User and groups: rename with --setattr must check format

There are 2 possible methods to rename users and groups:
- either use ipa user|group-mod oldname --rename newname
- or use settattr:
   ipa user-mod oldname --setattr uid=newname
   ipa group-mod oldname --setattr cn=newname

The first method validates the new name but the second method
doesn't. Add a validation to make both methods consistent

Fixes: https://pagure.io/freeipa/issue/9396

Signed-off-by: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>

ipaserver/plugins/baseuser.py

@@ -636,6 +636,8 @@ class baseuser_mod(LDAPUpdate):
     """
     Prototype command plugin to be implemented by real plugin
     """
+    NAME_PATTERN = re.compile(constants.PATTERN_GROUPUSER_NAME)
+
     def check_namelength(self, ldap, **options):
         if options.get('rename') is not None:
             config = ldap.get_ipa_config()
@@ -648,6 +650,14 @@ class baseuser_mod(LDAPUpdate):
                         )
                     )
 
+    def check_name(self, entry_attrs):
+        if 'uid' in entry_attrs:
+            # Check the pattern if the user is renamed
+            if self.NAME_PATTERN.match(entry_attrs.single_value['uid']) is None:
+                raise errors.ValidationError(
+                    name='uid',
+                    error=constants.ERRMSG_GROUPUSER_NAME.format('user'))
+
     def preserve_krbprincipalname_pre(self, ldap, entry_attrs, *keys, **options):
         """
         preserve user principal aliases during rename operation. This is the
@@ -763,6 +773,7 @@ class baseuser_mod(LDAPUpdate):
         add_sshpubkey_to_attrs_pre(self.context, attrs_list)
 
         self.check_namelength(ldap, **options)
+        self.check_name(entry_attrs)
 
         self.check_mail(entry_attrs)
 

ipaserver/plugins/group.py

@@ -21,6 +21,7 @@
 import six
 
 import logging
+import re
 
 from ipalib import api
 from ipalib import Int, Str, Flag
@@ -468,6 +469,8 @@ class group_mod(LDAPUpdate):
         ),
     )
 
+    NAME_PATTERN = re.compile(PATTERN_GROUPUSER_NAME)
+
     def pre_callback(self, ldap, dn, entry_attrs, *keys, **options):
         assert isinstance(dn, DN)
 
@@ -478,6 +481,13 @@ class group_mod(LDAPUpdate):
                 raise errors.ProtectedEntryError(label=u'group', key=keys[-1],
                     reason=u'Cannot be renamed')
 
+        if 'cn' in entry_attrs:
+            # Check the pattern if the group is renamed
+            if self.NAME_PATTERN.match(entry_attrs.single_value['cn']) is None:
+                raise errors.ValidationError(
+                    name='cn',
+                    error=ERRMSG_GROUPUSER_NAME.format('group'))
+
         if ('posix' in options and options['posix']) or 'gidnumber' in options:
             old_entry_attrs = ldap.get_entry(dn, ['objectclass'])
             dn = old_entry_attrs.dn