IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2026-07-29 15:55:47 -05:00
Code Issues Packages Projects Releases Wiki Activity

Terminology improvements: use block list

Browse Source 
Some places have to use the old name because it's part of the stable API
or stable LDAP attributes.

See: https://tools.ietf.org/id/draft-knodel-terminology-01.html
Signed-off-by: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Alexander Bokovoy <abbra@users.noreply.github.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
This commit is contained in:
Christian Heimes
2020-06-23 10:16:29 +02:00
committed by Florence Blanc-Renaud
parent 3ce816ba77
commit 3ec1b77f6a
11 changed files with 111 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
daemons/ipa-kdb/ipa_kdb_mspac.c
+42 -42
View File
@@ -1446,9 +1446,9 @@ krb5_error_code filter_logon_info(krb5_context context,
/* Check if this domain has been filtered out by the trust itself*/
if (domain->parent != NULL) {
for(k = 0; k < domain->parent->len_sid_blacklist_incoming; k++) {
for(k = 0; k < domain->parent->len_sid_blocklist_incoming; k++) {
result = dom_sid_check(info->info->info3.base.domain_sid,
&domain->parent->sid_blacklist_incoming[k], true);
&domain->parent->sid_blocklist_incoming[k], true);
if (result) {
filter_logon_info_log_message(info->info->info3.base.domain_sid);
return KRB5KDC_ERR_POLICY;
@@ -1457,23 +1457,23 @@ krb5_error_code filter_logon_info(krb5_context context,
}
/* Check if this user's SIDs membership is filtered too */
for(k = 0; k < domain->len_sid_blacklist_incoming; k++) {
for(k = 0; k < domain->len_sid_blocklist_incoming; k++) {
/* Short-circuit if there are no RIDs. This may happen if we filtered everything already.
* In normal situation there would be at least primary gid as RID in the RIDs array
* but if we filtered out the primary RID, this MS-PAC is invalid */
count = info->info->info3.base.groups.count;
result = dom_sid_is_prefix(info->info->info3.base.domain_sid,
&domain->sid_blacklist_incoming[k]);
&domain->sid_blocklist_incoming[k]);
if (result) {
i = 0;
j = 0;
if (domain->sid_blacklist_incoming[k].num_auths - info->info->info3.base.domain_sid->num_auths != 1) {
if (domain->sid_blocklist_incoming[k].num_auths - info->info->info3.base.domain_sid->num_auths != 1) {
krb5_klog_syslog(LOG_ERR, "Incoming SID blacklist element matching domain [%s with SID %s] "
"has more than one RID component. Invalid check skipped.",
domain->domain_name, domain->domain_sid);
break;
}
rid = domain->sid_blacklist_incoming[k].sub_auths[domain->sid_blacklist_incoming[k].num_auths - 1];
rid = domain->sid_blocklist_incoming[k].sub_auths[domain->sid_blocklist_incoming[k].num_auths - 1];
if (rid == info->info->info3.base.rid) {
filter_logon_info_log_message_rid(info->info->info3.base.domain_sid, rid);
/* Actual user's SID is filtered out */
@@ -1544,15 +1544,15 @@ krb5_error_code filter_logon_info(krb5_context context,
filter_logon_info_log_message(info->info->info3.sids[i].sid);
} else {
/* Go over incoming SID blacklist */
for(k = 0; k < domain->len_sid_blacklist_incoming; k++) {
for(k = 0; k < domain->len_sid_blocklist_incoming; k++) {
/* if SID is an exact match, filter it out */
result = dom_sid_check(&domain->sid_blacklist_incoming[k], info->info->info3.sids[i].sid, true);
result = dom_sid_check(&domain->sid_blocklist_incoming[k], info->info->info3.sids[i].sid, true);
if (result) {
filter_logon_info_log_message(info->info->info3.sids[i].sid);
break;
}
/* if SID is a suffix of the blacklist element, filter it out*/
result = dom_sid_is_prefix(&domain->sid_blacklist_incoming[k], info->info->info3.sids[i].sid);
result = dom_sid_is_prefix(&domain->sid_blocklist_incoming[k], info->info->info3.sids[i].sid);
if (result) {
filter_logon_info_log_message(info->info->info3.sids[i].sid);
break;
@@ -2384,8 +2384,8 @@ void ipadb_mspac_struct_free(struct ipadb_mspac **mspac)
free((*mspac)->trusts[i].domain_name);
free((*mspac)->trusts[i].flat_name);
free((*mspac)->trusts[i].domain_sid);
free((*mspac)->trusts[i].sid_blacklist_incoming);
free((*mspac)->trusts[i].sid_blacklist_outgoing);
free((*mspac)->trusts[i].sid_blocklist_incoming);
free((*mspac)->trusts[i].sid_blocklist_outgoing);
free((*mspac)->trusts[i].parent_name);
(*mspac)->trusts[i].parent = NULL;
if ((*mspac)->trusts[i].upn_suffixes) {
@@ -2436,21 +2436,21 @@ krb5_error_code ipadb_adtrusts_fill_sid_blacklist(char **source_sid_blacklist,
}
krb5_error_code ipadb_adtrusts_fill_sid_blacklists(struct ipadb_adtrusts *adtrust,
char **sid_blacklist_incoming,
char **sid_blacklist_outgoing)
char **sid_blocklist_incoming,
char **sid_blocklist_outgoing)
{
krb5_error_code kerr;
kerr = ipadb_adtrusts_fill_sid_blacklist(sid_blacklist_incoming,
&adtrust->sid_blacklist_incoming,
&adtrust->len_sid_blacklist_incoming);
kerr = ipadb_adtrusts_fill_sid_blacklist(sid_blocklist_incoming,
&adtrust->sid_blocklist_incoming,
&adtrust->len_sid_blocklist_incoming);
if (kerr) {
return kerr;
}
kerr = ipadb_adtrusts_fill_sid_blacklist(sid_blacklist_outgoing,
&adtrust->sid_blacklist_outgoing,
&adtrust->len_sid_blacklist_outgoing);
kerr = ipadb_adtrusts_fill_sid_blacklist(sid_blocklist_outgoing,
&adtrust->sid_blocklist_outgoing,
&adtrust->len_sid_blocklist_outgoing);
if (kerr) {
return kerr;
}
@@ -2482,24 +2482,24 @@ done:
return ret;
}
static void ipadb_free_sid_blacklists(char ***sid_blacklist_incoming, char ***sid_blacklist_outgoing)
static void ipadb_free_sid_blacklists(char ***sid_blocklist_incoming, char ***sid_blocklist_outgoing)
{
int i;
if (sid_blacklist_incoming && *sid_blacklist_incoming) {
for (i = 0; *sid_blacklist_incoming && (*sid_blacklist_incoming)[i]; i++) {
free((*sid_blacklist_incoming)[i]);
if (sid_blocklist_incoming && *sid_blocklist_incoming) {
for (i = 0; *sid_blocklist_incoming && (*sid_blocklist_incoming)[i]; i++) {
free((*sid_blocklist_incoming)[i]);
}
free(*sid_blacklist_incoming);
*sid_blacklist_incoming = NULL;
free(*sid_blocklist_incoming);
*sid_blocklist_incoming = NULL;
}
if (sid_blacklist_outgoing && *sid_blacklist_outgoing) {
for (i = 0; *sid_blacklist_outgoing && (*sid_blacklist_outgoing)[i]; i++) {
free((*sid_blacklist_outgoing)[i]);
if (sid_blocklist_outgoing && *sid_blocklist_outgoing) {
for (i = 0; *sid_blocklist_outgoing && (*sid_blocklist_outgoing)[i]; i++) {
free((*sid_blocklist_outgoing)[i]);
}
free(*sid_blacklist_outgoing);
*sid_blacklist_outgoing = NULL;
free(*sid_blocklist_outgoing);
*sid_blocklist_outgoing = NULL;
}
}
@@ -2519,8 +2519,8 @@ krb5_error_code ipadb_mspac_get_trusted_domains(struct ipadb_context *ipactx)
char *dnstr = NULL;
char *dnl = NULL;
LDAPDN dn = NULL;
char **sid_blacklist_incoming = NULL;
char **sid_blacklist_outgoing = NULL;
char **sid_blocklist_incoming = NULL;
char **sid_blocklist_outgoing = NULL;
int ret, n, i;
ret = asprintf(&base, "cn=ad,cn=trusts,%s", ipactx->base);
@@ -2604,13 +2604,13 @@ krb5_error_code ipadb_mspac_get_trusted_domains(struct ipadb_context *ipactx)
}
ret = ipadb_ldap_attr_to_strlist(lc, le, "ipaNTSIDBlacklistIncoming",
&sid_blacklist_incoming);
&sid_blocklist_incoming);
if (ret) {
if (ret == ENOENT) {
/* This attribute is optional */
ret = 0;
sid_blacklist_incoming = NULL;
sid_blocklist_incoming = NULL;
} else {
ret = EINVAL;
goto done;
@@ -2618,13 +2618,13 @@ krb5_error_code ipadb_mspac_get_trusted_domains(struct ipadb_context *ipactx)
}
ret = ipadb_ldap_attr_to_strlist(lc, le, "ipaNTSIDBlacklistOutgoing",
&sid_blacklist_outgoing);
&sid_blocklist_outgoing);
if (ret) {
if (ret == ENOENT) {
/* This attribute is optional */
ret = 0;
sid_blacklist_outgoing = NULL;
sid_blocklist_outgoing = NULL;
} else {
ret = EINVAL;
goto done;
@@ -2632,13 +2632,13 @@ krb5_error_code ipadb_mspac_get_trusted_domains(struct ipadb_context *ipactx)
}
ret = ipadb_adtrusts_fill_sid_blacklists(&t[n],
sid_blacklist_incoming,
sid_blacklist_outgoing);
sid_blocklist_incoming,
sid_blocklist_outgoing);
if (ret) {
goto done;
}
ipadb_free_sid_blacklists(&sid_blacklist_incoming,
&sid_blacklist_outgoing);
ipadb_free_sid_blacklists(&sid_blocklist_incoming,
&sid_blocklist_outgoing);
/* Parse first two RDNs of the entry to find its parent */
dnl = strcasestr(dnstr, base);
@@ -2696,8 +2696,8 @@ done:
}
free(dnstr);
free(base);
ipadb_free_sid_blacklists(&sid_blacklist_incoming,
&sid_blacklist_outgoing);
ipadb_free_sid_blacklists(&sid_blocklist_incoming,
&sid_blocklist_outgoing);
ldap_msgfree(res);
return ret;
}
daemons/ipa-kdb/ipa_kdb_mspac_private.h
+4 -4
View File
@@ -41,10 +41,10 @@ struct ipadb_adtrusts {
char *flat_name;
char *domain_sid;
struct dom_sid domsid;
struct dom_sid *sid_blacklist_incoming;
int len_sid_blacklist_incoming;
struct dom_sid *sid_blacklist_outgoing;
int len_sid_blacklist_outgoing;
struct dom_sid *sid_blocklist_incoming;
int len_sid_blocklist_incoming;
struct dom_sid *sid_blocklist_outgoing;
int len_sid_blocklist_outgoing;
struct ipadb_adtrusts *parent;
char *parent_name;
char **upn_suffixes;
daemons/ipa-kdb/tests/ipa_kdb_tests.c
+13 -13
View File
@@ -70,7 +70,7 @@ struct test_ctx {
#define FLAT_NAME "MYDOM"
#define DOM_SID "S-1-5-21-1-2-3"
#define DOM_SID_TRUST "S-1-5-21-4-5-6"
#define BLACKLIST_SID "S-1-5-1"
#define BLOCKLIST_SID "S-1-5-1"
static int setup(void **state)
{
@@ -117,13 +117,13 @@ static int setup(void **state)
ret = string_to_sid(DOM_SID_TRUST, &ipa_ctx->mspac->trusts[0].domsid);
assert_int_equal(ret, 0);
ipa_ctx->mspac->trusts[0].len_sid_blacklist_incoming = 1;
ipa_ctx->mspac->trusts[0].sid_blacklist_incoming = calloc(
ipa_ctx->mspac->trusts[0].len_sid_blacklist_incoming,
ipa_ctx->mspac->trusts[0].len_sid_blocklist_incoming = 1;
ipa_ctx->mspac->trusts[0].sid_blocklist_incoming = calloc(
ipa_ctx->mspac->trusts[0].len_sid_blocklist_incoming,
sizeof(struct dom_sid));
assert_non_null(ipa_ctx->mspac->trusts[0].sid_blacklist_incoming);
ret = string_to_sid(BLACKLIST_SID,
&ipa_ctx->mspac->trusts[0].sid_blacklist_incoming[0]);
assert_non_null(ipa_ctx->mspac->trusts[0].sid_blocklist_incoming);
ret = string_to_sid(BLOCKLIST_SID,
&ipa_ctx->mspac->trusts[0].sid_blocklist_incoming[0]);
assert_int_equal(ret, 0);
ipa_ctx->kcontext = krb5_ctx;
@@ -240,22 +240,22 @@ void test_filter_logon_info(void **state)
{3, {DOM_SID_TRUST"-1000", DOM_SID_TRUST"-1001", DOM_SID_TRUST"-1002"},
3, {DOM_SID_TRUST"-1000", DOM_SID_TRUST"-1001", DOM_SID_TRUST"-1002"}},
/* last SID filtered */
{3, {DOM_SID_TRUST"-1000", DOM_SID_TRUST"-1001", BLACKLIST_SID"-1002"},
{3, {DOM_SID_TRUST"-1000", DOM_SID_TRUST"-1001", BLOCKLIST_SID"-1002"},
2, {DOM_SID_TRUST"-1000", DOM_SID_TRUST"-1001"}},
/* center SID filtered */
{3, {DOM_SID_TRUST"-1000", BLACKLIST_SID"-1001", DOM_SID_TRUST"-1002"},
{3, {DOM_SID_TRUST"-1000", BLOCKLIST_SID"-1001", DOM_SID_TRUST"-1002"},
2, {DOM_SID_TRUST"-1000", DOM_SID_TRUST"-1002"}},
/* first SID filtered */
{3, {BLACKLIST_SID"-1000", DOM_SID_TRUST"-1001", DOM_SID_TRUST"-1002"},
{3, {BLOCKLIST_SID"-1000", DOM_SID_TRUST"-1001", DOM_SID_TRUST"-1002"},
2, {DOM_SID_TRUST"-1001", DOM_SID_TRUST"-1002"}},
/* first and last SID filtered */
{3, {BLACKLIST_SID"-1000", DOM_SID_TRUST"-1001", BLACKLIST_SID"-1002"},
{3, {BLOCKLIST_SID"-1000", DOM_SID_TRUST"-1001", BLOCKLIST_SID"-1002"},
1, {DOM_SID_TRUST"-1001"}},
/* two SIDs in a rwo filtered */
{3, {BLACKLIST_SID"-1000", BLACKLIST_SID"-1001", DOM_SID_TRUST"-1002"},
{3, {BLOCKLIST_SID"-1000", BLOCKLIST_SID"-1001", DOM_SID_TRUST"-1002"},
1, {DOM_SID_TRUST"-1002"}},
/* all SIDs filtered*/
{3, {BLACKLIST_SID"-1000", BLACKLIST_SID"-1001", BLACKLIST_SID"-1002"},
{3, {BLOCKLIST_SID"-1000", BLOCKLIST_SID"-1001", BLOCKLIST_SID"-1002"},
0, {}},
{0, {}, 0 , {}}
};
daemons/ipa-sam/ipa_sam.c
+6 -6
View File
@@ -140,8 +140,8 @@ bool E_md4hash(const char *passwd, uint8_t p16[16]); /* available in libcliauth-
#define LDAP_ATTRIBUTE_HOMEDIRECTORY "homeDirectory"
#define LDAP_ATTRIBUTE_LOGON_SCRIPT "ipaNTLogonScript"
#define LDAP_ATTRIBUTE_PROFILE_PATH "ipaNTProfilePath"
#define LDAP_ATTRIBUTE_SID_BLACKLIST_INCOMING "ipaNTSIDBlacklistIncoming"
#define LDAP_ATTRIBUTE_SID_BLACKLIST_OUTGOING "ipaNTSIDBlacklistOutgoing"
#define LDAP_ATTRIBUTE_SID_BLOCKLIST_INCOMING "ipaNTSIDBlacklistIncoming"
#define LDAP_ATTRIBUTE_SID_BLOCKLIST_OUTGOING "ipaNTSIDBlacklistOutgoing"
#define LDAP_ATTRIBUTE_NTHASH "ipaNTHash"
#define LDAP_ATTRIBUTE_UIDNUMBER "uidnumber"
#define LDAP_ATTRIBUTE_GIDNUMBER "gidnumber"
@@ -2714,19 +2714,19 @@ static NTSTATUS ipasam_set_trusted_domain(struct pdb_methods *methods,
/* Only add default blacklists for incoming and outgoing SIDs but don't modify existing ones */
in_blacklist = get_attribute_values(tmp_ctx, priv2ld(ipasam_state), entry,
LDAP_ATTRIBUTE_SID_BLACKLIST_INCOMING, &count);
LDAP_ATTRIBUTE_SID_BLOCKLIST_INCOMING, &count);
out_blacklist = get_attribute_values(tmp_ctx, priv2ld(ipasam_state), entry,
LDAP_ATTRIBUTE_SID_BLACKLIST_OUTGOING, &count);
LDAP_ATTRIBUTE_SID_BLOCKLIST_OUTGOING, &count);
for (i = 0; ipa_mspac_well_known_sids[i]; i++) {
if (in_blacklist == NULL) {
smbldap_make_mod(priv2ld(ipasam_state), entry, &mods,
LDAP_ATTRIBUTE_SID_BLACKLIST_INCOMING,
LDAP_ATTRIBUTE_SID_BLOCKLIST_INCOMING,
ipa_mspac_well_known_sids[i]);
}
if (out_blacklist == NULL) {
smbldap_make_mod(priv2ld(ipasam_state), entry, &mods,
LDAP_ATTRIBUTE_SID_BLACKLIST_OUTGOING,
LDAP_ATTRIBUTE_SID_BLOCKLIST_OUTGOING,
ipa_mspac_well_known_sids[i]);
}
}
install/ui/src/freeipa/trust.js
+2 -2
View File
@@ -156,8 +156,8 @@ return {
]
},
{
name: 'blacklists',
label: '@i18n:objects.trust.blacklists',
name: 'blocklists',
label: '@i18n:objects.trust.blocklists',
fields: [
{
$type: 'multivalued',
install/ui/test/data/i18n_messages.json
+1 -1
View File
@@ -682,7 +682,7 @@
"trust": {
"account": "Account",
"admin_account": "Administrative account",
"blacklists": "SID blacklists",
"blocklists": "SID blocklists",
"details": "Trust Settings",
"domain": "Domain",
"establish_using": "Establish using",
install/ui/test/data/ipa_init_commands.json
+8 -8
View File
@@ -63113,11 +63113,11 @@
"flags" : [
"no_create"
],
"doc" : "SID blacklist incoming",
"doc" : "SID blocklist incoming",
"deprecated" : false,
"alwaysask" : false,
"confirm" : true,
"label" : "SID blacklist incoming",
"label" : "SID blocklist incoming",
"cli_name" : "sid_blacklist_incoming",
"attribute" : true,
"name" : "ipantsidblacklistincoming",
@@ -63134,10 +63134,10 @@
},
{
"attribute" : true,
"label" : "SID blacklist outgoing",
"label" : "SID blocklist outgoing",
"confirm" : true,
"cli_name" : "sid_blacklist_outgoing",
"doc" : "SID blacklist outgoing",
"doc" : "SID blocklist outgoing",
"deprecated" : false,
"alwaysask" : false,
"query" : true,
@@ -91347,10 +91347,10 @@
"noextrawhitespace" : true,
"attribute" : true,
"confirm" : true,
"label" : "SID blacklist incoming",
"label" : "SID blocklist incoming",
"cli_name" : "sid_blacklist_incoming",
"deprecated" : false,
"doc" : "SID blacklist incoming",
"doc" : "SID blocklist incoming",
"alwaysask" : false,
"sortorder" : 2,
"query" : false,
@@ -91362,9 +91362,9 @@
"attribute" : true,
"cli_name" : "sid_blacklist_outgoing",
"confirm" : true,
"label" : "SID blacklist outgoing",
"label" : "SID blocklist outgoing",
"alwaysask" : false,
"doc" : "SID blacklist outgoing",
"doc" : "SID blocklist outgoing",
"deprecated" : false,
"flags" : [
"no_create"
ipaserver/install/plugins/update_managed_permissions.py
+5 -5
View File
@@ -661,14 +661,14 @@ class update_managed_permissions(Updater):
# Exclude attributes filtered from the global read ACI
replaces_ga_aci = template.pop('replaces_global_anonymous_aci', False)
if replaces_ga_aci and is_new and anonymous_read_aci:
read_blacklist = set(
read_blocklist = set(
a.lower() for a in
anonymous_read_aci.target['targetattr']['expression'])
read_blacklist &= attributes
if read_blacklist:
read_blocklist &= attributes
if read_blocklist:
logger.debug('Excluded attributes for %s: %s',
name, ', '.join(read_blacklist))
entry['ipapermexcludedattr'] = list(read_blacklist)
name, ', '.join(read_blocklist))
entry['ipapermexcludedattr'] = list(read_blocklist)
# Sanity check
if template:
ipaserver/plugins/internal.py
+1 -1
View File
@@ -1514,7 +1514,7 @@ class i18n_messages(Command):
"account": _("Account"),
"add": _("Add trust"),
"admin_account": _("Administrative account"),
"blacklists": _("SID blacklists"),
"blocklists": _("SID blocklists"),
"details": _("Trust Settings"),
"domain": _("Domain"),
"establish_using": _("Establish using"),
ipaserver/plugins/migration.py
+23 -19
View File
@@ -183,8 +183,8 @@ def _create_kerberos_principals(ldap, pkey, entry_attrs, failed):
def _pre_migrate_user(ldap, pkey, dn, entry_attrs, failed, config, ctx, **kwargs):
assert isinstance(dn, DN)
attr_blacklist = ['krbprincipalkey','memberofindirect','memberindirect']
attr_blacklist.extend(kwargs.get('attr_blacklist', []))
attr_blocklist = ['krbprincipalkey','memberofindirect','memberindirect']
attr_blocklist.extend(kwargs.get('attr_blocklist', []))
ds_ldap = ctx['ds_ldap']
search_bases = kwargs.get('search_bases', None)
valid_gids = kwargs['valid_gids']
@@ -239,12 +239,12 @@ def _pre_migrate_user(ldap, pkey, dn, entry_attrs, failed, config, ctx, **kwargs
entry_attrs.setdefault('loginshell', default_shell)
# do not migrate all attributes
for attr in attr_blacklist:
for attr in attr_blocklist:
entry_attrs.pop(attr, None)
# do not migrate all object classes
if 'objectclass' in entry_attrs:
for object_class in kwargs.get('oc_blacklist', []):
for object_class in kwargs.get('oc_blocklist', []):
try:
entry_attrs['objectclass'].remove(object_class)
except ValueError: # object class not present
@@ -408,8 +408,8 @@ def _pre_migrate_group(ldap, pkey, dn, entry_attrs, failed, config, ctx, **kwarg
entry_attrs['member'] = new_members
assert isinstance(dn, DN)
attr_blacklist = ['memberofindirect','memberindirect']
attr_blacklist.extend(kwargs.get('attr_blacklist', []))
attr_blocklist = ['memberofindirect','memberindirect']
attr_blocklist.extend(kwargs.get('attr_blocklist', []))
schema = kwargs.get('schema', None)
entry_attrs['ipauniqueid'] = 'autogenerate'
@@ -426,12 +426,12 @@ def _pre_migrate_group(ldap, pkey, dn, entry_attrs, failed, config, ctx, **kwarg
raise ValueError('Schema %s not supported' % schema)
# do not migrate all attributes
for attr in attr_blacklist:
for attr in attr_blocklist:
entry_attrs.pop(attr, None)
# do not migrate all object classes
if 'objectclass' in entry_attrs:
for object_class in kwargs.get('oc_blacklist', []):
for object_class in kwargs.get('oc_blocklist', []):
try:
entry_attrs['objectclass'].remove(object_class)
except ValueError: # object class not present
@@ -505,8 +505,8 @@ class migrate_ds(Command):
'user': {
'filter_template' : '(&(|%s)(uid=*))',
'oc_option' : 'userobjectclass',
'oc_blacklist_option' : 'userignoreobjectclass',
'attr_blacklist_option' : 'userignoreattribute',
'oc_blocklist_option' : 'userignoreobjectclass',
'attr_blocklist_option' : 'userignoreattribute',
'pre_callback' : _pre_migrate_user,
'post_callback' : _post_migrate_user,
'exc_callback' : None
@@ -514,8 +514,8 @@ class migrate_ds(Command):
'group': {
'filter_template' : '(&(|%s)(cn=*))',
'oc_option' : 'groupobjectclass',
'oc_blacklist_option' : 'groupignoreobjectclass',
'attr_blacklist_option' : 'groupignoreattribute',
'oc_blocklist_option' : 'groupignoreobjectclass',
'attr_blocklist_option' : 'groupignoreattribute',
'pre_callback' : _pre_migrate_group,
'post_callback' : None,
'exc_callback' : _group_exc_callback,
@@ -782,13 +782,17 @@ migration process might be incomplete\n''')
ldap_obj.name, self.truncated_err_msg
)
blacklists = {}
for blacklist in ('oc_blacklist', 'attr_blacklist'):
blacklist_option = self.migrate_objects[ldap_obj_name][blacklist+'_option']
if blacklist_option is not None:
blacklists[blacklist] = options.get(blacklist_option, tuple())
blocklists = {}
for blocklist in ('oc_blocklist', 'attr_blocklist'):
blocklist_option = (
self.migrate_objects[ldap_obj_name][blocklist + '_option']
)
if blocklist_option is not None:
blocklists[blocklist] = options.get(
blocklist_option, tuple()
)
else:
blacklists[blacklist] = tuple()
blocklists[blocklist] = tuple()
# get default primary group for new users
if 'def_group_dn' not in context and options.get('use_def_group'):
@@ -842,7 +846,7 @@ migration process might be incomplete\n''')
search_bases=search_bases,
valid_gids=valid_gids,
invalid_gids=invalid_gids,
**blacklists
**blocklists
)
if not entry_attrs.dn:
continue
ipaserver/plugins/trust.py
+6 -6
View File
@@ -546,11 +546,11 @@ class trust(LDAPObject):
flags=['no_create', 'no_update']),
Str('ipantsidblacklistincoming*',
cli_name='sid_blacklist_incoming',
label=_('SID blacklist incoming'),
label=_('SID blocklist incoming'),
flags=['no_create']),
Str('ipantsidblacklistoutgoing*',
cli_name='sid_blacklist_outgoing',
label=_('SID blacklist outgoing'),
label=_('SID blocklist outgoing'),
flags=['no_create']),
Str('trustdirection',
label=_('Trust direction'),
@@ -571,7 +571,7 @@ class trust(LDAPObject):
),
)
def validate_sid_blacklists(self, entry_attrs):
def validate_sid_blocklists(self, entry_attrs):
if not _bindings_installed:
# SID validator is not available, return
# Even if invalid SID gets in the trust entry, it won't crash
@@ -1130,7 +1130,7 @@ class trust_mod(LDAPUpdate):
def pre_callback(self, ldap, dn, e_attrs, attrs_list, *keys, **options):
assert isinstance(dn, DN)
self.obj.validate_sid_blacklists(e_attrs)
self.obj.validate_sid_blocklists(e_attrs)
return dn
@@ -1619,13 +1619,13 @@ class trustdomain_find(LDAPSearch):
return truncated
trust_dn = self.obj.get_dn(args[0], trust_type=u'ad')
trust_entry = ldap.get_entry(trust_dn)
blacklist = trust_entry.get('ipantsidblacklistincoming')
blocklist = trust_entry.get('ipantsidblacklistincoming')
for entry in entries:
sid = entry.get('ipanttrusteddomainsid', [None])[0]
if sid is None:
continue
if sid in blacklist:
if sid in blocklist:
entry['domain_enabled'] = [False]
else:
entry['domain_enabled'] = [True]