IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Allow a user or group to change an attribute in its RDN

Browse Source 
Add secretary to the list of indexes otherwise RDN changing could be slow
Port --addattr, --setattr and --delattr from usermod to groupmod
This commit is contained in:
Rob Crittenden 2007-11-12 23:11:55 -05:00
parent 99b84bfd01
commit cd489f0a73
7 changed files with 195 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
ipa-admintools/ipa-groupmod
View File

@ -31,10 +31,13 @@ import kerberos
import ldap
def usage():
print "ipa-groupmod [-a] [-r] user group"
print "ipa-groupmod [-d|--desc description STRING] group"
print "ipa-groupmod [-a|--add] [-r|--remove] user group"
print "ipa-groupmod [-d|--desc description STRING] [--addattr attribute=value] [--delattr attribute] [--setattr attribute=value] group"
sys.exit(1)
def set_add_usage(which):
print "%s option usage: --%s NAME=VALUE" % (which, which)
def parse_options():
parser = OptionParser()
parser.add_option("-a", "--add", dest="add", action="store_true",
@ -43,13 +46,22 @@ def parse_options():
help="Remove a user from the group")
parser.add_option("-d", "--description", dest="desc",
help="Modify the description of the group")
parser.add_option("--addattr", dest="addattr",
help="Adds an attribute or values to that attribute, attr=value",
action="append")
parser.add_option("--delattr", dest="delattr",
help="Remove an attribute", action="append")
parser.add_option("--setattr", dest="setattr",
help="Set an attribute, dropping any existing values that may exist",
action="append")
parser.add_option("--usage", action="store_true",
help="Program usage")
args = ipa.config.init_config(sys.argv)
options, args = parser.parse_args(args)
if (not options.add and not options.remove) and (not options.desc):
if (not options.add and not options.remove) and (not options.desc and
not options.addattr and not options.delattr and not options.setattr):
usage()
return options, args
@ -69,7 +81,7 @@ def main():
if (options.add or options.remove) and (len(args) != 3):
usage()
if (options.desc and (len(args) != 2)):
elif ((options.desc or options.addattr or options.delattr or options.setattr) and (len(args) != 2)):
usage()
try:
@ -78,19 +90,54 @@ def main():
group = get_group(client, args[2])
if group is None:
return 1
client.add_user_to_group(args[1], group.dn)
print args[1] + " successfully added to " + args[2]
users = args[1].split(',')
for user in users:
client.add_user_to_group(user, group.dn)
print user + " successfully added to " + args[2]
elif options.remove:
group = get_group(client, args[2])
if group is None:
return 1
client.remove_user_from_group(args[1], group.dn)
print args[1] + " successfully removed"
elif options.desc:
users = args[1].split(',')
for user in users:
client.remove_user_from_group(user, group.dn)
print user + " successfully removed"
else:
group = get_group(client, args[1])
if group is None:
return 1
group.setValue('description', options.desc)
if options.desc:
group.setValue('description', options.desc)
if options.delattr:
for d in options.delattr:
# doesn't truly delete the attribute but does null out the value
group.setValue(d, '')
if options.setattr:
for s in options.setattr:
s = s.split('=')
if len(s) != 2:
set_add_usage("set")
sys.exit(1)
(attr,value) = s
group.setValue(attr, value)
if options.addattr:
for a in options.addattr:
a = a.split('=')
if len(a) != 2:
set_add_usage("add")
sys.exit(1)
(attr,value) = a
cvalue = group.getValue(attr)
if cvalue:
if isinstance(cvalue,str):
cvalue = [cvalue]
value = cvalue + [value]
group.setValue(attr, value)
client.update_group(group)
print args[1] + " successfully updated"
except xmlrpclib.Fault, f:

6
ipa-admintools/ipa-usermod
View File

@ -49,12 +49,12 @@ def parse_options():
help="User's last name")
parser.add_option("-s", "--shell", dest="shell",
help="Set user's login shell to shell")
parser.add_option("--add", dest="addattr",
parser.add_option("--addattr", dest="addattr",
help="Adds an attribute or values to that attribute, attr=value",
action="append")
parser.add_option("--del", dest="delattr",
parser.add_option("--delattr", dest="delattr",
help="Remove an attribute", action="append")
parser.add_option("--set", dest="setattr",
parser.add_option("--setattr", dest="setattr",
help="Set an attribute, dropping any existing values that may exist",
action="append")
parser.add_option("-M", "--mailAddress", dest="mail",

12
ipa-admintools/man/ipa-groupmod.1
View File

@ -37,5 +37,17 @@ Modify the description of the group
.TP
\fB\-r\fR, \fB\-\-remove\fR=\fIuser1,user2,...usern\fR
Remove one or more users from the group
.TP
\fB\-\-addattr\fR=\fIattr=value\fR
Add a new attribute, or value to an existing attribute
.TP
\fB\-\-delattr\fR=\fIattr=value\fR
Remove an attribute and all values
.TP
\fB\-\-setattr\fR=\fIattr=value\fR
Set an attribute to a new value, removing all old ones
.SH "EXIT STATUS"
The exit status is 0 on success, nonzero on error.

16
ipa-admintools/man/ipa-usermod.1
View File

@ -21,10 +21,10 @@
.SH "NAME"
ipa\-usermod \- Modify a user
.SH "SYNOPSIS"
ipa\-usermod [\fIOPTION\fR]... \fIgroup\fR
ipa\-usermod [\fIOPTION\fR]... \fIname\fR
.SH "DESCRIPTION"
Updates the members or description of \fIgroup\fR.
Updates the user \fIname\fR.
.SH "OPTIONS"
.TP
\fB\-a\fR, \fB\-\-add\fR=\fIuser1,user2,...usern\fR
@ -37,5 +37,17 @@ Modify the description of the group
.TP
\fB\-r\fR, \fB\-\-remove\fR=\fIuser1,user2,...usern\fR
Remove one or more users from the group
.TP
\fB\-\-addattr\fR=\fIattr=value\fR
Add a new attribute, or value to an existing attribute
.TP
\fB\-\-delattr\fR=\fIattr=value\fR
Remove an attribute and all values
.TP
\fB\-\-setattr\fR=\fIattr=value\fR
Set an attribute to a new value, removing all old ones
.SH "EXIT STATUS"
The exit status is 0 on success, nonzero on error.

8
ipa-server/ipa-install/share/indeces.ldif
View File

@ -42,6 +42,14 @@ cn:manager
nsSystemIndex:false
nsIndexType:eq
dn: cn=secretary,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
changetype: add
objectClass:top
objectClass:nsIndex
cn:secretary
nsSystemIndex:false
nsIndexType:eq
dn: cn=displayname,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config
changetype: add
objectClass:top

17
ipa-server/ipaserver/ipaldap.py
View File

@ -377,6 +377,23 @@ class IPAdmin(SimpleLDAPObject):
raise ipaerror.gen_exception(ipaerror.LDAP_DATABASE_ERROR, None, e)
return "Success"
def updateRDN(self, dn, newrdn):
"""Wrap the modrdn function."""
sctrl = self.__get_server_controls__()
if dn == newrdn:
# no need to report an error
return "Success"
try:
if sctrl is not None:
self.set_option(ldap.OPT_SERVER_CONTROLS, sctrl)
self.modrdn_s(dn, newrdn, delold=1)
except ldap.LDAPError, e:
raise ipaerror.gen_exception(ipaerror.LDAP_DATABASE_ERROR, None, e)
return "Success"
def updateEntry(self,dn,olduser,newuser):
"""This wraps the mod function. It assumes that the entry is already
populated with all of the desired objectclasses and attributes"""

88
ipa-server/xmlrpc-server/funcs.py
View File

@ -604,8 +604,40 @@ class IPAServer:
return new_dict
def update_user (self, oldentry, newentry, opts=None):
"""Thin wrapper around update_entry"""
return self.update_entry(oldentry, newentry, opts)
"""Wrapper around update_entry with user-specific handling.
If you want to change the RDN of a user you must use
this function. update_entry will fail.
"""
newrdn = 0
if oldentry.get('uid') != newentry.get('uid'):
# RDN change
conn = self.getConnection(opts)
try:
res = conn.updateRDN(oldentry.get('dn'), "uid=" + newentry.get('uid'))
newdn = oldentry.get('dn')
newdn = newdn.replace("uid=%s" % oldentry.get('uid'), "uid=%s" % newentry.get('uid'))
# Now fix up the dns and uids so they aren't seen as having
# changed.
oldentry['dn'] = newdn
newentry['dn'] = newdn
oldentry['uid'] = newentry['uid']
newrdn = 1
finally:
self.releaseConnection(conn)
try:
rv = self.update_entry(oldentry, newentry, opts)
return rv
except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST):
# This means that there was just an rdn change, nothing else.
if newrdn == 1:
return "Success"
else:
raise
def mark_user_deleted (self, uid, opts=None):
"""Mark a user as inactive in LDAP. We aren't actually deleting
@ -1005,8 +1037,56 @@ class IPAServer:
return failed
def update_group (self, oldentry, newentry, opts=None):
"""Thin wrapper around update_entry"""
return self.update_entry(oldentry, newentry, opts)
"""Wrapper around update_entry with group-specific handling.
If you want to change the RDN of a group you must use
this function. update_entry will fail.
"""
newrdn = 0
oldcn=oldentry.get('cn')
newcn=newentry.get('cn')
if isinstance(oldcn, str):
oldcn = [oldcn]
if isinstance(newcn, str):
newcn = [newcn]
oldcn.sort()
newcn.sort()
if oldcn != newcn:
# RDN change
conn = self.getConnection(opts)
try:
res = conn.updateRDN(oldentry.get('dn'), "cn=" + newcn[0])
newdn = oldentry.get('dn')
# Ick. Need to find the exact cn used in the old DN so we'll
# walk the list of cns and skip the obviously bad ones:
for c in oldentry.get('dn').split("cn="):
if c and c != "groups" and not c.startswith("accounts"):
newdn = newdn.replace("cn=%s" % c, "uid=%s" % newentry.get('cn')[0])
break
# Now fix up the dns and cns so they aren't seen as having
# changed.
oldentry['dn'] = newdn
newentry['dn'] = newdn
oldentry['cn'] = newentry['cn']
newrdn = 1
finally:
self.releaseConnection(conn)
try:
rv = self.update_entry(oldentry, newentry, opts)
return rv
except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST):
if newrdn == 1:
# This means that there was just the rdn change, no other
# attributes
return "Success"
else:
raise
def delete_group (self, group_dn, opts=None):
"""Delete a group