_option is not None:
blacklists[blacklist] = options.get(blacklist_option, tuple())
blocklists = {}
for blocklist in ('oc_blocklist', 'attr_blocklist'):
blocklist_option = (
self.migrate_objects[ldap_obj_name][blocklist + '_option']
)
if blocklist_option is not None:
blocklists[blocklist] = options.get(
blocklist_option, tuple()
)
else:
blacklists[blacklist] = tuple()
blocklists[blocklist] = tuple()
# get default primary group for new users
if 'def_group_dn' not in context and options.get('use_def_group'):
@@ -842,7 +846,7 @@ migration process might be incomplete\n''')
search_bases=search_bases,
valid_gids=valid_gids,
invalid_gids=invalid_gids,
**blacklists
**blocklists
)
if not entry_attrs.dn:
continue
ipaserver/plugins/trust.py
+6 -6
View File
@@ -546,11 +546,11 @@ class trust(LDAPObject):
flags=['no_create', 'no_update']),
Str('ipantsidblacklistincoming*',
cli_name='sid_blacklist_incoming',
label=_('SID blacklist incoming'),
label=_('SID blocklist incoming'),
flags=['no_create']),
Str('ipantsidblacklistoutgoing*',
cli_name='sid_blacklist_outgoing',
label=_('SID blacklist outgoing'),
label=_('SID blocklist outgoing'),
flags=['no_create']),
Str('trustdirection',
label=_('Trust direction'),
@@ -571,7 +571,7 @@ class trust(LDAPObject):
),
)
def validate_sid_blacklists(self, entry_attrs):
def validate_sid_blocklists(self, entry_attrs):
if not _bindings_installed:
# SID validator is not available, return
# Even if invalid SID gets in the trust entry, it won't crash
@@ -1130,7 +1130,7 @@ class trust_mod(LDAPUpdate):
def pre_callback(self, ldap, dn, e_attrs, attrs_list, *keys, **options):
assert isinstance(dn, DN)
self.obj.validate_sid_blacklists(e_attrs)
self.obj.validate_sid_blocklists(e_attrs)
return dn
@@ -1619,13 +1619,13 @@ class trustdomain_find(LDAPSearch):
return truncated
trust_dn = self.obj.get_dn(args[0], trust_type=u'ad')
trust_entry = ldap.get_entry(trust_dn)
blacklist = trust_entry.get('ipantsidblacklistincoming')
blocklist = trust_entry.get('ipantsidblacklistincoming')
for entry in entries:
sid = entry.get('ipanttrusteddomainsid', [None])[0]
if sid is None:
continue
if sid in blacklist:
if sid in blocklist:
entry['domain_enabled'] = [False]
else:
entry['domain_enabled'] = [True]