Commit Graph

83 Commits

Author SHA1 Message Date
Martin Babinsky
71f642f751 do not use keys() method when iterating through dictionaries
pylint-1.6.4-1.fc26.noarch reports "C0201(consider-iterating-dictionary)" when
building FreeIPA, we have to fix these errors

https://fedorahosted.org/freeipa/ticket/6391

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-10-12 10:38:52 +02:00
Martin Basti
4628522c53 Pylint: fix the rest of unused local variables
Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2016-10-11 16:50:32 +02:00
Martin Basti
45e3aee352 Pylint: enable check for unused-variables
Unused variables may:
* make code less readable
* create dead code
* potentialy hide issues/errors

Enabled check should prevent to leave unused variable in code

Check is locally disabled for modules that fix is not clear or easy or have too many occurences of
unused variables

Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-09-27 13:35:58 +02:00
Martin Babinsky
974eb7b5ef ipalib: introduce Principal parameter
This patch introduces a separate Principal parameter that allows the framework
to syntactically validate incoming/outcoming principals by using a single
shared codebase.

https://fedorahosted.org/freeipa/ticket/3864

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-07-01 09:37:25 +02:00
Fraser Tweedale
f0b1e37d2e ipaldap: turn LDAP filter utility functions into class methods
The LDAP filter utilities do not use any instance attributes, so
collectively turn them into class methods to promote reuse.

Part of: https://fedorahosted.org/freeipa/ticket/4559

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-06-29 08:52:29 +02:00
Jan Cholasta
b484667d15 ldap: fix handling of binary data in search filters
This fixes a UnicodeDecodeError when passing non-UTF-8 binary data to
LDAPClient.make_filter() and friends.

https://fedorahosted.org/freeipa/ticket/5381

Reviewed-By: David Kupka <dkupka@redhat.com>
Reviewed-By: Pavel Vomacka <pvomacka@redhat.com>
2016-06-21 09:45:20 +02:00
Florence Blanc-Renaud
53524fbbff add context to exception on LdapEntry decode error
When reading the content of an invalid LDAP entry, the exception
only displays the attribute name and value, but not the DN of the entry.
Because of this, it is difficult to identify the root cause of the
problem.

The fix raises a ValueError exception which also contains the entry DN.

https://fedorahosted.org/freeipa/ticket/5434

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-06-09 14:31:40 +02:00
Petr Viktorin
c192c1ae3e ipaldap: Convert dict items to list before iterating
In Python 3, dict.items() returns a view.
When such a view is iterated over, the dict cannot change size.

Part of the work for: https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-05-30 16:44:08 +02:00
Petr Viktorin
36094b2a54 ipaldap: Keep attribute names as text, not bytes
Part of the work for: https://fedorahosted.org/freeipa/ticket/4985

Reviewed-By: Martin Basti <mbasti@redhat.com>
2016-05-30 16:44:08 +02:00
Martin Basti
93332bcf4d Remove unused variable and finally block in SchemaCache
Handling exceptions in python is expensive operation, removing of
uneeded finally block is good for performance.

Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
2016-05-12 11:18:40 +02:00
Martin Babinsky
1f0959735f differentiate between limit types when LDAP search exceeds configured limits
When LDAP search fails on exceeded limits, we should raise an specific
exception for the type of limit raised (size, time, administrative) so that
the consumer can distinguish between e.g. searches returning too many entries
and those timing out.

https://fedorahosted.org/freeipa/ticket/5677

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2016-04-13 17:52:22 +02:00
Martin Basti
72d5499c5a pylint: supress false positive no-member errors
pylint 1.5 prints many false positive no-member errors which are
supressed by this commit.

https://fedorahosted.org/freeipa/ticket/5615

Reviewed-By: David Kupka <dkupka@redhat.com>
2016-03-02 14:57:36 +01:00
Petr Viktorin
fe7bd36728 ipaldap, ldapupdate: Encoding fixes for Python 3
https://fedorahosted.org/freeipa/ticket/5638

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2016-02-17 10:41:29 +01:00
Martin Basti
e4075b1fe2 Remove unused imports
This patch removes unused imports, alse pylint has been configured to
check unused imports.

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-23 07:59:22 +01:00
Martin Basti
2a1a3c498a Upgrade: increase time limit for upgrades
Default ldap search limit is now 30 sec by default during upgrade.

Limits must be changed for the whole ldap2 connection, because this
connection is used inside update plugins and commands called from
upgrade.

Together with increasing the time limit, also size limit should be
unlimited during upgrade. With sizelimit=None we may get the
TimeExceeded exception from getting default value of the sizelimit from LDAP.

https://fedorahosted.org/freeipa/ticket/5267

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-12-01 08:51:44 +01:00
Petr Viktorin
8a2b65a357 Fix more bytes/unicode issues
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-22 18:34:46 +02:00
Petr Viktorin
88fc27da52 ipaldap: Remove extraneous long (included in six.int_types)
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-10-13 14:16:32 +02:00
Jan Cholasta
ba5201979d Use bytes instead of str where appropriate
Under Python 2, "str" and "bytes" are synonyms.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-09-17 11:08:43 +02:00
Jan Cholasta
23507e6124 Alias "unicode" to "str" under Python 3
The six way of doing this is to replace all occurences of "unicode"
with "six.text_type". However, "unicode" is non-ambiguous and
(arguably) easier to read. Also, using it makes the patches smaller,
which should help with backporting.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-09-17 11:08:43 +02:00
Jan Cholasta
cf9bf9dcaf Use six.python_2_unicode_compatible
Rename __unicode__ to __str__ in classes which define it and use the
six.python_2_unicode_compatible decorator on them to make them compatible with
both Python 2 and 3.

Additional changes were required for the ipapython.dnsutil.DNSName class,
because it defined both __str__ and __unicode__.

Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-09-07 08:00:11 +02:00
Jan Cholasta
198908ec78 ldap: Make ldap2 connection management thread-safe again
This fixes the connection code in LDAPClient to not store the LDAP connection
in an attribute of the object, which in combination with ldap2's per-thread
connections lead to race conditions resulting in connection failures. ldap2
code was updated accordingly.

https://fedorahosted.org/freeipa/ticket/5268

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-09-04 13:31:46 +02:00
Petr Viktorin
fbacc26a6a Use six.integer_types instead of (long, int)
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
3bf91eab25 Use Python3-compatible dict method names
Python 2 has keys()/values()/items(), which return lists,
iterkeys()/itervalues()/iteritems(), which return iterators,
and viewkeys()/viewvalues()/viewitems() which return views.

Python 3 has only keys()/values()/items(), which return views.
To get iterators, one can use iter() or a for loop/comprehension;
for lists there's the list() constructor.

When iterating through the entire dict, without modifying the dict,
 the difference between Python 2's items() and iteritems() is
negligible, especially on small dicts (the main overhead is
extra memory, not CPU time). In the interest of simpler code,
this patch changes many instances of iteritems() to items(),
iterkeys() to keys() etc.

In other cases, helpers like six.itervalues are used.

Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
dd16cc98b0 Use six.string_types instead of "basestring"
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-09-01 11:42:01 +02:00
Petr Viktorin
27dabb4528 Modernize 'except' clauses
The 'as' syntax works from Python 2 on, and Python 3 will
drop the "comma" syntax.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2015-08-12 18:17:23 +02:00
Petr Vobornik
7d10547ae3 allow to call ldap2.destroy_connection multiple times
A regression fix.

Reviewed-By: Nathaniel McCallum <npmccallum@redhat.com>
2015-05-07 18:13:57 +02:00
Petr Vobornik
4364ac08c5 speed up indirect member processing
the old implementation tried to get all entries which are member of group.
That means also user. User can't have any members therefore this costly
processing was unnecessary.

New implementation reduces the search only to entries which have members.

Also page size was removed to avoid paging by small pages(default size: 100)
which is very slow for many members.

https://fedorahosted.org/freeipa/ticket/4947

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-27 05:55:04 +00:00
Jan Cholasta
b48cfe05e9 ldap: Remove IPASimpleLDAPObject
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
e2b0981d60 ldap: Use SimpleLDAPObject instead of IPASimpleLDAPObject in LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
db88498c95 ldap: Move schema handling from IPASimpleLDAPObject to LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
cbb112dd57 ldap: Use LDAPClient instead of IPASimpleLDAPObject in LDAPEntry
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
955885d8d9 ldap: Move value encoding from IPASimpleLDAPObject to LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
232e04d861 ldap: Use LDAPClient bind and unbind methods in IPAdmin
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
c904dea06a ldap: Add bind and unbind methods to LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
45d9b82f40 ldap: Use LDAPClient connection management in IPAdmin
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
02e1ebe07c ldap: Add connection management to LDAPClient
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
a849bca53f ldap: Remove unused IPAdmin methods
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Jan Cholasta
b106450dbf ldap: Drop python-ldap tuple compatibility
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2015-04-16 06:58:31 +00:00
Thierry Bordaz
c20009123f User life cycle: allows MODRDN from ldap2
enhance update_entry_rdn so that is allows
to move an entry a new superior

https://fedorahosted.org/freeipa/ticket/3813

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-04-16 06:50:16 +00:00
Tomas Babej
e11e8235ac baseldap: Handle missing parent objects properly in *-find commands
The find_entries function in ipaldap does not differentiate between
a LDAP search that returns error code 32 (No such object) and LDAP
search returning error code 0 (Success), but returning no results.

In both cases errors.NotFound is raised. In turn, LDAPSearch
commands interpret NotFound exception as no results.

To differentiate between the cases, a new error EmptyResult
was added, which inherits from NotFound to preserve the compatibility
with the new code.

This error is raised by ipaldap.find_entries in case it is performing
a search with and the target dn does not exist.

https://fedorahosted.org/freeipa/ticket/4659

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2015-01-13 16:16:14 +00:00
Martin Basti
29ba9d9d26 Refactoring of autobind, object_exists
Required to prevent code duplications

ipaldap.IPAdmin now has method do_bind, which tries several bind methods
ipaldap.IPAClient now has method object_exists(dn)

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-09-26 13:21:15 +02:00
Alexander Bokovoy
a9fe37e066 ipa-ldap-updater: make possible to use LDAPI with autobind in case of hardened LDAP configuration
When nsslapd-minssf is greater than 0, running as root
  ipa-ldap-updater [-l]
will fail even if we force use of autobind for root over LDAPI.

The reason for this is that schema updater doesn't get ldapi flag passed and
attempts to connect to LDAP port instead and for hardened configurations
using simple bind over LDAP is not enough.

Additionally, report properly previously unhandled LDAP exceptions.
https://fedorahosted.org/freeipa/ticket/3468

Reviewed-By: Petr Spacek <pspacek@redhat.com>
2014-07-04 08:13:23 +02:00
Tomas Babej
a5bb758978 ipaldap: Override conversion of nsds5replicalast{update,init}{start,end}
The replication related attributes with generalized time syntax have
special behaviour implemented in 389, as follows:

In case they are explicitly requested for and not set, 0 is returned.

However, 0 is not a valid value for LDAP Generalized time. Thus
we need to add these attributes to the _SYNTAX_OVERRIDE dictionary,
overriding their conversion to datetime and converting them to
string instead, which perserves the old behaviour expected by the
replication codebase.

https://fedorahosted.org/freeipa/ticket/4350

Reviewed-By: Martin Kosek <mkosek@redhat.com>
2014-07-02 16:12:05 +02:00
Petr Spacek
e821576129 Clarify LDAPClient docstrings about get_entry, get_entries and find_entries
Reviewed-By: Martin Basti <mbasti@redhat.com>
2014-06-20 12:38:58 +02:00
Martin Basti
d0ce6472f7 DNSName conversion in ipaldap
Domain name has to be stored in LDAP in punycoded value

Part of ticket:
IPA should allow internationalized domain names
https://fedorahosted.org/freeipa/ticket/3169

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-06-03 15:55:32 +02:00
Tomas Babej
1df696f543 ipalib: Add DateTime parameter
Adds a parameter that represents a DateTime format using datetime.datetime
object from python's native datetime library.

In the CLI, accepts one of the following formats:
    Accepts LDAP Generalized time without in the following format:
       '%Y%m%d%H%M%SZ'

    Accepts subset of values defined by ISO 8601:
        '%Y-%m-%dT%H:%M:%SZ'
        '%Y-%m-%dT%H:%MZ'
        '%Y-%m-%dZ'

    Also accepts above formats using ' ' (space) as a separator instead of 'T'.

As a simplification, it does not deal with timezone info and ISO 8601
values with timezone info (+-hhmm) are rejected. Values are expected
to be in the UTC timezone.

Values are saved to LDAP as LDAP Generalized time values in the format
'%Y%m%d%H%SZ' (no time fractions and UTC timezone is assumed). To avoid
confusion, in addition to subset of ISO 8601 values, the LDAP generalized
time in the format '%Y%m%d%H%M%SZ' is also accepted as an input (as this is the
format user will see on the output).

Part of: https://fedorahosted.org/freeipa/ticket/3306

Reviewed-By: Jan Cholasta <jcholast@redhat.com>
2014-05-05 18:57:29 +03:00
Jan Cholasta
9814b272af Keep original name when setting attribute in LDAPEntry.
Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:21 +02:00
Jan Cholasta
b4860d09b4 Replace get_syntax method of IPASimpleObject with new get_type method.
get_type returns the Python type for an LDAP attribute.

Reviewed-By: Tomas Babej <tbabej@redhat.com>
2014-04-18 14:59:20 +02:00
Jan Cholasta
c0c38ed314 Fix modlist generation code not to generate empty replace mods.
https://fedorahosted.org/freeipa/ticket/4138
Reviewed-By: Petr Viktorin <pviktori@redhat.com>
2014-03-03 12:14:09 +01:00
Jan Cholasta
5737eaf134 Raise an exception when legacy LDAP API is used. 2014-01-24 20:29:32 +01:00