mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-01-26 16:16:31 -06:00
idviews: Add user certificate attribute to user ID overrides
https://fedorahosted.org/freeipa/ticket/4955 Reviewed-By: Jan Cholasta <jcholast@redhat.com>
This commit is contained in:
Tomas Babej
Jan Cholasta
parent
42bcbcf460
commit
6adf863781
2
ACI.txt
2
ACI.txt
@ -149,7 +149,7 @@ aci: (targetfilter = "(objectclass=ipahostgroup)")(version 3.0;acl "permission:S
|
||||
dn: cn=views,cn=accounts,dc=ipa,dc=example
|
||||
aci: (targetattr = "cn || createtimestamp || description || entryusn || gidnumber || ipaanchoruuid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaGroupOverride)")(version 3.0;acl "permission:System: Read Group ID Overrides";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=views,cn=accounts,dc=ipa,dc=example
|
||||
aci: (targetattr = "createtimestamp || description || entryusn || gecos || gidnumber || homedirectory || ipaanchoruuid || ipaoriginaluid || ipasshpubkey || loginshell || modifytimestamp || objectclass || uid || uidnumber")(targetfilter = "(objectclass=ipaUserOverride)")(version 3.0;acl "permission:System: Read User ID Overrides";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
aci: (targetattr = "createtimestamp || description || entryusn || gecos || gidnumber || homedirectory || ipaanchoruuid || ipaoriginaluid || ipasshpubkey || loginshell || modifytimestamp || objectclass || uid || uidnumber || usercertificate")(targetfilter = "(objectclass=ipaUserOverride)")(version 3.0;acl "permission:System: Read User ID Overrides";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=ranges,cn=etc,dc=ipa,dc=example
|
||||
aci: (targetattr = "cn || createtimestamp || entryusn || ipabaseid || ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || ipasecondarybaserid || modifytimestamp || objectclass")(targetfilter = "(objectclass=ipaidrange)")(version 3.0;acl "permission:System: Read ID Ranges";allow (compare,read,search) userdn = "ldap:///all";)
|
||||
dn: cn=views,cn=accounts,dc=ipa,dc=example
|
||||
|
||||
30
API.txt
30
API.txt
@ -2429,7 +2429,7 @@ output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDA
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
output: PrimaryKey('value', None, None)
|
||||
command: idoverrideuser_add
|
||||
args: 2,15,3
|
||||
args: 2,16,3
|
||||
arg: Str('idviewcn', cli_name='idview', multivalue=False, primary_key=True, query=True, required=True)
|
||||
arg: Str('ipaanchoruuid', attribute=True, cli_name='anchor', multivalue=False, primary_key=True, required=True)
|
||||
option: Str('addattr*', cli_name='addattr', exclude='webui')
|
||||
@ -2446,6 +2446,19 @@ option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui
|
||||
option: Str('setattr*', cli_name='setattr', exclude='webui')
|
||||
option: Str('uid', attribute=True, cli_name='login', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$', required=False)
|
||||
option: Int('uidnumber', attribute=True, cli_name='uid', minvalue=1, multivalue=False, required=False)
|
||||
option: Bytes('usercertificate', attribute=True, cli_name='certificate', multivalue=True, required=False)
|
||||
option: Str('version?', exclude='webui')
|
||||
output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
output: PrimaryKey('value', None, None)
|
||||
command: idoverrideuser_add_cert
|
||||
args: 2,5,3
|
||||
arg: Str('idviewcn', cli_name='idview', multivalue=False, primary_key=True, query=True, required=True)
|
||||
arg: Str('ipaanchoruuid', attribute=True, cli_name='anchor', multivalue=False, primary_key=True, query=True, required=True)
|
||||
option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
|
||||
option: Flag('fallback_to_ldap?', autofill=True, default=False)
|
||||
option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')
|
||||
option: Bytes('usercertificate', alwaysask=True, attribute=True, cli_name='certificate', multivalue=True, required=False)
|
||||
option: Str('version?', exclude='webui')
|
||||
output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
@ -2485,7 +2498,7 @@ output: ListOfEntries('result', (<type 'list'>, <type 'tuple'>), Gettext('A list
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
output: Output('truncated', <type 'bool'>, None)
|
||||
command: idoverrideuser_mod
|
||||
args: 2,18,3
|
||||
args: 2,19,3
|
||||
arg: Str('idviewcn', cli_name='idview', multivalue=False, primary_key=True, query=True, required=True)
|
||||
arg: Str('ipaanchoruuid', attribute=True, cli_name='anchor', multivalue=False, primary_key=True, query=True, required=True)
|
||||
option: Str('addattr*', cli_name='addattr', exclude='webui')
|
||||
@ -2505,6 +2518,19 @@ option: Flag('rights', autofill=True, default=False)
|
||||
option: Str('setattr*', cli_name='setattr', exclude='webui')
|
||||
option: Str('uid', attribute=True, autofill=False, cli_name='login', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$', required=False)
|
||||
option: Int('uidnumber', attribute=True, autofill=False, cli_name='uid', minvalue=1, multivalue=False, required=False)
|
||||
option: Bytes('usercertificate', attribute=True, autofill=False, cli_name='certificate', multivalue=True, required=False)
|
||||
option: Str('version?', exclude='webui')
|
||||
output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
output: PrimaryKey('value', None, None)
|
||||
command: idoverrideuser_remove_cert
|
||||
args: 2,5,3
|
||||
arg: Str('idviewcn', cli_name='idview', multivalue=False, primary_key=True, query=True, required=True)
|
||||
arg: Str('ipaanchoruuid', attribute=True, cli_name='anchor', multivalue=False, primary_key=True, query=True, required=True)
|
||||
option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
|
||||
option: Flag('fallback_to_ldap?', autofill=True, default=False)
|
||||
option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')
|
||||
option: Bytes('usercertificate', alwaysask=True, attribute=True, cli_name='certificate', multivalue=True, required=False)
|
||||
option: Str('version?', exclude='webui')
|
||||
output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
|
||||
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
||||
|
||||
4
VERSION
4
VERSION
@ -90,5 +90,5 @@ IPA_DATA_VERSION=20100614120000
|
||||
# #
|
||||
########################################################
|
||||
IPA_API_VERSION_MAJOR=2
|
||||
IPA_API_VERSION_MINOR=165
|
||||
# Last change: mbasti - limit ipamaxusernamelength value to 255
|
||||
IPA_API_VERSION_MINOR=166
|
||||
# Last change: tbabej - idviews: Add user certificate attribute to user ID overrides
|
||||
|
||||
@ -3,6 +3,6 @@ attributeTypes: (2.16.840.1.113730.3.8.11.62 NAME 'ipaAnchorUUID' DESC 'Unique A
|
||||
attributeTypes: (2.16.840.1.113730.3.8.11.63 NAME 'ipaOriginalUid' DESC 'Original UID of overriden user' EQUALITY caseIgnoreMatch ORDERING caseIgnoreOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'IPA v4')
|
||||
objectClasses: (2.16.840.1.113730.3.8.12.29 NAME 'ipaIDView' SUP nsContainer STRUCTURAL MAY ( description ) X-ORIGIN 'IPA v4' )
|
||||
objectClasses: (2.16.840.1.113730.3.8.12.30 NAME 'ipaOverrideAnchor' SUP top STRUCTURAL MUST ( ipaAnchorUUID ) MAY ( description ) X-ORIGIN 'IPA v4' )
|
||||
objectClasses: (2.16.840.1.113730.3.8.12.31 NAME 'ipaUserOverride' DESC 'Override for User Attributes' SUP ipaOverrideAnchor STRUCTURAL MAY ( uid $ uidNumber $ gidNumber $ homeDirectory $ loginShell $ gecos $ ipaOriginalUid ) X-ORIGIN 'IPA v4' )
|
||||
objectClasses: (2.16.840.1.113730.3.8.12.31 NAME 'ipaUserOverride' DESC 'Override for User Attributes' SUP ipaOverrideAnchor STRUCTURAL MAY ( uid $ uidNumber $ gidNumber $ homeDirectory $ loginShell $ gecos $ ipaOriginalUid $ userCertificate ) X-ORIGIN 'IPA v4' )
|
||||
objectClasses: (2.16.840.1.113730.3.8.12.32 NAME 'ipaGroupOverride' DESC 'Override for Group Attributes' SUP ipaOverrideAnchor STRUCTURAL MAY ( gidNumber $ cn ) X-ORIGIN 'IPA v4' )
|
||||
objectClasses: (2.16.840.1.113730.3.8.12.35 NAME 'ipaOverrideTarget' SUP top STRUCTURAL MUST ( ipaAnchorUUID ) X-ORIGIN 'IPA v4' )
|
||||
|
||||
@ -23,9 +23,11 @@ import six
|
||||
|
||||
from ipalib.plugins.baseldap import (LDAPQuery, LDAPObject, LDAPCreate,
|
||||
LDAPDelete, LDAPUpdate, LDAPSearch,
|
||||
LDAPAddAttribute, LDAPRemoveAttribute,
|
||||
LDAPRetrieve, global_output_params)
|
||||
from ipalib.plugins.hostgroup import get_complete_hostgroup_member_list
|
||||
from ipalib import api, Str, Int, Flag, _, ngettext, errors, output
|
||||
from ipalib.plugins.service import validate_certificate
|
||||
from ipalib import api, Str, Int, Bytes, Flag, _, ngettext, errors, output
|
||||
from ipalib.constants import IPA_ANCHOR_PREFIX, SID_ANCHOR_PREFIX
|
||||
from ipalib.plugable import Registry
|
||||
from ipalib.util import (normalize_sshpubkey, validate_sshpubkey,
|
||||
@ -817,7 +819,7 @@ class idoverrideuser(baseidoverride):
|
||||
'ipapermdefaultattr': {
|
||||
'objectClass', 'ipaAnchorUUID', 'uidNumber', 'description',
|
||||
'homeDirectory', 'uid', 'ipaOriginalUid', 'loginShell', 'gecos',
|
||||
'gidNumber', 'ipaSshPubkey',
|
||||
'gidNumber', 'ipaSshPubkey', 'usercertificate'
|
||||
},
|
||||
},
|
||||
}
|
||||
@ -825,6 +827,11 @@ class idoverrideuser(baseidoverride):
|
||||
object_class = baseidoverride.object_class + ['ipaUserOverride']
|
||||
possible_objectclasses = ['ipasshuser', 'ipaSshGroupOfPubKeys']
|
||||
default_attributes = baseidoverride.default_attributes + [
|
||||
'homeDirectory', 'uidNumber', 'uid', 'ipaOriginalUid', 'loginShell',
|
||||
'ipaSshPubkey', 'gidNumber', 'gecos', 'usercertificate;binary',
|
||||
]
|
||||
|
||||
search_display_attributes = baseidoverride.default_attributes + [
|
||||
'homeDirectory', 'uidNumber', 'uid', 'ipaOriginalUid', 'loginShell',
|
||||
'ipaSshPubkey', 'gidNumber', 'gecos',
|
||||
]
|
||||
@ -870,6 +877,12 @@ class idoverrideuser(baseidoverride):
|
||||
csv=True,
|
||||
flags=['no_search'],
|
||||
),
|
||||
Bytes('usercertificate*', validate_certificate,
|
||||
cli_name='certificate',
|
||||
label=_('Certificate'),
|
||||
doc=_('Base-64 encoded user certificate'),
|
||||
flags=['no_search',],
|
||||
),
|
||||
)
|
||||
|
||||
override_object = 'user'
|
||||
@ -888,6 +901,17 @@ class idoverrideuser(baseidoverride):
|
||||
# we have no way to update the original_uid
|
||||
pass
|
||||
|
||||
def convert_usercertificate_pre(self, entry_attrs):
|
||||
if 'usercertificate' in entry_attrs:
|
||||
entry_attrs['usercertificate;binary'] = entry_attrs.pop(
|
||||
'usercertificate')
|
||||
|
||||
def convert_usercertificate_post(self, entry_attrs, **options):
|
||||
if 'usercertificate;binary' in entry_attrs:
|
||||
entry_attrs['usercertificate'] = entry_attrs.pop(
|
||||
'usercertificate;binary')
|
||||
|
||||
|
||||
|
||||
@register()
|
||||
class idoverridegroup(baseidoverride):
|
||||
@ -935,6 +959,50 @@ class idoverridegroup(baseidoverride):
|
||||
|
||||
override_object = 'group'
|
||||
|
||||
@register()
|
||||
class idoverrideuser_add_cert(LDAPAddAttribute):
|
||||
__doc__ = _('Add one or more certificates to the idoverrideuser entry')
|
||||
msg_summary = _('Added certificates to idoverrideuser "%(value)s"')
|
||||
attribute = 'usercertificate'
|
||||
|
||||
takes_options = LDAPAddAttribute.takes_options + (fallback_to_ldap_option,)
|
||||
|
||||
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys,
|
||||
**options):
|
||||
dn = self.obj.get_dn(*keys, **options)
|
||||
self.obj.convert_usercertificate_pre(entry_attrs)
|
||||
|
||||
return dn
|
||||
|
||||
def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
|
||||
assert isinstance(dn, DN)
|
||||
self.obj.convert_usercertificate_post(entry_attrs, **options)
|
||||
self.obj.convert_anchor_to_human_readable_form(entry_attrs, **options)
|
||||
return dn
|
||||
|
||||
|
||||
@register()
|
||||
class idoverrideuser_remove_cert(LDAPRemoveAttribute):
|
||||
__doc__ = _('Remove one or more certificates to the idoverrideuser entry')
|
||||
msg_summary = _('Removed certificates from idoverrideuser "%(value)s"')
|
||||
attribute = 'usercertificate'
|
||||
|
||||
takes_options = LDAPRemoveAttribute.takes_options + (fallback_to_ldap_option,)
|
||||
|
||||
def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys,
|
||||
**options):
|
||||
dn = self.obj.get_dn(*keys, **options)
|
||||
self.obj.convert_usercertificate_pre(entry_attrs)
|
||||
|
||||
return dn
|
||||
|
||||
def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
|
||||
assert isinstance(dn, DN)
|
||||
self.obj.convert_usercertificate_post(entry_attrs, **options)
|
||||
self.obj.convert_anchor_to_human_readable_form(entry_attrs, **options)
|
||||
|
||||
return dn
|
||||
|
||||
|
||||
@register()
|
||||
class idoverrideuser_add(baseidoverride_add):
|
||||
@ -946,6 +1014,7 @@ class idoverrideuser_add(baseidoverride_add):
|
||||
entry_attrs, attrs_list, *keys, **options)
|
||||
|
||||
entry_attrs['objectclass'].append('ipasshuser')
|
||||
self.obj.convert_usercertificate_pre(entry_attrs)
|
||||
|
||||
# Update the ipaOriginalUid
|
||||
self.obj.update_original_uid_reference(entry_attrs)
|
||||
@ -955,6 +1024,7 @@ class idoverrideuser_add(baseidoverride_add):
|
||||
dn = super(idoverrideuser_add, self).post_callback(ldap, dn,
|
||||
entry_attrs, *keys, **options)
|
||||
convert_sshpubkey_post(entry_attrs)
|
||||
self.obj.convert_usercertificate_post(entry_attrs, **options)
|
||||
return dn
|
||||
|
||||
|
||||
@ -985,12 +1055,15 @@ class idoverrideuser_mod(baseidoverride_mod):
|
||||
|
||||
if 'ipasshpubkey' in entry_attrs and 'ipasshuser' not in obj_classes:
|
||||
obj_classes.append('ipasshuser')
|
||||
|
||||
self.obj.convert_usercertificate_pre(entry_attrs)
|
||||
return dn
|
||||
|
||||
def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
|
||||
dn = super(idoverrideuser_mod, self).post_callback(ldap, dn,
|
||||
entry_attrs, *keys, **options)
|
||||
convert_sshpubkey_post(entry_attrs)
|
||||
self.obj.convert_usercertificate_post(entry_attrs, **options)
|
||||
return dn
|
||||
|
||||
|
||||
@ -1005,6 +1078,7 @@ class idoverrideuser_find(baseidoverride_find):
|
||||
ldap, entries, truncated, *args, **options)
|
||||
for entry in entries:
|
||||
convert_sshpubkey_post(entry)
|
||||
self.obj.convert_usercertificate_post(entry, **options)
|
||||
return truncated
|
||||
|
||||
|
||||
@ -1016,6 +1090,7 @@ class idoverrideuser_show(baseidoverride_show):
|
||||
dn = super(idoverrideuser_show, self).post_callback(ldap, dn,
|
||||
entry_attrs, *keys, **options)
|
||||
convert_sshpubkey_post(entry_attrs)
|
||||
self.obj.convert_usercertificate_post(entry_attrs, **options)
|
||||
return dn
|
||||
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user