IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Use LDAP search instead of *group_show to check for a group objectclass.

Browse Source 
https://fedorahosted.org/freeipa/ticket/3706
This commit is contained in:
Jan Cholasta
2013-06-25 13:08:18 +00:00
committed by Alexander Bokovoy
parent 100f13d95b
commit 55da832867
3 changed files with 41 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
ipalib/plugins/host.py
View File

@@ -364,22 +364,24 @@ class host(LDAPObject):
return managed_hosts return managed_hosts
def suppress_netgroup_memberof(self, entry_attrs): def suppress_netgroup_memberof(self, ldap, entry_attrs):
""" """
We don't want to show managed netgroups so remove them from the We don't want to show managed netgroups so remove them from the
memberofindirect list. memberofindirect list.
""" """
ng_container = DN(api.env.container_netgroup, api.env.basedn) ng_container = DN(api.env.container_netgroup, api.env.basedn)
if 'memberofindirect' in entry_attrs: for member in list(entry_attrs.get('memberofindirect', [])):
for member in list(entry_attrs['memberofindirect']): memberdn = DN(member)
memberdn = DN(member) if not memberdn.endswith(ng_container):
if memberdn.endswith(ng_container): continue
try:
netgroup = api.Command['netgroup_show'](memberdn['cn'], all=True)['result'] filter = ldap.make_filter({'objectclass': 'mepmanagedentry'})
if self.has_objectclass(netgroup['objectclass'], 'mepmanagedentry'): try:
entry_attrs['memberofindirect'].remove(member) ldap.get_entries(memberdn, ldap.SCOPE_BASE, filter, [''])
except errors.NotFound: except errors.NotFound:
pass pass
else:
entry_attrs['memberofindirect'].remove(member)
api.register(host) api.register(host)
@@ -753,7 +755,7 @@ class host_mod(LDAPUpdate):
if options.get('all', False): if options.get('all', False):
entry_attrs['managing'] = self.obj.get_managed_hosts(dn) entry_attrs['managing'] = self.obj.get_managed_hosts(dn)
self.obj.suppress_netgroup_memberof(entry_attrs) self.obj.suppress_netgroup_memberof(ldap, entry_attrs)
convert_sshpubkey_post(ldap, dn, entry_attrs) convert_sshpubkey_post(ldap, dn, entry_attrs)
@@ -832,7 +834,7 @@ class host_find(LDAPSearch):
set_certificate_attrs(entry_attrs) set_certificate_attrs(entry_attrs)
set_kerberos_attrs(entry_attrs, options) set_kerberos_attrs(entry_attrs, options)
self.obj.get_password_attributes(ldap, dn, entry_attrs) self.obj.get_password_attributes(ldap, dn, entry_attrs)
self.obj.suppress_netgroup_memberof(entry_attrs) self.obj.suppress_netgroup_memberof(ldap, entry_attrs)
if entry_attrs['has_password']: if entry_attrs['has_password']:
# If an OTP is set there is no keytab, at least not one # If an OTP is set there is no keytab, at least not one
# fetched anywhere. # fetched anywhere.
@@ -874,7 +876,7 @@ class host_show(LDAPRetrieve):
if options.get('all', False): if options.get('all', False):
entry_attrs['managing'] = self.obj.get_managed_hosts(dn) entry_attrs['managing'] = self.obj.get_managed_hosts(dn)
self.obj.suppress_netgroup_memberof(entry_attrs) self.obj.suppress_netgroup_memberof(ldap, entry_attrs)
convert_sshpubkey_post(ldap, dn, entry_attrs) convert_sshpubkey_post(ldap, dn, entry_attrs)
@@ -987,7 +989,7 @@ class host_disable(LDAPQuery):
def post_callback(self, ldap, dn, entry_attrs, *keys, **options): def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
assert isinstance(dn, DN) assert isinstance(dn, DN)
self.obj.suppress_netgroup_memberof(entry_attrs) self.obj.suppress_netgroup_memberof(ldap, entry_attrs)
return dn return dn
api.register(host_disable) api.register(host_disable)
@@ -1001,7 +1003,7 @@ class host_add_managedby(LDAPAddMember):
def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options): def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options):
assert isinstance(dn, DN) assert isinstance(dn, DN)
self.obj.suppress_netgroup_memberof(entry_attrs) self.obj.suppress_netgroup_memberof(ldap, entry_attrs)
return (completed, dn) return (completed, dn)
api.register(host_add_managedby) api.register(host_add_managedby)
@@ -1015,7 +1017,7 @@ class host_remove_managedby(LDAPRemoveMember):
def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options): def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options):
assert isinstance(dn, DN) assert isinstance(dn, DN)
self.obj.suppress_netgroup_memberof(entry_attrs) self.obj.suppress_netgroup_memberof(ldap, entry_attrs)
return (completed, dn) return (completed, dn)
api.register(host_remove_managedby) api.register(host_remove_managedby)

39
ipalib/plugins/hostgroup.py
View File

@@ -92,23 +92,24 @@ class hostgroup(LDAPObject):
), ),
) )
def suppress_netgroup_memberof(self, dn, entry_attrs): def suppress_netgroup_memberof(self, ldap, dn, entry_attrs):
""" """
We don't want to show managed netgroups so remove them from the We don't want to show managed netgroups so remove them from the
memberOf list. memberOf list.
""" """
if 'memberof' in entry_attrs: hgdn = DN(dn)
hgdn = DN(dn) for member in list(entry_attrs.get('memberof', [])):
for member in list(entry_attrs['memberof']): ngdn = DN(member)
ngdn = DN(member) if ngdn['cn'] != hgdn['cn']:
if ngdn['cn'] == hgdn['cn']: continue
try:
netgroup = api.Command['netgroup_show'](ngdn['cn'], all=True)['result'] filter = ldap.make_filter({'objectclass': 'mepmanagedentry'})
if self.has_objectclass(netgroup['objectclass'], 'mepmanagedentry'): try:
entry_attrs['memberof'].remove(member) ldap.get_entries(ngdn, ldap.SCOPE_BASE, filter, [''])
return except errors.NotFound:
except errors.NotFound: pass
pass else:
entry_attrs['memberof'].remove(member)
api.register(hostgroup) api.register(hostgroup)
@@ -146,7 +147,7 @@ class hostgroup_add(LDAPCreate):
# be sure to ignore it in memberOf # be sure to ignore it in memberOf
newentry = wait_for_value(ldap, dn, 'objectclass', 'mepOriginEntry') newentry = wait_for_value(ldap, dn, 'objectclass', 'mepOriginEntry')
entry_from_entry(entry_attrs, newentry) entry_from_entry(entry_attrs, newentry)
self.obj.suppress_netgroup_memberof(dn, entry_attrs) self.obj.suppress_netgroup_memberof(ldap, dn, entry_attrs)
return dn return dn
@@ -169,7 +170,7 @@ class hostgroup_mod(LDAPUpdate):
def post_callback(self, ldap, dn, entry_attrs, *keys, **options): def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
assert isinstance(dn, DN) assert isinstance(dn, DN)
self.obj.suppress_netgroup_memberof(dn, entry_attrs) self.obj.suppress_netgroup_memberof(ldap, dn, entry_attrs)
return dn return dn
api.register(hostgroup_mod) api.register(hostgroup_mod)
@@ -188,7 +189,7 @@ class hostgroup_find(LDAPSearch):
return truncated return truncated
for entry in entries: for entry in entries:
(dn, entry_attrs) = entry (dn, entry_attrs) = entry
self.obj.suppress_netgroup_memberof(dn, entry_attrs) self.obj.suppress_netgroup_memberof(ldap, dn, entry_attrs)
return truncated return truncated
api.register(hostgroup_find) api.register(hostgroup_find)
@@ -199,7 +200,7 @@ class hostgroup_show(LDAPRetrieve):
def post_callback(self, ldap, dn, entry_attrs, *keys, **options): def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
assert isinstance(dn, DN) assert isinstance(dn, DN)
self.obj.suppress_netgroup_memberof( dn, entry_attrs) self.obj.suppress_netgroup_memberof(ldap, dn, entry_attrs)
return dn return dn
api.register(hostgroup_show) api.register(hostgroup_show)
@@ -210,7 +211,7 @@ class hostgroup_add_member(LDAPAddMember):
def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options): def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options):
assert isinstance(dn, DN) assert isinstance(dn, DN)
self.obj.suppress_netgroup_memberof(dn, entry_attrs) self.obj.suppress_netgroup_memberof(ldap, dn, entry_attrs)
return (completed, dn) return (completed, dn)
api.register(hostgroup_add_member) api.register(hostgroup_add_member)
@@ -221,7 +222,7 @@ class hostgroup_remove_member(LDAPRemoveMember):
def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options): def post_callback(self, ldap, completed, failed, dn, entry_attrs, *keys, **options):
assert isinstance(dn, DN) assert isinstance(dn, DN)
self.obj.suppress_netgroup_memberof(dn, entry_attrs) self.obj.suppress_netgroup_memberof(ldap, dn, entry_attrs)
return (completed, dn) return (completed, dn)
api.register(hostgroup_remove_member) api.register(hostgroup_remove_member)

3
ipalib/plugins/pwpolicy.py
View File

@@ -121,7 +121,8 @@ class cosentry_add(LDAPCreate):
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options): def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
assert isinstance(dn, DN) assert isinstance(dn, DN)
# check for existence of the group # check for existence of the group
result = self.api.Command.group_show(keys[-1], all=True)['result'] group_dn = self.api.Object.group.get_dn(keys[-1])
result = ldap.get_entry(group_dn, ['objectclass'])
oc = map(lambda x:x.lower(),result['objectclass']) oc = map(lambda x:x.lower(),result['objectclass'])
if 'mepmanagedentry' in oc: if 'mepmanagedentry' in oc:
raise errors.ManagedPolicyError() raise errors.ManagedPolicyError()