From kmccarth at redhat.com  Tue Sep  4 17:23:54 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Tue, 4 Sep 2007 10:23:54 -0700
Subject: [Freeipa-devel] [PATCH] add test target to makefiles
Message-ID: <20070904172354.GA3596@moon.usersys.redhat.com>

Adding test target to top-level makefiles and makefiles in direct
subdirs (hook up deeper ones as you need them).

Hooked up the ipa-python unit test to run from the Makefile.

-Kevin
-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1188926565 25200
# Node ID cd1400b2d848ae6a83ccce9679bd6ec034218d93
# Parent  b8e9c44915550cf7d6e935acb804e11e94fea015
Add 'test' target to makefiles.  Hook up ipautil tests to run.

diff -r b8e9c4491555 -r cd1400b2d848 Makefile
--- a/Makefile	Fri Aug 31 10:59:26 2007 -0700
+++ b/Makefile	Tue Sep 04 10:22:45 2007 -0700
@@ -59,6 +59,11 @@ clean:
 		(cd $$subdir && $(MAKE) $@) || exit 1; \
 	done
 	rm -f *~
+
+test:
+	@for subdir in $(SUBDIRS); do \
+		(cd $$subdir && $(MAKE) $@) || exit 1; \
+	done
 
 version-update:
 	sed s/VERSION/$(SERV_VERSION)/ ipa-server/freeipa-server.spec.in \
diff -r b8e9c4491555 -r cd1400b2d848 ipa-admintools/Makefile
--- a/ipa-admintools/Makefile	Fri Aug 31 10:59:26 2007 -0700
+++ b/ipa-admintools/Makefile	Tue Sep 04 10:22:45 2007 -0700
@@ -10,3 +10,5 @@ install:
 
 clean:
 	rm -f *~ *.pyc
+
+test:
diff -r b8e9c4491555 -r cd1400b2d848 ipa-client/Makefile
--- a/ipa-client/Makefile	Fri Aug 31 10:59:26 2007 -0700
+++ b/ipa-client/Makefile	Tue Sep 04 10:22:45 2007 -0700
@@ -21,3 +21,5 @@ clean:
 	done
 	rm -f *~
 	rm -f ipaclient/*~
+
+test:
diff -r b8e9c4491555 -r cd1400b2d848 ipa-python/Makefile
--- a/ipa-python/Makefile	Fri Aug 31 10:59:26 2007 -0700
+++ b/ipa-python/Makefile	Tue Sep 04 10:22:45 2007 -0700
@@ -1,6 +1,7 @@ PYTHONLIBDIR ?= $(shell  python -c "from
 PYTHONLIBDIR ?= $(shell  python -c "from distutils.sysconfig import *; print get_python_lib()")
 PACKAGEDIR ?= $(DESTDIR)/$(PYTHONLIBDIR)/ipa
 CONFIGDIR ?= $(DESTDIR)/etc/ipa
+TESTS = $(wildcard test/*.py)
 
 all: ;
 
@@ -15,3 +16,10 @@ clean:
 clean:
 	rm -f *~ *.pyc
 
+.PHONY: test
+test: $(subst .py,.tst,$(TESTS))
+
+%.tst: %.py
+	python $<
+
+
diff -r b8e9c4491555 -r cd1400b2d848 ipa-python/test/test_ipautil.py
--- a/ipa-python/test/test_ipautil.py	Fri Aug 31 10:59:26 2007 -0700
+++ b/ipa-python/test/test_ipautil.py	Tue Sep 04 10:22:45 2007 -0700
@@ -17,12 +17,17 @@
 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 #
 
+import sys
+sys.path.insert(0, ".")
+
 import unittest
-import ipa.ipautil
+
+import ipautil
+
 
 class TestCIDict(unittest.TestCase):
     def setUp(self):
-        self.cidict = ipa.ipautil.CIDict()
+        self.cidict = ipautil.CIDict()
         self.cidict["Key1"] = "val1"
         self.cidict["key2"] = "val2"
         self.cidict["KEY3"] = "VAL3"
diff -r b8e9c4491555 -r cd1400b2d848 ipa-server/Makefile
--- a/ipa-server/Makefile	Fri Aug 31 10:59:26 2007 -0700
+++ b/ipa-server/Makefile	Tue Sep 04 10:22:45 2007 -0700
@@ -21,3 +21,5 @@ clean:
 	done
 	rm -f *~
 	rm -f ipaserver/*~
+
+test:
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070904/0a823c6f/attachment.bin>

From kmacmill at redhat.com  Tue Sep  4 19:23:03 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 04 Sep 2007 15:23:03 -0400
Subject: [Freeipa-devel] [PATCH] add scriptaculous effects library
In-Reply-To: <20070830220708.GD17333@moon.usersys.redhat.com>
References: <20070830220708.GD17333@moon.usersys.redhat.com>
Message-ID: <1188933783.5497.4.camel@localhost.localdomain>

On Thu, 2007-08-30 at 15:07 -0700, Kevin McCarthy wrote:
> This adds the effects.js library from http://script.aculo.us/.  This
> code is released under the MIT license:
> http://wiki.script.aculo.us/scriptaculous/show/License
> 
> -Kevin
> 

Pushed.

Karl



From kmacmill at redhat.com  Tue Sep  4 19:24:12 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 04 Sep 2007 15:24:12 -0400
Subject: [Freeipa-devel] [PATCH] Autosuggest for uid and email
In-Reply-To: <20070830221127.GE17333@moon.usersys.redhat.com>
References: <20070830221127.GE17333@moon.usersys.redhat.com>
Message-ID: <1188933852.5497.6.camel@localhost.localdomain>

On Thu, 2007-08-30 at 15:11 -0700, Kevin McCarthy wrote:
> This patch adds auto-suggest for the uid and email fields.
> Email searching isn't there yet, so we don't verify email uniqueness
> yet, but it's done for uid.
> 
> -Kevin

Pushed.



From kmacmill at redhat.com  Tue Sep  4 19:29:29 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 04 Sep 2007 15:29:29 -0400
Subject: [Freeipa-devel] [PATCH] Client autoconfiguration
In-Reply-To: <1188518691.6201.6.camel@localhost.localdomain>
References: <1188518691.6201.6.camel@localhost.localdomain>
Message-ID: <1188934169.5497.12.camel@localhost.localdomain>

On Thu, 2007-08-30 at 20:04 -0400, Simo Sorce wrote:
> This patch completes the client tool.
> It does basic autoconfiguration of nss_ldap andpam_krb5 after discovery.
> 
> It is still a bit rough when changing /etc/krb5.conf and depends on a
> yet un-pushed fixed package of nss_ldap (you can download it from koji
> to test).
> 
> But this is a start.
> 

I think that there is a file that you forgot to add last time
(ipadiscovery.py) so the patch to it in this changeset fails.

Karl





From kmacmill at redhat.com  Tue Sep  4 19:30:31 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 04 Sep 2007 15:30:31 -0400
Subject: [Freeipa-devel] [PATCH] add test target to makefiles
In-Reply-To: <20070904172354.GA3596@moon.usersys.redhat.com>
References: <20070904172354.GA3596@moon.usersys.redhat.com>
Message-ID: <1188934231.5497.14.camel@localhost.localdomain>

On Tue, 2007-09-04 at 10:23 -0700, Kevin McCarthy wrote:
> Adding test target to top-level makefiles and makefiles in direct
> subdirs (hook up deeper ones as you need them).
> 
> Hooked up the ipa-python unit test to run from the Makefile.
> 

Pushed.



From kmacmill at redhat.com  Tue Sep  4 19:36:30 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 04 Sep 2007 15:36:30 -0400
Subject: [Freeipa-devel] [PATCH] account deactivation checkbox
In-Reply-To: <20070831180100.GA14043@moon.usersys.redhat.com>
References: <20070831180100.GA14043@moon.usersys.redhat.com>
Message-ID: <1188934590.5497.22.camel@localhost.localdomain>

On Fri, 2007-08-31 at 11:01 -0700, Kevin McCarthy wrote:
> This patch adds account deactivation to the view/add/edit person pages.
> 
> It also fixes a bug in genModList(), to make it case-insensitive for
> keys.

Pushed. As a side note - is inactivation the right word for this?
Locking might be clearer since we talked about a "tombstone" feature for
the future.

Karl



From ssorce at redhat.com  Tue Sep  4 19:42:38 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Tue, 04 Sep 2007 15:42:38 -0400
Subject: [Freeipa-devel] Pushed my patches for client and server
	configuration tools
Message-ID: <1188934958.3329.18.camel@localhost.localdomain>

Karl acked them so I did a big push to bring them all in at the same
time (they are interdependent).

Simo.



From kmacmill at redhat.com  Tue Sep  4 19:45:45 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 04 Sep 2007 15:45:45 -0400
Subject: [Freeipa-devel] [PATCH] Server side conf
In-Reply-To: <1188600343.6201.45.camel@localhost.localdomain>
References: <1188600343.6201.45.camel@localhost.localdomain>
Message-ID: <1188935145.5497.30.camel@localhost.localdomain>

On Fri, 2007-08-31 at 18:45 -0400, Simo Sorce wrote:
> These 2 patches completes the previous ones (depend on them) and
> improves the server installation script.
> Addedd:
>  - request for password admin
>  - changing the admin password via SSL so that the user has a kerberos
> password
>  - fixes around to make all this work
> 

Ack for both.

Karl




From prowley at redhat.com  Tue Sep  4 20:13:55 2007
From: prowley at redhat.com (Pete Rowley)
Date: Tue, 04 Sep 2007 13:13:55 -0700
Subject: [Freeipa-devel] [PATCH] account deactivation checkbox
In-Reply-To: <1188934590.5497.22.camel@localhost.localdomain>
References: <20070831180100.GA14043@moon.usersys.redhat.com>
	<1188934590.5497.22.camel@localhost.localdomain>
Message-ID: <46DDBC83.1030508@redhat.com>

Karl MacMillan wrote:
> On Fri, 2007-08-31 at 11:01 -0700, Kevin McCarthy wrote:
>   
>> This patch adds account deactivation to the view/add/edit person pages.
>>
>> It also fixes a bug in genModList(), to make it case-insensitive for
>> keys.
>>     
>
> Pushed. As a side note - is inactivation the right word for this?
> Locking might be clearer since we talked about a "tombstone" feature for
> the future.
>   
The term locking is overloaded and there are other ways for an account 
to become "locked", such as password expiry and the like. Inactivation 
is the term used by the DS feature to specifically "lock" an account 
without any password mojo going on - I think it is better that we 
conform to that rather than add to the mire.

-- 
Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070904/4d6704bd/attachment.bin>

From ssorce at redhat.com  Tue Sep  4 20:16:49 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Tue, 04 Sep 2007 16:16:49 -0400
Subject: [Freeipa-devel] [PATCH] remove unneded dependency
Message-ID: <1188937009.3329.21.camel@localhost.localdomain>

This patch removes an actual dependency of the freeipa-client on
freeipa-server.

Simo.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-150-ipautil.patch
Type: text/x-patch
Size: 6446 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070904/de42f7bc/attachment.bin>

From kmccarth at redhat.com  Tue Sep  4 20:40:48 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Tue, 4 Sep 2007 13:40:48 -0700
Subject: [Freeipa-devel] [PATCH] Generalized Time parser and tests
Message-ID: <20070904204047.GC3596@moon.usersys.redhat.com>

Attached is a Generalized Time parser, for use in the
krbPaswordExpiration field.  Pete mentioned that this may be better done
on the DS, but I was almost done with the code, so here it is anyway.

This patch depends on Simo's patch just sent to the list:
freeipa-150-ipautil.patch

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1188938699 25200
# Node ID 354f0a246e344b7404e00c0ed4402329c0bb4edc
# Parent  046b581f32f76c3888da4910bb04a7f6f9475e6d
Generalized Time parser and tests, for use in krbPasswordExpiration

diff -r 046b581f32f7 -r 354f0a246e34 ipa-python/ipautil.py
--- a/ipa-python/ipautil.py	Tue Sep 04 16:13:15 2007 -0400
+++ b/ipa-python/ipautil.py	Tue Sep 04 13:44:59 2007 -0700
@@ -30,6 +30,7 @@ from string import lower
 from string import lower
 import re
 import xmlrpclib
+import datetime
 
 def realm_to_suffix(realm_name):
     s = realm_name.split(".")
@@ -233,3 +234,100 @@ def unwrap_binary_data(data):
     else:
         return data
 
+class GeneralizedTimeZone(datetime.tzinfo):
+    """This class is a basic timezone wrapper for the offset specified
+       in a Generalized Time.  It is dst-ignorant."""
+    def __init__(self,offsetstr="Z"):
+        super(GeneralizedTimeZone, self).__init__()
+
+        self.name = offsetstr
+        self.houroffset = 0
+        self.minoffset = 0
+
+        if offsetstr == "Z":
+            self.houroffset = 0
+            self.minoffset = 0
+        else:
+            if (len(offsetstr) >= 3) and re.match(r'[-+]\d\d', offsetstr):
+                self.houroffset = int(offsetstr[0:3])
+                offsetstr = offsetstr[3:]
+            if (len(offsetstr) >= 2) and re.match(r'\d\d', offsetstr):
+                self.minoffset = int(offsetstr[0:2])
+                offsetstr = offsetstr[2:]
+            if len(offsetstr) > 0:
+                raise ValueError()
+        if self.houroffset < 0:
+            self.minoffset *= -1
+
+    def utcoffset(self, dt):
+        return datetime.timedelta(hours=self.houroffset, minutes=self.minoffset)
+
+    def dst(self, dt):
+        return datetime.timedelta(0)
+
+    def tzname(self, dt):
+        return self.name
+
+
+def parse_generalized_time(timestr):
+    """Parses are Generalized Time string (as specified in X.680),
+       returning a datetime object.  Generalized Times are stored inside
+       the krbPasswordExpiration attribute in LDAP.
+
+       This method doesn't attempt to be perfect wrt timezones.  If python
+       can't be bothered to implement them, how can we..."""
+
+    if len(timestr) < 8:
+        return None
+    try:
+        date = timestr[:8]
+        time = timestr[8:]
+
+        year = int(date[:4])
+        month = int(date[4:6])
+        day = int(date[6:8])
+
+        hour = min = sec = msec = 0
+        tzone = None
+
+        if (len(time) >= 2) and re.match(r'\d', time[0]):
+            hour = int(time[:2])
+            time = time[2:]
+            if len(time) >= 2 and (time[0] == "," or time[0] == "."):
+                hour_fraction = "."
+                time = time[1:]
+                while (len(time) > 0) and re.match(r'\d', time[0]):
+                    hour_fraction += time[0]
+                    time = time[1:]
+                total_secs = int(float(hour_fraction) * 3600)
+                min, sec = divmod(total_secs, 60)
+
+        if (len(time) >= 2) and re.match(r'\d', time[0]):
+            min = int(time[:2])
+            time = time[2:]
+            if len(time) >= 2 and (time[0] == "," or time[0] == "."):
+                min_fraction = "."
+                time = time[1:]
+                while (len(time) > 0) and re.match(r'\d', time[0]):
+                    min_fraction += time[0]
+                    time = time[1:]
+                sec = int(float(min_fraction) * 60)
+
+        if (len(time) >= 2) and re.match(r'\d', time[0]):
+            sec = int(time[:2])
+            time = time[2:]
+            if len(time) >= 2 and (time[0] == "," or time[0] == "."):
+                sec_fraction = "."
+                time = time[1:]
+                while (len(time) > 0) and re.match(r'\d', time[0]):
+                    sec_fraction += time[0]
+                    time = time[1:]
+                msec = int(float(sec_fraction) * 1000000)
+
+        if (len(time) > 0):
+            tzone = GeneralizedTimeZone(time)
+
+        return datetime.datetime(year, month, day, hour, min, sec, msec, tzone)
+
+    except ValueError:
+        return None
diff -r 046b581f32f7 -r 354f0a246e34 ipa-python/test/test_ipautil.py
--- a/ipa-python/test/test_ipautil.py	Tue Sep 04 16:13:15 2007 -0400
+++ b/ipa-python/test/test_ipautil.py	Tue Sep 04 13:44:59 2007 -0700
@@ -21,6 +21,7 @@ sys.path.insert(0, ".")
 sys.path.insert(0, ".")
 
 import unittest
+import datetime
 
 import ipautil
 
@@ -207,6 +208,102 @@ class TestCIDict(unittest.TestCase):
         self.assert_(item in items)
         items.discard(item)
 
+class TestTimeParser(unittest.TestCase):
+    def setUp(self):
+        pass
+
+    def tearDown(self):
+        pass
+
+    def testSimple(self):
+        timestr = "20070803"
+
+        time = ipautil.parse_generalized_time(timestr)
+        self.assertEqual(2007, time.year)
+        self.assertEqual(8, time.month)
+        self.assertEqual(3, time.day)
+        self.assertEqual(0, time.hour)
+        self.assertEqual(0, time.minute)
+        self.assertEqual(0, time.second)
+
+    def testHourMinSec(self):
+        timestr = "20051213141205"
+
+        time = ipautil.parse_generalized_time(timestr)
+        self.assertEqual(2005, time.year)
+        self.assertEqual(12, time.month)
+        self.assertEqual(13, time.day)
+        self.assertEqual(14, time.hour)
+        self.assertEqual(12, time.minute)
+        self.assertEqual(5, time.second)
+
+    def testFractions(self):
+        timestr = "2003092208.5"
+
+        time = ipautil.parse_generalized_time(timestr)
+        self.assertEqual(2003, time.year)
+        self.assertEqual(9, time.month)
+        self.assertEqual(22, time.day)
+        self.assertEqual(8, time.hour)
+        self.assertEqual(30, time.minute)
+        self.assertEqual(0, time.second)
+
+        timestr = "199203301544,25"
+
+        time = ipautil.parse_generalized_time(timestr)
+        self.assertEqual(1992, time.year)
+        self.assertEqual(3, time.month)
+        self.assertEqual(30, time.day)
+        self.assertEqual(15, time.hour)
+        self.assertEqual(44, time.minute)
+        self.assertEqual(15, time.second)
+
+        timestr = "20060401185912,8"
+
+        time = ipautil.parse_generalized_time(timestr)
+        self.assertEqual(2006, time.year)
+        self.assertEqual(4, time.month)
+        self.assertEqual(1, time.day)
+        self.assertEqual(18, time.hour)
+        self.assertEqual(59, time.minute)
+        self.assertEqual(12, time.second)
+        self.assertEqual(800000, time.microsecond)
+
+    def testTimeZones(self):
+        timestr = "20051213141205Z"
+
+        time = ipautil.parse_generalized_time(timestr)
+        self.assertEqual(0, time.tzinfo.houroffset)
+        self.assertEqual(0, time.tzinfo.minoffset)
+        offset = time.tzinfo.utcoffset(None)
+        self.assertEqual(0, offset.seconds)
+
+        timestr = "20051213141205+0500"
+
+        time = ipautil.parse_generalized_time(timestr)
+        self.assertEqual(5, time.tzinfo.houroffset)
+        self.assertEqual(0, time.tzinfo.minoffset)
+        offset = time.tzinfo.utcoffset(None)
+        self.assertEqual(5 * 60 * 60, offset.seconds)
+
+        timestr = "20051213141205-0500"
+
+        time = ipautil.parse_generalized_time(timestr)
+        self.assertEqual(-5, time.tzinfo.houroffset)
+        self.assertEqual(0, time.tzinfo.minoffset)
+        # NOTE - the offset is always positive - it's minutes
+        #        _east_ of UTC
+        offset = time.tzinfo.utcoffset(None)
+        self.assertEqual((24 - 5) * 60 * 60, offset.seconds)
+
+        timestr = "20051213141205-0930"
+
+        time = ipautil.parse_generalized_time(timestr)
+        self.assertEqual(-9, time.tzinfo.houroffset)
+        self.assertEqual(-30, time.tzinfo.minoffset)
+        offset = time.tzinfo.utcoffset(None)
+        self.assertEqual(((24 - 9) * 60 * 60) - (30 * 60), offset.seconds)
+
 
 if __name__ == '__main__':
     unittest.main()
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070904/ad5e4391/attachment.bin>

From prowley at redhat.com  Tue Sep  4 22:48:14 2007
From: prowley at redhat.com (Pete Rowley)
Date: Tue, 04 Sep 2007 15:48:14 -0700
Subject: [Freeipa-devel] [PATCH] adding dna plugin from FDS
Message-ID: <46DDE0AE.7070106@redhat.com>


-- 
Pete

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: diffs.txt
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070904/3a4e4d8f/attachment.txt>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070904/3a4e4d8f/attachment.bin>

From rcritten at redhat.com  Wed Sep  5 15:43:41 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Wed, 05 Sep 2007 11:43:41 -0400
Subject: [Freeipa-devel] [PATCH] use forwarded tickets for auth - merged
Message-ID: <46DECEAD.9000008@redhat.com>

Same basic changes as before but re-merged so it should apply cleanly now.

This fairly invasive patch enables LDAP SASL authentication using a 
forwarded kerberos ticket. It can also handle the existing proxied 
authentication method (so it won't break the GUI).

I also refactored the LDAP connection code to be simpler to call, and 
did a few other small bug fixes.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-150-sasl.patch
Type: text/x-patch
Size: 24651 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070905/4a8e05dd/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070905/4a8e05dd/attachment-0001.bin>

From kmccarth at redhat.com  Wed Sep  5 22:48:52 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Wed, 5 Sep 2007 15:48:52 -0700
Subject: [Freeipa-devel] [PATCH] password expiration messages
Message-ID: <20070905224852.GA2073@moon.usersys.redhat.com>

Add password expiration messages to user show/edit.
Small fix to uid and email suggestion - lowercase before generating.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189032844 25200
# Node ID 0e5e5b22b477e9147b810e63b1c7c02fa15ebc09
# Parent  354f0a246e344b7404e00c0ed4402329c0bb4edc
Add password expiration messages to user show/edit pages.
Add userhelper module to provide ui logic.
Fix uid/email suggest to lowercase first.

diff -r 354f0a246e34 -r 0e5e5b22b477 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 04 13:44:59 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Wed Sep 05 15:54:04 2007 -0700
@@ -17,6 +17,7 @@ import ipa.user
 import ipa.user
 import xmlrpclib
 import forms.user
+from helpers import userhelper
 from ipa import ipaerror
 
 ipa.config.init_config()
@@ -203,6 +204,9 @@ class Root(controllers.RootController):
         if (len(givenname) == 0) or (len(sn) == 0):
             return ""
 
+        givenname = givenname.lower()
+        sn = sn.lower()
+
         uid = givenname[0] + sn[:7]
         try:
             client.get_user_by_uid(uid)
@@ -244,6 +248,9 @@ class Root(controllers.RootController):
         if (len(givenname) == 0) or (len(sn) == 0):
             return ""
 
+        givenname = givenname.lower()
+        sn = sn.lower()
+
         # TODO - get from config
         domain = "freeipa.org"
 
diff -r 354f0a246e34 -r 0e5e5b22b477 ipa-server/ipa-gui/ipagui/forms/user.py
--- a/ipa-server/ipa-gui/ipagui/forms/user.py	Tue Sep 04 13:44:59 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/user.py	Wed Sep 05 15:54:04 2007 -0700
@@ -23,6 +23,7 @@ class UserFields():
     uid_hidden = widgets.HiddenField(name="uid")
     uidnumber_hidden = widgets.HiddenField(name="uidnumber")
     gidnumber_hidden = widgets.HiddenField(name="gidnumber")
+    krbPasswordExpiration_hidden = widgets.HiddenField(name="krbPasswordExpiration")
 
     user_orig = widgets.HiddenField(name="user_orig")
 
@@ -53,6 +54,7 @@ class UserEditForm(widgets.Form):
     fields = [UserFields.givenname, UserFields.sn, UserFields.mail,
               UserFields.uid_hidden, UserFields.user_orig,
               UserFields.uidnumber_hidden, UserFields.gidnumber_hidden,
+              UserFields.krbPasswordExpiration_hidden,
               ]
 
     def __init__(self, *args, **kw):
diff -r 354f0a246e34 -r 0e5e5b22b477 ipa-server/ipa-gui/ipagui/helpers/__init__.py
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/helpers/__init__.py	Wed Sep 05 15:54:04 2007 -0700
@@ -0,0 +1,1 @@
+# __init__.py
diff -r 354f0a246e34 -r 0e5e5b22b477 ipa-server/ipa-gui/ipagui/helpers/userhelper.py
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/helpers/userhelper.py	Wed Sep 05 15:54:04 2007 -0700
@@ -0,0 +1,23 @@
+import sys
+import datetime
+
+from ipa import ipautil
+
+def password_expires_in(datestr):
+    """Returns the number of days that password expires in.  Returns a negative number
+       if the password is already expired."""
+    if (datestr == None) or (datestr == ""):
+        return sys.maxint
+
+    expdate = ipautil.parse_generalized_time(datestr)
+    if not expdate:
+        return sys.maxint
+
+    delta = expdate - datetime.datetime.now()
+    return delta.days
+
+def password_is_expired(days):
+    return days < 0
+
+def password_expires_soon(days):
+    return (not password_is_expired(days)) and (days < 7)
diff -r 354f0a246e34 -r 0e5e5b22b477 ipa-server/ipa-gui/ipagui/static/css/style.css
--- a/ipa-server/ipa-gui/ipagui/static/css/style.css	Tue Sep 04 13:44:59 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/static/css/style.css	Wed Sep 05 15:54:04 2007 -0700
@@ -140,6 +140,12 @@ body {
   font-weight: bolder;
 }
 
+.warning_message {
+  font-size: 120%;
+  color: #ee0000;
+  font-weight: bolder;
+}
+
 .fielderror {
   color: red;
   font-weight: bold;
diff -r 354f0a246e34 -r 0e5e5b22b477 ipa-server/ipa-gui/ipagui/templates/useredit.kid
--- a/ipa-server/ipa-gui/ipagui/templates/useredit.kid	Tue Sep 04 13:44:59 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/useredit.kid	Wed Sep 05 15:54:04 2007 -0700
@@ -8,6 +8,24 @@
 <body>
     <h2>Edit Person</h2>
 
+<?python
+from ipagui.helpers import userhelper
+pw_expires_days = userhelper.password_expires_in(user.get("krbPasswordExpiration"))
+pw_expires_soon = userhelper.password_expires_soon(pw_expires_days)
+pw_is_expired = userhelper.password_is_expired(pw_expires_days)
+if pw_expires_days != 1:
+    days_suffix = "s"
+else:
+    days_suffix = ""
+?>
+
+    <div py:if='pw_expires_soon' class="warning_message">
+        Password will expire in ${pw_expires_days} day${days_suffix}
+    </div>
+    <div py:if='pw_is_expired' class="warning_message">
+        Password has expired
+    </div>
+
      ${form.display(action="userupdate", value=user)}
 </body>
 </html>
diff -r 354f0a246e34 -r 0e5e5b22b477 ipa-server/ipa-gui/ipagui/templates/usershow.kid
--- a/ipa-server/ipa-gui/ipagui/templates/usershow.kid	Tue Sep 04 13:44:59 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/usershow.kid	Wed Sep 05 15:54:04 2007 -0700
@@ -7,6 +7,24 @@
 </head>
 <body>
     <h2>View Person</h2>
+
+<?python
+from ipagui.helpers import userhelper
+pw_expires_days = userhelper.password_expires_in(user.get("krbPasswordExpiration"))
+pw_expires_soon = userhelper.password_expires_soon(pw_expires_days)
+pw_is_expired = userhelper.password_is_expired(pw_expires_days)
+if pw_expires_days != 1:
+    days_suffix = "s"
+else:
+    days_suffix = ""
+?>
+
+    <div py:if='pw_expires_soon' class="warning_message">
+        Password will expire in ${pw_expires_days} day${days_suffix}
+    </div>
+    <div py:if='pw_is_expired' class="warning_message">
+        Password has expired
+    </div>
 
     <div class="formsection">Identity Details</div>
     <table class="formtable" cellpadding="2" cellspacing="0" border="0">
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070905/14454eed/attachment.bin>

From kmccarth at redhat.com  Thu Sep  6 00:01:28 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Wed, 5 Sep 2007 17:01:28 -0700
Subject: [Freeipa-devel] [PATCH] small ui tweeks
Message-ID: <20070906000128.GB2073@moon.usersys.redhat.com>

Small adjustments to the ui that started to add up, so broke into a
patch.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189036795 25200
# Node ID fb7131394f05647904166312bb369b77f235a70d
# Parent  0e5e5b22b477e9147b810e63b1c7c02fa15ebc09
Small UI tweeks
- Rename buttons
- Add fake "logged in as" text
- Increase font size and spacing for sidebar
- Fix search messages for no results
- Open ipa footer link in new window

diff -r 0e5e5b22b477 -r fb7131394f05 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Wed Sep 05 15:54:04 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Wed Sep 05 16:59:55 2007 -0700
@@ -108,7 +108,7 @@ class Root(controllers.RootController):
     def userupdate(self, **kw):
         """Updates an existing user"""
         restrict_post()
-        if kw.get('submit') == 'Cancel':
+        if kw.get('submit') == 'Cancel Edit':
             turbogears.flash("Edit user cancelled")
             raise turbogears.redirect('/usershow', uid=kw.get('uid'))
 
diff -r 0e5e5b22b477 -r fb7131394f05 ipa-server/ipa-gui/ipagui/static/css/style.css
--- a/ipa-server/ipa-gui/ipagui/static/css/style.css	Wed Sep 05 15:54:04 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/static/css/style.css	Wed Sep 05 16:59:55 2007 -0700
@@ -29,12 +29,20 @@ body {
   margin:0;
 }
 
+#header #logo {
+}
+
+#header #login {
+  float:right;
+}
+
 
 #nav {
   background:#cc0000;
   color:#fff;
   min-height:3px;
   max-height:3px;
+  clear:both;
 }
 
 #nav ul {
@@ -75,7 +83,11 @@ body {
   float:left;
   width:10%;
   padding: 5px;
-  font-size: small;
+  font-size: medium;
+}
+
+#sidebar p {
+  line-height: 150%;
 }
 
 #sidebar h2 {
diff -r 0e5e5b22b477 -r fb7131394f05 ipa-server/ipa-gui/ipagui/templates/master.kid
--- a/ipa-server/ipa-gui/ipagui/templates/master.kid	Wed Sep 05 15:54:04 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/master.kid	Wed Sep 05 16:59:55 2007 -0700
@@ -26,10 +26,15 @@
 
     <div id="page">
       <div id="header">
-        <a href="${tg.url('/')}"><img 
-          src="${tg.url('/static/images/logo.png')}"
-          border="0"
-          /></a>
+        <div id="login">
+          Logged in as: ace
+        </div>
+        <div id="logo">
+            <a href="${tg.url('/')}"><img 
+            src="${tg.url('/static/images/logo.png')}"
+            border="0"
+            /></a>
+        </div>
       </div>
 
       <div id="nav"><!-- 
@@ -38,21 +43,25 @@
 
       <div id="sidebar">
         <h2>Tasks</h2>
+        <p>
         <a href="${tg.url('/usernew')}">Add Person</a><br/>
         <a href="${tg.url('/userlist')}">Find People</a><br/>
-        <br />
+        </p>
+        <p>
         <a href="${tg.url('/groupindex')}">Add Group</a><br/>
         <a href="${tg.url('/groupindex')}">Find Groups</a><br/>
-        <br />
+        </p>
+        <p>
         <a href="${tg.url('/')}">Manage Policy</a><br/>
         <a href="${tg.url('/')}">Self Service</a><br/>
+        </p>
       </div>
 
       <div py:replace="[item.text]+item[:]"></div>
 
 
       <div id="footer">
-        <a href="http://www.freeipa.com/">Powered by FreeIPA</a>
+        <a href="http://www.freeipa.com/" target="_blank">Powered by FreeIPA</a>
       </div>
     </div>
 
diff -r 0e5e5b22b477 -r fb7131394f05 ipa-server/ipa-gui/ipagui/templates/usereditform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid	Wed Sep 05 15:54:04 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid	Wed Sep 05 16:59:55 2007 -0700
@@ -158,11 +158,13 @@
       <tr>
         <th>
           <br />
-          <input type="submit" class="submitbutton" name="submit" value="Submit"/>
+          <input type="submit" class="submitbutton" name="submit"
+              value="Update Person"/>
         </th>
         <td>
           <br />
-          <input type="submit" class="submitbutton" name="submit" value="Cancel" />
+          <input type="submit" class="submitbutton" name="submit"
+              value="Cancel Edit" />
         </td>
         <td></td>
       </tr>
diff -r 0e5e5b22b477 -r fb7131394f05 ipa-server/ipa-gui/ipagui/templates/userlist.kid
--- a/ipa-server/ipa-gui/ipagui/templates/userlist.kid	Wed Sep 05 15:54:04 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/userlist.kid	Wed Sep 05 16:59:55 2007 -0700
@@ -6,20 +6,18 @@
 <title>Find People</title>
 </head>
 <body>
-    <h2>Find People</h2>
     <div id="search">
         <form action="${tg.url('/userlist')}" method="post">
-            Search:
             <input id="uid" type="text" name="uid" value="${uid}" />
-            <input type="submit" />
+            <input type="submit" value="Find People"/>
         </form>
         <script type="text/javascript">
             document.getElementById("uid").focus();
         </script>
     </div>
-    <div py:if='users != None'>
+    <div py:if='(users != None) and (len(users) > 0)'>
         <h2>${len(users)} results returned:</h2>
-        <table id="resultstable" py:if='len(users) > 0'>
+        <table id="resultstable">
             <tr>
                 <th>
                     <label class="fieldlabel" py:content="fields.uid.label" />
@@ -61,9 +59,9 @@
                 </td>
             </tr>
         </table>
-        <div py:if='len(users) == 0'>
-            No results found.
-        </div>
+    </div>
+    <div py:if='(users != None) and (len(users) == 0)'>
+        <h2>No results found for "${uid}"</h2>
     </div>
 </body>
 </html>
diff -r 0e5e5b22b477 -r fb7131394f05 ipa-server/ipa-gui/ipagui/templates/usernewform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/usernewform.kid	Wed Sep 05 15:54:04 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/usernewform.kid	Wed Sep 05 16:59:55 2007 -0700
@@ -167,15 +167,11 @@
 
     <table class="formtable" cellpadding="2" cellspacing="0" border="0">
       <tr>
-        <th>
-          <br />
-          <input type="submit" class="submitbutton" name="submit" value="Submit"/>
-        </th>
+        <th></th>
         <td>
           <br />
-          <input type="submit" class="submitbutton" name="submit" value="Cancel" />
+          <input type="submit" class="submitbutton" name="submit" value="Add Person"/>
         </td>
-        <td></td>
       </tr>
     </table>
 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070905/e86cce83/attachment.bin>

From kmccarth at redhat.com  Thu Sep  6 00:28:37 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Wed, 5 Sep 2007 17:28:37 -0700
Subject: [Freeipa-devel] UID and email address suggestion algorithms
Message-ID: <20070906002837.GC2073@moon.usersys.redhat.com>

This code was committed previously, but deserves some discussion before
it sees the light of day.  Right now the code is in controllers.py:
suggest_uid and suggest_email.

The uid tries in the following order:
- givenname[0] + sn[:7]
- givenname[:7] + sn[0]
- (givenname + sn)[:8]
- sn[:8]
- lastly, it appends an incrementing counter to givenname[0] + sn[:7]

For the email address, the code isn't activated yet, but I suggest
trying:
- "%s.%s@%s" % (givenname, sn, domain)
- the result of suggest_uid() @domain

Comments?  Do you think the ordering is good?

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070905/42bbe9f7/attachment.bin>

From prowley at redhat.com  Thu Sep  6 00:44:00 2007
From: prowley at redhat.com (Pete Rowley)
Date: Wed, 05 Sep 2007 17:44:00 -0700
Subject: [Freeipa-devel] UID and email address suggestion algorithms
In-Reply-To: <20070906002837.GC2073@moon.usersys.redhat.com>
References: <20070906002837.GC2073@moon.usersys.redhat.com>
Message-ID: <46DF4D50.6010704@redhat.com>

Kevin McCarthy wrote:
> Comments?  Do you think the ordering is good?
>   
Looks good.

-- 
Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070905/86038d7f/attachment.bin>

From ssorce at redhat.com  Thu Sep  6 03:38:28 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Wed, 05 Sep 2007 23:38:28 -0400
Subject: [Freeipa-devel] UID and email address suggestion algorithms
In-Reply-To: <20070906002837.GC2073@moon.usersys.redhat.com>
References: <20070906002837.GC2073@moon.usersys.redhat.com>
Message-ID: <1189049908.3329.40.camel@localhost.localdomain>

On Wed, 2007-09-05 at 17:28 -0700, Kevin McCarthy wrote:
> This code was committed previously, but deserves some discussion before
> it sees the light of day.  Right now the code is in controllers.py:
> suggest_uid and suggest_email.
> 
> The uid tries in the following order:
> - givenname[0] + sn[:7]
> - givenname[:7] + sn[0]
> - (givenname + sn)[:8]
> - sn[:8]
> - lastly, it appends an incrementing counter to givenname[0] + sn[:7]
> 
> For the email address, the code isn't activated yet, but I suggest
> trying:
> - "%s.%s@%s" % (givenname, sn, domain)
> - the result of suggest_uid() @domain
> 
> Comments?  Do you think the ordering is good?

I am sure customers will come asking for customizing the way this is
done.
Every company you visit have their own standards to create user names
and sometimes they simply cannot be changed.
Is there any chance we can express this as a set of regexp stored on the
directory that the app fetches? This way they can be easily customized.

Simo.



From rcritten at redhat.com  Thu Sep  6 12:45:59 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Thu, 06 Sep 2007 08:45:59 -0400
Subject: [Freeipa-devel] [PATCH] password expiration messages
In-Reply-To: <20070905224852.GA2073@moon.usersys.redhat.com>
References: <20070905224852.GA2073@moon.usersys.redhat.com>
Message-ID: <46DFF687.9040507@redhat.com>

Kevin McCarthy wrote:
> Add password expiration messages to user show/edit.
> Small fix to uid and email suggestion - lowercase before generating.
> 

+1

The # of days warning should definitely be user-configurable somewhere. 
We need to make a note of that.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070906/d9f8cd40/attachment.bin>

From rcritten at redhat.com  Thu Sep  6 12:47:47 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Thu, 06 Sep 2007 08:47:47 -0400
Subject: [Freeipa-devel] [PATCH] small ui tweeks
In-Reply-To: <20070906000128.GB2073@moon.usersys.redhat.com>
References: <20070906000128.GB2073@moon.usersys.redhat.com>
Message-ID: <46DFF6F3.9070409@redhat.com>

Kevin McCarthy wrote:
> Small adjustments to the ui that started to add up, so broke into a
> patch.
> 
> -Kevin
> 

+1

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070906/a9ab123a/attachment.bin>

From rcritten at redhat.com  Thu Sep  6 12:50:20 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Thu, 06 Sep 2007 08:50:20 -0400
Subject: [Freeipa-devel] UID and email address suggestion algorithms
In-Reply-To: <20070906002837.GC2073@moon.usersys.redhat.com>
References: <20070906002837.GC2073@moon.usersys.redhat.com>
Message-ID: <46DFF78C.6050204@redhat.com>

Kevin McCarthy wrote:
> This code was committed previously, but deserves some discussion before
> it sees the light of day.  Right now the code is in controllers.py:
> suggest_uid and suggest_email.
> 
> The uid tries in the following order:
> - givenname[0] + sn[:7]
> - givenname[:7] + sn[0]
> - (givenname + sn)[:8]
> - sn[:8]
> - lastly, it appends an incrementing counter to givenname[0] + sn[:7]
> 
> For the email address, the code isn't activated yet, but I suggest
> trying:
> - "%s.%s@%s" % (givenname, sn, domain)
> - the result of suggest_uid() @domain
> 
> Comments?  Do you think the ordering is good?

Should it enforce a minimum uid length?

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070906/09a9888b/attachment.bin>

From kmccarth at redhat.com  Thu Sep  6 16:20:25 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 6 Sep 2007 09:20:25 -0700
Subject: [Freeipa-devel] UID and email address suggestion algorithms
In-Reply-To: <46DFF78C.6050204@redhat.com>
References: <20070906002837.GC2073@moon.usersys.redhat.com>
	<46DFF78C.6050204@redhat.com>
Message-ID: <20070906162025.GA23442@moon.usersys.redhat.com>

Rob Crittenden wrote:
> Kevin McCarthy wrote:
>> This code was committed previously, but deserves some discussion before
>> it sees the light of day.  Right now the code is in controllers.py:
>> suggest_uid and suggest_email.
>> The uid tries in the following order:
>> - givenname[0] + sn[:7]
>> - givenname[:7] + sn[0]
>> - (givenname + sn)[:8]
>> - sn[:8]
>> - lastly, it appends an incrementing counter to givenname[0] + sn[:7]
>> For the email address, the code isn't activated yet, but I suggest
>> trying:
>> - "%s.%s@%s" % (givenname, sn, domain)
>> - the result of suggest_uid() @domain
>> Comments?  Do you think the ordering is good?
>
> Should it enforce a minimum uid length?

Don't know.  I know we need to support many different systems, so I
thought "lowest common denominator" would be 8 chars.  I'm reluctant to
increase this unless someone confirms it's okay.

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070906/4fab7efe/attachment.bin>

From kmccarth at redhat.com  Thu Sep  6 16:29:27 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 6 Sep 2007 09:29:27 -0700
Subject: [Freeipa-devel] UID and email address suggestion algorithms
In-Reply-To: <1189049908.3329.40.camel@localhost.localdomain>
References: <20070906002837.GC2073@moon.usersys.redhat.com>
	<1189049908.3329.40.camel@localhost.localdomain>
Message-ID: <20070906162927.GB23442@moon.usersys.redhat.com>

Simo Sorce wrote:
> I am sure customers will come asking for customizing the way this is
> done.
> Every company you visit have their own standards to create user names
> and sometimes they simply cannot be changed.
> Is there any chance we can express this as a set of regexp stored on the
> directory that the app fetches? This way they can be easily customized.

I agree companies will want to customize this.  However, I think we'll
need more than just a regexp to fully express this.  Another idea might
be to provide a set of methods that we supply, and they can specify
which to use and in which order.  If they want to customize, they can
code up a method (in Python) and add it to a special directory.

This may take some time to get right, so my feeling for right now is
provide a reasonable default and a way to disable auto-suggest.  If
there is time later (after getting more of the application done) we can
revisit or perhaps push to 2.0.

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070906/a69caa8e/attachment.bin>

From kmacmill at redhat.com  Thu Sep  6 17:49:32 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 06 Sep 2007 13:49:32 -0400
Subject: [Freeipa-devel] UID and email address suggestion algorithms
In-Reply-To: <20070906162025.GA23442@moon.usersys.redhat.com>
References: <20070906002837.GC2073@moon.usersys.redhat.com>
	<46DFF78C.6050204@redhat.com>
	<20070906162025.GA23442@moon.usersys.redhat.com>
Message-ID: <1189100972.5251.12.camel@localhost.localdomain>

On Thu, 2007-09-06 at 09:20 -0700, Kevin McCarthy wrote:
> Rob Crittenden wrote:
> > Kevin McCarthy wrote:
> >> This code was committed previously, but deserves some discussion before
> >> it sees the light of day.  Right now the code is in controllers.py:
> >> suggest_uid and suggest_email.
> >> The uid tries in the following order:
> >> - givenname[0] + sn[:7]
> >> - givenname[:7] + sn[0]
> >> - (givenname + sn)[:8]
> >> - sn[:8]
> >> - lastly, it appends an incrementing counter to givenname[0] + sn[:7]
> >> For the email address, the code isn't activated yet, but I suggest
> >> trying:
> >> - "%s.%s@%s" % (givenname, sn, domain)
> >> - the result of suggest_uid() @domain
> >> Comments?  Do you think the ordering is good?
> >
> > Should it enforce a minimum uid length?
> 
> Don't know.  I know we need to support many different systems, so I
> thought "lowest common denominator" would be 8 chars.  I'm reluctant to
> increase this unless someone confirms it's okay.
> 

Even this might be unacceptable in some places - so it would need to be
defeatable or configurable.

Karl



From kmccarth at redhat.com  Thu Sep  6 18:11:08 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 6 Sep 2007 11:11:08 -0700
Subject: [Freeipa-devel] [PATCH] search box in header, other fixes
Message-ID: <20070906181107.GA25833@moon.usersys.redhat.com>

This patch adds a search box into the header.
It changes the account status to use a select instead of a checkbox.
It also makes a small improvement to auto-suggest, to keep suggesting
(as you fix the name) until you overwrite the suggestion yourself.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189102152 25200
# Node ID b401723077f1f3e705f983185b07c47a95eb2579
# Parent  fb7131394f05647904166312bb369b77f235a70d
Add search box in header.
Change account status to use select list and 'active'/'inactive' values.
Improve autosuggest to keep suggesting unless you overwrite a suggestion
(if you correct the name, it will re-suggest).

diff -r fb7131394f05 -r b401723077f1 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Wed Sep 05 16:59:55 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Thu Sep 06 11:09:12 2007 -0700
@@ -47,6 +47,14 @@ class Root(controllers.RootController):
     @expose(template="ipagui.templates.welcome")
     def index(self):
         return dict()
+
+    @expose()
+    def topsearch(self, **kw):
+        if kw.get('searchtype') == "Users":
+            return self.userlist(uid=kw.get('searchvalue'))
+        else:
+            return self.index()
+
 
 
     ########
diff -r fb7131394f05 -r b401723077f1 ipa-server/ipa-gui/ipagui/forms/user.py
--- a/ipa-server/ipa-gui/ipagui/forms/user.py	Wed Sep 05 16:59:55 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/user.py	Thu Sep 06 11:09:12 2007 -0700
@@ -10,7 +10,10 @@ class UserFields():
     sn = widgets.TextField(name="sn", label="Last name")
     mail = widgets.TextField(name="mail", label="E-mail address")
     telephonenumber = widgets.TextField(name="telephonenumber", label="Phone")
-    nsAccountLock = widgets.CheckBox(name="nsAccountLock", label="Account Deactivated")
+    # nsAccountLock = widgets.CheckBox(name="nsAccountLock", label="Account Deactivated")
+    nsAccountLock = widgets.SingleSelectField(name="nsAccountLock",
+            label="Account Status",
+            options = [("", "active"), ("true", "inactive")])
 
     uid.validator = validators.PlainText(not_empty=True)
     userpassword.validator = validators.String(not_empty=True)
diff -r fb7131394f05 -r b401723077f1 ipa-server/ipa-gui/ipagui/helpers/userhelper.py
--- a/ipa-server/ipa-gui/ipagui/helpers/userhelper.py	Wed Sep 05 16:59:55 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/helpers/userhelper.py	Thu Sep 06 11:09:12 2007 -0700
@@ -21,3 +21,9 @@ def password_is_expired(days):
 
 def password_expires_soon(days):
     return (not password_is_expired(days)) and (days < 7)
+
+def account_status_display(status):
+    if status == "true":
+        return "inactive"
+    else:
+        return "active"
diff -r fb7131394f05 -r b401723077f1 ipa-server/ipa-gui/ipagui/static/css/style.css
--- a/ipa-server/ipa-gui/ipagui/static/css/style.css	Wed Sep 05 16:59:55 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/static/css/style.css	Thu Sep 06 11:09:12 2007 -0700
@@ -17,6 +17,7 @@ body {
   background:#ccc;   /* should be same as #sidebar */
   margin:0 auto;
   width:100%;
+  clear:both;
 }
 
 
@@ -24,16 +25,25 @@ body {
   background:#fff;
 }
 
-#header h1 {
-  padding:5px;
-  margin:0;
+#header #logo {
+  float:left;
 }
 
-#header #logo {
+#header #headerinfo {
+  text-align:right;
 }
 
-#header #login {
-  float:right;
+#header #headerinfo #login {
+}
+
+#header #headerinfo #topsearch {
+  padding-top: 15px;
+}
+
+.searchtext {
+  background-color:#E5F1F4;
+  border:1px solid #8E8E8E;
+  color:#444444;
 }
 
 
@@ -42,7 +52,6 @@ body {
   color:#fff;
   min-height:3px;
   max-height:3px;
-  clear:both;
 }
 
 #nav ul {
diff -r fb7131394f05 -r b401723077f1 ipa-server/ipa-gui/ipagui/templates/master.kid
--- a/ipa-server/ipa-gui/ipagui/templates/master.kid	Wed Sep 05 16:59:55 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/master.kid	Thu Sep 06 11:09:12 2007 -0700
@@ -24,19 +24,41 @@
         </span>
     </div>
 
-    <div id="page">
-      <div id="header">
+    <div id="header">
+      <div id="logo">
+        <a href="${tg.url('/')}"><img 
+        src="${tg.url('/static/images/logo.png')}"
+        border="0"
+        /></a>
+      </div>
+      <div id="headerinfo">
         <div id="login">
           Logged in as: ace
         </div>
-        <div id="logo">
-            <a href="${tg.url('/')}"><img 
-            src="${tg.url('/static/images/logo.png')}"
-            border="0"
-            /></a>
+        <div id="topsearch">
+          <form action="${tg.url('/topsearch')}" method="post">
+            <select name="searchtype">
+                <option>Users</option>
+                <option>Groups</option>
+            </select>
+            <input class="searchtext" id="topsearchbox" type="text"
+              name="searchvalue"
+              value="Type search terms here."
+              onfocus="clearsearch()" />
+            <input type="submit" value="Search"/>
+          </form>
+          <script type="text/javascript">
+            function clearsearch() {
+              topsearchbox = document.getElementById('topsearchbox');
+              topsearchbox.onfocus = null;
+              topsearchbox.value = "";
+            }
+          </script>
         </div>
       </div>
+    </div>
 
+    <div id="page">
       <div id="nav"><!-- 
       This used to have links.  Keeping around in case we move them back...
       --></div>
diff -r fb7131394f05 -r b401723077f1 ipa-server/ipa-gui/ipagui/templates/usernewform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/usernewform.kid	Wed Sep 05 16:59:55 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/usernewform.kid	Thu Sep 06 11:09:12 2007 -0700
@@ -27,6 +27,9 @@
           <span py:if="tg.errors.get('sn')" class="fielderror"
               py:content="tg.errors.get('sn')" />
           <script type="text/javascript">
+            var uid_suggest = ""
+            var mail_suggest = ""
+
             function autofill(self) {
               givenname = document.getElementById('form_givenname');
               sn = document.getElementById('form_sn');
@@ -35,22 +38,24 @@
               }
               uid = document.getElementById('form_uid');
               mail = document.getElementById('form_mail');
-              if (uid.value == "") {
+              if ((uid.value == "") || (uid.value == uid_suggest)) {
                 new Ajax.Request('${tg.url('/suggest_uid')}', {
                     method: 'get',
                     parameters: {'givenname': givenname.value, 'sn': sn.value},
                     onSuccess: function(transport) {
                         uid.value = transport.responseText;
+                        uid_suggest = uid.value;
                         new Effect.Highlight(uid);
                       }
                     });
               }
-              if (mail.value == "") {
+              if ((mail.value == "") || (mail.value == mail_suggest)) {
                 new Ajax.Request('${tg.url('/suggest_email')}', {
                     method: 'get',
                     parameters: {'givenname': givenname.value, 'sn': sn.value},
                     onSuccess: function(transport) {
                         mail.value = transport.responseText;
+                        mail_suggest = mail.value;
                         new Effect.Highlight(mail);
                       }
                     });
diff -r fb7131394f05 -r b401723077f1 ipa-server/ipa-gui/ipagui/templates/usershow.kid
--- a/ipa-server/ipa-gui/ipagui/templates/usershow.kid	Wed Sep 05 16:59:55 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/usershow.kid	Thu Sep 06 11:09:12 2007 -0700
@@ -86,7 +86,7 @@ else:
         <th>
           <label class="fieldlabel" py:content="fields.nsAccountLock.label" />:
         </th>
-        <td>${user.get("nsAccountLock")}</td>
+        <td>${userhelper.account_status_display(user.get("nsAccountLock"))}</td>
       </tr>
     </table>
 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070906/52f872b2/attachment.bin>

From prowley at redhat.com  Thu Sep  6 19:16:34 2007
From: prowley at redhat.com (Pete Rowley)
Date: Thu, 06 Sep 2007 12:16:34 -0700
Subject: [Freeipa-devel] UID and email address suggestion algorithms
In-Reply-To: <20070906162927.GB23442@moon.usersys.redhat.com>
References: <20070906002837.GC2073@moon.usersys.redhat.com>	<1189049908.3329.40.camel@localhost.localdomain>
	<20070906162927.GB23442@moon.usersys.redhat.com>
Message-ID: <46E05212.8040409@redhat.com>

Kevin McCarthy wrote:
> This may take some time to get right, so my feeling for right now is
> provide a reasonable default and a way to disable auto-suggest.  If
> there is time later (after getting more of the application done) we can
> revisit or perhaps push to 2.0.
>   
I think this is more than adequate for v1.0. If some deployments want 
different behavior it is not impossible to change - these are just 
scripts after all.

-- 
Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070906/9f409a3e/attachment.bin>

From kmccarth at redhat.com  Thu Sep  6 21:27:19 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 6 Sep 2007 14:27:19 -0700
Subject: [Freeipa-devel] [PATCH] confirm password
Message-ID: <20070906212719.GB25833@moon.usersys.redhat.com>

After some feedback from Bob and Pete, I'm removing the password
generator and adding a confirm password field.  (Just commented out for
now in case people change their mind)

Factored out the validators.

Minor css tweaks.

This is a small fix, but I have to rebuild my dev environment and wanted
to get it to the list before then.

-Kevin
-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189114101 25200
# Node ID 9ec22fc089922c9479ce5b9d523313965a8d576a
# Parent  b401723077f1f3e705f983185b07c47a95eb2579
Password changes:
  - remove password generator button
  - add confirm password field

diff -r b401723077f1 -r 9ec22fc08992 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Thu Sep 06 11:09:12 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Thu Sep 06 14:28:21 2007 -0700
@@ -197,7 +197,7 @@ class Root(controllers.RootController):
     def userindex(self):
         raise turbogears.redirect("/userlist")
 
-    @expose()
+    # @expose()
     def generate_password(self):
         password = ""
         generator = random.SystemRandom()
diff -r b401723077f1 -r 9ec22fc08992 ipa-server/ipa-gui/ipagui/forms/user.py
--- a/ipa-server/ipa-gui/ipagui/forms/user.py	Thu Sep 06 11:09:12 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/user.py	Thu Sep 06 14:28:21 2007 -0700
@@ -3,7 +3,9 @@ from turbogears import validators, widge
 
 class UserFields():
     uid = widgets.TextField(name="uid", label="Login")
-    userpassword = widgets.TextField(name="userpassword", label="Password")
+    userpassword = widgets.PasswordField(name="userpassword", label="Password")
+    userpassword_confirm = widgets.PasswordField(name="userpassword_confirm",
+            label="Confirm Password")
     uidnumber = widgets.TextField(name="uidnumber", label="UID")
     gidnumber = widgets.TextField(name="gidnumber", label="GID")
     givenname = widgets.TextField(name="givenname", label="First name")
@@ -15,14 +17,6 @@ class UserFields():
             label="Account Status",
             options = [("", "active"), ("true", "inactive")])
 
-    uid.validator = validators.PlainText(not_empty=True)
-    userpassword.validator = validators.String(not_empty=True)
-    givenname.validator = validators.String(not_empty=True)
-    sn.validator = validators.String(not_empty=True)
-    mail.validator = validators.Email(not_empty=True)
-    #  validators.PhoneNumber may be a bit too picky, requiring an area code
-    telephonenumber.validator = validators.PlainText(not_empty=True)
-
     uid_hidden = widgets.HiddenField(name="uid")
     uidnumber_hidden = widgets.HiddenField(name="uidnumber")
     gidnumber_hidden = widgets.HiddenField(name="gidnumber")
@@ -30,6 +24,20 @@ class UserFields():
 
     user_orig = widgets.HiddenField(name="user_orig")
 
+class UserNewValidator(validators.Schema):
+    uid = validators.PlainText(not_empty=True)
+    userpassword = validators.String(not_empty=True)
+    userpassword_confirm = validators.String(not_empty=True)
+    givenname = validators.String(not_empty=True)
+    sn = validators.String(not_empty=True)
+    mail = validators.Email(not_empty=True)
+    #  validators.PhoneNumber may be a bit too picky, requiring an area code
+    # telephonenumber = validators.PlainText(not_empty=False)
+
+    chained_validators = [
+      validators.FieldsMatch('userpassword', 'userpassword_confirm')
+    ]
+
 
 class UserNewForm(widgets.Form):
     params = ['user']
@@ -37,6 +45,8 @@ class UserNewForm(widgets.Form):
     fields = [UserFields.uid, UserFields.givenname,
               UserFields.uidnumber, UserFields.gidnumber,
               UserFields.sn, UserFields.mail]
+
+    validator = UserNewValidator()
 
     def __init__(self, *args, **kw):
         super(UserNewForm,self).__init__(*args, **kw)
@@ -50,6 +60,18 @@ class UserNewForm(widgets.Form):
     def has_foo(self):
         return False
 
+class UserEditValidator(validators.Schema):
+    userpassword = validators.String(not_empty=False)
+    userpassword_confirm = validators.String(not_empty=False)
+    givenname = validators.String(not_empty=True)
+    sn = validators.String(not_empty=True)
+    mail = validators.Email(not_empty=True)
+    #  validators.PhoneNumber may be a bit too picky, requiring an area code
+    # telephonenumber = validators.PlainText(not_empty=False)
+
+    chained_validators = [
+      validators.FieldsMatch('userpassword', 'userpassword_confirm')
+    ]
 
 class UserEditForm(widgets.Form):
     params = ['user']
@@ -59,6 +81,8 @@ class UserEditForm(widgets.Form):
               UserFields.uidnumber_hidden, UserFields.gidnumber_hidden,
               UserFields.krbPasswordExpiration_hidden,
               ]
+
+    validator = UserEditValidator()
 
     def __init__(self, *args, **kw):
         super(UserEditForm,self).__init__(*args, **kw)
diff -r b401723077f1 -r 9ec22fc08992 ipa-server/ipa-gui/ipagui/static/css/style.css
--- a/ipa-server/ipa-gui/ipagui/static/css/style.css	Thu Sep 06 11:09:12 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/static/css/style.css	Thu Sep 06 14:28:21 2007 -0700
@@ -31,6 +31,7 @@ body {
 
 #header #headerinfo {
   text-align:right;
+  padding-right:10px;
 }
 
 #header #headerinfo #login {
diff -r b401723077f1 -r 9ec22fc08992 ipa-server/ipa-gui/ipagui/templates/usereditform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid	Thu Sep 06 11:09:12 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid	Thu Sep 06 14:28:21 2007 -0700
@@ -56,8 +56,9 @@
           <span py:replace="user.userpassword.display(value_for(user.userpassword))" />
           <span py:if="tg.errors.get('userpassword')" class="fielderror"
               py:content="tg.errors.get('userpassword')" />
+
+          <!-- 
           <span id="password_text">********</span>
-
           <input id="genpassword_button" type="button" value="Generate Password"
               disabled="true"
               onclick="new Ajax.Request('${tg.url('/generate_password')}',
@@ -89,6 +90,20 @@
               }
             }
           </script>
+          -->
+        </td>
+      </tr>
+
+      <tr>
+        <th valign="top">
+          <label class="fieldlabel" for="${user.userpassword_confirm.field_id}"
+            py:content="user.userpassword_confirm.label" />:
+        </th>
+        <td valign="top">
+          <span py:replace="user.userpassword_confirm.display(
+               value_for(user.userpassword_confirm))" />
+          <span py:if="tg.errors.get('userpassword_confirm')" class="fielderror"
+              py:content="tg.errors.get('userpassword_confirm')" />
         </td>
       </tr>
 
diff -r b401723077f1 -r 9ec22fc08992 ipa-server/ipa-gui/ipagui/templates/usernewform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/usernewform.kid	Thu Sep 06 11:09:12 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/usernewform.kid	Thu Sep 06 14:28:21 2007 -0700
@@ -92,6 +92,7 @@
           <span py:if="tg.errors.get('userpassword')" class="fielderror"
               py:content="tg.errors.get('userpassword')" />
 
+          <!--
           <input type="button" value="Generate Password"
               onclick="new Ajax.Request('${tg.url('/generate_password')}',
                 {
@@ -101,6 +102,20 @@
                         transport.responseText;
                   }
                 });" />
+            -->
+        </td>
+      </tr>
+
+      <tr>
+        <th>
+          <label class="fieldlabel" for="${user.userpassword_confirm.field_id}"
+            py:content="user.userpassword_confirm.label" />:
+        </th>
+        <td>
+          <span py:replace="user.userpassword_confirm.display(
+              value_for(user.userpassword_confirm))" />
+          <span py:if="tg.errors.get('userpassword_confirm')" class="fielderror"
+              py:content="tg.errors.get('userpassword_confirm')" />
         </td>
       </tr>
 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070906/05272cda/attachment.bin>

From ssorce at redhat.com  Thu Sep  6 22:05:42 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 06 Sep 2007 18:05:42 -0400
Subject: [Freeipa-devel] [PATCH] Client install config file parsing/changing
Message-ID: <1189116342.3329.52.camel@localhost.localdomain>

This patch introduce a much better class to manipulate config files.
It has been tested with the ldap.conf and krb5.conf files and should
work
without any problem with smb.conf as well as other similar config files.

This patch also stop trying changing the ldap.conf and krb5.conf files
on client installs for now, as previously configured files existing on
the system may render the authentication/enumeration of users unusable
if strange directives where found. The original files are backuped. In
future we may switch back to changing config files, but before doing
that we need a lot more testing on what options are compatible and which
are not with our setup.

Right now running ipa-client-install on a client configures it correctly
(you just need to reboot the system or restart services to be able to
authenticate with pam_krb5).
The only gotcha is that until the fixed nss_ldap packages are available
adding the following line to /etc/ldap.conf is still needed:
host 1.2.3.4
     ^^^^^^^--IP address of the IPA server

Simo.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-151-conffiles.patch
Type: text/x-patch
Size: 26150 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070906/34f25260/attachment.bin>

From kmccarth at redhat.com  Thu Sep  6 23:19:36 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 6 Sep 2007 16:19:36 -0700
Subject: [Freeipa-devel] [PATCH] krb/dsinstance.py has 'from util import *'
Message-ID: <20070906231935.GC25833@moon.usersys.redhat.com>

Just a heads-up that dsinstance.py seems to be using the old util
package still.  Maybe I missed a patch file, but a quick glance didn't
find one.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189120867 25200
# Node ID 31924e58a3c3a0e550d7ebc68c89b03fa1a10f3f
# Parent  9ec22fc089922c9479ce5b9d523313965a8d576a
Fix dsinstance.py and krbinstance.py imports

diff -r 9ec22fc08992 -r 31924e58a3c3 ipa-server/ipaserver/dsinstance.py
--- a/ipa-server/ipaserver/dsinstance.py	Thu Sep 06 14:28:21 2007 -0700
+++ b/ipa-server/ipaserver/dsinstance.py	Thu Sep 06 16:21:07 2007 -0700
@@ -24,7 +24,7 @@ import shutil
 import shutil
 import logging
 import pwd
-from util import *
+from ipa.ipautil import *
 
 
 SHARE_DIR = "/usr/share/ipa/"
diff -r 9ec22fc08992 -r 31924e58a3c3 ipa-server/ipaserver/krbinstance.py
--- a/ipa-server/ipaserver/krbinstance.py	Thu Sep 06 14:28:21 2007 -0700
+++ b/ipa-server/ipaserver/krbinstance.py	Thu Sep 06 16:21:07 2007 -0700
@@ -29,7 +29,7 @@ import pwd
 import pwd
 import socket
 import time
-from util import *
+from ipa.ipautil import *
 
 def host_to_domain(fqdn):
     s = fqdn.split(".")
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070906/b67faaf9/attachment.bin>

From rcritten at redhat.com  Fri Sep  7 13:10:08 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 07 Sep 2007 09:10:08 -0400
Subject: [Freeipa-devel] command-line arguments
Message-ID: <46E14DB0.40704@redhat.com>

The command-line tools now are more like beefy unit tests. Some of them 
are very simple so probably don't require a lot more work, but others 
do, particularly the ones to add and modify users.

What attributes do we want to allow and/or require? I picked more or 
less at random when writing it originally, using luseradd as a loose model.

Currently it requires first name, lats name and uid. Optional are gecos 
and home directory.

The main questions I have, some of which apply to adding a user in 
general, are:

- Will we allow the password to be set?
- Should adding a user create a user-specific group?
- Can we set the shell?
- Can we override the uidNumber?
- Do we create any directories?

And for the tools in general, do we want an interactive mode?

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/63620f89/attachment.bin>

From ssorce at redhat.com  Fri Sep  7 14:01:28 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 07 Sep 2007 10:01:28 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <46E14DB0.40704@redhat.com>
References: <46E14DB0.40704@redhat.com>
Message-ID: <1189173688.19300.4.camel@localhost.localdomain>

On Fri, 2007-09-07 at 09:10 -0400, Rob Crittenden wrote:
> The command-line tools now are more like beefy unit tests. Some of them 
> are very simple so probably don't require a lot more work, but others 
> do, particularly the ones to add and modify users.
> 
> What attributes do we want to allow and/or require? I picked more or 
> less at random when writing it originally, using luseradd as a loose model.
> 
> Currently it requires first name, lats name and uid. Optional are gecos 
> and home directory.

Requiring First and Last names kills service users which have none, I'd
make that optional

> The main questions I have, some of which apply to adding a user in 
> general, are:
> 
> - Will we allow the password to be set?
Why not? You would have to go another step to set it if you don't allow
it here.

> - Should adding a user create a user-specific group?
I'd say no, users are created which are members of the default users
group or another specified existing group.

> - Can we set the shell?
We need a default of some sort, but I guess we should be able to set it.

> - Can we override the uidNumber?
IMO, we shouldn't, is there any reason why an admin should specify an
uidNumber on creation ?

> - Do we create any directories?
IMO, no, where would you create them? the tool may even run on a PDA on
the other side of the world at some point, and usually it runs on the
admin workstation anyway.
Should we instead configure pam_mkhomedir by default ?

> And for the tools in general, do we want an interactive mode?

IMO, yes.

Simo.



From rcritten at redhat.com  Fri Sep  7 14:19:13 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 07 Sep 2007 10:19:13 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189173688.19300.4.camel@localhost.localdomain>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
Message-ID: <46E15DE1.40103@redhat.com>

Simo Sorce wrote:
> On Fri, 2007-09-07 at 09:10 -0400, Rob Crittenden wrote:
>> The command-line tools now are more like beefy unit tests. Some of them 
>> are very simple so probably don't require a lot more work, but others 
>> do, particularly the ones to add and modify users.
>>
>> What attributes do we want to allow and/or require? I picked more or 
>> less at random when writing it originally, using luseradd as a loose model.
>>
>> Currently it requires first name, lats name and uid. Optional are gecos 
>> and home directory.
> 
> Requiring First and Last names kills service users which have none, I'd
> make that optional
> 
>> The main questions I have, some of which apply to adding a user in 
>> general, are:
>>
>> - Will we allow the password to be set?
> Why not? You would have to go another step to set it if you don't allow
> it here.

Right, I'm just not sure how once I have the password, to set it in 
Kerberos. What do I need to call to get the right things set?

>> - Should adding a user create a user-specific group?
> I'd say no, users are created which are members of the default users
> group or another specified existing group.

Ok. So optionally prompt for group. The current XML-RPC side add user 
code has a default group, how configurable should that be? Should the 
group name go into /etc/ipa/ipa.conf?

>> - Can we set the shell?
> We need a default of some sort, but I guess we should be able to set it.

Ok, should the default be configurable? And what should the default be, 
/bin/sh?

>> - Can we override the uidNumber?
> IMO, we shouldn't, is there any reason why an admin should specify an
> uidNumber on creation ?

I dunno, it's why I asked :-)

>> - Do we create any directories?
> IMO, no, where would you create them? the tool may even run on a PDA on
> the other side of the world at some point, and usually it runs on the
> admin workstation anyway.
> Should we instead configure pam_mkhomedir by default ?

Right, I couldn't see how we'd create anything but I figure that 
*something* would need to.

>> And for the tools in general, do we want an interactive mode?
> 
> IMO, yes.

Ok. The libuser commands seem to have an interactive mode but they don't 
seem to work on F7 for me:

# luseradd --interactive foo
#
# grep foo /etc/passwd
foo:x:502:502:foo:/home/foo:/bin/bash

Not very interactive :-)

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/e7d3cee4/attachment.bin>

From adingman at redhat.com  Fri Sep  7 14:38:55 2007
From: adingman at redhat.com (Andrew C. Dingman)
Date: Fri, 07 Sep 2007 10:38:55 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189173688.19300.4.camel@localhost.localdomain>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
Message-ID: <1189175936.22717.17.camel@sinope>

On Fri, 2007-09-07 at 10:01 -0400, Simo Sorce wrote:
> > - Can we override the uidNumber?
> IMO, we shouldn't, is there any reason why an admin should specify an
> uidNumber on creation ?

Sometimes, usually for interoperability with other legacy systems. It's
an option I'd miss if it weren't there, as an admin, though as a rule
it's more useful to be able to specify a UID allocation policy than a
specific UID.

> 
> > - Do we create any directories?
> IMO, no, where would you create them? the tool may even run on a PDA
> on
> the other side of the world at some point, and usually it runs on the
> admin workstation anyway.
> Should we instead configure pam_mkhomedir by default ? 

I like this idea. I think it's an under-appreciated and under-used
module.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/417e8710/attachment.sig>

From ssorce at redhat.com  Fri Sep  7 14:47:23 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 07 Sep 2007 10:47:23 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <46E15DE1.40103@redhat.com>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
	<46E15DE1.40103@redhat.com>
Message-ID: <1189176443.19300.13.camel@localhost.localdomain>

On Fri, 2007-09-07 at 10:19 -0400, Rob Crittenden wrote:
> Simo Sorce wrote:
> > On Fri, 2007-09-07 at 09:10 -0400, Rob Crittenden wrote:

> >> - Will we allow the password to be set?
> > Why not? You would have to go another step to set it if you don't allow
> > it here.
> 
> Right, I'm just not sure how once I have the password, to set it in 
> Kerberos. What do I need to call to get the right things set?

you do a password change after the user have been created using the
passwd ext op, our slapi module will take care of anything else.

> >> - Should adding a user create a user-specific group?
> > I'd say no, users are created which are members of the default users
> > group or another specified existing group.
> 
> Ok. So optionally prompt for group. The current XML-RPC side add user 
> code has a default group, how configurable should that be? Should the 
> group name go into /etc/ipa/ipa.conf?

No, I want to get rid of ipa.conf as soon as possible.
We need to store information on LDAP, as it is the only way to replicate
and update it. Anything on files is BAAAAAD :)

> >> - Can we set the shell?
> > We need a default of some sort, but I guess we should be able to set it.
> 
> Ok, should the default be configurable? And what should the default be, 
> /bin/sh?

I'd say the default should be /bin/nologin not all users in an
enterprise need shell access to some server, they may just need to auth
against a mail server.
But the shell thing is a big problem, and has always been.
It is usually a user preference, and users should be able to have a
different shell on different systems.
On some systems they should be forbidden to have a shell at all. Current
practice of placing it in the user object sucks as it comes from the old
days when /etc/passwd was on a single system.

I'd like to address this somehow for IPAv2, currently I am open to
suggestions.

> >> - Can we override the uidNumber?
> > IMO, we shouldn't, is there any reason why an admin should specify an
> > uidNumber on creation ?
> 
> I dunno, it's why I asked :-)

I say that if admins really want to mess with the system they go and
change it in ldap later, we should send no uidNumer at all and have DNA
come up with it.

> >> - Do we create any directories?
> > IMO, no, where would you create them? the tool may even run on a PDA on
> > the other side of the world at some point, and usually it runs on the
> > admin workstation anyway.
> > Should we instead configure pam_mkhomedir by default ?
> 
> Right, I couldn't see how we'd create anything but I figure that 
> *something* would need to.

Yeah but should we install pam_mkhomedir by default? Current
ipa-client-install does not do it.

> >> And for the tools in general, do we want an interactive mode?
> > 
> > IMO, yes.
> 
> Ok. The libuser commands seem to have an interactive mode but they don't 
> seem to work on F7 for me:

Honestly I'd abstain from using libuser as a model :)

> # luseradd --interactive foo
> #
> # grep foo /etc/passwd
> foo:x:502:502:foo:/home/foo:/bin/bash
> 
> Not very interactive :-)

Heh.

Simo.



From ssorce at redhat.com  Fri Sep  7 14:49:45 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 07 Sep 2007 10:49:45 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189175936.22717.17.camel@sinope>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
	<1189175936.22717.17.camel@sinope>
Message-ID: <1189176585.19300.16.camel@localhost.localdomain>

On Fri, 2007-09-07 at 10:38 -0400, Andrew C. Dingman wrote:
> On Fri, 2007-09-07 at 10:01 -0400, Simo Sorce wrote:
> > > - Can we override the uidNumber?
> > IMO, we shouldn't, is there any reason why an admin should specify an
> > uidNumber on creation ?
> 
> Sometimes, usually for interoperability with other legacy systems. It's
> an option I'd miss if it weren't there, as an admin, though as a rule
> it's more useful to be able to specify a UID allocation policy than a
> specific UID.

Usually uidNumbers may have to be set for system accounts, but for user
accounts??

And this opens another debate, should we have system services accounts
in IPA?
IMO no, for v1 at least they should stay local in /etc/passwd as
unfortunately they are not at all standardized on all platforms and
linux flavors.

> > 
> > > - Do we create any directories?
> > IMO, no, where would you create them? the tool may even run on a PDA
> > on
> > the other side of the world at some point, and usually it runs on the
> > admin workstation anyway.
> > Should we instead configure pam_mkhomedir by default ? 
> 
> I like this idea. I think it's an under-appreciated and under-used
> module.

Thanks.

Simo.



From adingman at redhat.com  Fri Sep  7 15:11:06 2007
From: adingman at redhat.com (Andrew C. Dingman)
Date: Fri, 07 Sep 2007 11:11:06 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189176585.19300.16.camel@localhost.localdomain>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
	<1189175936.22717.17.camel@sinope>
	<1189176585.19300.16.camel@localhost.localdomain>
Message-ID: <1189177866.22717.31.camel@sinope>

On Fri, 2007-09-07 at 10:49 -0400, Simo Sorce wrote:
> Usually uidNumbers may have to be set for system accounts, but for user
> accounts??

In an ideal world, no. In the real world, it can smooth things out just
often enough that I wouldn't want the ability to go away. I wouldn't
mind if it were a bit of a pain, though, 'cause even in a large
environment it's a rare occurrence. Personally, as long as I can safely
make the change with ldapmodify on the new user and group, I don't feel
a need for a specific UI. If it's more complicated than that to pull
off, I do.

> And this opens another debate, should we have system services accounts
> in IPA?
> IMO no, for v1 at least they should stay local in /etc/passwd as
> unfortunately they are not at all standardized on all platforms and
> linux flavors.

Sounds reasonable to start with. System accounts aren't even the same
across an all-RHEL site, since some packages add their own.

There's an argument to be made that putting 'root' in the directory is a
good thing, since it lets you leave the account passwordless on the
local systems. That's nice if you have an admin leave and need to change
the password everywhere. If you do that, though, it would be good to
make the client installer remove the local root password so that the
system doesn't end up with two working credentials for root, one of
which will never get rotated. And, of course, whether having root in
both /etc/password and LDAP even works depends on your NSS
configuration. I'm afraid I haven't followed this project quite closely
enough to know how it would work with the rest of your infrastructure.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/344b13ff/attachment.sig>

From ssorce at redhat.com  Fri Sep  7 15:27:23 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 07 Sep 2007 11:27:23 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189177866.22717.31.camel@sinope>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
	<1189175936.22717.17.camel@sinope>
	<1189176585.19300.16.camel@localhost.localdomain>
	<1189177866.22717.31.camel@sinope>
Message-ID: <1189178843.19300.22.camel@localhost.localdomain>

On Fri, 2007-09-07 at 11:11 -0400, Andrew C. Dingman wrote:
> On Fri, 2007-09-07 at 10:49 -0400, Simo Sorce wrote:
> > Usually uidNumbers may have to be set for system accounts, but for user
> > accounts??
> 
> In an ideal world, no. In the real world, it can smooth things out just
> often enough that I wouldn't want the ability to go away. I wouldn't
> mind if it were a bit of a pain, though, 'cause even in a large
> environment it's a rare occurrence. Personally, as long as I can safely
> make the change with ldapmodify on the new user and group, I don't feel
> a need for a specific UI. If it's more complicated than that to pull
> off, I do.

ldapmodify will do it, so I vote for not letting the admin specify the
uidNumber in the current tools.

> > And this opens another debate, should we have system services accounts
> > in IPA?
> > IMO no, for v1 at least they should stay local in /etc/passwd as
> > unfortunately they are not at all standardized on all platforms and
> > linux flavors.
> 
> Sounds reasonable to start with. System accounts aren't even the same
> across an all-RHEL site, since some packages add their own.
> 
> There's an argument to be made that putting 'root' in the directory is a
> good thing, since it lets you leave the account passwordless on the
> local systems. That's nice if you have an admin leave and need to change
> the password everywhere.

It makes it also impossible to take the system out or to log in when the
network is down for system maintenance. Until we have offline support I
would not do this.
Also having a single per-site password, would make it for a very bad
situation when the password is compromised (you have access as root on
_all_ the machines at that point).
Also it make it impossible for users to join the machine and keep
themselves control on it. In some enterprises that is not wanted but in
many R&D departments that's a necessity.

>  If you do that, though, it would be good to
> make the client installer remove the local root password so that the
> system doesn't end up with two working credentials for root, one of
> which will never get rotated. And, of course, whether having root in
> both /etc/password and LDAP even works depends on your NSS
> configuration. I'm afraid I haven't followed this project quite closely
> enough to know how it would work with the rest of your infrastructure.

No plan to move root into IPA for now, ah and now that I think of it I
am going to make sure our conf does not allow to "see" uids lower than
500 (or we risk disrupting local accounts and root) for IPAv1

Simo.



From kmacmill at redhat.com  Fri Sep  7 15:38:11 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 11:38:11 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189178843.19300.22.camel@localhost.localdomain>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
	<1189175936.22717.17.camel@sinope>
	<1189176585.19300.16.camel@localhost.localdomain>
	<1189177866.22717.31.camel@sinope>
	<1189178843.19300.22.camel@localhost.localdomain>
Message-ID: <1189179491.9692.16.camel@localhost.localdomain>

On Fri, 2007-09-07 at 11:27 -0400, Simo Sorce wrote:
> On Fri, 2007-09-07 at 11:11 -0400, Andrew C. Dingman wrote:
> > On Fri, 2007-09-07 at 10:49 -0400, Simo Sorce wrote:
> > > Usually uidNumbers may have to be set for system accounts, but for user
> > > accounts??
> > 
> > In an ideal world, no. In the real world, it can smooth things out just
> > often enough that I wouldn't want the ability to go away. I wouldn't
> > mind if it were a bit of a pain, though, 'cause even in a large
> > environment it's a rare occurrence. Personally, as long as I can safely
> > make the change with ldapmodify on the new user and group, I don't feel
> > a need for a specific UI. If it's more complicated than that to pull
> > off, I do.
> 
> ldapmodify will do it, so I vote for not letting the admin specify the
> uidNumber in the current tools.
> 

But it would be nice to be able to specify it via xml-rpc for conversion
tools.

> > > And this opens another debate, should we have system services accounts
> > > in IPA?
> > > IMO no, for v1 at least they should stay local in /etc/passwd as
> > > unfortunately they are not at all standardized on all platforms and
> > > linux flavors.
> > 
> > Sounds reasonable to start with. System accounts aren't even the same
> > across an all-RHEL site, since some packages add their own.
> > 
> > There's an argument to be made that putting 'root' in the directory is a
> > good thing, since it lets you leave the account passwordless on the
> > local systems. That's nice if you have an admin leave and need to change
> > the password everywhere.
> 
> It makes it also impossible to take the system out or to log in when the
> network is down for system maintenance. Until we have offline support I
> would not do this.

Agreed.

> Also having a single per-site password, would make it for a very bad
> situation when the password is compromised (you have access as root on
> _all_ the machines at that point).
> Also it make it impossible for users to join the machine and keep
> themselves control on it. In some enterprises that is not wanted but in
> many R&D departments that's a necessity.
> 

Having the ability to grant administrative rights to normal users will
help this situation (and also argues for pushing this to v2).

Karl



From adingman at redhat.com  Fri Sep  7 15:42:21 2007
From: adingman at redhat.com (Andrew C. Dingman)
Date: Fri, 07 Sep 2007 11:42:21 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189178843.19300.22.camel@localhost.localdomain>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
	<1189175936.22717.17.camel@sinope>
	<1189176585.19300.16.camel@localhost.localdomain>
	<1189177866.22717.31.camel@sinope>
	<1189178843.19300.22.camel@localhost.localdomain>
Message-ID: <1189179741.22717.40.camel@sinope>

On Fri, 2007-09-07 at 11:27 -0400, Simo Sorce wrote:
> On Fri, 2007-09-07 at 11:11 -0400, Andrew C. Dingman wrote:
> > On Fri, 2007-09-07 at 10:49 -0400, Simo Sorce wrote:
> > > Usually uidNumbers may have to be set for system accounts, but for user
> > > accounts??
> > 
> > In an ideal world, no. In the real world, it can smooth things out just
> > often enough that I wouldn't want the ability to go away. I wouldn't
> > mind if it were a bit of a pain, though, 'cause even in a large
> > environment it's a rare occurrence. Personally, as long as I can safely
> > make the change with ldapmodify on the new user and group, I don't feel
> > a need for a specific UI. If it's more complicated than that to pull
> > off, I do.
> 
> ldapmodify will do it, so I vote for not letting the admin specify the
> uidNumber in the current tools.

As long as it's that simple, so do I.

> > There's an argument to be made that putting 'root' in the directory is a
> > good thing, since it lets you leave the account passwordless on the
> > local systems. That's nice if you have an admin leave and need to change
> > the password everywhere.
> 
> It makes it also impossible to take the system out or to log in when the
> network is down for system maintenance. Until we have offline support I
> would not do this.

Single-user mode gets around this pretty easily, and it's pretty well a
given that going into runlevel one doesn't disrupt the clients when the
network is already down.

> Also having a single per-site password, would make it for a very bad
> situation when the password is compromised (you have access as root on
> _all_ the machines at that point).

True

> Also it make it impossible for users to join the machine and keep
> themselves control on it. In some enterprises that is not wanted but in
> many R&D departments that's a necessity.

Sudo solves many problems, including this one. In fact, I run a number
of my machines with no root password and all administration done through
sudo. The FDA auditors loved that.

> No plan to move root into IPA for now,

Probably at best too complicated for v1

>  ah and now that I think of it I
> am going to make sure our conf does not allow to "see" uids lower than
> 500 (or we risk disrupting local accounts and root) for IPAv1

Makes sense to me
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/dfe22487/attachment.sig>

From ssorce at redhat.com  Fri Sep  7 15:52:35 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 07 Sep 2007 11:52:35 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189179491.9692.16.camel@localhost.localdomain>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
	<1189175936.22717.17.camel@sinope>
	<1189176585.19300.16.camel@localhost.localdomain>
	<1189177866.22717.31.camel@sinope>
	<1189178843.19300.22.camel@localhost.localdomain>
	<1189179491.9692.16.camel@localhost.localdomain>
Message-ID: <1189180355.19300.24.camel@localhost.localdomain>

On Fri, 2007-09-07 at 11:38 -0400, Karl MacMillan wrote:
> 
> But it would be nice to be able to specify it via xml-rpc for
> conversion
> tools.

If by "conversion" tools you mean migration I say we should provide a
specific tool.
Pushing thousands of entries at once through the xml-rpc interface is
not going to scale IMO.

Simo.



From ssorce at redhat.com  Fri Sep  7 15:57:12 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 07 Sep 2007 11:57:12 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189179741.22717.40.camel@sinope>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
	<1189175936.22717.17.camel@sinope>
	<1189176585.19300.16.camel@localhost.localdomain>
	<1189177866.22717.31.camel@sinope>
	<1189178843.19300.22.camel@localhost.localdomain>
	<1189179741.22717.40.camel@sinope>
Message-ID: <1189180632.19300.27.camel@localhost.localdomain>

On Fri, 2007-09-07 at 11:42 -0400, Andrew C. Dingman wrote:
> On Fri, 2007-09-07 at 11:27 -0400, Simo Sorce wrote:

> > It makes it also impossible to take the system out or to log in when the
> > network is down for system maintenance. Until we have offline support I
> > would not do this.
> 
> Single-user mode gets around this pretty easily, and it's pretty well a
> given that going into runlevel one doesn't disrupt the clients when the
> network is already down.

Not all systems let you login without the root password even in
single-user mode.

> > Also it make it impossible for users to join the machine and keep
> > themselves control on it. In some enterprises that is not wanted but in
> > many R&D departments that's a necessity.
> 
> Sudo solves many problems, including this one. In fact, I run a number
> of my machines with no root password and all administration done through
> sudo. The FDA auditors loved that.

I love sudo as well, we are plannig to support it asap with the work on
policies.

Simo.



From kmacmill at redhat.com  Fri Sep  7 16:01:29 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 12:01:29 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189180355.19300.24.camel@localhost.localdomain>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
	<1189175936.22717.17.camel@sinope>
	<1189176585.19300.16.camel@localhost.localdomain>
	<1189177866.22717.31.camel@sinope>
	<1189178843.19300.22.camel@localhost.localdomain>
	<1189179491.9692.16.camel@localhost.localdomain>
	<1189180355.19300.24.camel@localhost.localdomain>
Message-ID: <1189180889.9692.33.camel@localhost.localdomain>

On Fri, 2007-09-07 at 11:52 -0400, Simo Sorce wrote:
> On Fri, 2007-09-07 at 11:38 -0400, Karl MacMillan wrote:
> > 
> > But it would be nice to be able to specify it via xml-rpc for
> > conversion
> > tools.
> 
> If by "conversion" tools you mean migration

I do.

>  I say we should provide a
> specific tool.
> Pushing thousands of entries at once through the xml-rpc interface is
> not going to scale IMO.
> 

I think we should make it scale (perhaps by providing an interface that
can batch the calls) for a few reasons:

1) It gives us a layer to gloss over differences in schema / do data
conversion.

2) It allows 3rd parties - including some admins - to more easily write
their own custom migration tools. Writing straight to ldap is always
going to be a pain for non-ldap developers.

3) It lowers the documentation burden significantly.

Karl



From adingman at redhat.com  Fri Sep  7 16:45:03 2007
From: adingman at redhat.com (Andrew C. Dingman)
Date: Fri, 07 Sep 2007 12:45:03 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189180632.19300.27.camel@localhost.localdomain>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
	<1189175936.22717.17.camel@sinope>
	<1189176585.19300.16.camel@localhost.localdomain>
	<1189177866.22717.31.camel@sinope>
	<1189178843.19300.22.camel@localhost.localdomain>
	<1189179741.22717.40.camel@sinope>
	<1189180632.19300.27.camel@localhost.localdomain>
Message-ID: <1189183504.22717.50.camel@sinope>

On Fri, 2007-09-07 at 11:57 -0400, Simo Sorce wrote:
> On Fri, 2007-09-07 at 11:42 -0400, Andrew C. Dingman wrote:
> > On Fri, 2007-09-07 at 11:27 -0400, Simo Sorce wrote:
> Not all systems let you login without the root password even in
> single-user mode.

I don't know of a Linux distribution where I can't get around the
password for maintenance, but I'll have to take your word for it on
other systems.

> > > Also it make it impossible for users to join the machine and keep
> > > themselves control on it. In some enterprises that is not wanted but in
> > > many R&D departments that's a necessity.
> > 
> > Sudo solves many problems, including this one. In fact, I run a number
> > of my machines with no root password and all administration done through
> > sudo. The FDA auditors loved that.
> 
> I love sudo as well, we are plannig to support it asap with the work on
> policies.

In that case, I think the argument for considering root in IPA is much
weaker. Sudo and no root password at all is a better solution. If you
support sudo through IPA, then any admin who wants to can just remove
the root password from the local system. I had assumed that sudo support
would be a v2 goal.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/86a7619f/attachment.sig>

From ssorce at redhat.com  Fri Sep  7 16:51:36 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 07 Sep 2007 12:51:36 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189183504.22717.50.camel@sinope>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
	<1189175936.22717.17.camel@sinope>
	<1189176585.19300.16.camel@localhost.localdomain>
	<1189177866.22717.31.camel@sinope>
	<1189178843.19300.22.camel@localhost.localdomain>
	<1189179741.22717.40.camel@sinope>
	<1189180632.19300.27.camel@localhost.localdomain>
	<1189183504.22717.50.camel@sinope>
Message-ID: <1189183896.19300.30.camel@localhost.localdomain>

On Fri, 2007-09-07 at 12:45 -0400, Andrew C. Dingman wrote:
> On Fri, 2007-09-07 at 11:57 -0400, Simo Sorce wrote:
> > On Fri, 2007-09-07 at 11:42 -0400, Andrew C. Dingman wrote:
> > > On Fri, 2007-09-07 at 11:27 -0400, Simo Sorce wrote:
> > Not all systems let you login without the root password even in
> > single-user mode.
> 
> I don't know of a Linux distribution where I can't get around the
> password for maintenance, but I'll have to take your word for it on
> other systems.

IIRC Debian always ask you for the root password, sure you can always
boot with a rescue disk, but that's cheating :)

> > > > Also it make it impossible for users to join the machine and keep
> > > > themselves control on it. In some enterprises that is not wanted but in
> > > > many R&D departments that's a necessity.
> > > 
> > > Sudo solves many problems, including this one. In fact, I run a number
> > > of my machines with no root password and all administration done through
> > > sudo. The FDA auditors loved that.
> > 
> > I love sudo as well, we are plannig to support it asap with the work on
> > policies.
> 
> In that case, I think the argument for considering root in IPA is much
> weaker. Sudo and no root password at all is a better solution. If you
> support sudo through IPA, then any admin who wants to can just remove
> the root password from the local system. I had assumed that sudo support
> would be a v2 goal.

yeah sudo will be v2, but nobody will prevent yo9u to use sudo with
IPAv1, its just that you will have to replicate the configuration on
multiple machines on your own.

Simo.




From adingman at redhat.com  Fri Sep  7 17:05:54 2007
From: adingman at redhat.com (Andrew C. Dingman)
Date: Fri, 07 Sep 2007 13:05:54 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189183896.19300.30.camel@localhost.localdomain>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
	<1189175936.22717.17.camel@sinope>
	<1189176585.19300.16.camel@localhost.localdomain>
	<1189177866.22717.31.camel@sinope>
	<1189178843.19300.22.camel@localhost.localdomain>
	<1189179741.22717.40.camel@sinope>
	<1189180632.19300.27.camel@localhost.localdomain>
	<1189183504.22717.50.camel@sinope>
	<1189183896.19300.30.camel@localhost.localdomain>
Message-ID: <1189184754.22717.62.camel@sinope>

On Fri, 2007-09-07 at 12:51 -0400, Simo Sorce wrote:
> On Fri, 2007-09-07 at 12:45 -0400, Andrew C. Dingman wrote:
> > On Fri, 2007-09-07 at 11:57 -0400, Simo Sorce wrote:
> > > On Fri, 2007-09-07 at 11:42 -0400, Andrew C. Dingman wrote:
> > > > On Fri, 2007-09-07 at 11:27 -0400, Simo Sorce wrote:
> > > Not all systems let you login without the root password even in
> > > single-user mode.
> > 
> > I don't know of a Linux distribution where I can't get around the
> > password for maintenance, but I'll have to take your word for it on
> > other systems.
> 
> IIRC Debian always ask you for the root password, sure you can always
> boot with a rescue disk, but that's cheating :)

True enough, but even on a Debian system, 'init=/bin/bash' gets around
this problem. No rescue disk needed ;)

My /next/ home server will run RHEL, FDS, and Fedora Certificate System,
but right now they're all Debian boxen.

> > > > > Also it make it impossible for users to join the machine and keep
> > > > > themselves control on it. In some enterprises that is not wanted but in
> > > > > many R&D departments that's a necessity.
> > > > 
> > > > Sudo solves many problems, including this one. In fact, I run a number
> > > > of my machines with no root password and all administration done through
> > > > sudo. The FDA auditors loved that.
> > > 
> > > I love sudo as well, we are plannig to support it asap with the work on
> > > policies.
> > 
> > In that case, I think the argument for considering root in IPA is much
> > weaker. Sudo and no root password at all is a better solution. If you
> > support sudo through IPA, then any admin who wants to can just remove
> > the root password from the local system. I had assumed that sudo support
> > would be a v2 goal.
> 
> yeah sudo will be v2, but nobody will prevent yo9u to use sudo with
> IPAv1, its just that you will have to replicate the configuration on
> multiple machines on your own.

Isn't there a pre-existing LDAP schema for this? Not that I've used it,
but that should simplify the replication considerably, especially if
you've already automated setting up the FDS instance. Perhaps I should
download the code and actually play with it a bit.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/bd57bd9c/attachment.sig>

From kmacmill at redhat.com  Fri Sep  7 17:07:24 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 13:07:24 -0400
Subject: [Freeipa-devel] [PATCH] remove unneded dependency
In-Reply-To: <1188937009.3329.21.camel@localhost.localdomain>
References: <1188937009.3329.21.camel@localhost.localdomain>
Message-ID: <1189184844.9692.37.camel@localhost.localdomain>

On Tue, 2007-09-04 at 16:16 -0400, Simo Sorce wrote:
> This patch removes an actual dependency of the freeipa-client on
> freeipa-server.
> 

Ack and pushed.

Karl




From kmacmill at redhat.com  Fri Sep  7 17:10:34 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 13:10:34 -0400
Subject: [Freeipa-devel] [PATCH] Generalized Time parser and tests
In-Reply-To: <20070904204047.GC3596@moon.usersys.redhat.com>
References: <20070904204047.GC3596@moon.usersys.redhat.com>
Message-ID: <1189185034.9692.39.camel@localhost.localdomain>

On Tue, 2007-09-04 at 13:40 -0700, Kevin McCarthy wrote:
> Attached is a Generalized Time parser, for use in the
> krbPaswordExpiration field.  Pete mentioned that this may be better done
> on the DS, but I was almost done with the code, so here it is anyway.
> 
> This patch depends on Simo's patch just sent to the list:
> freeipa-150-ipautil.patch
> 

Nothing in the python library does this - maybe
http://docs.python.org/lib/module-datetime.html?

Karl



From kmccarth at redhat.com  Fri Sep  7 17:13:28 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Fri, 7 Sep 2007 10:13:28 -0700
Subject: [Freeipa-devel] [PATCH] Generalized Time parser and tests
In-Reply-To: <1189185034.9692.39.camel@localhost.localdomain>
References: <20070904204047.GC3596@moon.usersys.redhat.com>
	<1189185034.9692.39.camel@localhost.localdomain>
Message-ID: <20070907171328.GD19932@moon.usersys.redhat.com>

Karl MacMillan wrote:
> On Tue, 2007-09-04 at 13:40 -0700, Kevin McCarthy wrote:
> > Attached is a Generalized Time parser, for use in the
> > krbPaswordExpiration field.  Pete mentioned that this may be better done
> > on the DS, but I was almost done with the code, so here it is anyway.
> > 
> > This patch depends on Simo's patch just sent to the list:
> > freeipa-150-ipautil.patch
> > 
> 
> Nothing in the python library does this - maybe
> http://docs.python.org/lib/module-datetime.html?

Not that I could see.  I'm returning a datetime object from my method
though!  :-)

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/89af05c5/attachment.bin>

From kmacmill at redhat.com  Fri Sep  7 17:14:37 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 13:14:37 -0400
Subject: [Freeipa-devel] [PATCH] Generalized Time parser and tests
In-Reply-To: <20070904204047.GC3596@moon.usersys.redhat.com>
References: <20070904204047.GC3596@moon.usersys.redhat.com>
Message-ID: <1189185277.9692.41.camel@localhost.localdomain>

On Tue, 2007-09-04 at 13:40 -0700, Kevin McCarthy wrote:
> Attached is a Generalized Time parser, for use in the
> krbPaswordExpiration field.  Pete mentioned that this may be better done
> on the DS, but I was almost done with the code, so here it is anyway.
> 
> This patch depends on Simo's patch just sent to the list:
> freeipa-150-ipautil.patch
> 
I assumed as much - had to ask.

Acked and pushed.

Karl



From kmacmill at redhat.com  Fri Sep  7 17:19:21 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 13:19:21 -0400
Subject: [Freeipa-devel] [PATCH] adding dna plugin from FDS
In-Reply-To: <46DDE0AE.7070106@redhat.com>
References: <46DDE0AE.7070106@redhat.com>
Message-ID: <1189185561.9692.43.camel@localhost.localdomain>

On Tue, 2007-09-04 at 15:48 -0700, Pete Rowley wrote:

Acked and pushed.

Karl



From prowley at redhat.com  Fri Sep  7 17:20:57 2007
From: prowley at redhat.com (Pete Rowley)
Date: Fri, 07 Sep 2007 10:20:57 -0700
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189173688.19300.4.camel@localhost.localdomain>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
Message-ID: <46E18879.6050806@redhat.com>

Simo Sorce wrote:
> On Fri, 2007-09-07 at 09:10 -0400, Rob Crittenden wrote:
>   
>> The command-line tools now are more like beefy unit tests. Some of them 
>> are very simple so probably don't require a lot more work, but others 
>> do, particularly the ones to add and modify users.
>>
>> What attributes do we want to allow and/or require? I picked more or 
>> less at random when writing it originally, using luseradd as a loose model.
>>
>> Currently it requires first name, lats name and uid. Optional are gecos 
>> and home directory.
>>     
>
> Requiring First and Last names kills service users which have none, I'd
> make that optional
>   
And set the required sn to the uid - really this kind of fix up should 
be the domain of the TBD schema fixup plugin.
>   
>   
>> - Can we override the uidNumber?
>>     
> IMO, we shouldn't, is there any reason why an admin should specify an
> uidNumber on creation ?
>
>   
Yes, they want something different than auto-gen would provide, such as 
a uid in a specific range to work with existing scripts etc.  I don't 
see a good reason to prevent this and I don't think it is for us to 
decide the site policy.


-- 
Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/9d6b4f34/attachment.bin>

From kmacmill at redhat.com  Fri Sep  7 17:26:11 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 13:26:11 -0400
Subject: [Freeipa-devel] [PATCH] krb/dsinstance.py has 'from util import *'
In-Reply-To: <20070906231935.GC25833@moon.usersys.redhat.com>
References: <20070906231935.GC25833@moon.usersys.redhat.com>
Message-ID: <1189185971.9692.45.camel@localhost.localdomain>

On Thu, 2007-09-06 at 16:19 -0700, Kevin McCarthy wrote:
> Just a heads-up that dsinstance.py seems to be using the old util
> package still.  Maybe I missed a patch file, but a quick glance didn't
> find one.
> 
> -Kevin
> 

Acked and pushed.

Karl



From kmacmill at redhat.com  Fri Sep  7 17:26:31 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 13:26:31 -0400
Subject: [Freeipa-devel] [PATCH] use forwarded tickets for auth - merged
In-Reply-To: <46DECEAD.9000008@redhat.com>
References: <46DECEAD.9000008@redhat.com>
Message-ID: <1189185991.9692.47.camel@localhost.localdomain>

On Wed, 2007-09-05 at 11:43 -0400, Rob Crittenden wrote:
> Same basic changes as before but re-merged so it should apply cleanly now.
> 
> This fairly invasive patch enables LDAP SASL authentication using a 
> forwarded kerberos ticket. It can also handle the existing proxied 
> authentication method (so it won't break the GUI).
> 
> I also refactored the LDAP connection code to be simpler to call, and 
> did a few other small bug fixes.
> 

Acked and pushed.

Karl



From kmacmill at redhat.com  Fri Sep  7 17:27:10 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 13:27:10 -0400
Subject: [Freeipa-devel] [PATCH] password expiration messages
In-Reply-To: <46DFF687.9040507@redhat.com>
References: <20070905224852.GA2073@moon.usersys.redhat.com>
	<46DFF687.9040507@redhat.com>
Message-ID: <1189186030.9692.49.camel@localhost.localdomain>

On Thu, 2007-09-06 at 08:45 -0400, Rob Crittenden wrote:
> Kevin McCarthy wrote:
> > Add password expiration messages to user show/edit.
> > Small fix to uid and email suggestion - lowercase before generating.
> > 
> 
> +1
> 
> The # of days warning should definitely be user-configurable somewhere. 
> We need to make a note of that.
> 

pushed - Karl



From kmacmill at redhat.com  Fri Sep  7 17:28:26 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 13:28:26 -0400
Subject: [Freeipa-devel] [PATCH] confirm password
In-Reply-To: <20070906212719.GB25833@moon.usersys.redhat.com>
References: <20070906212719.GB25833@moon.usersys.redhat.com>
Message-ID: <1189186106.9692.51.camel@localhost.localdomain>

On Thu, 2007-09-06 at 14:27 -0700, Kevin McCarthy wrote:
> After some feedback from Bob and Pete, I'm removing the password
> generator and adding a confirm password field.  (Just commented out for
> now in case people change their mind)
> 

What was the rationale for this?

Karl





From prowley at redhat.com  Fri Sep  7 17:30:45 2007
From: prowley at redhat.com (Pete Rowley)
Date: Fri, 07 Sep 2007 10:30:45 -0700
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189176443.19300.13.camel@localhost.localdomain>
References: <46E14DB0.40704@redhat.com>	<1189173688.19300.4.camel@localhost.localdomain>	<46E15DE1.40103@redhat.com>
	<1189176443.19300.13.camel@localhost.localdomain>
Message-ID: <46E18AC5.9000009@redhat.com>

Simo Sorce wrote:
> On Fri, 2007-09-07 at 10:19 -0400, Rob Crittenden wrote:
>   
>> Simo Sorce wrote:
>>     
>>> On Fri, 2007-09-07 at 09:10 -0400, Rob Crittenden wrote:
>>>       
>   
>>>> - Should adding a user create a user-specific group?
>>>>         
>>> I'd say no, users are created which are members of the default users
>>> group or another specified existing group.
>>>       
>> Ok. So optionally prompt for group. The current XML-RPC side add user 
>> code has a default group, how configurable should that be? Should the 
>> group name go into /etc/ipa/ipa.conf?
>>     
>
> No, I want to get rid of ipa.conf as soon as possible.
> We need to store information on LDAP, as it is the only way to replicate
> and update it. Anything on files is BAAAAAD :)
>   
Yes, site wide config goes in ldap somewhere under cn=system.
>   
>>>> - Can we set the shell?
>>>>         
>>> We need a default of some sort, but I guess we should be able to set it.
>>>       
>> Ok, should the default be configurable? And what should the default be, 
>> /bin/sh?
>>     
>
> I'd say the default should be /bin/nologin not all users in an
> enterprise need shell access to some server, they may just need to auth
> against a mail server.
>   
I think /bin/sh should be the default as it is likely linked to the 
preferred site default shell anyway, we can have a specific option to  
create a no login account. That way the most common task of creating a 
new user account is the least work for the admin.
> But the shell thing is a big problem, and has always been.
> It is usually a user preference, and users should be able to have a
> different shell on different systems.
>   
I don't think this problem is big, a little annoying if this is your 
requirement, but not a big problem since the users can always arrange 
for the correct shell to be loaded on login via other means.
> On some systems they should be forbidden to have a shell at all. Current
> practice of placing it in the user object sucks as it comes from the old
> days when /etc/passwd was on a single system.
>
>   
That is a job for access control policy not a shell setting.

>
>   
>>>> - Do we create any directories?
>>>>         
>>> IMO, no, where would you create them? the tool may even run on a PDA on
>>> the other side of the world at some point, and usually it runs on the
>>> admin workstation anyway.
>>> Should we instead configure pam_mkhomedir by default ?
>>>       
>> Right, I couldn't see how we'd create anything but I figure that 
>> *something* would need to.
>>     
>
> Yeah but should we install pam_mkhomedir by default? Current
> ipa-client-install does not do it.
>
>   
If we can do it while having it make sense then that would be a good 
thing - what are the corner cases here?

-- 
Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/fd44db04/attachment.bin>

From kmacmill at redhat.com  Fri Sep  7 17:37:21 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 13:37:21 -0400
Subject: [Freeipa-devel] [PATCH] Client install config file
	parsing/changing
In-Reply-To: <1189116342.3329.52.camel@localhost.localdomain>
References: <1189116342.3329.52.camel@localhost.localdomain>
Message-ID: <1189186641.9692.53.camel@localhost.localdomain>

On Thu, 2007-09-06 at 18:05 -0400, Simo Sorce wrote:
> This patch introduce a much better class to manipulate config files.
> It has been tested with the ldap.conf and krb5.conf files and should
> work
> without any problem with smb.conf as well as other similar config files.
> 
> This patch also stop trying changing the ldap.conf and krb5.conf files
> on client installs for now, as previously configured files existing on
> the system may render the authentication/enumeration of users unusable
> if strange directives where found. The original files are backuped. In
> future we may switch back to changing config files, but before doing
> that we need a lot more testing on what options are compatible and which
> are not with our setup.
> 
> Right now running ipa-client-install on a client configures it correctly
> (you just need to reboot the system or restart services to be able to
> authenticate with pam_krb5).
> The only gotcha is that until the fixed nss_ldap packages are available
> adding the following line to /etc/ldap.conf is still needed:
> host 1.2.3.4
>      ^^^^^^^--IP address of the IPA server
> 

Acked and pushed.

Karl





From rcritten at redhat.com  Fri Sep  7 17:38:27 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 07 Sep 2007 13:38:27 -0400
Subject: [Freeipa-devel] [PATCH] search box in header, other fixes
In-Reply-To: <20070906181107.GA25833@moon.usersys.redhat.com>
References: <20070906181107.GA25833@moon.usersys.redhat.com>
Message-ID: <46E18C93.4000708@redhat.com>

Kevin McCarthy wrote:
> This patch adds a search box into the header.
> It changes the account status to use a select instead of a checkbox.
> It also makes a small improvement to auto-suggest, to keep suggesting
> (as you fix the name) until you overwrite the suggestion yourself.
> 
> -Kevin
>

+1

I gather that Group search isn't implemented yet? It seems to be a no-op.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/b4184b81/attachment.bin>

From kmccarth at redhat.com  Fri Sep  7 17:41:03 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Fri, 7 Sep 2007 10:41:03 -0700
Subject: [Freeipa-devel] [PATCH] search box in header, other fixes
In-Reply-To: <46E18C93.4000708@redhat.com>
References: <20070906181107.GA25833@moon.usersys.redhat.com>
	<46E18C93.4000708@redhat.com>
Message-ID: <20070907174103.GE19932@moon.usersys.redhat.com>

Rob Crittenden wrote:
> Kevin McCarthy wrote:
>> This patch adds a search box into the header.
>> It changes the account status to use a select instead of a checkbox.
>> It also makes a small improvement to auto-suggest, to keep suggesting
>> (as you fix the name) until you overwrite the suggestion yourself.
>> -Kevin
>>
>
> +1
>
> I gather that Group search isn't implemented yet? It seems to be a no-op.

Good code review. :-)  Yup, it's not implemented yet.  I'll hook it up
when I get to the group functionality.

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/d7a1a176/attachment.bin>

From kmacmill at redhat.com  Fri Sep  7 17:41:14 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 13:41:14 -0400
Subject: [Freeipa-devel] [PATCH] search box in header, other fixes
In-Reply-To: <46E18C93.4000708@redhat.com>
References: <20070906181107.GA25833@moon.usersys.redhat.com>
	<46E18C93.4000708@redhat.com>
Message-ID: <1189186874.9692.55.camel@localhost.localdomain>

On Fri, 2007-09-07 at 13:38 -0400, Rob Crittenden wrote:
> Kevin McCarthy wrote:
> > This patch adds a search box into the header.
> > It changes the account status to use a select instead of a checkbox.
> > It also makes a small improvement to auto-suggest, to keep suggesting
> > (as you fix the name) until you overwrite the suggestion yourself.
> > 
> > -Kevin
> >
> 
> +1
> 
> I gather that Group search isn't implemented yet? It seems to be a no-op.

pushed - Karl



From kmacmill at redhat.com  Fri Sep  7 17:42:14 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 13:42:14 -0400
Subject: [Freeipa-devel] [PATCH] confirm password
In-Reply-To: <20070906212719.GB25833@moon.usersys.redhat.com>
References: <20070906212719.GB25833@moon.usersys.redhat.com>
Message-ID: <1189186934.9692.57.camel@localhost.localdomain>

On Thu, 2007-09-06 at 14:27 -0700, Kevin McCarthy wrote:
> After some feedback from Bob and Pete, I'm removing the password
> generator and adding a confirm password field.  (Just commented out for
> now in case people change their mind)
> 
> Factored out the validators.
> 
> Minor css tweaks.
> 
> This is a small fix, but I have to rebuild my dev environment and wanted
> to get it to the list before then.
> 

I went ahead and pushed this.

Karl



From prowley at redhat.com  Fri Sep  7 17:50:42 2007
From: prowley at redhat.com (Pete Rowley)
Date: Fri, 07 Sep 2007 10:50:42 -0700
Subject: [Freeipa-devel] [PATCH] confirm password
In-Reply-To: <1189186106.9692.51.camel@localhost.localdomain>
References: <20070906212719.GB25833@moon.usersys.redhat.com>
	<1189186106.9692.51.camel@localhost.localdomain>
Message-ID: <46E18F72.90309@redhat.com>

Karl MacMillan wrote:
> On Thu, 2007-09-06 at 14:27 -0700, Kevin McCarthy wrote:
>   
>> After some feedback from Bob and Pete, I'm removing the password
>> generator and adding a confirm password field.  (Just commented out for
>> now in case people change their mind)
>>
>>     
>
> What was the rationale for this?
>
>   
Generating passwords requires that the password be communicated to the 
admin in the clear which introduces shoulder surfers and screen scrapers 
to the threat model.  In addition the password is not likely to be 
memorable enough to not be written down somewhere, and so further 
exposing it to risk of compromise.

-- 
Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/01428f31/attachment.bin>

From kmacmill at redhat.com  Fri Sep  7 17:54:22 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 13:54:22 -0400
Subject: [Freeipa-devel] [PATCH] confirm password
In-Reply-To: <46E18F72.90309@redhat.com>
References: <20070906212719.GB25833@moon.usersys.redhat.com>
	<1189186106.9692.51.camel@localhost.localdomain>
	<46E18F72.90309@redhat.com>
Message-ID: <1189187662.9692.60.camel@localhost.localdomain>

On Fri, 2007-09-07 at 10:50 -0700, Pete Rowley wrote:
> Karl MacMillan wrote:
> > On Thu, 2007-09-06 at 14:27 -0700, Kevin McCarthy wrote:
> >   
> >> After some feedback from Bob and Pete, I'm removing the password
> >> generator and adding a confirm password field.  (Just commented out for
> >> now in case people change their mind)
> >>
> >>     
> >
> > What was the rationale for this?
> >
> >   
> Generating passwords requires that the password be communicated to the 
> admin in the clear which introduces shoulder surfers and screen scrapers 
> to the threat model.  In addition the password is not likely to be 
> memorable enough to not be written down somewhere, and so further 
> exposing it to risk of compromise.
> 

Except that it is useful when generating accounts (especially a large
number) and then printing the account information to hand to the user.
We had discussed being able to generate a pdf with the account
information for this purpose.

Karl



From kmccarth at redhat.com  Fri Sep  7 18:01:42 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Fri, 7 Sep 2007 11:01:42 -0700
Subject: [Freeipa-devel] [PATCH] small (but important) fixes for release
Message-ID: <20070907180142.GF19932@moon.usersys.redhat.com>

Fixes three issues:
- password isn't mandatory for add person
- fix for searching on '*' (it blew up)
- Change my principal to 'admin' until the correct way is sorted out

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189187990 25200
# Node ID f4520ad4b8a35603fe4533f206a17a71543e6cac
# Parent  31924e58a3c3a0e550d7ebc68c89b03fa1a10f3f
mall release fixes:
- Use admin for principal (temporarily)
- Make password not required for add person
- Fix for searching on '*' or ''

diff -r 31924e58a3c3 -r f4520ad4b8a3 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Thu Sep 06 16:21:07 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Fri Sep 07 10:59:50 2007 -0700
@@ -27,7 +27,8 @@ password_chars = "0123456789ABCDEFGHIJKL
 password_chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
 
 client = ipa.ipaclient.IPAClient(True)
-client.set_principal("test at FREEIPA.ORG")
+# client.set_principal("test at FREEIPA.ORG")
+client.set_principal("admin at FREEIPA.ORG")
 
 user_fields = ['*', 'nsAccountLock']
 
diff -r 31924e58a3c3 -r f4520ad4b8a3 ipa-server/ipa-gui/ipagui/forms/user.py
--- a/ipa-server/ipa-gui/ipagui/forms/user.py	Thu Sep 06 16:21:07 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/user.py	Fri Sep 07 10:59:50 2007 -0700
@@ -26,8 +26,8 @@ class UserFields():
 
 class UserNewValidator(validators.Schema):
     uid = validators.PlainText(not_empty=True)
-    userpassword = validators.String(not_empty=True)
-    userpassword_confirm = validators.String(not_empty=True)
+    userpassword = validators.String(not_empty=False)
+    userpassword_confirm = validators.String(not_empty=False)
     givenname = validators.String(not_empty=True)
     sn = validators.String(not_empty=True)
     mail = validators.Email(not_empty=True)
diff -r 31924e58a3c3 -r f4520ad4b8a3 ipa-server/xmlrpc-server/funcs.py
--- a/ipa-server/xmlrpc-server/funcs.py	Thu Sep 06 16:21:07 2007 -0700
+++ b/ipa-server/xmlrpc-server/funcs.py	Fri Sep 07 10:59:50 2007 -0700
@@ -389,7 +389,7 @@ class IPAServer:
         criteria_words = re.split(r'\s+', criteria)
         criteria_words = filter(lambda value:value!="", criteria_words)
         if len(criteria_words) == 0:
-            return []
+            return [0]
 
         (exact_match_filter, partial_match_filter) = self.__generate_match_filters(
                 search_fields, criteria_words)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/dbde3cd6/attachment.bin>

From ssorce at redhat.com  Fri Sep  7 18:05:31 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 07 Sep 2007 14:05:31 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <46E18AC5.9000009@redhat.com>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
	<46E15DE1.40103@redhat.com>
	<1189176443.19300.13.camel@localhost.localdomain>
	<46E18AC5.9000009@redhat.com>
Message-ID: <1189188331.19300.36.camel@localhost.localdomain>

On Fri, 2007-09-07 at 10:30 -0700, Pete Rowley wrote:
> If we can do it while having it make sense then that would be a good 
> thing - what are the corner cases here? 

The real problem here, as it is for the shell, is that we have a global
setting for something local.

On my laptop I will probably like to have /home/simo, but on a corporate
server I may have /home/remote/simo or /home/s/simo or /users/simo
or /rdu/simo or /mnt/remote/simo or whatever.

Also in future we may want to support something like nfs://server/home/
or cifs://server/path/whatevr, this would make much more sense, but
would require the client to know how to mount that and make it
available, a job for v2 or v3 which requires some helpers.

Simo.



From kmccarth at redhat.com  Fri Sep  7 18:08:21 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Fri, 7 Sep 2007 11:08:21 -0700
Subject: [Freeipa-devel] [PATCH] small (but important) fixes for release
In-Reply-To: <20070907180142.GF19932@moon.usersys.redhat.com>
References: <20070907180142.GF19932@moon.usersys.redhat.com>
Message-ID: <20070907180821.GG19932@moon.usersys.redhat.com>

Kevin McCarthy wrote:
> Fixes three issues:
> - password isn't mandatory for add person
> - fix for searching on '*' (it blew up)
> - Change my principal to 'admin' until the correct way is sorted out

Rob pointed out his next patch/readme will obviate the needs for
changing the principal.  Here's a revised patch with just the first two
fixes.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189188479 25200
# Node ID c6f1383b70771d65b315242611d7ae1419aab115
# Parent  31924e58a3c3a0e550d7ebc68c89b03fa1a10f3f
small release fixes:
- Make password not required for add person
- Fix for searching on '*' or ''

diff -r 31924e58a3c3 -r c6f1383b7077 ipa-server/ipa-gui/ipagui/forms/user.py
--- a/ipa-server/ipa-gui/ipagui/forms/user.py	Thu Sep 06 16:21:07 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/user.py	Fri Sep 07 11:07:59 2007 -0700
@@ -26,8 +26,8 @@ class UserFields():
 
 class UserNewValidator(validators.Schema):
     uid = validators.PlainText(not_empty=True)
-    userpassword = validators.String(not_empty=True)
-    userpassword_confirm = validators.String(not_empty=True)
+    userpassword = validators.String(not_empty=False)
+    userpassword_confirm = validators.String(not_empty=False)
     givenname = validators.String(not_empty=True)
     sn = validators.String(not_empty=True)
     mail = validators.Email(not_empty=True)
diff -r 31924e58a3c3 -r c6f1383b7077 ipa-server/xmlrpc-server/funcs.py
--- a/ipa-server/xmlrpc-server/funcs.py	Thu Sep 06 16:21:07 2007 -0700
+++ b/ipa-server/xmlrpc-server/funcs.py	Fri Sep 07 11:07:59 2007 -0700
@@ -389,7 +389,7 @@ class IPAServer:
         criteria_words = re.split(r'\s+', criteria)
         criteria_words = filter(lambda value:value!="", criteria_words)
         if len(criteria_words) == 0:
-            return []
+            return [0]
 
         (exact_match_filter, partial_match_filter) = self.__generate_match_filters(
                 search_fields, criteria_words)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/519776f1/attachment.bin>

From prowley at redhat.com  Fri Sep  7 18:09:07 2007
From: prowley at redhat.com (Pete Rowley)
Date: Fri, 07 Sep 2007 11:09:07 -0700
Subject: [Freeipa-devel] [PATCH] confirm password
In-Reply-To: <1189187662.9692.60.camel@localhost.localdomain>
References: <20070906212719.GB25833@moon.usersys.redhat.com>	
	<1189186106.9692.51.camel@localhost.localdomain>	
	<46E18F72.90309@redhat.com>
	<1189187662.9692.60.camel@localhost.localdomain>
Message-ID: <46E193C3.2060108@redhat.com>

Karl MacMillan wrote:
> On Fri, 2007-09-07 at 10:50 -0700, Pete Rowley wrote:
>   
>> Karl MacMillan wrote:
>>     
>>> On Thu, 2007-09-06 at 14:27 -0700, Kevin McCarthy wrote:
>>>   
>>>       
>>>> After some feedback from Bob and Pete, I'm removing the password
>>>> generator and adding a confirm password field.  (Just commented out for
>>>> now in case people change their mind)
>>>>
>>>>     
>>>>         
>>> What was the rationale for this?
>>>
>>>   
>>>       
>> Generating passwords requires that the password be communicated to the 
>> admin in the clear which introduces shoulder surfers and screen scrapers 
>> to the threat model.  In addition the password is not likely to be 
>> memorable enough to not be written down somewhere, and so further 
>> exposing it to risk of compromise.
>>
>>     
>
> Except that it is useful when generating accounts (especially a large
> number) and then printing the account information to hand to the user.
> We had discussed being able to generate a pdf with the account
> information for this purpose.
>
>   
Generating a unique password and then printing it out for easy 
compromise seems like something we definitely shouldn't be doing or 
encouraging. I believe current practice of setting the initial password 
tends to fall into two categories:

1) the end user is asked to type it in
2) it is deterministic

Both options are covered by the ui as it now is with the caveat that the 
deterministic password must be typed in.

I don't see this in the PRD, did I miss it?

-- 
Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/53cabfee/attachment.bin>

From rcritten at redhat.com  Fri Sep  7 18:12:46 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 07 Sep 2007 14:12:46 -0400
Subject: [Freeipa-devel] [PATCH] add group cli to Makefile,
	update install instructions
Message-ID: <46E1949E.7080406@redhat.com>

I had forgotten to add the ipa-group* command-line tools to Makefile.

I updated the installation instructions to describe how to create a new 
user and make that user an administrator.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-162-install.patch
Type: text/x-patch
Size: 2675 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/4d185cb9/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/4d185cb9/attachment-0001.bin>

From kmacmill at redhat.com  Fri Sep  7 18:12:54 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 14:12:54 -0400
Subject: [Freeipa-devel] [PATCH] confirm password
In-Reply-To: <46E193C3.2060108@redhat.com>
References: <20070906212719.GB25833@moon.usersys.redhat.com>
	<1189186106.9692.51.camel@localhost.localdomain>
	<46E18F72.90309@redhat.com>
	<1189187662.9692.60.camel@localhost.localdomain>
	<46E193C3.2060108@redhat.com>
Message-ID: <1189188774.9692.63.camel@localhost.localdomain>

On Fri, 2007-09-07 at 11:09 -0700, Pete Rowley wrote:
> Karl MacMillan wrote:

[...]
 
> >
> > Except that it is useful when generating accounts (especially a large
> > number) and then printing the account information to hand to the user.
> > We had discussed being able to generate a pdf with the account
> > information for this purpose.
> >
> >   
> Generating a unique password and then printing it out for easy 
> compromise seems like something we definitely shouldn't be doing or 
> encouraging.

Why? I've used that setup many times before and as long as the printer
is secure it works very well. Just like it displaying the password on
the screen can be secure and very convenient, you just have to take
precautions.

>  I believe current practice of setting the initial password 
> tends to fall into two categories:
> 
> 1) the end user is asked to type it in
> 2) it is deterministic
> 
> Both options are covered by the ui as it now is with the caveat that the 
> deterministic password must be typed in.
> 
> I don't see this in the PRD, did I miss it?
> 

Don't think it's covered in there.

Karl



From kmacmill at redhat.com  Fri Sep  7 18:23:22 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 14:23:22 -0400
Subject: [Freeipa-devel] [PATCH] small (but important) fixes for release
In-Reply-To: <20070907180821.GG19932@moon.usersys.redhat.com>
References: <20070907180142.GF19932@moon.usersys.redhat.com>
	<20070907180821.GG19932@moon.usersys.redhat.com>
Message-ID: <1189189402.9692.65.camel@localhost.localdomain>

On Fri, 2007-09-07 at 11:08 -0700, Kevin McCarthy wrote:
> Kevin McCarthy wrote:
> > Fixes three issues:
> > - password isn't mandatory for add person
> > - fix for searching on '*' (it blew up)
> > - Change my principal to 'admin' until the correct way is sorted out
> 
> Rob pointed out his next patch/readme will obviate the needs for
> changing the principal.  Here's a revised patch with just the first two
> fixes.
> 

Pushed.



From kmacmill at redhat.com  Fri Sep  7 18:24:57 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 07 Sep 2007 14:24:57 -0400
Subject: [Freeipa-devel] [PATCH] add group cli to Makefile, update
	install instructions
In-Reply-To: <46E1949E.7080406@redhat.com>
References: <46E1949E.7080406@redhat.com>
Message-ID: <1189189497.9692.67.camel@localhost.localdomain>

On Fri, 2007-09-07 at 14:12 -0400, Rob Crittenden wrote:
> I had forgotten to add the ipa-group* command-line tools to Makefile.
> 
> I updated the installation instructions to describe how to create a new 
> user and make that user an administrator.

Pushed.



From adingman at redhat.com  Fri Sep  7 18:25:24 2007
From: adingman at redhat.com (Andrew C. Dingman)
Date: Fri, 07 Sep 2007 14:25:24 -0400
Subject: [Freeipa-devel] [PATCH] confirm password
In-Reply-To: <46E193C3.2060108@redhat.com>
References: <20070906212719.GB25833@moon.usersys.redhat.com>
	<1189186106.9692.51.camel@localhost.localdomain>
	<46E18F72.90309@redhat.com>
	<1189187662.9692.60.camel@localhost.localdomain>
	<46E193C3.2060108@redhat.com>
Message-ID: <1189189525.9829.12.camel@sinope>

On Fri, 2007-09-07 at 11:09 -0700, Pete Rowley wrote:
> > Except that it is useful when generating accounts (especially a large
> > number) and then printing the account information to hand to the user.
> > We had discussed being able to generate a pdf with the account
> > information for this purpose.
> >
> >   
> Generating a unique password and then printing it out for easy 
> compromise seems like something we definitely shouldn't be doing or 
> encouraging. I believe current practice of setting the initial password 
> tends to fall into two categories:
> 
> 1) the end user is asked to type it in
> 2) it is deterministic

3) Generate an already-expired password which the user must change at
first login. Print the thing out and put it in their inbox. Since the
password has to be changed on first use, any compromise will be detected
by the user, who WILL contact the helpdesk because they want access to
their account.

In the case where a user expects the password change / new account, this
is probably far more secure than giving them a deterministic password,
since there's at least a communication channel to intercept rather than
simple common knowledge. It's also often far more practical than making
the user come to the admin to type the password themselves. Of course,
taking the paper out of the equation would be even better.

This was the *only* thing that satisfied all the assorted regulatory
bodies at my former employer. We couldn't make remote users type it in
themselves, and we weren't allowed to use deterministic passwords.
Besides, users often keep dump, predictable passwords like
'PassWord070907" if you give them out in the first place.

(Of course, all passwords suck, and I'd much rather see something like
smartcards and PKInit, but that's neither here nor there nor yet.)

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/1731fc22/attachment.sig>

From ssorce at redhat.com  Fri Sep  7 18:44:04 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 07 Sep 2007 14:44:04 -0400
Subject: [Freeipa-devel] [PATCH] confirm password
In-Reply-To: <1189189525.9829.12.camel@sinope>
References: <20070906212719.GB25833@moon.usersys.redhat.com>
	<1189186106.9692.51.camel@localhost.localdomain>
	<46E18F72.90309@redhat.com>
	<1189187662.9692.60.camel@localhost.localdomain>
	<46E193C3.2060108@redhat.com>  <1189189525.9829.12.camel@sinope>
Message-ID: <1189190644.19300.42.camel@localhost.localdomain>

On Fri, 2007-09-07 at 14:25 -0400, Andrew C. Dingman wrote:
> 
> 3) Generate an already-expired password which the user must change at
> first login. Print the thing out and put it in their inbox. Since the
> password has to be changed on first use, any compromise will be
> detected
> by the user, who WILL contact the helpdesk because they want access to
> their account. 

I like this one _very_ much, I am testing packages with a "fixed"
kpasswd client tool (and pam_krb5 as well). If that works I will test
this scenario and implement it.

Simo.



From prowley at redhat.com  Fri Sep  7 18:47:32 2007
From: prowley at redhat.com (Pete Rowley)
Date: Fri, 07 Sep 2007 11:47:32 -0700
Subject: [Freeipa-devel] [PATCH] confirm password
In-Reply-To: <1189189525.9829.12.camel@sinope>
References: <20070906212719.GB25833@moon.usersys.redhat.com>	
	<1189186106.9692.51.camel@localhost.localdomain>	
	<46E18F72.90309@redhat.com>	
	<1189187662.9692.60.camel@localhost.localdomain>	
	<46E193C3.2060108@redhat.com> <1189189525.9829.12.camel@sinope>
Message-ID: <46E19CC4.1060707@redhat.com>

Andrew C. Dingman wrote:
> On Fri, 2007-09-07 at 11:09 -0700, Pete Rowley wrote:
>   
>>> Except that it is useful when generating accounts (especially a large
>>> number) and then printing the account information to hand to the user.
>>> We had discussed being able to generate a pdf with the account
>>> information for this purpose.
>>>
>>>   
>>>       
>> Generating a unique password and then printing it out for easy 
>> compromise seems like something we definitely shouldn't be doing or 
>> encouraging. I believe current practice of setting the initial password 
>> tends to fall into two categories:
>>
>> 1) the end user is asked to type it in
>> 2) it is deterministic
>>     
>
> 3) Generate an already-expired password which the user must change at
> first login.
This is a good point, passwords for new accounts should be created in 
this state.
>  Print the thing out and put it in their inbox. Since the
> password has to be changed on first use, any compromise will be detected
> by the user, who WILL contact the helpdesk because they want access to
> their account.
>   
This is a reasonable compromise, but the difference between printing out 
the password and generating a deterministic one that is based on user 
data is quite small (apart from your point about regulatory bodies) - in 
both cases there is an increased chance for compromise.  The important 
issue is being able to detect the compromise in both of these cases.

In any case, I don't think we should try to solve this problem now - it 
is not clear that we would even be solving the right problem.


-- 
Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/9566eb27/attachment.bin>

From ssorce at redhat.com  Fri Sep  7 19:30:56 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 07 Sep 2007 15:30:56 -0400
Subject: [Freeipa-devel] command-line arguments
In-Reply-To: <1189179741.22717.40.camel@sinope>
References: <46E14DB0.40704@redhat.com>
	<1189173688.19300.4.camel@localhost.localdomain>
	<1189175936.22717.17.camel@sinope>
	<1189176585.19300.16.camel@localhost.localdomain>
	<1189177866.22717.31.camel@sinope>
	<1189178843.19300.22.camel@localhost.localdomain>
	<1189179741.22717.40.camel@sinope>
Message-ID: <1189193456.19300.47.camel@localhost.localdomain>

On Fri, 2007-09-07 at 11:42 -0400, Andrew C. Dingman wrote:
> 
> >  ah and now that I think of it I
> > am going to make sure our conf does not allow to "see" uids lower
> than
> > 500 (or we risk disrupting local accounts and root) for IPAv1
> 
> Makes sense to me 

Turns out nss_ldap can't do that, only pam_ldap which we don't use, I
will take mental note to see if we can force this in v2.

Simo.



From rcritten at redhat.com  Fri Sep  7 19:47:30 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 07 Sep 2007 15:47:30 -0400
Subject: [Freeipa-devel] reason for re-install failure
Message-ID: <46E1AAD2.2020108@redhat.com>

I ran into the "fail on re-install" problem where the install fails on a 
kadmin timeout.

The problem is that the installation appends the new password to 
/var/kerberos/krb5kdc/ldappwd. This can lead to duplicate entries and it 
apparently makes things flip out. I just removed that file and the 
re-install went fine.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/55bb7f49/attachment.bin>

From ssorce at redhat.com  Fri Sep  7 20:07:59 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 07 Sep 2007 16:07:59 -0400
Subject: [Freeipa-devel] reason for re-install failure
In-Reply-To: <46E1AAD2.2020108@redhat.com>
References: <46E1AAD2.2020108@redhat.com>
Message-ID: <1189195679.19300.49.camel@localhost.localdomain>

On Fri, 2007-09-07 at 15:47 -0400, Rob Crittenden wrote:
> I ran into the "fail on re-install" problem where the install fails on a 
> kadmin timeout.
> 
> The problem is that the installation appends the new password to 
> /var/kerberos/krb5kdc/ldappwd. This can lead to duplicate entries and it 
> apparently makes things flip out. I just removed that file and the 
> re-install went fine.

Ok this maybe seen as a bug, should we backup and move the original file
on installation ?

Simo.



From rcritten at redhat.com  Fri Sep  7 20:35:56 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 07 Sep 2007 16:35:56 -0400
Subject: [Freeipa-devel] problem with proxy
Message-ID: <46E1B62C.80004@redhat.com>

When trying to add a user to a group by proxying I got this error logged 
by FDS:

[07/Sep/2007:16:03:45 -0400] NSACLPlugin - conn=42 op=0 (main): Deny 
proxy on 
entry(cn=admins,cn=groups,cn=accounts,dc=greyoak,dc=com).attr(cn): no 
aci matched the resource
[07/Sep/2007:16:03:45 -0400] NSACLPlugin - conn=42 op=0 (main): Deny 
search on 
entry(cn=admins,cn=groups,cn=accounts,dc=greyoak,dc=com).attr(cn) to 
proxy (uid=rcrit,cn=users,cn=accounts,dc=greyoak,dc=com): error occurred

Looks like the aci's need some tuning.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/0e3bfc6d/attachment.bin>

From kmccarth at redhat.com  Fri Sep  7 22:19:02 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Fri, 7 Sep 2007 15:19:02 -0700
Subject: [Freeipa-devel] [PATCH] additions to readme file
Message-ID: <20070907221901.GI19932@moon.usersys.redhat.com>

Added some required packages to the readme file.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189203531 25200
# Node ID 85f5a6db2258ef62b642e6cd7b117ed33afeeab3
# Parent  0b99cba4f16d818f936770474cc8047c0a00c4c0
Add required packages to README

diff -r 0b99cba4f16d -r 85f5a6db2258 ipa-server/ipa-install/README
--- a/ipa-server/ipa-install/README	Fri Sep 07 11:29:02 2007 -0700
+++ b/ipa-server/ipa-install/README	Fri Sep 07 15:18:51 2007 -0700
@@ -5,12 +5,19 @@ fedora-ds-base
 fedora-ds-base
 fedora-ds-base-devel
 openldap-clients
+openldap-devel
 krb5-server-ldap
 cyrus-sasl-gssapi
 httpd
 mod_auth_kerb
 ntp
 openssl-devel
+nspr-devel
+nss-devel
+mozldap-devel
+mod_python
+gcc
+python-ldap
 
 Installation example:
 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/cc594fdf/attachment.bin>

From kmccarth at redhat.com  Fri Sep  7 23:48:14 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Fri, 7 Sep 2007 16:48:14 -0700
Subject: [Freeipa-devel] [PATCH] fix duplicate entry error
Message-ID: <20070907234814.GK19932@moon.usersys.redhat.com>

A last batch of minuscule fixes, after finally getting the demo
environment up again.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189209214 25200
# Node ID 5b206b60249e0a33f700db71c011c09a25fe6808
# Parent  4daefc6ef68c12235fa3756f1b7f49564f758a1e
Fix duplicate entry error to be more descriptive.
Add TurboGears to required package list
Clear password on Edit Person page.
Change uidnumber/gidnumber on Add Person to say 'Generated by server'

diff -r 4daefc6ef68c -r 5b206b60249e ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Fri Sep 07 15:59:54 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Fri Sep 07 16:53:34 2007 -0700
@@ -94,6 +94,10 @@ class Root(controllers.RootController):
             rv = client.add_user(new_user)
             turbogears.flash("%s added!" % kw['uid'])
             raise turbogears.redirect('/usershow', uid=kw['uid'])
+        except ipaerror.exception_for(ipaerror.LDAP_DUPLICATE):
+            turbogears.flash("Person with login '%s' already exists" %
+                    kw.get('uid'))
+            return dict(form=user_new_form, tg_template='ipagui.templates.usernew')
         except ipaerror.IPAError, e:
             turbogears.flash("User add failed: " + str(e))
             return dict(form=user_new_form, tg_template='ipagui.templates.usernew')
@@ -107,6 +111,10 @@ class Root(controllers.RootController):
 
         user = client.get_user_by_uid(uid, user_fields)
         user_dict = user.toDict()
+        # Edit shouldn't fill in the password field.
+        if user_dict.has_key('userpassword'):
+            del(user_dict['userpassword'])
+
         # store a copy of the original user for the update later
         user_data = b64encode(dumps(user_dict))
         user_dict['user_orig'] = user_data
diff -r 4daefc6ef68c -r 5b206b60249e ipa-server/ipa-gui/ipagui/forms/user.py
--- a/ipa-server/ipa-gui/ipagui/forms/user.py	Fri Sep 07 15:59:54 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/user.py	Fri Sep 07 16:53:34 2007 -0700
@@ -43,7 +43,6 @@ class UserNewForm(widgets.Form):
     params = ['user']
 
     fields = [UserFields.uid, UserFields.givenname,
-              UserFields.uidnumber, UserFields.gidnumber,
               UserFields.sn, UserFields.mail]
 
     validator = UserNewValidator()
diff -r 4daefc6ef68c -r 5b206b60249e ipa-server/ipa-gui/ipagui/templates/usernewform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/usernewform.kid	Fri Sep 07 15:59:54 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/usernewform.kid	Fri Sep 07 16:53:34 2007 -0700
@@ -125,9 +125,7 @@
             py:content="user.uidnumber.label" />:
         </th>
         <td>
-          <span py:replace="user.uidnumber.display(value_for(user.uidnumber))" />
-          <span py:if="tg.errors.get('uidnumber')" class="fielderror"
-              py:content="tg.errors.get('uidnumber')" />
+          Generated by server
         </td>
       </tr>
 
@@ -137,9 +135,7 @@
             py:content="user.gidnumber.label" />:
         </th>
         <td>
-          <span py:replace="user.gidnumber.display(value_for(user.gidnumber))" />
-          <span py:if="tg.errors.get('gidnumber')" class="fielderror"
-              py:content="tg.errors.get('gidnumber')" />
+          Generated by server
         </td>
       </tr>
     </table>
diff -r 4daefc6ef68c -r 5b206b60249e ipa-server/ipa-install/README
--- a/ipa-server/ipa-install/README	Fri Sep 07 15:59:54 2007 -0700
+++ b/ipa-server/ipa-install/README	Fri Sep 07 16:53:34 2007 -0700
@@ -18,6 +18,7 @@ mod_python
 mod_python
 gcc
 python-ldap
+TurboGears
 
 Installation example:
 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070907/45d5803e/attachment.bin>

From kmacmill at redhat.com  Mon Sep 10 13:14:14 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 10 Sep 2007 09:14:14 -0400
Subject: [Freeipa-devel] [PATCH] additions to readme file
In-Reply-To: <20070907221901.GI19932@moon.usersys.redhat.com>
References: <20070907221901.GI19932@moon.usersys.redhat.com>
Message-ID: <1189430054.3551.5.camel@localhost.localdomain>

On Fri, 2007-09-07 at 15:19 -0700, Kevin McCarthy wrote:
> Added some required packages to the readme file.
> 
> -Kevin
> 

Pushed - Karl




From kmacmill at redhat.com  Mon Sep 10 13:14:55 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 10 Sep 2007 09:14:55 -0400
Subject: [Freeipa-devel] [PATCH] fix duplicate entry error
In-Reply-To: <20070907234814.GK19932@moon.usersys.redhat.com>
References: <20070907234814.GK19932@moon.usersys.redhat.com>
Message-ID: <1189430095.3551.7.camel@localhost.localdomain>

On Fri, 2007-09-07 at 16:48 -0700, Kevin McCarthy wrote:
> A last batch of minuscule fixes, after finally getting the demo
> environment up again.
> 

Pushed - Karl



From kmacmill at redhat.com  Mon Sep 10 13:16:28 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 10 Sep 2007 09:16:28 -0400
Subject: [Freeipa-devel] reason for re-install failure
In-Reply-To: <1189195679.19300.49.camel@localhost.localdomain>
References: <46E1AAD2.2020108@redhat.com>
	<1189195679.19300.49.camel@localhost.localdomain>
Message-ID: <1189430188.3551.9.camel@localhost.localdomain>

On Fri, 2007-09-07 at 16:07 -0400, Simo Sorce wrote:
> On Fri, 2007-09-07 at 15:47 -0400, Rob Crittenden wrote:
> > I ran into the "fail on re-install" problem where the install fails on a 
> > kadmin timeout.
> > 
> > The problem is that the installation appends the new password to 
> > /var/kerberos/krb5kdc/ldappwd. This can lead to duplicate entries and it 
> > apparently makes things flip out. I just removed that file and the 
> > re-install went fine.
> 
> Ok this maybe seen as a bug, should we backup and move the original file
> on installation ?
> 
> Simo.

Nah - I think we should just have a set of re-install diections that
tell how to remove FDS instances and fix this problem.

Karl



From rcritten at redhat.com  Mon Sep 10 13:24:01 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 10 Sep 2007 09:24:01 -0400
Subject: [Freeipa-devel] reason for re-install failure
In-Reply-To: <1189430188.3551.9.camel@localhost.localdomain>
References: <46E1AAD2.2020108@redhat.com>	
	<1189195679.19300.49.camel@localhost.localdomain>
	<1189430188.3551.9.camel@localhost.localdomain>
Message-ID: <46E54571.2070605@redhat.com>

Karl MacMillan wrote:
> On Fri, 2007-09-07 at 16:07 -0400, Simo Sorce wrote:
>> On Fri, 2007-09-07 at 15:47 -0400, Rob Crittenden wrote:
>>> I ran into the "fail on re-install" problem where the install fails on a 
>>> kadmin timeout.
>>>
>>> The problem is that the installation appends the new password to 
>>> /var/kerberos/krb5kdc/ldappwd. This can lead to duplicate entries and it 
>>> apparently makes things flip out. I just removed that file and the 
>>> re-install went fine.
>> Ok this maybe seen as a bug, should we backup and move the original file
>> on installation ?
>>
>> Simo.
> 
> Nah - I think we should just have a set of re-install diections that
> tell how to remove FDS instances and fix this problem.
> 
> Karl
> 

It's really a kerberos bug. I think we should simply replace any 
existing entries. We have a very specific DN in there. Replacing it is 
likely the right thing to do.


rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/2d89829a/attachment.bin>

From kmacmill at redhat.com  Mon Sep 10 13:30:43 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 10 Sep 2007 09:30:43 -0400
Subject: [Freeipa-devel] reason for re-install failure
In-Reply-To: <46E54571.2070605@redhat.com>
References: <46E1AAD2.2020108@redhat.com>
	<1189195679.19300.49.camel@localhost.localdomain>
	<1189430188.3551.9.camel@localhost.localdomain>
	<46E54571.2070605@redhat.com>
Message-ID: <1189431043.3551.26.camel@localhost.localdomain>

On Mon, 2007-09-10 at 09:24 -0400, Rob Crittenden wrote:
> Karl MacMillan wrote:
> > On Fri, 2007-09-07 at 16:07 -0400, Simo Sorce wrote:
> >> On Fri, 2007-09-07 at 15:47 -0400, Rob Crittenden wrote:
> >>> I ran into the "fail on re-install" problem where the install fails on a 
> >>> kadmin timeout.
> >>>
> >>> The problem is that the installation appends the new password to 
> >>> /var/kerberos/krb5kdc/ldappwd. This can lead to duplicate entries and it 
> >>> apparently makes things flip out. I just removed that file and the 
> >>> re-install went fine.
> >> Ok this maybe seen as a bug, should we backup and move the original file
> >> on installation ?
> >>
> >> Simo.
> > 
> > Nah - I think we should just have a set of re-install diections that
> > tell how to remove FDS instances and fix this problem.
> > 
> > Karl
> > 
> 
> It's really a kerberos bug. I think we should simply replace any 
> existing entries. We have a very specific DN in there. Replacing it is 
> likely the right thing to do.
> 

I'm fine with that - I was only trying to avoid really solving the
reinstall problem. I think it is just too hard to get right and will eat
up a lot of time.

So, you are suggesting intelligently editing that file if it exists
rather than replacing?

Karl



From ssorce at redhat.com  Mon Sep 10 13:33:29 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Mon, 10 Sep 2007 09:33:29 -0400
Subject: [Freeipa-devel] reason for re-install failure
In-Reply-To: <1189431043.3551.26.camel@localhost.localdomain>
References: <46E1AAD2.2020108@redhat.com>
	<1189195679.19300.49.camel@localhost.localdomain>
	<1189430188.3551.9.camel@localhost.localdomain>
	<46E54571.2070605@redhat.com>
	<1189431043.3551.26.camel@localhost.localdomain>
Message-ID: <1189431209.19300.70.camel@localhost.localdomain>

On Mon, 2007-09-10 at 09:30 -0400, Karl MacMillan wrote:
> On Mon, 2007-09-10 at 09:24 -0400, Rob Crittenden wrote:
> > Karl MacMillan wrote:
> > > On Fri, 2007-09-07 at 16:07 -0400, Simo Sorce wrote:
> > >> On Fri, 2007-09-07 at 15:47 -0400, Rob Crittenden wrote:
> > >>> I ran into the "fail on re-install" problem where the install fails on a 
> > >>> kadmin timeout.
> > >>>
> > >>> The problem is that the installation appends the new password to 
> > >>> /var/kerberos/krb5kdc/ldappwd. This can lead to duplicate entries and it 
> > >>> apparently makes things flip out. I just removed that file and the 
> > >>> re-install went fine.
> > >> Ok this maybe seen as a bug, should we backup and move the original file
> > >> on installation ?
> > >>
> > >> Simo.
> > > 
> > > Nah - I think we should just have a set of re-install diections that
> > > tell how to remove FDS instances and fix this problem.
> > > 
> > > Karl
> > > 
> > 
> > It's really a kerberos bug. I think we should simply replace any 
> > existing entries. We have a very specific DN in there. Replacing it is 
> > likely the right thing to do.
> > 
> 
> I'm fine with that - I was only trying to avoid really solving the
> reinstall problem. I think it is just too hard to get right and will eat
> up a lot of time.
> 
> So, you are suggesting intelligently editing that file if it exists
> rather than replacing?

No, just replacing it, and, perhaps backup-ing the original one.
ldappwd contains just one line.

Simo.



From rcritten at redhat.com  Mon Sep 10 13:41:06 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 10 Sep 2007 09:41:06 -0400
Subject: [Freeipa-devel] reason for re-install failure
In-Reply-To: <1189431209.19300.70.camel@localhost.localdomain>
References: <46E1AAD2.2020108@redhat.com>	
	<1189195679.19300.49.camel@localhost.localdomain>	
	<1189430188.3551.9.camel@localhost.localdomain>	
	<46E54571.2070605@redhat.com>	
	<1189431043.3551.26.camel@localhost.localdomain>
	<1189431209.19300.70.camel@localhost.localdomain>
Message-ID: <46E54972.40806@redhat.com>

Simo Sorce wrote:
> On Mon, 2007-09-10 at 09:30 -0400, Karl MacMillan wrote:
>> On Mon, 2007-09-10 at 09:24 -0400, Rob Crittenden wrote:
>>> Karl MacMillan wrote:
>>>> On Fri, 2007-09-07 at 16:07 -0400, Simo Sorce wrote:
>>>>> On Fri, 2007-09-07 at 15:47 -0400, Rob Crittenden wrote:
>>>>>> I ran into the "fail on re-install" problem where the install fails on a 
>>>>>> kadmin timeout.
>>>>>>
>>>>>> The problem is that the installation appends the new password to 
>>>>>> /var/kerberos/krb5kdc/ldappwd. This can lead to duplicate entries and it 
>>>>>> apparently makes things flip out. I just removed that file and the 
>>>>>> re-install went fine.
>>>>> Ok this maybe seen as a bug, should we backup and move the original file
>>>>> on installation ?
>>>>>
>>>>> Simo.
>>>> Nah - I think we should just have a set of re-install diections that
>>>> tell how to remove FDS instances and fix this problem.
>>>>
>>>> Karl
>>>>
>>> It's really a kerberos bug. I think we should simply replace any 
>>> existing entries. We have a very specific DN in there. Replacing it is 
>>> likely the right thing to do.
>>>
>> I'm fine with that - I was only trying to avoid really solving the
>> reinstall problem. I think it is just too hard to get right and will eat
>> up a lot of time.
>>
>> So, you are suggesting intelligently editing that file if it exists
>> rather than replacing?
> 
> No, just replacing it, and, perhaps backup-ing the original one.
> ldappwd contains just one line.
> 
> Simo.
> 

Yup, in theory this is right. I think this file falls under the "we own 
it, we'll do what we want" category.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/a3f56c9a/attachment.bin>

From kmacmill at redhat.com  Mon Sep 10 14:09:59 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 10 Sep 2007 10:09:59 -0400
Subject: [Freeipa-devel] FreeIPA Milestone 3 released
Message-ID: <1189433399.3551.32.camel@localhost.localdomain>

FreeIPA Milestone 3 has been released. This release, though
significantly more polished than the previous milestones, is still aimed
at developers.

Major changes in this release include:

* Automated setup of authentication
* Further work on initial directory layout
* Initial support for group administration
* Support for proxy authentication between the web interface and 
  directory with forwarded kerberos tickets
* Significant improvements to the web gui
* Addition of distributed numeric assignment directory plugin
* Server install is optionally interactive
* Initial client setup tool

Karl





From rcritten at redhat.com  Mon Sep 10 17:03:16 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 10 Sep 2007 13:03:16 -0400
Subject: [Freeipa-devel] TurboGears identity
Message-ID: <46E578D4.5070508@redhat.com>

TurboGears has some identity stuff built in. I've managed to write my 
own provider that lets us use the standard identity.* stuff (very 
limited currently).

The downside is that a TurboGears configuration file will need to be 
updated for this to be available. I'm not sure if we want to mess around 
with TG internals or not.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/56a54e29/attachment.bin>

From kmccarth at redhat.com  Mon Sep 10 17:04:12 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Mon, 10 Sep 2007 10:04:12 -0700
Subject: [Freeipa-devel] [PATCH] edit protected fields
Message-ID: <20070910170410.GB3594@moon.usersys.redhat.com>

This patch adds a checkbox to the edit person page, to toggle editing
"protected" fields - currently uidnumber, gidnumber, and password.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189443753 25200
# Node ID 17eb647a011bcf7d0c0a54dcf48f6d60ce1e932d
# Parent  530e225e14080cae2f36464a4cd2bf18b425b9be
Edit protected fields checkbox on user edit page.
(Password updating still doesn't work due to ACI though)

diff -r 530e225e1408 -r 17eb647a011b ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Mon Sep 10 08:55:36 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Mon Sep 10 10:02:33 2007 -0700
@@ -145,6 +145,12 @@ class Root(controllers.RootController):
                 new_user.setValue('nsAccountLock', 'true')
             else:
                 new_user.setValue('nsAccountLock', None)
+            if kw.get('userpassword'):
+                new_user.setValue('userpassword', kw.get('userpassword'))
+            if kw.get('uidnumber'):
+                new_user.setValue('uidnumber', kw.get('uidnumber'))
+            if kw.get('gidnumber'):
+                new_user.setValue('gidnumber', kw.get('gidnumber'))
 
             #
             # this is a hack until we decide on the policy for names/cn/sn/givenName
diff -r 530e225e1408 -r 17eb647a011b ipa-server/ipa-gui/ipagui/forms/user.py
--- a/ipa-server/ipa-gui/ipagui/forms/user.py	Mon Sep 10 08:55:36 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/user.py	Mon Sep 10 10:02:33 2007 -0700
@@ -77,7 +77,7 @@ class UserEditForm(widgets.Form):
 
     fields = [UserFields.givenname, UserFields.sn, UserFields.mail,
               UserFields.uid_hidden, UserFields.user_orig,
-              UserFields.uidnumber_hidden, UserFields.gidnumber_hidden,
+              UserFields.uidnumber, UserFields.gidnumber,
               UserFields.krbPasswordExpiration_hidden,
               ]
 
diff -r 530e225e1408 -r 17eb647a011b ipa-server/ipa-gui/ipagui/static/css/style.css
--- a/ipa-server/ipa-gui/ipagui/static/css/style.css	Mon Sep 10 08:55:36 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/static/css/style.css	Mon Sep 10 10:02:33 2007 -0700
@@ -149,6 +149,10 @@ body {
 }
 
 .small {
+  font-size: small;
+}
+
+.xsmall {
   font-size: x-small;
 }
 
diff -r 530e225e1408 -r 17eb647a011b ipa-server/ipa-gui/ipagui/templates/master.kid
--- a/ipa-server/ipa-gui/ipagui/templates/master.kid	Mon Sep 10 08:55:36 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/master.kid	Mon Sep 10 10:02:33 2007 -0700
@@ -28,7 +28,7 @@
       <div id="logo">
         <a href="${tg.url('/')}"><img 
         src="${tg.url('/static/images/logo.png')}"
-        border="0"
+        border="0" alt="homepage"
         /></a>
       </div>
       <div id="headerinfo">
diff -r 530e225e1408 -r 17eb647a011b ipa-server/ipa-gui/ipagui/templates/useredit.kid
--- a/ipa-server/ipa-gui/ipagui/templates/useredit.kid	Mon Sep 10 08:55:36 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/useredit.kid	Mon Sep 10 10:02:33 2007 -0700
@@ -6,7 +6,16 @@
 <title>Edit Person</title>
 </head>
 <body>
+
+  <div>
+    <div style="float:right">
+      <input type="checkbox"
+          onclick="toggleProtectedFields(this);">
+        <span class="small">edit protected fields</span>
+      </input>
+    </div>
     <h2>Edit Person</h2>
+  </div>
 
 <?python
 from ipagui.helpers import userhelper
diff -r 530e225e1408 -r 17eb647a011b ipa-server/ipa-gui/ipagui/templates/usereditform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid	Mon Sep 10 08:55:36 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid	Mon Sep 10 10:02:33 2007 -0700
@@ -1,6 +1,26 @@
 <div xmlns:py="http://purl.org/kid/ns#"
   class="simpleroster">
   <form action="${action}" name="${name}" method="${method}" class="tableform">
+
+  <script type="text/javascript">
+    function toggleProtectedFields(checkbox) {
+      passwordField = document.getElementById('form_userpassword');
+      passwordConfirmField = document.getElementById('form_userpassword_confirm');
+      uidnumberField = document.getElementById('form_uidnumber');
+      gidnumberField = document.getElementById('form_gidnumber');
+      if (checkbox.checked) {
+        passwordField.disabled = false;
+        passwordConfirmField.disabled = false;
+        uidnumberField.disabled = false;
+        gidnumberField.disabled = false;
+      } else {
+        passwordField.disabled = true;
+        passwordConfirmField.disabled = true;
+        uidnumberField.disabled = true;
+        gidnumberField.disabled = true;
+      }
+    }
+  </script>
 
 
   <div py:for="field in hidden_fields"
@@ -56,6 +76,10 @@
           <span py:replace="user.userpassword.display(value_for(user.userpassword))" />
           <span py:if="tg.errors.get('userpassword')" class="fielderror"
               py:content="tg.errors.get('userpassword')" />
+
+          <script type="text/javascript">
+              document.getElementById('form_userpassword').disabled = true;
+          </script>
 
           <!-- 
           <span id="password_text">********</span>
@@ -71,7 +95,7 @@
                 });" />
           <br />
           <input type="checkbox"
-              onclick="togglePassword(this);"><span class="small">edit</span></input>
+              onclick="togglePassword(this);"><span class="xsmall">edit</span></input>
           <script type="text/javascript">
             document.getElementById('form_userpassword').style.display='none';
 
@@ -104,6 +128,10 @@
                value_for(user.userpassword_confirm))" />
           <span py:if="tg.errors.get('userpassword_confirm')" class="fielderror"
               py:content="tg.errors.get('userpassword_confirm')" />
+
+          <script type="text/javascript">
+              document.getElementById('form_userpassword_confirm').disabled = true;
+          </script>
         </td>
       </tr>
 
@@ -113,7 +141,14 @@
             py:content="user.uidnumber.label" />:
         </th>
         <td>
-          ${value_for(user.uidnumber)}
+          <span py:replace="user.uidnumber.display(
+               value_for(user.uidnumber))" />
+          <span py:if="tg.errors.get('uidnumber')" class="fielderror"
+              py:content="tg.errors.get('uidnumber')" />
+
+          <script type="text/javascript">
+              document.getElementById('form_uidnumber').disabled = true;
+          </script>
         </td>
       </tr>
 
@@ -123,7 +158,14 @@
             py:content="user.gidnumber.label" />:
         </th>
         <td>
-          ${value_for(user.gidnumber)}
+          <span py:replace="user.gidnumber.display(
+               value_for(user.gidnumber))" />
+          <span py:if="tg.errors.get('gidnumber')" class="fielderror"
+              py:content="tg.errors.get('gidnumber')" />
+
+          <script type="text/javascript">
+              document.getElementById('form_gidnumber').disabled = true;
+          </script>
         </td>
       </tr>
     </table>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/d5ad07b4/attachment.bin>

From kmccarth at redhat.com  Mon Sep 10 17:08:23 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Mon, 10 Sep 2007 10:08:23 -0700
Subject: [Freeipa-devel] TurboGears identity
In-Reply-To: <46E578D4.5070508@redhat.com>
References: <46E578D4.5070508@redhat.com>
Message-ID: <20070910170822.GC3594@moon.usersys.redhat.com>

Rob Crittenden wrote:
> TurboGears has some identity stuff built in. I've managed to write my own 
> provider that lets us use the standard identity.* stuff (very limited 
> currently).
>
> The downside is that a TurboGears configuration file will need to be 
> updated for this to be available. I'm not sure if we want to mess around 
> with TG internals or not.

Which configuration file?  If it's a config file in our repository (i.e,
under 'ipa-gui/'), I would say it's fine.  Just make a note and we'll need
to port it going forward.

-Kevin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/3c7b103a/attachment.bin>

From rcritten at redhat.com  Mon Sep 10 17:28:16 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 10 Sep 2007 13:28:16 -0400
Subject: [Freeipa-devel] TurboGears identity
In-Reply-To: <20070910170822.GC3594@moon.usersys.redhat.com>
References: <46E578D4.5070508@redhat.com>
	<20070910170822.GC3594@moon.usersys.redhat.com>
Message-ID: <46E57EB0.5030606@redhat.com>

Kevin McCarthy wrote:
> Rob Crittenden wrote:
>> TurboGears has some identity stuff built in. I've managed to write my own 
>> provider that lets us use the standard identity.* stuff (very limited 
>> currently).
>>
>> The downside is that a TurboGears configuration file will need to be 
>> updated for this to be available. I'm not sure if we want to mess around 
>> with TG internals or not.
> 
> Which configuration file?  If it's a config file in our repository (i.e,
> under 'ipa-gui/'), I would say it's fine.  Just make a note and we'll need
> to port it going forward.

Unfortunately it's not so easy. The *.cfg in ipa-gui needs to be updated 
but so does 
/usr/lib/python2.5/site-packages/TurboGears-1.0.2.2-py2.5.egg-info/entry_points.txt

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/bb4dc9b0/attachment.bin>

From kmccarth at redhat.com  Mon Sep 10 17:39:02 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Mon, 10 Sep 2007 10:39:02 -0700
Subject: [Freeipa-devel] TurboGears identity
In-Reply-To: <46E57EB0.5030606@redhat.com>
References: <46E578D4.5070508@redhat.com>
	<20070910170822.GC3594@moon.usersys.redhat.com>
	<46E57EB0.5030606@redhat.com>
Message-ID: <20070910173902.GD3594@moon.usersys.redhat.com>

Rob Crittenden wrote:
> Kevin McCarthy wrote:
>> Which configuration file?  If it's a config file in our repository (i.e,
>> under 'ipa-gui/'), I would say it's fine.  Just make a note and we'll need
>> to port it going forward.
>
> Unfortunately it's not so easy. The *.cfg in ipa-gui needs to be updated 
> but so does 
> /usr/lib/python2.5/site-packages/TurboGears-1.0.2.2-py2.5.egg-info/entry_points.txt

There's a ipa_gui.egg-info that seems to contain other files that are in
the global directory (but not the entry_points.txt file).  Is there any
possibility we can try adding that file to our local directory and see
if it works (assuming you haven't already)?  It seems horrible to have
to modify the global file :-/

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/c23868b8/attachment.bin>

From rcritten at redhat.com  Mon Sep 10 18:04:55 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 10 Sep 2007 14:04:55 -0400
Subject: [Freeipa-devel] TurboGears identity
In-Reply-To: <20070910173902.GD3594@moon.usersys.redhat.com>
References: <46E578D4.5070508@redhat.com>	<20070910170822.GC3594@moon.usersys.redhat.com>	<46E57EB0.5030606@redhat.com>
	<20070910173902.GD3594@moon.usersys.redhat.com>
Message-ID: <46E58747.6090300@redhat.com>

Kevin McCarthy wrote:
> Rob Crittenden wrote:
>> Kevin McCarthy wrote:
>>> Which configuration file?  If it's a config file in our repository (i.e,
>>> under 'ipa-gui/'), I would say it's fine.  Just make a note and we'll need
>>> to port it going forward.
>> Unfortunately it's not so easy. The *.cfg in ipa-gui needs to be updated 
>> but so does 
>> /usr/lib/python2.5/site-packages/TurboGears-1.0.2.2-py2.5.egg-info/entry_points.txt
> 
> There's a ipa_gui.egg-info that seems to contain other files that are in
> the global directory (but not the entry_points.txt file).  Is there any
> possibility we can try adding that file to our local directory and see
> if it works (assuming you haven't already)?  It seems horrible to have
> to modify the global file :-/
> 
> -Kevin

There seems to be a way to set where to look for providers but I haven't 
been able to work it out yet. I'll keep banging on it.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/c5bf84e5/attachment.bin>

From kmacmill at redhat.com  Mon Sep 10 19:47:55 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 10 Sep 2007 15:47:55 -0400
Subject: [Freeipa-devel] reason for re-install failure
In-Reply-To: <46E54972.40806@redhat.com>
References: <46E1AAD2.2020108@redhat.com>
	<1189195679.19300.49.camel@localhost.localdomain>
	<1189430188.3551.9.camel@localhost.localdomain>
	<46E54571.2070605@redhat.com>
	<1189431043.3551.26.camel@localhost.localdomain>
	<1189431209.19300.70.camel@localhost.localdomain>
	<46E54972.40806@redhat.com>
Message-ID: <1189453675.5977.25.camel@localhost.localdomain>

On Mon, 2007-09-10 at 09:41 -0400, Rob Crittenden wrote:
> Simo Sorce wrote:
> > On Mon, 2007-09-10 at 09:30 -0400, Karl MacMillan wrote:
> >> On Mon, 2007-09-10 at 09:24 -0400, Rob Crittenden wrote:
> >>> Karl MacMillan wrote:
> >>>> On Fri, 2007-09-07 at 16:07 -0400, Simo Sorce wrote:
> >>>>> On Fri, 2007-09-07 at 15:47 -0400, Rob Crittenden wrote:
> >>>>>> I ran into the "fail on re-install" problem where the install fails on a 
> >>>>>> kadmin timeout.
> >>>>>>
> >>>>>> The problem is that the installation appends the new password to 
> >>>>>> /var/kerberos/krb5kdc/ldappwd. This can lead to duplicate entries and it 
> >>>>>> apparently makes things flip out. I just removed that file and the 
> >>>>>> re-install went fine.
> >>>>> Ok this maybe seen as a bug, should we backup and move the original file
> >>>>> on installation ?
> >>>>>
> >>>>> Simo.
> >>>> Nah - I think we should just have a set of re-install diections that
> >>>> tell how to remove FDS instances and fix this problem.
> >>>>
> >>>> Karl
> >>>>
> >>> It's really a kerberos bug. I think we should simply replace any 
> >>> existing entries. We have a very specific DN in there. Replacing it is 
> >>> likely the right thing to do.
> >>>
> >> I'm fine with that - I was only trying to avoid really solving the
> >> reinstall problem. I think it is just too hard to get right and will eat
> >> up a lot of time.
> >>
> >> So, you are suggesting intelligently editing that file if it exists
> >> rather than replacing?
> > 
> > No, just replacing it, and, perhaps backup-ing the original one.
> > ldappwd contains just one line.
> > 
> > Simo.
> > 
> 
> Yup, in theory this is right. I think this file falls under the "we own 
> it, we'll do what we want" category.
> 

The attached patch should fix this, correct?

Karl
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeiap-ldappwd-fix.patch
Type: text/x-patch
Size: 572 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/2b6c3d87/attachment.bin>

From rcritten at redhat.com  Mon Sep 10 20:11:03 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 10 Sep 2007 16:11:03 -0400
Subject: [Freeipa-devel] reason for re-install failure
In-Reply-To: <1189453675.5977.25.camel@localhost.localdomain>
References: <46E1AAD2.2020108@redhat.com>	
	<1189195679.19300.49.camel@localhost.localdomain>	
	<1189430188.3551.9.camel@localhost.localdomain>	
	<46E54571.2070605@redhat.com>	
	<1189431043.3551.26.camel@localhost.localdomain>	
	<1189431209.19300.70.camel@localhost.localdomain>	
	<46E54972.40806@redhat.com>
	<1189453675.5977.25.camel@localhost.localdomain>
Message-ID: <46E5A4D7.2050302@redhat.com>

Karl MacMillan wrote:
> On Mon, 2007-09-10 at 09:41 -0400, Rob Crittenden wrote:
>> Simo Sorce wrote:
>>> On Mon, 2007-09-10 at 09:30 -0400, Karl MacMillan wrote:
>>>> On Mon, 2007-09-10 at 09:24 -0400, Rob Crittenden wrote:
>>>>> Karl MacMillan wrote:
>>>>>> On Fri, 2007-09-07 at 16:07 -0400, Simo Sorce wrote:
>>>>>>> On Fri, 2007-09-07 at 15:47 -0400, Rob Crittenden wrote:
>>>>>>>> I ran into the "fail on re-install" problem where the install fails on a 
>>>>>>>> kadmin timeout.
>>>>>>>>
>>>>>>>> The problem is that the installation appends the new password to 
>>>>>>>> /var/kerberos/krb5kdc/ldappwd. This can lead to duplicate entries and it 
>>>>>>>> apparently makes things flip out. I just removed that file and the 
>>>>>>>> re-install went fine.
>>>>>>> Ok this maybe seen as a bug, should we backup and move the original file
>>>>>>> on installation ?
>>>>>>>
>>>>>>> Simo.
>>>>>> Nah - I think we should just have a set of re-install diections that
>>>>>> tell how to remove FDS instances and fix this problem.
>>>>>>
>>>>>> Karl
>>>>>>
>>>>> It's really a kerberos bug. I think we should simply replace any 
>>>>> existing entries. We have a very specific DN in there. Replacing it is 
>>>>> likely the right thing to do.
>>>>>
>>>> I'm fine with that - I was only trying to avoid really solving the
>>>> reinstall problem. I think it is just too hard to get right and will eat
>>>> up a lot of time.
>>>>
>>>> So, you are suggesting intelligently editing that file if it exists
>>>> rather than replacing?
>>> No, just replacing it, and, perhaps backup-ing the original one.
>>> ldappwd contains just one line.
>>>
>>> Simo.
>>>
>> Yup, in theory this is right. I think this file falls under the "we own 
>> it, we'll do what we want" category.
>>
> 
> The attached patch should fix this, correct?
> 
> Karl
> 

Yup, +1.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/34faa81f/attachment.bin>

From rcritten at redhat.com  Mon Sep 10 20:49:15 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 10 Sep 2007 16:49:15 -0400
Subject: [Freeipa-devel] [PATCH] Use Apache mod_proxy for auth
Message-ID: <46E5ADCB.1040903@redhat.com>

* Enable mod_proxy to sit in front of TurboGears and pass along the 
kerberos principal name
* Add an identity an visit class to TurboGears that can handle the use 
without requiring a database
* Update the UI to show the user correctly.
* Note that this is currently disabled. It is hardcoded to always return 
the principal test at FREEIPA.ORG in proxyprovider.py. So this won't change 
the way Kevin develops or demos.
* It doesn't handle an unauthorized request because that can never happen.

I'm not 100% sure I got all the @identity() stuff set right in 
controllers.py but it is a start.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-172-proxy.diff
Type: text/x-patch
Size: 16444 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/c83d74e9/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/c83d74e9/attachment-0001.bin>

From kmccarth at redhat.com  Mon Sep 10 21:35:20 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Mon, 10 Sep 2007 14:35:20 -0700
Subject: [Freeipa-devel] [PATCH] Use Apache mod_proxy for auth
In-Reply-To: <46E5ADCB.1040903@redhat.com>
References: <46E5ADCB.1040903@redhat.com>
Message-ID: <20070910213520.GG3594@moon.usersys.redhat.com>

Rob Crittenden wrote:
> * Enable mod_proxy to sit in front of TurboGears and pass along the 
> kerberos principal name
> * Add an identity an visit class to TurboGears that can handle the use 
> without requiring a database
> * Update the UI to show the user correctly.
> * Note that this is currently disabled. It is hardcoded to always return 
> the principal test at FREEIPA.ORG in proxyprovider.py. So this won't change 
> the way Kevin develops or demos.
> * It doesn't handle an unauthorized request because that can never happen.
>
> I'm not 100% sure I got all the @identity() stuff set right in 
> controllers.py but it is a start.

I'm not familiar with the identity stuff, but it looks good.  Let's get
it in and play with it.

Glad you were able to get this working without having to hack the global
file!

-Kevin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/a0bd69ef/attachment.bin>

From kmccarth at redhat.com  Tue Sep 11 00:17:46 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Mon, 10 Sep 2007 17:17:46 -0700
Subject: [Freeipa-devel] Strange ldap aci bug when adding groups
Message-ID: <20070911001745.GH3594@moon.usersys.redhat.com>

I ran into an issue where the web gui can't add groups.  Pete and I have
poked around for an hour and it seems to be a bug in the directory
server.  I'm able to add a group via command line when I bind as
uid=test, but when I bind as webservice and enable proxying via command
line, I get permission denied.  Strangely, bind as webservice and proxy
_works_ for adding users on the command line.

I'm going to try and simplify the setup and get a bug report to the FDS
team tomorrow.  Just wanted to check if anyone else has hit this issue
yet.

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/2291edf9/attachment.bin>

From rcritten at redhat.com  Tue Sep 11 01:27:11 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 10 Sep 2007 21:27:11 -0400
Subject: [Freeipa-devel] Strange ldap aci bug when adding groups
In-Reply-To: <20070911001745.GH3594@moon.usersys.redhat.com>
References: <20070911001745.GH3594@moon.usersys.redhat.com>
Message-ID: <46E5EEEF.4040702@redhat.com>

Kevin McCarthy wrote:
> I ran into an issue where the web gui can't add groups.  Pete and I have
> poked around for an hour and it seems to be a bug in the directory
> server.  I'm able to add a group via command line when I bind as
> uid=test, but when I bind as webservice and enable proxying via command
> line, I get permission denied.  Strangely, bind as webservice and proxy
> _works_ for adding users on the command line.
> 
> I'm going to try and simplify the setup and get a bug report to the FDS
> team tomorrow.  Just wanted to check if anyone else has hit this issue
> yet.
> 
> -Kevin
>

This is the same thing I reported last week. Set debug to 128 and you'll 
see an ACI deny.

To set the debug level do something like:

% ldapmodify -x -D "cn=directory manager" -w freeipa
dn: cn=config
changetype: modify
replace: nsslapd-errorlog-level
nsslapd-errorlog-level: 128

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/647cfa19/attachment.bin>

From rcritten at redhat.com  Tue Sep 11 01:38:51 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 10 Sep 2007 21:38:51 -0400
Subject: [Freeipa-devel] Strange ldap aci bug when adding groups
In-Reply-To: <46E5EEEF.4040702@redhat.com>
References: <20070911001745.GH3594@moon.usersys.redhat.com>
	<46E5EEEF.4040702@redhat.com>
Message-ID: <46E5F1AB.9040505@redhat.com>

Rob Crittenden wrote:
> Kevin McCarthy wrote:
>> I ran into an issue where the web gui can't add groups.  Pete and I have
>> poked around for an hour and it seems to be a bug in the directory
>> server.  I'm able to add a group via command line when I bind as
>> uid=test, but when I bind as webservice and enable proxying via command
>> line, I get permission denied.  Strangely, bind as webservice and proxy
>> _works_ for adding users on the command line.
>>
>> I'm going to try and simplify the setup and get a bug report to the FDS
>> team tomorrow.  Just wanted to check if anyone else has hit this issue
>> yet.
>>
>> -Kevin
>>
> 
> This is the same thing I reported last week. Set debug to 128 and you'll 
> see an ACI deny.
> 
> To set the debug level do something like:
> 
> % ldapmodify -x -D "cn=directory manager" -w freeipa
> dn: cn=config
> changetype: modify
> replace: nsslapd-errorlog-level
> nsslapd-errorlog-level: 128

I added another ACI and that fixed it. I'm not sure it is the *right* 
ACI :-)

aci: 
(targetfilter="(&(objectClass=groupOfUniqueNames)(objectClass=posixGroup))")(targetattr="*")(version 
3.0; acl "allowproxy-webservice"; allow (proxy) 
userdn="ldap:///uid=webservice,cn=sysaccounts,cn=etc,dc=greyoak,dc=com";)

Once proxied add,delete,read,write access is already provided via the an 
existing ACI. The problem is that proxy isn't allowed. The access ACI is:

aci: targetfilter="(|(objectClass=person)(objectClass=krbPrincipalAux)
(objectClass=posixAccount)(objectClass=groupOfUniqueNames)(objectClass=posixGroup))")
(targetattr="*")(version 3.0; acl "Account Admins can manage Users and 
Groups";
allow (search,add,delete,read,write) 
groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=greyoak,dc=com";)

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070910/b5a904b5/attachment.bin>

From ssorce at redhat.com  Tue Sep 11 03:26:32 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Mon, 10 Sep 2007 23:26:32 -0400
Subject: [Freeipa-devel] Strange ldap aci bug when adding groups
In-Reply-To: <46E5F1AB.9040505@redhat.com>
References: <20070911001745.GH3594@moon.usersys.redhat.com>
	<46E5EEEF.4040702@redhat.com>  <46E5F1AB.9040505@redhat.com>
Message-ID: <1189481192.17727.6.camel@localhost.localdomain>

On Mon, 2007-09-10 at 21:38 -0400, Rob Crittenden wrote:
> Rob Crittenden wrote:
> > Kevin McCarthy wrote:
> >> I ran into an issue where the web gui can't add groups.  Pete and I have
> >> poked around for an hour and it seems to be a bug in the directory
> >> server.  I'm able to add a group via command line when I bind as
> >> uid=test, but when I bind as webservice and enable proxying via command
> >> line, I get permission denied.  Strangely, bind as webservice and proxy
> >> _works_ for adding users on the command line.
> >>
> >> I'm going to try and simplify the setup and get a bug report to the FDS
> >> team tomorrow.  Just wanted to check if anyone else has hit this issue
> >> yet.
> >>
> >> -Kevin
> >>
> > 
> > This is the same thing I reported last week. Set debug to 128 and you'll 
> > see an ACI deny.
> > 
> > To set the debug level do something like:
> > 
> > % ldapmodify -x -D "cn=directory manager" -w freeipa
> > dn: cn=config
> > changetype: modify
> > replace: nsslapd-errorlog-level
> > nsslapd-errorlog-level: 128
> 
> I added another ACI and that fixed it. I'm not sure it is the *right* 
> ACI :-)
> 
> aci: 
> (targetfilter="(&(objectClass=groupOfUniqueNames)(objectClass=posixGroup))")(targetattr="*")(version 
> 3.0; acl "allowproxy-webservice"; allow (proxy) 
> userdn="ldap:///uid=webservice,cn=sysaccounts,cn=etc,dc=greyoak,dc=com";)
> 
> Once proxied add,delete,read,write access is already provided via the an 
> existing ACI. The problem is that proxy isn't allowed. The access ACI is:
> 
> aci: targetfilter="(|(objectClass=person)(objectClass=krbPrincipalAux)
> (objectClass=posixAccount)(objectClass=groupOfUniqueNames)(objectClass=posixGroup))")
> (targetattr="*")(version 3.0; acl "Account Admins can manage Users and 
> Groups";
> allow (search,add,delete,read,write) 
> groupdn="ldap:///cn=admins,cn=groups,cn=accounts,dc=greyoak,dc=com";)

Ok this means that the filter in the proxy ACI means that those are the
entries you are allowed to touch when proxied. This is unexpected I
thought the target was what you were allowed to proxy as.
I will do some test tomorrow and will change the ACI of proxy
accordingly.

Simo.



From kmacmill at redhat.com  Tue Sep 11 18:21:32 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 11 Sep 2007 14:21:32 -0400
Subject: [Freeipa-devel] Access control
Message-ID: <1189534893.10411.8.camel@localhost.localdomain>

I started a page on access control for v1 at
http://freeipa.org/page/AccessControl. Not a whole lot there right now -
just some use cases and initial thoughts.

I have some questions:

How do we control which users / groups a user can modify or read? The
FDS ACI allow all sorts of control over which entry a user can access
(by DN, ldap search, etc.). I'd like to present enough power while
keeping things simple.

How can we determine what access a user has without trying an action?
This is needed for presenting editing forms that don't allow you to make
modifications of entries you're not allowed to edit.

Should we show blank fields if the user can't read an attribute or just
omit the field altogether?

Karl



From kmacmill at redhat.com  Tue Sep 11 18:25:50 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 11 Sep 2007 14:25:50 -0400
Subject: [Freeipa-devel] reason for re-install failure
In-Reply-To: <46E5A4D7.2050302@redhat.com>
References: <46E1AAD2.2020108@redhat.com>
	<1189195679.19300.49.camel@localhost.localdomain>
	<1189430188.3551.9.camel@localhost.localdomain>
	<46E54571.2070605@redhat.com>
	<1189431043.3551.26.camel@localhost.localdomain>
	<1189431209.19300.70.camel@localhost.localdomain>
	<46E54972.40806@redhat.com>
	<1189453675.5977.25.camel@localhost.localdomain>
	<46E5A4D7.2050302@redhat.com>
Message-ID: <1189535151.10411.12.camel@localhost.localdomain>

On Mon, 2007-09-10 at 16:11 -0400, Rob Crittenden wrote:
> Karl MacMillan wrote:
> > On Mon, 2007-09-10 at 09:41 -0400, Rob Crittenden wrote:
> >> Simo Sorce wrote:
> >>> On Mon, 2007-09-10 at 09:30 -0400, Karl MacMillan wrote:
> >>>> On Mon, 2007-09-10 at 09:24 -0400, Rob Crittenden wrote:
> >>>>> Karl MacMillan wrote:
> >>>>>> On Fri, 2007-09-07 at 16:07 -0400, Simo Sorce wrote:
> >>>>>>> On Fri, 2007-09-07 at 15:47 -0400, Rob Crittenden wrote:
> >>>>>>>> I ran into the "fail on re-install" problem where the install fails on a 
> >>>>>>>> kadmin timeout.
> >>>>>>>>
> >>>>>>>> The problem is that the installation appends the new password to 
> >>>>>>>> /var/kerberos/krb5kdc/ldappwd. This can lead to duplicate entries and it 
> >>>>>>>> apparently makes things flip out. I just removed that file and the 
> >>>>>>>> re-install went fine.
> >>>>>>> Ok this maybe seen as a bug, should we backup and move the original file
> >>>>>>> on installation ?
> >>>>>>>
> >>>>>>> Simo.
> >>>>>> Nah - I think we should just have a set of re-install diections that
> >>>>>> tell how to remove FDS instances and fix this problem.
> >>>>>>
> >>>>>> Karl
> >>>>>>
> >>>>> It's really a kerberos bug. I think we should simply replace any 
> >>>>> existing entries. We have a very specific DN in there. Replacing it is 
> >>>>> likely the right thing to do.
> >>>>>
> >>>> I'm fine with that - I was only trying to avoid really solving the
> >>>> reinstall problem. I think it is just too hard to get right and will eat
> >>>> up a lot of time.
> >>>>
> >>>> So, you are suggesting intelligently editing that file if it exists
> >>>> rather than replacing?
> >>> No, just replacing it, and, perhaps backup-ing the original one.
> >>> ldappwd contains just one line.
> >>>
> >>> Simo.
> >>>
> >> Yup, in theory this is right. I think this file falls under the "we own 
> >> it, we'll do what we want" category.
> >>
> > 
> > The attached patch should fix this, correct?
> > 
> > Karl
> > 
> 
> Yup, +1.
> 

Pushed - Karl
> rob



From kmacmill at redhat.com  Tue Sep 11 18:27:09 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 11 Sep 2007 14:27:09 -0400
Subject: [Freeipa-devel] [PATCH] Use Apache mod_proxy for auth
In-Reply-To: <46E5ADCB.1040903@redhat.com>
References: <46E5ADCB.1040903@redhat.com>
Message-ID: <1189535229.10411.14.camel@localhost.localdomain>

On Mon, 2007-09-10 at 16:49 -0400, Rob Crittenden wrote:
> * Enable mod_proxy to sit in front of TurboGears and pass along the 
> kerberos principal name
> * Add an identity an visit class to TurboGears that can handle the use 
> without requiring a database
> * Update the UI to show the user correctly.
> * Note that this is currently disabled. It is hardcoded to always return 
> the principal test at FREEIPA.ORG in proxyprovider.py. So this won't change 
> the way Kevin develops or demos.
> * It doesn't handle an unauthorized request because that can never happen.
> 
> I'm not 100% sure I got all the @identity() stuff set right in 
> controllers.py but it is a start.
> 

Pushed.

Karl



From kmacmill at redhat.com  Tue Sep 11 18:27:23 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 11 Sep 2007 14:27:23 -0400
Subject: [Freeipa-devel] [PATCH] edit protected fields
In-Reply-To: <20070910170410.GB3594@moon.usersys.redhat.com>
References: <20070910170410.GB3594@moon.usersys.redhat.com>
Message-ID: <1189535243.10411.16.camel@localhost.localdomain>

On Mon, 2007-09-10 at 10:04 -0700, Kevin McCarthy wrote:
> This patch adds a checkbox to the edit person page, to toggle editing
> "protected" fields - currently uidnumber, gidnumber, and password.
> 
> -Kevin
> 

Pushed - Karl



From rmeggins at redhat.com  Tue Sep 11 18:44:26 2007
From: rmeggins at redhat.com (Richard Megginson)
Date: Tue, 11 Sep 2007 12:44:26 -0600
Subject: [Freeipa-devel] Access control
In-Reply-To: <1189534893.10411.8.camel@localhost.localdomain>
References: <1189534893.10411.8.camel@localhost.localdomain>
Message-ID: <46E6E20A.7070400@redhat.com>

Karl MacMillan wrote:
> I started a page on access control for v1 at
> http://freeipa.org/page/AccessControl. Not a whole lot there right now -
> just some use cases and initial thoughts.
>
> I have some questions:
>
> How do we control which users / groups a user can modify or read? The
> FDS ACI allow all sorts of control over which entry a user can access
> (by DN, ldap search, etc.). I'd like to present enough power while
> keeping things simple.
>   
Fedora DS implements support for the Get Effective Rights control.  But 
I don't know if it does everything you want to do from a GUI 
standpoint.  You also want to know what attributes are marked 
NO-USER-MODIFICATION, which ones are virtual and cannot be edited 
directly, etc.  See 
https://www.redhat.com/archives/fedora-directory-devel/2006-November/msg00000.html
> How can we determine what access a user has without trying an action?
> This is needed for presenting editing forms that don't allow you to make
> modifications of entries you're not allowed to edit.
>
> Should we show blank fields if the user can't read an attribute or just
> omit the field altogether?
>
> Karl
>
> _______________________________________________
> Freeipa-devel mailing list
> Freeipa-devel at redhat.com
> https://www.redhat.com/mailman/listinfo/freeipa-devel
>   

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070911/ea1d0c7e/attachment.bin>

From rcritten at redhat.com  Tue Sep 11 19:07:04 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Tue, 11 Sep 2007 15:07:04 -0400
Subject: [Freeipa-devel] [PATCH] Initial password setting support
Message-ID: <46E6E758.6030006@redhat.com>

Added the API needed to set the user password.

Apparently the old password is NOT checked when setting a new one. I'm 
not sure if the plugin should do this or we should, or whether we just 
let it be as-is.

I also removed some strange calls to set the realm.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-175-password.diff
Type: text/x-patch
Size: 7004 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070911/88cb1e7f/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070911/88cb1e7f/attachment-0001.bin>

From prowley at redhat.com  Tue Sep 11 19:50:00 2007
From: prowley at redhat.com (Pete Rowley)
Date: Tue, 11 Sep 2007 12:50:00 -0700
Subject: [Freeipa-devel] Access control
In-Reply-To: <1189534893.10411.8.camel@localhost.localdomain>
References: <1189534893.10411.8.camel@localhost.localdomain>
Message-ID: <46E6F168.7090704@redhat.com>

Karl MacMillan wrote:
>
> I have some questions:
>
> How do we control which users / groups a user can modify or read? The
> FDS ACI allow all sorts of control over which entry a user can access
> (by DN, ldap search, etc.). I'd like to present enough power while
> keeping things simple.
The model is the members of group X can do Y to the members of group Z. 
That is the simplification and the reason for the memberof plugin (there 
was no way to express "to the members of group Z" prior to that).

> How can we determine what access a user has without trying an action?
> This is needed for presenting editing forms that don't allow you to make
> modifications of entries you're not allowed to edit.
>
>   
I have a bug open for Get Effective Rights control to address 
deficiencies in that control when trying to find out what the user is 
allowed to do (can't get to bugzilla right now).



-- 
Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070911/f2cc9cb4/attachment.bin>

From kmacmill at redhat.com  Tue Sep 11 20:08:21 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 11 Sep 2007 16:08:21 -0400
Subject: [Freeipa-devel] Access control
In-Reply-To: <46E6F168.7090704@redhat.com>
References: <1189534893.10411.8.camel@localhost.localdomain>
	<46E6F168.7090704@redhat.com>
Message-ID: <1189541301.4823.5.camel@localhost.localdomain>

On Tue, 2007-09-11 at 12:50 -0700, Pete Rowley wrote:
> Karl MacMillan wrote:
> >
> > I have some questions:
> >
> > How do we control which users / groups a user can modify or read? The
> > FDS ACI allow all sorts of control over which entry a user can access
> > (by DN, ldap search, etc.). I'd like to present enough power while
> > keeping things simple.
> The model is the members of group X can do Y to the members of group Z. 
> That is the simplification and the reason for the memberof plugin (there 
> was no way to express "to the members of group Z" prior to that).
> 

I don't think that is sufficient as it prevents things like letting
manager Dave change attribute foo of all of his employees.

> > How can we determine what access a user has without trying an action?
> > This is needed for presenting editing forms that don't allow you to make
> > modifications of entries you're not allowed to edit.
> >
> >   
> I have a bug open for Get Effective Rights control to address 
> deficiencies in that control when trying to find out what the user is 
> allowed to do (can't get to bugzilla right now).
> 

What are the args to get effective rights and what does it return? The
docs at
http://directory.fedoraproject.org/wiki/Get_Effective_Rights_Design are
a little hard core for an LDAP newb like me.

Karl



From rmeggins at redhat.com  Tue Sep 11 20:13:18 2007
From: rmeggins at redhat.com (Richard Megginson)
Date: Tue, 11 Sep 2007 14:13:18 -0600
Subject: [Freeipa-devel] Access control
In-Reply-To: <1189541301.4823.5.camel@localhost.localdomain>
References: <1189534893.10411.8.camel@localhost.localdomain>	<46E6F168.7090704@redhat.com>
	<1189541301.4823.5.camel@localhost.localdomain>
Message-ID: <46E6F6DE.7030002@redhat.com>

Karl MacMillan wrote:
> On Tue, 2007-09-11 at 12:50 -0700, Pete Rowley wrote:
>   
>> Karl MacMillan wrote:
>>     
>>> I have some questions:
>>>
>>> How do we control which users / groups a user can modify or read? The
>>> FDS ACI allow all sorts of control over which entry a user can access
>>> (by DN, ldap search, etc.). I'd like to present enough power while
>>> keeping things simple.
>>>       
>> The model is the members of group X can do Y to the members of group Z. 
>> That is the simplification and the reason for the memberof plugin (there 
>> was no way to express "to the members of group Z" prior to that).
>>
>>     
>
> I don't think that is sufficient as it prevents things like letting
> manager Dave change attribute foo of all of his employees.
>
>   
>>> How can we determine what access a user has without trying an action?
>>> This is needed for presenting editing forms that don't allow you to make
>>> modifications of entries you're not allowed to edit.
>>>
>>>   
>>>       
>> I have a bug open for Get Effective Rights control to address 
>> deficiencies in that control when trying to find out what the user is 
>> allowed to do (can't get to bugzilla right now).
>>
>>     
>
> What are the args to get effective rights and what does it return? The
> docs at
> http://directory.fedoraproject.org/wiki/Get_Effective_Rights_Design are
> a little hard core for an LDAP newb like me.
>   
I don't think there is a whole lot of user oriented material for this 
feature.
http://www.redhat.com/docs/manuals/dir-server/release-notes/ger.html
> Karl
>
> _______________________________________________
> Freeipa-devel mailing list
> Freeipa-devel at redhat.com
> https://www.redhat.com/mailman/listinfo/freeipa-devel
>   

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070911/3e347908/attachment.bin>

From ssorce at redhat.com  Tue Sep 11 20:15:53 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Tue, 11 Sep 2007 16:15:53 -0400
Subject: [Freeipa-devel] Access control
In-Reply-To: <1189541301.4823.5.camel@localhost.localdomain>
References: <1189534893.10411.8.camel@localhost.localdomain>
	<46E6F168.7090704@redhat.com>
	<1189541301.4823.5.camel@localhost.localdomain>
Message-ID: <1189541753.4281.5.camel@localhost.localdomain>

On Tue, 2007-09-11 at 16:08 -0400, Karl MacMillan wrote:
> On Tue, 2007-09-11 at 12:50 -0700, Pete Rowley wrote:

> > The model is the members of group X can do Y to the members of group Z. 
> > That is the simplification and the reason for the memberof plugin (there 
> > was no way to express "to the members of group Z" prior to that).

> I don't think that is sufficient as it prevents things like letting
> manager Dave change attribute foo of all of his employees.

No, it just means all of his employees will be in the group
"employees-of-Dave".

Simo.




From ssorce at redhat.com  Tue Sep 11 20:20:41 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Tue, 11 Sep 2007 16:20:41 -0400
Subject: [Freeipa-devel] [PATCH] Initial password setting support
In-Reply-To: <46E6E758.6030006@redhat.com>
References: <46E6E758.6030006@redhat.com>
Message-ID: <1189542041.4281.10.camel@localhost.localdomain>

On Tue, 2007-09-11 at 15:07 -0400, Rob Crittenden wrote:
> 
> Apparently the old password is NOT checked when setting a new one.
> I'm 
> not sure if the plugin should do this or we should, or whether we
> just 
> let it be as-is. 

The old password is not checked in ldap because, in order to change the
password, you have to connect to the ldap server, and that means you
must have already authenticated yourself to the ldap server and you have
to know your password to do that.

The other reason is that the same interface can be used by privileged
users to change other users passwords, in that case they can't know the
other user existing password.

I can change the code of the plugin to test (or even require) for the
old password for self-changes. Is this necessary?

Simo.




From prowley at redhat.com  Tue Sep 11 21:02:14 2007
From: prowley at redhat.com (Pete Rowley)
Date: Tue, 11 Sep 2007 14:02:14 -0700
Subject: [Freeipa-devel] [PATCH] Initial password setting support
In-Reply-To: <1189542041.4281.10.camel@localhost.localdomain>
References: <46E6E758.6030006@redhat.com>
	<1189542041.4281.10.camel@localhost.localdomain>
Message-ID: <46E70256.9050807@redhat.com>

Simo Sorce wrote:
> I can change the code of the plugin to test (or even require) for the
> old password for self-changes. Is this necessary?
>   
This might be prudent eventually, but I wouldn't put off something that 
is core to this version to do it. Getting into policy here and we would 
probably be best leaving that for later versions.

-- 
Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070911/b1c5453a/attachment.bin>

From kmccarth at redhat.com  Tue Sep 11 21:41:02 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Tue, 11 Sep 2007 14:41:02 -0700
Subject: [Freeipa-devel] [PATCH] small proxyprovider fixes
Message-ID: <20070911214102.GB32755@moon.usersys.redhat.com>

Looks like the sqlobject code had some bugs that we inherited.  This
fixes a few errors.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189547153 25200
# Node ID 02e4e2799015d084815205144d948f2a8ec16bd3
# Parent  86d3d2751aa846ccec19048026b029fba53380d4
Small fixes to proxyprovider.

diff -r 86d3d2751aa8 -r 02e4e2799015 ipa-server/ipa-gui/ipagui/proxyprovider.py
--- a/ipa-server/ipa-gui/ipagui/proxyprovider.py	Tue Sep 11 13:28:34 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/proxyprovider.py	Tue Sep 11 14:45:53 2007 -0700
@@ -31,19 +31,19 @@ class ProxyIdentity(object):
     user= property(_get_user)
 
     def _get_user_name(self):
-        if not self.user:
+        if not self._user:
             return None
-        return self.user.user_name
+        return self._user.user_name
     user_name= property(_get_user_name)
 
-    def _get_name(self):
-        if not self.user:
+    def _get_display_name(self):
+        if not self._user:
             return None
-        return self.user.name
-    user_name= property(_get_name)
+        return self._user.display_name
+    display_name= property(_get_display_name)
 
     def _get_anonymous(self):
-        return not self.user
+        return not self._user
     anonymous= property(_get_anonymous)
 
     def _get_permissions(self):
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070911/f04e9274/attachment.bin>

From kmccarth at redhat.com  Tue Sep 11 21:59:23 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Tue, 11 Sep 2007 14:59:23 -0700
Subject: [Freeipa-devel] [PATCH] add group
Message-ID: <20070911215923.GC32755@moon.usersys.redhat.com>

Very basic add group screen.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189547511 25200
# Node ID 9acbc033daa53673d5e92c7204dc1a6c28824a76
# Parent  02e4e2799015d084815205144d948f2a8ec16bd3
Add group screen. More to come...

diff -r 02e4e2799015 -r 9acbc033daa5 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 11 14:45:53 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 11 14:51:51 2007 -0700
@@ -18,12 +18,15 @@ import ipa.user
 import ipa.user
 import xmlrpclib
 import forms.user
+import forms.group
 from helpers import userhelper
 from ipa import ipaerror
 
 ipa.config.init_config()
 user_new_form = forms.user.UserNewForm()
 user_edit_form = forms.user.UserEditForm()
+group_new_form = forms.group.GroupNewForm()
+group_edit_form = forms.group.GroupEditForm()
 
 password_chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
 
@@ -283,10 +286,12 @@ class Root(controllers.RootController):
         return ""
 
     @expose()
+    @identity.require(identity.not_anonymous())
     def suggest_email(self, givenname, sn):
         if (len(givenname) == 0) or (len(sn) == 0):
             return ""
 
+        client.set_principal(identity.current.user_name)
         givenname = givenname.lower()
         sn = sn.lower()
 
@@ -331,13 +336,55 @@ class Root(controllers.RootController):
         client.set_principal(identity.current.user_name)
         return dict()
 
-
-    ############
-    # Resource #
-    ############
-
-    @expose("ipagui.templates.resindex")
-    @identity.require(identity.not_anonymous())
-    def resindex(self, tg_errors=None):
-        client.set_principal(identity.current.user_name)
-        return dict()
+    @expose("ipagui.templates.groupnew")
+    @identity.require(identity.not_anonymous())
+    def groupnew(self, tg_errors=None):
+        """Displays the new group form"""
+        if tg_errors:
+            turbogears.flash("There was a problem with the form!")
+
+        client.set_principal(identity.current.user_name)
+
+        return dict(form=group_new_form)
+
+    @expose()
+    @identity.require(identity.not_anonymous())
+    def groupcreate(self, **kw):
+        """Creates a new group"""
+        restrict_post()
+        client.set_principal(identity.current.user_name)
+
+        if kw.get('submit') == 'Cancel':
+            turbogears.flash("Add group cancelled")
+            raise turbogears.redirect('/')
+
+        tg_errors, kw = self.groupcreatevalidate(**kw)
+        if tg_errors:
+            return dict(form=group_new_form, tg_template='ipagui.templates.groupnew')
+
+        try:
+            new_group = ipa.group.Group()
+            new_group.setValue('cn', kw.get('cn'))
+            new_group.setValue('description', kw.get('description'))
+
+            rv = client.add_group(new_group)
+            turbogears.flash("%s added!" % kw.get('cn'))
+            # raise turbogears.redirect('/groupedit', cn=kw['cn'])
+            raise turbogears.redirect('/')
+        except ipaerror.exception_for(ipaerror.LDAP_DUPLICATE):
+            turbogears.flash("Group with name '%s' already exists" %
+                    kw.get('cn'))
+            return dict(form=group_new_form, tg_template='ipagui.templates.groupnew')
+        except ipaerror.IPAError, e:
+            turbogears.flash("Group add failed: " + str(e) + "<br/>" + str(e.detail))
+            return dict(form=group_new_form, tg_template='ipagui.templates.groupnew')
+
+    @validate(form=group_new_form)
+    @identity.require(identity.not_anonymous())
+    def groupcreatevalidate(self, tg_errors=None, **kw):
+        return tg_errors, kw
+
+    @validate(form=group_edit_form)
+    @identity.require(identity.not_anonymous())
+    def groupupdatevalidate(self, tg_errors=None, **kw):
+        return tg_errors, kw
diff -r 02e4e2799015 -r 9acbc033daa5 ipa-server/ipa-gui/ipagui/forms/group.py
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/forms/group.py	Tue Sep 11 14:51:51 2007 -0700
@@ -0,0 +1,48 @@
+import turbogears
+from turbogears import validators, widgets
+
+class GroupFields():
+    cn = widgets.TextField(name="cn", label="Name")
+    gidnumber = widgets.TextField(name="gidnumber", label="GID")
+    description = widgets.TextField(name="description", label="Description")
+
+    cn_hidden = widgets.HiddenField(name="cn")
+
+    group_orig = widgets.HiddenField(name="group_orig")
+
+class GroupNewValidator(validators.Schema):
+    cn = validators.PlainText(not_empty=True)
+    description = validators.String(not_empty=False)
+
+
+class GroupNewForm(widgets.Form):
+    params = ['group']
+
+    fields = [GroupFields.cn, GroupFields.description]
+
+    validator = GroupNewValidator()
+
+    def __init__(self, *args, **kw):
+        super(GroupNewForm,self).__init__(*args, **kw)
+        (self.template_c, self.template) = widgets.meta.load_kid_template("ipagui.templates.groupnewform")
+        self.group = GroupFields
+
+    def update_params(self, params):
+        super(GroupNewForm,self).update_params(params)
+
+
+class GroupEditValidator(validators.Schema):
+    gidnumber = widgets.TextField(name="gidnumber", label="GID")
+    description = widgets.TextField(name="description", label="Description")
+
+class GroupEditForm(widgets.Form):
+    params = ['group']
+
+    fields = [GroupFields.gidnumber, GroupFields.description]
+
+    validator = GroupEditValidator()
+
+    def __init__(self, *args, **kw):
+        super(GroupEditForm,self).__init__(*args, **kw)
+        (self.template_c, self.template) = widgets.meta.load_kid_template("ipagui.templates.groupeditform")
+        self.group = GroupFields
diff -r 02e4e2799015 -r 9acbc033daa5 ipa-server/ipa-gui/ipagui/forms/user.py
--- a/ipa-server/ipa-gui/ipagui/forms/user.py	Tue Sep 11 14:45:53 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/user.py	Tue Sep 11 14:51:51 2007 -0700
@@ -65,6 +65,8 @@ class UserEditValidator(validators.Schem
     givenname = validators.String(not_empty=True)
     sn = validators.String(not_empty=True)
     mail = validators.Email(not_empty=True)
+    uidnumber = validators.Int(not_empty=False)
+    gidnumber = validators.Int(not_empty=False)
     #  validators.PhoneNumber may be a bit too picky, requiring an area code
     # telephonenumber = validators.PlainText(not_empty=False)
 
diff -r 02e4e2799015 -r 9acbc033daa5 ipa-server/ipa-gui/ipagui/templates/groupnew.kid
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/templates/groupnew.kid	Tue Sep 11 14:51:51 2007 -0700
@@ -0,0 +1,13 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:py="http://purl.org/kid/ns#"
+    py:extends="'userlayout.kid'">
+<head>
+    <meta content="text/html; charset=utf-8" http-equiv="Content-Type" py:replace="''"/>
+    <title>Add Group</title>
+</head>
+<body>
+    <h2>Add Group</h2>
+
+    ${form.display(action="groupcreate")}
+</body>
+</html>
diff -r 02e4e2799015 -r 9acbc033daa5 ipa-server/ipa-gui/ipagui/templates/groupnewform.kid
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/templates/groupnewform.kid	Tue Sep 11 14:51:51 2007 -0700
@@ -0,0 +1,55 @@
+<div xmlns:py="http://purl.org/kid/ns#"
+  class="simpleroster">
+  <form action="${action}" name="${name}" method="${method}" class="tableform">
+
+    <div class="formsection">Group Details</div>
+    <table class="formtable" cellpadding="2" cellspacing="0" border="0">
+      <tr>
+        <th>
+          <label class="fieldlabel" for="${group.cn.field_id}"
+            py:content="group.cn.label" />:
+        </th>
+        <td>
+          <span py:replace="group.cn.display(value_for(group.cn))" />
+          <span py:if="tg.errors.get('cn')" class="fielderror"
+              py:content="tg.errors.get('cn')" />
+
+        </td>
+      </tr>
+
+      <tr>
+        <th>
+          <label class="fieldlabel" for="${group.description.field_id}"
+            py:content="group.description.label" />:
+        </th>
+        <td>
+          <span py:replace="group.description.display(value_for(group.description))" />
+          <span py:if="tg.errors.get('description')" class="fielderror"
+              py:content="tg.errors.get('description')" />
+
+        </td>
+      </tr>
+
+      <tr>
+        <th>
+          <label class="fieldlabel" for="${group.gidnumber.field_id}"
+            py:content="group.gidnumber.label" />:
+        </th>
+        <td>
+          Generated by server
+        </td>
+      </tr>
+    </table>
+
+    <table class="formtable" cellpadding="2" cellspacing="0" border="0">
+      <tr>
+        <th></th>
+        <td>
+          <br />
+          <input type="submit" class="submitbutton" name="submit" value="Add Group"/>
+        </td>
+      </tr>
+    </table>
+
+  </form>
+</div>
diff -r 02e4e2799015 -r 9acbc033daa5 ipa-server/ipa-gui/ipagui/templates/master.kid
--- a/ipa-server/ipa-gui/ipagui/templates/master.kid	Tue Sep 11 14:45:53 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/master.kid	Tue Sep 11 14:51:51 2007 -0700
@@ -69,7 +69,7 @@
         <a href="${tg.url('/userlist')}">Find People</a><br/>
         </p>
         <p>
-        <a href="${tg.url('/groupindex')}">Add Group</a><br/>
+        <a href="${tg.url('/groupnew')}">Add Group</a><br/>
         <a href="${tg.url('/groupindex')}">Find Groups</a><br/>
         </p>
         <p>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070911/bf0a8c02/attachment.bin>

From mccann at jhu.edu  Wed Sep 12 15:27:30 2007
From: mccann at jhu.edu (William Jon McCann)
Date: Wed, 12 Sep 2007 11:27:30 -0400
Subject: [Freeipa-devel] [PATCH] don't echo passwords
Message-ID: <939dd5750709120827t5c904aaam3b19e619fb6ed2cc@mail.gmail.com>

Hi,

Just recently heard about FreeIPA and it sounds like exactly what we
need.  So, thanks!

A couple of things that I noticed about the server install script are:
 - passwords are echoed
 - some of the prompts don't have defaults (particularly the y/n ones)
 - perhaps we should ask for the passwords to be confirmed to help avoid typos?

A patch for the password echo is attached.  I'll send separate patches
for the other issues or any more that I encounter.

Thanks again,
Jon
-------------- next part --------------
A non-text attachment was scrubbed...
Name: fi-install-password-echo.diff
Type: text/x-diff
Size: 1843 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070912/50be8265/attachment.bin>

From ssorce at redhat.com  Wed Sep 12 15:49:49 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Wed, 12 Sep 2007 11:49:49 -0400
Subject: [Freeipa-devel] [PATCH] don't echo passwords
In-Reply-To: <939dd5750709120827t5c904aaam3b19e619fb6ed2cc@mail.gmail.com>
References: <939dd5750709120827t5c904aaam3b19e619fb6ed2cc@mail.gmail.com>
Message-ID: <1189612189.4281.13.camel@localhost.localdomain>

On Wed, 2007-09-12 at 11:27 -0400, William Jon McCann wrote:
> A couple of things that I noticed about the server install script are:
>  - passwords are echoed
>  - some of the prompts don't have defaults (particularly the y/n ones)
>  - perhaps we should ask for the passwords to be confirmed to help
> avoid typos?


Thanks,
yes this was a known issue, and I was waiting for a more stable script
before switching to getpass, but as you have done it I will integrate
the patch and add the confirmation step as well (as long as you see the
password you don't need it, but now you do).

Thank you very much for the patch, it is very welcome.

Simo.



From kmccarth at redhat.com  Wed Sep 12 15:57:26 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Wed, 12 Sep 2007 08:57:26 -0700
Subject: [Freeipa-devel] [PATCH] Initial password setting support
In-Reply-To: <46E6E758.6030006@redhat.com>
References: <46E6E758.6030006@redhat.com>
Message-ID: <20070912155726.GB25543@moon.usersys.redhat.com>

Rob Crittenden wrote:
> Added the API needed to set the user password.
>
> Apparently the old password is NOT checked when setting a new one. I'm not 
> sure if the plugin should do this or we should, or whether we just let it 
> be as-is.
>
> I also removed some strange calls to set the realm.

Looks good for committing.

-Kevin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070912/38877e34/attachment.bin>

From ssorce at redhat.com  Wed Sep 12 17:23:05 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Wed, 12 Sep 2007 13:23:05 -0400
Subject: [Freeipa-devel] [PATCH] don't echo passwords
In-Reply-To: <939dd5750709120827t5c904aaam3b19e619fb6ed2cc@mail.gmail.com>
References: <939dd5750709120827t5c904aaam3b19e619fb6ed2cc@mail.gmail.com>
Message-ID: <1189617785.4281.16.camel@localhost.localdomain>

On Wed, 2007-09-12 at 11:27 -0400, William Jon McCann wrote:
> 
> A patch for the password echo is attached.  I'll send separate patches
> for the other issues or any more that I encounter. 

Pushed and added also a patch to ask for confirmation.

Couldn't find y/N questions w/o the [y/N] hint, are you looking at the
mercurial repository or the code in one of the drops/milestones?

Simo.



From mccann at jhu.edu  Wed Sep 12 17:37:28 2007
From: mccann at jhu.edu (William Jon McCann)
Date: Wed, 12 Sep 2007 13:37:28 -0400
Subject: [Freeipa-devel] [PATCH] don't echo passwords
In-Reply-To: <1189617785.4281.16.camel@localhost.localdomain>
References: <939dd5750709120827t5c904aaam3b19e619fb6ed2cc@mail.gmail.com>
	<1189617785.4281.16.camel@localhost.localdomain>
Message-ID: <939dd5750709121037i1a55f885w28f8f54a2ac01d58@mail.gmail.com>

On 9/12/07, Simo Sorce <ssorce at redhat.com> wrote:
> On Wed, 2007-09-12 at 11:27 -0400, William Jon McCann wrote:
> >
> > A patch for the password echo is attached.  I'll send separate patches
> > for the other issues or any more that I encounter.
>
> Pushed and added also a patch to ask for confirmation.

Thanks.

> Couldn't find y/N questions w/o the [y/N] hint, are you looking at the
> mercurial repository or the code in one of the drops/milestones?

Sorry I wasn't very clear.  I mean that there is no guidance as to
what the default is.  From looking at the code it seems that the
default answer is 'no'.  I would suggest something like:

Do you want to use DOMAIN as the realm name? [yes] :

So that a return accepts the default which in this case is "yes".
Also probably good to handle case insensitve "y" and "yes" as
affirmative.

A minor thing but a lot of people including myself will just choose
the defaults the first time they test the software...

Jon



From kmccarth at redhat.com  Wed Sep 12 17:37:58 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Wed, 12 Sep 2007 10:37:58 -0700
Subject: [Freeipa-devel] [PATCH] basic group list/show/edit
Message-ID: <20070912173758.GC25543@moon.usersys.redhat.com>

This is the initial framework for group list/show/edit.  Just wanted to
get it out of the way in an initial patch so the interesting stuff is
more apparent later.

Lot's still to do - specifically group member management and search
improvements (ala user search).

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189618831 25200
# Node ID c87fc8161f0439834fdbd8c1d381c7cb25f65ed4
# Parent  0bf55b38d551f2fae8902b9c882e1c5802ea5c62
Group edit page

diff -r 0bf55b38d551 -r c87fc8161f04 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 11 02:48:53 2007 -0400
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Wed Sep 12 10:40:31 2007 -0700
@@ -34,6 +34,8 @@ client = ipa.ipaclient.IPAClient(True)
 
 user_fields = ['*', 'nsAccountLock']
 
+group_fields = ['*']
+
 def restrict_post():
     if cherrypy.request.method != "POST":
         turbogears.flash("This method only accepts posts")
@@ -58,7 +60,7 @@ class Root(controllers.RootController):
         if kw.get('searchtype') == "Users":
             return self.userlist(uid=kw.get('searchvalue'))
         else:
-            return self.index()
+            return self.grouplist(criteria=kw.get('searchvalue'))
 
 
 
@@ -160,9 +162,9 @@ class Root(controllers.RootController):
             if kw.get('userpassword'):
                 new_user.setValue('userpassword', kw.get('userpassword'))
             if kw.get('uidnumber'):
-                new_user.setValue('uidnumber', kw.get('uidnumber'))
+                new_user.setValue('uidnumber', str(kw.get('uidnumber')))
             if kw.get('gidnumber'):
-                new_user.setValue('gidnumber', kw.get('gidnumber'))
+                new_user.setValue('gidnumber', str(kw.get('gidnumber')))
 
             #
             # this is a hack until we decide on the policy for names/cn/sn/givenName
@@ -183,7 +185,7 @@ class Root(controllers.RootController):
     @expose("ipagui.templates.userlist")
     @identity.require(identity.not_anonymous())
     def userlist(self, **kw):
-        """Retrieve a list of all users and display them in one huge list"""
+        """Searches for users and displays list of results"""
         client.set_principal(identity.current.user_name)
         users = None
         counter = 0
@@ -379,6 +381,88 @@ class Root(controllers.RootController):
             turbogears.flash("Group add failed: " + str(e) + "<br/>" + str(e.detail))
             return dict(form=group_new_form, tg_template='ipagui.templates.groupnew')
 
+
+    @expose("ipagui.templates.groupedit")
+    @identity.require(identity.not_anonymous())
+    def groupedit(self, cn, tg_errors=None):
+        """Displays the edit group form"""
+        if tg_errors:
+            turbogears.flash("There was a problem with the form!")
+
+        client.set_principal(identity.current.user_name)
+        group = client.get_group_by_cn(cn, group_fields)
+        group_dict = group.toDict()
+
+        # store a copy of the original group for the update later
+        group_data = b64encode(dumps(group_dict))
+        group_dict['group_orig'] = group_data
+        return dict(form=group_edit_form, group=group_dict)
+
+    @expose()
+    @identity.require(identity.not_anonymous())
+    def groupupdate(self, **kw):
+        """Updates an existing group"""
+        restrict_post()
+        client.set_principal(identity.current.user_name)
+        if kw.get('submit') == 'Cancel Edit':
+            turbogears.flash("Edit group cancelled")
+            raise turbogears.redirect('/groupshow', cn=kw.get('cn'))
+
+        tg_errors, kw = self.groupupdatevalidate(**kw)
+        if tg_errors:
+            return dict(form=group_edit_form, group=kw,
+                        tg_template='ipagui.templates.groupedit')
+
+        try:
+            orig_group_dict = loads(b64decode(kw.get('group_orig')))
+
+            new_group = ipa.group.Group(orig_group_dict)
+            new_group.setValue('description', kw.get('description'))
+            if kw.get('gidnumber'):
+                new_group.setValue('gidnumber', str(kw.get('gidnumber')))
+
+            rv = client.update_group(new_group)
+            turbogears.flash("%s updated!" % kw['cn'])
+            raise turbogears.redirect('/groupshow', cn=kw['cn'])
+        except ipaerror.IPAError, e:
+            turbogears.flash("User update failed: " + str(e))
+            return dict(form=group_edit_form, group=kw,
+                        tg_template='ipagui.templates.groupedit')
+
+    @expose("ipagui.templates.grouplist")
+    @identity.require(identity.not_anonymous())
+    def grouplist(self, **kw):
+        """Search for groups and display results"""
+        client.set_principal(identity.current.user_name)
+        groups = None
+        # counter = 0
+        criteria = kw.get('criteria')
+        if criteria != None and len(criteria) > 0:
+            try:
+                groups = client.find_groups(criteria.encode('utf-8'))
+                # counter = groups[0]
+                # groups = groups[1:]
+                # if counter == -1:
+                #     turbogears.flash("These results are truncated.<br />" +
+                #                     "Please refine your search and try again.")
+            except ipaerror.IPAError, e:
+                turbogears.flash("Find groups failed: " + str(e))
+                raise turbogears.redirect("/grouplist")
+
+        return dict(groups=groups, criteria=criteria, fields=forms.group.GroupFields())
+
+    @expose("ipagui.templates.groupshow")
+    @identity.require(identity.not_anonymous())
+    def groupshow(self, cn):
+        """Retrieve a single group for display"""
+        client.set_principal(identity.current.user_name)
+        try:
+            group = client.get_group_by_cn(cn, group_fields)
+            return dict(group=group.toDict(), fields=forms.group.GroupFields())
+        except ipaerror.IPAError, e:
+            turbogears.flash("Group show failed: " + str(e))
+            raise turbogears.redirect("/")
+
     @validate(form=group_new_form)
     @identity.require(identity.not_anonymous())
     def groupcreatevalidate(self, tg_errors=None, **kw):
diff -r 0bf55b38d551 -r c87fc8161f04 ipa-server/ipa-gui/ipagui/forms/group.py
--- a/ipa-server/ipa-gui/ipagui/forms/group.py	Tue Sep 11 02:48:53 2007 -0400
+++ b/ipa-server/ipa-gui/ipagui/forms/group.py	Wed Sep 12 10:40:31 2007 -0700
@@ -32,13 +32,15 @@ class GroupNewForm(widgets.Form):
 
 
 class GroupEditValidator(validators.Schema):
-    gidnumber = widgets.TextField(name="gidnumber", label="GID")
-    description = widgets.TextField(name="description", label="Description")
+    gidnumber = validators.Int(not_empty=False)
+    description = validators.String(not_empty=False)
 
 class GroupEditForm(widgets.Form):
     params = ['group']
 
-    fields = [GroupFields.gidnumber, GroupFields.description]
+    fields = [GroupFields.gidnumber, GroupFields.description,
+              GroupFields.cn_hidden,
+              GroupFields.group_orig]
 
     validator = GroupEditValidator()
 
diff -r 0bf55b38d551 -r c87fc8161f04 ipa-server/ipa-gui/ipagui/templates/groupedit.kid
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/templates/groupedit.kid	Wed Sep 12 10:40:31 2007 -0700
@@ -0,0 +1,21 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:py="http://purl.org/kid/ns#"
+    py:extends="'grouplayout.kid'">
+<head>
+    <meta content="text/html; charset=utf-8" http-equiv="Content-Type" py:replace="''"/>
+    <title>Edit Group</title>
+</head>
+<body>
+  <div>
+    <div style="float:right">
+      <input type="checkbox"
+          onclick="toggleProtectedFields(this);">
+        <span class="small">edit protected fields</span>
+      </input>
+    </div>
+    <h2>Edit Group</h2>
+  </div>
+
+  ${form.display(action="groupupdate", value=group)}
+</body>
+</html>
diff -r 0bf55b38d551 -r c87fc8161f04 ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Wed Sep 12 10:40:31 2007 -0700
@@ -0,0 +1,82 @@
+<div xmlns:py="http://purl.org/kid/ns#"
+  class="simpleroster">
+  <form action="${action}" name="${name}" method="${method}" class="tableform">
+
+  <script type="text/javascript">
+    function toggleProtectedFields(checkbox) {
+      gidnumberField = document.getElementById('form_gidnumber');
+      if (checkbox.checked) {
+        gidnumberField.disabled = false;
+      } else {
+        gidnumberField.disabled = true;
+      }
+    }
+  </script>
+
+    <div py:for="field in hidden_fields"
+      py:replace="field.display(value_for(field), **params_for(field))" 
+      />
+
+    <div class="formsection">Group Details</div>
+    <table class="formtable" cellpadding="2" cellspacing="0" border="0">
+      <tr>
+        <th>
+          <label class="fieldlabel" for="${group.cn.field_id}"
+            py:content="group.cn.label" />:
+        </th>
+        <td>
+          <!-- <span py:replace="group.cn.display(value_for(group.cn))" />
+          <span py:if="tg.errors.get('cn')" class="fielderror"
+              py:content="tg.errors.get('cn')" /> -->
+          ${value_for(group.cn)}
+
+        </td>
+      </tr>
+
+      <tr>
+        <th>
+          <label class="fieldlabel" for="${group.description.field_id}"
+            py:content="group.description.label" />:
+        </th>
+        <td>
+          <span py:replace="group.description.display(value_for(group.description))" />
+          <span py:if="tg.errors.get('description')" class="fielderror"
+              py:content="tg.errors.get('description')" />
+
+        </td>
+      </tr>
+
+      <tr>
+        <th>
+          <label class="fieldlabel" for="${group.gidnumber.field_id}"
+            py:content="group.gidnumber.label" />:
+        </th>
+        <td>
+          <span py:replace="group.gidnumber.display(value_for(group.gidnumber))" />
+          <span py:if="tg.errors.get('gidnumber')" class="fielderror"
+              py:content="tg.errors.get('gidnumber')" />
+
+          <script type="text/javascript">
+              document.getElementById('form_gidnumber').disabled = true;
+          </script>
+        </td>
+      </tr>
+    </table>
+
+    <table class="formtable" cellpadding="2" cellspacing="0" border="0">
+      <tr>
+        <th>
+          <br />
+          <input type="submit" class="submitbutton" name="submit"
+              value="Update Group"/>
+        </th>
+        <td>
+          <br />
+          <input type="submit" class="submitbutton" name="submit"
+              value="Cancel Edit" />
+        </td>
+      </tr>
+    </table>
+
+  </form>
+</div>
diff -r 0bf55b38d551 -r c87fc8161f04 ipa-server/ipa-gui/ipagui/templates/grouplist.kid
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/templates/grouplist.kid	Wed Sep 12 10:40:31 2007 -0700
@@ -0,0 +1,43 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:py="http://purl.org/kid/ns#"
+    py:extends="'grouplayout.kid'">
+<head>
+<meta content="text/html; charset=utf-8" http-equiv="Content-Type" py:replace="''"/>
+<title>Find Groups</title>
+</head>
+<body>
+    <div id="search">
+        <form action="${tg.url('/grouplist')}" method="post">
+            <input id="criteria" type="text" name="criteria" value="${criteria}" />
+            <input type="submit" value="Find Groups"/>
+        </form>
+        <script type="text/javascript">
+            document.getElementById("criteria").focus();
+        </script>
+    </div>
+    <div py:if='(groups != None) and (len(groups) > 0)'>
+        <h2>${len(groups)} results returned:</h2>
+        <table id="resultstable">
+            <tr>
+                <th>
+                    <label class="fieldlabel" py:content="fields.cn.label" />
+                </th>
+                <th>
+                    <label class="fieldlabel" py:content="fields.description.label" />
+                </th>
+            </tr>
+            <tr py:for="group in groups">
+                <td>
+                    <a href="${tg.url('/groupshow',cn=group.cn)}">${group.cn}</a>
+                </td>
+                <td>
+                    ${group.description}
+                </td>
+            </tr>
+        </table>
+    </div>
+    <div py:if='(groups != None) and (len(groups) == 0)'>
+        <h2>No results found for "${criteria}"</h2>
+    </div>
+</body>
+</html>
diff -r 0bf55b38d551 -r c87fc8161f04 ipa-server/ipa-gui/ipagui/templates/groupnew.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupnew.kid	Tue Sep 11 02:48:53 2007 -0400
+++ b/ipa-server/ipa-gui/ipagui/templates/groupnew.kid	Wed Sep 12 10:40:31 2007 -0700
@@ -1,6 +1,6 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" xmlns:py="http://purl.org/kid/ns#"
-    py:extends="'userlayout.kid'">
+    py:extends="'grouplayout.kid'">
 <head>
     <meta content="text/html; charset=utf-8" http-equiv="Content-Type" py:replace="''"/>
     <title>Add Group</title>
diff -r 0bf55b38d551 -r c87fc8161f04 ipa-server/ipa-gui/ipagui/templates/groupshow.kid
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/templates/groupshow.kid	Wed Sep 12 10:40:31 2007 -0700
@@ -0,0 +1,38 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:py="http://purl.org/kid/ns#"
+    py:extends="'grouplayout.kid'">
+<head>
+    <meta content="text/html; charset=utf-8" http-equiv="Content-Type" py:replace="''"/>
+    <title>View Group</title>
+</head>
+<body>
+    <h2>View Group</h2>
+
+    <div class="formsection">Group Details</div>
+    <table class="formtable" cellpadding="2" cellspacing="0" border="0">
+        <tr>
+          <th>
+            <label class="fieldlabel" py:content="fields.cn.label" />:
+          </th>
+          <td>${group.get("cn")}</td>
+        </tr>
+
+        <tr>
+          <th>
+            <label class="fieldlabel" py:content="fields.description.label" />:
+          </th>
+          <td>${group.get("description")}</td>
+        </tr>
+
+        <tr>
+          <th>
+            <label class="fieldlabel" py:content="fields.gidnumber.label" />:
+          </th>
+          <td>${group.get("gidnumber")}</td>
+        </tr>
+    </table>
+
+    <a href="${tg.url('/groupedit', cn=group.get('cn'))}">edit</a>
+
+</body>
+</html>
diff -r 0bf55b38d551 -r c87fc8161f04 ipa-server/ipa-gui/ipagui/templates/master.kid
--- a/ipa-server/ipa-gui/ipagui/templates/master.kid	Tue Sep 11 02:48:53 2007 -0400
+++ b/ipa-server/ipa-gui/ipagui/templates/master.kid	Wed Sep 12 10:40:31 2007 -0700
@@ -70,7 +70,7 @@
         </p>
         <p>
         <a href="${tg.url('/groupnew')}">Add Group</a><br/>
-        <a href="${tg.url('/groupindex')}">Find Groups</a><br/>
+        <a href="${tg.url('/grouplist')}">Find Groups</a><br/>
         </p>
         <p>
         <a href="${tg.url('/')}">Manage Policy</a><br/>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070912/8de96f9b/attachment.bin>

From ssorce at redhat.com  Wed Sep 12 18:00:45 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Wed, 12 Sep 2007 14:00:45 -0400
Subject: [Freeipa-devel] [PATCH] don't echo passwords
In-Reply-To: <939dd5750709121037i1a55f885w28f8f54a2ac01d58@mail.gmail.com>
References: <939dd5750709120827t5c904aaam3b19e619fb6ed2cc@mail.gmail.com>
	<1189617785.4281.16.camel@localhost.localdomain>
	<939dd5750709121037i1a55f885w28f8f54a2ac01d58@mail.gmail.com>
Message-ID: <1189620045.4281.19.camel@localhost.localdomain>

On Wed, 2007-09-12 at 13:37 -0400, William Jon McCann wrote:
> On 9/12/07, Simo Sorce <ssorce at redhat.com> wrote:
> > On Wed, 2007-09-12 at 11:27 -0400, William Jon McCann wrote:
> > >
> > > A patch for the password echo is attached.  I'll send separate patches
> > > for the other issues or any more that I encounter.
> >
> > Pushed and added also a patch to ask for confirmation.
> 
> Thanks.
> 
> > Couldn't find y/N questions w/o the [y/N] hint, are you looking at the
> > mercurial repository or the code in one of the drops/milestones?
> 
> Sorry I wasn't very clear.  I mean that there is no guidance as to
> what the default is.  From looking at the code it seems that the
> default answer is 'no'.  I would suggest something like:
> 
> Do you want to use DOMAIN as the realm name? [yes] :
> 
> So that a return accepts the default which in this case is "yes".
> Also probably good to handle case insensitve "y" and "yes" as
> affirmative.
> 
> A minor thing but a lot of people including myself will just choose
> the defaults the first time they test the software...

The default is the one presented as Capital:
[y/N] defaults to N
[Y/n] defaults to Y

This is what we used in other software too ...

Simo.



From mccann at jhu.edu  Wed Sep 12 18:27:13 2007
From: mccann at jhu.edu (William Jon McCann)
Date: Wed, 12 Sep 2007 14:27:13 -0400
Subject: [Freeipa-devel] [PATCH] don't echo passwords
In-Reply-To: <1189620045.4281.19.camel@localhost.localdomain>
References: <939dd5750709120827t5c904aaam3b19e619fb6ed2cc@mail.gmail.com>
	<1189617785.4281.16.camel@localhost.localdomain>
	<939dd5750709121037i1a55f885w28f8f54a2ac01d58@mail.gmail.com>
	<1189620045.4281.19.camel@localhost.localdomain>
Message-ID: <939dd5750709121127x1d4530abx7efe755dba3d368@mail.gmail.com>

On 9/12/07, Simo Sorce <ssorce at redhat.com> wrote:
> On Wed, 2007-09-12 at 13:37 -0400, William Jon McCann wrote:
> > On 9/12/07, Simo Sorce <ssorce at redhat.com> wrote:
> > > On Wed, 2007-09-12 at 11:27 -0400, William Jon McCann wrote:
> > > >
> > > > A patch for the password echo is attached.  I'll send separate patches
> > > > for the other issues or any more that I encounter.
> > >
> > > Pushed and added also a patch to ask for confirmation.
> >
> > Thanks.
> >
> > > Couldn't find y/N questions w/o the [y/N] hint, are you looking at the
> > > mercurial repository or the code in one of the drops/milestones?
> >
> > Sorry I wasn't very clear.  I mean that there is no guidance as to
> > what the default is.  From looking at the code it seems that the
> > default answer is 'no'.  I would suggest something like:
> >
> > Do you want to use DOMAIN as the realm name? [yes] :
> >
> > So that a return accepts the default which in this case is "yes".
> > Also probably good to handle case insensitve "y" and "yes" as
> > affirmative.
> >
> > A minor thing but a lot of people including myself will just choose
> > the defaults the first time they test the software...
>
> The default is the one presented as Capital:
> [y/N] defaults to N
> [Y/n] defaults to Y
>
> This is what we used in other software too ...

Oh.  That wasn't obvious to me.  In any case it is probably better to
default to "yes" for the suggested realm name.

Jon



From ssorce at redhat.com  Wed Sep 12 18:45:41 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Wed, 12 Sep 2007 14:45:41 -0400
Subject: [Freeipa-devel] [PATCH] don't echo passwords
In-Reply-To: <939dd5750709121127x1d4530abx7efe755dba3d368@mail.gmail.com>
References: <939dd5750709120827t5c904aaam3b19e619fb6ed2cc@mail.gmail.com>
	<1189617785.4281.16.camel@localhost.localdomain>
	<939dd5750709121037i1a55f885w28f8f54a2ac01d58@mail.gmail.com>
	<1189620045.4281.19.camel@localhost.localdomain>
	<939dd5750709121127x1d4530abx7efe755dba3d368@mail.gmail.com>
Message-ID: <1189622741.4281.24.camel@localhost.localdomain>

On Wed, 2007-09-12 at 14:27 -0400, William Jon McCann wrote:
> Oh.  That wasn't obvious to me.  In any case it is probably better to
> default to "yes" for the suggested realm name. 

Uhmm not sure about that, opinions?



From mccann at jhu.edu  Wed Sep 12 18:55:17 2007
From: mccann at jhu.edu (William Jon McCann)
Date: Wed, 12 Sep 2007 14:55:17 -0400
Subject: [Freeipa-devel] [PATCH] don't echo passwords
In-Reply-To: <1189622741.4281.24.camel@localhost.localdomain>
References: <939dd5750709120827t5c904aaam3b19e619fb6ed2cc@mail.gmail.com>
	<1189617785.4281.16.camel@localhost.localdomain>
	<939dd5750709121037i1a55f885w28f8f54a2ac01d58@mail.gmail.com>
	<1189620045.4281.19.camel@localhost.localdomain>
	<939dd5750709121127x1d4530abx7efe755dba3d368@mail.gmail.com>
	<1189622741.4281.24.camel@localhost.localdomain>
Message-ID: <939dd5750709121155g172d90fci1a64179e575a506b@mail.gmail.com>

On 9/12/07, Simo Sorce <ssorce at redhat.com> wrote:
> On Wed, 2007-09-12 at 14:27 -0400, William Jon McCann wrote:
> > Oh.  That wasn't obvious to me.  In any case it is probably better to
> > default to "yes" for the suggested realm name.
>
> Uhmm not sure about that, opinions?
>

Or, what about this:

"Please provide a realm name: [PHA.JHU.EDU]: "

Don't mean to be annoying about this - it isn't a big deal.  But from
a first time installer point of view the process seemed a little
awkward.  In my experience a good rule of thumb is to always produce a
workable configuration in response to the user hitting enter for all
prompts...

Jon



From rcritten at redhat.com  Wed Sep 12 19:50:24 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Wed, 12 Sep 2007 15:50:24 -0400
Subject: [Freeipa-devel] [PATCH] don't echo passwords
In-Reply-To: <939dd5750709121155g172d90fci1a64179e575a506b@mail.gmail.com>
References: <939dd5750709120827t5c904aaam3b19e619fb6ed2cc@mail.gmail.com>	<1189617785.4281.16.camel@localhost.localdomain>	<939dd5750709121037i1a55f885w28f8f54a2ac01d58@mail.gmail.com>	<1189620045.4281.19.camel@localhost.localdomain>	<939dd5750709121127x1d4530abx7efe755dba3d368@mail.gmail.com>	<1189622741.4281.24.camel@localhost.localdomain>
	<939dd5750709121155g172d90fci1a64179e575a506b@mail.gmail.com>
Message-ID: <46E84300.5000109@redhat.com>

William Jon McCann wrote:
> On 9/12/07, Simo Sorce <ssorce at redhat.com> wrote:
>> On Wed, 2007-09-12 at 14:27 -0400, William Jon McCann wrote:
>>> Oh.  That wasn't obvious to me.  In any case it is probably better to
>>> default to "yes" for the suggested realm name.
>> Uhmm not sure about that, opinions?
>>
> 
> Or, what about this:
> 
> "Please provide a realm name: [PHA.JHU.EDU]: "
> 
> Don't mean to be annoying about this - it isn't a big deal.  But from
> a first time installer point of view the process seemed a little
> awkward.  In my experience a good rule of thumb is to always produce a
> workable configuration in response to the user hitting enter for all
> prompts...
> 

+1. This is what most other interactive installers do.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070912/64f61ce3/attachment.bin>

From ssorce at redhat.com  Wed Sep 12 22:59:35 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Wed, 12 Sep 2007 18:59:35 -0400
Subject: [Freeipa-devel] [PATCH] don't echo passwords
In-Reply-To: <939dd5750709121155g172d90fci1a64179e575a506b@mail.gmail.com>
References: <939dd5750709120827t5c904aaam3b19e619fb6ed2cc@mail.gmail.com>
	<1189617785.4281.16.camel@localhost.localdomain>
	<939dd5750709121037i1a55f885w28f8f54a2ac01d58@mail.gmail.com>
	<1189620045.4281.19.camel@localhost.localdomain>
	<939dd5750709121127x1d4530abx7efe755dba3d368@mail.gmail.com>
	<1189622741.4281.24.camel@localhost.localdomain>
	<939dd5750709121155g172d90fci1a64179e575a506b@mail.gmail.com>
Message-ID: <1189637975.4281.33.camel@localhost.localdomain>

On Wed, 2007-09-12 at 14:55 -0400, William Jon McCann wrote:
> Or, what about this:
> 
> "Please provide a realm name: [PHA.JHU.EDU]: "
> 
> Don't mean to be annoying about this - it isn't a big deal.  But from
> a first time installer point of view the process seemed a little
> awkward.  In my experience a good rule of thumb is to always produce a
> workable configuration in response to the user hitting enter for all
> prompts... 

Good idea,
implemented and pushed.

Thanks,
Simo.



From kmccarth at redhat.com  Thu Sep 13 17:27:12 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 13 Sep 2007 10:27:12 -0700
Subject: [Freeipa-devel] [PATCH] javascript sorting of user results
	w/tablekit
Message-ID: <20070913172712.GA19864@moon.usersys.redhat.com>

This patch adds the tablekit package:
http://www.millstream.com.au/view/code/tablekit/ (licensed under MIT)
and uses it to add javascript table sorting for the user results.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189704395 25200
# Node ID 698d4ac367ffb7c1ad37232aebc629d64a45ad30
# Parent  7efa620853f6437f26f072d82f51401e94485d8f
Adds javascript table sorting for user results
Adds tablekit: http://www.millstream.com.au/view/code/tablekit/ licensed under MIT.

diff -r 7efa620853f6 -r 698d4ac367ff ipa-server/ipa-gui/ipagui/static/css/style.css
--- a/ipa-server/ipa-gui/ipagui/static/css/style.css	Thu Sep 13 10:18:41 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/static/css/style.css	Thu Sep 13 10:26:35 2007 -0700
@@ -194,3 +194,37 @@ body {
 #resultstable th {
   background: #eee;
 }
+
+/*
+ * TableKit css
+ */
+
+.sortcol {
+  cursor: pointer;
+  padding-right: 20px !important;
+  background-repeat: no-repeat !important;
+  background-position: right center !important;
+}
+.sortasc {
+  background-image: url(/static/images/up.gif) !important;
+}
+.sortdesc {
+  background-image: url(/static/images/down.gif) !important;
+}
+.nosort {
+  cursor: default;
+}
+
+th.resize-handle-active {
+  cursor: e-resize;
+}
+
+div.resize-handle {
+  cursor: e-resize;
+  width: 2px;
+  border-right: 1px dashed #1E90FF;
+  position:absolute;
+  top:0;
+  left:0;
+}
+
diff -r 7efa620853f6 -r 698d4ac367ff ipa-server/ipa-gui/ipagui/static/javascript/tablekit.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/static/javascript/tablekit.js	Thu Sep 13 10:26:35 2007 -0700
@@ -0,0 +1,846 @@
+/*
+*
+* Copyright (c) 2007 Andrew Tetlaw & Millstream Web Software
+* http://www.millstream.com.au/view/code/tablekit/
+* Version: 1.2.1 2007-03-11
+* 
+* Permission is hereby granted, free of charge, to any person
+* obtaining a copy of this software and associated documentation
+* files (the "Software"), to deal in the Software without
+* restriction, including without limitation the rights to use, copy,
+* modify, merge, publish, distribute, sublicense, and/or sell copies
+* of the Software, and to permit persons to whom the Software is
+* furnished to do so, subject to the following conditions:
+* 
+* The above copyright notice and this permission notice shall be
+* included in all copies or substantial portions of the Software.
+* 
+* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+* SOFTWARE.
+* * 
+*/
+
+// Use the TableKit class constructure if you'd prefer to init your tables as JS objects
+var TableKit = Class.create();
+
+TableKit.prototype = {
+	initialize : function(elm, options) {
+		var table = $(elm);
+		if(table.tagName !== "TABLE") {
+			return;
+		}
+		TableKit.register(table,Object.extend(TableKit.options,options || {}));
+		this.id = table.id;
+		var op = TableKit.option('sortable resizable editable', this.id);
+		if(op.sortable) {
+			TableKit.Sortable.init(table);
+		} 
+		if(op.resizable) {
+			TableKit.Resizable.init(table);
+		}
+		if(op.editable) {
+			TableKit.Editable.init(table);
+		}
+	},
+	sort : function(column, order) {
+		TableKit.Sortable.sort(this.id, column, order);
+	},
+	resizeColumn : function(column, w) {
+		TableKit.Resizable.resize(this.id, column, w);
+	},
+	editCell : function(row, column) {
+		TableKit.Editable.editCell(this.id, row, column);
+	}
+};
+
+Object.extend(TableKit, {
+	getBodyRows : function(table) {
+		table = $(table);
+		var id = table.id;
+		if(!TableKit.rows[id]) {
+			TableKit.rows[id] = (table.tHead && table.tHead.rows.length > 0) ? $A(table.tBodies[0].rows) : $A(table.rows).without(table.rows[0]);
+		}
+		return TableKit.rows[id];
+	},
+	getHeaderCells : function(table, cell) {
+		if(!table) { table = $(cell).up('table'); }
+		var id = table.id;
+		if(!TableKit.heads[id]) {
+			TableKit.heads[id] = $A((table.tHead && table.tHead.rows.length > 0) ? table.tHead.rows[table.tHead.rows.length-1].cells : table.rows[0].cells);
+		}
+		return TableKit.heads[id];
+	},
+	getCellIndex : function(cell) {
+		return $A(cell.parentNode.cells).indexOf(cell);
+	},
+	getRowIndex : function(row) {
+		return $A(row.parentNode.rows).indexOf(row);
+	},
+	getCellText : function(cell, refresh) {
+		if(!cell) { return ""; }
+		TableKit.registerCell(cell);
+		var data = TableKit.cells[cell.id];
+		if(refresh || data.refresh || !data.textContent) {
+			data.textContent = cell.textContent ? cell.textContent : cell.innerText;
+			data.refresh = false;
+		}
+		return data.textContent;
+	},
+	register : function(table, options) {
+		if(!table.id) {
+			TableKit._tblcount += 1;
+			table.id = "tablekit-table-" + TableKit._tblcount;
+		}
+		var id = table.id;
+		TableKit.tables[id] = TableKit.tables[id] ? Object.extend(TableKit.tables[id], options || {}) : Object.extend({sortable:false,resizable:false,editable:false}, options || {});
+	},
+	registerCell : function(cell) {
+		if(!cell.id) {
+			TableKit._cellcount += 1;
+			cell.id = "tablekit-cell-" + TableKit._cellcount;
+		}
+		if(!TableKit.cells[cell.id]) {
+			TableKit.cells[cell.id] = {textContent : '', htmlContent : '', active : false};
+		}
+	},
+	isSortable : function(table) {
+		return TableKit.tables[table.id] ? TableKit.tables[table.id].sortable : false;
+	},
+	isResizable : function(table) {
+		return TableKit.tables[table.id] ? TableKit.tables[table.id].resizable : false;
+	},
+	isEditable : function(table) {
+		return TableKit.tables[table.id] ? TableKit.tables[table.id].editable : false;
+	},
+	setup : function(o) {
+		Object.extend(TableKit.options, o || {} );
+	},
+	option : function(s, id, o1, o2) {
+		o1 = o1 || TableKit.options;
+		o2 = o2 || (id ? (TableKit.tables[id] ? TableKit.tables[id] : {}) : {});
+		var key = id + s;
+		if(!TableKit._opcache[key]){
+			TableKit._opcache[key] = $A($w(s)).inject([],function(a,v){
+				a.push(a[v] = o2[v] || o1[v]);
+				return a;
+			});
+		}
+		return TableKit._opcache[key];
+	},
+	e : function(event) {
+		return event || window.event;
+	},
+	tables : {},
+	_opcache : {},
+	cells : {},
+	rows : {},
+	heads : {},
+	options : {
+		autoLoad : true,
+		stripe : true,
+		sortable : true,
+		resizable : true,
+		editable : true,
+		rowEvenClass : 'roweven',
+		rowOddClass : 'rowodd',
+		sortableSelector : ['table.sortable'],
+		columnClass : 'sortcol',
+		descendingClass : 'sortdesc',
+		ascendingClass : 'sortasc',
+		noSortClass : 'nosort',
+		sortFirstAscendingClass : 'sortfirstasc',
+		sortFirstDecendingClass : 'sortfirstdesc',
+		resizableSelector : ['table.resizable'],
+		minWidth : 10,
+		showHandle : true,
+		resizeOnHandleClass : 'resize-handle-active',
+		editableSelector : ['table.editable'],
+		formClassName : 'editable-cell-form',
+		noEditClass : 'noedit',
+		editAjaxURI : '/',
+		editAjaxOptions : {}
+	},
+	_tblcount : 0,
+	_cellcount : 0,
+	load : function() {
+		if(TableKit.options.autoLoad) {
+			if(TableKit.options.sortable) {
+				$A(TableKit.options.sortableSelector).each(function(s){
+					$$(s).each(function(t) {
+						TableKit.Sortable.init(t);
+					});
+				});
+			}
+			if(TableKit.options.resizable) {
+				$A(TableKit.options.resizableSelector).each(function(s){
+					$$(s).each(function(t) {
+						TableKit.Resizable.init(t);
+					});
+				});
+			}
+			if(TableKit.options.editable) {
+				$A(TableKit.options.editableSelector).each(function(s){
+					$$(s).each(function(t) {
+						TableKit.Editable.init(t);
+					});
+				});
+			}
+		}
+	}
+});
+
+TableKit.Rows = {
+	stripe : function(table) {
+		var rows = TableKit.getBodyRows(table);
+		rows.each(function(r,i) {
+			TableKit.Rows.addStripeClass(table,r,i);
+		});
+	},
+	addStripeClass : function(t,r,i) {
+		t = t || r.up('table');
+		var op = TableKit.option('rowEvenClass rowOddClass', t.id);
+		var css = ((i+1)%2 === 0 ? op[0] : op[1]);
+		// using prototype's assClassName/RemoveClassName was not efficient for large tables, hence:
+		var cn = r.className.split(/\s+/);
+		var newCn = [];
+		for(var x = 0, l = cn.length; x < l; x += 1) {
+			if(cn[x] !== op[0] && cn[x] !== op[1]) { newCn.push(cn[x]); }
+		}
+		newCn.push(css);
+		r.className = newCn.join(" ");
+	}
+};
+
+TableKit.Sortable = {
+	init : function(elm, options){
+		var table = $(elm);
+		if(table.tagName !== "TABLE") {
+			return;
+		}
+		TableKit.register(table,Object.extend(options || {},{sortable:true}));
+		var sortFirst;
+		var cells = TableKit.getHeaderCells(table);
+		var op = TableKit.option('noSortClass columnClass sortFirstAscendingClass sortFirstDecendingClass', table.id);
+		cells.each(function(c){
+			c = $(c);
+			if(!c.hasClassName(op.noSortClass)) {
+				Event.observe(c, 'mousedown', TableKit.Sortable._sort);
+				c.addClassName(op.columnClass);
+				if(c.hasClassName(op.sortFirstAscendingClass) || c.hasClassName(op.sortFirstDecendingClass)) {
+					sortFirst = c;
+				}
+			}
+		});
+
+		if(sortFirst) {
+			if(sortFirst.hasClassName(op.sortFirstAscendingClass)) {
+				TableKit.Sortable.sort(table, sortFirst, 1);
+			} else {
+				TableKit.Sortable.sort(table, sortFirst, -1);
+			}
+		} else { // just add row stripe classes
+			TableKit.Rows.stripe(table);
+		}
+	},
+	reload : function(table) {
+		table = $(table);
+		var cells = TableKit.getHeaderCells(table);
+		var op = TableKit.option('noSortClass columnClass', table.id);
+		cells.each(function(c){
+			c = $(c);
+			if(!c.hasClassName(op.noSortClass)) {
+				Event.stopObserving(c, 'mousedown', TableKit.Sortable._sort);
+				c.removeClassName(op.columnClass);
+			}
+		});
+		TableKit.Sortable.init(table);
+	},
+	_sort : function(e) {
+		if(TableKit.Resizable._onHandle) {return;}
+		e = TableKit.e(e);
+		Event.stop(e);
+		var cell = Event.element(e);
+		while(!(cell.tagName && cell.tagName.match(/td|th/gi))) {
+			cell = cell.parentNode;
+		}
+		TableKit.Sortable.sort(null, cell);
+	},
+	sort : function(table, index, order) {
+		var cell;
+		if(typeof index === 'number') {
+			if(!table || (table.tagName && table.tagName !== "TABLE")) {
+				return;
+			}
+			table = $(table);
+			index = Math.min(table.rows[0].cells.length, index);
+			index = Math.max(1, index);
+			index -= 1;
+			cell = (table.tHead && table.tHead.rows.length > 0) ? $(table.tHead.rows[table.tHead.rows.length-1].cells[index]) : $(table.rows[0].cells[index]);
+		} else {
+			cell = $(index);
+			table = table ? $(table) : cell.up('table');
+			index = TableKit.getCellIndex(cell);
+		}
+		var op = TableKit.option('noSortClass descendingClass ascendingClass', table.id);
+		
+		if(cell.hasClassName(op.noSortClass)) {return;}	
+		
+		order = order ? order : (cell.hasClassName(op.descendingClass) ? 1 : -1);
+		var rows = TableKit.getBodyRows(table);
+
+		if(cell.hasClassName(op.ascendingClass) || cell.hasClassName(op.descendingClass)) {
+			rows.reverse(); // if it was already sorted we just need to reverse it.
+		} else {
+			var datatype = TableKit.Sortable.getDataType(cell,index,table);
+			var tkst = TableKit.Sortable.types;
+			rows.sort(function(a,b) {
+				return order * tkst[datatype].compare(TableKit.getCellText(a.cells[index]),TableKit.getCellText(b.cells[index]));
+			});
+		}
+		var tb = table.tBodies[0];
+		var tkr = TableKit.Rows;
+		rows.each(function(r,i) {
+			tb.appendChild(r);
+			tkr.addStripeClass(table,r,i);
+		});
+		var hcells = TableKit.getHeaderCells(null, cell);
+		$A(hcells).each(function(c,i){
+			c = $(c);
+			c.removeClassName(op.ascendingClass);
+			c.removeClassName(op.descendingClass);
+			if(index === i) {
+				if(order === 1) {
+					c.removeClassName(op.descendingClass);
+					c.addClassName(op.ascendingClass);
+				} else {
+					c.removeClassName(op.ascendingClass);
+					c.addClassName(op.descendingClass);
+				}
+			}
+		});
+	},
+	types : {},
+	detectors : [],
+	addSortType : function() {
+		$A(arguments).each(function(o){
+			TableKit.Sortable.types[o.name] = o;
+		});
+	},
+	getDataType : function(cell,index,table) {
+		cell = $(cell);
+		index = (index || index === 0) ? index : TableKit.getCellIndex(cell);
+		
+		var colcache = TableKit.Sortable._coltypecache;
+		var cache = colcache[table.id] ? colcache[table.id] : (colcache[table.id] = {});
+		
+		if(!cache[index]) {
+			var t = '';
+			// first look for a data type id on the heading row cell
+			if(cell.id && TableKit.Sortable.types[cell.id]) {
+				t = cell.id;
+			}
+			t = cell.classNames().detect(function(n){ // then look for a data type classname on the heading row cell
+				return (TableKit.Sortable.types[n]) ? true : false;
+			});
+			if(!t) {
+				var rows = TableKit.getBodyRows(table);
+				cell = rows[0].cells[index]; // grab same index cell from body row to try and match data type
+				t = TableKit.Sortable.detectors.detect(
+						function(d){
+							return TableKit.Sortable.types[d].detect(TableKit.getCellText(cell));
+						});
+			}
+			cache[index] = t;
+		}
+		return cache[index];
+	},
+	_coltypecache : {}
+};
+
+TableKit.Sortable.detectors = $A($w('date-iso date date-eu date-au time currency datasize number casesensitivetext text')); // setting it here because Safari complained when I did it above...
+
+TableKit.Sortable.Type = Class.create();
+TableKit.Sortable.Type.prototype = {
+	initialize : function(name, options){
+		this.name = name;
+		options = Object.extend({
+			normal : function(v){
+				return v;
+			},
+			pattern : /.*/
+		}, options || {});
+		this.normal = options.normal;
+		this.pattern = options.pattern;
+		if(options.compare) {
+			this.compare = options.compare;
+		}
+		if(options.detect) {
+			this.detect = options.detect;
+		}
+	},
+	compare : function(a,b){
+		return TableKit.Sortable.Type.compare(this.normal(a), this.normal(b));
+	},
+	detect : function(v){
+		return this.pattern.test(v);
+	}
+};
+
+TableKit.Sortable.Type.compare = function(a,b) {
+	return a < b ? -1 : a === b ? 0 : 1;
+};
+
+TableKit.Sortable.addSortType(
+	new TableKit.Sortable.Type('number', {
+		pattern : /^[-+]?[\d]*\.?[\d]+(?:[eE][-+]?[\d]+)?/,
+		normal : function(v) {
+			// This will grab the first thing that looks like a number from a string, so you can use it to order a column of various srings containing numbers.
+			v = parseFloat(v.replace(/^.*?([-+]?[\d]*\.?[\d]+(?:[eE][-+]?[\d]+)?).*$/,"$1"));
+			return isNaN(v) ? 0 : v;
+		}}),
+	new TableKit.Sortable.Type('text',{
+		normal : function(v) {
+			return v ? v.toLowerCase() : '';
+		}}),
+	new TableKit.Sortable.Type('casesensitivetext',{pattern : /^[A-Z]+$/}),
+	new TableKit.Sortable.Type('datasize',{
+		pattern : /^[-+]?[\d]*\.?[\d]+(?:[eE][-+]?[\d]+)?\s?[k|m|g|t]b$/i,
+		normal : function(v) {
+			var r = v.match(/^([-+]?[\d]*\.?[\d]+([eE][-+]?[\d]+)?)\s?([k|m|g|t]?b)?/i);
+			var b = r[1] ? Number(r[1]).valueOf() : 0;
+			var m = r[3] ? r[3].substr(0,1).toLowerCase() : '';
+			var result = b;
+			switch(m) {
+				case  'k':
+					result = b * 1024;
+					break;
+				case  'm':				
+					result = b * 1024 * 1024;
+					break;
+				case  'g':
+					result = b * 1024 * 1024 * 1024;
+					break;
+				case  't':
+					result = b * 1024 * 1024 * 1024 * 1024;
+					break;
+			}
+			return result;
+		}}),
+	new TableKit.Sortable.Type('date-au',{
+		pattern : /^\d{2}\/\d{2}\/\d{4}\s?(?:\d{1,2}\:\d{2}(?:\:\d{2})?\s?[a|p]?m?)?/i,
+		normal : function(v) {
+			if(!this.pattern.test(v)) {return 0;}
+			var r = v.match(/^(\d{2})\/(\d{2})\/(\d{4})\s?(?:(\d{1,2})\:(\d{2})(?:\:(\d{2}))?\s?([a|p]?m?))?/i);
+			var yr_num = r[3];
+			var mo_num = parseInt(r[2],10)-1;
+			var day_num = r[1];
+			var hr_num = r[4] ? r[4] : 0;
+			if(r[7] && r[7].toLowerCase().indexOf('p') !== -1) {
+				hr_num = parseInt(r[4],10) + 12;
+			}
+			var min_num = r[5] ? r[5] : 0;
+			var sec_num = r[6] ? r[6] : 0;
+			return new Date(yr_num, mo_num, day_num, hr_num, min_num, sec_num, 0).valueOf();
+		}}),
+	new TableKit.Sortable.Type('date-us',{
+		pattern : /^\d{2}\/\d{2}\/\d{4}\s?(?:\d{1,2}\:\d{2}(?:\:\d{2})?\s?[a|p]?m?)?/i,
+		normal : function(v) {
+			if(!this.pattern.test(v)) {return 0;}
+			var r = v.match(/^(\d{2})\/(\d{2})\/(\d{4})\s?(?:(\d{1,2})\:(\d{2})(?:\:(\d{2}))?\s?([a|p]?m?))?/i);
+			var yr_num = r[3];
+			var mo_num = parseInt(r[1],10)-1;
+			var day_num = r[2];
+			var hr_num = r[4] ? r[4] : 0;
+			if(r[7] && r[7].toLowerCase().indexOf('p') !== -1) {
+				hr_num = parseInt(r[4],10) + 12;
+			}
+			var min_num = r[5] ? r[5] : 0;
+			var sec_num = r[6] ? r[6] : 0;
+			return new Date(yr_num, mo_num, day_num, hr_num, min_num, sec_num, 0).valueOf();
+		}}),
+	new TableKit.Sortable.Type('date-eu',{
+		pattern : /^\d{2}-\d{2}-\d{4}/i,
+		normal : function(v) {
+			if(!this.pattern.test(v)) {return 0;}
+			var r = v.match(/^(\d{2})-(\d{2})-(\d{4})/);
+			var yr_num = r[3];
+			var mo_num = parseInt(r[2],10)-1;
+			var day_num = r[1];
+			return new Date(yr_num, mo_num, day_num).valueOf();
+		}}),
+	new TableKit.Sortable.Type('date-iso',{
+		pattern : /[\d]{4}-[\d]{2}-[\d]{2}(?:T[\d]{2}\:[\d]{2}(?:\:[\d]{2}(?:\.[\d]+)?)?(Z|([-+][\d]{2}:[\d]{2})?)?)?/, // 2005-03-26T19:51:34Z
+		normal : function(v) {
+			if(!this.pattern.test(v)) {return 0;}
+		    var d = v.match(/([\d]{4})(-([\d]{2})(-([\d]{2})(T([\d]{2}):([\d]{2})(:([\d]{2})(\.([\d]+))?)?(Z|(([-+])([\d]{2}):([\d]{2})))?)?)?)?/);		
+		    var offset = 0;
+		    var date = new Date(d[1], 0, 1);
+		    if (d[3]) { date.setMonth(d[3] - 1) ;}
+		    if (d[5]) { date.setDate(d[5]); }
+		    if (d[7]) { date.setHours(d[7]); }
+		    if (d[8]) { date.setMinutes(d[8]); }
+		    if (d[10]) { date.setSeconds(d[10]); }
+		    if (d[12]) { date.setMilliseconds(Number("0." + d[12]) * 1000); }
+		    if (d[14]) {
+		        offset = (Number(d[16]) * 60) + Number(d[17]);
+		        offset *= ((d[15] === '-') ? 1 : -1);
+		    }
+		    offset -= date.getTimezoneOffset();
+		    if(offset !== 0) {
+		    	var time = (Number(date) + (offset * 60 * 1000));
+		    	date.setTime(Number(time));
+		    }
+			return date.valueOf();
+		}}),
+	new TableKit.Sortable.Type('date',{
+		pattern: /^(?:sun|mon|tue|wed|thu|fri|sat)\,\s\d{1,2}\s(?:jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)\s\d{4}(?:\s\d{2}\:\d{2}(?:\:\d{2})?(?:\sGMT(?:[+-]\d{4})?)?)?/i, //Mon, 18 Dec 1995 17:28:35 GMT
+		compare : function(a,b) { // must be standard javascript date format
+			if(a && b) {
+				return TableKit.Sortable.Type.compare(new Date(a),new Date(b));
+			} else {
+				return TableKit.Sortable.Type.compare(a ? 1 : 0, b ? 1 : 0);
+			}
+		}}),
+	new TableKit.Sortable.Type('time',{
+		pattern : /^\d{1,2}\:\d{2}(?:\:\d{2})?(?:\s[a|p]m)?$/i,
+		compare : function(a,b) {
+			var d = new Date();
+			var ds = d.getMonth() + "/" + d.getDate() + "/" + d.getFullYear() + " ";
+			return TableKit.Sortable.Type.compare(new Date(ds + a),new Date(ds + b));
+		}}),
+	new TableKit.Sortable.Type('currency',{
+		pattern : /^[$????]/, // dollar,pound,yen,euro,generic currency symbol
+		normal : function(v) {
+			return v ? parseFloat(v.replace(/[^-\d\.]/g,'')) : 0;
+		}})
+);
+
+TableKit.Resizable = {
+	init : function(elm, options){
+		var table = $(elm);
+		if(table.tagName !== "TABLE") {return;}
+		TableKit.register(table,Object.extend(options || {},{resizable:true}));		 
+		var cells = TableKit.getHeaderCells(table);
+		cells.each(function(c){
+			c = $(c);
+			Event.observe(c, 'mouseover', TableKit.Resizable.initDetect);
+			Event.observe(c, 'mouseout', TableKit.Resizable.killDetect);
+		});
+	},
+	resize : function(table, index, w) {
+		var cell;
+		if(typeof index === 'number') {
+			if(!table || (table.tagName && table.tagName !== "TABLE")) {return;}
+			table = $(table);
+			index = Math.min(table.rows[0].cells.length, index);
+			index = Math.max(1, index);
+			index -= 1;
+			cell = (table.tHead && table.tHead.rows.length > 0) ? $(table.tHead.rows[table.tHead.rows.length-1].cells[index]) : $(table.rows[0].cells[index]);
+		} else {
+			cell = $(index);
+			table = table ? $(table) : cell.up('table');
+			index = TableKit.getCellIndex(cell);
+		}
+		var pad = parseInt(cell.getStyle('paddingLeft'),10) + parseInt(cell.getStyle('paddingRight'),10);
+		w = Math.max(w-pad, TableKit.option('minWidth', table.id)[0]);
+		
+		cell.setStyle({'width' : w + 'px'});
+	},
+	initDetect : function(e) {
+		e = TableKit.e(e);
+		var cell = Event.element(e);
+		Event.observe(cell, 'mousemove', TableKit.Resizable.detectHandle);
+		Event.observe(cell, 'mousedown', TableKit.Resizable.startResize);
+	},
+	detectHandle : function(e) {
+		e = TableKit.e(e);
+		var cell = Event.element(e);
+  		if(TableKit.Resizable.pointerPos(cell,Event.pointerX(e),Event.pointerY(e))){
+  			cell.addClassName(TableKit.option('resizeOnHandleClass', cell.up('table').id)[0]);
+  			TableKit.Resizable._onHandle = true;
+  		} else {
+  			cell.removeClassName(TableKit.option('resizeOnHandleClass', cell.up('table').id)[0]);
+  			TableKit.Resizable._onHandle = false;
+  		}
+	},
+	killDetect : function(e) {
+		e = TableKit.e(e);
+		TableKit.Resizable._onHandle = false;
+		var cell = Event.element(e);
+		Event.stopObserving(cell, 'mousemove', TableKit.Resizable.detectHandle);
+		Event.stopObserving(cell, 'mousedown', TableKit.Resizable.startResize);
+		cell.removeClassName(TableKit.option('resizeOnHandleClass', cell.up('table').id)[0]);
+	},
+	startResize : function(e) {
+		e = TableKit.e(e);
+		if(!TableKit.Resizable._onHandle) {return;}
+		var cell = Event.element(e);
+		Event.stopObserving(cell, 'mousemove', TableKit.Resizable.detectHandle);
+		Event.stopObserving(cell, 'mousedown', TableKit.Resizable.startResize);
+		Event.stopObserving(cell, 'mouseout', TableKit.Resizable.killDetect);
+		TableKit.Resizable._cell = cell;
+		var table = cell.up('table');
+		TableKit.Resizable._tbl = table;
+		if(TableKit.option('showHandle', table.id)[0]) {
+			TableKit.Resizable._handle = $(document.createElement('div')).addClassName('resize-handle').setStyle({
+				'top' : Position.cumulativeOffset(cell)[1] + 'px',
+				'left' : Event.pointerX(e) + 'px',
+				'height' : table.getDimensions().height + 'px'
+			});
+			document.body.appendChild(TableKit.Resizable._handle);
+		}
+		Event.observe(document, 'mousemove', TableKit.Resizable.drag);
+		Event.observe(document, 'mouseup', TableKit.Resizable.endResize);
+		Event.stop(e);
+	},
+	endResize : function(e) {
+		e = TableKit.e(e);
+		var cell = TableKit.Resizable._cell;
+		TableKit.Resizable.resize(null, cell, (Event.pointerX(e) - Position.cumulativeOffset(cell)[0]));
+		Event.stopObserving(document, 'mousemove', TableKit.Resizable.drag);
+		Event.stopObserving(document, 'mouseup', TableKit.Resizable.endResize);
+		if(TableKit.option('showHandle', TableKit.Resizable._tbl.id)[0]) {
+			$$('div.resize-handle').each(function(elm){
+				document.body.removeChild(elm);
+			});
+		}
+		Event.observe(cell, 'mouseout', TableKit.Resizable.killDetect);
+		TableKit.Resizable._tbl = TableKit.Resizable._handle = TableKit.Resizable._cell = null;
+		Event.stop(e);
+	},
+	drag : function(e) {
+		e = TableKit.e(e);
+		if(TableKit.Resizable._handle === null) {
+			try {
+				TableKit.Resizable.resize(TableKit.Resizable._tbl, TableKit.Resizable._cell, (Event.pointerX(e) - Position.cumulativeOffset(TableKit.Resizable._cell)[0]));
+			} catch(e) {}
+		} else {
+			TableKit.Resizable._handle.setStyle({'left' : Event.pointerX(e) + 'px'});
+		}
+		return false;
+	},
+	pointerPos : function(element, x, y) {
+    	var offset = Position.cumulativeOffset(element);
+	    return (y >= offset[1] &&
+	            y <  offset[1] + element.offsetHeight &&
+	            x >= offset[0] + element.offsetWidth - 5 &&
+	            x <  offset[0] + element.offsetWidth);
+  	},
+	_onHandle : false,
+	_cell : null,
+	_tbl : null,
+	_handle : null
+};
+
+
+TableKit.Editable = {
+	init : function(elm, options){
+		var table = $(elm);
+		if(table.tagName !== "TABLE") {return;}
+		TableKit.register(table,Object.extend(options || {},{editable:true}));
+		Event.observe(table.tBodies[0], 'click', TableKit.Editable._editCell);
+	},
+	_editCell : function(e) {
+		e = TableKit.e(e);
+		var cell = Event.findElement(e,'td');
+		TableKit.Editable.editCell(null, cell);
+	},
+	editCell : function(table, index, cindex) {
+		var cell, row;
+		if(typeof index === 'number') {
+			if(!table || (table.tagName && table.tagName !== "TABLE")) {return;}
+			table = $(table);
+			index = Math.min(table.tBodies[0].rows.length, index);
+			index = Math.max(1, index);
+			index -= 1;
+			cindex = Math.min(table.rows[0].cells.length, cindex);
+			cindex = Math.max(1, cindex);
+			cindex -= 1;
+			row = $(table.tBodies[0].rows[index]);
+			cell = $(row.cells[cindex]);
+		} else {
+			cell = $(index);
+			table = (table && table.tagName && table.tagName !== "TABLE") ? $(table) : cell.up('table');
+			row = cell.up('tr');
+		}
+		var op = TableKit.option('noEditClass', table.id);
+		if(cell.hasClassName(op.noEditClass)) {return;}
+		
+		var head = $(TableKit.getHeaderCells(table, cell)[TableKit.getCellIndex(cell)]);
+		if(head.hasClassName(op.noEditClass)) {return;}
+		
+		TableKit.registerCell(cell);
+		var data = TableKit.cells[cell.id];
+		if(data.active) {return;}
+		data.htmlContent = cell.innerHTML;
+		var ftype = TableKit.Editable.types['text-input'];
+		if(head.id && TableKit.Editable.types[head.id]) {
+			ftype = TableKit.Editable.types[head.id];
+		} else {
+			var n = head.classNames().detect(function(n){
+					return (TableKit.Editable.types[n]) ? true : false;
+			});
+			ftype = n ? TableKit.Editable.types[n] : ftype;
+		}
+		ftype.edit(cell);
+		data.active = true;
+	},
+	types : {},
+	addCellEditor : function(o) {
+		if(o && o.name) { TableKit.Editable.types[o.name] = o; }
+	}
+};
+
+TableKit.Editable.CellEditor = Class.create();
+TableKit.Editable.CellEditor.prototype = {
+	initialize : function(name, options){
+		this.name = name;
+		this.options = Object.extend({
+			element : 'input',
+			attributes : {name : 'value', type : 'text'},
+			selectOptions : [],
+			showSubmit : true,
+			submitText : 'OK',
+			showCancel : true,
+			cancelText : 'Cancel',
+			ajaxURI : null,
+			ajaxOptions : null
+		}, options || {});
+	},
+	edit : function(cell) {
+		cell = $(cell);
+		var op = this.options;
+		var table = cell.up('table');
+		
+		var form = $(document.createElement("form"));
+		form.id = cell.id + '-form';
+		form.addClassName(TableKit.option('formClassName', table.id)[0]);
+		form.onsubmit = this._submit.bindAsEventListener(this);
+		
+		var field = document.createElement(op.element);
+			$H(op.attributes).each(function(v){
+				field[v.key] = v.value;
+			});
+			switch(op.element) {
+				case 'input':
+				case 'textarea':
+				field.value = TableKit.getCellText(cell);
+				break;
+				
+				case 'select':
+				var txt = TableKit.getCellText(cell);
+				$A(op.selectOptions).each(function(v){
+					field.options[field.options.length] = new Option(v[0], v[1]);
+					if(txt === v[1]) {
+						field.options[field.options.length-1].selected = 'selected';
+					}
+				});
+				break;
+			}
+			form.appendChild(field);
+			if(op.element === 'textarea') {
+				form.appendChild(document.createElement("br"));
+			}
+			if(op.showSubmit) {
+				var okButton = document.createElement("input");
+				okButton.type = "submit";
+				okButton.value = op.submitText;
+				okButton.className = 'editor_ok_button';
+				form.appendChild(okButton);
+			}
+			if(op.showCancel) {
+				var cancelLink = document.createElement("a");
+				cancelLink.href = "#";
+				cancelLink.appendChild(document.createTextNode(op.cancelText));
+				cancelLink.onclick = this._cancel.bindAsEventListener(this);
+				cancelLink.className = 'editor_cancel';      
+				form.appendChild(cancelLink);
+			}
+			cell.innerHTML = '';
+			cell.appendChild(form);
+	},
+	_submit : function(e) {
+		var cell = Event.findElement(e,'td');
+		var form = Event.findElement(e,'form');
+		Event.stop(e);
+		this.submit(cell,form);
+	},
+	submit : function(cell, form) {
+		var op = this.options;
+		form = form ? form : cell.down('form');
+		var head = $(TableKit.getHeaderCells(null, cell)[TableKit.getCellIndex(cell)]);
+		var row = cell.up('tr');
+		var table = cell.up('table');
+		var s = '&row=' + (TableKit.getRowIndex(row)+1) + '&cell=' + (TableKit.getCellIndex(cell)+1) + '&id=' + row.id + '&field=' + head.id + '&' + Form.serialize(form);
+		this.ajax = new Ajax.Updater(cell, op.ajaxURI || TableKit.option('editAjaxURI', table.id)[0], Object.extend(op.ajaxOptions || TableKit.option('editAjaxOptions', table.id)[0], {
+			postBody : s,
+			onComplete : function() {
+				var data = TableKit.cells[cell.id];
+				data.active = false;
+				data.refresh = true; // mark cell cache for refreshing, in case cell contents has changed and sorting is applied
+			}
+		}));
+	},
+	_cancel : function(e) {
+		var cell = Event.findElement(e,'td');
+		Event.stop(e);
+		this.cancel(cell);
+	},
+	cancel : function(cell) {
+		this.ajax = null;
+		var data = TableKit.cells[cell.id];
+		cell.innerHTML = data.htmlContent;
+		data.htmlContent = '';
+		data.active = false;
+	},
+	ajax : null
+};
+
+TableKit.Editable.textInput = function(n,attributes) {
+	TableKit.Editable.addCellEditor(new TableKit.Editable.CellEditor(n, {
+		element : 'input',
+		attributes : Object.extend({name : 'value', type : 'text'}, attributes||{})
+	}));
+};
+TableKit.Editable.textInput('text-input');
+
+TableKit.Editable.multiLineInput = function(n,attributes) {
+	TableKit.Editable.addCellEditor(new TableKit.Editable.CellEditor(n, {
+		element : 'textarea',
+		attributes : Object.extend({name : 'value', rows : '5', cols : '20'}, attributes||{})
+	}));	
+};	
+TableKit.Editable.multiLineInput('multi-line-input');
+
+TableKit.Editable.selectInput = function(n,attributes,selectOptions) {
+	TableKit.Editable.addCellEditor(new TableKit.Editable.CellEditor(n, {
+		element : 'select',
+		attributes : Object.extend({name : 'value'}, attributes||{}),
+		'selectOptions' : selectOptions
+	}));	
+};
+
+/*
+TableKit.Bench = {
+	bench : [],
+	start : function(){
+		TableKit.Bench.bench[0] = new Date().getTime();
+	},
+	end : function(s){
+		TableKit.Bench.bench[1] = new Date().getTime();
+		alert(s + ' ' + ((TableKit.Bench.bench[1]-TableKit.Bench.bench[0])/1000)+' seconds.') //console.log(s + ' ' + ((TableKit.Bench.bench[1]-TableKit.Bench.bench[0])/1000)+' seconds.')
+		TableKit.Bench.bench = [];
+	}
+} */
+
+if(window.FastInit) {
+	FastInit.addOnLoad(TableKit.load);
+} else {
+	Event.observe(window, 'load', TableKit.load);
+}
\ No newline at end of file
diff -r 7efa620853f6 -r 698d4ac367ff ipa-server/ipa-gui/ipagui/templates/userlist.kid
--- a/ipa-server/ipa-gui/ipagui/templates/userlist.kid	Thu Sep 13 10:18:41 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/userlist.kid	Thu Sep 13 10:26:35 2007 -0700
@@ -6,6 +6,7 @@
 <title>Find People</title>
 </head>
 <body>
+    <script type="text/javascript" charset="utf-8" src="${tg.url('/static/javascript/tablekit.js')}"></script>
     <div id="search">
         <form action="${tg.url('/userlist')}" method="post">
             <input id="uid" type="text" name="uid" value="${uid}" />
@@ -17,10 +18,11 @@
     </div>
     <div py:if='(users != None) and (len(users) > 0)'>
         <h2>${len(users)} results returned:</h2>
-        <table id="resultstable">
+        <table id="resultstable" class="sortable resizable">
+          <thead>
             <tr>
                 <th>
-                    <label class="fieldlabel" py:content="fields.uid.label" />
+                    ${fields.uid.label}
                 </th>
                 <th>
                     Name
@@ -38,6 +40,8 @@
                     License Plate
                 </th>
             </tr>
+          </thead>
+          <tbody>
             <tr py:for="user in users">
                 <td>
                     <a href="${tg.url('/usershow',uid=user.uid)}">${user.uid}</a>
@@ -58,6 +62,7 @@
                     ${user.carLicense}
                 </td>
             </tr>
+          </tbody>
         </table>
     </div>
     <div py:if='(users != None) and (len(users) == 0)'>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070913/62771c3e/attachment.bin>

From kmccarth at redhat.com  Thu Sep 13 17:29:19 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 13 Sep 2007 10:29:19 -0700
Subject: [Freeipa-devel] [PATCH] javascript sorting of user results
	w/tablekit
In-Reply-To: <20070913172712.GA19864@moon.usersys.redhat.com>
References: <20070913172712.GA19864@moon.usersys.redhat.com>
Message-ID: <20070913172919.GB19864@moon.usersys.redhat.com>

Kevin McCarthy wrote:
> This patch adds the tablekit package:
> http://www.millstream.com.au/view/code/tablekit/ (licensed under MIT)
> and uses it to add javascript table sorting for the user results.

The patch needs the attached two images to be put in 
ipa-server/ipa-gui/ipagui/static/images

Thanks,

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: down.gif
Type: image/gif
Size: 57 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070913/42e69070/attachment.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: up.gif
Type: image/gif
Size: 56 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070913/42e69070/attachment-0001.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070913/42e69070/attachment.bin>

From rcritten at redhat.com  Thu Sep 13 18:24:17 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Thu, 13 Sep 2007 14:24:17 -0400
Subject: [Freeipa-devel] [PATCH] ticket forwarding and TurboGears
Message-ID: <46E98051.3020703@redhat.com>

I got ticket forwarding working with TurboGears yesterday. This raises 
some issues though. First an explanation of how I'm doing it.

I require Kerberos auth for connections to Apache. If delegation is 
available then Apache will save a copy of the ticket.

For the XML-RPC interface this is enough as it runs through mod_python. 
We grab a pointer to the file and use the ticket.

With TurboGears I'm using mod_proxy to forward the requests after 
authentication. What I do is grab a copy of the environment variables 
REMOTE_USER and KRB5CCNAME and include those as request headers to 
TurboGears. TG then can identify the principle and the location of that 
users keytab. We will need to restrict the TurboGears listener to 
localhost. If we wanted to be absolutely sure that nothing funny was 
going on we could use the Authorization header to re-verify the ticket. 
I lack the kerberos know-how to do this.

This means we can do away with all the proxying mess and not issue a 
client cert to the web server.

Do we want to go ahead and remove that now or leave it in as dead code? 
We can remove the proxy ACIs which will prevent people from proxying in 
and leave the code alone for a while I suppose.

For GUI developers there is a way to not use mod_proxy and continue 
contacting it directly. What you'll need to do is look in 
ipa-gui/ipagui/proxyprovider.py and hardcode the principal name and 
keytab location. For the keytab run: kinit | grep FILE and use the whole 
FILE: url.

And remember, this requires the mod_auth_kerb that I supplied earlier.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-179-ticket.patch
Type: text/x-patch
Size: 6874 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070913/61a88311/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070913/61a88311/attachment-0001.bin>

From prowley at redhat.com  Thu Sep 13 18:39:11 2007
From: prowley at redhat.com (Pete Rowley)
Date: Thu, 13 Sep 2007 11:39:11 -0700
Subject: [Freeipa-devel] [PATCH] ticket forwarding and TurboGears
In-Reply-To: <46E98051.3020703@redhat.com>
References: <46E98051.3020703@redhat.com>
Message-ID: <46E983CF.9070002@redhat.com>

Rob Crittenden wrote:
> This means we can do away with all the proxying mess and not issue a 
> client cert to the web server.
>
> Do we want to go ahead and remove that now or leave it in as dead 
> code? We can remove the proxy ACIs which will prevent people from 
> proxying in and leave the code alone for a while I suppose.
I think that is a decent way of dealing with this. Since the code is 
already written we can use it as a backup in case ticket forwarding is 
not appropriate for some reason. Once real deployments have kicked the 
tires a few times we will be in a better position to see what may be needed.

-- 
Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070913/359238a6/attachment.bin>

From rcritten at redhat.com  Thu Sep 13 19:19:06 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Thu, 13 Sep 2007 15:19:06 -0400
Subject: [Freeipa-devel] [PATCH] javascript sorting of user
	results	w/tablekit
In-Reply-To: <20070913172712.GA19864@moon.usersys.redhat.com>
References: <20070913172712.GA19864@moon.usersys.redhat.com>
Message-ID: <46E98D2A.6090801@redhat.com>

Kevin McCarthy wrote:
> This patch adds the tablekit package:
> http://www.millstream.com.au/view/code/tablekit/ (licensed under MIT)
> and uses it to add javascript table sorting for the user results.
> 
> -Kevin
> 
>

+1

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070913/25a01e69/attachment.bin>

From ssorce at redhat.com  Thu Sep 13 19:29:54 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 13 Sep 2007 15:29:54 -0400
Subject: [Freeipa-devel] [PATCH] javascript sorting of user results
	w/tablekit
In-Reply-To: <20070913172919.GB19864@moon.usersys.redhat.com>
References: <20070913172712.GA19864@moon.usersys.redhat.com>
	<20070913172919.GB19864@moon.usersys.redhat.com>
Message-ID: <1189711794.18288.30.camel@localhost.localdomain>

On Thu, 2007-09-13 at 10:29 -0700, Kevin McCarthy wrote:
> Kevin McCarthy wrote:
> > This patch adds the tablekit package:
> > http://www.millstream.com.au/view/code/tablekit/ (licensed under MIT)
> > and uses it to add javascript table sorting for the user results.
> 
> The patch needs the attached two images to be put in 
> ipa-server/ipa-gui/ipagui/static/images

Can you send them it in form of a patch as well ?

Simo.



From kmccarth at redhat.com  Thu Sep 13 19:44:12 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 13 Sep 2007 12:44:12 -0700
Subject: [Freeipa-devel] [PATCH] javascript sorting of user results
	w/tablekit
In-Reply-To: <1189711794.18288.30.camel@localhost.localdomain>
References: <20070913172712.GA19864@moon.usersys.redhat.com>
	<20070913172919.GB19864@moon.usersys.redhat.com>
	<1189711794.18288.30.camel@localhost.localdomain>
Message-ID: <20070913194412.GC19864@moon.usersys.redhat.com>

Simo Sorce wrote:
> On Thu, 2007-09-13 at 10:29 -0700, Kevin McCarthy wrote:
> > Kevin McCarthy wrote:
> > > This patch adds the tablekit package:
> > > http://www.millstream.com.au/view/code/tablekit/ (licensed under MIT)
> > > and uses it to add javascript table sorting for the user results.
> > 
> > The patch needs the attached two images to be put in 
> > ipa-server/ipa-gui/ipagui/static/images
> 
> Can you send them it in form of a patch as well ?

No, unfortunately, binary files don't come through as a patch.  I don't
have a good solution to this problem.  :-/

-Kevin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070913/7182cc04/attachment.bin>

From kmccarth at redhat.com  Thu Sep 13 19:45:41 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 13 Sep 2007 12:45:41 -0700
Subject: [Freeipa-devel] [PATCH] ticket forwarding and TurboGears
In-Reply-To: <46E98051.3020703@redhat.com>
References: <46E98051.3020703@redhat.com>
Message-ID: <20070913194540.GD19864@moon.usersys.redhat.com>

Rob Crittenden wrote:
> I got ticket forwarding working with TurboGears yesterday. This raises some 
> issues though. First an explanation of how I'm doing it.

Looks good.  (Of course, I'm not an Kerberos person - just saying that
the TG changes look good.)

-Kevin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070913/0eaca813/attachment.bin>

From nalin at redhat.com  Fri Sep 14 20:08:37 2007
From: nalin at redhat.com (Nalin Dahyabhai)
Date: Fri, 14 Sep 2007 16:08:37 -0400
Subject: [Freeipa-devel] [PATCH] ticket forwarding and TurboGears
In-Reply-To: <46E98051.3020703@redhat.com>
References: <46E98051.3020703@redhat.com>
Message-ID: <20070914200837.GA9414@redhat.com>

On Thu, Sep 13, 2007 at 02:24:17PM -0400, Rob Crittenden wrote:
> With TurboGears I'm using mod_proxy to forward the requests after 
> authentication. What I do is grab a copy of the environment variables 
> REMOTE_USER and KRB5CCNAME and include those as request headers to 
> TurboGears. TG then can identify the principle and the location of that 
> users keytab.

I can't comment on the rest (not enough familiarity with it), but what
you're calling a keytab here is actually a credential cache -- a keytab
file is something rather different, and the use of the terms here
confused the heck out of me.

Cheers,

Nalin



From rcritten at redhat.com  Fri Sep 14 21:34:00 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 14 Sep 2007 17:34:00 -0400
Subject: [Freeipa-devel] [PATCH] ticket forwarding and TurboGears
In-Reply-To: <20070914200837.GA9414@redhat.com>
References: <46E98051.3020703@redhat.com> <20070914200837.GA9414@redhat.com>
Message-ID: <46EAFE48.5090203@redhat.com>

Nalin Dahyabhai wrote:
> On Thu, Sep 13, 2007 at 02:24:17PM -0400, Rob Crittenden wrote:
>> With TurboGears I'm using mod_proxy to forward the requests after 
>> authentication. What I do is grab a copy of the environment variables 
>> REMOTE_USER and KRB5CCNAME and include those as request headers to 
>> TurboGears. TG then can identify the principle and the location of that 
>> users keytab.
> 
> I can't comment on the rest (not enough familiarity with it), but what
> you're calling a keytab here is actually a credential cache -- a keytab
> file is something rather different, and the use of the terms here
> confused the heck out of me.
> 
> Cheers,
> 
> Nalin

Ok, here is a replacement patch for freeipa-179-ticket.patch that uses a 
better variable name.

rob
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: freeipa-179-ticket.patch2
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070914/0197f5a3/attachment.ksh>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070914/0197f5a3/attachment.bin>

From kmccarth at redhat.com  Fri Sep 14 22:20:00 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Fri, 14 Sep 2007 15:20:00 -0700
Subject: [Freeipa-devel] [PATCH] draft of group member management
Message-ID: <20070914221959.GD17116@moon.usersys.redhat.com>

This is half finished, but suitable for a code review.  I'll also push
to demo so you can play with it.

This is basic group member management.  There are still a lot of issues
to deal with, but it is functional.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189808409 25200
# Node ID 22f90eaa60da6f1ef6cd85335482f8b65166d9bc
# Parent  c35fdc2573b634dbdf2b4b219c88666dd1dd66b4
patch queue: groupmember.patch

diff -r c35fdc2573b6 -r 22f90eaa60da ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Thu Sep 13 10:55:56 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Fri Sep 14 15:20:09 2007 -0700
@@ -120,17 +120,21 @@ class Root(controllers.RootController):
         if tg_errors:
             turbogears.flash("There was a problem with the form!")
 
-        client.set_principal(identity.current.user_name)
-        user = client.get_user_by_uid(uid, user_fields)
-        user_dict = user.toDict()
-        # Edit shouldn't fill in the password field.
-        if user_dict.has_key('userpassword'):
-            del(user_dict['userpassword'])
-
-        # store a copy of the original user for the update later
-        user_data = b64encode(dumps(user_dict))
-        user_dict['user_orig'] = user_data
-        return dict(form=user_edit_form, user=user_dict)
+        try:
+            client.set_principal(identity.current.user_name)
+            user = client.get_user_by_uid(uid, user_fields)
+            user_dict = user.toDict()
+            # Edit shouldn't fill in the password field.
+            if user_dict.has_key('userpassword'):
+                del(user_dict['userpassword'])
+
+            # store a copy of the original user for the update later
+            user_data = b64encode(dumps(user_dict))
+            user_dict['user_orig'] = user_data
+            return dict(form=user_edit_form, user=user_dict)
+        except ipaerror.IPAError, e:
+            turbogears.flash("User edit failed: " + str(e))
+            raise turbogears.redirect('/usershow', uid=kw.get('uid'))
 
     @expose()
     @identity.require(identity.not_anonymous())
@@ -204,6 +208,24 @@ class Root(controllers.RootController):
 
         return dict(users=users, uid=uid, fields=forms.user.UserFields())
 
+    @expose("ipagui.templates.userlistajax")
+    @identity.require(identity.not_anonymous())
+    def userlist_ajax(self, **kw):
+        """Searches for users and displays list of results in a table.
+           This method is used for ajax calls."""
+        client.set_principal(identity.current.user_name)
+        users = []
+        uid = kw.get('uid')
+        if uid != None and len(uid) > 0:
+            try:
+                users = client.find_users(uid.encode('utf-8'))
+                counter = users[0]
+                users = users[1:]
+            except ipaerror.IPAError, e:
+                turbogears.flash("User list failed: " + str(e))
+
+        return dict(users=users, uid=uid, fields=forms.user.UserFields())
+
 
     @expose("ipagui.templates.usershow")
     @identity.require(identity.not_anonymous())
@@ -371,8 +393,7 @@ class Root(controllers.RootController):
 
             rv = client.add_group(new_group)
             turbogears.flash("%s added!" % kw.get('cn'))
-            # raise turbogears.redirect('/groupedit', cn=kw['cn'])
-            raise turbogears.redirect('/')
+            raise turbogears.redirect('/groupshow', cn=kw.get('cn'))
         except ipaerror.exception_for(ipaerror.LDAP_DUPLICATE):
             turbogears.flash("Group with name '%s' already exists" %
                     kw.get('cn'))
@@ -390,13 +411,43 @@ class Root(controllers.RootController):
             turbogears.flash("There was a problem with the form!")
 
         client.set_principal(identity.current.user_name)
-        group = client.get_group_by_cn(cn, group_fields)
-        group_dict = group.toDict()
-
-        # store a copy of the original group for the update later
-        group_data = b64encode(dumps(group_dict))
-        group_dict['group_orig'] = group_data
-        return dict(form=group_edit_form, group=group_dict)
+        try:
+            group = client.get_group_by_cn(cn, group_fields)
+
+            group_dict = group.toDict()
+
+            #
+            # convert members to users, for easier manipulation on the page
+            #
+            member_dns = []
+            if group_dict.has_key('uniquemember'):
+                member_dns = group_dict.get('uniquemember')
+                # remove from dict - it's not needed for update
+                # and we are storing the members in a different form
+                del group_dict['uniquemember']
+            if not(isinstance(member_dns,list) or isinstance(member_dns,tuple)):
+                member_dns = [member_dns]
+
+            # TODO: convert this into an efficient (single) function call
+            member_users = map(
+                    lambda dn: client.get_user_by_dn(dn, ['givenname', 'sn', 'uid']),
+                    member_dns)
+
+            # Map users into an array of dicts, which can be serialized
+            # (so we don't have to do this on each round trip)
+            member_dicts = map(lambda user: user.toDict(), member_users)
+
+            # store a copy of the original group for the update later
+            group_data = b64encode(dumps(group_dict))
+            member_data = b64encode(dumps(member_dicts))
+            group_dict['group_orig'] = group_data
+            group_dict['member_data'] = member_data
+
+            return dict(form=group_edit_form, group=group_dict, members=member_dicts)
+        except ipaerror.IPAError, e:
+            turbogears.flash("User show failed: " + str(e))
+            turbogears.flash("Group edit failed: " + str(e))
+            raise turbogears.redirect('/groupshow', uid=kw.get('cn'))
 
     @expose()
     @identity.require(identity.not_anonymous())
@@ -408,26 +459,83 @@ class Root(controllers.RootController):
             turbogears.flash("Edit group cancelled")
             raise turbogears.redirect('/groupshow', cn=kw.get('cn'))
 
+        # Decode the member data, in case we need to round trip
+        member_dicts = loads(b64decode(kw.get('member_data')))
+
+
         tg_errors, kw = self.groupupdatevalidate(**kw)
         if tg_errors:
-            return dict(form=group_edit_form, group=kw,
+            return dict(form=group_edit_form, group=kw, members=member_dicts,
                         tg_template='ipagui.templates.groupedit')
 
+        group_modified = False
+
+        #
+        # Update group itself
+        #
         try:
             orig_group_dict = loads(b64decode(kw.get('group_orig')))
 
             new_group = ipa.group.Group(orig_group_dict)
-            new_group.setValue('description', kw.get('description'))
+            if new_group.description != kw.get('description'):
+                group_modified = True
+                new_group.setValue('description', kw.get('description'))
             if kw.get('gidnumber'):
+                group_modified = True
                 new_group.setValue('gidnumber', str(kw.get('gidnumber')))
 
-            rv = client.update_group(new_group)
-            turbogears.flash("%s updated!" % kw['cn'])
-            raise turbogears.redirect('/groupshow', cn=kw['cn'])
+            if group_modified:
+                rv = client.update_group(new_group)
+            #
+            # TODO - if the group update succeeds, but below operations fail,
+            # we needs to make sure a subsequent submit doesn't try to update
+            # the group again.  Probably by overwriting the group_orig hidden
+            # field blob.
+            #
         except ipaerror.IPAError, e:
             turbogears.flash("User update failed: " + str(e))
-            return dict(form=group_edit_form, group=kw,
+            return dict(form=group_edit_form, group=kw, members=member_dicts,
                         tg_template='ipagui.templates.groupedit')
+
+        #
+        # Add members
+        #
+        try:
+            uidadds = kw.get('uidadd')
+            if uidadds != None:
+                if not(isinstance(uidadds,list) or isinstance(uidadds,tuple)):
+                    uidadds = [uidadds]
+                failed = client.add_users_to_group(uidadds, kw.get('cn'))
+                #
+                # TODO - deal with failed adds
+                #
+        except ipaerror.IPAError, e:
+            turbogears.flash("User update failed: " + str(e))
+            return dict(form=group_edit_form, group=kw, members=member_dicts,
+                        tg_template='ipagui.templates.groupedit')
+
+        #
+        # Remove members
+        #
+        try:
+            uiddels = kw.get('uiddel')
+            if uiddels != None:
+                if not(isinstance(uiddels,list) or isinstance(uiddels,tuple)):
+                    uiddels = [uiddels]
+                failed = client.remove_users_from_group(uiddels, kw.get('cn'))
+                #
+                # TODO - deal with failed removals
+                #
+        except ipaerror.IPAError, e:
+            turbogears.flash("User update failed: " + str(e))
+            return dict(form=group_edit_form, group=kw, members=member_dicts,
+                        tg_template='ipagui.templates.groupedit')
+
+        # TODO if not group_modified
+
+        turbogears.flash("%s updated!" % kw['cn'])
+        raise turbogears.redirect('/groupshow', cn=kw['cn'])
+
 
     @expose("ipagui.templates.grouplist")
     @identity.require(identity.not_anonymous())
@@ -458,7 +566,25 @@ class Root(controllers.RootController):
         client.set_principal(identity.current.user_name)
         try:
             group = client.get_group_by_cn(cn, group_fields)
-            return dict(group=group.toDict(), fields=forms.group.GroupFields())
+            group_dict = group.toDict()
+
+            #
+            # convert members to users, for display on the page
+            #
+            member_dns = []
+            if group_dict.has_key('uniquemember'):
+                member_dns = group_dict.get('uniquemember')
+            if not(isinstance(member_dns,list) or isinstance(member_dns,tuple)):
+                member_dns = [member_dns]
+
+            # TODO: convert this into an efficient (single) function call
+            member_users = map(
+                    lambda dn: client.get_user_by_dn(dn, ['givenname', 'sn', 'uid']),
+                    member_dns)
+            member_dicts = map(lambda user: user.toDict(), member_users)
+
+            return dict(group=group_dict, fields=forms.group.GroupFields(),
+                    members = member_dicts)
         except ipaerror.IPAError, e:
             turbogears.flash("Group show failed: " + str(e))
             raise turbogears.redirect("/")
diff -r c35fdc2573b6 -r 22f90eaa60da ipa-server/ipa-gui/ipagui/forms/group.py
--- a/ipa-server/ipa-gui/ipagui/forms/group.py	Thu Sep 13 10:55:56 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/group.py	Fri Sep 14 15:20:09 2007 -0700
@@ -9,6 +9,7 @@ class GroupFields():
     cn_hidden = widgets.HiddenField(name="cn")
 
     group_orig = widgets.HiddenField(name="group_orig")
+    member_data = widgets.HiddenField(name="member_data")
 
 class GroupNewValidator(validators.Schema):
     cn = validators.PlainText(not_empty=True)
@@ -36,11 +37,11 @@ class GroupEditValidator(validators.Sche
     description = validators.String(not_empty=False)
 
 class GroupEditForm(widgets.Form):
-    params = ['group']
+    params = ['members', 'group']
 
     fields = [GroupFields.gidnumber, GroupFields.description,
               GroupFields.cn_hidden,
-              GroupFields.group_orig]
+              GroupFields.group_orig, GroupFields.member_data]
 
     validator = GroupEditValidator()
 
diff -r c35fdc2573b6 -r 22f90eaa60da ipa-server/ipa-gui/ipagui/templates/groupedit.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupedit.kid	Thu Sep 13 10:55:56 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupedit.kid	Fri Sep 14 15:20:09 2007 -0700
@@ -16,6 +16,6 @@
     <h2>Edit Group</h2>
   </div>
 
-  ${form.display(action="groupupdate", value=group)}
+  ${form.display(action="groupupdate", value=group, members=members)}
 </body>
 </html>
diff -r c35fdc2573b6 -r 22f90eaa60da ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Thu Sep 13 10:55:56 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Fri Sep 14 15:20:09 2007 -0700
@@ -2,14 +2,112 @@
   class="simpleroster">
   <form action="${action}" name="${name}" method="${method}" class="tableform">
 
+
+  <?python searchurl = tg.url('/userlist_ajax') ?>
+
   <script type="text/javascript">
     function toggleProtectedFields(checkbox) {
-      gidnumberField = document.getElementById('form_gidnumber');
+      gidnumberField = $('form_gidnumber');
       if (checkbox.checked) {
         gidnumberField.disabled = false;
       } else {
         gidnumberField.disabled = true;
       }
+    }
+
+    /*
+     * Callback used for afterFinish in scriptaculous effect
+     */
+    function removeElement(effect) {
+      Element.remove(effect.element);
+    }
+
+    function adduser(uid, cn) {
+      newdiv = document.createElement('div');
+      newdiv.appendChild(document.createTextNode(
+        cn.escapeHTML() + " (" + uid.escapeHTML() + ") "));
+
+      undolink = document.createElement('a');
+      undolink.setAttribute('href', '');
+      undolink.setAttribute('onclick',
+        'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' +
+        'return false;');
+      undolink.appendChild(document.createTextNode("undo"));
+      newdiv.appendChild(undolink);
+
+      uidInfo = document.createElement('input');
+      uidInfo.setAttribute('type', 'hidden');
+      uidInfo.setAttribute('name', 'uidadd');
+      uidInfo.setAttribute('value', uid);
+      newdiv.appendChild(uidInfo);
+
+      newdiv.style.display = 'none';
+      $('newmembers').appendChild(newdiv);
+
+      return newdiv
+    }
+
+    function adduserHandler(element, uid, cn) {
+      newdiv = adduser(uid, cn)
+      new Effect.Fade(Element.up(element));
+      new Effect.Appear(newdiv);
+      /* Element.up(element).remove(); */
+    }
+
+    function removeuser(uid, cn) {
+      newdiv = document.createElement('div');
+      newdiv.appendChild(document.createTextNode(
+        cn.escapeHTML() + " (" + uid.escapeHTML() + ") "));
+
+      undolink = document.createElement('a');
+      undolink.setAttribute('href', '');
+      undolink.setAttribute('onclick',
+        'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' +
+        "new Effect.Appear($('member-" + uid + "'));" +
+        'return false;');
+      undolink.appendChild(document.createTextNode("undo"));
+      newdiv.appendChild(undolink);
+
+      uidInfo = document.createElement('input');
+      uidInfo.setAttribute('type', 'hidden');
+      uidInfo.setAttribute('name', 'uiddel');
+      uidInfo.setAttribute('value', uid);
+      newdiv.appendChild(uidInfo);
+
+      newdiv.style.display = 'none';
+      $('delmembers').appendChild(newdiv);
+
+      return newdiv
+    }
+
+    function removeuserHandler(element, uid, cn) {
+      newdiv = removeuser(uid, cn);
+      new Effect.Fade(Element.up(element));
+      new Effect.Appear(newdiv);
+      /* Element.up(element).remove(); */
+    }
+
+    function enterDoSearch(e) {
+      var keyPressed;
+      if (window.event) {
+        keyPressed = window.event.keyCode;
+      } else {
+        keyPressed = e.which; 
+      }
+
+      if (keyPressed == 13) {
+        return doSearch();
+      } else {
+        return true;
+      }
+    }
+
+    function doSearch() {
+      new Ajax.Updater('searchresults',
+          '${searchurl}',
+          {  asynchronous:true,
+             parameters: { uid: $('uid').value } });
+      return false;
     }
   </script>
 
@@ -63,6 +161,56 @@
       </tr>
     </table>
 
+    <div>
+      <div class="formsection">Group Members</div>
+
+      <div style="float:right; width:50%">
+        <div>To Remove:</div>
+        <div id="delmembers">
+        </div>
+      </div>
+
+      <div>
+        <div py:for="member in members" id="member-${member.get('uid')}">
+          <?python
+          member_uid = member.get('uid')
+          member_name = "%s %s" % (member.get('givenname', ''),
+                                   member.get('sn', ''))
+          ?>
+          ${member_name}
+          <a href="" 
+            onclick="removeuserHandler(this, '${member_uid}', '${member_name}');
+                     return false;"
+          >remove</a>
+        </div>
+      </div>
+
+    </div>
+
+    <div style="clear:both">
+      <div class="formsection">Add Persons</div>
+
+      <div style="float:right; width:50%">
+        <div>To Add:</div>
+        <div id="newmembers">
+        </div>
+      </div>
+
+      <div>
+        <div id="search">
+          <input id="uid" type="text" name="uid"
+            onkeypress="return enterDoSearch(event);" />
+          <input type="button" value="Find Users"
+            onclick="return doSearch();"
+          />
+        </div>
+        <div id="searchresults">
+        </div>
+      </div>
+    </div>
+
+
+
     <table class="formtable" cellpadding="2" cellspacing="0" border="0">
       <tr>
         <th>
diff -r c35fdc2573b6 -r 22f90eaa60da ipa-server/ipa-gui/ipagui/templates/groupshow.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupshow.kid	Thu Sep 13 10:55:56 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupshow.kid	Fri Sep 14 15:20:09 2007 -0700
@@ -32,6 +32,18 @@
         </tr>
     </table>
 
+    <div class="formsection">Group Members</div>
+    <div py:for="member in members">
+      <?python
+      member_name = "%s %s" % (member.get('givenname', ''),
+                               member.get('sn', ''))
+      ?>
+      ${member_name} (${member.get('uid')})
+    </div>
+
+    <br/>
+    <br/>
+
     <a href="${tg.url('/groupedit', cn=group.get('cn'))}">edit</a>
 
 </body>
diff -r c35fdc2573b6 -r 22f90eaa60da ipa-server/ipa-gui/ipagui/templates/userlistajax.kid
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/templates/userlistajax.kid	Fri Sep 14 15:20:09 2007 -0700
@@ -0,0 +1,14 @@
+<div xmlns:py="http://purl.org/kid/ns#">
+    <div py:if='(users != None) and (len(users) > 0)'>
+        <div>${len(users)} results returned:</div>
+        <div py:for="user in users">
+          ${user.givenName} ${user.sn} (${user.uid})
+          <a href="" 
+            onclick="adduserHandler(this, '${user.uid}', '${user.cn}'); return false;"
+          >add</a>
+        </div>
+    </div>
+    <div py:if='(users != None) and (len(users) == 0)'>
+        No results found for "${uid}"
+    </div>
+</div>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070914/0c7ee1fc/attachment.bin>

From ssorce at redhat.com  Mon Sep 17 15:54:50 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Mon, 17 Sep 2007 11:54:50 -0400
Subject: [Freeipa-devel] proposed groupOfEntries
Message-ID: <1190044490.8152.4.camel@localhost.localdomain>

We discussed about the annoying groupOfNames limitation this draft
proposes to solve, should we think of using this?

http://www.ietf.org/internet-drafts/draft-findlay-ldap-groupofentries-00.txt

Simo.



From kmccarth at redhat.com  Mon Sep 17 16:05:12 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Mon, 17 Sep 2007 09:05:12 -0700
Subject: [Freeipa-devel] [PATCH] javascript sorting of user results
	w/tablekit
In-Reply-To: <1189711794.18288.30.camel@localhost.localdomain>
References: <20070913172712.GA19864@moon.usersys.redhat.com>
	<20070913172919.GB19864@moon.usersys.redhat.com>
	<1189711794.18288.30.camel@localhost.localdomain>
Message-ID: <20070917160511.GA3793@moon.usersys.redhat.com>

Simo Sorce wrote:
> On Thu, 2007-09-13 at 10:29 -0700, Kevin McCarthy wrote:
> > Kevin McCarthy wrote:
> > > This patch adds the tablekit package:
> > > http://www.millstream.com.au/view/code/tablekit/ (licensed under MIT)
> > > and uses it to add javascript table sorting for the user results.
> > 
> > The patch needs the attached two images to be put in 
> > ipa-server/ipa-gui/ipagui/static/images
> 
> Can you send them it in form of a patch as well ?

After peeking, there is an option to 'hg export', --git, that may in
fact handle binary files.

I'm attaching a patch file you can use instead.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1189705250 25200
# Node ID 1ec401303027b7e69db36f54435dbae5b11bf0fb
# Parent  560f12c5c74a5ceb778d30883ac0ed72b77f96cd
Adding sort images.

diff --git a/ipa-server/ipa-gui/ipagui/static/images/down.gif b/ipa-server/ipa-gui/ipagui/static/images/down.gif
new file mode 100644
index 0000000000000000000000000000000000000000..c527b4e61d9150fd99f42433a4ebe343df2e4001
GIT binary patch
literal 57
zc${<hbhEHb<Y(YuXkcUjg8%>jEB<5wG8q|kKzxu41Cu~c|H|$M{1FX-e(C;a_p~!H
GSOWlaSq^Ie

diff --git a/ipa-server/ipa-gui/ipagui/static/images/up.gif b/ipa-server/ipa-gui/ipagui/static/images/up.gif
new file mode 100644
index 0000000000000000000000000000000000000000..c5ef548a1ec6a4925162882d83da6dad783ec9c2
GIT binary patch
literal 56
zc${<hbhEHb<Y(YuXkcUjg8%>jEB<5wG8q|kKzxu40~3Ew|H{<|I3F2r+}E}I-U<c=
FYXER84`2WQ

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070917/9e9b8604/attachment.bin>

From prowley at redhat.com  Mon Sep 17 17:59:30 2007
From: prowley at redhat.com (Pete Rowley)
Date: Mon, 17 Sep 2007 10:59:30 -0700
Subject: [Freeipa-devel] proposed groupOfEntries
In-Reply-To: <1190044490.8152.4.camel@localhost.localdomain>
References: <1190044490.8152.4.camel@localhost.localdomain>
Message-ID: <46EEC082.5080506@redhat.com>

Simo Sorce wrote:
> We discussed about the annoying groupOfNames limitation this draft
> proposes to solve, should we think of using this?
>
> http://www.ietf.org/internet-drafts/draft-findlay-ldap-groupofentries-00.txt
>
>   
This would require directory server code - it needs to be supported for 
access control and the like.

-- 
Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070917/106eb084/attachment.bin>

From kmccarth at redhat.com  Mon Sep 17 18:43:47 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Mon, 17 Sep 2007 11:43:47 -0700
Subject: [Freeipa-devel] [PATCH] persist group add and remove lists on
	server round trip
Message-ID: <20070917184347.GB3793@moon.usersys.redhat.com>

This patch persists and restores the add/remove lists on server round
trip.  This is needed for validation failure.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190054808 25200
# Node ID 9a39b5ad527aeaae93a0359bd1ca89ae5652bc3c
# Parent  22f90eaa60da6f1ef6cd85335482f8b65166d9bc
Persist adds and removes on a server round trip.

diff -r 22f90eaa60da -r 9a39b5ad527a ipa-server/ipa-gui/ipagui/forms/group.py
--- a/ipa-server/ipa-gui/ipagui/forms/group.py	Fri Sep 14 15:20:09 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/group.py	Mon Sep 17 11:46:48 2007 -0700
@@ -10,6 +10,7 @@ class GroupFields():
 
     group_orig = widgets.HiddenField(name="group_orig")
     member_data = widgets.HiddenField(name="member_data")
+    uid_to_cn_json = widgets.HiddenField(name="uid_to_cn_json")
 
 class GroupNewValidator(validators.Schema):
     cn = validators.PlainText(not_empty=True)
@@ -41,7 +42,8 @@ class GroupEditForm(widgets.Form):
 
     fields = [GroupFields.gidnumber, GroupFields.description,
               GroupFields.cn_hidden,
-              GroupFields.group_orig, GroupFields.member_data]
+              GroupFields.group_orig, GroupFields.member_data,
+              GroupFields.uid_to_cn_json]
 
     validator = GroupEditValidator()
 
diff -r 22f90eaa60da -r 9a39b5ad527a ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Fri Sep 14 15:20:09 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Mon Sep 17 11:46:48 2007 -0700
@@ -1,13 +1,18 @@
 <div xmlns:py="http://purl.org/kid/ns#"
   class="simpleroster">
-  <form action="${action}" name="${name}" method="${method}" class="tableform">
+  <form action="${action}" name="${name}" method="${method}" class="tableform"
+      onsubmit="preSubmit()" >
 
 
   <?python searchurl = tg.url('/userlist_ajax') ?>
 
   <script type="text/javascript">
+    // this is used for round-trip recontruction of the names.
+    // the hidden fields only contain uids.  
+    var uid_to_cn_hash = new Hash();
+
     function toggleProtectedFields(checkbox) {
-      gidnumberField = $('form_gidnumber');
+      var gidnumberField = $('form_gidnumber');
       if (checkbox.checked) {
         gidnumberField.disabled = false;
       } else {
@@ -23,11 +28,13 @@
     }
 
     function adduser(uid, cn) {
-      newdiv = document.createElement('div');
+      uid_to_cn_hash[uid] = cn;
+
+      var newdiv = document.createElement('div');
       newdiv.appendChild(document.createTextNode(
         cn.escapeHTML() + " (" + uid.escapeHTML() + ") "));
 
-      undolink = document.createElement('a');
+      var undolink = document.createElement('a');
       undolink.setAttribute('href', '');
       undolink.setAttribute('onclick',
         'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' +
@@ -35,7 +42,7 @@
       undolink.appendChild(document.createTextNode("undo"));
       newdiv.appendChild(undolink);
 
-      uidInfo = document.createElement('input');
+      var uidInfo = document.createElement('input');
       uidInfo.setAttribute('type', 'hidden');
       uidInfo.setAttribute('name', 'uidadd');
       uidInfo.setAttribute('value', uid);
@@ -48,18 +55,20 @@
     }
 
     function adduserHandler(element, uid, cn) {
-      newdiv = adduser(uid, cn)
+      var newdiv = adduser(uid, cn)
       new Effect.Fade(Element.up(element));
       new Effect.Appear(newdiv);
       /* Element.up(element).remove(); */
     }
 
     function removeuser(uid, cn) {
-      newdiv = document.createElement('div');
+      uid_to_cn_hash[uid] = cn;
+
+      var newdiv = document.createElement('div');
       newdiv.appendChild(document.createTextNode(
         cn.escapeHTML() + " (" + uid.escapeHTML() + ") "));
 
-      undolink = document.createElement('a');
+      var undolink = document.createElement('a');
       undolink.setAttribute('href', '');
       undolink.setAttribute('onclick',
         'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' +
@@ -68,7 +77,7 @@
       undolink.appendChild(document.createTextNode("undo"));
       newdiv.appendChild(undolink);
 
-      uidInfo = document.createElement('input');
+      var uidInfo = document.createElement('input');
       uidInfo.setAttribute('type', 'hidden');
       uidInfo.setAttribute('name', 'uiddel');
       uidInfo.setAttribute('value', uid);
@@ -81,7 +90,7 @@
     }
 
     function removeuserHandler(element, uid, cn) {
-      newdiv = removeuser(uid, cn);
+      var newdiv = removeuser(uid, cn);
       new Effect.Fade(Element.up(element));
       new Effect.Appear(newdiv);
       /* Element.up(element).remove(); */
@@ -108,6 +117,12 @@
           {  asynchronous:true,
              parameters: { uid: $('uid').value } });
       return false;
+    }
+
+    function preSubmit() {
+      var json = uid_to_cn_hash.toJSON();
+      $('form_uid_to_cn_json').value = json;
+      return true;
     }
   </script>
 
@@ -178,7 +193,7 @@
                                    member.get('sn', ''))
           ?>
           ${member_name}
-          <a href="" 
+          <a href="#" 
             onclick="removeuserHandler(this, '${member_uid}', '${member_name}');
                      return false;"
           >remove</a>
@@ -227,4 +242,40 @@
     </table>
 
   </form>
+
+  <script type="text/javascript">
+    /*
+     * This section restores the contents of the add and remove lists
+     * dynamically if we have to refresh the page
+     */
+    if ($('form_uid_to_cn_json').value != "") {
+      uid_to_cn_hash = new Hash($('form_uid_to_cn_json').value.evalJSON());
+    }
+  </script>
+
+  <?python
+  uidadds = value.get('uidadd', [])
+  if not(isinstance(uidadds,list) or isinstance(uidadds,tuple)):
+      uidadds = [uidadds]
+
+  uiddels = value.get('uiddel', [])
+  if not(isinstance(uiddels,list) or isinstance(uiddels,tuple)):
+      uiddels = [uiddels]
+  ?>
+
+  <script py:for="uidadd in uidadds">
+    var uid = "${uidadd}";
+    var cn = uid_to_cn_hash[uid];
+    var newdiv = adduser(uid, cn);
+    newdiv.style.display = 'block';
+  </script>
+
+  <script py:for="uiddel in uiddels">
+    var uid = "${uiddel}";
+    var cn = uid_to_cn_hash[uid];
+    var newdiv = removeuser(uid, cn);
+    newdiv.style.display = 'block';
+    $('member-' + uid).style.display = 'none';
+  </script>
+
 </div>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070917/b64f1f8c/attachment.bin>

From kmccarth at redhat.com  Mon Sep 17 22:34:57 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Mon, 17 Sep 2007 15:34:57 -0700
Subject: [Freeipa-devel] [PATCH] group refinements
Message-ID: <20070917223456.GC3793@moon.usersys.redhat.com>

This patch continues the refinements to group editing:
- prevent double adds
- search indication while in progress
- filter exising entries from search results
- correct calculation of result counter after filtering

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190067851 25200
# Node ID a2db36c1fc6c85bc41ab0fab14aa0b3c0757012f
# Parent  9a39b5ad527aeaae93a0359bd1ca89ae5652bc3c
Prevent members from being added added twice.
Display search message while in progress.
Correctly calculate number of search results after filtering.

diff -r 9a39b5ad527a -r a2db36c1fc6c ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Mon Sep 17 11:46:48 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Mon Sep 17 15:24:11 2007 -0700
@@ -10,6 +10,15 @@
     // this is used for round-trip recontruction of the names.
     // the hidden fields only contain uids.  
     var uid_to_cn_hash = new Hash();
+
+    // used to filter search results.
+    // records uids already in the group
+    var member_hash = new Hash();
+
+    // used to prevent double adding
+    // records uid to be added
+    var added_hash = new Hash();
+
 
     function toggleProtectedFields(checkbox) {
       var gidnumberField = $('form_gidnumber');
@@ -30,6 +39,11 @@
     function adduser(uid, cn) {
       uid_to_cn_hash[uid] = cn;
 
+      if ((added_hash[uid] == 1) || (member_hash[uid] == 1)) {
+        return null;
+      }
+      added_hash[uid] = 1;
+
       var newdiv = document.createElement('div');
       newdiv.appendChild(document.createTextNode(
         cn.escapeHTML() + " (" + uid.escapeHTML() + ") "));
@@ -38,6 +52,7 @@
       undolink.setAttribute('href', '');
       undolink.setAttribute('onclick',
         'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' +
+        'added_hash.remove("' + uid + '");' +
         'return false;');
       undolink.appendChild(document.createTextNode("undo"));
       newdiv.appendChild(undolink);
@@ -56,9 +71,11 @@
 
     function adduserHandler(element, uid, cn) {
       var newdiv = adduser(uid, cn)
-      new Effect.Fade(Element.up(element));
-      new Effect.Appear(newdiv);
-      /* Element.up(element).remove(); */
+      if (newdiv != null) {
+        new Effect.Fade(Element.up(element));
+        new Effect.Appear(newdiv);
+        /* Element.up(element).remove(); */
+      }
     }
 
     function removeuser(uid, cn) {
@@ -112,10 +129,12 @@
     }
 
     function doSearch() {
+      $('searchresults').update("Searching...");
       new Ajax.Updater('searchresults',
           '${searchurl}',
           {  asynchronous:true,
-             parameters: { uid: $('uid').value } });
+             parameters: { uid: $('uid').value },
+             evalScripts: true });
       return false;
     }
 
@@ -192,11 +211,14 @@
           member_name = "%s %s" % (member.get('givenname', ''),
                                    member.get('sn', ''))
           ?>
-          ${member_name}
+          ${member_name} (${member_uid})
           <a href="#" 
             onclick="removeuserHandler(this, '${member_uid}', '${member_name}');
                      return false;"
           >remove</a>
+          <script type="text/javascript">
+            member_hash["${member_uid}"] = 1;
+          </script>
         </div>
       </div>
 
@@ -267,7 +289,9 @@
     var uid = "${uidadd}";
     var cn = uid_to_cn_hash[uid];
     var newdiv = adduser(uid, cn);
-    newdiv.style.display = 'block';
+    if (newdiv != null) {
+      newdiv.style.display = 'block';
+    }
   </script>
 
   <script py:for="uiddel in uiddels">
diff -r 9a39b5ad527a -r a2db36c1fc6c ipa-server/ipa-gui/ipagui/templates/userlistajax.kid
--- a/ipa-server/ipa-gui/ipagui/templates/userlistajax.kid	Mon Sep 17 11:46:48 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/userlistajax.kid	Mon Sep 17 15:24:11 2007 -0700
@@ -1,14 +1,33 @@
 <div xmlns:py="http://purl.org/kid/ns#">
+    <div id="search-results-count">
+    </div>
+    <script type="text/javascript">
+      search_string = "${uid}";
+      results_counter = 0;
+    </script>
     <div py:if='(users != None) and (len(users) > 0)'>
-        <div>${len(users)} results returned:</div>
-        <div py:for="user in users">
+        <div py:for="user in users" id="search-${user.uid}">
+          <script type="text/javascript">
+            if ((added_hash["${user.uid}"] == 1) ||
+                (member_hash["${user.uid}"] == 1)) {
+              $("search-${user.uid}").style.display = 'none';
+            } else {
+              results_counter = results_counter + 1;
+            }
+          </script>
           ${user.givenName} ${user.sn} (${user.uid})
           <a href="" 
             onclick="adduserHandler(this, '${user.uid}', '${user.cn}'); return false;"
           >add</a>
         </div>
     </div>
-    <div py:if='(users != None) and (len(users) == 0)'>
-        No results found for "${uid}"
-    </div>
+    <script type="text/javascript">
+      if (results_counter == 0) {
+        $('search-results-count').appendChild(document.createTextNode(
+          "No results found for " + search_string));
+      } else {
+        $('search-results-count').appendChild(document.createTextNode(
+          "" + results_counter + " results found:"));
+      }
+    </script>
 </div>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070917/8a129d1d/attachment.bin>

From kmccarth at redhat.com  Tue Sep 18 17:49:25 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Tue, 18 Sep 2007 10:49:25 -0700
Subject: [Freeipa-devel] [PATCH] fixes to edit protected checkbox
Message-ID: <20070918174923.GC21122@moon.usersys.redhat.com>

This patch makes the edit protected checkbox sticky, and also implements
required field validation for protected fields - only when the box is
checked.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190138093 25200
# Node ID 364d56d319c1f6ec629d00a7b53585a534ed3962
# Parent  a2db36c1fc6c85bc41ab0fab14aa0b3c0757012f
Fixes to the edit protected checkbox.
- Make checkbox sticky on round trips
- Make required fields validate when checkbox is checked.

diff -r a2db36c1fc6c -r 364d56d319c1 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Mon Sep 17 15:24:11 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 18 10:54:53 2007 -0700
@@ -163,11 +163,10 @@ class Root(controllers.RootController):
                 new_user.setValue('nsAccountLock', 'true')
             else:
                 new_user.setValue('nsAccountLock', None)
-            if kw.get('userpassword'):
-                new_user.setValue('userpassword', kw.get('userpassword'))
-            if kw.get('uidnumber'):
+            if kw.get('editprotected') == 'true':
+                if kw.get('userpassword'):
+                    new_user.setValue('userpassword', kw.get('userpassword'))
                 new_user.setValue('uidnumber', str(kw.get('uidnumber')))
-            if kw.get('gidnumber'):
                 new_user.setValue('gidnumber', str(kw.get('gidnumber')))
 
             #
@@ -480,9 +479,11 @@ class Root(controllers.RootController):
             if new_group.description != kw.get('description'):
                 group_modified = True
                 new_group.setValue('description', kw.get('description'))
-            if kw.get('gidnumber'):
-                group_modified = True
-                new_group.setValue('gidnumber', str(kw.get('gidnumber')))
+            if kw.get('editprotected') == 'true':
+                new_gid = str(kw.get('gidnumber'))
+                if new_group.gidnumber != new_gid:
+                    group_modified = True
+                    new_group.setValue('gidnumber', new_gid)
 
             if group_modified:
                 rv = client.update_group(new_group)
diff -r a2db36c1fc6c -r 364d56d319c1 ipa-server/ipa-gui/ipagui/forms/group.py
--- a/ipa-server/ipa-gui/ipagui/forms/group.py	Mon Sep 17 15:24:11 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/group.py	Tue Sep 18 10:54:53 2007 -0700
@@ -7,13 +7,14 @@ class GroupFields():
     description = widgets.TextField(name="description", label="Description")
 
     cn_hidden = widgets.HiddenField(name="cn")
+    editprotected_hidden = widgets.HiddenField(name="editprotected")
 
     group_orig = widgets.HiddenField(name="group_orig")
     member_data = widgets.HiddenField(name="member_data")
     uid_to_cn_json = widgets.HiddenField(name="uid_to_cn_json")
 
 class GroupNewValidator(validators.Schema):
-    cn = validators.PlainText(not_empty=True)
+    cn = validators.String(not_empty=True)
     description = validators.String(not_empty=False)
 
 
@@ -37,11 +38,15 @@ class GroupEditValidator(validators.Sche
     gidnumber = validators.Int(not_empty=False)
     description = validators.String(not_empty=False)
 
+    pre_validators = [
+      validators.RequireIfPresent(required='gidnumber', present='editprotected'),
+    ]
+
 class GroupEditForm(widgets.Form):
     params = ['members', 'group']
 
     fields = [GroupFields.gidnumber, GroupFields.description,
-              GroupFields.cn_hidden,
+              GroupFields.cn_hidden, GroupFields.editprotected_hidden,
               GroupFields.group_orig, GroupFields.member_data,
               GroupFields.uid_to_cn_json]
 
diff -r a2db36c1fc6c -r 364d56d319c1 ipa-server/ipa-gui/ipagui/forms/user.py
--- a/ipa-server/ipa-gui/ipagui/forms/user.py	Mon Sep 17 15:24:11 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/user.py	Tue Sep 18 10:54:53 2007 -0700
@@ -21,6 +21,7 @@ class UserFields():
     uidnumber_hidden = widgets.HiddenField(name="uidnumber")
     gidnumber_hidden = widgets.HiddenField(name="gidnumber")
     krbPasswordExpiration_hidden = widgets.HiddenField(name="krbPasswordExpiration")
+    editprotected_hidden = widgets.HiddenField(name="editprotected")
 
     user_orig = widgets.HiddenField(name="user_orig")
 
@@ -70,6 +71,11 @@ class UserEditValidator(validators.Schem
     #  validators.PhoneNumber may be a bit too picky, requiring an area code
     # telephonenumber = validators.PlainText(not_empty=False)
 
+    pre_validators = [
+      validators.RequireIfPresent(required='uidnumber', present='editprotected'),
+      validators.RequireIfPresent(required='gidnumber', present='editprotected'),
+    ]
+
     chained_validators = [
       validators.FieldsMatch('userpassword', 'userpassword_confirm')
     ]
@@ -81,6 +87,7 @@ class UserEditForm(widgets.Form):
               UserFields.uid_hidden, UserFields.user_orig,
               UserFields.uidnumber, UserFields.gidnumber,
               UserFields.krbPasswordExpiration_hidden,
+              UserFields.editprotected_hidden,
               ]
 
     validator = UserEditValidator()
diff -r a2db36c1fc6c -r 364d56d319c1 ipa-server/ipa-gui/ipagui/templates/groupedit.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupedit.kid	Mon Sep 17 15:24:11 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupedit.kid	Tue Sep 18 10:54:53 2007 -0700
@@ -8,7 +8,7 @@
 <body>
   <div>
     <div style="float:right">
-      <input type="checkbox"
+      <input type="checkbox" id="toggleprotected_checkbox"
           onclick="toggleProtectedFields(this);">
         <span class="small">edit protected fields</span>
       </input>
diff -r a2db36c1fc6c -r 364d56d319c1 ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Mon Sep 17 15:24:11 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Tue Sep 18 10:54:53 2007 -0700
@@ -24,8 +24,10 @@
       var gidnumberField = $('form_gidnumber');
       if (checkbox.checked) {
         gidnumberField.disabled = false;
+        $('form_editprotected').value = 'true';
       } else {
         gidnumberField.disabled = true;
+        $('form_editprotected').value = '';
       }
     }
 
@@ -273,6 +275,11 @@
     if ($('form_uid_to_cn_json').value != "") {
       uid_to_cn_hash = new Hash($('form_uid_to_cn_json').value.evalJSON());
     }
+
+    if ($('form_editprotected').value != "") {
+      $('toggleprotected_checkbox').checked = true;
+      toggleProtectedFields($('toggleprotected_checkbox'));
+    }
   </script>
 
   <?python
diff -r a2db36c1fc6c -r 364d56d319c1 ipa-server/ipa-gui/ipagui/templates/useredit.kid
--- a/ipa-server/ipa-gui/ipagui/templates/useredit.kid	Mon Sep 17 15:24:11 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/useredit.kid	Tue Sep 18 10:54:53 2007 -0700
@@ -9,7 +9,7 @@
 
   <div>
     <div style="float:right">
-      <input type="checkbox"
+      <input type="checkbox" id="toggleprotected_checkbox"
           onclick="toggleProtectedFields(this);">
         <span class="small">edit protected fields</span>
       </input>
diff -r a2db36c1fc6c -r 364d56d319c1 ipa-server/ipa-gui/ipagui/templates/usereditform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid	Mon Sep 17 15:24:11 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid	Tue Sep 18 10:54:53 2007 -0700
@@ -13,11 +13,13 @@
         passwordConfirmField.disabled = false;
         uidnumberField.disabled = false;
         gidnumberField.disabled = false;
+        $('form_editprotected').value = 'true';
       } else {
         passwordField.disabled = true;
         passwordConfirmField.disabled = true;
         uidnumberField.disabled = true;
         gidnumberField.disabled = true;
+        $('form_editprotected').value = '';
       }
     }
   </script>
@@ -228,4 +230,11 @@
     </table>
 
   </form>
+
+  <script type="text/javascript">
+    if ($('form_editprotected').value != "") {
+      $('toggleprotected_checkbox').checked = true;
+      toggleProtectedFields($('toggleprotected_checkbox'));
+    }
+  </script>
 </div>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070918/925d8d76/attachment.bin>

From rcritten at redhat.com  Tue Sep 18 17:57:38 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Tue, 18 Sep 2007 13:57:38 -0400
Subject: [Freeipa-devel] [PATCH] fixes to edit protected checkbox
In-Reply-To: <20070918174923.GC21122@moon.usersys.redhat.com>
References: <20070918174923.GC21122@moon.usersys.redhat.com>
Message-ID: <46F01192.8010906@redhat.com>

Kevin McCarthy wrote:
> This patch makes the edit protected checkbox sticky, and also implements
> required field validation for protected fields - only when the box is
> checked.
> 
> -Kevin
>

Looks good.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070918/f69a02a5/attachment.bin>

From rcritten at redhat.com  Tue Sep 18 17:57:56 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Tue, 18 Sep 2007 13:57:56 -0400
Subject: [Freeipa-devel] [PATCH] group refinements
In-Reply-To: <20070917223456.GC3793@moon.usersys.redhat.com>
References: <20070917223456.GC3793@moon.usersys.redhat.com>
Message-ID: <46F011A4.6060305@redhat.com>

Kevin McCarthy wrote:
> This patch continues the refinements to group editing:
> - prevent double adds
> - search indication while in progress
> - filter exising entries from search results
> - correct calculation of result counter after filtering
> 
> -Kevin

Looks good.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070918/76c53f55/attachment.bin>

From rcritten at redhat.com  Tue Sep 18 17:58:13 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Tue, 18 Sep 2007 13:58:13 -0400
Subject: [Freeipa-devel] [PATCH] draft of group member management
In-Reply-To: <20070914221959.GD17116@moon.usersys.redhat.com>
References: <20070914221959.GD17116@moon.usersys.redhat.com>
Message-ID: <46F011B5.3010402@redhat.com>

Kevin McCarthy wrote:
> This is half finished, but suitable for a code review.  I'll also push
> to demo so you can play with it.
> 
> This is basic group member management.  There are still a lot of issues
> to deal with, but it is functional.
> 
> -Kevin

+1

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070918/d61e3adf/attachment.bin>

From kmccarth at redhat.com  Tue Sep 18 21:57:18 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Tue, 18 Sep 2007 14:57:18 -0700
Subject: [Freeipa-devel] [PATCH] user search client-side limit
Message-ID: <20070918215718.GE21122@moon.usersys.redhat.com>

Add searchlimit parameter to userlist function.
Add limit for the editgroup ajax search.
Minor UI clean for editgroup page.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190152710 25200
# Node ID 88832dc9643b967ffed0aa4377512490accfe0e4
# Parent  364d56d319c1f6ec629d00a7b53585a534ed3962
Add client-side search limit parameter for user search.
Limit editgroup user ajax search.
Minor UI cleanup for editgroup.

diff -r 364d56d319c1 -r 88832dc9643b ipa-python/ipaclient.py
--- a/ipa-python/ipaclient.py	Tue Sep 18 10:54:53 2007 -0700
+++ b/ipa-python/ipaclient.py	Tue Sep 18 14:58:30 2007 -0700
@@ -91,11 +91,11 @@ class IPAClient:
         result = self.transport.get_add_schema()
         return result
 
-    def find_users(self, criteria, sattrs=None):
+    def find_users(self, criteria, sattrs=None, searchlimit=0):
         """Return a list: counter followed by a User object for each user that
            matches the criteria. If the results are truncated, counter will
            be set to -1"""
-        result = self.transport.find_users(criteria, sattrs)
+        result = self.transport.find_users(criteria, sattrs, searchlimit)
         counter = result[0]
 
         users = [counter]
diff -r 364d56d319c1 -r 88832dc9643b ipa-python/rpcclient.py
--- a/ipa-python/rpcclient.py	Tue Sep 18 10:54:53 2007 -0700
+++ b/ipa-python/rpcclient.py	Tue Sep 18 14:58:30 2007 -0700
@@ -150,7 +150,7 @@ class RPCClient:
     
         return ipautil.unwrap_binary_data(result)
 
-    def find_users (self, criteria, sattrs=None):
+    def find_users (self, criteria, sattrs=None, searchlimit=0):
         """Return a list: counter followed by a User object for each user that
            matches the criteria. If the results are truncated, counter will
            be set to -1"""
@@ -160,7 +160,7 @@ class RPCClient:
             # None values are not allowed in XML-RPC
             if sattrs is None:
                 sattrs = "__NONE__"
-            result = server.find_users(criteria, sattrs)
+            result = server.find_users(criteria, sattrs, searchlimit)
         except xmlrpclib.Fault, fault:
             raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
         except socket.error, (value, msg):
diff -r 364d56d319c1 -r 88832dc9643b ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 18 10:54:53 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 18 14:58:30 2007 -0700
@@ -214,16 +214,18 @@ class Root(controllers.RootController):
            This method is used for ajax calls."""
         client.set_principal(identity.current.user_name)
         users = []
+        searchlimit = 100
         uid = kw.get('uid')
         if uid != None and len(uid) > 0:
             try:
-                users = client.find_users(uid.encode('utf-8'))
+                users = client.find_users(uid.encode('utf-8'), None, searchlimit)
                 counter = users[0]
                 users = users[1:]
             except ipaerror.IPAError, e:
                 turbogears.flash("User list failed: " + str(e))
 
-        return dict(users=users, uid=uid, fields=forms.user.UserFields())
+        return dict(users=users, uid=uid, fields=forms.user.UserFields(),
+                counter=counter)
 
 
     @expose("ipagui.templates.usershow")
diff -r 364d56d319c1 -r 88832dc9643b ipa-server/ipa-gui/ipagui/static/css/style.css
--- a/ipa-server/ipa-gui/ipagui/static/css/style.css	Tue Sep 18 10:54:53 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/static/css/style.css	Tue Sep 18 14:58:30 2007 -0700
@@ -146,6 +146,16 @@ body {
 .formtable th {
   width: 20%;
   text-align: right;
+}
+
+.floatlist {
+  float: right;
+  width: 50%;
+}
+
+.floatheader {
+  color: #885555;
+  font-weight: bold;
 }
 
 .small {
diff -r 364d56d319c1 -r 88832dc9643b ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Tue Sep 18 10:54:53 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Tue Sep 18 14:58:30 2007 -0700
@@ -200,8 +200,8 @@
     <div>
       <div class="formsection">Group Members</div>
 
-      <div style="float:right; width:50%">
-        <div>To Remove:</div>
+      <div class="floatlist">
+        <div class="floatheader">To Remove:</div>
         <div id="delmembers">
         </div>
       </div>
@@ -229,8 +229,8 @@
     <div style="clear:both">
       <div class="formsection">Add Persons</div>
 
-      <div style="float:right; width:50%">
-        <div>To Add:</div>
+      <div class="floatlist">
+        <div class="floatheader">To Add:</div>
         <div id="newmembers">
         </div>
       </div>
diff -r 364d56d319c1 -r 88832dc9643b ipa-server/ipa-gui/ipagui/templates/userlistajax.kid
--- a/ipa-server/ipa-gui/ipagui/templates/userlistajax.kid	Tue Sep 18 10:54:53 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/userlistajax.kid	Tue Sep 18 14:58:30 2007 -0700
@@ -23,11 +23,14 @@
     </div>
     <script type="text/javascript">
       if (results_counter == 0) {
-        $('search-results-count').appendChild(document.createTextNode(
-          "No results found for " + search_string));
+        var message = "No results found for " + search_string;
       } else {
-        $('search-results-count').appendChild(document.createTextNode(
-          "" + results_counter + " results found:"));
+        var message =  results_counter + " results found:";
       }
+      $('search-results-count').appendChild(document.createTextNode(message));
+    </script>
+    <script py:if="counter &lt; 0">
+      $('search-results-count').appendChild(document.createTextNode(
+        " (truncated)"));
     </script>
 </div>
diff -r 364d56d319c1 -r 88832dc9643b ipa-server/xmlrpc-server/funcs.py
--- a/ipa-server/xmlrpc-server/funcs.py	Tue Sep 18 10:54:53 2007 -0700
+++ b/ipa-server/xmlrpc-server/funcs.py	Tue Sep 18 14:58:30 2007 -0700
@@ -413,7 +413,7 @@ class IPAServer:
     
         return users
 
-    def find_users (self, criteria, sattrs=None, opts=None):
+    def find_users (self, criteria, sattrs=None, searchlimit=0, opts=None):
         """Returns a list: counter followed by the results.
            If the results are truncated, counter will be set to -1."""
         # Assume the list of fields to search will come from a central
@@ -435,13 +435,13 @@ class IPAServer:
         try:
             try:
                 exact_results = conn.getListAsync(self.basedn, self.scope,
-                        exact_match_filter, sattrs)
+                        exact_match_filter, sattrs, 0, None, None, -1, searchlimit)
             except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
                 exact_results = [0]
 
             try:
                 partial_results = conn.getListAsync(self.basedn, self.scope,
-                        partial_match_filter, sattrs)
+                        partial_match_filter, sattrs, 0, None, None, -1, searchlimit)
             except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
                 partial_results = [0]
         finally:
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070918/5411c5f9/attachment.bin>

From kmccarth at redhat.com  Tue Sep 18 22:53:52 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Tue, 18 Sep 2007 15:53:52 -0700
Subject: [Freeipa-devel] [PATCH] group search improvements
Message-ID: <20070918225352.GF21122@moon.usersys.redhat.com>

This patch adds the same functionality user search has to group search:
- async search with  results in the event of size/time limits
- return value indicating timeout
- configurable search fields.

This code is very ripe for re-factoring as there is now significant
overlap between group and user search.  I didn't want to do it quite
yet, as there's some more I want to do with search (field specification)
and I think that will be a good time to re-factor.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190156196 25200
# Node ID 4002a364c5bdd0be267d88cb2ea2a25ea65c0eef
# Parent  88832dc9643b967ffed0aa4377512490accfe0e4
Implement asynchronous search for groups.
Use the filter generation code to search on multiple fields.

diff -r 88832dc9643b -r 4002a364c5bd ipa-python/ipaclient.py
--- a/ipa-python/ipaclient.py	Tue Sep 18 14:58:30 2007 -0700
+++ b/ipa-python/ipaclient.py	Tue Sep 18 15:56:36 2007 -0700
@@ -158,13 +158,14 @@ class IPAClient:
         result = self.transport.add_group(group_dict, group_container)
         return result
 
-    def find_groups(self, criteria, sattrs=None):
+    def find_groups(self, criteria, sattrs=None, searchlimit=0):
         """Find groups whose cn matches the criteria. Wildcards are 
            acceptable. Returns a list of Group objects."""
-        result = self.transport.find_groups(criteria, sattrs)
-
-        groups = []
-        for attrs in result:
+        result = self.transport.find_groups(criteria, sattrs, searchlimit)
+        counter = result[0]
+
+        groups = [counter]
+        for attrs in result[1:]:
             if attrs is not None:
                 groups.append(group.Group(attrs))
 
diff -r 88832dc9643b -r 4002a364c5bd ipa-python/rpcclient.py
--- a/ipa-python/rpcclient.py	Tue Sep 18 14:58:30 2007 -0700
+++ b/ipa-python/rpcclient.py	Tue Sep 18 15:56:36 2007 -0700
@@ -275,7 +275,7 @@ class RPCClient:
         except socket.error, (value, msg):
             raise xmlrpclib.Fault(value, msg)
 
-    def find_groups (self, criteria, sattrs=None):
+    def find_groups (self, criteria, sattrs=None, searchlimit=0):
         """Return a list containing a Group object for each group that matches
            the criteria."""
     
@@ -284,7 +284,7 @@ class RPCClient:
             # None values are not allowed in XML-RPC
             if sattrs is None:
                 sattrs = "__NONE__"
-            result = server.find_groups(criteria, sattrs)
+            result = server.find_groups(criteria, sattrs, searchlimit)
         except xmlrpclib.Fault, fault:
             raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
         except socket.error, (value, msg):
diff -r 88832dc9643b -r 4002a364c5bd ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 18 14:58:30 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 18 15:56:36 2007 -0700
@@ -551,11 +551,11 @@ class Root(controllers.RootController):
         if criteria != None and len(criteria) > 0:
             try:
                 groups = client.find_groups(criteria.encode('utf-8'))
-                # counter = groups[0]
-                # groups = groups[1:]
-                # if counter == -1:
-                #     turbogears.flash("These results are truncated.<br />" +
-                #                     "Please refine your search and try again.")
+                counter = groups[0]
+                groups = groups[1:]
+                if counter == -1:
+                    turbogears.flash("These results are truncated.<br />" +
+                                    "Please refine your search and try again.")
             except ipaerror.IPAError, e:
                 turbogears.flash("Find groups failed: " + str(e))
                 raise turbogears.redirect("/grouplist")
diff -r 88832dc9643b -r 4002a364c5bd ipa-server/xmlrpc-server/funcs.py
--- a/ipa-server/xmlrpc-server/funcs.py	Tue Sep 18 14:58:30 2007 -0700
+++ b/ipa-server/xmlrpc-server/funcs.py	Tue Sep 18 15:56:36 2007 -0700
@@ -603,25 +603,72 @@ class IPAServer:
         finally:
             self.releaseConnection(conn)
 
-    def find_groups (self, criteria, sattrs=None, opts=None):
+    def find_groups (self, criteria, sattrs=None, searchlimit=0, opts=None):
         """Return a list containing a User object for each
         existing group that matches the criteria.
         """
+        # Assume the list of fields to search will come from a central
+        # configuration repository.  A good format for that would be
+        # a comma-separated list of fields
+        search_fields_conf_str = "cn,description"
+        search_fields = string.split(search_fields_conf_str, ",")
+
         criteria = self.__safe_filter(criteria)
-
-        filter = "(&(cn=%s)(objectClass=posixGroup))" % criteria
-        conn = self.getConnection(opts)
-        try:
-            results = conn.getList(self.basedn, self.scope, filter, sattrs)
-        except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
-            results = []
-        finally:
-            self.releaseConnection(conn)
-
-        groups = []
-        for u in results:
+        criteria_words = re.split(r'\s+', criteria)
+        criteria_words = filter(lambda value:value!="", criteria_words)
+        if len(criteria_words) == 0:
+            return [0]
+
+        (exact_match_filter, partial_match_filter) = self.__generate_match_filters(
+                search_fields, criteria_words)
+
+        #
+        # further constrain search to just the objectClass
+        # TODO - need to parameterize this into generate_match_filters,
+        #        and work it into the field-specification search feature
+        #
+        exact_match_filter = "(&(objectClass=posixGroup)%s)" % exact_match_filter
+        partial_match_filter = "(&(objectClass=posixGroup)%s)" % partial_match_filter
+
+        #
+        # TODO - copy/paste from find_users.  needs to be refactored
+        #
+        conn = self.getConnection(opts)
+        try:
+            try:
+                exact_results = conn.getListAsync(self.basedn, self.scope,
+                        exact_match_filter, sattrs, 0, None, None, -1, searchlimit)
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
+                exact_results = [0]
+
+            try:
+                partial_results = conn.getListAsync(self.basedn, self.scope,
+                        partial_match_filter, sattrs, 0, None, None, -1, searchlimit)
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
+                partial_results = [0]
+        finally:
+            self.releaseConnection(conn)
+
+        exact_counter = exact_results[0]
+        partial_counter = partial_results[0]
+
+        exact_results = exact_results[1:]
+        partial_results = partial_results[1:]
+
+        # Remove exact matches from the partial_match list
+        exact_dns = set(map(lambda e: e.dn, exact_results))
+        partial_results = filter(lambda e: e.dn not in exact_dns,
+                                 partial_results)
+
+        if (exact_counter == -1) or (partial_counter == -1):
+            counter = -1
+        else:
+            counter = len(exact_results) + len(partial_results)
+
+        groups = [counter]
+        for u in exact_results + partial_results:
             groups.append(self.convert_entry(u))
-    
+
         return groups
 
     def add_user_to_group(self, user, group, opts=None):
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070918/c56a2405/attachment.bin>

From rcritten at redhat.com  Wed Sep 19 12:48:22 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Wed, 19 Sep 2007 08:48:22 -0400
Subject: [Freeipa-devel] [PATCH] group search improvements
In-Reply-To: <20070918225352.GF21122@moon.usersys.redhat.com>
References: <20070918225352.GF21122@moon.usersys.redhat.com>
Message-ID: <46F11A96.5040907@redhat.com>

Kevin McCarthy wrote:
> This patch adds the same functionality user search has to group search:
> - async search with  results in the event of size/time limits
> - return value indicating timeout
> - configurable search fields.
> 
> This code is very ripe for re-factoring as there is now significant
> overlap between group and user search.  I didn't want to do it quite
> yet, as there's some more I want to do with search (field specification)
> and I think that will be a good time to re-factor.
> 
> -Kevin

I see what you mean about refactoring. I think it is ok to go as-is and 
we'll optimize later (I promise).

Can you see if the command-line ipa-findgroup still works? I think the 
addition of the counter will break it.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070919/78bba297/attachment.bin>

From kmccarth at redhat.com  Wed Sep 19 15:44:21 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Wed, 19 Sep 2007 08:44:21 -0700
Subject: [Freeipa-devel] [PATCH] group search improvements
In-Reply-To: <46F11A96.5040907@redhat.com>
References: <20070918225352.GF21122@moon.usersys.redhat.com>
	<46F11A96.5040907@redhat.com>
Message-ID: <20070919154421.GB19392@moon.usersys.redhat.com>

Rob Crittenden wrote:
> Can you see if the command-line ipa-findgroup still works? I think the 
> addition of the counter will break it.

I did forget to update ipa-findgroup (thanks Rob).

Attached is a revised patch including that fix.

-Kevin
-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190216554 25200
# Node ID f7e2e4d1ed705049d26e77eab8829af43abe0055
# Parent  88832dc9643b967ffed0aa4377512490accfe0e4
Implement asynchronous search for groups.
Use the filter generation code to search on multiple fields.

diff -r 88832dc9643b -r f7e2e4d1ed70 ipa-admintools/ipa-findgroup
--- a/ipa-admintools/ipa-findgroup	Tue Sep 18 14:58:30 2007 -0700
+++ b/ipa-admintools/ipa-findgroup	Wed Sep 19 08:42:34 2007 -0700
@@ -50,7 +50,9 @@ def main():
         client = ipaclient.IPAClient()
         groups = client.find_groups(args[1])
 
-        if len(groups) == 0:
+        counter = groups[0]
+        groups = groups[1:]
+        if counter == 0:
             print "No entries found for", args[1]
             return 0
 
diff -r 88832dc9643b -r f7e2e4d1ed70 ipa-python/ipaclient.py
--- a/ipa-python/ipaclient.py	Tue Sep 18 14:58:30 2007 -0700
+++ b/ipa-python/ipaclient.py	Wed Sep 19 08:42:34 2007 -0700
@@ -158,13 +158,14 @@ class IPAClient:
         result = self.transport.add_group(group_dict, group_container)
         return result
 
-    def find_groups(self, criteria, sattrs=None):
+    def find_groups(self, criteria, sattrs=None, searchlimit=0):
         """Find groups whose cn matches the criteria. Wildcards are 
            acceptable. Returns a list of Group objects."""
-        result = self.transport.find_groups(criteria, sattrs)
-
-        groups = []
-        for attrs in result:
+        result = self.transport.find_groups(criteria, sattrs, searchlimit)
+        counter = result[0]
+
+        groups = [counter]
+        for attrs in result[1:]:
             if attrs is not None:
                 groups.append(group.Group(attrs))
 
diff -r 88832dc9643b -r f7e2e4d1ed70 ipa-python/rpcclient.py
--- a/ipa-python/rpcclient.py	Tue Sep 18 14:58:30 2007 -0700
+++ b/ipa-python/rpcclient.py	Wed Sep 19 08:42:34 2007 -0700
@@ -275,7 +275,7 @@ class RPCClient:
         except socket.error, (value, msg):
             raise xmlrpclib.Fault(value, msg)
 
-    def find_groups (self, criteria, sattrs=None):
+    def find_groups (self, criteria, sattrs=None, searchlimit=0):
         """Return a list containing a Group object for each group that matches
            the criteria."""
     
@@ -284,7 +284,7 @@ class RPCClient:
             # None values are not allowed in XML-RPC
             if sattrs is None:
                 sattrs = "__NONE__"
-            result = server.find_groups(criteria, sattrs)
+            result = server.find_groups(criteria, sattrs, searchlimit)
         except xmlrpclib.Fault, fault:
             raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
         except socket.error, (value, msg):
diff -r 88832dc9643b -r f7e2e4d1ed70 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 18 14:58:30 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Wed Sep 19 08:42:34 2007 -0700
@@ -551,11 +551,11 @@ class Root(controllers.RootController):
         if criteria != None and len(criteria) > 0:
             try:
                 groups = client.find_groups(criteria.encode('utf-8'))
-                # counter = groups[0]
-                # groups = groups[1:]
-                # if counter == -1:
-                #     turbogears.flash("These results are truncated.<br />" +
-                #                     "Please refine your search and try again.")
+                counter = groups[0]
+                groups = groups[1:]
+                if counter == -1:
+                    turbogears.flash("These results are truncated.<br />" +
+                                    "Please refine your search and try again.")
             except ipaerror.IPAError, e:
                 turbogears.flash("Find groups failed: " + str(e))
                 raise turbogears.redirect("/grouplist")
diff -r 88832dc9643b -r f7e2e4d1ed70 ipa-server/xmlrpc-server/funcs.py
--- a/ipa-server/xmlrpc-server/funcs.py	Tue Sep 18 14:58:30 2007 -0700
+++ b/ipa-server/xmlrpc-server/funcs.py	Wed Sep 19 08:42:34 2007 -0700
@@ -603,25 +603,72 @@ class IPAServer:
         finally:
             self.releaseConnection(conn)
 
-    def find_groups (self, criteria, sattrs=None, opts=None):
+    def find_groups (self, criteria, sattrs=None, searchlimit=0, opts=None):
         """Return a list containing a User object for each
         existing group that matches the criteria.
         """
+        # Assume the list of fields to search will come from a central
+        # configuration repository.  A good format for that would be
+        # a comma-separated list of fields
+        search_fields_conf_str = "cn,description"
+        search_fields = string.split(search_fields_conf_str, ",")
+
         criteria = self.__safe_filter(criteria)
-
-        filter = "(&(cn=%s)(objectClass=posixGroup))" % criteria
-        conn = self.getConnection(opts)
-        try:
-            results = conn.getList(self.basedn, self.scope, filter, sattrs)
-        except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
-            results = []
-        finally:
-            self.releaseConnection(conn)
-
-        groups = []
-        for u in results:
+        criteria_words = re.split(r'\s+', criteria)
+        criteria_words = filter(lambda value:value!="", criteria_words)
+        if len(criteria_words) == 0:
+            return [0]
+
+        (exact_match_filter, partial_match_filter) = self.__generate_match_filters(
+                search_fields, criteria_words)
+
+        #
+        # further constrain search to just the objectClass
+        # TODO - need to parameterize this into generate_match_filters,
+        #        and work it into the field-specification search feature
+        #
+        exact_match_filter = "(&(objectClass=posixGroup)%s)" % exact_match_filter
+        partial_match_filter = "(&(objectClass=posixGroup)%s)" % partial_match_filter
+
+        #
+        # TODO - copy/paste from find_users.  needs to be refactored
+        #
+        conn = self.getConnection(opts)
+        try:
+            try:
+                exact_results = conn.getListAsync(self.basedn, self.scope,
+                        exact_match_filter, sattrs, 0, None, None, -1, searchlimit)
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
+                exact_results = [0]
+
+            try:
+                partial_results = conn.getListAsync(self.basedn, self.scope,
+                        partial_match_filter, sattrs, 0, None, None, -1, searchlimit)
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
+                partial_results = [0]
+        finally:
+            self.releaseConnection(conn)
+
+        exact_counter = exact_results[0]
+        partial_counter = partial_results[0]
+
+        exact_results = exact_results[1:]
+        partial_results = partial_results[1:]
+
+        # Remove exact matches from the partial_match list
+        exact_dns = set(map(lambda e: e.dn, exact_results))
+        partial_results = filter(lambda e: e.dn not in exact_dns,
+                                 partial_results)
+
+        if (exact_counter == -1) or (partial_counter == -1):
+            counter = -1
+        else:
+            counter = len(exact_results) + len(partial_results)
+
+        groups = [counter]
+        for u in exact_results + partial_results:
             groups.append(self.convert_entry(u))
-    
+
         return groups
 
     def add_user_to_group(self, user, group, opts=None):
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070919/73eff35a/attachment.bin>

From rcritten at redhat.com  Wed Sep 19 19:12:01 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Wed, 19 Sep 2007 15:12:01 -0400
Subject: [Freeipa-devel] [PATCH] group search improvements
In-Reply-To: <20070919154421.GB19392@moon.usersys.redhat.com>
References: <20070918225352.GF21122@moon.usersys.redhat.com>	<46F11A96.5040907@redhat.com>
	<20070919154421.GB19392@moon.usersys.redhat.com>
Message-ID: <46F17481.3070708@redhat.com>

Kevin McCarthy wrote:
> Rob Crittenden wrote:
>> Can you see if the command-line ipa-findgroup still works? I think the 
>> addition of the counter will break it.
> 
> I did forget to update ipa-findgroup (thanks Rob).
> 
> Attached is a revised patch including that fix.
> 
> -Kevin

+1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070919/cf11f267/attachment.bin>

From kmccarth at redhat.com  Wed Sep 19 20:47:02 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Wed, 19 Sep 2007 13:47:02 -0700
Subject: [Freeipa-devel] [PATCH] handle group add/del errors
Message-ID: <20070919204702.GA21467@moon.usersys.redhat.com>

This isn't the best solution, but it's a first step.  With this commit,
I'm considering groups "good enough" and will start mocking out some
other parts of the app for discussion.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190234632 25200
# Node ID b52e28ce1b72dd28344038cfa0ca8a3576ddf7bf
# Parent  cd0f7c22cb7ab4811d128d5682795683d86c4abd
Handle add/remove failures a little bit better.
Still some refinements that can be done, but at least it shows the failures
now.

diff -r cd0f7c22cb7a -r b52e28ce1b72 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 11 02:48:53 2007 -0400
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Wed Sep 19 13:43:52 2007 -0700
@@ -446,7 +446,6 @@ class Root(controllers.RootController):
 
             return dict(form=group_edit_form, group=group_dict, members=member_dicts)
         except ipaerror.IPAError, e:
-            turbogears.flash("User show failed: " + str(e))
             turbogears.flash("Group edit failed: " + str(e))
             raise turbogears.redirect('/groupshow', uid=kw.get('cn'))
 
@@ -489,12 +488,12 @@ class Root(controllers.RootController):
 
             if group_modified:
                 rv = client.update_group(new_group)
-            #
-            # TODO - if the group update succeeds, but below operations fail,
-            # we needs to make sure a subsequent submit doesn't try to update
-            # the group again.  Probably by overwriting the group_orig hidden
-            # field blob.
-            #
+                #
+                # If the group update succeeds, but below operations fail, we
+                # need to make sure a subsequent submit doesn't try to update
+                # the group again.
+                #
+                kw['group_orig'] = b64encode(dumps(new_group.toDict()))
         except ipaerror.IPAError, e:
             turbogears.flash("User update failed: " + str(e))
             return dict(form=group_edit_form, group=kw, members=member_dicts,
@@ -503,15 +502,14 @@ class Root(controllers.RootController):
         #
         # Add members
         #
+        failed_adds = []
         try:
             uidadds = kw.get('uidadd')
             if uidadds != None:
                 if not(isinstance(uidadds,list) or isinstance(uidadds,tuple)):
                     uidadds = [uidadds]
-                failed = client.add_users_to_group(uidadds, kw.get('cn'))
-                #
-                # TODO - deal with failed adds
-                #
+                failed_adds = client.add_users_to_group(uidadds, kw.get('cn'))
+                kw['uidadd'] = failed_adds
         except ipaerror.IPAError, e:
             turbogears.flash("User update failed: " + str(e))
             return dict(form=group_edit_form, group=kw, members=member_dicts,
@@ -520,21 +518,36 @@ class Root(controllers.RootController):
         #
         # Remove members
         #
+        failed_dels = []
         try:
             uiddels = kw.get('uiddel')
             if uiddels != None:
                 if not(isinstance(uiddels,list) or isinstance(uiddels,tuple)):
                     uiddels = [uiddels]
-                failed = client.remove_users_from_group(uiddels, kw.get('cn'))
-                #
-                # TODO - deal with failed removals
-                #
+                failed_dels = client.remove_users_from_group(uiddels, kw.get('cn'))
+                kw['uiddel'] = failed_dels
         except ipaerror.IPAError, e:
             turbogears.flash("User update failed: " + str(e))
             return dict(form=group_edit_form, group=kw, members=member_dicts,
                         tg_template='ipagui.templates.groupedit')
 
-        # TODO if not group_modified
+        #
+        # TODO - check failed ops to see if it's because of another update.
+        #        handle "someone else already did it" errors better - perhaps
+        #        not even as an error
+        # TODO - update the Group Members list.
+        #        (note that we have to handle the above todo first, or else
+        #         there will be an error message, but the add/del lists will
+        #         be empty)
+        #
+        if (len(failed_adds) > 0) or (len(failed_dels) > 0):
+            message = "There was an error updating group members.<br />"
+            message += "Failures have been preserved in the add/remove lists."
+            if group_modified:
+                message = "Group Details successfully updated.<br />" + message
+            turbogears.flash(message)
+            return dict(form=group_edit_form, group=kw, members=member_dicts,
+                        tg_template='ipagui.templates.groupedit')
 
         turbogears.flash("%s updated!" % kw['cn'])
         raise turbogears.redirect('/groupshow', cn=kw['cn'])
diff -r cd0f7c22cb7a -r b52e28ce1b72 ipa-server/xmlrpc-server/funcs.py
--- a/ipa-server/xmlrpc-server/funcs.py	Tue Sep 11 02:48:53 2007 -0400
+++ b/ipa-server/xmlrpc-server/funcs.py	Wed Sep 19 13:43:52 2007 -0700
@@ -715,7 +715,7 @@ class IPAServer:
             except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST):
                 # User is already in the group
                 failed.append(user)
-            except ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND):
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
                 # User or the group does not exist
                 failed.append(user)
 
@@ -773,7 +773,7 @@ class IPAServer:
             except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST):
                 # User is not in the group
                 failed.append(user)
-            except ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND):
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
                 # User or the group does not exist
                 failed.append(user)
 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070919/d088559d/attachment.bin>

From rcritten at redhat.com  Wed Sep 19 20:56:17 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Wed, 19 Sep 2007 16:56:17 -0400
Subject: [Freeipa-devel] [PATCH] handle group add/del errors
In-Reply-To: <20070919204702.GA21467@moon.usersys.redhat.com>
References: <20070919204702.GA21467@moon.usersys.redhat.com>
Message-ID: <46F18CF1.5040906@redhat.com>

Kevin McCarthy wrote:
> This isn't the best solution, but it's a first step.  With this commit,
> I'm considering groups "good enough" and will start mocking out some
> other parts of the app for discussion.
> 
> -Kevin
> 

+1

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070919/91f51d4f/attachment.bin>

From kmccarth at redhat.com  Wed Sep 19 22:53:56 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Wed, 19 Sep 2007 15:53:56 -0700
Subject: [Freeipa-devel] [PATCH] add pasword change call to gui
Message-ID: <20070919225355.GB21467@moon.usersys.redhat.com>

This patch adds in the user password api call to the web gui.

Currently, I am getting a permission error for this.  Making the big
assumption it's a known problem at this point.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190242741 25200
# Node ID 0774967a0594d3201ab6837a746682b6b82029f4
# Parent  d38d108442e06a986eec88d47aed60cdc61d477f
Add password changing call to web gui.

diff -r d38d108442e0 -r 0774967a0594 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Wed Sep 19 15:10:50 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Wed Sep 19 15:59:01 2007 -0700
@@ -151,6 +151,7 @@ class Root(controllers.RootController):
             return dict(form=user_edit_form, user=kw,
                         tg_template='ipagui.templates.useredit')
 
+        password_change = False
         try:
             orig_user_dict = loads(b64decode(kw.get('user_orig')))
 
@@ -165,7 +166,7 @@ class Root(controllers.RootController):
                 new_user.setValue('nsAccountLock', None)
             if kw.get('editprotected') == 'true':
                 if kw.get('userpassword'):
-                    new_user.setValue('userpassword', kw.get('userpassword'))
+                    password_change = True
                 new_user.setValue('uidnumber', str(kw.get('uidnumber')))
                 new_user.setValue('gidnumber', str(kw.get('gidnumber')))
 
@@ -177,12 +178,26 @@ class Root(controllers.RootController):
                                       new_user.getValue('sn')))
 
             rv = client.update_user(new_user)
-            turbogears.flash("%s updated!" % kw['uid'])
-            raise turbogears.redirect('/usershow', uid=kw['uid'])
+        except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST), e:
+            if not password_change:
+                turbogears.flash("User update failed: " + str(e))
+                return dict(form=user_edit_form, user=kw,
+                            tg_template='ipagui.templates.useredit')
         except ipaerror.IPAError, e:
             turbogears.flash("User update failed: " + str(e))
             return dict(form=user_edit_form, user=kw,
                         tg_template='ipagui.templates.useredit')
+
+        try:
+            if password_change:
+                rv = client.modifyPassword(kw['uid'], "", kw.get('userpassword'))
+        except ipaerror.IPAError, e:
+            turbogears.flash("User password change failed: " + str(e))
+            return dict(form=user_edit_form, user=kw,
+                        tg_template='ipagui.templates.useredit')
+
+        turbogears.flash("%s updated!" % kw['uid'])
+        raise turbogears.redirect('/usershow', uid=kw['uid'])
 
 
     @expose("ipagui.templates.userlist")
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070919/dbcf4f03/attachment.bin>

From rcritten at redhat.com  Thu Sep 20 00:21:32 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Wed, 19 Sep 2007 20:21:32 -0400
Subject: [Freeipa-devel] [PATCH] add pasword change call to gui
In-Reply-To: <20070919225355.GB21467@moon.usersys.redhat.com>
References: <20070919225355.GB21467@moon.usersys.redhat.com>
Message-ID: <46F1BD0C.1090208@redhat.com>

Kevin McCarthy wrote:
> This patch adds in the user password api call to the web gui.
> 
> Currently, I am getting a permission error for this.  Making the big
> assumption it's a known problem at this point.
> 
> -Kevin

You're probably still using the old proxy method of authentication. Once 
the patches get caught up and you are forced to use kerberos things 
should work much better.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070919/451e33cb/attachment.bin>

From rcritten at redhat.com  Thu Sep 20 12:46:57 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Thu, 20 Sep 2007 08:46:57 -0400
Subject: [Freeipa-devel] [PATCH] add pasword change call to gui
In-Reply-To: <20070919225355.GB21467@moon.usersys.redhat.com>
References: <20070919225355.GB21467@moon.usersys.redhat.com>
Message-ID: <46F26BC1.5020400@redhat.com>

Kevin McCarthy wrote:
> This patch adds in the user password api call to the web gui.
> 
> Currently, I am getting a permission error for this.  Making the big
> assumption it's a known problem at this point.
> 
> -Kevin
> 

Patch looks ok.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070920/6f0161ea/attachment.bin>

From rcritten at redhat.com  Thu Sep 20 14:06:35 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Thu, 20 Sep 2007 10:06:35 -0400
Subject: [Freeipa-devel] [PATCH] remove proxy support
Message-ID: <46F27E6B.1080001@redhat.com>

This patch removes the ACI and certificate generation for doing proxy 
authentication.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-180-noproxy.patch
Type: text/x-patch
Size: 4059 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070920/af290661/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070920/af290661/attachment-0001.bin>

From ssorce at redhat.com  Thu Sep 20 19:20:06 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 15:20:06 -0400
Subject: [Freeipa-devel] PATCH: setup bind as part of server configuration
Message-ID: <1190316006.2567.113.camel@localhost.localdomain>

This patch will help QA, you have to explicitly pass --setup-bind and no
question about it is asked if you don't.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-180-setup-bind.patch
Type: text/x-patch
Size: 17641 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070920/ae273342/attachment.bin>

From prowley at redhat.com  Thu Sep 20 20:17:05 2007
From: prowley at redhat.com (Pete Rowley)
Date: Thu, 20 Sep 2007 13:17:05 -0700
Subject: [Freeipa-devel] PATCH: setup bind as part of server configuration
In-Reply-To: <1190316006.2567.113.camel@localhost.localdomain>
References: <1190316006.2567.113.camel@localhost.localdomain>
Message-ID: <46F2D541.6090402@redhat.com>

Simo Sorce wrote:
> This patch will help QA, you have to explicitly pass --setup-bind and no
> question about it is asked if you don't.
>   
Ack
> ------------------------------------------------------------------------
>
> # HG changeset patch
> # User Simo Sorce <ssorce at redhat.com>
> # Date 1190315421 14400
> # Node ID 9353b33672ee1bf8afabee1615d2cd4aebcce019
> # Parent  578d26927d915e3c85bded0c2206cf9679a58977
> Initial support for confiuguring a DNS Server during installation.
> It's not perfect yet but good enough to include it.
>
> diff -r 578d26927d91 -r 9353b33672ee ipa-client/ipa-install/ipa-client-install
> --- a/ipa-client/ipa-install/ipa-client-install	Thu Sep 13 12:10:55 2007 -0400
> +++ b/ipa-client/ipa-install/ipa-client-install	Thu Sep 20 15:10:21 2007 -0400
> @@ -31,7 +31,6 @@ import ipaclient.ipadiscovery
>  import ipaclient.ipadiscovery
>  import ipaclient.ipachangeconf
>  from ipa.ipautil import run
> -import shutil
>  
>  def parse_options():
>      parser = OptionParser(version=VERSION)
> diff -r 578d26927d91 -r 9353b33672ee ipa-server/ipa-install/ipa-server-install
> --- a/ipa-server/ipa-install/ipa-server-install	Thu Sep 13 12:10:55 2007 -0400
> +++ b/ipa-server/ipa-install/ipa-server-install	Thu Sep 20 15:10:21 2007 -0400
> @@ -36,6 +36,7 @@ from optparse import OptionParser
>  from optparse import OptionParser
>  import ipaserver.dsinstance
>  import ipaserver.krbinstance
> +import ipaserver.bindinstance
>  from ipa.ipautil import run
>  
>  def parse_options():
> @@ -51,10 +52,13 @@ def parse_options():
>      parser.add_option("-a", "--admin-password", dest="admin_password",
>                        help="admin user kerberos password")
>      parser.add_option("-d", "--debug", dest="debug", action="store_true",
> -                     dest="debug", default=False, help="print debugging information")
> +                      default=False, help="print debugging information")
>      parser.add_option("--hostname", dest="host_name", help="fully qualified name of server")
> -    parser.add_option("-U", "--unattended", dest="unattended",
> -                     help="unattended installation never prompts the user")
> +    parser.add_option("--ip-address", dest="ip_address", help="Master Server IP Address")
> +    parser.add_option("--setup-bind", dest="setup_bind", action="store_true",
> +                      default=False, help="configure bind with our zone file")
> +    parser.add_option("-U", "--unattended", dest="unattended", action="store_true",
> +                      default=False, help="unattended installation never prompts the user")
>  
>      options, args = parser.parse_args()
>  
> @@ -63,7 +67,7 @@ def parse_options():
>                                 not options.dm_password or
>                                 not options.admin_password or
>                                 not options.master_password):
> -        parser.error("error: In unattended mode you need to provide -u, -r, -p and -P options")
> +        parser.error("error: In unattended mode you need to provide iat least -u, -r, -p and -P options")
>  
>      return options
>  
> @@ -93,34 +97,140 @@ def main():
>      ds_user = ""
>      realm_name = ""
>      host_name = ""
> +    domain_name = ""
> +    ip_address = ""
>      master_password = ""
>      dm_password = ""
>      admin_password = ""
>  
> +    # check bind packages are installed
> +    bind = ipaserver.bindinstance.BindInstance()
> +    if options.setup_bind:
> +        if not bind.check_inst():
> +            print "--setup-bind was specified but bind is not installed on the system"
> +            print "Please install bind (you also need the package 'caching-nameserver') and restart the setup program"
> +            return "-Fatal Error-"
> +
>      # check the hostname is correctly configured, it must be as the kldap
>      # utilities just use the hostname as returned by gethostbyname to set
>      # up some of the standard entries
>  
> +    host_name = ""
>      if options.host_name:
>          host_name = options.host_name
>      else:
> -        host_name = socket.gethostname()
> -    if len(host_name.split(".")) < 2:
> -        print "Invalid hostname <"+host_name+">"
> -        print "Check the /etc/hosts file and make sure to have a valid FQDN"
> -        return "-Fatal Error-"
> -
> -    ip = socket.gethostbyname(host_name)
> -    if ip == "127.0.0.1":
> -        print "The hostname resolves to the localhost address (127.0.0.1)"
> -        print "Please change your /etc/hosts file or your DNS so that the"
> -        print "hostname resolves to the ip address of your network interface."
> -        print "The KDC service does not listen on 127.0.0.1"
> -        print ""
> -        print "Please fix your /etc/hosts file and restart the setup program"
> -        return "-Fatal Error-"
> -     
> -    print "The Final KDC Host Name will be: " + host_name + ". With IP address: " + ip
> +        try:
> +            host_name = socket.gethostname()
> +        except:
> +            pass
> +        if options.unattended:
> +           if len(host_name.split(".")) < 2 or host_name == "localhost.localdomain":
> +               print "Invalid hostname: "+host_name
> +               print "This host name can't be used as a hostname for an IPA Server"
> +               return "-Fatal Error-"
> +        else:
> +            host_ok = False
> +            while not host_ok:
> +               if host_name == "":
> +                   print ""
> +                   host_name = raw_input("Please provide a Fully Qualified name to use for your system [master.example.com]: ")
> +                   if host_name != "":
> +                       host_name = "master.example.com"
> +    
> +               if len(host_name.split(".")) < 2 or host_name == "localhost.localdomain":
> +                   print "Invalid hostname: "+host_name
> +                   print "This host name can't be used as a hostname for an IPA Server"
> +                   host_name = ""
> +                   continue
> +               else:
> +                   host_ok = True
> +    
> +               yesno = raw_input("Please confirm this ["+host_name+"] is the server hostname you want to use [Y/n]: ")
> +               if yesno != "" and yesno.lower() != 'y':
> +                   host_name = ""
> +                   host_ok = False
> +
> +    domain_name = host_name[host_name.find(".")+1:]
> +
> +    # Check we have a public IP that is associated with the hostname
> +    ip = ""
> +    askip = False
> +    try:
> +        ip = socket.gethostbyname(host_name)
> +
> +        if ip == "127.0.0.1" or ip == "::1":
> +            print "The hostname resolves to the localhost address (127.0.0.1/::1)"
> +            print "Please change your /etc/hosts file so that the hostname"
> +            print "resolves to the ip address of your network interface."
> +            print "The KDC service does not listen on localhost"
> +            print ""
> +            print "Please fix your /etc/hosts file and restart the setup program"
> +            return "-Fatal Error-"
> +
> +    except:
> +        print "The provided hostname can't actually be use to resolve the IP address"
> +        if options.ip_address:
> +            ip = options.ip_address
> +        else:
> +            askip = True
> +
> +    if ip != "":
> +        try:
> +            socket.inet_pton(socket.AF_INET, ip)
> +        except:
> +            try:
> +                socket.inet_pton(socket.AF_INET6, ip)
> +            except:
> +                print "Invalid IP format"
> +                if options.unattended:
> +                    return "-Fatal Error-"
> +                else:
> +                    ip = ""
> +                    askip = True
> +
> +        if options.ip_address and options.ip_address != ip:
> +            if options.setup_bind:
> +                ip = options.ip_address
> +            else:
> +                print "Error: the hostname resolves to an IP that is different from the one provided on the command line"
> +                print "Please fix your DNS or /etc/hosts file to provide consistent information and restart the setup program"
> +                return "-Fatal Error-"
> + 
> +    if options.unattended:
> +        if askip or ip == "":
> +            print "Unable to resolve IP address"
> +            return "-Fatal Error-"
> +
> +    while askip:
> +        ip = raw_input("Please provide the IP address to be used for this host name: ")
> +
> +        if ip == "":
> +            print "An empty IP is not acceptable"
> +            continue
> +        if ip == "127.0.0.1" or ip == "::1":
> +            print "The IPA Server can't use localhost as a valid IP"
> +            continue
> +
> +        try:
> +            socket.inet_pton(socket.AF_INET, ip)
> +        except:
> +            try:
> +                socket.inet_pton(socket.AF_INET6, ip)
> +            except:
> +                print "Invalid IP format"
> +                continue
> +
> +        print "Adding ["+ip+" "+host_name+"] to your /etc/hosts file"
> +        hosts_fd = open('/etc/hosts', 'r+')
> +        hosts_fd.seek(0, 2)
> +        hosts_fd.write(ip+'\t'+host_name+' '+host_name[:host_name.find('.')]+'\n')
> +        hosts_fd.close()
> +        askip = False
> +
> +    ip_address = ip
> +
> +    print "The IPA Master Server Name will be: " + host_name + ". With IP address: " + ip_address
> +    print "The IPA Domain Name will be: " + domain_name
>      print ""
>  
>      if not options.ds_user:
> @@ -152,7 +262,7 @@ def main():
>          print "The kerberos protocol requires a Realm name to be defined."
>          print "Usually the domain name all in uppercase is used as realm name."
>          print ""
> -        upper_dom = (host_name[host_name.find(".")+1:]).upper()
> +        upper_dom = domain_name.upper()
>          realm_name = raw_input("Please provide a realm name ["+upper_dom+"]: ")
>          print ""
>          if realm_name == "":
> @@ -227,6 +337,11 @@ def main():
>      else:
>          admin_password = options.admin_password
>  
> +    if not options.unattended:
> +        print ""
> +        print "The following operations may take some minutes to complete."
> +        print "Please wait until the prompt is returned."
> +
>      # Create a directory server instance
>      ds = ipaserver.dsinstance.DsInstance()
>      ds.create_instance(ds_user, realm_name, host_name, dm_password)
> @@ -235,8 +350,24 @@ def main():
>      krb = ipaserver.krbinstance.KrbInstance()
>      krb.create_instance(ds_user, realm_name, host_name, dm_password, master_password)
>  
> -    # Restart ds after the krb instance has changed ds configurations
> +    bind.setup(host_name, ip_address, realm_name)
> +    if options.setup_bind:
> +        skipbind = False
> +        if not options.unattended:
> +            print "This program is about to replace the DNS Server configuration,"
> +            print "with an automatically generated one, based on the data gathered so far."
> +            print "This will REPLACE any existing configuration."
> +            yesno = raw_input("Are you sure you want to configure the DNS Server ? [y/N]: ")
> +            if yesno.lower() != 'y':
> +                skipbind = True
> +        if not skipbind:
> +            bind.create_instance()
> +    else:
> +        bind.create_sample_bind_zone()
> +
> +    # Restart ds and krb after configurations have been changed
>      ds.restart()
> +    krb.restart()
>  
>      # Restart apache
>      run(["/sbin/service", "httpd", "restart"])
> diff -r 578d26927d91 -r 9353b33672ee ipa-server/ipa-install/share/bind.named.conf.template
> --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
> +++ b/ipa-server/ipa-install/share/bind.named.conf.template	Thu Sep 20 15:10:21 2007 -0400
> @@ -0,0 +1,41 @@
> +options {
> +	/* make named use port 53 for the source of all queries, to allow
> +	 * firewalls to block all ports except 53:
> +	 */
> +	query-source    port 53;
> +	query-source-v6 port 53;
> +
> +	// Put files that named is allowed to write in the data/ directory:
> +	directory "/var/named"; // the default
> +	dump-file               "data/cache_dump.db";
> +	statistics-file         "data/named_stats.txt";
> +	memstatistics-file      "data/named_mem_stats.txt";
> +
> +        /* Not used yet, support only on very recent bind versions */
> +#       tkey-gssapi-credential "DNS/$FQDN";
> +#       tkey-domain "$REALM";
> +};
> +
> +logging {
> +/*      If you want to enable debugging, eg. using the 'rndc trace' command,
> + *      By default, SELinux policy does not allow named to modify the /var/named directory,
> + *      so put the default debug log file in data/ :
> + */
> +        channel default_debug {
> +                file "data/named.run";
> +                severity dynamic;
> +        };
> +};
> +
> +zone "." IN {
> +	type hint;
> +	file "named.ca";
> +};
> +
> +include "/etc/named.rfc1912.zones";
> +
> +zone "$DOMAIN" {
> +	type master;
> +	file "$DOMAIN.zone.db";
> +};
> +
> diff -r 578d26927d91 -r 9353b33672ee ipa-server/ipaserver/bindinstance.py
> --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
> +++ b/ipa-server/ipaserver/bindinstance.py	Thu Sep 20 15:10:21 2007 -0400
> @@ -0,0 +1,113 @@
> +#! /usr/bin/python -E
> +# Authors: Simo Sorce <ssorce at redhat.com>
> +#
> +# Copyright (C) 2007  Red Hat
> +# see file 'COPYING' for use and warranty information
> +#
> +# This program is free software; you can redistribute it and/or
> +# modify it under the terms of the GNU General Public License as
> +# published by the Free Software Foundation; version 2 or later
> +#
> +# This program is distributed in the hope that it will be useful,
> +# but WITHOUT ANY WARRANTY; without even the implied warranty of
> +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
> +# GNU General Public License for more details.
> +#
> +# You should have received a copy of the GNU General Public License
> +# along with this program; if not, write to the Free Software
> +# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
> +#
> +
> +import string
> +import tempfile
> +import shutil
> +import os
> +import socket
> +from ipa.ipautil import *
> +
> +class BindInstance:
> +    def __init__(self):
> +        self.fqdn = None
> +	self.domain = None
> +        self.host = None
> +        self.ip_address = None
> +        self.realm = None
> +        self.sub_dict = None
> +
> +    def setup(self, fqdn, ip_address, realm_name):
> +        self.fqdn = fqdn
> +        self.ip_address = ip_address
> +        self.realm = realm_name
> +        self.domain = fqdn[fqdn.find(".")+1:]
> +        self.host = fqdn[:fqdn.find(".")]
> +
> +        self.__setup_sub_dict()
> +
> +    def check_inst(self):
> +        # So far this file is always present in both RHEL5 and Fedora if all the necessary
> +        # bind packages are installed (RHEL5 requires also the pkg: caching-nameserver)
> +        if not os.path.exists('/etc/named.rfc1912.zones'):
> +             return False
> +
> +        return True
> +
> +    def create_sample_bind_zone(self):
> +        bind_txt = template_file(SHARE_DIR + "bind.zone.db.template", self.sub_dict)
> +        [bind_fd, bind_name] = tempfile.mkstemp(".db","sample.zone.")
> +        os.write(bind_fd, bind_txt)
> +        os.close(bind_fd)
> +        print "Sample zone file for bind has been created in "+bind_name
> +
> +    def create_instance(self):
> +
> +        try:
> +            self.stop()
> +        except:
> +            pass
> +
> +        self.__setup_zone()
> +        self.__setup_named_conf()
> +
> +        self.start()
> +
> +    def stop(self):
> +        run(["/sbin/service", "named", "stop"])
> +
> +    def start(self):
> +        run(["/sbin/service", "named", "start"])
> +
> +    def restart(self):
> +        run(["/sbin/service", "named", "restart"])
> +
> +    def __setup_sub_dict(self):
> +        self.sub_dict = dict(FQDN=self.fqdn,
> +                             IP=self.ip_address,
> +                             DOMAIN=self.domain,
> +                             HOST=self.host,
> +                             REALM=self.realm)
> +
> +    def __setup_zone(self):
> +        zone_txt = template_file(SHARE_DIR + "bind.zone.db.template", self.sub_dict)
> +        zone_fd = open('/var/named/'+self.domain+'.zone.db', 'w')
> +        zone_fd.write(zone_txt)
> +        zone_fd.close()
> +
> +    def __setup_named_conf(self):
> +        if os.path.exists('/etc/named.conf'):
> +            shutil.copy2('/etc/named.conf', '/etc/named.conf.ipabkp')
> +        named_txt = template_file(SHARE_DIR + "bind.named.conf.template", self.sub_dict)
> +        named_fd = open('/etc/named.conf', 'w')
> +        named_fd.seek(0)
> +        named_fd.truncate(0)
> +        named_fd.write(named_txt)
> +        named_fd.close()
> +
> +        if os.path.exists('/etc/resolve.conf'):
> +            shutil.copy2('/etc/resolve.conf', '/etc/resolv.conf.ipabkp')
> +        resolve_txt = "search "+self.domain+"\nnameserver "+self.ip_address+"\n"
> +        resolve_fd = open('/etc/resolve.conf', 'w')
> +        resolve_fd.seek(0)
> +        resolve_fd.truncate(0)
> +        resolve_fd.write(resolve_txt)
> +        resolve_fd.close()
> +
> diff -r 578d26927d91 -r 9353b33672ee ipa-server/ipaserver/krbinstance.py
> --- a/ipa-server/ipaserver/krbinstance.py	Thu Sep 13 12:10:55 2007 -0400
> +++ b/ipa-server/ipaserver/krbinstance.py	Thu Sep 20 15:10:21 2007 -0400
> @@ -73,6 +73,9 @@ class KrbInstance:
>          
>  	self.suffix = realm_to_suffix(self.realm)
>          self.kdc_password = generate_kdc_password()
> +
> +        self.stop()
> +
>  	self.__configure_kdc_account_password()
>  
>          self.__setup_sub_dict()
> @@ -88,8 +91,6 @@ class KrbInstance:
>          self.__create_http_keytab()
>  
>          self.__export_kadmin_changepw_keytab()
> -
> -        self.__create_sample_bind_zone()
>  
>          self.__add_pwd_extop_module()
>  
> @@ -161,13 +162,6 @@ class KrbInstance:
>          args = ["/usr/bin/setfacl", "-m", "u:"+self.ds_user+":r", "/var/kerberos/krb5kdc/.k5."+self.realm]
>          run(args)
>  
> -    def __create_sample_bind_zone(self):
> -        bind_txt = template_file(SHARE_DIR + "bind.zone.db.template", self.sub_dict)
> -        [bind_fd, bind_name] = tempfile.mkstemp(".db","sample.zone.")
> -        os.write(bind_fd, bind_txt)
> -        os.close(bind_fd)
> -        print "Sample zone file for bind has been created in "+bind_name
> -
>      def __create_ds_keytab(self):
>          (kwrite, kread, kerr) = os.popen3("/usr/kerberos/sbin/kadmin.local")
>          kwrite.write("addprinc -randkey ldap/"+self.fqdn+"@"+self.realm+"\n")
>   
> ------------------------------------------------------------------------
>
> _______________________________________________
> Freeipa-devel mailing list
> Freeipa-devel at redhat.com
> https://www.redhat.com/mailman/listinfo/freeipa-devel


-- 
Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3241 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070920/5e82d13f/attachment.bin>

From ssorce at redhat.com  Thu Sep 20 21:03:54 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:03:54 -0400
Subject: [Freeipa-devel] [PATCH] small proxyprovider fixes
In-Reply-To: <20070911214102.GB32755@moon.usersys.redhat.com>
References: <20070911214102.GB32755@moon.usersys.redhat.com>
Message-ID: <1190322234.2567.116.camel@localhost.localdomain>

On Tue, 2007-09-11 at 14:41 -0700, Kevin McCarthy wrote:
> 
> 
> 
> 
> 
> 
> 
> plain text
> document
> attachment
> (freeipa-189-smallproxyfixes.patch)

Pushed



From ssorce at redhat.com  Thu Sep 20 21:04:08 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:04:08 -0400
Subject: [Freeipa-devel] [PATCH] add group
In-Reply-To: <20070911215923.GC32755@moon.usersys.redhat.com>
References: <20070911215923.GC32755@moon.usersys.redhat.com>
Message-ID: <1190322248.2567.118.camel@localhost.localdomain>

On Tue, 2007-09-11 at 14:59 -0700, Kevin McCarthy wrote:
> plain text document attachment (freeipa-190-groupadd.patch)

Pushed



From ssorce at redhat.com  Thu Sep 20 21:04:21 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:04:21 -0400
Subject: [Freeipa-devel] [PATCH] basic group list/show/edit
In-Reply-To: <20070912173758.GC25543@moon.usersys.redhat.com>
References: <20070912173758.GC25543@moon.usersys.redhat.com>
Message-ID: <1190322261.2567.120.camel@localhost.localdomain>

On Wed, 2007-09-12 at 10:37 -0700, Kevin McCarthy wrote:
> 
> 
> plain text document attachment
> (freeipa-192-grouplistedit.patch)

Pushed



From ssorce at redhat.com  Thu Sep 20 21:04:34 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:04:34 -0400
Subject: [Freeipa-devel] [PATCH] javascript sorting of user results
	w/tablekit
In-Reply-To: <20070913172712.GA19864@moon.usersys.redhat.com>
References: <20070913172712.GA19864@moon.usersys.redhat.com>
Message-ID: <1190322274.2567.122.camel@localhost.localdomain>

On Thu, 2007-09-13 at 10:27 -0700, Kevin McCarthy wrote:
> plain text document attachment (freeipa-181-usersort.diff)

Pushed



From ssorce at redhat.com  Thu Sep 20 21:04:49 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:04:49 -0400
Subject: [Freeipa-devel] [PATCH] javascript sorting of user results
	w/tablekit
In-Reply-To: <20070917160511.GA3793@moon.usersys.redhat.com>
References: <20070913172712.GA19864@moon.usersys.redhat.com>
	<20070913172919.GB19864@moon.usersys.redhat.com>
	<1189711794.18288.30.camel@localhost.localdomain>
	<20070917160511.GA3793@moon.usersys.redhat.com>
Message-ID: <1190322289.2567.124.camel@localhost.localdomain>

On Mon, 2007-09-17 at 09:05 -0700, Kevin McCarthy wrote:
> plain text document attachment (freeipa-193-sortimages.patch)

Pushed




From ssorce at redhat.com  Thu Sep 20 21:06:44 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:06:44 -0400
Subject: [Freeipa-devel] [PATCH] ticket forwarding and TurboGears
In-Reply-To: <46EAFE48.5090203@redhat.com>
References: <46E98051.3020703@redhat.com> <20070914200837.GA9414@redhat.com>
	<46EAFE48.5090203@redhat.com>
Message-ID: <1190322404.2567.126.camel@localhost.localdomain>

On Fri, 2007-09-14 at 17:34 -0400, Rob Crittenden wrote:
> plain text document attachment (freeipa-179-ticket.patch2)

Pushed but I had merge conflicts as Kevin imported the previous version.
Please check the merge is correct.

Simo.



From ssorce at redhat.com  Thu Sep 20 21:06:56 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:06:56 -0400
Subject: [Freeipa-devel] [PATCH] draft of group member management
In-Reply-To: <20070914221959.GD17116@moon.usersys.redhat.com>
References: <20070914221959.GD17116@moon.usersys.redhat.com>
Message-ID: <1190322416.2567.128.camel@localhost.localdomain>

On Fri, 2007-09-14 at 15:20 -0700, Kevin McCarthy wrote:
> plain text document attachment (freeipa-195-groupmember.patch)

Pushed



From ssorce at redhat.com  Thu Sep 20 21:07:09 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:07:09 -0400
Subject: [Freeipa-devel] [PATCH] persist group add and remove lists on
	server round trip
In-Reply-To: <20070917184347.GB3793@moon.usersys.redhat.com>
References: <20070917184347.GB3793@moon.usersys.redhat.com>
Message-ID: <1190322429.2567.130.camel@localhost.localdomain>

On Mon, 2007-09-17 at 11:43 -0700, Kevin McCarthy wrote:
> plain text document attachment (freeipa-196-persistaddremoves.patch)

Pushed



From ssorce at redhat.com  Thu Sep 20 21:07:21 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:07:21 -0400
Subject: [Freeipa-devel] [PATCH] group refinements
In-Reply-To: <20070917223456.GC3793@moon.usersys.redhat.com>
References: <20070917223456.GC3793@moon.usersys.redhat.com>
Message-ID: <1190322441.2567.132.camel@localhost.localdomain>

On Mon, 2007-09-17 at 15:34 -0700, Kevin McCarthy wrote:
> plain text document attachment (freeipa-197-groupdoubleadd.patch)

Pushed



From ssorce at redhat.com  Thu Sep 20 21:07:37 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:07:37 -0400
Subject: [Freeipa-devel] [PATCH] fixes to edit protected checkbox
In-Reply-To: <20070918174923.GC21122@moon.usersys.redhat.com>
References: <20070918174923.GC21122@moon.usersys.redhat.com>
Message-ID: <1190322457.2567.134.camel@localhost.localdomain>

On Tue, 2007-09-18 at 10:49 -0700, Kevin McCarthy wrote:
> plain text document attachment (freeipa-198-editprotectedfixes.patch)

Pushed



From ssorce at redhat.com  Thu Sep 20 21:07:52 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:07:52 -0400
Subject: [Freeipa-devel] [PATCH] user search client-side limit
In-Reply-To: <20070918215718.GE21122@moon.usersys.redhat.com>
References: <20070918215718.GE21122@moon.usersys.redhat.com>
Message-ID: <1190322472.2567.136.camel@localhost.localdomain>

On Tue, 2007-09-18 at 14:57 -0700, Kevin McCarthy wrote:
> plain text document attachment (freeipa-199-usersearchlimit.patch)

Pushed



From ssorce at redhat.com  Thu Sep 20 21:08:05 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:08:05 -0400
Subject: [Freeipa-devel] [PATCH] group search improvements
In-Reply-To: <20070919154421.GB19392@moon.usersys.redhat.com>
References: <20070918225352.GF21122@moon.usersys.redhat.com>
	<46F11A96.5040907@redhat.com>
	<20070919154421.GB19392@moon.usersys.redhat.com>
Message-ID: <1190322485.2567.138.camel@localhost.localdomain>

On Wed, 2007-09-19 at 08:44 -0700, Kevin McCarthy wrote:
> plain text document attachment (freeipa-200-groupsearch.patch)

Pushed



From ssorce at redhat.com  Thu Sep 20 21:08:19 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:08:19 -0400
Subject: [Freeipa-devel] [PATCH] handle group add/del errors
In-Reply-To: <20070919204702.GA21467@moon.usersys.redhat.com>
References: <20070919204702.GA21467@moon.usersys.redhat.com>
Message-ID: <1190322499.2567.140.camel@localhost.localdomain>

On Wed, 2007-09-19 at 13:47 -0700, Kevin McCarthy wrote:
> plain text document attachment (freeipa-201-groupfailures.patch)

Pushed



From ssorce at redhat.com  Thu Sep 20 21:08:33 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:08:33 -0400
Subject: [Freeipa-devel] [PATCH] add pasword change call to gui
In-Reply-To: <20070919225355.GB21467@moon.usersys.redhat.com>
References: <20070919225355.GB21467@moon.usersys.redhat.com>
Message-ID: <1190322513.2567.142.camel@localhost.localdomain>

On Wed, 2007-09-19 at 15:53 -0700, Kevin McCarthy wrote:
> plain text document attachment (freeipa-202-userpassword.patch)

Pushed



From kmccarth at redhat.com  Thu Sep 20 21:19:28 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 20 Sep 2007 14:19:28 -0700
Subject: [Freeipa-devel] [PATCH] ticket forwarding and TurboGears
In-Reply-To: <1190322404.2567.126.camel@localhost.localdomain>
References: <46E98051.3020703@redhat.com> <20070914200837.GA9414@redhat.com>
	<46EAFE48.5090203@redhat.com>
	<1190322404.2567.126.camel@localhost.localdomain>
Message-ID: <20070920211928.GB15868@moon.usersys.redhat.com>

Simo Sorce wrote:
> On Fri, 2007-09-14 at 17:34 -0400, Rob Crittenden wrote:
> > plain text document attachment (freeipa-179-ticket.patch2)
> 
> Pushed but I had merge conflicts as Kevin imported the previous version.
> Please check the merge is correct.

I missed importing Rob's patch.  My subsequent code isn't using the
correct new calls.  I will submit a patch today to fix this problem.

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070920/be0f728b/attachment.bin>

From ssorce at redhat.com  Thu Sep 20 21:20:38 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:20:38 -0400
Subject: [Freeipa-devel] [PATCH] remove proxy support
In-Reply-To: <46F27E6B.1080001@redhat.com>
References: <46F27E6B.1080001@redhat.com>
Message-ID: <1190323238.2567.144.camel@localhost.localdomain>

On Thu, 2007-09-20 at 10:06 -0400, Rob Crittenden wrote:
> differences between files attachment (freeipa-180-noproxy.patch)

Acked and pushed



From ssorce at redhat.com  Thu Sep 20 21:20:51 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:20:51 -0400
Subject: [Freeipa-devel] PATCH: setup bind as part of server configuration
In-Reply-To: <1190316006.2567.113.camel@localhost.localdomain>
References: <1190316006.2567.113.camel@localhost.localdomain>
Message-ID: <1190323251.2567.146.camel@localhost.localdomain>

On Thu, 2007-09-20 at 15:20 -0400, Simo Sorce wrote:
> differences between files attachment (freeipa-180-setup-bind.patch)

Pushed



From ssorce at redhat.com  Thu Sep 20 21:21:32 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 17:21:32 -0400
Subject: [Freeipa-devel] [PATCH] Initial password setting support
In-Reply-To: <46E6E758.6030006@redhat.com>
References: <46E6E758.6030006@redhat.com>
Message-ID: <1190323292.2567.148.camel@localhost.localdomain>

On Tue, 2007-09-11 at 15:07 -0400, Rob Crittenden wrote:
> differences between files attachment (freeipa-175-password.diff)

Pushed



From kmccarth at redhat.com  Thu Sep 20 21:54:29 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 20 Sep 2007 14:54:29 -0700
Subject: [Freeipa-devel] [PATCH] krbcache setting fixes
Message-ID: <20070920215429.GC15868@moon.usersys.redhat.com>

This patch is to add the set_krbcache() calls to the new methods in
controller I added.

The patch is untested - I'm still having troubles with krb ticket
issues.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190325203 25200
# Node ID 62a1ecb5573f42faa4453b094678abc6a784c2b5
# Parent  e0c187057e32e2e58510023e427f5a615ab17539
Add set_krbccache() calls to new controller methods.
Small fix to proxyprovider for anonymous case.

diff -r e0c187057e32 -r 62a1ecb5573f ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Thu Sep 20 16:58:54 2007 -0400
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Thu Sep 20 14:53:23 2007 -0700
@@ -228,7 +228,7 @@ class Root(controllers.RootController):
     def userlist_ajax(self, **kw):
         """Searches for users and displays list of results in a table.
            This method is used for ajax calls."""
-        client.set_principal(identity.current.user_name)
+        client.set_krbccache(os.environ["KRB5CCNAME"])
         users = []
         searchlimit = 100
         uid = kw.get('uid')
@@ -332,7 +332,7 @@ class Root(controllers.RootController):
         if (len(givenname) == 0) or (len(sn) == 0):
             return ""
 
-        client.set_principal(identity.current.user_name)
+        client.set_krbccache(os.environ["KRB5CCNAME"])
         givenname = givenname.lower()
         sn = sn.lower()
 
@@ -384,7 +384,7 @@ class Root(controllers.RootController):
         if tg_errors:
             turbogears.flash("There was a problem with the form!")
 
-        client.set_principal(identity.current.user_name)
+        client.set_krbccache(os.environ["KRB5CCNAME"])
 
         return dict(form=group_new_form)
 
@@ -393,7 +393,7 @@ class Root(controllers.RootController):
     def groupcreate(self, **kw):
         """Creates a new group"""
         restrict_post()
-        client.set_principal(identity.current.user_name)
+        client.set_krbccache(os.environ["KRB5CCNAME"])
 
         if kw.get('submit') == 'Cancel':
             turbogears.flash("Add group cancelled")
@@ -427,7 +427,7 @@ class Root(controllers.RootController):
         if tg_errors:
             turbogears.flash("There was a problem with the form!")
 
-        client.set_principal(identity.current.user_name)
+        client.set_krbccache(os.environ["KRB5CCNAME"])
         try:
             group = client.get_group_by_cn(cn, group_fields)
 
@@ -470,7 +470,7 @@ class Root(controllers.RootController):
     def groupupdate(self, **kw):
         """Updates an existing group"""
         restrict_post()
-        client.set_principal(identity.current.user_name)
+        client.set_krbccache(os.environ["KRB5CCNAME"])
         if kw.get('submit') == 'Cancel Edit':
             turbogears.flash("Edit group cancelled")
             raise turbogears.redirect('/groupshow', cn=kw.get('cn'))
@@ -573,7 +573,7 @@ class Root(controllers.RootController):
     @identity.require(identity.not_anonymous())
     def grouplist(self, **kw):
         """Search for groups and display results"""
-        client.set_principal(identity.current.user_name)
+        client.set_krbccache(os.environ["KRB5CCNAME"])
         groups = None
         # counter = 0
         criteria = kw.get('criteria')
@@ -595,7 +595,7 @@ class Root(controllers.RootController):
     @identity.require(identity.not_anonymous())
     def groupshow(self, cn):
         """Retrieve a single group for display"""
-        client.set_principal(identity.current.user_name)
+        client.set_krbccache(os.environ["KRB5CCNAME"])
         try:
             group = client.get_group_by_cn(cn, group_fields)
             group_dict = group.toDict()
diff -r e0c187057e32 -r 62a1ecb5573f ipa-server/ipa-gui/ipagui/proxyprovider.py
--- a/ipa-server/ipa-gui/ipagui/proxyprovider.py	Thu Sep 20 16:58:54 2007 -0400
+++ b/ipa-server/ipa-gui/ipagui/proxyprovider.py	Thu Sep 20 14:53:23 2007 -0700
@@ -19,8 +19,7 @@ class IPA_User(object):
 
 class ProxyIdentity(object):
     def __init__(self, visit_key, user=None):
-        if user:
-            self._user= user
+        self._user= user
         self.visit_key= visit_key
    
     def _get_user(self):
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070920/5de6280b/attachment.bin>

From ssorce at redhat.com  Thu Sep 20 22:13:13 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 20 Sep 2007 18:13:13 -0400
Subject: [Freeipa-devel] [PATCH] krbcache setting fixes
In-Reply-To: <20070920215429.GC15868@moon.usersys.redhat.com>
References: <20070920215429.GC15868@moon.usersys.redhat.com>
Message-ID: <1190326393.2567.150.camel@localhost.localdomain>

On Thu, 2007-09-20 at 14:54 -0700, Kevin McCarthy wrote:
> This patch is to add the set_krbcache() calls to the new methods in
> controller I added.
> 
> The patch is untested - I'm still having troubles with krb ticket
> issues.

Acked an pushed.



From kmccarth at redhat.com  Thu Sep 20 23:44:56 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 20 Sep 2007 16:44:56 -0700
Subject: [Freeipa-devel] web gui dev env issues
Message-ID: <20070920234456.GE15868@moon.usersys.redhat.com>

So after the latest push, I've still been unable to get my dev
environment working again.  My debugging shows the correct file name is
making it all the way up to the
conn.set_krbccache(krbccache) in funcs.py.

In my krb5kdc.log file, I'm seeing a couple interesting errors:

Sep 20 14:53:57 tuna.usersys.redhat.com krb5kdc[3602](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) 172.16.25.136: UNKNOWN_SERVER: authtime 1190325099,  test at FREEIPA.ORG for host/dhcp-172-16-25-252.sfbay.redhat.com at FREEIPA.ORG, Server not found in Kerberos database

The interesting thing is that my vm running ipa is tuna.usersys.redhat.com
(172.16.25.136).  The host referenced above in the log file is my main laptop -
where I'm running the browser hitting the web gui.  Is my browser host
information somehow making it all the way through as part of this?

The other line that may be relevant is

Sep 20 15:55:18 tuna.usersys.redhat.com krb5kdc[3602](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 172.16.25.136: NEEDED_PREAUTH: test at FREEIPA.ORG for krbtgt/FREEIPA.ORG at FREEIPA.ORG, Additional pre-authentication required


Any ideas?  I'm at a loss.

Thanks,

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070920/b3e603bf/attachment.bin>

From ssorce at redhat.com  Fri Sep 21 13:21:10 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 21 Sep 2007 09:21:10 -0400
Subject: [Freeipa-devel] web gui dev env issues
In-Reply-To: <20070920234456.GE15868@moon.usersys.redhat.com>
References: <20070920234456.GE15868@moon.usersys.redhat.com>
Message-ID: <1190380870.2567.154.camel@localhost.localdomain>

On Thu, 2007-09-20 at 16:44 -0700, Kevin McCarthy wrote:
> So after the latest push, I've still been unable to get my dev
> environment working again.  My debugging shows the correct file name is
> making it all the way up to the
> conn.set_krbccache(krbccache) in funcs.py.
> 
> In my krb5kdc.log file, I'm seeing a couple interesting errors:
> 
> Sep 20 14:53:57 tuna.usersys.redhat.com krb5kdc[3602](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) 172.16.25.136: UNKNOWN_SERVER: authtime 1190325099,  test at FREEIPA.ORG for host/dhcp-172-16-25-252.sfbay.redhat.com at FREEIPA.ORG, Server not found in Kerberos database
> 
> The interesting thing is that my vm running ipa is tuna.usersys.redhat.com
> (172.16.25.136).  The host referenced above in the log file is my main laptop -
> where I'm running the browser hitting the web gui.  Is my browser host
> information somehow making it all the way through as part of this?

This must be a bug, I see no reason why something should try to contact
your laptop.

> The other line that may be relevant is
> 
> Sep 20 15:55:18 tuna.usersys.redhat.com krb5kdc[3602](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 172.16.25.136: NEEDED_PREAUTH: test at FREEIPA.ORG for krbtgt/FREEIPA.ORG at FREEIPA.ORG, Additional pre-authentication required
> 

This means the account does not have the Preauth bit set. When it is set
the key material is calculated differently. Uhmm I guess I should set
this in the ipa_kpasswd module
Meanwhile you can work around this by removing the option
from /var/kerberos/krb5kdc/kdc.conf and restart krb5kdc


Simo.



From rcritten at redhat.com  Fri Sep 21 14:50:34 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 21 Sep 2007 10:50:34 -0400
Subject: [Freeipa-devel] [PATCH] command-line interactivity
Message-ID: <46F3DA3A.6010801@redhat.com>

- Give ipa-adduser, ipa-addgroup and ipa-usermod an interactive mode
- Add ipa-passwd tool
- Add simple field validation package
-This patch adds a package requirement, python-krbV. This is needed to 
determine the current user based on their kerberos ticket.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-200-interactive.patch
Type: text/x-patch
Size: 18173 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070921/a27d7ae5/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070921/a27d7ae5/attachment-0001.bin>

From rcritten at redhat.com  Fri Sep 21 15:55:50 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 21 Sep 2007 11:55:50 -0400
Subject: [Freeipa-devel] [PATCH] command-line interactivity
In-Reply-To: <46F3DA3A.6010801@redhat.com>
References: <46F3DA3A.6010801@redhat.com>
Message-ID: <46F3E986.30205@redhat.com>

Rob Crittenden wrote:
> - Give ipa-adduser, ipa-addgroup and ipa-usermod an interactive mode
> - Add ipa-passwd tool
> - Add simple field validation package
> -This patch adds a package requirement, python-krbV. This is needed to 
> determine the current user based on their kerberos ticket.
> 
> rob

Ah crud, ignore this patch. I need to resubmit.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070921/e28dcc03/attachment.bin>

From rcritten at redhat.com  Fri Sep 21 15:58:57 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 21 Sep 2007 11:58:57 -0400
Subject: [Freeipa-devel] [PATCH] command-line interactivity
In-Reply-To: <46F3DA3A.6010801@redhat.com>
References: <46F3DA3A.6010801@redhat.com>
Message-ID: <46F3EA41.3060904@redhat.com>

Rob Crittenden wrote:
> - Give ipa-adduser, ipa-addgroup and ipa-usermod an interactive mode
> - Add ipa-passwd tool
> - Add simple field validation package
> -This patch adds a package requirement, python-krbV. This is needed to 
> determine the current user based on their kerberos ticket.

I forgot to include the new files in the patch. This one replaces the 
earlier patch so we can have a unified check-in message.

rob
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: freeipa-200-interactive.patch2
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070921/41badc0c/attachment.ksh>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070921/41badc0c/attachment.bin>

From rcritten at redhat.com  Fri Sep 21 16:06:25 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 21 Sep 2007 12:06:25 -0400
Subject: [Freeipa-devel] [PATCH] handle login failures in GUI
Message-ID: <46F3EC01.1030705@redhat.com>

- Add a failed login page. In theory it should never been seen but it 
makes things nicer
- Remove the login.kid page template
- Remove the login link from master.kid

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-202-login.patch
Type: text/x-patch
Size: 6421 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070921/6b352cf1/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070921/6b352cf1/attachment-0001.bin>

From kmccarth at redhat.com  Fri Sep 21 16:17:00 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Fri, 21 Sep 2007 09:17:00 -0700
Subject: [Freeipa-devel] [PATCH] handle login failures in GUI
In-Reply-To: <46F3EC01.1030705@redhat.com>
References: <46F3EC01.1030705@redhat.com>
Message-ID: <20070921161659.GA13130@moon.usersys.redhat.com>

Rob Crittenden wrote:
> - Add a failed login page. In theory it should never been seen but it makes 
> things nicer
> - Remove the login.kid page template
> - Remove the login link from master.kid

Looks good.

A future todo would be to have loginfailed.kid extend
master.kid so it uses the same layout automatically.  But then we'll
need to somehow "hide" links, so it may not be worth the effort.

-Kevin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070921/38c44210/attachment.bin>

From rcritten at redhat.com  Fri Sep 21 16:25:54 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 21 Sep 2007 12:25:54 -0400
Subject: [Freeipa-devel] [PATCH] handle login failures in GUI
In-Reply-To: <20070921161659.GA13130@moon.usersys.redhat.com>
References: <46F3EC01.1030705@redhat.com>
	<20070921161659.GA13130@moon.usersys.redhat.com>
Message-ID: <46F3F092.2060103@redhat.com>

Kevin McCarthy wrote:
> Rob Crittenden wrote:
>> - Add a failed login page. In theory it should never been seen but it makes 
>> things nicer
>> - Remove the login.kid page template
>> - Remove the login link from master.kid
> 
> Looks good.
> 
> A future todo would be to have loginfailed.kid extend
> master.kid so it uses the same layout automatically.  But then we'll
> need to somehow "hide" links, so it may not be worth the effort.
> 
>

That is why I pulled the logo stuff out of master.kid. I had originally 
extended it but you could see all the links on the side :-(

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070921/f1714824/attachment.bin>

From kmccarth at redhat.com  Fri Sep 21 16:29:12 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Fri, 21 Sep 2007 09:29:12 -0700
Subject: [Freeipa-devel] [PATCH] command-line interactivity
In-Reply-To: <46F3EA41.3060904@redhat.com>
References: <46F3DA3A.6010801@redhat.com> <46F3EA41.3060904@redhat.com>
Message-ID: <20070921162912.GB13130@moon.usersys.redhat.com>

Rob Crittenden wrote:
> Rob Crittenden wrote:
>> - Give ipa-adduser, ipa-addgroup and ipa-usermod an interactive mode
>> - Add ipa-passwd tool
>> - Add simple field validation package
>> -This patch adds a package requirement, python-krbV. This is needed to 
>> determine the current user based on their kerberos ticket.
>
> I forgot to include the new files in the patch. This one replaces the 
> earlier patch so we can have a unified check-in message.

Looks good.  And unit tests even!!!

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 2228 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070921/3ee700e3/attachment.bin>

From ssorce at redhat.com  Fri Sep 21 17:00:19 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 21 Sep 2007 13:00:19 -0400
Subject: [Freeipa-devel] [PATCH] handle login failures in GUI
In-Reply-To: <46F3F092.2060103@redhat.com>
References: <46F3EC01.1030705@redhat.com>
	<20070921161659.GA13130@moon.usersys.redhat.com>
	<46F3F092.2060103@redhat.com>
Message-ID: <1190394019.2567.167.camel@localhost.localdomain>

On Fri, 2007-09-21 at 12:25 -0400, Rob Crittenden wrote:
> Kevin McCarthy wrote:
> > Rob Crittenden wrote:
> >> - Add a failed login page. In theory it should never been seen but it makes 
> >> things nicer
> >> - Remove the login.kid page template
> >> - Remove the login link from master.kid
> > 
> > Looks good.
> > 
> > A future todo would be to have loginfailed.kid extend
> > master.kid so it uses the same layout automatically.  But then we'll
> > need to somehow "hide" links, so it may not be worth the effort.
> > 
> >
> 
> That is why I pulled the logo stuff out of master.kid. I had originally 
> extended it but you could see all the links on the side :-(

May be split master in a common template for any usage, even anonymous?
Then you can have an authedmaster.kid file that inherit from it as well
as the loginfailed.kid one ?

Just an idea.
Simo.



From kmccarth at redhat.com  Fri Sep 21 17:05:11 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Fri, 21 Sep 2007 10:05:11 -0700
Subject: [Freeipa-devel] [PATCH] handle login failures in GUI
In-Reply-To: <1190394019.2567.167.camel@localhost.localdomain>
References: <46F3EC01.1030705@redhat.com>
	<20070921161659.GA13130@moon.usersys.redhat.com>
	<46F3F092.2060103@redhat.com>
	<1190394019.2567.167.camel@localhost.localdomain>
Message-ID: <20070921170510.GE13130@moon.usersys.redhat.com>

Simo Sorce wrote:
> May be split master in a common template for any usage, even anonymous?
> Then you can have an authedmaster.kid file that inherit from it as well
> as the loginfailed.kid one ?

I finally got a copy of the TG book this week.  The last time I tried to
figure out template inheritance it gave me a headache (it's not as
simple as it should be).  After I look over the template part of the
book I'll see if I can make things better.

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070921/2994b167/attachment.bin>

From rcritten at redhat.com  Fri Sep 21 19:23:15 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 21 Sep 2007 15:23:15 -0400
Subject: [Freeipa-devel] [PATCH] Add a little debugging
Message-ID: <46F41A23.2030701@redhat.com>

Added an Apache/mod_python config option to enable LDAP debugging. This 
should help diagnose problems.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-203-debug.patch
Type: text/x-patch
Size: 5982 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070921/8172b38d/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070921/8172b38d/attachment-0001.bin>

From rcritten at redhat.com  Sat Sep 22 02:24:47 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 21 Sep 2007 22:24:47 -0400
Subject: [Freeipa-devel] gui not packaged
Message-ID: <46F47CEF.9010303@redhat.com>

I just noticed that we aren't packaging the TurboGears GUI.

Now that I think about it, I'm not sure where we should put it.

Any bright ideas?

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070921/03f85167/attachment.bin>

From kmacmill at redhat.com  Mon Sep 24 15:26:34 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 24 Sep 2007 11:26:34 -0400
Subject: [Freeipa-devel] gui not packaged
In-Reply-To: <46F47CEF.9010303@redhat.com>
References: <46F47CEF.9010303@redhat.com>
Message-ID: <1190647594.4732.33.camel@localhost.localdomain>

On Fri, 2007-09-21 at 22:24 -0400, Rob Crittenden wrote:
> I just noticed that we aren't packaging the TurboGears GUI.
> 

Minor detail.

> Now that I think about it, I'm not sure where we should put it.
> 
> Any bright ideas?
> 

No bright ideas, but doesn't this somewhat depend on how we are going to
deploy this? If we are going to sit behind apache then perhaps some
apache related location is appropriate. Otherwise, I'm not sure. I don't
think in the python site-lib (like the setup.py that is there would do)
is a good idea.

Karl



From kmccarth at redhat.com  Mon Sep 24 15:42:32 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Mon, 24 Sep 2007 08:42:32 -0700
Subject: [Freeipa-devel] gui not packaged
In-Reply-To: <1190647594.4732.33.camel@localhost.localdomain>
References: <46F47CEF.9010303@redhat.com>
	<1190647594.4732.33.camel@localhost.localdomain>
Message-ID: <20070924154231.GA3516@moon.usersys.redhat.com>

Karl MacMillan wrote:
> On Fri, 2007-09-21 at 22:24 -0400, Rob Crittenden wrote:
> > I just noticed that we aren't packaging the TurboGears GUI.
> > 
> 
> Minor detail.
> 
> > Now that I think about it, I'm not sure where we should put it.
> > 
> > Any bright ideas?
> > 
> 
> No bright ideas, but doesn't this somewhat depend on how we are going to
> deploy this? If we are going to sit behind apache then perhaps some
> apache related location is appropriate. Otherwise, I'm not sure. I don't
> think in the python site-lib (like the setup.py that is there would do)
> is a good idea.

Yeah, perhaps under a /usr/share/ipa directory or something like that
would be a reasonable place.

-Kevin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/6e448f83/attachment.bin>

From rcritten at redhat.com  Mon Sep 24 19:39:20 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 24 Sep 2007 15:39:20 -0400
Subject: [Freeipa-devel] [PATCH] Show unauthenticated page
Message-ID: <46F81268.9060401@redhat.com>

Show a hopefully useful set of pages when the kerberos connection fails.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-200-interactive.patch
Type: text/x-patch
Size: 18173 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/3a25cc2d/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/3a25cc2d/attachment-0001.bin>

From rcritten at redhat.com  Mon Sep 24 19:43:22 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 24 Sep 2007 15:43:22 -0400
Subject: [Freeipa-devel] [PATCH] catch more exceptions
Message-ID: <46F8135A.6010702@redhat.com>

Some of the cmdline tools weren't catching IPAErrors. Fix that.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-205-exception.patch
Type: text/x-patch
Size: 2035 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/e81ee207/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/e81ee207/attachment-0001.bin>

From rcritten at redhat.com  Mon Sep 24 19:46:38 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 24 Sep 2007 15:46:38 -0400
Subject: [Freeipa-devel] [PATCH] more no proxy work
Message-ID: <46F8141E.80407@redhat.com>

Falling back to trying proxy auth was generating some bogus errors that 
just caused confusion. Don't even try falling back now, just let things 
fail.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-206-noproxy.patch
Type: text/x-patch
Size: 1187 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/6927de2b/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/6927de2b/attachment-0001.bin>

From rcritten at redhat.com  Mon Sep 24 19:48:28 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 24 Sep 2007 15:48:28 -0400
Subject: [Freeipa-devel] [PATCH] a little more debug output
Message-ID: <46F8148C.8050208@redhat.com>

Print the request environment for debugging purposes.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-207-debug.patch
Type: text/x-patch
Size: 1381 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/a890e59f/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/a890e59f/attachment-0001.bin>

From rcritten at redhat.com  Mon Sep 24 19:50:26 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 24 Sep 2007 15:50:26 -0400
Subject: [Freeipa-devel] [PATCH] install the new error pages
Message-ID: <46F81502.3040309@redhat.com>

Forgot to include the Makefile in the patch to add kerberos auth failure 
pages.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-208-errors.patch
Type: text/x-patch
Size: 654 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/b22d76df/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/b22d76df/attachment-0001.bin>

From kmacmill at redhat.com  Mon Sep 24 19:51:29 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 24 Sep 2007 15:51:29 -0400
Subject: [Freeipa-devel] [PATCH] Show unauthenticated page
In-Reply-To: <46F81268.9060401@redhat.com>
References: <46F81268.9060401@redhat.com>
Message-ID: <1190663489.8631.45.camel@localhost.localdomain>

On Mon, 2007-09-24 at 15:39 -0400, Rob Crittenden wrote:
> Show a hopefully useful set of pages when the kerberos connection fails.
> 

Is this the correct patch attached?

Karl



From kmacmill at redhat.com  Mon Sep 24 19:52:19 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 24 Sep 2007 15:52:19 -0400
Subject: [Freeipa-devel] [PATCH] catch more exceptions
In-Reply-To: <46F8135A.6010702@redhat.com>
References: <46F8135A.6010702@redhat.com>
Message-ID: <1190663539.8631.47.camel@localhost.localdomain>

On Mon, 2007-09-24 at 15:43 -0400, Rob Crittenden wrote:
> Some of the cmdline tools weren't catching IPAErrors. Fix that.
> 

Ached and pushed.

Karl



From rcritten at redhat.com  Mon Sep 24 19:54:08 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 24 Sep 2007 15:54:08 -0400
Subject: [Freeipa-devel] [PATCH] client browser setup
Message-ID: <46F815E0.1010601@redhat.com>

First crack at automated browser configuration. Requires running a 
script to set things up on the client machine.

One will need to run browsersetup.sh in order to get the configuration 
and links setup properly.

This will blow up if Firefox is upgraded though. Each Firefox gets its 
own /usr/lib/firefox-version directory. This script will need to be run 
each time a new version of Firefox is installed. Note that I'm fairly 
sure that this will only affect new profiles, not existing ones.

So if you get things setup properly they will work ok even through 
Firefox updates, but any new profiles created after an upgrade without 
the script being run won't work properly.

Not sure what the right solution for that is, but its a start.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-209-clientsetup.patch
Type: text/x-patch
Size: 6373 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/829c709d/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/829c709d/attachment-0001.bin>

From kmacmill at redhat.com  Mon Sep 24 19:54:42 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 24 Sep 2007 15:54:42 -0400
Subject: [Freeipa-devel] [PATCH] more no proxy work
In-Reply-To: <46F8141E.80407@redhat.com>
References: <46F8141E.80407@redhat.com>
Message-ID: <1190663682.8631.49.camel@localhost.localdomain>

On Mon, 2007-09-24 at 15:46 -0400, Rob Crittenden wrote:
> Falling back to trying proxy auth was generating some bogus errors that 
> just caused confusion. Don't even try falling back now, just let things 
> fail.

Acked and pushed. We could also just delete that code and trust the
revision control system.

Karl



From rcritten at redhat.com  Mon Sep 24 19:55:27 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 24 Sep 2007 15:55:27 -0400
Subject: [Freeipa-devel] [PATCH] Show unauthenticated page
In-Reply-To: <1190663489.8631.45.camel@localhost.localdomain>
References: <46F81268.9060401@redhat.com>
	<1190663489.8631.45.camel@localhost.localdomain>
Message-ID: <46F8162F.5040203@redhat.com>

Karl MacMillan wrote:
> On Mon, 2007-09-24 at 15:39 -0400, Rob Crittenden wrote:
>> Show a hopefully useful set of pages when the kerberos connection fails.
>>
> 
> Is this the correct patch attached?
> 
> Karl
> 

Crud. It is now.

thanks

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-204-error.patch
Type: text/x-patch
Size: 4312 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/2d523600/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/2d523600/attachment-0001.bin>

From kmacmill at redhat.com  Mon Sep 24 20:12:06 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 24 Sep 2007 16:12:06 -0400
Subject: [Freeipa-devel] [PATCH] handle login failures in GUI
In-Reply-To: <46F3EC01.1030705@redhat.com>
References: <46F3EC01.1030705@redhat.com>
Message-ID: <1190664726.8631.58.camel@localhost.localdomain>

On Fri, 2007-09-21 at 12:06 -0400, Rob Crittenden wrote:
> - Add a failed login page. In theory it should never been seen but it 
> makes things nicer
> - Remove the login.kid page template
> - Remove the login link from master.kid
> 

Pushed.



From kmacmill at redhat.com  Mon Sep 24 20:13:13 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 24 Sep 2007 16:13:13 -0400
Subject: [Freeipa-devel] [PATCH] command-line interactivity
In-Reply-To: <46F3EA41.3060904@redhat.com>
References: <46F3DA3A.6010801@redhat.com>  <46F3EA41.3060904@redhat.com>
Message-ID: <1190664793.8631.60.camel@localhost.localdomain>

On Fri, 2007-09-21 at 11:58 -0400, Rob Crittenden wrote:
> Rob Crittenden wrote:
> > - Give ipa-adduser, ipa-addgroup and ipa-usermod an interactive mode
> > - Add ipa-passwd tool
> > - Add simple field validation package
> > -This patch adds a package requirement, python-krbV. This is needed to 
> > determine the current user based on their kerberos ticket.
> 
> I forgot to include the new files in the patch. This one replaces the 
> earlier patch so we can have a unified check-in message.
> 
> rob

Pushed.





From kmacmill at redhat.com  Mon Sep 24 20:14:28 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 24 Sep 2007 16:14:28 -0400
Subject: [Freeipa-devel] [PATCH] Add a little debugging
In-Reply-To: <46F41A23.2030701@redhat.com>
References: <46F41A23.2030701@redhat.com>
Message-ID: <1190664868.8631.62.camel@localhost.localdomain>

On Fri, 2007-09-21 at 15:23 -0400, Rob Crittenden wrote:
> Added an Apache/mod_python config option to enable LDAP debugging. This 
> should help diagnose problems.
> 

Pushed.



From kmacmill at redhat.com  Mon Sep 24 20:15:10 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 24 Sep 2007 16:15:10 -0400
Subject: [Freeipa-devel] [PATCH] a little more debug output
In-Reply-To: <46F8148C.8050208@redhat.com>
References: <46F8148C.8050208@redhat.com>
Message-ID: <1190664910.8631.64.camel@localhost.localdomain>

On Mon, 2007-09-24 at 15:48 -0400, Rob Crittenden wrote:
> Print the request environment for debugging purposes.
> 

Acked and pushed.



From kmacmill at redhat.com  Mon Sep 24 20:15:56 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 24 Sep 2007 16:15:56 -0400
Subject: [Freeipa-devel] [PATCH] Show unauthenticated page
In-Reply-To: <46F8162F.5040203@redhat.com>
References: <46F81268.9060401@redhat.com>
	<1190663489.8631.45.camel@localhost.localdomain>
	<46F8162F.5040203@redhat.com>
Message-ID: <1190664956.8631.66.camel@localhost.localdomain>

On Mon, 2007-09-24 at 15:55 -0400, Rob Crittenden wrote:
> Karl MacMillan wrote:
> > On Mon, 2007-09-24 at 15:39 -0400, Rob Crittenden wrote:
> >> Show a hopefully useful set of pages when the kerberos connection fails.
> >>
> > 
> > Is this the correct patch attached?
> > 
> > Karl
> > 
> 
> Crud. It is now.

Acked and pushed.

"screenies"?

Karl



From kmacmill at redhat.com  Mon Sep 24 20:16:19 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 24 Sep 2007 16:16:19 -0400
Subject: [Freeipa-devel] [PATCH] install the new error pages
In-Reply-To: <46F81502.3040309@redhat.com>
References: <46F81502.3040309@redhat.com>
Message-ID: <1190664979.8631.68.camel@localhost.localdomain>

On Mon, 2007-09-24 at 15:50 -0400, Rob Crittenden wrote:
> Forgot to include the Makefile in the patch to add kerberos auth failure 
> pages.
> 

Acked and pushed.

Karl



From kmacmill at redhat.com  Mon Sep 24 20:17:37 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Mon, 24 Sep 2007 16:17:37 -0400
Subject: [Freeipa-devel] [PATCH] client browser setup
In-Reply-To: <46F815E0.1010601@redhat.com>
References: <46F815E0.1010601@redhat.com>
Message-ID: <1190665057.8631.70.camel@localhost.localdomain>

On Mon, 2007-09-24 at 15:54 -0400, Rob Crittenden wrote:
> First crack at automated browser configuration. Requires running a 
> script to set things up on the client machine.
> 
> One will need to run browsersetup.sh in order to get the configuration 
> and links setup properly.
> 
> This will blow up if Firefox is upgraded though. Each Firefox gets its 
> own /usr/lib/firefox-version directory. This script will need to be run 
> each time a new version of Firefox is installed. Note that I'm fairly 
> sure that this will only affect new profiles, not existing ones.
> 
> So if you get things setup properly they will work ok even through 
> Firefox updates, but any new profiles created after an upgrade without 
> the script being run won't work properly.
> 
> Not sure what the right solution for that is, but its a start.
> 

Acked and pushed.

Karl



From rcritten at redhat.com  Mon Sep 24 20:45:15 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 24 Sep 2007 16:45:15 -0400
Subject: [Freeipa-devel] [PATCH] per-user browser configuration
Message-ID: <46F821DB.6050208@redhat.com>

The current code will modify the Firefox app.js which will cause the an 
rpm -V to choke.

Add a new script that will change the current user's configuration.

This needs more work to not hardcode freeipa.org.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-213-browser.patch
Type: text/x-patch
Size: 5763 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/5a652cf0/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/5a652cf0/attachment-0001.bin>

From rcritten at redhat.com  Mon Sep 24 21:37:49 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Mon, 24 Sep 2007 17:37:49 -0400
Subject: [Freeipa-devel] [PATCH] actually commit usersetup.sh
Message-ID: <46F82E2D.2010509@redhat.com>

In my rush to update the browser settings I forgot to add the new 
script. It is in this patch.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-214-usersetup.patch
Type: text/x-patch
Size: 2222 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/b4b62071/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070924/b4b62071/attachment-0001.bin>

From rcritten at redhat.com  Tue Sep 25 13:05:12 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Tue, 25 Sep 2007 09:05:12 -0400
Subject: [Freeipa-devel] [PATCH] bugfix for TurboGears
Message-ID: <46F90788.1080901@redhat.com>

Some new debugging code I added caused TurboGears to throw up. This 
should fix it.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-215-bugfix.patch
Type: text/x-patch
Size: 842 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070925/b2dd97b1/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070925/b2dd97b1/attachment-0001.bin>

From rcritten at redhat.com  Tue Sep 25 13:12:09 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Tue, 25 Sep 2007 09:12:09 -0400
Subject: [Freeipa-devel] [PATCH] make testing easier
Message-ID: <46F90929.2060804@redhat.com>

Simo is having problems with his Apache server seemingly not doing 
ticket forwarding but only for mod_python. In trying to help him 
diagnose this it became very apparent that even this low-level testing 
was difficult to setup.

I've redone ipa.conf to not require Kerberos for the / but instead just 
target it for the things we use (plus /cgi-bin for good measure).

I've added a new uri, /ipatest, that is shipped commented out but can be 
used for this and any future basic testing needs.

I also include a simple CGI and a simple mod_python script that uses 
python-ldap to do a GSSAPI LDAP connection similar to what we do in IPA.

Please consider this carefully. I'm a little nervous about the ipa.conf 
changes but they were necessary because for some reason curl choked when 
I had <Location /> protected by Kerberos (either a bug in Apache or curl 
or both, but regardless testing was impossibe).

The only risk is that we (or someone) adds a new URI to do work and it 
ends up not being protected by Kerberos. A small risk but a real one.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-216-testing.patch
Type: text/x-patch
Size: 8976 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070925/5d546624/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070925/5d546624/attachment-0001.bin>

From rcritten at redhat.com  Tue Sep 25 13:34:45 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Tue, 25 Sep 2007 09:34:45 -0400
Subject: [Freeipa-devel] [PATCH] make testing easier
In-Reply-To: <46F90929.2060804@redhat.com>
References: <46F90929.2060804@redhat.com>
Message-ID: <46F90E75.40602@redhat.com>

Rob Crittenden wrote:
> Simo is having problems with his Apache server seemingly not doing 
> ticket forwarding but only for mod_python. In trying to help him 
> diagnose this it became very apparent that even this low-level testing 
> was difficult to setup.
> 
> I've redone ipa.conf to not require Kerberos for the / but instead just 
> target it for the things we use (plus /cgi-bin for good measure).
> 
> I've added a new uri, /ipatest, that is shipped commented out but can be 
> used for this and any future basic testing needs.
> 
> I also include a simple CGI and a simple mod_python script that uses 
> python-ldap to do a GSSAPI LDAP connection similar to what we do in IPA.
> 
> Please consider this carefully. I'm a little nervous about the ipa.conf 
> changes but they were necessary because for some reason curl choked when 
> I had <Location /> protected by Kerberos (either a bug in Apache or curl 
> or both, but regardless testing was impossibe).
> 
> The only risk is that we (or someone) adds a new URI to do work and it 
> ends up not being protected by Kerberos. A small risk but a real one.
>

Hmm, found an issue with the Apache configuration. Still review the 
patch but not ready for commit.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070925/44d7393b/attachment.bin>

From rcritten at redhat.com  Tue Sep 25 14:12:51 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Tue, 25 Sep 2007 10:12:51 -0400
Subject: [Freeipa-devel] [PATCH] address issues with previous test patch
Message-ID: <46F91763.9060901@redhat.com>

This patch depends on the previous patch, freeipa-216-testint.patch.

I stupidly used the same directory for both the tests and the real IPA 
server, oops. This fixes that.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-217-testing.patch
Type: text/x-patch
Size: 1441 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070925/7dafb5b9/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070925/7dafb5b9/attachment-0001.bin>

From kmccarth at redhat.com  Tue Sep 25 17:16:42 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Tue, 25 Sep 2007 10:16:42 -0700
Subject: [Freeipa-devel] [PATCH] bugfix for TurboGears
In-Reply-To: <46F90788.1080901@redhat.com>
References: <46F90788.1080901@redhat.com>
Message-ID: <20070925171642.GC20742@moon.usersys.redhat.com>

Rob Crittenden wrote:
> Some new debugging code I added caused TurboGears to throw up. This should 
> fix it.

Looks good.

-Kevin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070925/b907df90/attachment.bin>

From kmacmill at redhat.com  Tue Sep 25 17:22:50 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 25 Sep 2007 13:22:50 -0400
Subject: [Freeipa-devel] [PATCH] per-user browser configuration
In-Reply-To: <46F821DB.6050208@redhat.com>
References: <46F821DB.6050208@redhat.com>
Message-ID: <1190740970.4149.6.camel@localhost.localdomain>

On Mon, 2007-09-24 at 16:45 -0400, Rob Crittenden wrote:
> The current code will modify the Firefox app.js which will cause the an 
> rpm -V to choke.
> 
> Add a new script that will change the current user's configuration.
> 
> This needs more work to not hardcode freeipa.org.
> 

Acked and pushed this and the next patch to commit usersetup.sh.

Karl



From kmacmill at redhat.com  Tue Sep 25 17:23:28 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 25 Sep 2007 13:23:28 -0400
Subject: [Freeipa-devel] [PATCH] bugfix for TurboGears
In-Reply-To: <20070925171642.GC20742@moon.usersys.redhat.com>
References: <46F90788.1080901@redhat.com>
	<20070925171642.GC20742@moon.usersys.redhat.com>
Message-ID: <1190741008.4149.8.camel@localhost.localdomain>

On Tue, 2007-09-25 at 10:16 -0700, Kevin McCarthy wrote:
> Rob Crittenden wrote:
> > Some new debugging code I added caused TurboGears to throw up. This should 
> > fix it.
> 
> Looks good.
> 

Pushed.



From kmacmill at redhat.com  Tue Sep 25 17:55:11 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 25 Sep 2007 13:55:11 -0400
Subject: [Freeipa-devel] [PATCH] Misc small fixes
Message-ID: <b1273ecc51648983b4fa.1190742911@localhost.localdomain>

* Remove the rpmbuild tree with the dist-clean target.
* Move ipa-server-setupssl from /usr/sbin to /usr/share/ipa
* Check in requirement change for generated freeipa-python.spec
* Fix interactive hostname in ipa-server-install.

Signed-off-by: User "Karl MacMillan <kmacmillan at mentalrootkit.com>"
---

diff -r 219dd6d19458 -r b1273ecc5164 Makefile
--- a/Makefile	Mon Sep 24 15:26:35 2007 -0400
+++ b/Makefile	Tue Sep 25 13:52:24 2007 -0400
@@ -155,4 +155,4 @@ local-dist: clean version-update local-a
 local-dist: clean version-update local-archive tarballs archive-cleanup rpms
 
 dist-clean: clean
-	rm -fr dist
+	rm -fr rpmbuild dist
diff -r 219dd6d19458 -r b1273ecc5164 ipa-python/freeipa-python.spec
--- a/ipa-python/freeipa-python.spec	Mon Sep 24 15:26:35 2007 -0400
+++ b/ipa-python/freeipa-python.spec	Tue Sep 25 13:52:24 2007 -0400
@@ -10,7 +10,7 @@ BuildRoot:      %{_tmppath}/%{name}-%{ve
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildArch: 	noarch
 
-Requires: python PyKerberos python-krbV
+Requires: python PyKerberos
 
 %{!?python_sitelib: %define python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")}
 
diff -r 219dd6d19458 -r b1273ecc5164 ipa-server/Makefile
--- a/ipa-server/Makefile	Mon Sep 24 15:26:35 2007 -0400
+++ b/ipa-server/Makefile	Tue Sep 25 13:52:24 2007 -0400
@@ -1,5 +1,9 @@ SUBDIRS=ipa-install xmlrpc-server ipa-kp
 SUBDIRS=ipa-install xmlrpc-server ipa-kpasswd ipa-slapi-plugins
-PYTHONDIR=$(DESTDIR)/usr/share/ipa/ipaserver
+
+SHAREDIR=$(DESTDIR)/usr/share/ipa
+PYTHONDIR=$(SHAREDIR)/ipaserver
+SBINDIR=$(DESTDIR)/usr/sbin
+
 
 all:
 	@for subdir in $(SUBDIRS); do \
diff -r 219dd6d19458 -r b1273ecc5164 ipa-server/freeipa-server.spec
--- a/ipa-server/freeipa-server.spec	Mon Sep 24 15:26:35 2007 -0400
+++ b/ipa-server/freeipa-server.spec	Tue Sep 25 13:52:24 2007 -0400
@@ -41,7 +41,6 @@ rm -rf %{buildroot}
 %files
 %defattr(-,root,root,-)
 %{_sbindir}/ipa-server-install
-%{_sbindir}/ipa-server-setupssl
 %{_sbindir}/ipa_kpasswd
 %attr(755,root,root) %{_initrddir}/ipa-kpasswd
 
diff -r 219dd6d19458 -r b1273ecc5164 ipa-server/freeipa-server.spec.in
--- a/ipa-server/freeipa-server.spec.in	Mon Sep 24 15:26:35 2007 -0400
+++ b/ipa-server/freeipa-server.spec.in	Tue Sep 25 13:52:24 2007 -0400
@@ -41,7 +41,6 @@ rm -rf %{buildroot}
 %files
 %defattr(-,root,root,-)
 %{_sbindir}/ipa-server-install
-%{_sbindir}/ipa-server-setupssl
 %{_sbindir}/ipa_kpasswd
 %attr(755,root,root) %{_initrddir}/ipa-kpasswd
 
diff -r 219dd6d19458 -r b1273ecc5164 ipa-server/ipa-install/Makefile
--- a/ipa-server/ipa-install/Makefile	Mon Sep 24 15:26:35 2007 -0400
+++ b/ipa-server/ipa-install/Makefile	Tue Sep 25 13:52:24 2007 -0400
@@ -1,3 +1,4 @@ SBINDIR=$(DESTDIR)/usr/sbin
+SHAREDIR=$(DESTDIR)/usr/share/ipa
 SBINDIR=$(DESTDIR)/usr/sbin
 
 all: ;
@@ -5,7 +6,7 @@ install:
 install:
 	-mkdir $(SBINDIR)
 	install -m 755 ipa-server-install $(SBINDIR)
-	install -m 755 ipa-server-setupssl $(SBINDIR)
+	install -m 755 ipa-server-setupssl $(SHAREDIR)
 	$(MAKE) -C share $@
 	$(MAKE) -C test $@
 
diff -r 219dd6d19458 -r b1273ecc5164 ipa-server/ipa-install/ipa-server-install
--- a/ipa-server/ipa-install/ipa-server-install	Mon Sep 24 15:26:35 2007 -0400
+++ b/ipa-server/ipa-install/ipa-server-install	Tue Sep 25 13:52:24 2007 -0400
@@ -134,7 +134,7 @@ def main():
                if host_name == "":
                    print ""
                    host_name = raw_input("Please provide a Fully Qualified name to use for your system [master.example.com]: ")
-                   if host_name != "":
+                   if host_name == "":
                        host_name = "master.example.com"
     
                if len(host_name.split(".")) < 2 or host_name == "localhost.localdomain":
diff -r 219dd6d19458 -r b1273ecc5164 ipa-server/ipaserver/dsinstance.py
--- a/ipa-server/ipaserver/dsinstance.py	Mon Sep 24 15:26:35 2007 -0400
+++ b/ipa-server/ipaserver/dsinstance.py	Tue Sep 25 13:52:24 2007 -0400
@@ -156,7 +156,7 @@ class DsInstance:
     def __enable_ssl(self):
         logging.debug("configuring ssl for ds instance")
         dirname = self.config_dirname()
-        args = ["/usr/sbin/ipa-server-setupssl", self.dm_password,
+        args = ["/usr/share/ipa/ipa-server-setupssl", self.dm_password,
                 dirname, self.host_name]
         run(args)
         logging.debug("done configuring ssl for ds instance")



From kmccarth at redhat.com  Tue Sep 25 18:30:06 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Tue, 25 Sep 2007 11:30:06 -0700
Subject: [Freeipa-devel] [PATCH] a bunch of small tweeks
Message-ID: <20070925183006.GD20742@moon.usersys.redhat.com>

This is a set of small tweeks suggested in my meeting with Bob and Pete
yesterday.

The most controversial is adding a search timeout for find users and
groups.  I've put this at 2 seconds for now.  The problem with this
approach is that it makes the number of results that come back random -
depending on the server.

So, consider it a test.  Please send your feedback if you have opinions
(it's pushed to demo).

Thanks,

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190744748 25200
# Node ID 5d98050287aaaf9a6e9918f285c35615c6a8da2f
# Parent  352318dff857cf339f5385e4ab6062ca4ed85fb2
Misc small fixes:
- Members of groups are clickable
- Combine name and uid into a single column in find users
- Remove license plate from searching
- Mailto links on user emails
- Add timelimit to finds.  This is experimental...
- Fix usersearch to only search on objectClass=Person
- Change search to use get parameter

diff -r 352318dff857 -r 5d98050287aa ipa-server/ipa-gui/ipagui/templates/grouplist.kid
--- a/ipa-server/ipa-gui/ipagui/templates/grouplist.kid	Tue Sep 25 09:13:14 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/grouplist.kid	Tue Sep 25 11:25:48 2007 -0700
@@ -7,7 +7,7 @@
 </head>
 <body>
     <div id="search">
-        <form action="${tg.url('/grouplist')}" method="post">
+        <form action="${tg.url('/grouplist')}" method="get">
             <input id="criteria" type="text" name="criteria" value="${criteria}" />
             <input type="submit" value="Find Groups"/>
         </form>
diff -r 352318dff857 -r 5d98050287aa ipa-server/ipa-gui/ipagui/templates/groupshow.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupshow.kid	Tue Sep 25 09:13:14 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupshow.kid	Tue Sep 25 11:25:48 2007 -0700
@@ -37,8 +37,10 @@
       <?python
       member_name = "%s %s" % (member.get('givenname', ''),
                                member.get('sn', ''))
+      member_uid = member.get('uid')
       ?>
-      ${member_name} (${member.get('uid')})
+      <a href="${tg.url('usershow', uid=member_uid)}"
+        >${member_name}</a> (${member_uid})
     </div>
 
     <br/>
diff -r 352318dff857 -r 5d98050287aa ipa-server/ipa-gui/ipagui/templates/userlist.kid
--- a/ipa-server/ipa-gui/ipagui/templates/userlist.kid	Tue Sep 25 09:13:14 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/userlist.kid	Tue Sep 25 11:25:48 2007 -0700
@@ -8,7 +8,7 @@
 <body>
     <script type="text/javascript" charset="utf-8" src="${tg.url('/static/javascript/tablekit.js')}"></script>
     <div id="search">
-        <form action="${tg.url('/userlist')}" method="post">
+        <form action="${tg.url('/userlist')}" method="get">
             <input id="uid" type="text" name="uid" value="${uid}" />
             <input type="submit" value="Find People"/>
         </form>
@@ -22,10 +22,7 @@
           <thead>
             <tr>
                 <th>
-                    ${fields.uid.label}
-                </th>
-                <th>
-                    Name
+                    Person
                 </th>
                 <th>
                     Phone
@@ -36,18 +33,14 @@
                 <th>
                     Title
                 </th>
-                <th>
-                    License Plate
-                </th>
             </tr>
           </thead>
           <tbody>
             <tr py:for="user in users">
                 <td>
-                    <a href="${tg.url('/usershow',uid=user.uid)}">${user.uid}</a>
-                </td>
-                <td>
-                    ${user.givenName} ${user.sn}
+                    <a href="${tg.url('/usershow',uid=user.uid)}"
+                    >${user.givenName} ${user.sn}</a>
+                    (${user.uid})
                 </td>
                 <td>
                     ${user.telephoneNumber}
@@ -58,9 +51,6 @@
                 <td>
                     ${user.title}
                 </td>
-                <td>
-                    ${user.carLicense}
-                </td>
             </tr>
           </tbody>
         </table>
diff -r 352318dff857 -r 5d98050287aa ipa-server/ipa-gui/ipagui/templates/usershow.kid
--- a/ipa-server/ipa-gui/ipagui/templates/usershow.kid	Tue Sep 25 09:13:14 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/usershow.kid	Tue Sep 25 11:25:48 2007 -0700
@@ -70,7 +70,7 @@ else:
           <th>
             <label class="fieldlabel" py:content="fields.mail.label" />:
           </th>
-          <td>${user.get("mail")}</td>
+          <td><a href="mailto:${user.get('mail')}">${user.get("mail")}</a></td>
         </tr>
         <tr>
           <th>
diff -r 352318dff857 -r 5d98050287aa ipa-server/ipaserver/ipaldap.py
--- a/ipa-server/ipaserver/ipaldap.py	Tue Sep 25 09:13:14 2007 -0700
+++ b/ipa-server/ipaserver/ipaldap.py	Tue Sep 25 11:25:48 2007 -0700
@@ -343,7 +343,8 @@ class IPAdmin(SimpleLDAPObject):
                 for result in result_list:
                     entries.append(result)
                 type, result_list = self.result(msgid, 0)
-        except (ldap.ADMINLIMIT_EXCEEDED, ldap.SIZELIMIT_EXCEEDED), e:
+        except (ldap.ADMINLIMIT_EXCEEDED, ldap.SIZELIMIT_EXCEEDED,
+                ldap.TIMELIMIT_EXCEEDED), e:
             partial = 1
         except ldap.LDAPError, e:
             raise ipaerror.gen_exception(ipaerror.LDAP_DATABASE_ERROR, None, e)
diff -r 352318dff857 -r 5d98050287aa ipa-server/xmlrpc-server/funcs.py
--- a/ipa-server/xmlrpc-server/funcs.py	Tue Sep 25 09:13:14 2007 -0700
+++ b/ipa-server/xmlrpc-server/funcs.py	Tue Sep 25 11:25:48 2007 -0700
@@ -424,10 +424,14 @@ class IPAServer:
     def find_users (self, criteria, sattrs=None, searchlimit=0, opts=None):
         """Returns a list: counter followed by the results.
            If the results are truncated, counter will be set to -1."""
+
+        # TODO - retrieve from config
+        timelimit = 2
+
         # Assume the list of fields to search will come from a central
         # configuration repository.  A good format for that would be
         # a comma-separated list of fields
-        search_fields_conf_str = "uid,givenName,sn,telephoneNumber,ou,carLicense,title"
+        search_fields_conf_str = "uid,givenName,sn,telephoneNumber,ou,title"
         search_fields = string.split(search_fields_conf_str, ",")
 
         criteria = self.__safe_filter(criteria)
@@ -439,17 +443,27 @@ class IPAServer:
         (exact_match_filter, partial_match_filter) = self.__generate_match_filters(
                 search_fields, criteria_words)
 
+        #
+        # further constrain search to just the objectClass
+        # TODO - need to parameterize this into generate_match_filters,
+        #        and work it into the field-specification search feature
+        #
+        exact_match_filter = "(&(objectClass=person)%s)" % exact_match_filter
+        partial_match_filter = "(&(objectClass=person)%s)" % partial_match_filter
+
         conn = self.getConnection(opts)
         try:
             try:
                 exact_results = conn.getListAsync(self.basedn, self.scope,
-                        exact_match_filter, sattrs, 0, None, None, -1, searchlimit)
+                        exact_match_filter, sattrs, 0, None, None, timelimit,
+                        searchlimit)
             except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
                 exact_results = [0]
 
             try:
                 partial_results = conn.getListAsync(self.basedn, self.scope,
-                        partial_match_filter, sattrs, 0, None, None, -1, searchlimit)
+                        partial_match_filter, sattrs, 0, None, None, timelimit,
+                        searchlimit)
             except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
                 partial_results = [0]
         finally:
@@ -615,6 +629,10 @@ class IPAServer:
         """Return a list containing a User object for each
         existing group that matches the criteria.
         """
+
+        # TODO - retrieve from config
+        timelimit = 2
+
         # Assume the list of fields to search will come from a central
         # configuration repository.  A good format for that would be
         # a comma-separated list of fields
@@ -645,13 +663,15 @@ class IPAServer:
         try:
             try:
                 exact_results = conn.getListAsync(self.basedn, self.scope,
-                        exact_match_filter, sattrs, 0, None, None, -1, searchlimit)
+                        exact_match_filter, sattrs, 0, None, None, timelimit,
+                        searchlimit)
             except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
                 exact_results = [0]
 
             try:
                 partial_results = conn.getListAsync(self.basedn, self.scope,
-                        partial_match_filter, sattrs, 0, None, None, -1, searchlimit)
+                        partial_match_filter, sattrs, 0, None, None, timelimit,
+                        searchlimit)
             except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
                 partial_results = [0]
         finally:
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070925/0588d92f/attachment.bin>

From kmacmill at redhat.com  Tue Sep 25 19:10:48 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Tue, 25 Sep 2007 15:10:48 -0400
Subject: [Freeipa-devel] [PATCH] Make apache work with selinux
Message-ID: <6e5bd8def3659ba1dae9.1190747448@localhost.localdomain>

The default configuration of the apache selinux policy doesn't allow
apache to connect to the turbogears gui. This sets the correct
boolean to allow that connection.

Signed-off-by: User "Karl MacMillan <kmacmill at redhat.com>"
---

diff -r b1273ecc5164 -r 6e5bd8def365 ipa-server/ipa-install/ipa-server-install
--- a/ipa-server/ipa-install/ipa-server-install	Tue Sep 25 13:52:24 2007 -0400
+++ b/ipa-server/ipa-install/ipa-server-install	Tue Sep 25 15:09:01 2007 -0400
@@ -369,6 +369,9 @@ def main():
     ds.restart()
     krb.restart()
 
+    # Allow apache to connect to the turbogears web gui
+    run(["/usr/sbin/setsebool", "httpd_can_network", "true"])
+
     # Restart apache
     run(["/sbin/service", "httpd", "restart"])
 



From kmccarth at redhat.com  Tue Sep 25 20:32:03 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Tue, 25 Sep 2007 13:32:03 -0700
Subject: [Freeipa-devel] [PATCH] show user groups
Message-ID: <20070925203203.GE20742@moon.usersys.redhat.com>

This patch adds the list of groups a user belongs to onto the usershow
page.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190752543 25200
# Node ID a481d970fdc257ff919f72b7a9dc8d0459eab0d3
# Parent  5d98050287aaaf9a6e9918f285c35615c6a8da2f
Show the list of groups a user belongs to.

diff -r 5d98050287aa -r a481d970fdc2 ipa-python/ipaclient.py
--- a/ipa-python/ipaclient.py	Tue Sep 25 11:25:48 2007 -0700
+++ b/ipa-python/ipaclient.py	Tue Sep 25 13:35:43 2007 -0700
@@ -160,6 +160,15 @@ class IPAClient:
         result = self.transport.get_group_by_dn(dn,sattrs)
         return group.Group(result)
 
+    def get_groups_by_member(self,member_dn,sattrs=None):
+        """Gets the groups that member_dn belongs to.
+           If sattrs is not None then only those
+           attributes will be returned, otherwise all available
+           attributes are returned. The result is a list of groups."""
+        results = self.transport.get_groups_by_member(member_dn,sattrs)
+
+        return map(lambda result: group.Group(result), results)
+
     def add_group(self,group,group_container=None):
         """Add a group. group is a ipa.group.Group object"""
 
diff -r 5d98050287aa -r a481d970fdc2 ipa-python/rpcclient.py
--- a/ipa-python/rpcclient.py	Tue Sep 25 11:25:48 2007 -0700
+++ b/ipa-python/rpcclient.py	Tue Sep 25 13:35:43 2007 -0700
@@ -258,6 +258,23 @@ class RPCClient:
 
         return ipautil.unwrap_binary_data(result)
 
+    def get_groups_by_member(self,member_dn,sattrs=None):
+        """Gets the groups that member_dn belongs to.
+           If sattrs is not None then only those
+           attributes will be returned, otherwise all available
+           attributes are returned. The result is a list of dicts."""
+        server = self.setup_server()
+        if sattrs is None:
+            sattrs = "__NONE__"
+        try:
+            result = server.get_groups_by_member(member_dn, sattrs)
+        except xmlrpclib.Fault, fault:
+            raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
+        except socket.error, (value, msg):
+            raise xmlrpclib.Fault(value, msg)
+
+        return ipautil.unwrap_binary_data(result)
+
     def add_group(self,group,group_container=None):
         """Add a new group. Takes as input a dict where the key is the
            attribute name and the value is either a string or in the case
diff -r 5d98050287aa -r a481d970fdc2 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 25 11:25:48 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 25 13:35:43 2007 -0700
@@ -251,7 +251,9 @@ class Root(controllers.RootController):
         client.set_krbccache(os.environ["KRB5CCNAME"])
         try:
             user = client.get_user_by_uid(uid, user_fields)
-            return dict(user=user.toDict(), fields=forms.user.UserFields())
+            user_groups = client.get_groups_by_member(user.dn, ['cn'])
+            return dict(user=user.toDict(), fields=forms.user.UserFields(),
+                        user_groups=user_groups)
         except ipaerror.IPAError, e:
             turbogears.flash("User show failed: " + str(e))
             raise turbogears.redirect("/")
diff -r 5d98050287aa -r a481d970fdc2 ipa-server/ipa-gui/ipagui/templates/usershow.kid
--- a/ipa-server/ipa-gui/ipagui/templates/usershow.kid	Tue Sep 25 11:25:48 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/usershow.kid	Tue Sep 25 13:35:43 2007 -0700
@@ -90,6 +90,14 @@ else:
       </tr>
     </table>
 
+    <div class="formsection">Groups</div>
+    <div py:for="group in user_groups">
+      <a href="${tg.url('/groupshow', cn=group.cn)}">${group.cn}</a>
+    </div>
+
+    <br/>
+    <br/>
+
     <a href="${tg.url('/useredit', uid=user.get('uid'))}">edit</a>
 
 </body>
diff -r 5d98050287aa -r a481d970fdc2 ipa-server/xmlrpc-server/funcs.py
--- a/ipa-server/xmlrpc-server/funcs.py	Tue Sep 25 11:25:48 2007 -0700
+++ b/ipa-server/xmlrpc-server/funcs.py	Tue Sep 25 13:35:43 2007 -0700
@@ -204,6 +204,20 @@ class IPAServer:
     
         return self.convert_entry(ent)
 
+    def __get_list (self, base, filter, sattrs=None, opts=None):
+        """Gets a list of entries. Each is converted to a dict of values.
+           Multi-valued fields are represented as lists.
+        """
+        entries = []
+
+        conn = self.getConnection(opts)
+        try:
+            entries = conn.getList(base, self.scope, filter, sattrs)
+        finally:
+            self.releaseConnection(conn)
+
+        return map(self.convert_entry, entries)
+
     def __update_entry (self, oldentry, newentry, opts=None):
         """Update an LDAP entry
 
@@ -585,7 +599,7 @@ class IPAServer:
         cn = self.__safe_filter(cn)
         filter = "(cn=" + cn + ")"
         return self.__get_entry(self.basedn, filter, sattrs, opts)
-    
+
     def get_group_by_dn (self, dn, sattrs=None, opts=None):
         """Get a specific group's entry. Return as a dict of values.
            Multi-valued fields are represented as lists.
@@ -593,7 +607,16 @@ class IPAServer:
 
         filter = "(objectClass=*)"
         return self.__get_entry(dn, filter, sattrs, opts)
-    
+
+    def get_groups_by_member (self, member_dn, sattrs=None, opts=None):
+        """Get a specific group's entry. Return as a dict of values.
+           Multi-valued fields are represented as lists.
+        """
+
+        filter = "(&(objectClass=posixGroup)(uniqueMember=%s))" % member_dn
+
+        return self.__get_list(self.basedn, filter, sattrs, opts)
+
     def add_group (self, group, group_container=None, opts=None):
         """Add a group in LDAP. Takes as input a dict where the key is the
            attribute name and the value is either a string or in the case
diff -r 5d98050287aa -r a481d970fdc2 ipa-server/xmlrpc-server/ipaxmlrpc.py
--- a/ipa-server/xmlrpc-server/ipaxmlrpc.py	Tue Sep 25 11:25:48 2007 -0700
+++ b/ipa-server/xmlrpc-server/ipaxmlrpc.py	Tue Sep 25 13:35:43 2007 -0700
@@ -326,6 +326,7 @@ def handler(req, profiling=False):
             h.register_function(f.modifyPassword)
             h.register_function(f.get_group_by_cn)
             h.register_function(f.get_group_by_dn)
+            h.register_function(f.get_groups_by_member)
             h.register_function(f.add_group)
             h.register_function(f.find_groups)
             h.register_function(f.add_user_to_group)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070925/fb676514/attachment.bin>

From kmccarth at redhat.com  Tue Sep 25 22:40:36 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Tue, 25 Sep 2007 15:40:36 -0700
Subject: [Freeipa-devel] [PATCH] managers and direct reports
Message-ID: <20070925224035.GF20742@moon.usersys.redhat.com>

This patch adds manager and direct reports to the usershow page.

It depends on the freeipa-212-usergrouplist.patch, as it fixes a bug in
it.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190760289 25200
# Node ID 18ac2f4b2b71549356300b311b59d9781b304a32
# Parent  a481d970fdc257ff919f72b7a9dc8d0459eab0d3
Adds manager and direct reports to usershow page.
Fixes a bug with the group by member where is wasn't trapping not found errors.

diff -r a481d970fdc2 -r 18ac2f4b2b71 ipa-python/ipaclient.py
--- a/ipa-python/ipaclient.py	Tue Sep 25 13:35:43 2007 -0700
+++ b/ipa-python/ipaclient.py	Tue Sep 25 15:44:49 2007 -0700
@@ -68,6 +68,15 @@ class IPAClient:
         result = self.transport.get_user_by_dn(dn,sattrs)
         return user.User(result)
 
+    def get_users_by_manager(self,manager_dn,sattrs=None):
+        """Gets the users the report to a particular manager.
+           If sattrs is not None then only those
+           attributes will be returned, otherwise all available
+           attributes are returned. The result is a list of groups."""
+        results = self.transport.get_users_by_manager(manager_dn, sattrs)
+
+        return map(lambda result: user.User(result), results)
+
     def add_user(self,user,user_container=None):
         """Add a user. user is a ipa.user.User object"""
 
diff -r a481d970fdc2 -r 18ac2f4b2b71 ipa-python/rpcclient.py
--- a/ipa-python/rpcclient.py	Tue Sep 25 13:35:43 2007 -0700
+++ b/ipa-python/rpcclient.py	Tue Sep 25 15:44:49 2007 -0700
@@ -101,6 +101,23 @@ class RPCClient:
 
         return ipautil.unwrap_binary_data(result)
 
+    def get_users_by_manager(self,manager_dn,sattrs=None):
+        """Gets the users that report to a manager.
+           If sattrs is not None then only those
+           attributes will be returned, otherwise all available
+           attributes are returned. The result is a list of dicts."""
+        server = self.setup_server()
+        if sattrs is None:
+            sattrs = "__NONE__"
+        try:
+            result = server.get_users_by_manager(manager_dn, sattrs)
+        except xmlrpclib.Fault, fault:
+            raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
+        except socket.error, (value, msg):
+            raise xmlrpclib.Fault(value, msg)
+
+        return ipautil.unwrap_binary_data(result)
+
     def add_user(self,user,user_container=None):
         """Add a new user. Takes as input a dict where the key is the
            attribute name and the value is either a string or in the case
diff -r a481d970fdc2 -r 18ac2f4b2b71 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 25 13:35:43 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Tue Sep 25 15:44:49 2007 -0700
@@ -252,8 +252,20 @@ class Root(controllers.RootController):
         try:
             user = client.get_user_by_uid(uid, user_fields)
             user_groups = client.get_groups_by_member(user.dn, ['cn'])
+            user_reports = client.get_users_by_manager(user.dn,
+                    ['givenname', 'sn', 'uid'])
+
+            user_manager = None
+            try:
+                if user.manager:
+                    user_manager = client.get_user_by_dn(user.manager,
+                        ['givenname', 'sn', 'uid'])
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
+                pass
+
             return dict(user=user.toDict(), fields=forms.user.UserFields(),
-                        user_groups=user_groups)
+                        user_groups=user_groups, user_reports=user_reports,
+                        user_manager=user_manager)
         except ipaerror.IPAError, e:
             turbogears.flash("User show failed: " + str(e))
             raise turbogears.redirect("/")
diff -r a481d970fdc2 -r 18ac2f4b2b71 ipa-server/ipa-gui/ipagui/templates/usershow.kid
--- a/ipa-server/ipa-gui/ipagui/templates/usershow.kid	Tue Sep 25 13:35:43 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/usershow.kid	Tue Sep 25 15:44:49 2007 -0700
@@ -78,6 +78,15 @@ else:
           </th>
           <td>${user.get("telephonenumber")}</td>
         </tr>
+        <tr py:if='user_manager'>
+          <th>
+            Manager:
+          </th>
+          <td>
+            <a href="${tg.url('/usershow', uid=user_manager.uid)}"
+              >${user_manager.givenname} ${user_manager.sn}</a>
+          </td>
+        </tr>
     </table>
 
     <div class="formsection">Account Status</div>
@@ -90,6 +99,12 @@ else:
       </tr>
     </table>
 
+    <div class="formsection" py:if='len(user_reports) &gt; 0'>Direct Reports</div>
+    <div py:for="report in user_reports">
+      <a href="${tg.url('/usershow', uid=report.uid)}"
+        >${report.givenname} ${report.sn}</a>
+    </div>
+
     <div class="formsection">Groups</div>
     <div py:for="group in user_groups">
       <a href="${tg.url('/groupshow', cn=group.cn)}">${group.cn}</a>
diff -r a481d970fdc2 -r 18ac2f4b2b71 ipa-server/xmlrpc-server/funcs.py
--- a/ipa-server/xmlrpc-server/funcs.py	Tue Sep 25 13:35:43 2007 -0700
+++ b/ipa-server/xmlrpc-server/funcs.py	Tue Sep 25 15:44:49 2007 -0700
@@ -308,7 +308,18 @@ class IPAServer:
 
         filter = "(objectClass=*)"
         return self.__get_entry(dn, filter, sattrs, opts)
-    
+
+    def get_users_by_manager (self, manager_dn, sattrs=None, opts=None):
+        """Gets the users that report to a particular manager.
+        """
+
+        filter = "(&(objectClass=person)(manager=%s))" % manager_dn
+
+        try:
+            return self.__get_list(self.basedn, filter, sattrs, opts)
+        except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
+            return []
+
     def add_user (self, user, user_container=None, opts=None):
         """Add a user in LDAP. Takes as input a dict where the key is the
            attribute name and the value is either a string or in the case
@@ -615,7 +626,10 @@ class IPAServer:
 
         filter = "(&(objectClass=posixGroup)(uniqueMember=%s))" % member_dn
 
-        return self.__get_list(self.basedn, filter, sattrs, opts)
+        try:
+            return self.__get_list(self.basedn, filter, sattrs, opts)
+        except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
+            return []
 
     def add_group (self, group, group_container=None, opts=None):
         """Add a group in LDAP. Takes as input a dict where the key is the
diff -r a481d970fdc2 -r 18ac2f4b2b71 ipa-server/xmlrpc-server/ipaxmlrpc.py
--- a/ipa-server/xmlrpc-server/ipaxmlrpc.py	Tue Sep 25 13:35:43 2007 -0700
+++ b/ipa-server/xmlrpc-server/ipaxmlrpc.py	Tue Sep 25 15:44:49 2007 -0700
@@ -316,6 +316,7 @@ def handler(req, profiling=False):
             h = ModXMLRPCRequestHandler()
             h.register_function(f.get_user_by_uid)
             h.register_function(f.get_user_by_dn)
+            h.register_function(f.get_users_by_manager)
             h.register_function(f.add_user)
             h.register_function(f.get_add_schema)
             h.register_function(f.get_all_users)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070925/c7e001e1/attachment.bin>

From kmccarth at redhat.com  Tue Sep 25 23:49:54 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Tue, 25 Sep 2007 16:49:54 -0700
Subject: [Freeipa-devel] [PATCH] favicon file
Message-ID: <20070925234954.GG20742@moon.usersys.redhat.com>

This patch adds an icon file for IPA.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190764459 25200
# Node ID 17f80e1a0426de4ec8181bd7f1735a7795377138
# Parent  916b24d87d516c4bbace661329cfdd8750c790d4
Add IPA icon file.

diff --git a/ipa-server/ipa-gui/ipagui/static/images/favicon.ico b/ipa-server/ipa-gui/ipagui/static/images/favicon.ico
index 332557bc307647601389c14939be0671c62efcd7..bafbff928ec5d4b1ea316c42d6d4da8443a34810
GIT binary patch
literal 3638
zc%0RjXH-<z7RUdSXw<|cm}o4FMp1)_qKH93qJkg at BULFXI)Z>8h!hd&O@}sgX$}Jd
z(#udC`p~3G7ePTlL`BpP1tqr3J2RS<mG^v~^1i&i)?Me^{rj(T_C5FRea;0a_yi&%
z5SsaH;0MyKT>1V!eJ&78eCtSGAQ8AJm at 8!R6nxb9d_MYZw&TaDIAqsmz;VND9A_K?
zzcnA`L)XwB=ZX;e78L$M0W--NtfzO7?PmZxZW3ON^`XBq7BYie6zi|XJ*FOf6u$?<
zO&@s)E>N##VJgoTT+7`E?c|~^=oI1=7a}P)1P(?!(Rp|!{O`4cQ5XTs9m{aGr2x-s
z;_*1v3jF62V1=1M=Rq^NUH2oI=tH;8!*FvZ+H!- at ptS&(hud+muM~gWZh)801|+$t
z!)>qzk=%GhXi?$fpa!#RDX8|;!f;Lie(NlQK~V(q!cJgsZy|DN3z2<%1G)nY(O at Nq
zRIODQAah4+uSeTiC5&B7z+_P*ZkqfAFC$6R2OYuQhBUOqy5fPSCNkyc;}&Bd@^V6u
z>!^aKO&Mr7whsI5RH8z2Dehl1hHYOp;$-LIwzDeuZ=NH~LK;*3EqGgT3FS%dcy%oU
zjNV$DJ4r*1nLK`fbQirO#)gAb at X6X(w`Re#ijCCbC`1R);ZT!|;dAov+Bh50Dxw(6
z^v02a8YtE$;6h#;dSV<<f58B0mB|Q<v&Teb0*2Z4cvuvM=<z;;8p<KZQU#3jI&e`~
zj@!&bcsbOKwo}{SaaJ4NLybsG55O%i9r)?4$7D7WXUgMXS)Gg;Yk3S^G{W?aD!hB~
z3;{pSMWm4w*z_H^xL*?dXJh1hdIg``H5l^MgjHW9-ZteR%tRW!=TyMeSPa%kCt3}~
zz at K@7Zewvw76hQ*eIMRD8H38r61=<BiUIo_$WmE^7NfP8s$`+V^8mU at e0L(PG3c+4
zd|fd(@Dh-n;DonRPw{4a2>h{byd3SrtGZM?@YcaicTJ45tnj?M0{rG|@LxPa8+k|k
zH<RGMn}(ac8amD>VP<?7{1y(0`wdy|PViq&fUCX)MS81IY_J9oy|uxAJ5BsgNKSA*
zo<#qzMu|+gcugw%2YO+7YZZlpmZE}`c}?<MYfb;7HKuhiOy2w5wzx*$q at CNFRlTbq
z@)PaTOZwj)KC8EDUDnllRD2<GC9ENrrDAb%hrLHFm|8r$&(oBueYUQV{pPbdSa#_A
zLBHiTikB^o12!MI4wDVvf4wDCIa5t{#i|&EGORy+{EVl&bII=1`29bhh(-A9)ou<;
z_sm~%F6Wb#n~V^#h?<dj?9`9yRttl?(u<)Xx7N(@g0xs5XJ53otvKp}U3A!AG8RY8
z{mS4M5<i8KU%GLYq^oG2QwT+PPt06m!GTI)@82Ka^B-KKYzph_N^;5LuR7~F>*Gr;
zsI!AM+aS}P2`y7OlH<t;eSIG;ac-~@130Q8*c#;kpQZwoGi|^htV6tw0u09+F`jq^
z4Ba(I<U}IpPAA;G4e-ac1gI58qU7Bq$u)hH(bwZxOD=q6zQ(JGQRoHO!nz<DZAlEI
zG+)JOGZnCzCh!^WfYt8hkSGYlHD@)9=QBZ1^hSDuD-!f2Av;nEy3S at WxQWQ~)<x>`
zyJ*x~3hVv~{Mwv{_Lx&JXBeZM<SsKk7-2oth~2XoN`58?470*SMG|c5)1lp41VvsV
zT1dWDS;)b06R8zX`%tK}0=7>(G3>e*Q57k$)7uF8#yNO7+yl8Bf4qA+iPI at Tphcg>
zaD)l6Eo9*1NP}KE8)a9#aOFllvLbEpyr&jLfpi=_p$s<534>V|kY=rki+9@*SyzCg
z17%<;uY at Vn9+s-&u)NoRh(ofdk2?d8f(Q)8+r#{lBZjZW!m6zhMNVo^>d!~v)O}>^
zoQ00l+u=Rf2<3-$c$n!0w)~e!*|!Ym15MDw2}06H2aM=a==IP>tj{619o_`3>$!+O
zz8gBD)nM#ej26RHaCv$IJcc1g%C5loMkV~n`;M`Yg;{w#UROn-(@_b|e#UrKpN8ms
z7G5>wVuBk5CfSQ!#+spCn+oqOb5Iv at jMOKxM#W($Id6tc`c at Pkm%$*Dj!{zQ%#%D3
z5 at do<`9%nLd;?wPlJF``#q}f?Tz-5T3};=W_#8wq=OQkr2f<~l2+p+Rqc6c7vQ_b5
zw{UTyCJj at aB~TkKM}?LsQY=(3Me1=pHvuwzd1$cNg_{8e;9R+YcfXB;KiUfON3GzQ
zNFegXDC&~k5nh^z4i9}evi(TioWacf0pzPM#+Ljb3^^*G&EFVTJq&O{Qv%`JzW`Tx
zJ}ND?LMb;8d8c;3%|;CkWWSF%AcaJwMbK-=AbYF^hJp?uLw6NM@&aMp%f)DlGm=A2
zBJ0I{DBZaV+re6xM7kllqY?+nGo>ni1>b=NOjff|<ZA$rtYE}ug~4te1tv+pXbm?*
zfw2UdBG017WiLF6SfJmn#WXJkyE{1;%!@$4?<1(!T!0J8Yhe4J1-FvU!$Wo<ddYcd
zf1ER}lQRYX at em4LKgOxXTs+K=K);VZLdg0%4b;Q6kpsIF284B}ibgA*nF$Y{neh({
z7q-PTTGjiyM4=T^sXSFx4o8*eRj_o)lGnPzK94HYfFi^Kk8Yjfye5s>+9j_!s>FCy
zqM)FP$|G2ns``BCJjH5xjXitz)OImBWJJLb6wr7=t(<&ywc-c9r}j?;wF<?gq3KpE
znANTLf&ZZA=}Q!HWB?uw#XK4>P4Vp7&+UXfy4Kg=)(w+-GKhv8k4hu)do?vKSbJLi
zPhJqTK7V~jQZ1Q9Lze>T_3G*zr*zl9czO28W!c((_7;0Sk)uG)N>MS#Y3J83guH3V
z^z?yeu5;{nJjst(IPFjP9pZKh;SLJ8UDTWD>6T=!d17q;$@Mi&j|sQ6v#VC=P+BKr
zM=a_Mn|(7N-e~iR9sO#u0`5h4yUH?;F#(r}bY!zPULK17#psCZ3r#ke->X4Jrd`GS
z*L^G*Vgg>0_nCL=9HWWBroXuL7y1Iu`e|I6E!~n)8gw`K*}5ia0S{%dSSriubT`t9
z<`%jO1j?nQaUNzR at 41^BYt8M&5-FmhN9%igHKyIArI(5Y4ZYH03;1lpMXzmgSfwzP
zn`RTE5hFqr?(Pr1I$y$eXA-V3H6^;C^4Pt$hvFhJF&cW8^kSk<xsySprT^qpYxcTb
zd at bJFD{_DPcb_)<g?&&+e&7lzhn^0L+t`@i<U40)KT+S<r6E*Ez83Hl1>^7ind0I$
z$9*y<CXRgf^RBM0u0nxgQo!f_HeYU-$z&e<@zJ|yMn<=^W5o))gbIyuLHsT!{0U|1
zY~2>OdUfiG6`PHgZ5Id%JG-RF_eslQiZhvKu4G)^{q}J3fi34&JmX#%>FVn26sNx5
zr+HFL at t33D_E~O{5HmfHY#r>eVx+6nl=C4!h*71OJw<tjmJZ70+upv7`{PofhSdA?
z`LNGZs97Ywm6pHvZQ68LLQI26rBMFHg^IFoGWHLY8-$6gQYinyDU{- at o`kZ5EjGGU
dl#g;^R~Iq9{F~#y{8{~P&KdvoBIgeNzX01MF<k%v

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070925/bee26d4d/attachment.bin>

From ssorce at redhat.com  Wed Sep 26 14:46:38 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Wed, 26 Sep 2007 10:46:38 -0400
Subject: [Freeipa-devel] [PATCH] Misc small fixes
In-Reply-To: <b1273ecc51648983b4fa.1190742911@localhost.localdomain>
References: <b1273ecc51648983b4fa.1190742911@localhost.localdomain>
Message-ID: <1190817998.3915.21.camel@hopeson>

On Tue, 2007-09-25 at 13:55 -0400, Karl MacMillan wrote:
> * Remove the rpmbuild tree with the dist-clean target.

Uhmm I am actually using the rpmbuild tree to hold the rpms (freeipa
ones and others), can we separate out the cleaning of rpmbuild ?

I think it is nice to clean up the tree but still have the rpms around.

> * Move ipa-server-setupssl from /usr/sbin to /usr/share/ipa
> * Check in requirement change for generated freeipa-python.spec

> * Fix interactive hostname in ipa-server-install.

Thanks for this.

Simo.




From kmacmill at redhat.com  Wed Sep 26 14:58:20 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Wed, 26 Sep 2007 10:58:20 -0400
Subject: [Freeipa-devel] [PATCH] Misc small fixes
In-Reply-To: <1190817998.3915.21.camel@hopeson>
References: <b1273ecc51648983b4fa.1190742911@localhost.localdomain>
	<1190817998.3915.21.camel@hopeson>
Message-ID: <1190818700.2895.13.camel@localhost.localdomain>

On Wed, 2007-09-26 at 10:46 -0400, Simo Sorce wrote:
> On Tue, 2007-09-25 at 13:55 -0400, Karl MacMillan wrote:
> > * Remove the rpmbuild tree with the dist-clean target.
> 
> Uhmm I am actually using the rpmbuild tree to hold the rpms (freeipa
> ones and others), can we separate out the cleaning of rpmbuild ?
> 
> I think it is nice to clean up the tree but still have the rpms around.
> 

There is currently a clean target that doesn't remove any rpms and
dist-clean which removes dist and rpmbuild as well. Does just calling
clean work for you?

Karl



From ssorce at redhat.com  Wed Sep 26 18:00:25 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Wed, 26 Sep 2007 14:00:25 -0400
Subject: [Freeipa-devel] [PATCH] Misc small fixes
In-Reply-To: <1190818700.2895.13.camel@localhost.localdomain>
References: <b1273ecc51648983b4fa.1190742911@localhost.localdomain>
	<1190817998.3915.21.camel@hopeson>
	<1190818700.2895.13.camel@localhost.localdomain>
Message-ID: <1190829625.3798.3.camel@hopeson>

On Wed, 2007-09-26 at 10:58 -0400, Karl MacMillan wrote:
> On Wed, 2007-09-26 at 10:46 -0400, Simo Sorce wrote:
> > On Tue, 2007-09-25 at 13:55 -0400, Karl MacMillan wrote:
> > > * Remove the rpmbuild tree with the dist-clean target.
> > 
> > Uhmm I am actually using the rpmbuild tree to hold the rpms (freeipa
> > ones and others), can we separate out the cleaning of rpmbuild ?
> > 
> > I think it is nice to clean up the tree but still have the rpms around.
> > 
> 
> There is currently a clean target that doesn't remove any rpms and
> dist-clean which removes dist and rpmbuild as well. Does just calling
> clean work for you?

I'll try :-P
As soon as we don't call dist-clean from any other target I think that's
fine.

Simo.



From kmccarth at redhat.com  Wed Sep 26 20:08:06 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Wed, 26 Sep 2007 13:08:06 -0700
Subject: [Freeipa-devel] [PATCH] help text for searches
Message-ID: <20070926200806.GE18132@moon.usersys.redhat.com>

I removed the mocks from the demo, but wanted to preserve the help text.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190837309 25200
# Node ID 0003b3b106655aa0867142b53bf1530f8a5982d7
# Parent  fb85b362df17c135cbe7beb0e8733d70021b3700
patch queue: helptext.patch

diff -r fb85b362df17 -r 0003b3b10665 ipa-server/ipa-gui/ipagui/templates/grouplist.kid
--- a/ipa-server/ipa-gui/ipagui/templates/grouplist.kid	Wed Sep 26 09:59:13 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/grouplist.kid	Wed Sep 26 13:08:29 2007 -0700
@@ -39,5 +39,22 @@
     <div py:if='(groups != None) and (len(groups) == 0)'>
         <h2>No results found for "${criteria}"</h2>
     </div>
+    <div py:if='groups == None'>
+      <p>
+        Search automatically looks across multiple fields.  If you want to find
+        Joe in Finance, try typing "joe finance" into the search box.
+      </p>
+      <p>
+        Exact matches are listed first, followed by partial matches.  If your search
+        is too broad, you will get a warning that the search returned too many
+        results.  Try being more specific.
+      </p>
+      <p>
+        The results that come back are sortable.  Simply click on a column
+        header to sort on that header.  A triangle will indicate the sorted
+        column, along with its direction. Clicking and dragging between headers
+        will allow you to resize the header.
+      </p>
+    </div>
 </body>
 </html>
diff -r fb85b362df17 -r 0003b3b10665 ipa-server/ipa-gui/ipagui/templates/userlist.kid
--- a/ipa-server/ipa-gui/ipagui/templates/userlist.kid	Wed Sep 26 09:59:13 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/userlist.kid	Wed Sep 26 13:08:29 2007 -0700
@@ -58,5 +58,22 @@
     <div py:if='(users != None) and (len(users) == 0)'>
         <h2>No results found for "${uid}"</h2>
     </div>
+    <div py:if='users == None'>
+      <p>
+        Search automatically looks across multiple fields.  If you want to find
+        Joe in Finance, try typing "joe finance" into the search box.
+      </p>
+      <p>
+        Exact matches are listed first, followed by partial matches.  If your search
+        is too broad, you will get a warning that the search returned too many
+        results.  Try being more specific.
+      </p>
+      <p>
+        The results that come back are sortable.  Simply click on a column
+        header to sort on that header.  A triangle will indicate the sorted
+        column, along with its direction. Clicking and dragging between headers
+        will allow you to resize the header.
+      </p>
+    </div>
 </body>
 </html>
diff -r fb85b362df17 -r 0003b3b10665 ipa-server/ipa-gui/ipagui/templates/welcome.kid
--- a/ipa-server/ipa-gui/ipagui/templates/welcome.kid	Wed Sep 26 09:59:13 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/welcome.kid	Wed Sep 26 13:08:29 2007 -0700
@@ -10,6 +10,20 @@
         <div id="status_block" py:if="value_of('tg_flash', None)"
             py:content="XML(tg_flash)"></div>
         <h1>Welcome to Free IPA</h1>
+
+        <p>
+          IPA is used to manage Identity, Policy, and Auditing for your
+          organization.
+        </p>
+        <p>
+          To get started, you can use the search box in the top right to find
+          users or groups you need to work on.  Search automatically looks
+          across multiple fields.  If you want to find Joe in Finance, try typing
+          "joe finance" into the search box.
+        </p>
+        <p>
+          Alternatively, select a task from the left sidebar.
+        </p>
     </div>
 
 </body>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070926/7258cc9f/attachment.bin>

From rcritten at redhat.com  Wed Sep 26 20:55:10 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Wed, 26 Sep 2007 16:55:10 -0400
Subject: [Freeipa-devel] [PATCH] list xml-rpc methods
Message-ID: <46FAC72E.4030905@redhat.com>

One of the things that XML-RPC clients are going to want to do is 
interrogate the server to find out what it can do. Some parts of that 
were broken. Should be fixed here.

Now one thing I may need to tweak is that all functions include the 
variable opts in it. This isn't actually sent by the client, it is 
appended in the server. I'll need to figure out how to not show that as 
an argument. Later.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-218-methods.patch
Type: text/x-patch
Size: 4144 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070926/39ed7956/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070926/39ed7956/attachment-0001.bin>

From kmccarth at redhat.com  Wed Sep 26 22:44:04 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Wed, 26 Sep 2007 15:44:04 -0700
Subject: [Freeipa-devel] [PATCH] add group dn operation methods
Message-ID: <20070926224403.GF18132@moon.usersys.redhat.com>

This patch adds api calls that manipulate group members using dns.

My apache set up isn't quite working right now, so I wasn't able to test
over the xmlrpc calls.  I might have made a typo although I tried to be
careful.

The calls do work for the gui.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190846854 25200
# Node ID 5bc5ed865060671057635f21456c561b4402416c
# Parent  db401a2fa6ac3b1c64d2892d6271ab8e5f5e3f5c
Adds methods to manipulate groups by dns.
Renamed some of the user_group parameters to be self-evident.
Binary wrapping isn't necessary on strings, so removed from xmlrpc calls.

diff -r db401a2fa6ac -r 5bc5ed865060 ipa-python/ipaclient.py
--- a/ipa-python/ipaclient.py	Wed Sep 26 15:04:09 2007 -0700
+++ b/ipa-python/ipaclient.py	Wed Sep 26 15:47:34 2007 -0700
@@ -205,41 +205,65 @@ class IPAClient:
 
         return groups
 
-    def add_user_to_group(self, user, group):
+    def add_member_to_group(self, member_dn, group_cn):
+        """Add a member to an existing group.
+        """
+
+        return self.transport.add_member_to_group(member_dn, group_cn)
+
+    def add_members_to_group(self, member_dns, group_cn):
+        """Add several members to an existing group.
+           member_dns is a list of dns to add
+
+           Returns a list of the dns that were not added.
+        """
+
+        return self.transport.add_members_to_group(member_dns, group_cn)
+
+    def remove_member_from_group(self, member_dn, group_cn):
+        """Remove a member from an existing group.
+        """
+
+        return self.transport.remove_member_from_group(member_dn, group_cn)
+
+    def remove_members_from_group(self, member_dns, group_cn):
+        """Remove several members from an existing group.
+           member_dns is a list of dns to remove
+
+           Returns a list of the dns that were not removed.
+        """
+
+        return self.transport.remove_members_from_group(member_dns, group_cn)
+
+    def add_user_to_group(self, user_uid, group_cn):
         """Add a user to an existing group.
-           user is a uid of the user to add
-           group is the cn of the group to be added to
-        """
-
-        return self.transport.add_user_to_group(user, group)
-
-    def add_users_to_group(self, users, group):
+        """
+
+        return self.transport.add_user_to_group(user_uid, group_cn)
+
+    def add_users_to_group(self, user_uids, group_cn):
         """Add several users to an existing group.
-           user is a list of uids of the users to add
-           group is the cn of the group to be added to
-
-           Returns a list of the users that were not added.
-        """
-
-        return self.transport.add_users_to_group(users, group)
-
-    def remove_user_from_group(self, user, group):
+           user_uids is a list of uids of the users to add
+
+           Returns a list of the user uids that were not added.
+        """
+
+        return self.transport.add_users_to_group(user_uids, group_cn)
+
+    def remove_user_from_group(self, user_uid, group_cn):
         """Remove a user from an existing group.
-           user is a uid of the user to remove
-           group is the cn of the group to be removed from
-        """
-
-        return self.transport.remove_user_from_group(user, group)
-
-    def remove_users_from_group(self, users, group):
+        """
+
+        return self.transport.remove_user_from_group(user_uid, group_cn)
+
+    def remove_users_from_group(self, user_uids, group_cn):
         """Remove several users from an existing group.
-           user is a list of uids of the users to remove
-           group is the cn of the group to be removed from
-
-           Returns a list of the users that were not removed.
-        """
-
-        return self.transport.remove_users_from_group(users, group)
+           user_uids is a list of uids of the users to remove
+
+           Returns a list of the user uids that were not removed.
+        """
+
+        return self.transport.remove_users_from_group(user_uids, group_cn)
 
     def update_group(self,group):
         """Update a group entry."""
diff -r db401a2fa6ac -r 5bc5ed865060 ipa-python/rpcclient.py
--- a/ipa-python/rpcclient.py	Wed Sep 26 15:04:09 2007 -0700
+++ b/ipa-python/rpcclient.py	Wed Sep 26 15:47:34 2007 -0700
@@ -326,68 +326,114 @@ class RPCClient:
     
         return ipautil.unwrap_binary_data(result)
 
-    def add_user_to_group(self, user, group):
+    def add_member_to_group(self, member_dn, group_cn):
+        """Add a new member to an existing group.
+        """
+        server = self.setup_server()
+        try:
+            result = server.add_member_to_group(member_dn, group_cn)
+        except xmlrpclib.Fault, fault:
+            raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
+        except socket.error, (value, msg):
+            raise xmlrpclib.Fault(value, msg)
+
+        return ipautil.unwrap_binary_data(result)
+
+    def add_members_to_group(self, member_dns, group_cn):
+        """Add several members to an existing group.
+           member_dns is a list of the dns to add
+
+           Returns a list of the dns that were not added.
+        """
+        server = self.setup_server()
+        try:
+            result = server.add_members_to_group(member_dns, group_cn)
+        except xmlrpclib.Fault, fault:
+            raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
+        except socket.error, (value, msg):
+            raise xmlrpclib.Fault(value, msg)
+
+        return ipautil.unwrap_binary_data(result)
+
+    def remove_member_from_group(self, member_dn, group_cn):
+        """Remove a member from an existing group.
+        """
+        server = self.setup_server()
+        try:
+            result = server.remove_member_from_group(member_dn, group_cn)
+        except xmlrpclib.Fault, fault:
+            raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
+        except socket.error, (value, msg):
+            raise xmlrpclib.Fault(value, msg)
+
+        return ipautil.unwrap_binary_data(result)
+
+    def remove_members_from_group(self, member_dns, group_cn):
+        """Remove several members from an existing group.
+
+           Returns a list of the dns that were not removed.
+        """
+        server = self.setup_server()
+        try:
+            result = server.remove_members_from_group(member_dns, group_cn)
+        except xmlrpclib.Fault, fault:
+            raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
+        except socket.error, (value, msg):
+            raise xmlrpclib.Fault(value, msg)
+
+        return ipautil.unwrap_binary_data(result)
+
+    def add_user_to_group(self, user_uid, group_cn):
         """Add a user to an existing group.
-           user is a uid of the user to add
-           group is the cn of the group to be added to
-        """
-        server = self.setup_server()
-        try:
-            result = server.add_user_to_group(ipautil.wrap_binary_data(user),
-                    ipautil.wrap_binary_data(group))
-        except xmlrpclib.Fault, fault:
-            raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
-        except socket.error, (value, msg):
-            raise xmlrpclib.Fault(value, msg)
-    
-        return ipautil.unwrap_binary_data(result)
-
-    def add_users_to_group(self, users, group):
+        """
+        server = self.setup_server()
+        try:
+            result = server.add_user_to_group(user_uid, group_cn)
+        except xmlrpclib.Fault, fault:
+            raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
+        except socket.error, (value, msg):
+            raise xmlrpclib.Fault(value, msg)
+
+        return ipautil.unwrap_binary_data(result)
+
+    def add_users_to_group(self, user_uids, group_cn):
         """Add several users to an existing group.
-           user is a list of the uids of the users to add
-           group is the cn of the group to be added to
-
-           Returns a list of the users that were not added.
-        """
-        server = self.setup_server()
-        try:
-            result = server.add_users_to_group(ipautil.wrap_binary_data(users),
-                    ipautil.wrap_binary_data(group))
-        except xmlrpclib.Fault, fault:
-            raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
-        except socket.error, (value, msg):
-            raise xmlrpclib.Fault(value, msg)
-    
-        return ipautil.unwrap_binary_data(result)
-
-    def remove_user_from_group(self, user, group):
+           user_uids is a list of the uids of the users to add
+
+           Returns a list of the user uids that were not added.
+        """
+        server = self.setup_server()
+        try:
+            result = server.add_users_to_group(user_uids, group_cn)
+        except xmlrpclib.Fault, fault:
+            raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
+        except socket.error, (value, msg):
+            raise xmlrpclib.Fault(value, msg)
+
+        return ipautil.unwrap_binary_data(result)
+
+    def remove_user_from_group(self, user_uid, group_cn):
         """Remove a user from an existing group.
-           user is a uid of the user to remove
-           group is the cn of the group to be removed from
-        """
-        server = self.setup_server()
-        try:
-            result = server.remove_user_from_group(ipautil.wrap_binary_data(user),
-                    ipautil.wrap_binary_data(group))
-        except xmlrpclib.Fault, fault:
-            raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
-        except socket.error, (value, msg):
-            raise xmlrpclib.Fault(value, msg)
-    
-        return ipautil.unwrap_binary_data(result)
-
-    def remove_users_from_group(self, users, group):
+        """
+        server = self.setup_server()
+        try:
+            result = server.remove_user_from_group(user_uid, group_cn)
+        except xmlrpclib.Fault, fault:
+            raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
+        except socket.error, (value, msg):
+            raise xmlrpclib.Fault(value, msg)
+    
+        return ipautil.unwrap_binary_data(result)
+
+    def remove_users_from_group(self, user_uids, group_cn):
         """Remove several users from an existing group.
-           user is a list of the uids of the users to remove
-           group is the cn of the group to be removed from
-
-           Returns a list of the users that were not removed.
-        """
-        server = self.setup_server()
-        try:
-            result = server.remove_users_from_group(
-                    ipautil.wrap_binary_data(users),
-                    ipautil.wrap_binary_data(group))
+           user_uids is a list of the uids of the users to remove
+
+           Returns a list of the user uids that were not removed.
+        """
+        server = self.setup_server()
+        try:
+            result = server.remove_users_from_group(user_uids, group_cn)
         except xmlrpclib.Fault, fault:
             raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
         except socket.error, (value, msg):
diff -r db401a2fa6ac -r 5bc5ed865060 ipa-server/ipaserver/ipaldap.py
--- a/ipa-server/ipaserver/ipaldap.py	Wed Sep 26 15:04:09 2007 -0700
+++ b/ipa-server/ipaserver/ipaldap.py	Wed Sep 26 15:47:34 2007 -0700
@@ -215,7 +215,7 @@ class IPAdmin(SimpleLDAPObject):
            out this way so that we can call them from places other than
            instance creation e.g. when we just need to reconnect, not create a
            new instance"""
-        if debug.lower() == "on":
+        if debug and debug.lower() == "on":
             ldap.set_option(ldap.OPT_DEBUG_LEVEL,255)
         if cacert is not None:
             ldap.set_option(ldap.OPT_X_TLS_CACERTFILE,cacert)
diff -r db401a2fa6ac -r 5bc5ed865060 ipa-server/xmlrpc-server/funcs.py
--- a/ipa-server/xmlrpc-server/funcs.py	Wed Sep 26 15:04:09 2007 -0700
+++ b/ipa-server/xmlrpc-server/funcs.py	Wed Sep 26 15:47:34 2007 -0700
@@ -66,6 +66,8 @@ class IPAConnPool:
         return conn
 
     def releaseConn(self, conn):
+        if conn is None:
+            return
         # We can't re-use SASL connections. If proxydn is None it means
         # we have a Kerberos credentails cache set. See ipaldap.set_krbccache
         if conn.proxydn is None:
@@ -736,27 +738,24 @@ class IPAServer:
 
         return groups
 
-    def add_user_to_group(self, user, group, opts=None):
-        """Add a user to an existing group.
-           user is a uid of the user to add
-           group is the cn of the group to be added to
-        """
-
-        old_group = self.get_group_by_cn(group, None, opts)
+    def add_member_to_group(self, member_dn, group_cn, opts=None):
+        """Add a member to an existing group.
+        """
+
+        old_group = self.get_group_by_cn(group_cn, None, opts)
         if old_group is None:
             raise ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND)
         new_group = copy.deepcopy(old_group)
 
-        user_dn = self.get_user_by_uid(user, ['dn', 'uid', 'objectclass'], opts)
-        if user_dn is None:
-            raise ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND)
+        # check to make sure member_dn exists
+        member_entry = self.__get_entry(member_dn, "(objectClass=*)", ['dn','uid'], opts)
 
         if new_group.get('uniquemember') is not None:
             if ((isinstance(new_group.get('uniquemember'), str)) or (isinstance(new_group.get('uniquemember'), unicode))):
                 new_group['uniquemember'] = [new_group['uniquemember']]
-            new_group['uniquemember'].append(user_dn['dn'])
-        else:
-            new_group['uniquemember'] = user_dn['dn']
+            new_group['uniquemember'].append(member_dn)
+        else:
+            new_group['uniquemember'] = member_dn
 
         try:
             ret = self.__update_entry(old_group, new_group, opts)
@@ -764,50 +763,44 @@ class IPAServer:
             raise
         return ret
 
-    def add_users_to_group(self, users, group, opts=None):
-        """Given a list of user uid's add them to the group cn denoted by group
-           Returns a list of the users were not added to the group.
+    def add_members_to_group(self, member_dns, group_cn, opts=None):
+        """Given a list of dn's, add them to the group cn denoted by group
+           Returns a list of the member_dns that were not added to the group.
         """
 
         failed = []
 
-        if (isinstance(users, str)):
-            users = [users]
-
-        for user in users:
+        if (isinstance(member_dns, str)):
+            member_dns = [member_dns]
+
+        for member_dn in member_dns:
             try:
-                self.add_user_to_group(user, group, opts)
+                self.add_member_to_group(member_dn, group_cn, opts)
             except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST):
                 # User is already in the group
-                failed.append(user)
+                failed.append(member_dn)
             except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
                 # User or the group does not exist
-                failed.append(user)
+                failed.append(member_dn)
 
         return failed
 
-    def remove_user_from_group(self, user, group, opts=None):
-        """Remove a user from an existing group.
-           user is a uid of the user to remove
-           group is the cn of the group to be removed from
-        """
-
-        old_group = self.get_group_by_cn(group, None, opts)
+    def remove_member_from_group(self, member_dn, group_cn, opts=None):
+        """Remove a member_dn from an existing group.
+        """
+
+        old_group = self.get_group_by_cn(group_cn, None, opts)
         if old_group is None:
             raise ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND)
         new_group = copy.deepcopy(old_group)
-
-        user_dn = self.get_user_by_uid(user, ['dn', 'uid', 'objectclass'], opts)
-        if user_dn is None:
-            raise ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND)
 
         if new_group.get('uniquemember') is not None:
             if ((isinstance(new_group.get('uniquemember'), str)) or (isinstance(new_group.get('uniquemember'), unicode))):
                 new_group['uniquemember'] = [new_group['uniquemember']]
             try:
-                new_group['uniquemember'].remove(user_dn['dn'])
+                new_group['uniquemember'].remove(member_dn)
             except ValueError:
-                # User is not in the group
+                # member is not in the group
                 # FIXME: raise more specific error?
                 raise ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND)
         else:
@@ -821,26 +814,89 @@ class IPAServer:
             raise
         return ret
 
-    def remove_users_from_group(self, users, group, opts=None):
-        """Given a list of user uid's remove them from the group cn denoted
-           by group
-           Returns a list of the users were not removed from the group.
+    def remove_members_from_group(self, member_dns, group_cn, opts=None):
+        """Given a list of member dn's remove them from the group.
+           Returns a list of the members not removed from the group.
         """
 
         failed = []
 
-        if (isinstance(users, str)):
-            users = [users]
-
-        for user in users:
+        if (isinstance(member_dns, str)):
+            member_dns = [member_dns]
+
+        for member_dn in member_dns:
             try:
-                self.remove_user_from_group(user, group, opts)
+                self.remove_member_from_group(member_dn, group_cn, opts)
+            except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST):
+                # member is not in the group
+                failed.append(member_dn)
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
+                # member_dn or the group does not exist
+                failed.append(member_dn)
+
+        return failed
+
+    def add_user_to_group(self, user_uid, group_cn, opts=None):
+        """Add a user to an existing group.
+        """
+
+        user = self.get_user_by_uid(user_uid, ['dn', 'uid', 'objectclass'], opts)
+        if user is None:
+            raise ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND)
+
+        return self.add_member_to_group(user['dn'], group_cn, opts)
+
+    def add_users_to_group(self, user_uids, group_cn, opts=None):
+        """Given a list of user uid's add them to the group cn denoted by group
+           Returns a list of the users were not added to the group.
+        """
+
+        failed = []
+
+        if (isinstance(user_uids, str)):
+            user_uids = [user_uids]
+
+        for user_uid in user_uids:
+            try:
+                self.add_user_to_group(user_uid, group_cn, opts)
+            except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST):
+                # User is already in the group
+                failed.append(user_uid)
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
+                # User or the group does not exist
+                failed.append(user_uid)
+
+        return failed
+
+    def remove_user_from_group(self, user_uid, group_cn, opts=None):
+        """Remove a user from an existing group.
+        """
+
+        user = self.get_user_by_uid(user_uid, ['dn', 'uid', 'objectclass'], opts)
+        if user is None:
+            raise ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND)
+
+        return self.remove_member_from_group(user['dn'], group_cn, opts)
+
+    def remove_users_from_group(self, user_uids, group_cn, opts=None):
+        """Given a list of user uid's remove them from the group
+           Returns a list of the user uids not removed from the group.
+        """
+
+        failed = []
+
+        if (isinstance(user_uids, str)):
+            user_uids = [user_uids]
+
+        for user_uid in user_uids:
+            try:
+                self.remove_user_from_group(user_uid, group_cn, opts)
             except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST):
                 # User is not in the group
-                failed.append(user)
+                failed.append(user_uid)
             except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
                 # User or the group does not exist
-                failed.append(user)
+                failed.append(user_uid)
 
         return failed
 
diff -r db401a2fa6ac -r 5bc5ed865060 ipa-server/xmlrpc-server/ipaxmlrpc.py
--- a/ipa-server/xmlrpc-server/ipaxmlrpc.py	Wed Sep 26 15:04:09 2007 -0700
+++ b/ipa-server/xmlrpc-server/ipaxmlrpc.py	Wed Sep 26 15:47:34 2007 -0700
@@ -330,6 +330,10 @@ def handler(req, profiling=False):
             h.register_function(f.get_groups_by_member)
             h.register_function(f.add_group)
             h.register_function(f.find_groups)
+            h.register_function(f.add_member_to_group)
+            h.register_function(f.add_members_to_group)
+            h.register_function(f.remove_member_from_group)
+            h.register_function(f.remove_members_from_group)
             h.register_function(f.add_user_to_group)
             h.register_function(f.add_users_to_group)
             h.register_function(f.add_group_to_group)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070926/5944c376/attachment.bin>

From kmacmill at redhat.com  Thu Sep 27 13:44:13 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 09:44:13 -0400
Subject: [Freeipa-devel] [PATCH] make testing easier
In-Reply-To: <46F90929.2060804@redhat.com>
References: <46F90929.2060804@redhat.com>
Message-ID: <1190900653.2798.9.camel@localhost.localdomain>

On Tue, 2007-09-25 at 09:12 -0400, Rob Crittenden wrote:
> Simo is having problems with his Apache server seemingly not doing 
> ticket forwarding but only for mod_python. In trying to help him 
> diagnose this it became very apparent that even this low-level testing 
> was difficult to setup.
> 
> I've redone ipa.conf to not require Kerberos for the / but instead just 
> target it for the things we use (plus /cgi-bin for good measure).
> 

Is this the right approach or should we have specific urls for testing /
error. I don't think I understand the changes well enough to assess the
risks.

> I've added a new uri, /ipatest, that is shipped commented out but can be 
> used for this and any future basic testing needs.
> 
> I also include a simple CGI and a simple mod_python script that uses 
> python-ldap to do a GSSAPI LDAP connection similar to what we do in IPA.
> 
> Please consider this carefully. I'm a little nervous about the ipa.conf 
> changes but they were necessary because for some reason curl choked when 
> I had <Location /> protected by Kerberos (either a bug in Apache or curl 
> or both, but regardless testing was impossibe).
> 
> The only risk is that we (or someone) adds a new URI to do work and it 
> ends up not being protected by Kerberos. A small risk but a real one.
> 

I went ahead and pushed this patch and the related fixes.

Karl





From kmacmill at redhat.com  Thu Sep 27 13:44:13 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 09:44:13 -0400
Subject: [Freeipa-devel] [PATCH] make testing easier
In-Reply-To: <46F90929.2060804@redhat.com>
References: <46F90929.2060804@redhat.com>
Message-ID: <1190900653.2798.9.camel@localhost.localdomain>

On Tue, 2007-09-25 at 09:12 -0400, Rob Crittenden wrote:
> Simo is having problems with his Apache server seemingly not doing 
> ticket forwarding but only for mod_python. In trying to help him 
> diagnose this it became very apparent that even this low-level testing 
> was difficult to setup.
> 
> I've redone ipa.conf to not require Kerberos for the / but instead just 
> target it for the things we use (plus /cgi-bin for good measure).
> 

Is this the right approach or should we have specific urls for testing /
error. I don't think I understand the changes well enough to assess the
risks.

> I've added a new uri, /ipatest, that is shipped commented out but can be 
> used for this and any future basic testing needs.
> 
> I also include a simple CGI and a simple mod_python script that uses 
> python-ldap to do a GSSAPI LDAP connection similar to what we do in IPA.
> 
> Please consider this carefully. I'm a little nervous about the ipa.conf 
> changes but they were necessary because for some reason curl choked when 
> I had <Location /> protected by Kerberos (either a bug in Apache or curl 
> or both, but regardless testing was impossibe).
> 
> The only risk is that we (or someone) adds a new URI to do work and it 
> ends up not being protected by Kerberos. A small risk but a real one.
> 

I went ahead and pushed this patch and the related fixes.

Karl





From kmacmill at redhat.com  Thu Sep 27 13:49:12 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 09:49:12 -0400
Subject: [Freeipa-devel] [PATCH] a bunch of small tweeks
In-Reply-To: <20070925183006.GD20742@moon.usersys.redhat.com>
References: <20070925183006.GD20742@moon.usersys.redhat.com>
Message-ID: <1190900952.4543.1.camel@localhost.localdomain>

On Tue, 2007-09-25 at 11:30 -0700, Kevin McCarthy wrote:
> This is a set of small tweeks suggested in my meeting with Bob and Pete
> yesterday.
> 
> The most controversial is adding a search timeout for find users and
> groups.  I've put this at 2 seconds for now.  The problem with this
> approach is that it makes the number of results that come back random -
> depending on the server.
> 
> So, consider it a test.  Please send your feedback if you have opinions
> (it's pushed to demo).
> 

It looks like the time limit will effect all clients, including xml-rpc
clients? If so, that doesn't seem like a good idea. Should we expose a
timeout parameter in the xml-rpc layer and let the gui have a
configurable value that it always passes?

Karl



From kmacmill at redhat.com  Thu Sep 27 13:51:11 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 09:51:11 -0400
Subject: [Freeipa-devel] [PATCH] show user groups
In-Reply-To: <20070925203203.GE20742@moon.usersys.redhat.com>
References: <20070925203203.GE20742@moon.usersys.redhat.com>
Message-ID: <1190901071.4543.3.camel@localhost.localdomain>

On Tue, 2007-09-25 at 13:32 -0700, Kevin McCarthy wrote:
> This patch adds the list of groups a user belongs to onto the usershow
> page.
> 

Acked and pushed.

Karl



From kmacmill at redhat.com  Thu Sep 27 13:52:15 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 09:52:15 -0400
Subject: [Freeipa-devel] [PATCH] managers and direct reports
In-Reply-To: <20070925224035.GF20742@moon.usersys.redhat.com>
References: <20070925224035.GF20742@moon.usersys.redhat.com>
Message-ID: <1190901135.4543.5.camel@localhost.localdomain>

On Tue, 2007-09-25 at 15:40 -0700, Kevin McCarthy wrote:
> This patch adds manager and direct reports to the usershow page.
> 
> It depends on the freeipa-212-usergrouplist.patch, as it fixes a bug in
> it.
> 

Acked and pushed.

Karl



From kmacmill at redhat.com  Thu Sep 27 13:52:57 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 09:52:57 -0400
Subject: [Freeipa-devel] [PATCH] favicon file
In-Reply-To: <20070925234954.GG20742@moon.usersys.redhat.com>
References: <20070925234954.GG20742@moon.usersys.redhat.com>
Message-ID: <1190901177.4543.7.camel@localhost.localdomain>

On Tue, 2007-09-25 at 16:49 -0700, Kevin McCarthy wrote:
> This patch adds an icon file for IPA.
> 

Acked and pushed.



From kmacmill at redhat.com  Thu Sep 27 13:53:40 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 09:53:40 -0400
Subject: [Freeipa-devel] [PATCH] help text for searches
In-Reply-To: <20070926200806.GE18132@moon.usersys.redhat.com>
References: <20070926200806.GE18132@moon.usersys.redhat.com>
Message-ID: <1190901220.4543.9.camel@localhost.localdomain>

On Wed, 2007-09-26 at 13:08 -0700, Kevin McCarthy wrote:
> I removed the mocks from the demo, but wanted to preserve the help text.
> 

Acked and pushed.



From kmacmill at redhat.com  Thu Sep 27 13:54:11 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 09:54:11 -0400
Subject: [Freeipa-devel] [PATCH] list xml-rpc methods
In-Reply-To: <46FAC72E.4030905@redhat.com>
References: <46FAC72E.4030905@redhat.com>
Message-ID: <1190901251.4543.11.camel@localhost.localdomain>

On Wed, 2007-09-26 at 16:55 -0400, Rob Crittenden wrote:
> One of the things that XML-RPC clients are going to want to do is 
> interrogate the server to find out what it can do. Some parts of that 
> were broken. Should be fixed here.
> 
> Now one thing I may need to tweak is that all functions include the 
> variable opts in it. This isn't actually sent by the client, it is 
> appended in the server. I'll need to figure out how to not show that as 
> an argument. Later.
> 

Acked and pushed.



From kmacmill at redhat.com  Thu Sep 27 13:55:03 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 09:55:03 -0400
Subject: [Freeipa-devel] [PATCH] add group dn operation methods
In-Reply-To: <20070926224403.GF18132@moon.usersys.redhat.com>
References: <20070926224403.GF18132@moon.usersys.redhat.com>
Message-ID: <1190901303.4543.13.camel@localhost.localdomain>

On Wed, 2007-09-26 at 15:44 -0700, Kevin McCarthy wrote:
> This patch adds api calls that manipulate group members using dns.
> 
> My apache set up isn't quite working right now, so I wasn't able to test
> over the xmlrpc calls.  I might have made a typo although I tried to be
> careful.
> 
> The calls do work for the gui.
> 

Acked and pushed.



From rcritten at redhat.com  Thu Sep 27 14:06:12 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Thu, 27 Sep 2007 10:06:12 -0400
Subject: [Freeipa-devel] [PATCH] make testing easier
In-Reply-To: <1190900653.2798.9.camel@localhost.localdomain>
References: <46F90929.2060804@redhat.com>
	<1190900653.2798.9.camel@localhost.localdomain>
Message-ID: <46FBB8D4.7020302@redhat.com>

Karl MacMillan wrote:
> On Tue, 2007-09-25 at 09:12 -0400, Rob Crittenden wrote:
>> Simo is having problems with his Apache server seemingly not doing 
>> ticket forwarding but only for mod_python. In trying to help him 
>> diagnose this it became very apparent that even this low-level testing 
>> was difficult to setup.
>>
>> I've redone ipa.conf to not require Kerberos for the / but instead just 
>> target it for the things we use (plus /cgi-bin for good measure).
>>
> 
> Is this the right approach or should we have specific urls for testing /
> error. I don't think I understand the changes well enough to assess the
> risks.

I don't understand. Isn't /ipatest a specific url for testing? I was 
thinking this would be disabled by default.

We need a specific url for errors because it needs to be unauthenticated 
(so the user has a place to go on the same machine if their auth fails).

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070927/f2ee2eff/attachment.bin>

From kmacmill at redhat.com  Thu Sep 27 14:41:19 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 10:41:19 -0400
Subject: [Freeipa-devel] [PATCH] make testing easier
In-Reply-To: <46FBB8D4.7020302@redhat.com>
References: <46F90929.2060804@redhat.com>
	<1190900653.2798.9.camel@localhost.localdomain>
	<46FBB8D4.7020302@redhat.com>
Message-ID: <1190904079.4862.2.camel@localhost.localdomain>

On Thu, 2007-09-27 at 10:06 -0400, Rob Crittenden wrote:
> Karl MacMillan wrote:
> > On Tue, 2007-09-25 at 09:12 -0400, Rob Crittenden wrote:
> >> Simo is having problems with his Apache server seemingly not doing 
> >> ticket forwarding but only for mod_python. In trying to help him 
> >> diagnose this it became very apparent that even this low-level testing 
> >> was difficult to setup.
> >>
> >> I've redone ipa.conf to not require Kerberos for the / but instead just 
> >> target it for the things we use (plus /cgi-bin for good measure).
> >>
> > 
> > Is this the right approach or should we have specific urls for testing /
> > error. I don't think I understand the changes well enough to assess the
> > risks.
> 
> I don't understand. Isn't /ipatest a specific url for testing? I was 
> thinking this would be disabled by default.
> 
> We need a specific url for errors because it needs to be unauthenticated 
> (so the user has a place to go on the same machine if their auth fails).
> 

That was my understanding from the patch, but you mentioned that / would
not be authenticated and that posed some risk. I was trying to
understand that portion of your comments.

Karl



From rcritten at redhat.com  Thu Sep 27 15:22:56 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Thu, 27 Sep 2007 11:22:56 -0400
Subject: [Freeipa-devel] [PATCH] make testing easier
In-Reply-To: <1190904079.4862.2.camel@localhost.localdomain>
References: <46F90929.2060804@redhat.com>	
	<1190900653.2798.9.camel@localhost.localdomain>	
	<46FBB8D4.7020302@redhat.com>
	<1190904079.4862.2.camel@localhost.localdomain>
Message-ID: <46FBCAD0.3090601@redhat.com>

Karl MacMillan wrote:
> On Thu, 2007-09-27 at 10:06 -0400, Rob Crittenden wrote:
>> Karl MacMillan wrote:
>>> On Tue, 2007-09-25 at 09:12 -0400, Rob Crittenden wrote:
>>>> Simo is having problems with his Apache server seemingly not doing 
>>>> ticket forwarding but only for mod_python. In trying to help him 
>>>> diagnose this it became very apparent that even this low-level testing 
>>>> was difficult to setup.
>>>>
>>>> I've redone ipa.conf to not require Kerberos for the / but instead just 
>>>> target it for the things we use (plus /cgi-bin for good measure).
>>>>
>>> Is this the right approach or should we have specific urls for testing /
>>> error. I don't think I understand the changes well enough to assess the
>>> risks.
>> I don't understand. Isn't /ipatest a specific url for testing? I was 
>> thinking this would be disabled by default.
>>
>> We need a specific url for errors because it needs to be unauthenticated 
>> (so the user has a place to go on the same machine if their auth fails).
>>
> 
> That was my understanding from the patch, but you mentioned that / would
> not be authenticated and that posed some risk. I was trying to
> understand that portion of your comments.
> 
> Karl
> 

Oh. The risk is if someone decides to put some other content on the web 
server it won't be automatically protected by kerberos.

rob

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070927/8252aeef/attachment.bin>

From ssorce at redhat.com  Thu Sep 27 15:59:53 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Thu, 27 Sep 2007 11:59:53 -0400
Subject: [Freeipa-devel] [PATCH] make testing easier
In-Reply-To: <46FBCAD0.3090601@redhat.com>
References: <46F90929.2060804@redhat.com>
	<1190900653.2798.9.camel@localhost.localdomain>
	<46FBB8D4.7020302@redhat.com>
	<1190904079.4862.2.camel@localhost.localdomain>
	<46FBCAD0.3090601@redhat.com>
Message-ID: <1190908793.3476.13.camel@hopeson>

On Thu, 2007-09-27 at 11:22 -0400, Rob Crittenden wrote:
> Karl MacMillan wrote:
> > On Thu, 2007-09-27 at 10:06 -0400, Rob Crittenden wrote:
> >> Karl MacMillan wrote:
> >>> On Tue, 2007-09-25 at 09:12 -0400, Rob Crittenden wrote:
> >>>> Simo is having problems with his Apache server seemingly not doing 
> >>>> ticket forwarding but only for mod_python. In trying to help him 
> >>>> diagnose this it became very apparent that even this low-level testing 
> >>>> was difficult to setup.
> >>>>
> >>>> I've redone ipa.conf to not require Kerberos for the / but instead just 
> >>>> target it for the things we use (plus /cgi-bin for good measure).
> >>>>
> >>> Is this the right approach or should we have specific urls for testing /
> >>> error. I don't think I understand the changes well enough to assess the
> >>> risks.
> >> I don't understand. Isn't /ipatest a specific url for testing? I was 
> >> thinking this would be disabled by default.
> >>
> >> We need a specific url for errors because it needs to be unauthenticated 
> >> (so the user has a place to go on the same machine if their auth fails).
> >>
> > 
> > That was my understanding from the patch, but you mentioned that / would
> > not be authenticated and that posed some risk. I was trying to
> > understand that portion of your comments.
> > 
> > Karl
> > 
> 
> Oh. The risk is if someone decides to put some other content on the web 
> server it won't be automatically protected by kerberos.

Uhmm I say it is a low level risk, as by default admins are used to know
that content is anonymous.
Anyways, is it possible to server a page under / as anonymous while / is
not?
Maybe using a rewrite rule ?

Simo.



From rcritten at redhat.com  Thu Sep 27 17:12:05 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Thu, 27 Sep 2007 13:12:05 -0400
Subject: [Freeipa-devel] [PATCH] make testing easier
In-Reply-To: <1190908793.3476.13.camel@hopeson>
References: <46F90929.2060804@redhat.com>	
	<1190900653.2798.9.camel@localhost.localdomain>	
	<46FBB8D4.7020302@redhat.com>	
	<1190904079.4862.2.camel@localhost.localdomain>	
	<46FBCAD0.3090601@redhat.com> <1190908793.3476.13.camel@hopeson>
Message-ID: <46FBE465.4080802@redhat.com>

Simo Sorce wrote:
> On Thu, 2007-09-27 at 11:22 -0400, Rob Crittenden wrote:
>> Karl MacMillan wrote:
>>> On Thu, 2007-09-27 at 10:06 -0400, Rob Crittenden wrote:
>>>> Karl MacMillan wrote:
>>>>> On Tue, 2007-09-25 at 09:12 -0400, Rob Crittenden wrote:
>>>>>> Simo is having problems with his Apache server seemingly not doing 
>>>>>> ticket forwarding but only for mod_python. In trying to help him 
>>>>>> diagnose this it became very apparent that even this low-level testing 
>>>>>> was difficult to setup.
>>>>>>
>>>>>> I've redone ipa.conf to not require Kerberos for the / but instead just 
>>>>>> target it for the things we use (plus /cgi-bin for good measure).
>>>>>>
>>>>> Is this the right approach or should we have specific urls for testing /
>>>>> error. I don't think I understand the changes well enough to assess the
>>>>> risks.
>>>> I don't understand. Isn't /ipatest a specific url for testing? I was 
>>>> thinking this would be disabled by default.
>>>>
>>>> We need a specific url for errors because it needs to be unauthenticated 
>>>> (so the user has a place to go on the same machine if their auth fails).
>>>>
>>> That was my understanding from the patch, but you mentioned that / would
>>> not be authenticated and that posed some risk. I was trying to
>>> understand that portion of your comments.
>>>
>>> Karl
>>>
>> Oh. The risk is if someone decides to put some other content on the web 
>> server it won't be automatically protected by kerberos.
> 
> Uhmm I say it is a low level risk, as by default admins are used to know
> that content is anonymous.
> Anyways, is it possible to server a page under / as anonymous while / is
> not?
> Maybe using a rewrite rule ?
> 
> Simo.
> 

You add a "Satisfy Any" and "Allow from all" into the Directory/Location 
entry.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070927/b53f82b7/attachment.bin>

From kmccarth at redhat.com  Thu Sep 27 17:18:03 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 27 Sep 2007 10:18:03 -0700
Subject: [Freeipa-devel] [PATCH] a bunch of small tweeks
In-Reply-To: <1190900952.4543.1.camel@localhost.localdomain>
References: <20070925183006.GD20742@moon.usersys.redhat.com>
	<1190900952.4543.1.camel@localhost.localdomain>
Message-ID: <20070927171803.GA16797@moon.usersys.redhat.com>

Karl MacMillan wrote:
> On Tue, 2007-09-25 at 11:30 -0700, Kevin McCarthy wrote:
> > This is a set of small tweeks suggested in my meeting with Bob and Pete
> > yesterday.
> > 
> > The most controversial is adding a search timeout for find users and
> > groups.  I've put this at 2 seconds for now.  The problem with this
> > approach is that it makes the number of results that come back random -
> > depending on the server.
> > 
> > So, consider it a test.  Please send your feedback if you have opinions
> > (it's pushed to demo).
> > 
> 
> It looks like the time limit will effect all clients, including xml-rpc
> clients? If so, that doesn't seem like a good idea. Should we expose a
> timeout parameter in the xml-rpc layer and let the gui have a
> configurable value that it always passes?

I'm not sure why it matters differently for xml-rpc clients?  The time
limit it on the ldap search operation.  Or, do we expect the xml-rpc
clients to be used more for reporting (in which case I agree it's a
problem).

-Kevin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070927/ba941d62/attachment.bin>

From kmacmill at redhat.com  Thu Sep 27 17:30:09 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 13:30:09 -0400
Subject: [Freeipa-devel] [PATCH] a bunch of small tweeks
In-Reply-To: <20070927171803.GA16797@moon.usersys.redhat.com>
References: <20070925183006.GD20742@moon.usersys.redhat.com>
	<1190900952.4543.1.camel@localhost.localdomain>
	<20070927171803.GA16797@moon.usersys.redhat.com>
Message-ID: <1190914209.2765.0.camel@localhost.localdomain>

On Thu, 2007-09-27 at 10:18 -0700, Kevin McCarthy wrote:
> Karl MacMillan wrote:
> > On Tue, 2007-09-25 at 11:30 -0700, Kevin McCarthy wrote:
> > > This is a set of small tweeks suggested in my meeting with Bob and Pete
> > > yesterday.
> > > 
> > > The most controversial is adding a search timeout for find users and
> > > groups.  I've put this at 2 seconds for now.  The problem with this
> > > approach is that it makes the number of results that come back random -
> > > depending on the server.
> > > 
> > > So, consider it a test.  Please send your feedback if you have opinions
> > > (it's pushed to demo).
> > > 
> > 
> > It looks like the time limit will effect all clients, including xml-rpc
> > clients? If so, that doesn't seem like a good idea. Should we expose a
> > timeout parameter in the xml-rpc layer and let the gui have a
> > configurable value that it always passes?
> 
> I'm not sure why it matters differently for xml-rpc clients?  The time
> limit it on the ldap search operation.  Or, do we expect the xml-rpc
> clients to be used more for reporting (in which case I agree it's a
> problem).
> 

I was thinking that the xml-rpc clients might be used in ways that we
don't want the timeout - reporting being a good example.

Karl



From kmccarth at redhat.com  Thu Sep 27 17:45:34 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 27 Sep 2007 10:45:34 -0700
Subject: [Freeipa-devel] [PATCH] a bunch of small tweeks
In-Reply-To: <1190914209.2765.0.camel@localhost.localdomain>
References: <20070925183006.GD20742@moon.usersys.redhat.com>
	<1190900952.4543.1.camel@localhost.localdomain>
	<20070927171803.GA16797@moon.usersys.redhat.com>
	<1190914209.2765.0.camel@localhost.localdomain>
Message-ID: <20070927174533.GB16797@moon.usersys.redhat.com>

Karl MacMillan wrote:
> On Thu, 2007-09-27 at 10:18 -0700, Kevin McCarthy wrote:
> > Karl MacMillan wrote:
> > > On Tue, 2007-09-25 at 11:30 -0700, Kevin McCarthy wrote:
> > > > This is a set of small tweeks suggested in my meeting with Bob and Pete
> > > > yesterday.
> > > > 
> > > > The most controversial is adding a search timeout for find users and
> > > > groups.  I've put this at 2 seconds for now.  The problem with this
> > > > approach is that it makes the number of results that come back random -
> > > > depending on the server.
> > > > 
> > > > So, consider it a test.  Please send your feedback if you have opinions
> > > > (it's pushed to demo).
> > > > 
> > > 
> > > It looks like the time limit will effect all clients, including xml-rpc
> > > clients? If so, that doesn't seem like a good idea. Should we expose a
> > > timeout parameter in the xml-rpc layer and let the gui have a
> > > configurable value that it always passes?
> > 
> > I'm not sure why it matters differently for xml-rpc clients?  The time
> > limit it on the ldap search operation.  Or, do we expect the xml-rpc
> > clients to be used more for reporting (in which case I agree it's a
> > problem).
> > 
> 
> I was thinking that the xml-rpc clients might be used in ways that we
> don't want the timeout - reporting being a good example.

Okay, I will add a timeout parameter then, and default it to "no
timeout".

I'm buried in the group edit stuff right now, so if you don't mind
pushing it would work better for me to add that as a separate patch
later today/tomorrow.  :-)

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070927/f8de02cb/attachment.bin>

From kmacmill at redhat.com  Thu Sep 27 18:03:48 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 14:03:48 -0400
Subject: [Freeipa-devel] [PATCH] a bunch of small tweeks
In-Reply-To: <20070927174533.GB16797@moon.usersys.redhat.com>
References: <20070925183006.GD20742@moon.usersys.redhat.com>
	<1190900952.4543.1.camel@localhost.localdomain>
	<20070927171803.GA16797@moon.usersys.redhat.com>
	<1190914209.2765.0.camel@localhost.localdomain>
	<20070927174533.GB16797@moon.usersys.redhat.com>
Message-ID: <1190916228.3197.0.camel@localhost.localdomain>

On Thu, 2007-09-27 at 10:45 -0700, Kevin McCarthy wrote:
> Karl MacMillan wrote:
> > On Thu, 2007-09-27 at 10:18 -0700, Kevin McCarthy wrote:
> > > Karl MacMillan wrote:
> > > > On Tue, 2007-09-25 at 11:30 -0700, Kevin McCarthy wrote:
> > > > > This is a set of small tweeks suggested in my meeting with Bob and Pete
> > > > > yesterday.
> > > > > 
> > > > > The most controversial is adding a search timeout for find users and
> > > > > groups.  I've put this at 2 seconds for now.  The problem with this
> > > > > approach is that it makes the number of results that come back random -
> > > > > depending on the server.
> > > > > 
> > > > > So, consider it a test.  Please send your feedback if you have opinions
> > > > > (it's pushed to demo).
> > > > > 
> > > > 
> > > > It looks like the time limit will effect all clients, including xml-rpc
> > > > clients? If so, that doesn't seem like a good idea. Should we expose a
> > > > timeout parameter in the xml-rpc layer and let the gui have a
> > > > configurable value that it always passes?
> > > 
> > > I'm not sure why it matters differently for xml-rpc clients?  The time
> > > limit it on the ldap search operation.  Or, do we expect the xml-rpc
> > > clients to be used more for reporting (in which case I agree it's a
> > > problem).
> > > 
> > 
> > I was thinking that the xml-rpc clients might be used in ways that we
> > don't want the timeout - reporting being a good example.
> 
> Okay, I will add a timeout parameter then, and default it to "no
> timeout".
> 
> I'm buried in the group edit stuff right now, so if you don't mind
> pushing it would work better for me to add that as a separate patch
> later today/tomorrow.  :-)
> 

You got it - pushed.

Karl



From kmccarth at redhat.com  Thu Sep 27 18:34:18 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 27 Sep 2007 11:34:18 -0700
Subject: [Freeipa-devel] [PATCH] change groupedit to perform operations on
	dn's for users
Message-ID: <20070927183417.GD16797@moon.usersys.redhat.com>

This patch changes the groupedit.kid page to manipulate users using
their dns.  It adds proper escaping to the dynamically generated
javascript strings (at the python -> javascript) boundary don't fail if
they python variable contains a ' or "

Previously, the uids were being translated into dns using a search.  Now
the dns come directly from TG, so need to be translated into utf-8.

Next step is changing the page to work with groups too.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190917653 25200
# Node ID d9bfdc313e9522daeaa5cfdcc9295da12190003d
# Parent  5bc5ed865060671057635f21456c561b4402416c
patch queue: group_users_use_dns.patch

diff -r 5bc5ed865060 -r d9bfdc313e95 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Wed Sep 26 15:47:34 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Thu Sep 27 11:27:33 2007 -0700
@@ -17,6 +17,7 @@ import ipa.config
 import ipa.config
 import ipa.ipaclient
 import ipa.user
+from ipa.entity import utf8_encode_values
 import xmlrpclib
 import forms.user
 import forms.group
@@ -534,12 +535,13 @@ class Root(controllers.RootController):
         #
         failed_adds = []
         try:
-            uidadds = kw.get('uidadd')
-            if uidadds != None:
-                if not(isinstance(uidadds,list) or isinstance(uidadds,tuple)):
-                    uidadds = [uidadds]
-                failed_adds = client.add_users_to_group(uidadds, kw.get('cn'))
-                kw['uidadd'] = failed_adds
+            dnadds = kw.get('dnadd')
+            if dnadds != None:
+                if not(isinstance(dnadds,list) or isinstance(dnadds,tuple)):
+                    dnadds = [dnadds]
+                failed_adds = client.add_members_to_group(
+                        utf8_encode_values(dnadds), kw.get('cn'))
+                kw['dnadd'] = failed_adds
         except ipaerror.IPAError, e:
             turbogears.flash("User update failed: " + str(e))
             return dict(form=group_edit_form, group=kw, members=member_dicts,
@@ -550,12 +552,13 @@ class Root(controllers.RootController):
         #
         failed_dels = []
         try:
-            uiddels = kw.get('uiddel')
-            if uiddels != None:
-                if not(isinstance(uiddels,list) or isinstance(uiddels,tuple)):
-                    uiddels = [uiddels]
-                failed_dels = client.remove_users_from_group(uiddels, kw.get('cn'))
-                kw['uiddel'] = failed_dels
+            dndels = kw.get('dndel')
+            if dndels != None:
+                if not(isinstance(dndels,list) or isinstance(dndels,tuple)):
+                    dndels = [dndels]
+                failed_dels = client.remove_members_from_group(
+                        utf8_encode_values(dndels), kw.get('cn'))
+                kw['dndel'] = failed_dels
         except ipaerror.IPAError, e:
             turbogears.flash("User update failed: " + str(e))
             return dict(form=group_edit_form, group=kw, members=member_dicts,
diff -r 5bc5ed865060 -r d9bfdc313e95 ipa-server/ipa-gui/ipagui/forms/group.py
--- a/ipa-server/ipa-gui/ipagui/forms/group.py	Wed Sep 26 15:47:34 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/group.py	Thu Sep 27 11:27:33 2007 -0700
@@ -11,7 +11,7 @@ class GroupFields():
 
     group_orig = widgets.HiddenField(name="group_orig")
     member_data = widgets.HiddenField(name="member_data")
-    uid_to_cn_json = widgets.HiddenField(name="uid_to_cn_json")
+    dn_to_cn_json = widgets.HiddenField(name="dn_to_cn_json")
 
 class GroupNewValidator(validators.Schema):
     cn = validators.String(not_empty=True)
@@ -48,7 +48,7 @@ class GroupEditForm(widgets.Form):
     fields = [GroupFields.gidnumber, GroupFields.description,
               GroupFields.cn_hidden, GroupFields.editprotected_hidden,
               GroupFields.group_orig, GroupFields.member_data,
-              GroupFields.uid_to_cn_json]
+              GroupFields.dn_to_cn_json]
 
     validator = GroupEditValidator()
 
diff -r 5bc5ed865060 -r d9bfdc313e95 ipa-server/ipa-gui/ipagui/helpers/ipahelper.py
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/helpers/ipahelper.py	Thu Sep 27 11:27:33 2007 -0700
@@ -0,0 +1,9 @@
+import re
+
+def javascript_string_escape(input):
+    """Escapes the ' " and \ characters in a string so
+       it can be embedded inside a dynamically generated string."""
+
+    return re.sub(r'[\'\"\\]',
+            lambda match: "\\%s" % match.group(),
+            input)
diff -r 5bc5ed865060 -r d9bfdc313e95 ipa-server/ipa-gui/ipagui/static/javascript/ipautil.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/static/javascript/ipautil.js	Thu Sep 27 11:27:33 2007 -0700
@@ -0,0 +1,8 @@
+
+/*
+ * Escapes the ' " and \ characters in a string, so
+ * it can be embedded inside a dynamically generated string.
+ */
+function jsStringEscape(input) {
+    return input.gsub(/(['"\\])/, function(match){ return "\\" + match[0]} );
+}
diff -r 5bc5ed865060 -r d9bfdc313e95 ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Wed Sep 26 15:47:34 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Thu Sep 27 11:27:33 2007 -0700
@@ -3,21 +3,30 @@
   <form action="${action}" name="${name}" method="${method}" class="tableform"
       onsubmit="preSubmit()" >
 
+<?python
+from ipagui.helpers import ipahelper
+?>
+
 
   <?python searchurl = tg.url('/userlist_ajax') ?>
 
   <script type="text/javascript">
     // this is used for round-trip recontruction of the names.
-    // the hidden fields only contain uids.  
-    var uid_to_cn_hash = new Hash();
+    // the hidden fields only contain dns.
+    var dn_to_cn_hash = new Hash();
 
     // used to filter search results.
-    // records uids already in the group
+    // records dns already in the group
     var member_hash = new Hash();
 
     // used to prevent double adding
-    // records uid to be added
+    // records dns to be added
     var added_hash = new Hash();
+
+    // Tracks the div ids that each member belongs to.
+    // Since dn's will contain illegal characters for div ids, this is used
+    // to map them to the correct div
+    var dn_to_member_div_id = new Hash();
 
 
     function toggleProtectedFields(checkbox) {
@@ -38,32 +47,32 @@
       Element.remove(effect.element);
     }
 
-    function adduser(uid, cn) {
-      uid_to_cn_hash[uid] = cn;
-
-      if ((added_hash[uid] == 1) || (member_hash[uid] == 1)) {
+    function adduser(dn, cn) {
+      dn_to_cn_hash[dn] = cn;
+
+      if ((added_hash[dn] == 1) || (member_hash[dn] == 1)) {
         return null;
       }
-      added_hash[uid] = 1;
+      added_hash[dn] = 1;
 
       var newdiv = document.createElement('div');
       newdiv.appendChild(document.createTextNode(
-        cn.escapeHTML() + " (" + uid.escapeHTML() + ") "));
+        cn.escapeHTML() + " "));
 
       var undolink = document.createElement('a');
       undolink.setAttribute('href', '');
       undolink.setAttribute('onclick',
         'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' +
-        'added_hash.remove("' + uid + '");' +
+        'added_hash.remove("' + jsStringEscape(dn) + '");' +
         'return false;');
       undolink.appendChild(document.createTextNode("undo"));
       newdiv.appendChild(undolink);
 
-      var uidInfo = document.createElement('input');
-      uidInfo.setAttribute('type', 'hidden');
-      uidInfo.setAttribute('name', 'uidadd');
-      uidInfo.setAttribute('value', uid);
-      newdiv.appendChild(uidInfo);
+      var dnInfo = document.createElement('input');
+      dnInfo.setAttribute('type', 'hidden');
+      dnInfo.setAttribute('name', 'dnadd');
+      dnInfo.setAttribute('value', dn);
+      newdiv.appendChild(dnInfo);
 
       newdiv.style.display = 'none';
       $('newmembers').appendChild(newdiv);
@@ -71,8 +80,8 @@
       return newdiv
     }
 
-    function adduserHandler(element, uid, cn) {
-      var newdiv = adduser(uid, cn)
+    function adduserHandler(element, dn, cn) {
+      var newdiv = adduser(dn, cn)
       if (newdiv != null) {
         new Effect.Fade(Element.up(element));
         new Effect.Appear(newdiv);
@@ -80,27 +89,28 @@
       }
     }
 
-    function removeuser(uid, cn) {
-      uid_to_cn_hash[uid] = cn;
+    function removeuser(dn, cn) {
+      dn_to_cn_hash[dn] = cn;
 
       var newdiv = document.createElement('div');
       newdiv.appendChild(document.createTextNode(
-        cn.escapeHTML() + " (" + uid.escapeHTML() + ") "));
-
+        cn.escapeHTML() + " "));
+
+      orig_div_id = dn_to_member_div_id[dn];
       var undolink = document.createElement('a');
       undolink.setAttribute('href', '');
       undolink.setAttribute('onclick',
         'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' +
-        "new Effect.Appear($('member-" + uid + "'));" +
+        "new Effect.Appear($('" + orig_div_id + "'));" +
         'return false;');
       undolink.appendChild(document.createTextNode("undo"));
       newdiv.appendChild(undolink);
 
-      var uidInfo = document.createElement('input');
-      uidInfo.setAttribute('type', 'hidden');
-      uidInfo.setAttribute('name', 'uiddel');
-      uidInfo.setAttribute('value', uid);
-      newdiv.appendChild(uidInfo);
+      var dnInfo = document.createElement('input');
+      dnInfo.setAttribute('type', 'hidden');
+      dnInfo.setAttribute('name', 'dndel');
+      dnInfo.setAttribute('value', dn);
+      newdiv.appendChild(dnInfo);
 
       newdiv.style.display = 'none';
       $('delmembers').appendChild(newdiv);
@@ -108,8 +118,8 @@
       return newdiv
     }
 
-    function removeuserHandler(element, uid, cn) {
-      var newdiv = removeuser(uid, cn);
+    function removeuserHandler(element, dn, cn) {
+      var newdiv = removeuser(dn, cn);
       new Effect.Fade(Element.up(element));
       new Effect.Appear(newdiv);
       /* Element.up(element).remove(); */
@@ -141,8 +151,8 @@
     }
 
     function preSubmit() {
-      var json = uid_to_cn_hash.toJSON();
-      $('form_uid_to_cn_json').value = json;
+      var json = dn_to_cn_hash.toJSON();
+      $('form_dn_to_cn_json').value = json;
       return true;
     }
   </script>
@@ -207,20 +217,32 @@
       </div>
 
       <div>
-        <div py:for="member in members" id="member-${member.get('uid')}">
+        <?python div_counter = 1 ?>
+        <div py:for="member in members" id="member-${div_counter}">
           <?python
+          member_dn = member.get('dn')
+          member_dn_esc = ipahelper.javascript_string_escape(member_dn)
+
           member_uid = member.get('uid')
+          member_uid_esc = ipahelper.javascript_string_escape(member_uid)
+
           member_name = "%s %s" % (member.get('givenname', ''),
                                    member.get('sn', ''))
+          member_name_esc = ipahelper.javascript_string_escape(member_name)
           ?>
           ${member_name} (${member_uid})
           <a href="#" 
-            onclick="removeuserHandler(this, '${member_uid}', '${member_name}');
+            onclick="removeuserHandler(this, '${member_dn_esc}',
+                                       '${member_name_esc} (${member_uid_esc})');
                      return false;"
           >remove</a>
           <script type="text/javascript">
-            member_hash["${member_uid}"] = 1;
+            dn_to_member_div_id['${member_dn_esc}'] = "member-${div_counter}";
+            member_hash["${member_dn_esc}"] = 1;
           </script>
+          <?python
+          div_counter = div_counter + 1
+          ?>
         </div>
       </div>
 
@@ -272,8 +294,8 @@
      * This section restores the contents of the add and remove lists
      * dynamically if we have to refresh the page
      */
-    if ($('form_uid_to_cn_json').value != "") {
-      uid_to_cn_hash = new Hash($('form_uid_to_cn_json').value.evalJSON());
+    if ($('form_dn_to_cn_json').value != "") {
+      dn_to_cn_hash = new Hash($('form_dn_to_cn_json').value.evalJSON());
     }
 
     if ($('form_editprotected').value != "") {
@@ -283,30 +305,37 @@
   </script>
 
   <?python
-  uidadds = value.get('uidadd', [])
-  if not(isinstance(uidadds,list) or isinstance(uidadds,tuple)):
-      uidadds = [uidadds]
-
-  uiddels = value.get('uiddel', [])
-  if not(isinstance(uiddels,list) or isinstance(uiddels,tuple)):
-      uiddels = [uiddels]
+  dnadds = value.get('dnadd', [])
+  if not(isinstance(dnadds,list) or isinstance(dnadds,tuple)):
+      dnadds = [dnadds]
+
+  dndels = value.get('dndel', [])
+  if not(isinstance(dndels,list) or isinstance(dndels,tuple)):
+      dndels = [dndels]
   ?>
 
-  <script py:for="uidadd in uidadds">
-    var uid = "${uidadd}";
-    var cn = uid_to_cn_hash[uid];
-    var newdiv = adduser(uid, cn);
+  <script py:for="dnadd in dnadds">
+    <?python
+    dnadd_esc = ipahelper.javascript_string_escape(dnadd)
+    ?>
+    var dn = "${dnadd_esc}";
+    var cn = dn_to_cn_hash[dn];
+    var newdiv = adduser(dn, cn);
     if (newdiv != null) {
       newdiv.style.display = 'block';
     }
   </script>
 
-  <script py:for="uiddel in uiddels">
-    var uid = "${uiddel}";
-    var cn = uid_to_cn_hash[uid];
-    var newdiv = removeuser(uid, cn);
+  <script py:for="dndel in dndels">
+    <?python
+    dndel_esc = ipahelper.javascript_string_escape(dndel)
+    ?>
+    var dn = "${dndel_esc}";
+    var cn = dn_to_cn_hash[dn];
+    var newdiv = removeuser(dn, cn);
     newdiv.style.display = 'block';
-    $('member-' + uid).style.display = 'none';
+    orig_div_id = dn_to_member_div_id[dn]
+    $(orig_div_id).style.display = 'none';
   </script>
 
 </div>
diff -r 5bc5ed865060 -r d9bfdc313e95 ipa-server/ipa-gui/ipagui/templates/master.kid
--- a/ipa-server/ipa-gui/ipagui/templates/master.kid	Wed Sep 26 15:47:34 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/master.kid	Thu Sep 27 11:27:33 2007 -0700
@@ -11,6 +11,7 @@
     </style>
     <script type="text/javascript" charset="utf-8" src="${tg.url('/static/javascript/prototype.js')}"></script>
     <script type="text/javascript" charset="utf-8" src="${tg.url('/static/javascript/scriptaculous.js?load=effects')}"></script>
+    <script type="text/javascript" charset="utf-8" src="${tg.url('/static/javascript/ipautil.js')}"></script>
 </head>
 
 <body py:match="item.tag=='{http://www.w3.org/1999/xhtml}body'" py:attrs="item.items()">
diff -r 5bc5ed865060 -r d9bfdc313e95 ipa-server/ipa-gui/ipagui/templates/userlistajax.kid
--- a/ipa-server/ipa-gui/ipagui/templates/userlistajax.kid	Wed Sep 26 15:47:34 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/userlistajax.kid	Thu Sep 27 11:27:33 2007 -0700
@@ -1,24 +1,42 @@
 <div xmlns:py="http://purl.org/kid/ns#">
+
+<?python
+from ipagui.helpers import ipahelper
+?>
     <div id="search-results-count">
     </div>
+    <?python
+    criteria_esc = ipahelper.javascript_string_escape(uid)
+    ?>
     <script type="text/javascript">
-      search_string = "${uid}";
+      search_string = "${criteria_esc}";
       results_counter = 0;
     </script>
+    <?python search_div_counter = 1 ?>
     <div py:if='(users != None) and (len(users) > 0)'>
-        <div py:for="user in users" id="search-${user.uid}">
+        <div py:for="user in users" id="search-${search_div_counter}">
+          <?python
+          user_dn_esc = ipahelper.javascript_string_escape(user.dn)
+          user_uid_esc = ipahelper.javascript_string_escape(user.uid)
+          user_cn_esc = ipahelper.javascript_string_escape(user.cn)
+          ?>
           <script type="text/javascript">
-            if ((added_hash["${user.uid}"] == 1) ||
-                (member_hash["${user.uid}"] == 1)) {
-              $("search-${user.uid}").style.display = 'none';
+            if ((added_hash["${user_dn_esc}"] == 1) ||
+                (member_hash["${user_dn_esc}"] == 1)) {
+              $("search-${search_div_counter}").style.display = 'none';
             } else {
               results_counter = results_counter + 1;
             }
           </script>
           ${user.givenName} ${user.sn} (${user.uid})
-          <a href="" 
-            onclick="adduserHandler(this, '${user.uid}', '${user.cn}'); return false;"
+          <a href=""
+            onclick="adduserHandler(this, '${user_dn_esc}',
+                                   '${user_cn_esc} (${user_uid_esc})');
+                     return false;"
           >add</a>
+          <?python
+          search_div_counter = search_div_counter + 1
+          ?>
         </div>
     </div>
     <script type="text/javascript">
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070927/ed503f62/attachment.bin>

From kmacmill at redhat.com  Thu Sep 27 18:44:14 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 14:44:14 -0400
Subject: [Freeipa-devel] [PATCH] Install the web gui
Message-ID: <714c69eb34b96afa79fe.1190918654@localhost.localdomain>

Install the turbogears web gui including an init script. This
patch includes a few related changes:

* create a production configuration
* rename the web gui startup scrip to ipa-webgui
* add an init script
* chkconfig on the ipa-webgui init script
* make the start script properly daemonize the app when not
  in a development directory.
* Install everything to the correct places (/usr/sbin/ipa-webgui
  and /usr/share/ipa/ipagui mainly).

There are some things still left to do:

* Sort out the logging - the config needs to be adjusted so
  that logging messages end up in /var/log.

Signed-off-by: User "Karl MacMillan <kmacmill at redhat.com>"
---

diff -r 8d5e484bb583 -r 714c69eb34b9 ipa-python/ipaclient.py
--- a/ipa-python/ipaclient.py	Thu Sep 27 09:58:37 2007 -0400
+++ b/ipa-python/ipaclient.py	Thu Sep 27 14:43:21 2007 -0400
@@ -21,7 +21,8 @@
 #!/usr/bin/python
 
 import sys
-sys.path.append("/usr/share/ipa")
+if "/usr/share/ipa" not in sys.path:
+    sys.path.append("/usr/share/ipa")
 
 from ipaserver import funcs
 import ipa.rpcclient as rpcclient
diff -r 8d5e484bb583 -r 714c69eb34b9 ipa-server/Makefile
--- a/ipa-server/Makefile	Thu Sep 27 09:58:37 2007 -0400
+++ b/ipa-server/Makefile	Thu Sep 27 14:43:21 2007 -0400
@@ -1,4 +1,4 @@ SUBDIRS=ipa-install xmlrpc-server ipa-kp
-SUBDIRS=ipa-install xmlrpc-server ipa-kpasswd ipa-slapi-plugins
+SUBDIRS=ipa-install xmlrpc-server ipa-kpasswd ipa-slapi-plugins ipa-gui
 
 SHAREDIR=$(DESTDIR)/usr/share/ipa
 PYTHONDIR=$(SHAREDIR)/ipaserver
diff -r 8d5e484bb583 -r 714c69eb34b9 ipa-server/freeipa-server.spec
--- a/ipa-server/freeipa-server.spec	Thu Sep 27 09:58:37 2007 -0400
+++ b/ipa-server/freeipa-server.spec	Thu Sep 27 14:43:21 2007 -0400
@@ -1,6 +1,6 @@ Name:           freeipa-server
 Name:           freeipa-server
 Version:        0.4.0
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        FreeIPA authentication server
 
 Group:          System Environment/Base
@@ -42,7 +42,9 @@ rm -rf %{buildroot}
 %defattr(-,root,root,-)
 %{_sbindir}/ipa-server-install
 %{_sbindir}/ipa_kpasswd
+%{_sbindir}/ipa-webgui
 %attr(755,root,root) %{_initrddir}/ipa-kpasswd
+%attr(755,root,root) %{_initrddir}/ipa-webgui
 
 %dir %{_usr}/share/ipa
 %{_usr}/share/ipa/*
@@ -53,6 +55,9 @@ rm -rf %{buildroot}
 
 
 %changelog
+* Tue Sep 25 2007 Karl MacMillan <kmacmill at redhat.com> - 0.4.0-2
+- Package ipa-webgui
+
 * Fri Sep 7 2007 Karl MacMillan <kmacmill at redhat.com> - 0.3.0-1
 - Added support for libipa-dna-plugin
 
diff -r 8d5e484bb583 -r 714c69eb34b9 ipa-server/freeipa-server.spec.in
--- a/ipa-server/freeipa-server.spec.in	Thu Sep 27 09:58:37 2007 -0400
+++ b/ipa-server/freeipa-server.spec.in	Thu Sep 27 14:43:21 2007 -0400
@@ -1,6 +1,6 @@ Name:           freeipa-server
 Name:           freeipa-server
 Version:        VERSION
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        FreeIPA authentication server
 
 Group:          System Environment/Base
@@ -42,7 +42,9 @@ rm -rf %{buildroot}
 %defattr(-,root,root,-)
 %{_sbindir}/ipa-server-install
 %{_sbindir}/ipa_kpasswd
+%{_sbindir}/ipa-webgui
 %attr(755,root,root) %{_initrddir}/ipa-kpasswd
+%attr(755,root,root) %{_initrddir}/ipa-webgui
 
 %dir %{_usr}/share/ipa
 %{_usr}/share/ipa/*
@@ -53,6 +55,9 @@ rm -rf %{buildroot}
 
 
 %changelog
+* Tue Sep 25 2007 Karl MacMillan <kmacmill at redhat.com> - 0.4.0-2
+- Package ipa-webgui
+
 * Fri Sep 7 2007 Karl MacMillan <kmacmill at redhat.com> - 0.3.0-1
 - Added support for libipa-dna-plugin
 
diff -r 8d5e484bb583 -r 714c69eb34b9 ipa-server/ipa-gui/Makefile
--- a/ipa-server/ipa-gui/Makefile	Thu Sep 27 09:58:37 2007 -0400
+++ b/ipa-server/ipa-gui/Makefile	Thu Sep 27 14:43:21 2007 -0400
@@ -0,0 +1,39 @@
+SHAREDIR=$(DESTDIR)/usr/share/ipa
+SBINDIR=$(DESTDIR)/usr/sbin
+INITDIR = $(DESTDIR)/etc/rc.d/init.d
+
+IPAGUI_SUBDIRS=config forms helpers templates
+STATIC_SUBDIRS=css images javascript
+
+all: ;
+
+install:
+	-mkdir -p $(SHAREDIR)/ipagui
+	install -m 644 ipagui/*.py $(SHAREDIR)/ipagui
+
+	-mkdir -p $(SHAREDIR)/ipa_gui.egg-info
+	install -m 644 ipa_gui.egg-info/* $(SHAREDIR)/ipa_gui.egg-info
+
+	@for subdir in $(IPAGUI_SUBDIRS); do \
+		mkdir -p $(SHAREDIR)/ipagui/$$subdir; \
+		install -m 644 ipagui/$$subdir/*.py $(SHAREDIR)/ipagui/$$subdir; \
+	done
+
+	install -m 644 ipagui/config/*.cfg $(SHAREDIR)/ipagui/config
+
+	-mkdir -p $(SHAREDIR)/ipagui/static
+	@for subdir in $(STATIC_SUBDIRS); do \
+		mkdir -p $(SHAREDIR)/ipagui/static/$$subdir; \
+		install -m 644 ipagui/static/$$subdir/* $(SHAREDIR)/ipagui/static/$$subdir; \
+	done
+
+	install -m 644 ipa-webgui.cfg $(SHAREDIR)
+
+	install -m 755 ipa-webgui $(SBINDIR)
+
+	-mkdir -p $(INITDIR)
+	install -m 755 ipa-webgui.init $(INITDIR)/ipa-webgui
+
+clean:
+	find . -name "*.pyc" -exec rm -f {} \;
+	find . -name "*~" -exec rm -f {} \;
diff -r 8d5e484bb583 -r 714c69eb34b9 ipa-server/ipa-gui/ipa-webgui
--- a/ipa-server/ipa-gui/ipa-webgui	Thu Sep 27 09:58:37 2007 -0400
+++ b/ipa-server/ipa-gui/ipa-webgui	Thu Sep 27 14:43:21 2007 -0400
@@ -0,0 +1,99 @@
+#! /usr/bin/python -E
+#
+# Copyright (C) 2007  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; version 2 only
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+#
+
+import os, sys
+
+def daemonize():
+    pid = os.fork()
+    if pid != 0:
+        os._exit(0)
+    # become session leader
+    os.setsid()
+    
+    # fork again to reparent to init
+    pid = os.fork()
+    if pid != 0:
+        os._exit(0)
+
+    os.chdir("/")
+    os.umask(0)
+
+    import resource
+    maxfd = resource.getrlimit(resource.RLIMIT_NOFILE)[1]
+    if (maxfd == resource.RLIM_INFINITY):
+        maxfd = 1024
+      
+    # close all file descriptors
+    for fd in range(0, maxfd):
+        try:
+            os.close(fd)
+        except OSError:
+            pass
+
+    # stdin
+    os.open("/dev/null", os.O_RDWR)
+    # stdout
+    os.open("/dev/null", os.O_RDWR)
+    # stderr
+    os.open("/dev/null", os.O_RDWR)
+
+# To make development easier, we detect if we are in the development
+# environment to load a different configuration and avoid becoming
+# a daemon
+devel = False
+if os.path.exists(os.path.join(os.path.dirname(__file__), "Makefile")):
+    devel = True
+
+if not devel:
+    sys.path.append("/usr/share/ipa/")
+
+# this must be after sys.path is changed to work correctly
+import pkg_resources
+pkg_resources.require("TurboGears")
+pkg_resources.require("ipa_gui")
+
+
+from turbogears import update_config, start_server
+import cherrypy
+cherrypy.lowercase_api = True
+
+# Load the config - look for a local file first for development
+# and then the system config file
+if devel:
+    update_config(configfile="dev.cfg",
+                  modulename="ipagui.config.app")
+else:
+    update_config(configfile="/usr/share/ipa/ipa-webgui.cfg",
+                  modulename="ipagui.config.app")
+
+from ipagui.controllers import Root
+
+if not devel:
+    try:
+        daemonize()
+    except Exception, e:
+        sys.stderr.write("error becoming daemon: " + str(e))
+        sys.exit(1)
+
+start_server(Root())
+
+
+    
+        
+        
diff -r 8d5e484bb583 -r 714c69eb34b9 ipa-server/ipa-gui/ipa-webgui.cfg
--- a/ipa-server/ipa-gui/ipa-webgui.cfg	Thu Sep 27 09:58:37 2007 -0400
+++ b/ipa-server/ipa-gui/ipa-webgui.cfg	Thu Sep 27 14:43:21 2007 -0400
@@ -0,0 +1,97 @@
+[global]
+# DATABASE
+
+# no database for ipa-webgui since everything is stored in LDAP
+
+# IDENTITY
+
+# Our our sqlobject-derived proxy provider
+identity.provider='proxyprovider'
+
+# the first thing checked on any request. We want to short-circuit this
+# as early as possible
+identity.source = 'visit'
+
+# Turn on identity and visit (visit is required for identity)
+identity.on=True
+identity.failure_url="/loginfailed"
+visit.on=True
+visit.manager='proxyvisit'
+
+# SERVER
+
+server.environment="production"
+autoreload.package="ipagui"
+autoreload.on = False
+
+# Sets the number of threads the server uses
+server.thread_pool = 10
+
+# if this is part of a larger site, you can set the path
+# to the TurboGears instance here
+# server.webpath=""
+
+# Set to True if you are deploying your App behind a proxy
+# e.g. Apache using mod_proxy
+# base_url_filter.on = False
+
+# Set to True if your proxy adds the x_forwarded_host header
+# base_url_filter.use_x_forwarded_host = True
+
+# If your proxy does not add the x_forwarded_host header, set
+# the following to the *public* host url.
+# (Note: This will be overridden by the use_x_forwarded_host option
+# if it is set to True and the proxy adds the header correctly.
+# base_url_filter.base_url = "http://www.example.com"
+
+# Set to True if you'd like to abort execution if a controller gets an
+# unexpected parameter. False by default
+# tg.strict_parameters = False
+
+# LOGGING
+# Logging configuration generally follows the style of the standard
+# Python logging module configuration. Note that when specifying
+# log format messages, you need to use *() for formatting variables.
+# Deployment independent log configuration is in ipagui/config/log.cfg
+[logging]
+
+[[formatters]]
+[[[message_only]]]
+format='*(message)s'
+
+[[[full_content]]]
+format='*(asctime)s *(name)s *(levelname)s *(message)s'
+
+[[handlers]]
+[[[debug_out]]]
+class='StreamHandler'
+level='DEBUG'
+args='(sys.stdout,)'
+formatter='full_content'
+
+[[[access_out]]]
+class='StreamHandler'
+level='INFO'
+args='(sys.stdout,)'
+formatter='message_only'
+
+[[[error_out]]]
+class='StreamHandler'
+level='ERROR'
+args='(sys.stdout,)'
+
+[[loggers]]
+[[[ipagui]]]
+level='DEBUG'
+qualname='ipagui'
+handlers=['debug_out']
+
+[[[allinfo]]]
+level='INFO'
+handlers=['debug_out']
+
+[[[access]]]
+level='INFO'
+qualname='turbogears.access'
+handlers=['access_out']
+propagate=0
diff -r 8d5e484bb583 -r 714c69eb34b9 ipa-server/ipa-gui/ipa-webgui.init
--- a/ipa-server/ipa-gui/ipa-webgui.init	Thu Sep 27 09:58:37 2007 -0400
+++ b/ipa-server/ipa-gui/ipa-webgui.init	Thu Sep 27 14:43:21 2007 -0400
@@ -0,0 +1,71 @@
+#!/bin/sh
+#
+# ipa-webgui    This starts and stops ipa-webgui
+#
+# chkconfig:   - 36 64
+# description: ipa-webgui IPA Web User Interface
+# processname: /usr/sbin/ipa-webgui
+# configdir:   /etc/sysconfig/ipa-webgui
+#
+
+# Source function library.
+if [ -f /etc/rc.d/init.d/functions ] ; then
+. /etc/rc.d/init.d/functions
+fi
+# Source networking configuration.
+if [ -f /etc/sysconfig/network ] ; then
+. /etc/sysconfig/network
+fi
+
+# Check that networking is up.
+if [ "${NETWORKING}" = "no" ]
+then
+    echo "Networking is down"
+    exit 0
+fi
+
+NAME="ipa-webgui"
+
+start() {
+	echo -n $"Starting $NAME: "
+	daemon $NAME
+	RETVAL=$?
+	echo
+	[ $RETVAL -eq 0 ] && touch /var/lock/subsys/$NAME || \
+	   RETVAL=1
+	return $RETVAL
+}	
+
+stop() {
+	echo -n $"Shutting down $NAME: "
+	killproc $NAME
+	RETVAL=$?
+	echo
+	[ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/$NAME
+	return $RETVAL
+}	
+
+restart() {
+	stop
+	start
+}	
+
+case "$1" in
+  start)
+  	start
+	;;
+  stop)
+  	stop
+	;;
+  restart)
+  	restart
+	;;
+  condrestart)
+  	[ -f /var/lock/subsys/$NAME ] && restart || :
+	;;
+  *)
+	echo $"Usage: $0 {start|stop|restart|condrestart}"
+	exit 2
+esac
+
+exit $?
diff -r 8d5e484bb583 -r 714c69eb34b9 ipa-server/ipa-gui/ipa_gui.egg-info/SOURCES.txt
--- a/ipa-server/ipa-gui/ipa_gui.egg-info/SOURCES.txt	Thu Sep 27 09:58:37 2007 -0400
+++ b/ipa-server/ipa-gui/ipa_gui.egg-info/SOURCES.txt	Thu Sep 27 14:43:21 2007 -0400
@@ -1,4 +1,5 @@ README.txt
 README.txt
+ipa-webgui
 setup.py
 start-ipagui.py
 ipa_gui.egg-info/PKG-INFO
@@ -19,6 +20,7 @@ ipagui/release.py
 ipagui/release.py
 ipagui/config/__init__.py
 ipagui/forms/__init__.py
+ipagui/forms/group.py
 ipagui/forms/user.py
 ipagui/helpers/__init__.py
 ipagui/helpers/userhelper.py
diff -r 8d5e484bb583 -r 714c69eb34b9 ipa-server/ipa-gui/ipa_gui.egg-info/entry_points.txt
--- a/ipa-server/ipa-gui/ipa_gui.egg-info/entry_points.txt	Thu Sep 27 09:58:37 2007 -0400
+++ b/ipa-server/ipa-gui/ipa_gui.egg-info/entry_points.txt	Thu Sep 27 14:43:21 2007 -0400
@@ -1,6 +1,6 @@
 
     [turbogears.identity.provider]
     proxyprovider = ipagui.proxyprovider:ProxyIdentityProvider
-
     [turbogears.visit.manager]
     proxyvisit = ipagui.proxyvisit:ProxyVisitManager
+    
\ No newline at end of file
diff -r 8d5e484bb583 -r 714c69eb34b9 ipa-server/ipa-gui/sample-prod.cfg
--- a/ipa-server/ipa-gui/sample-prod.cfg	Thu Sep 27 09:58:37 2007 -0400
+++ b/ipa-server/ipa-gui/sample-prod.cfg	Thu Sep 27 14:43:21 2007 -0400
@@ -1,38 +1,31 @@
 [global]
-# This is where all of your settings go for your production environment.
-# You'll copy this file over to your production server and provide it
-# as a command-line option to your start script.
-# Settings that are the same for both development and production
-# (such as template engine, encodings, etc.) all go in 
-# ipagui/config/app.cfg
-
 # DATABASE
 
-# pick the form for your database
-# sqlobject.dburi="postgres://username at hostname/databasename"
-# sqlobject.dburi="mysql://username:password at hostname:port/databasename"
-# sqlobject.dburi="sqlite:///file_name_and_path"
+# no database for ipa-webgui since everything is stored in LDAP
 
-# If you have sqlite, here's a simple default to get you started
-# in development
-sqlobject.dburi="sqlite://%(current_dir_uri)s/devdata.sqlite"
+# IDENTITY
 
+# Our our sqlobject-derived proxy provider
+identity.provider='proxyprovider'
 
-# if you are using a database or table type without transactions
-# (MySQL default, for example), you should turn off transactions
-# by prepending notrans_ on the uri
-# sqlobject.dburi="notrans_mysql://username:password at hostname:port/databasename"
+# the first thing checked on any request. We want to short-circuit this
+# as early as possible
+identity.source = 'visit'
 
-# for Windows users, sqlite URIs look like:
-# sqlobject.dburi="sqlite:///drive_letter:/path/to/file"
-
+# Turn on identity and visit (visit is required for identity)
+identity.on=True
+identity.failure_url="/loginfailed"
+visit.on=True
+visit.manager='proxyvisit'
 
 # SERVER
 
 server.environment="production"
+autoreload.package="ipagui"
+autoreload.on = False
 
 # Sets the number of threads the server uses
-# server.thread_pool = 1
+server.thread_pool = 10
 
 # if this is part of a larger site, you can set the path
 # to the TurboGears instance here
@@ -66,7 +59,7 @@ server.environment="production"
 
 [[[access_out]]]
 # set the filename as the first argument below
-args="('server.log',)"
+args="('ipa-webgui',)"
 class='FileHandler'
 level='INFO'
 formatter='message_only'
@@ -74,11 +67,11 @@ formatter='message_only'
 [[loggers]]
 [[[ipagui]]]
 level='ERROR'
-qualname='ipagui'
-handlers=['error_out']
+qualname='ipa-webgui'
+handlers=['debug_out']
 
 [[[access]]]
 level='INFO'
-qualname='turbogears.access'
+qualname='ipa-webgui.access'
 handlers=['access_out']
 propagate=0
diff -r 8d5e484bb583 -r 714c69eb34b9 ipa-server/ipa-gui/setup.py
--- a/ipa-server/ipa-gui/setup.py	Thu Sep 27 09:58:37 2007 -0400
+++ b/ipa-server/ipa-gui/setup.py	Thu Sep 27 14:43:21 2007 -0400
@@ -19,30 +19,10 @@ setup(
     install_requires = [
         "TurboGears >= 1.0.2.2",
     ],
-    scripts = ["start-ipagui.py"],
     zip_safe=False,
     packages=find_packages(),
     package_data = find_package_data(where='ipagui',
                                      package='ipagui'),
-    keywords = [
-        # Use keywords if you'll be adding your package to the
-        # Python Cheeseshop
-        
-        # if this has widgets, uncomment the next line
-        # 'turbogears.widgets',
-        
-        # if this has a tg-admin command, uncomment the next line
-        # 'turbogears.command',
-        
-        # if this has identity providers, uncomment the next line
-        # 'turbogears.identity.provider',
-    
-        # If this is a template plugin, uncomment the next line
-        # 'python.templating.engines',
-        
-        # If this is a full application, uncomment the next line
-        # 'turbogears.app',
-    ],
     classifiers = [
         'Development Status :: 3 - Alpha',
         'Operating System :: OS Independent',
diff -r 8d5e484bb583 -r 714c69eb34b9 ipa-server/ipa-gui/start-ipagui.py
--- a/ipa-server/ipa-gui/start-ipagui.py	Thu Sep 27 09:58:37 2007 -0400
+++ b/ipa-server/ipa-gui/start-ipagui.py	Thu Sep 27 14:43:21 2007 -0400
@@ -1,25 +0,0 @@
-#!/usr/bin/python
-import pkg_resources
-pkg_resources.require("TurboGears")
-
-from turbogears import update_config, start_server
-import cherrypy
-cherrypy.lowercase_api = True
-from os.path import *
-import sys
-
-# first look on the command line for a desired config file,
-# if it's not on the command line, then
-# look for setup.py in this directory. If it's not there, this script is
-# probably installed
-if len(sys.argv) > 1:
-    update_config(configfile=sys.argv[1], 
-        modulename="ipagui.config")
-elif exists(join(dirname(__file__), "setup.py")):
-    update_config(configfile="dev.cfg",modulename="ipagui.config")
-else:
-    update_config(configfile="prod.cfg",modulename="ipagui.config")
-
-from ipagui.controllers import Root
-
-start_server(Root())
diff -r 8d5e484bb583 -r 714c69eb34b9 ipa-server/ipa-install/ipa-server-install
--- a/ipa-server/ipa-install/ipa-server-install	Thu Sep 27 09:58:37 2007 -0400
+++ b/ipa-server/ipa-install/ipa-server-install	Thu Sep 27 14:43:21 2007 -0400
@@ -370,7 +370,13 @@ def main():
     krb.restart()
 
     # Allow apache to connect to the turbogears web gui
-    run(["/usr/sbin/setsebool", "httpd_can_network", "true"])
+    run(["/usr/sbin/setsebool", "-P", "httpd_can_network_connect", "true"])
+
+    # Start the web gui
+    run(["/sbin/service", "ipa-webgui", "start"])
+
+    # Set the web gui to start on boot
+    run(["/sbin/chkconfig", "ipa-webgui", "on"])
 
     # Restart apache
     run(["/sbin/service", "httpd", "restart"])



From kmccarth at redhat.com  Thu Sep 27 18:54:36 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 27 Sep 2007 11:54:36 -0700
Subject: [Freeipa-devel] [PATCH] Install the web gui
In-Reply-To: <714c69eb34b96afa79fe.1190918654@localhost.localdomain>
References: <714c69eb34b96afa79fe.1190918654@localhost.localdomain>
Message-ID: <20070927185436.GE16797@moon.usersys.redhat.com>

Karl MacMillan wrote:
> Install the turbogears web gui including an init script. This
> patch includes a few related changes:
> 
> * create a production configuration
> * rename the web gui startup scrip to ipa-webgui
> * add an init script
> * chkconfig on the ipa-webgui init script
> * make the start script properly daemonize the app when not
>   in a development directory.
> * Install everything to the correct places (/usr/sbin/ipa-webgui
>   and /usr/share/ipa/ipagui mainly).
> 
> There are some things still left to do:
> 
> * Sort out the logging - the config needs to be adjusted so
>   that logging messages end up in /var/log.


Can we keep start-ipa.py for now, or at least have some kind of
back-door startup to run in a local dir?

It makes it much faster to develop the gui if I can run it from my
directory.  :-/

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070927/3f56ff25/attachment.bin>

From kmacmill at redhat.com  Thu Sep 27 19:03:51 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 15:03:51 -0400
Subject: [Freeipa-devel] [PATCH] Install the web gui
In-Reply-To: <20070927185436.GE16797@moon.usersys.redhat.com>
References: <714c69eb34b96afa79fe.1190918654@localhost.localdomain>
	<20070927185436.GE16797@moon.usersys.redhat.com>
Message-ID: <1190919831.3197.3.camel@localhost.localdomain>

On Thu, 2007-09-27 at 11:54 -0700, Kevin McCarthy wrote:
> Karl MacMillan wrote:
> > Install the turbogears web gui including an init script. This
> > patch includes a few related changes:
> > 
> > * create a production configuration
> > * rename the web gui startup scrip to ipa-webgui
> > * add an init script
> > * chkconfig on the ipa-webgui init script
> > * make the start script properly daemonize the app when not
> >   in a development directory.
> > * Install everything to the correct places (/usr/sbin/ipa-webgui
> >   and /usr/share/ipa/ipagui mainly).
> > 
> > There are some things still left to do:
> > 
> > * Sort out the logging - the config needs to be adjusted so
> >   that logging messages end up in /var/log.
> 
> 
> Can we keep start-ipa.py for now, or at least have some kind of
> back-door startup to run in a local dir?
> 
> It makes it much faster to develop the gui if I can run it from my
> directory.  :-/
> 

ipa-webgui does that for you - it loads dev.cfg and doesn't daemonize.

Karl



From kmacmill at redhat.com  Thu Sep 27 19:09:51 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Thu, 27 Sep 2007 15:09:51 -0400
Subject: [Freeipa-devel] [PATCH] Install the web gui
In-Reply-To: <1190919831.3197.3.camel@localhost.localdomain>
References: <714c69eb34b96afa79fe.1190918654@localhost.localdomain>
	<20070927185436.GE16797@moon.usersys.redhat.com>
	<1190919831.3197.3.camel@localhost.localdomain>
Message-ID: <1190920191.3197.5.camel@localhost.localdomain>

On Thu, 2007-09-27 at 15:03 -0400, Karl MacMillan wrote:
> On Thu, 2007-09-27 at 11:54 -0700, Kevin McCarthy wrote:
> > Karl MacMillan wrote:
> > > Install the turbogears web gui including an init script. This
> > > patch includes a few related changes:
> > > 
> > > * create a production configuration
> > > * rename the web gui startup scrip to ipa-webgui
> > > * add an init script
> > > * chkconfig on the ipa-webgui init script
> > > * make the start script properly daemonize the app when not
> > >   in a development directory.
> > > * Install everything to the correct places (/usr/sbin/ipa-webgui
> > >   and /usr/share/ipa/ipagui mainly).
> > > 
> > > There are some things still left to do:
> > > 
> > > * Sort out the logging - the config needs to be adjusted so
> > >   that logging messages end up in /var/log.
> > 
> > 
> > Can we keep start-ipa.py for now, or at least have some kind of
> > back-door startup to run in a local dir?
> > 
> > It makes it much faster to develop the gui if I can run it from my
> > directory.  :-/
> > 
> 
> ipa-webgui does that for you - it loads dev.cfg and doesn't daemonize.
> 

Or it does with this very slightly updated patch :)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ipa-gui-install.patch
Type: text/x-patch
Size: 18166 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070927/e0b1a0bd/attachment.bin>

From kmccarth at redhat.com  Thu Sep 27 20:24:45 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 27 Sep 2007 13:24:45 -0700
Subject: [Freeipa-devel] [PATCH] Install the web gui
In-Reply-To: <1190920191.3197.5.camel@localhost.localdomain>
References: <714c69eb34b96afa79fe.1190918654@localhost.localdomain>
	<20070927185436.GE16797@moon.usersys.redhat.com>
	<1190919831.3197.3.camel@localhost.localdomain>
	<1190920191.3197.5.camel@localhost.localdomain>
Message-ID: <20070927202445.GF16797@moon.usersys.redhat.com>

Karl MacMillan wrote:
> On Thu, 2007-09-27 at 15:03 -0400, Karl MacMillan wrote:
> > On Thu, 2007-09-27 at 11:54 -0700, Kevin McCarthy wrote:
> > > Karl MacMillan wrote:
> > > > Install the turbogears web gui including an init script. This
> > > > patch includes a few related changes:
> > > > 
> > > > * create a production configuration
> > > > * rename the web gui startup scrip to ipa-webgui
> > > > * add an init script
> > > > * chkconfig on the ipa-webgui init script
> > > > * make the start script properly daemonize the app when not
> > > >   in a development directory.
> > > > * Install everything to the correct places (/usr/sbin/ipa-webgui
> > > >   and /usr/share/ipa/ipagui mainly).
> > > > 
> > > > There are some things still left to do:
> > > > 
> > > > * Sort out the logging - the config needs to be adjusted so
> > > >   that logging messages end up in /var/log.
> > > 
> > > 
> > > Can we keep start-ipa.py for now, or at least have some kind of
> > > back-door startup to run in a local dir?
> > > 
> > > It makes it much faster to develop the gui if I can run it from my
> > > directory.  :-/
> > > 
> > 
> > ipa-webgui does that for you - it loads dev.cfg and doesn't daemonize.
> > 
> 
> Or it does with this very slightly updated patch :)

Excellent.  Thanks, Karl.

-Kevin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070927/bb1090b9/attachment.bin>

From kmccarth at redhat.com  Thu Sep 27 21:55:35 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 27 Sep 2007 14:55:35 -0700
Subject: [Freeipa-devel] [PATCH] edit nested groups
Message-ID: <20070927215535.GG16797@moon.usersys.redhat.com>

This patch adds nested groups support to the UI.  'nough said.  :-)

Depends on freeipa-221-groupedit_use_dns.patch

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190929895 25200
# Node ID a716a9835fd763d700d4f697f9ea20328344c64b
# Parent  d9bfdc313e9522daeaa5cfdcc9295da12190003d
Adds nested group handling to the view and edit group pages.
Renames the ajax seach page, because it's tightly bound to the group edit page.
This isn't super polished, but the basic functionality is there.

diff -r d9bfdc313e95 -r a716a9835fd7 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Thu Sep 27 11:27:33 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Thu Sep 27 14:51:35 2007 -0700
@@ -224,26 +224,6 @@ class Root(controllers.RootController):
 
         return dict(users=users, uid=uid, fields=forms.user.UserFields())
 
-    @expose("ipagui.templates.userlistajax")
-    @identity.require(identity.not_anonymous())
-    def userlist_ajax(self, **kw):
-        """Searches for users and displays list of results in a table.
-           This method is used for ajax calls."""
-        client.set_krbccache(os.environ["KRB5CCNAME"])
-        users = []
-        searchlimit = 100
-        uid = kw.get('uid')
-        if uid != None and len(uid) > 0:
-            try:
-                users = client.find_users(uid.encode('utf-8'), None, searchlimit)
-                counter = users[0]
-                users = users[1:]
-            except ipaerror.IPAError, e:
-                turbogears.flash("User list failed: " + str(e))
-
-        return dict(users=users, uid=uid, fields=forms.user.UserFields(),
-                counter=counter)
-
 
     @expose("ipagui.templates.usershow")
     @identity.require(identity.not_anonymous())
@@ -433,6 +413,40 @@ class Root(controllers.RootController):
         except ipaerror.IPAError, e:
             turbogears.flash("Group add failed: " + str(e) + "<br/>" + str(e.detail))
             return dict(form=group_new_form, tg_template='ipagui.templates.groupnew')
+
+    @expose("ipagui.templates.groupeditsearch")
+    @identity.require(identity.not_anonymous())
+    def groupedit_search(self, **kw):
+        """Searches for users+groups and displays list of results in a table.
+           This method is used for the ajax search on the group edit page.
+           It's not re-usable because the ajax/dom manipulation is tightly
+           bound to the groupedit page"""
+        client.set_krbccache(os.environ["KRB5CCNAME"])
+        users = []
+        groups = []
+        counter = 0
+        searchlimit = 100
+        criteria = kw.get('criteria')
+        if criteria != None and len(criteria) > 0:
+            try:
+                users = client.find_users(criteria.encode('utf-8'), None, searchlimit)
+                users_counter = users[0]
+                users = users[1:]
+
+                groups = client.find_groups(criteria.encode('utf-8'), None,
+                        searchlimit)
+                groups_counter = groups[0]
+                groups = groups[1:]
+
+                if users_counter < 0 or groups_counter < 0:
+                    counter = -1
+                else:
+                    counter = users_counter + groups_counter
+            except ipaerror.IPAError, e:
+                turbogears.flash("search failed: " + str(e))
+
+        return dict(users=users, groups=groups, criteria=criteria,
+                counter=counter)
 
 
     @expose("ipagui.templates.groupedit")
@@ -461,13 +475,15 @@ class Root(controllers.RootController):
                 member_dns = [member_dns]
 
             # TODO: convert this into an efficient (single) function call
-            member_users = map(
-                    lambda dn: client.get_user_by_dn(dn, ['givenname', 'sn', 'uid']),
+            # Note: this isn't quite right, since it can be users and groups.
+            members = map(
+                    lambda dn: client.get_user_by_dn(dn, ['dn', 'givenname', 'sn',
+                        'uid', 'cn']),
                     member_dns)
 
             # Map users into an array of dicts, which can be serialized
             # (so we don't have to do this on each round trip)
-            member_dicts = map(lambda user: user.toDict(), member_users)
+            member_dicts = map(lambda member: member.toDict(), members)
 
             # store a copy of the original group for the update later
             group_data = b64encode(dumps(group_dict))
@@ -526,7 +542,7 @@ class Root(controllers.RootController):
                 #
                 kw['group_orig'] = b64encode(dumps(new_group.toDict()))
         except ipaerror.IPAError, e:
-            turbogears.flash("User update failed: " + str(e))
+            turbogears.flash("Group update failed: " + str(e))
             return dict(form=group_edit_form, group=kw, members=member_dicts,
                         tg_template='ipagui.templates.groupedit')
 
@@ -543,7 +559,7 @@ class Root(controllers.RootController):
                         utf8_encode_values(dnadds), kw.get('cn'))
                 kw['dnadd'] = failed_adds
         except ipaerror.IPAError, e:
-            turbogears.flash("User update failed: " + str(e))
+            turbogears.flash("Group update failed: " + str(e))
             return dict(form=group_edit_form, group=kw, members=member_dicts,
                         tg_template='ipagui.templates.groupedit')
 
@@ -560,7 +576,7 @@ class Root(controllers.RootController):
                         utf8_encode_values(dndels), kw.get('cn'))
                 kw['dndel'] = failed_dels
         except ipaerror.IPAError, e:
-            turbogears.flash("User update failed: " + str(e))
+            turbogears.flash("Group update failed: " + str(e))
             return dict(form=group_edit_form, group=kw, members=member_dicts,
                         tg_template='ipagui.templates.groupedit')
 
@@ -627,10 +643,12 @@ class Root(controllers.RootController):
                 member_dns = [member_dns]
 
             # TODO: convert this into an efficient (single) function call
-            member_users = map(
-                    lambda dn: client.get_user_by_dn(dn, ['givenname', 'sn', 'uid']),
+            # Note: this isn't quite right, since it can be users and groups.
+            members = map(
+                    lambda dn: client.get_user_by_dn(dn, ['dn', 'givenname', 'sn',
+                        'uid', 'cn']),
                     member_dns)
-            member_dicts = map(lambda user: user.toDict(), member_users)
+            member_dicts = map(lambda member: member.toDict(), members)
 
             return dict(group=group_dict, fields=forms.group.GroupFields(),
                     members = member_dicts)
diff -r d9bfdc313e95 -r a716a9835fd7 ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Thu Sep 27 11:27:33 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Thu Sep 27 14:51:35 2007 -0700
@@ -8,7 +8,7 @@ from ipagui.helpers import ipahelper
 ?>
 
 
-  <?python searchurl = tg.url('/userlist_ajax') ?>
+  <?python searchurl = tg.url('/groupedit_search') ?>
 
   <script type="text/javascript">
     // this is used for round-trip recontruction of the names.
@@ -47,7 +47,7 @@ from ipagui.helpers import ipahelper
       Element.remove(effect.element);
     }
 
-    function adduser(dn, cn) {
+    function addmember(dn, cn) {
       dn_to_cn_hash[dn] = cn;
 
       if ((added_hash[dn] == 1) || (member_hash[dn] == 1)) {
@@ -80,8 +80,8 @@ from ipagui.helpers import ipahelper
       return newdiv
     }
 
-    function adduserHandler(element, dn, cn) {
-      var newdiv = adduser(dn, cn)
+    function addmemberHandler(element, dn, cn) {
+      var newdiv = addmember(dn, cn)
       if (newdiv != null) {
         new Effect.Fade(Element.up(element));
         new Effect.Appear(newdiv);
@@ -89,7 +89,7 @@ from ipagui.helpers import ipahelper
       }
     }
 
-    function removeuser(dn, cn) {
+    function removemember(dn, cn) {
       dn_to_cn_hash[dn] = cn;
 
       var newdiv = document.createElement('div');
@@ -118,8 +118,8 @@ from ipagui.helpers import ipahelper
       return newdiv
     }
 
-    function removeuserHandler(element, dn, cn) {
-      var newdiv = removeuser(dn, cn);
+    function removememberHandler(element, dn, cn) {
+      var newdiv = removemember(dn, cn);
       new Effect.Fade(Element.up(element));
       new Effect.Appear(newdiv);
       /* Element.up(element).remove(); */
@@ -145,7 +145,7 @@ from ipagui.helpers import ipahelper
       new Ajax.Updater('searchresults',
           '${searchurl}',
           {  asynchronous:true,
-             parameters: { uid: $('uid').value },
+             parameters: { criteria: $('criteria').value },
              evalScripts: true });
       return false;
     }
@@ -224,16 +224,17 @@ from ipagui.helpers import ipahelper
           member_dn_esc = ipahelper.javascript_string_escape(member_dn)
 
           member_uid = member.get('uid')
-          member_uid_esc = ipahelper.javascript_string_escape(member_uid)
-
-          member_name = "%s %s" % (member.get('givenname', ''),
-                                   member.get('sn', ''))
-          member_name_esc = ipahelper.javascript_string_escape(member_name)
+          if member_uid:
+              member_cn = "%s %s (%s)" % (member.get('givenName'),
+                                          member.get('sn'),
+                                          member.get('uid'))
+          else:
+              member_cn = "%s [group]" % member.get('cn')
+          member_cn_esc = ipahelper.javascript_string_escape(member_cn)
           ?>
-          ${member_name} (${member_uid})
+          ${member_cn}
           <a href="#" 
-            onclick="removeuserHandler(this, '${member_dn_esc}',
-                                       '${member_name_esc} (${member_uid_esc})');
+            onclick="removememberHandler(this, '${member_dn_esc}', '${member_cn_esc}');
                      return false;"
           >remove</a>
           <script type="text/javascript">
@@ -249,7 +250,7 @@ from ipagui.helpers import ipahelper
     </div>
 
     <div style="clear:both">
-      <div class="formsection">Add Persons</div>
+      <div class="formsection">Add Members</div>
 
       <div class="floatlist">
         <div class="floatheader">To Add:</div>
@@ -259,9 +260,9 @@ from ipagui.helpers import ipahelper
 
       <div>
         <div id="search">
-          <input id="uid" type="text" name="uid"
+          <input id="criteria" type="text" name="criteria"
             onkeypress="return enterDoSearch(event);" />
-          <input type="button" value="Find Users"
+          <input type="button" value="Find"
             onclick="return doSearch();"
           />
         </div>
@@ -320,7 +321,7 @@ from ipagui.helpers import ipahelper
     ?>
     var dn = "${dnadd_esc}";
     var cn = dn_to_cn_hash[dn];
-    var newdiv = adduser(dn, cn);
+    var newdiv = addmember(dn, cn);
     if (newdiv != null) {
       newdiv.style.display = 'block';
     }
@@ -332,7 +333,7 @@ from ipagui.helpers import ipahelper
     ?>
     var dn = "${dndel_esc}";
     var cn = dn_to_cn_hash[dn];
-    var newdiv = removeuser(dn, cn);
+    var newdiv = removemember(dn, cn);
     newdiv.style.display = 'block';
     orig_div_id = dn_to_member_div_id[dn]
     $(orig_div_id).style.display = 'none';
diff -r d9bfdc313e95 -r a716a9835fd7 ipa-server/ipa-gui/ipagui/templates/groupeditsearch.kid
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/templates/groupeditsearch.kid	Thu Sep 27 14:51:35 2007 -0700
@@ -0,0 +1,59 @@
+<div xmlns:py="http://purl.org/kid/ns#">
+
+<?python
+from ipagui.helpers import ipahelper
+?>
+    <div id="search-results-count">
+    </div>
+    <?python
+    criteria_esc = ipahelper.javascript_string_escape(criteria)
+    ?>
+    <script type="text/javascript">
+      search_string = "${criteria_esc}";
+      results_counter = 0;
+    </script>
+    <?python search_div_counter = 1 ?>
+    <div py:for="entities in (users, groups)">
+      <div py:if='(entities != None) and (len(entities) > 0)'>
+          <div py:for="entity in entities" id="search-${search_div_counter}">
+            <?python
+            ent_dn_esc = ipahelper.javascript_string_escape(entity.dn)
+            ent_uid = entity.uid
+            if ent_uid:
+                ent_cn = "%s %s (%s)" % (entity.givenName, entity.sn, entity.uid)
+            else:
+                ent_cn = "%s [group]" % entity.cn
+            ent_cn_esc = ipahelper.javascript_string_escape(ent_cn)
+            ?>
+            <script type="text/javascript">
+              if ((added_hash["${ent_dn_esc}"] == 1) ||
+                  (member_hash["${ent_dn_esc}"] == 1)) {
+                $("search-${search_div_counter}").style.display = 'none';
+              } else {
+                results_counter = results_counter + 1;
+              }
+            </script>
+            ${ent_cn}
+            <a href=""
+              onclick="addmemberHandler(this, '${ent_dn_esc}', '${ent_cn_esc}');
+                      return false;"
+            >add</a>
+            <?python
+            search_div_counter = search_div_counter + 1
+            ?>
+          </div>
+      </div>
+    </div>
+    <script type="text/javascript">
+      if (results_counter == 0) {
+        var message = "No results found for " + search_string;
+      } else {
+        var message =  results_counter + " results found:";
+      }
+      $('search-results-count').appendChild(document.createTextNode(message));
+    </script>
+    <script py:if="counter &lt; 0">
+      $('search-results-count').appendChild(document.createTextNode(
+        " (truncated)"));
+    </script>
+</div>
diff -r d9bfdc313e95 -r a716a9835fd7 ipa-server/ipa-gui/ipagui/templates/groupshow.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupshow.kid	Thu Sep 27 11:27:33 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupshow.kid	Thu Sep 27 14:51:35 2007 -0700
@@ -35,12 +35,19 @@
     <div class="formsection">Group Members</div>
     <div py:for="member in members">
       <?python
-      member_name = "%s %s" % (member.get('givenname', ''),
-                               member.get('sn', ''))
+
       member_uid = member.get('uid')
+      if member_uid:
+          member_cn = "%s %s" % (member.get('givenName'), member.get('sn'))
+          member_desc = "(%s)" % member_uid
+          view_url = tg.url('usershow', uid=member_uid)
+      else:
+          member_cn = "%s" % member.get('cn')
+          member_desc = "[group]"
+          view_url = tg.url('groupshow', cn=member_cn)
       ?>
-      <a href="${tg.url('usershow', uid=member_uid)}"
-        >${member_name}</a> (${member_uid})
+      <a href="${view_url}"
+        >${member_cn}</a> ${member_desc}
     </div>
 
     <br/>
diff -r d9bfdc313e95 -r a716a9835fd7 ipa-server/ipa-gui/ipagui/templates/userlistajax.kid
--- a/ipa-server/ipa-gui/ipagui/templates/userlistajax.kid	Thu Sep 27 11:27:33 2007 -0700
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,54 +0,0 @@
-<div xmlns:py="http://purl.org/kid/ns#">
-
-<?python
-from ipagui.helpers import ipahelper
-?>
-    <div id="search-results-count">
-    </div>
-    <?python
-    criteria_esc = ipahelper.javascript_string_escape(uid)
-    ?>
-    <script type="text/javascript">
-      search_string = "${criteria_esc}";
-      results_counter = 0;
-    </script>
-    <?python search_div_counter = 1 ?>
-    <div py:if='(users != None) and (len(users) > 0)'>
-        <div py:for="user in users" id="search-${search_div_counter}">
-          <?python
-          user_dn_esc = ipahelper.javascript_string_escape(user.dn)
-          user_uid_esc = ipahelper.javascript_string_escape(user.uid)
-          user_cn_esc = ipahelper.javascript_string_escape(user.cn)
-          ?>
-          <script type="text/javascript">
-            if ((added_hash["${user_dn_esc}"] == 1) ||
-                (member_hash["${user_dn_esc}"] == 1)) {
-              $("search-${search_div_counter}").style.display = 'none';
-            } else {
-              results_counter = results_counter + 1;
-            }
-          </script>
-          ${user.givenName} ${user.sn} (${user.uid})
-          <a href=""
-            onclick="adduserHandler(this, '${user_dn_esc}',
-                                   '${user_cn_esc} (${user_uid_esc})');
-                     return false;"
-          >add</a>
-          <?python
-          search_div_counter = search_div_counter + 1
-          ?>
-        </div>
-    </div>
-    <script type="text/javascript">
-      if (results_counter == 0) {
-        var message = "No results found for " + search_string;
-      } else {
-        var message =  results_counter + " results found:";
-      }
-      $('search-results-count').appendChild(document.createTextNode(message));
-    </script>
-    <script py:if="counter &lt; 0">
-      $('search-results-count').appendChild(document.createTextNode(
-        " (truncated)"));
-    </script>
-</div>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070927/d678511e/attachment.bin>

From kmccarth at redhat.com  Thu Sep 27 22:46:19 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 27 Sep 2007 15:46:19 -0700
Subject: [Freeipa-devel] [PATCH] timelimit parameters
Message-ID: <20070927224618.GH16797@moon.usersys.redhat.com>

Make timelimit a parameter in the find methods.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190933486 25200
# Node ID 11d7ba255e520dfc3fec3c705bab8e735a9e0863
# Parent  a716a9835fd763d700d4f697f9ea20328344c64b
Make timelimit a parameter to the find methods.

diff -r a716a9835fd7 -r 11d7ba255e52 ipa-python/ipaclient.py
--- a/ipa-python/ipaclient.py	Thu Sep 27 14:51:35 2007 -0700
+++ b/ipa-python/ipaclient.py	Thu Sep 27 15:51:26 2007 -0700
@@ -108,11 +108,11 @@ class IPAClient:
         result = self.transport.get_add_schema()
         return result
 
-    def find_users(self, criteria, sattrs=None, searchlimit=0):
+    def find_users(self, criteria, sattrs=None, searchlimit=0, timelimit=-1):
         """Return a list: counter followed by a User object for each user that
            matches the criteria. If the results are truncated, counter will
            be set to -1"""
-        result = self.transport.find_users(criteria, sattrs, searchlimit)
+        result = self.transport.find_users(criteria, sattrs, searchlimit, timelimit)
         counter = result[0]
 
         users = [counter]
@@ -192,10 +192,10 @@ class IPAClient:
         result = self.transport.add_group(group_dict, group_container)
         return result
 
-    def find_groups(self, criteria, sattrs=None, searchlimit=0):
+    def find_groups(self, criteria, sattrs=None, searchlimit=0, timelimit=-1):
         """Find groups whose cn matches the criteria. Wildcards are 
            acceptable. Returns a list of Group objects."""
-        result = self.transport.find_groups(criteria, sattrs, searchlimit)
+        result = self.transport.find_groups(criteria, sattrs, searchlimit, timelimit)
         counter = result[0]
 
         groups = [counter]
diff -r a716a9835fd7 -r 11d7ba255e52 ipa-python/rpcclient.py
--- a/ipa-python/rpcclient.py	Thu Sep 27 14:51:35 2007 -0700
+++ b/ipa-python/rpcclient.py	Thu Sep 27 15:51:26 2007 -0700
@@ -167,7 +167,7 @@ class RPCClient:
     
         return ipautil.unwrap_binary_data(result)
 
-    def find_users (self, criteria, sattrs=None, searchlimit=0):
+    def find_users (self, criteria, sattrs=None, searchlimit=0, timelimit=-1):
         """Return a list: counter followed by a User object for each user that
            matches the criteria. If the results are truncated, counter will
            be set to -1"""
@@ -177,7 +177,7 @@ class RPCClient:
             # None values are not allowed in XML-RPC
             if sattrs is None:
                 sattrs = "__NONE__"
-            result = server.find_users(criteria, sattrs, searchlimit)
+            result = server.find_users(criteria, sattrs, searchlimit, timelimit)
         except xmlrpclib.Fault, fault:
             raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
         except socket.error, (value, msg):
@@ -309,7 +309,7 @@ class RPCClient:
         except socket.error, (value, msg):
             raise xmlrpclib.Fault(value, msg)
 
-    def find_groups (self, criteria, sattrs=None, searchlimit=0):
+    def find_groups (self, criteria, sattrs=None, searchlimit=0, timelimit=-1):
         """Return a list containing a Group object for each group that matches
            the criteria."""
     
@@ -318,7 +318,7 @@ class RPCClient:
             # None values are not allowed in XML-RPC
             if sattrs is None:
                 sattrs = "__NONE__"
-            result = server.find_groups(criteria, sattrs, searchlimit)
+            result = server.find_groups(criteria, sattrs, searchlimit, timelimit)
         except xmlrpclib.Fault, fault:
             raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
         except socket.error, (value, msg):
diff -r a716a9835fd7 -r 11d7ba255e52 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Thu Sep 27 14:51:35 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Thu Sep 27 15:51:26 2007 -0700
@@ -212,7 +212,7 @@ class Root(controllers.RootController):
         uid = kw.get('uid')
         if uid != None and len(uid) > 0:
             try:
-                users = client.find_users(uid.encode('utf-8'))
+                users = client.find_users(uid.encode('utf-8'), None, 0, 2)
                 counter = users[0]
                 users = users[1:]
                 if counter == -1:
@@ -612,7 +612,7 @@ class Root(controllers.RootController):
         criteria = kw.get('criteria')
         if criteria != None and len(criteria) > 0:
             try:
-                groups = client.find_groups(criteria.encode('utf-8'))
+                groups = client.find_groups(criteria.encode('utf-8'), None, 0, 2)
                 counter = groups[0]
                 groups = groups[1:]
                 if counter == -1:
diff -r a716a9835fd7 -r 11d7ba255e52 ipa-server/xmlrpc-server/funcs.py
--- a/ipa-server/xmlrpc-server/funcs.py	Thu Sep 27 14:51:35 2007 -0700
+++ b/ipa-server/xmlrpc-server/funcs.py	Thu Sep 27 15:51:26 2007 -0700
@@ -448,12 +448,10 @@ class IPAServer:
     
         return users
 
-    def find_users (self, criteria, sattrs=None, searchlimit=0, opts=None):
+    def find_users (self, criteria, sattrs=None, searchlimit=0, timelimit=-1,
+            opts=None):
         """Returns a list: counter followed by the results.
            If the results are truncated, counter will be set to -1."""
-
-        # TODO - retrieve from config
-        timelimit = 2
 
         # Assume the list of fields to search will come from a central
         # configuration repository.  A good format for that would be
@@ -664,13 +662,11 @@ class IPAServer:
         finally:
             self.releaseConnection(conn)
 
-    def find_groups (self, criteria, sattrs=None, searchlimit=0, opts=None):
+    def find_groups (self, criteria, sattrs=None, searchlimit=0, timelimit=-1,
+            opts=None):
         """Return a list containing a User object for each
         existing group that matches the criteria.
         """
-
-        # TODO - retrieve from config
-        timelimit = 2
 
         # Assume the list of fields to search will come from a central
         # configuration repository.  A good format for that would be
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070927/45e60e52/attachment.bin>

From kmccarth at redhat.com  Thu Sep 27 23:07:30 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Thu, 27 Sep 2007 16:07:30 -0700
Subject: [Freeipa-devel] [PATCH] add missing filters
Message-ID: <20070927230729.GI16797@moon.usersys.redhat.com>

I added a couple methods earlier, but neglected to safe_filter the
filters.  This patch fixes that omission.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190934425 25200
# Node ID 0f0476cde60827fb776278f987ff7c33d5b2a304
# Parent  11d7ba255e520dfc3fec3c705bab8e735a9e0863
patch queue: add_filters.patch

diff -r 11d7ba255e52 -r 0f0476cde608 ipa-server/xmlrpc-server/funcs.py
--- a/ipa-server/xmlrpc-server/funcs.py	Thu Sep 27 15:51:26 2007 -0700
+++ b/ipa-server/xmlrpc-server/funcs.py	Thu Sep 27 16:07:05 2007 -0700
@@ -105,6 +105,7 @@ class IPAServer:
         """Given a kerberos principal get the LDAP uid"""
         global _LDAPPool
 
+        princ = self.__safe_filter(princ)
         filter = "(krbPrincipalName=" + princ + ")"
         # The only anonymous search we should have
         conn = _LDAPPool.getConn(self.host,self.sslport,self.bindca,self.bindcert,self.bindkey,None,None,debug)
@@ -315,6 +316,7 @@ class IPAServer:
         """Gets the users that report to a particular manager.
         """
 
+        manager_dn = self.__safe_filter(manager_dn)
         filter = "(&(objectClass=person)(manager=%s))" % manager_dn
 
         try:
@@ -624,6 +626,7 @@ class IPAServer:
            Multi-valued fields are represented as lists.
         """
 
+        member_dn = self.__safe_filter(member_dn)
         filter = "(&(objectClass=posixGroup)(uniqueMember=%s))" % member_dn
 
         try:
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070927/4c253ce5/attachment.bin>

From ssorce at redhat.com  Fri Sep 28 07:30:08 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 28 Sep 2007 03:30:08 -0400
Subject: [Freeipa-devel] Adding GUID to the user
Message-ID: <1190964608.3476.18.camel@hopeson>

It seem that many LDAP servers today provide GUIDs for their objects.
In particular while talking to OpenDirectory developers it came out that
a GUID would make things easier for an hypotetical MacOSX Client, also
it may make things a bit easier for a samba4 front-end using data on
freeIPA.

I'd like to add GUIDs to all our entries, is there any reason why we
shouldn't ?
Not sure yet how much work that will be, and if it is too much we can
delay it by a few months eventually.

Comments?

Simo.



From kmacmill at redhat.com  Fri Sep 28 12:58:52 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 28 Sep 2007 08:58:52 -0400
Subject: [Freeipa-devel] Adding GUID to the user
In-Reply-To: <1190964608.3476.18.camel@hopeson>
References: <1190964608.3476.18.camel@hopeson>
Message-ID: <1190984332.2934.2.camel@localhost.localdomain>

On Fri, 2007-09-28 at 03:30 -0400, Simo Sorce wrote:
> It seem that many LDAP servers today provide GUIDs for their objects.
> In particular while talking to OpenDirectory developers it came out that
> a GUID would make things easier for an hypotetical MacOSX Client, also
> it may make things a bit easier for a samba4 front-end using data on
> freeIPA.
> 
> I'd like to add GUIDs to all our entries, is there any reason why we
> shouldn't ?
> Not sure yet how much work that will be, and if it is too much we can
> delay it by a few months eventually.
> 
> Comments?
> 

I think we should definitely do this as it is also needed by anyone that
wants to store information about our objects in a separate datastore
(like an sql database). Without a guaranteed stable identifier to use as
a primary key it would not be safe to store, say, additional information
about users in a separate data store.

It would be nice if this could be done in v1 timeframe - any thoughts
about how hard this is?

Karl



From rmeggins at redhat.com  Fri Sep 28 14:33:54 2007
From: rmeggins at redhat.com (Richard Megginson)
Date: Fri, 28 Sep 2007 08:33:54 -0600
Subject: [Freeipa-devel] Adding GUID to the user
In-Reply-To: <1190984332.2934.2.camel@localhost.localdomain>
References: <1190964608.3476.18.camel@hopeson>
	<1190984332.2934.2.camel@localhost.localdomain>
Message-ID: <46FD10D2.1030607@redhat.com>

Karl MacMillan wrote:
> On Fri, 2007-09-28 at 03:30 -0400, Simo Sorce wrote:
>   
>> It seem that many LDAP servers today provide GUIDs for their objects.
>> In particular while talking to OpenDirectory developers it came out that
>> a GUID would make things easier for an hypotetical MacOSX Client, also
>> it may make things a bit easier for a samba4 front-end using data on
>> freeIPA.
>>
>> I'd like to add GUIDs to all our entries, is there any reason why we
>> shouldn't ?
>> Not sure yet how much work that will be, and if it is too much we can
>> delay it by a few months eventually.
>>
>> Comments?
>>
>>     
>
> I think we should definitely do this as it is also needed by anyone that
> wants to store information about our objects in a separate datastore
> (like an sql database). Without a guaranteed stable identifier to use as
> a primary key it would not be safe to store, say, additional information
> about users in a separate data store.
>
> It would be nice if this could be done in v1 timeframe - any thoughts
> about how hard this is?
>   
Fedora DS generates the operational attribute nsUniqueID for each 
entry.  It is a GUID/UUID but it is formatted a little bit differently e.g.
xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx
instead of the usual
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
> Karl
>
> _______________________________________________
> Freeipa-devel mailing list
> Freeipa-devel at redhat.com
> https://www.redhat.com/mailman/listinfo/freeipa-devel
>   

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070928/c84c0bc5/attachment.bin>

From rcritten at redhat.com  Fri Sep 28 14:46:26 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 28 Sep 2007 10:46:26 -0400
Subject: [Freeipa-devel] Adding GUID to the user
In-Reply-To: <46FD10D2.1030607@redhat.com>
References: <1190964608.3476.18.camel@hopeson>	<1190984332.2934.2.camel@localhost.localdomain>
	<46FD10D2.1030607@redhat.com>
Message-ID: <46FD13C2.5070903@redhat.com>

Richard Megginson wrote:
> Karl MacMillan wrote:
>> On Fri, 2007-09-28 at 03:30 -0400, Simo Sorce wrote:
>>  
>>> It seem that many LDAP servers today provide GUIDs for their objects.
>>> In particular while talking to OpenDirectory developers it came out that
>>> a GUID would make things easier for an hypotetical MacOSX Client, also
>>> it may make things a bit easier for a samba4 front-end using data on
>>> freeIPA.
>>>
>>> I'd like to add GUIDs to all our entries, is there any reason why we
>>> shouldn't ?
>>> Not sure yet how much work that will be, and if it is too much we can
>>> delay it by a few months eventually.
>>>
>>> Comments?
>>>
>>>     
>>
>> I think we should definitely do this as it is also needed by anyone that
>> wants to store information about our objects in a separate datastore
>> (like an sql database). Without a guaranteed stable identifier to use as
>> a primary key it would not be safe to store, say, additional information
>> about users in a separate data store.
>>
>> It would be nice if this could be done in v1 timeframe - any thoughts
>> about how hard this is?
>>   
> Fedora DS generates the operational attribute nsUniqueID for each 
> entry.  It is a GUID/UUID but it is formatted a little bit differently e.g.
> xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx
> instead of the usual
> xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

How does that work in MMR? Is it possible to get duplicates?

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070928/6b1dbbfd/attachment.bin>

From rmeggins at redhat.com  Fri Sep 28 14:48:47 2007
From: rmeggins at redhat.com (Richard Megginson)
Date: Fri, 28 Sep 2007 08:48:47 -0600
Subject: [Freeipa-devel] Adding GUID to the user
In-Reply-To: <46FD13C2.5070903@redhat.com>
References: <1190964608.3476.18.camel@hopeson>	<1190984332.2934.2.camel@localhost.localdomain>
	<46FD10D2.1030607@redhat.com> <46FD13C2.5070903@redhat.com>
Message-ID: <46FD144F.8030901@redhat.com>

Rob Crittenden wrote:
> Richard Megginson wrote:
>> Karl MacMillan wrote:
>>> On Fri, 2007-09-28 at 03:30 -0400, Simo Sorce wrote:
>>>  
>>>> It seem that many LDAP servers today provide GUIDs for their objects.
>>>> In particular while talking to OpenDirectory developers it came out 
>>>> that
>>>> a GUID would make things easier for an hypotetical MacOSX Client, also
>>>> it may make things a bit easier for a samba4 front-end using data on
>>>> freeIPA.
>>>>
>>>> I'd like to add GUIDs to all our entries, is there any reason why we
>>>> shouldn't ?
>>>> Not sure yet how much work that will be, and if it is too much we can
>>>> delay it by a few months eventually.
>>>>
>>>> Comments?
>>>>
>>>>     
>>>
>>> I think we should definitely do this as it is also needed by anyone 
>>> that
>>> wants to store information about our objects in a separate datastore
>>> (like an sql database). Without a guaranteed stable identifier to 
>>> use as
>>> a primary key it would not be safe to store, say, additional 
>>> information
>>> about users in a separate data store.
>>>
>>> It would be nice if this could be done in v1 timeframe - any thoughts
>>> about how hard this is?
>>>   
>> Fedora DS generates the operational attribute nsUniqueID for each 
>> entry.  It is a GUID/UUID but it is formatted a little bit 
>> differently e.g.
>> xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx
>> instead of the usual
>> xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
>
> How does that work in MMR? Is it possible to get duplicates?
Nope.  The algorithm for UUID generation prohibits duplicates.
>
> rob

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070928/9361f5f1/attachment.bin>

From ssorce at redhat.com  Fri Sep 28 14:57:57 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 28 Sep 2007 10:57:57 -0400
Subject: [Freeipa-devel] Adding GUID to the user
In-Reply-To: <46FD10D2.1030607@redhat.com>
References: <1190964608.3476.18.camel@hopeson>
	<1190984332.2934.2.camel@localhost.localdomain>
	<46FD10D2.1030607@redhat.com>
Message-ID: <1190991477.3476.20.camel@hopeson>

On Fri, 2007-09-28 at 08:33 -0600, Richard Megginson wrote:
> Fedora DS generates the operational attribute nsUniqueID for each 
> entry.  It is a GUID/UUID but it is formatted a little bit differently
> e.g.
> xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx
> instead of the usual
> xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 

For interoperability reasons we really need a real GUID, is it possible
to have that ?

Simo.



From rmeggins at redhat.com  Fri Sep 28 15:10:04 2007
From: rmeggins at redhat.com (Richard Megginson)
Date: Fri, 28 Sep 2007 09:10:04 -0600
Subject: [Freeipa-devel] Adding GUID to the user
In-Reply-To: <1190991477.3476.20.camel@hopeson>
References: <1190964608.3476.18.camel@hopeson>	
	<1190984332.2934.2.camel@localhost.localdomain>	
	<46FD10D2.1030607@redhat.com> <1190991477.3476.20.camel@hopeson>
Message-ID: <46FD194C.2090802@redhat.com>

Simo Sorce wrote:
> On Fri, 2007-09-28 at 08:33 -0600, Richard Megginson wrote:
>   
>> Fedora DS generates the operational attribute nsUniqueID for each 
>> entry.  It is a GUID/UUID but it is formatted a little bit differently
>> e.g.
>> xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx
>> instead of the usual
>> xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 
>>     
>
> For interoperability reasons we really need a real GUID, is it possible
> to have that ?
>   
By real do you mean formatted as 8-4-4-4-12 instead of 8-8-8-8?  It is 
possible, but it would require a lot of code changes.  Another 
possibility is that we could deprecate nsUniqueID and instead use the 
LDAP entryUUID attribute.
> Simo.
>
>   

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070928/29a42b43/attachment.bin>

From ssorce at redhat.com  Fri Sep 28 15:56:18 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 28 Sep 2007 11:56:18 -0400
Subject: [Freeipa-devel] Adding GUID to the user
In-Reply-To: <46FD194C.2090802@redhat.com>
References: <1190964608.3476.18.camel@hopeson>
	<1190984332.2934.2.camel@localhost.localdomain>
	<46FD10D2.1030607@redhat.com> <1190991477.3476.20.camel@hopeson>
	<46FD194C.2090802@redhat.com>
Message-ID: <1190994978.3476.22.camel@hopeson>

On Fri, 2007-09-28 at 09:10 -0600, Richard Megginson wrote:
> Simo Sorce wrote:
> > On Fri, 2007-09-28 at 08:33 -0600, Richard Megginson wrote:
> >   
> >> Fedora DS generates the operational attribute nsUniqueID for each 
> >> entry.  It is a GUID/UUID but it is formatted a little bit differently
> >> e.g.
> >> xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx
> >> instead of the usual
> >> xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 
> >>     
> >
> > For interoperability reasons we really need a real GUID, is it possible
> > to have that ?
> >   
> By real do you mean formatted as 8-4-4-4-12 instead of 8-8-8-8?  It is 
> possible, but it would require a lot of code changes.  Another 
> possibility is that we could deprecate nsUniqueID and instead use the 
> LDAP entryUUID attribute.

Is the format the only difference?
Aren't there rules on how to build the GUID in term of what data to use
etc ?

Simo.



From kmccarth at redhat.com  Fri Sep 28 15:58:48 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Fri, 28 Sep 2007 08:58:48 -0700
Subject: [Freeipa-devel] [PATCH] refactor for better group member rendering
Message-ID: <20070928155848.GA10276@moon.usersys.redhat.com>

This patch improves the group member rendering code, so group members
and be displayed differently from user members.

Depends on the patches:
freeipa-221-groupedit_use_dns.patch
freeipa-222-nestedgroups.patch
freeipa-224-missing_filters.patch

-Kevin


-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190994790 25200
# Node ID a62a925a724305aa6094df2e0b1d729be569c53d
# Parent  0f0476cde60827fb776278f987ff7c33d5b2a304
Refactoring to allow better member rendering.
Created a MemberDisplayInfo to hold the info needed to render a member.
Changed round trip persistance to use that class.
Created a single renderMemberInfo method to render the members.
Changed dynamic as well as static lists to use renderMemberInfo.
Lastly, render groups members in italics.
Change view group to render group members in italics.

diff -r 0f0476cde608 -r a62a925a7243 ipa-server/ipa-gui/ipagui/forms/group.py
--- a/ipa-server/ipa-gui/ipagui/forms/group.py	Thu Sep 27 16:07:05 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/group.py	Fri Sep 28 08:53:10 2007 -0700
@@ -11,7 +11,7 @@ class GroupFields():
 
     group_orig = widgets.HiddenField(name="group_orig")
     member_data = widgets.HiddenField(name="member_data")
-    dn_to_cn_json = widgets.HiddenField(name="dn_to_cn_json")
+    dn_to_info_json = widgets.HiddenField(name="dn_to_info_json")
 
 class GroupNewValidator(validators.Schema):
     cn = validators.String(not_empty=True)
@@ -48,7 +48,7 @@ class GroupEditForm(widgets.Form):
     fields = [GroupFields.gidnumber, GroupFields.description,
               GroupFields.cn_hidden, GroupFields.editprotected_hidden,
               GroupFields.group_orig, GroupFields.member_data,
-              GroupFields.dn_to_cn_json]
+              GroupFields.dn_to_info_json]
 
     validator = GroupEditValidator()
 
diff -r 0f0476cde608 -r a62a925a7243 ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Thu Sep 27 16:07:05 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Fri Sep 28 08:53:10 2007 -0700
@@ -11,9 +11,21 @@ from ipagui.helpers import ipahelper
   <?python searchurl = tg.url('/groupedit_search') ?>
 
   <script type="text/javascript">
+
+    // Stored as the values in the dn_to_info_hash
+    MemberDisplayInfo = Class.create();
+    MemberDisplayInfo.prototype = {
+      initialize: function(name, descr, type) {
+        this.name = name;
+        this.descr = descr;
+        this.type = type;
+      },
+    };
+
+
     // this is used for round-trip recontruction of the names.
     // the hidden fields only contain dns.
-    var dn_to_cn_hash = new Hash();
+    var dn_to_info_hash = new Hash();
 
     // used to filter search results.
     // records dns already in the group
@@ -41,14 +53,33 @@ from ipagui.helpers import ipahelper
     }
 
     /*
+     * Renders the information about the member into the passed in
+     * element.  This is used by addmember and removemember to
+     * consistently create the dom for the member information
+     * (name, descr) and add icons/font changes correct for each type.
+     */
+    function renderMemberInfo(newdiv, info) {
+      if (info.type == "user") {
+        newdiv.appendChild(document.createTextNode(
+          info.name.escapeHTML() + " " + info.descr.escapeHTML() + " "));
+      } else if (info.type == "group") {
+        ital = document.createElement('i');
+        ital.appendChild(document.createTextNode(
+          info.name.escapeHTML() + " " + 
+          info.descr.escapeHTML() + " "));
+        newdiv.appendChild(ital);
+      }
+    }
+
+    /*
      * Callback used for afterFinish in scriptaculous effect
      */
     function removeElement(effect) {
       Element.remove(effect.element);
     }
 
-    function addmember(dn, cn) {
-      dn_to_cn_hash[dn] = cn;
+    function addmember(dn, info) {
+      dn_to_info_hash[dn] = info;
 
       if ((added_hash[dn] == 1) || (member_hash[dn] == 1)) {
         return null;
@@ -56,8 +87,7 @@ from ipagui.helpers import ipahelper
       added_hash[dn] = 1;
 
       var newdiv = document.createElement('div');
-      newdiv.appendChild(document.createTextNode(
-        cn.escapeHTML() + " "));
+      renderMemberInfo(newdiv, info);
 
       var undolink = document.createElement('a');
       undolink.setAttribute('href', '');
@@ -80,8 +110,8 @@ from ipagui.helpers import ipahelper
       return newdiv
     }
 
-    function addmemberHandler(element, dn, cn) {
-      var newdiv = addmember(dn, cn)
+    function addmemberHandler(element, dn, info) {
+      var newdiv = addmember(dn, info)
       if (newdiv != null) {
         new Effect.Fade(Element.up(element));
         new Effect.Appear(newdiv);
@@ -89,12 +119,11 @@ from ipagui.helpers import ipahelper
       }
     }
 
-    function removemember(dn, cn) {
-      dn_to_cn_hash[dn] = cn;
+    function removemember(dn, info) {
+      dn_to_info_hash[dn] = info;
 
       var newdiv = document.createElement('div');
-      newdiv.appendChild(document.createTextNode(
-        cn.escapeHTML() + " "));
+      renderMemberInfo(newdiv, info);
 
       orig_div_id = dn_to_member_div_id[dn];
       var undolink = document.createElement('a');
@@ -118,8 +147,8 @@ from ipagui.helpers import ipahelper
       return newdiv
     }
 
-    function removememberHandler(element, dn, cn) {
-      var newdiv = removemember(dn, cn);
+    function removememberHandler(element, dn, info) {
+      var newdiv = removemember(dn, info);
       new Effect.Fade(Element.up(element));
       new Effect.Appear(newdiv);
       /* Element.up(element).remove(); */
@@ -151,8 +180,8 @@ from ipagui.helpers import ipahelper
     }
 
     function preSubmit() {
-      var json = dn_to_cn_hash.toJSON();
-      $('form_dn_to_cn_json').value = json;
+      var json = dn_to_info_hash.toJSON();
+      $('form_dn_to_info_json').value = json;
       return true;
     }
   </script>
@@ -225,16 +254,30 @@ from ipagui.helpers import ipahelper
 
           member_uid = member.get('uid')
           if member_uid:
-              member_cn = "%s %s (%s)" % (member.get('givenName'),
-                                          member.get('sn'),
-                                          member.get('uid'))
+              member_name = "%s %s" % (member.get('givenName'),
+                                     member.get('sn'))
+              member_descr = "(%s)" % member.get('uid')
+              member_type = "user"
           else:
-              member_cn = "%s [group]" % member.get('cn')
-          member_cn_esc = ipahelper.javascript_string_escape(member_cn)
+              member_name = member.get('cn')
+              member_descr = "[group]"
+              member_type = "group"
+          member_name_esc = ipahelper.javascript_string_escape(member_name)
+          member_descr_esc = ipahelper.javascript_string_escape(member_descr)
+          member_type_esc = ipahelper.javascript_string_escape(member_type)
           ?>
-          ${member_cn}
+          <span id="member-info-${div_counter}"></span>
+          <script type="text/javascript">
+            renderMemberInfo($('member-info-${div_counter}'),
+                         new MemberDisplayInfo('${member_name_esc}',
+                                               '${member_descr_esc}',
+                                               '${member_type_esc}'));
+          </script>
           <a href="#" 
-            onclick="removememberHandler(this, '${member_dn_esc}', '${member_cn_esc}');
+            onclick="removememberHandler(this, '${member_dn_esc}',
+                         new MemberDisplayInfo('${member_name_esc}',
+                                               '${member_descr_esc}',
+                                               '${member_type_esc}'));
                      return false;"
           >remove</a>
           <script type="text/javascript">
@@ -295,8 +338,8 @@ from ipagui.helpers import ipahelper
      * This section restores the contents of the add and remove lists
      * dynamically if we have to refresh the page
      */
-    if ($('form_dn_to_cn_json').value != "") {
-      dn_to_cn_hash = new Hash($('form_dn_to_cn_json').value.evalJSON());
+    if ($('form_dn_to_info_json').value != "") {
+      dn_to_info_hash = new Hash($('form_dn_to_info_json').value.evalJSON());
     }
 
     if ($('form_editprotected').value != "") {
@@ -320,8 +363,8 @@ from ipagui.helpers import ipahelper
     dnadd_esc = ipahelper.javascript_string_escape(dnadd)
     ?>
     var dn = "${dnadd_esc}";
-    var cn = dn_to_cn_hash[dn];
-    var newdiv = addmember(dn, cn);
+    var info = dn_to_info_hash[dn];
+    var newdiv = addmember(dn, info);
     if (newdiv != null) {
       newdiv.style.display = 'block';
     }
@@ -332,8 +375,8 @@ from ipagui.helpers import ipahelper
     dndel_esc = ipahelper.javascript_string_escape(dndel)
     ?>
     var dn = "${dndel_esc}";
-    var cn = dn_to_cn_hash[dn];
-    var newdiv = removemember(dn, cn);
+    var info = dn_to_info_hash[dn];
+    var newdiv = removemember(dn, info);
     newdiv.style.display = 'block';
     orig_div_id = dn_to_member_div_id[dn]
     $(orig_div_id).style.display = 'none';
diff -r 0f0476cde608 -r a62a925a7243 ipa-server/ipa-gui/ipagui/templates/groupeditsearch.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupeditsearch.kid	Thu Sep 27 16:07:05 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupeditsearch.kid	Fri Sep 28 08:53:10 2007 -0700
@@ -20,11 +20,18 @@ from ipagui.helpers import ipahelper
             ent_dn_esc = ipahelper.javascript_string_escape(entity.dn)
             ent_uid = entity.uid
             if ent_uid:
-                ent_cn = "%s %s (%s)" % (entity.givenName, entity.sn, entity.uid)
+                ent_name = "%s %s" % (entity.givenName, entity.sn)
+                ent_descr = "(%s)" % entity.uid
+                ent_type = "user"
             else:
-                ent_cn = "%s [group]" % entity.cn
-            ent_cn_esc = ipahelper.javascript_string_escape(ent_cn)
+                ent_name = entity.cn
+                ent_descr = "[group]"
+                ent_type = "group"
+            ent_name_esc = ipahelper.javascript_string_escape(ent_name)
+            ent_descr_esc = ipahelper.javascript_string_escape(ent_descr)
+            ent_type_esc = ipahelper.javascript_string_escape(ent_type)
             ?>
+            <span id="search-info-${search_div_counter}"></span>
             <script type="text/javascript">
               if ((added_hash["${ent_dn_esc}"] == 1) ||
                   (member_hash["${ent_dn_esc}"] == 1)) {
@@ -32,10 +39,17 @@ from ipagui.helpers import ipahelper
               } else {
                 results_counter = results_counter + 1;
               }
+
+              renderMemberInfo($('search-info-${search_div_counter}'),
+                           new MemberDisplayInfo('${ent_name_esc}',
+                                                 '${ent_descr_esc}',
+                                                 '${ent_type_esc}'));
             </script>
-            ${ent_cn}
             <a href=""
-              onclick="addmemberHandler(this, '${ent_dn_esc}', '${ent_cn_esc}');
+              onclick="addmemberHandler(this, '${ent_dn_esc}',
+                           new MemberDisplayInfo('${ent_name_esc}',
+                                                 '${ent_descr_esc}',
+                                                 '${ent_type_esc}'));
                       return false;"
             >add</a>
             <?python
diff -r 0f0476cde608 -r a62a925a7243 ipa-server/ipa-gui/ipagui/templates/groupshow.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupshow.kid	Thu Sep 27 16:07:05 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupshow.kid	Fri Sep 28 08:53:10 2007 -0700
@@ -40,14 +40,24 @@
       if member_uid:
           member_cn = "%s %s" % (member.get('givenName'), member.get('sn'))
           member_desc = "(%s)" % member_uid
+          member_type = "user"
           view_url = tg.url('usershow', uid=member_uid)
       else:
           member_cn = "%s" % member.get('cn')
           member_desc = "[group]"
+          member_type = "group"
           view_url = tg.url('groupshow', cn=member_cn)
       ?>
-      <a href="${view_url}"
-        >${member_cn}</a> ${member_desc}
+      <span py:if='member_type == "user"'>
+        <a href="${view_url}"
+          >${member_cn}</a> ${member_desc}
+      </span>
+      <span py:if='member_type == "group"'>
+        <i>
+          <a href="${view_url}"
+            >${member_cn}</a> ${member_desc}
+        </i>
+      </span>
     </div>
 
     <br/>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070928/fe86b794/attachment.bin>

From rmeggins at redhat.com  Fri Sep 28 16:02:11 2007
From: rmeggins at redhat.com (Richard Megginson)
Date: Fri, 28 Sep 2007 10:02:11 -0600
Subject: [Freeipa-devel] Adding GUID to the user
In-Reply-To: <1190994978.3476.22.camel@hopeson>
References: <1190964608.3476.18.camel@hopeson>	
	<1190984332.2934.2.camel@localhost.localdomain>	
	<46FD10D2.1030607@redhat.com> <1190991477.3476.20.camel@hopeson>	
	<46FD194C.2090802@redhat.com> <1190994978.3476.22.camel@hopeson>
Message-ID: <46FD2583.7080007@redhat.com>

Simo Sorce wrote:
> On Fri, 2007-09-28 at 09:10 -0600, Richard Megginson wrote:
>   
>> Simo Sorce wrote:
>>     
>>> On Fri, 2007-09-28 at 08:33 -0600, Richard Megginson wrote:
>>>   
>>>       
>>>> Fedora DS generates the operational attribute nsUniqueID for each 
>>>> entry.  It is a GUID/UUID but it is formatted a little bit differently
>>>> e.g.
>>>> xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx
>>>> instead of the usual
>>>> xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 
>>>>     
>>>>         
>>> For interoperability reasons we really need a real GUID, is it possible
>>> to have that ?
>>>   
>>>       
>> By real do you mean formatted as 8-4-4-4-12 instead of 8-8-8-8?  It is 
>> possible, but it would require a lot of code changes.  Another 
>> possibility is that we could deprecate nsUniqueID and instead use the 
>> LDAP entryUUID attribute.
>>     
>
> Is the format the only difference?
>   
Yes.
> Aren't there rules on how to build the GUID in term of what data to use
> etc ?
>   
 From the DS code:
/* uuid.h - interface  to uuid layer. UUID is generated in accordance
            with UUIDs and GUIDs IETF draft
 */
typedef struct _guid_t
{
    unsigned32 time_low;
    unsigned16 time_mid;
    unsigned16 time_hi_and_version;
    unsigned8  clock_seq_hi_and_reserved;
    unsigned8  clock_seq_low;
    PRUint8    node[6];
} guid_t;

I'm not sure why they chose (in 1999/2000) to format the string 
representation as 8-8-8-8 instead of the 8-4-4-4-12 that the rest of the 
world uses, but it is only the string representation that is different.
> Simo.
>
>   

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070928/b3f5778b/attachment.bin>

From ssorce at redhat.com  Fri Sep 28 16:11:58 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 28 Sep 2007 12:11:58 -0400
Subject: [Freeipa-devel] Adding GUID to the user
In-Reply-To: <46FD2583.7080007@redhat.com>
References: <1190964608.3476.18.camel@hopeson>
	<1190984332.2934.2.camel@localhost.localdomain>
	<46FD10D2.1030607@redhat.com> <1190991477.3476.20.camel@hopeson>
	<46FD194C.2090802@redhat.com> <1190994978.3476.22.camel@hopeson>
	<46FD2583.7080007@redhat.com>
Message-ID: <1190995918.3476.25.camel@hopeson>

On Fri, 2007-09-28 at 10:02 -0600, Richard Megginson wrote:
> Simo Sorce wrote:
> > On Fri, 2007-09-28 at 09:10 -0600, Richard Megginson wrote:
> >   
> >> Simo Sorce wrote:
> >>     
> >>> On Fri, 2007-09-28 at 08:33 -0600, Richard Megginson wrote:
> >>>   
> >>>       
> >>>> Fedora DS generates the operational attribute nsUniqueID for each 
> >>>> entry.  It is a GUID/UUID but it is formatted a little bit differently
> >>>> e.g.
> >>>> xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx
> >>>> instead of the usual
> >>>> xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 
> >>>>     
> >>>>         
> >>> For interoperability reasons we really need a real GUID, is it possible
> >>> to have that ?
> >>>   
> >>>       
> >> By real do you mean formatted as 8-4-4-4-12 instead of 8-8-8-8?  It is 
> >> possible, but it would require a lot of code changes.  Another 
> >> possibility is that we could deprecate nsUniqueID and instead use the 
> >> LDAP entryUUID attribute.
> >>     
> >
> > Is the format the only difference?
> >   
> Yes.
> > Aren't there rules on how to build the GUID in term of what data to use
> > etc ?
> >   
>  From the DS code:
> /* uuid.h - interface  to uuid layer. UUID is generated in accordance
>             with UUIDs and GUIDs IETF draft
>  */
> typedef struct _guid_t
> {
>     unsigned32 time_low;
>     unsigned16 time_mid;
>     unsigned16 time_hi_and_version;
>     unsigned8  clock_seq_hi_and_reserved;
>     unsigned8  clock_seq_low;
>     PRUint8    node[6];
> } guid_t;
> 
> I'm not sure why they chose (in 1999/2000) to format the string 
> representation as 8-8-8-8 instead of the 8-4-4-4-12 that the rest of the 
> world uses, but it is only the string representation that is different.

Then I guess that in the interim we may just copy and reformat the
string into a new attribute at object creation?
I guess it can even be just a post operation and the attribute may be
taken off replication as we can guarantee it is completely equivalent to
the UUID. Does it make sense?

Simo.



From rmeggins at redhat.com  Fri Sep 28 16:21:29 2007
From: rmeggins at redhat.com (Richard Megginson)
Date: Fri, 28 Sep 2007 10:21:29 -0600
Subject: [Freeipa-devel] Adding GUID to the user
In-Reply-To: <1190995918.3476.25.camel@hopeson>
References: <1190964608.3476.18.camel@hopeson>	
	<1190984332.2934.2.camel@localhost.localdomain>	
	<46FD10D2.1030607@redhat.com> <1190991477.3476.20.camel@hopeson>	
	<46FD194C.2090802@redhat.com> <1190994978.3476.22.camel@hopeson>	
	<46FD2583.7080007@redhat.com> <1190995918.3476.25.camel@hopeson>
Message-ID: <46FD2A09.5020605@redhat.com>

Simo Sorce wrote:
> On Fri, 2007-09-28 at 10:02 -0600, Richard Megginson wrote:
>   
>> Simo Sorce wrote:
>>     
>>> On Fri, 2007-09-28 at 09:10 -0600, Richard Megginson wrote:
>>>   
>>>       
>>>> Simo Sorce wrote:
>>>>     
>>>>         
>>>>> On Fri, 2007-09-28 at 08:33 -0600, Richard Megginson wrote:
>>>>>   
>>>>>       
>>>>>           
>>>>>> Fedora DS generates the operational attribute nsUniqueID for each 
>>>>>> entry.  It is a GUID/UUID but it is formatted a little bit differently
>>>>>> e.g.
>>>>>> xxxxxxxx-xxxxxxxx-xxxxxxxx-xxxxxxxx
>>>>>> instead of the usual
>>>>>> xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 
>>>>>>     
>>>>>>         
>>>>>>             
>>>>> For interoperability reasons we really need a real GUID, is it possible
>>>>> to have that ?
>>>>>   
>>>>>       
>>>>>           
>>>> By real do you mean formatted as 8-4-4-4-12 instead of 8-8-8-8?  It is 
>>>> possible, but it would require a lot of code changes.  Another 
>>>> possibility is that we could deprecate nsUniqueID and instead use the 
>>>> LDAP entryUUID attribute.
>>>>     
>>>>         
>>> Is the format the only difference?
>>>   
>>>       
>> Yes.
>>     
>>> Aren't there rules on how to build the GUID in term of what data to use
>>> etc ?
>>>   
>>>       
>>  From the DS code:
>> /* uuid.h - interface  to uuid layer. UUID is generated in accordance
>>             with UUIDs and GUIDs IETF draft
>>  */
>> typedef struct _guid_t
>> {
>>     unsigned32 time_low;
>>     unsigned16 time_mid;
>>     unsigned16 time_hi_and_version;
>>     unsigned8  clock_seq_hi_and_reserved;
>>     unsigned8  clock_seq_low;
>>     PRUint8    node[6];
>> } guid_t;
>>
>> I'm not sure why they chose (in 1999/2000) to format the string 
>> representation as 8-8-8-8 instead of the 8-4-4-4-12 that the rest of the 
>> world uses, but it is only the string representation that is different.
>>     
>
> Then I guess that in the interim we may just copy and reformat the
> string into a new attribute at object creation?
> I guess it can even be just a post operation and the attribute may be
> taken off replication as we can guarantee it is completely equivalent to
> the UUID. Does it make sense?
>   
Yes, that should be ok.
> Simo.
>
>   

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070928/e6df732e/attachment.bin>

From kmccarth at redhat.com  Fri Sep 28 16:59:45 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Fri, 28 Sep 2007 09:59:45 -0700
Subject: [Freeipa-devel] [PATCH] sort group members
Message-ID: <20070928165945.GB10276@moon.usersys.redhat.com>

Sort the group members for the group show and edit pages.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1190998744 25200
# Node ID ea4707434a517839c30c6f88f6ad302e91189e48
# Parent  a62a925a724305aa6094df2e0b1d729be569c53d
Sort the group members on the view and edit group pages.

diff -r a62a925a7243 -r ea4707434a51 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Fri Sep 28 08:53:10 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Fri Sep 28 09:59:04 2007 -0700
@@ -48,6 +48,36 @@ def utf8_encode(value):
         value = value.encode('utf-8')
     return value
 
+def sort_group_member(a, b):
+    """Comparator function used for sorting group members."""
+    if a.get('uid') and b.get('uid'):
+        if a.get('givenname', '') == b.get('givenname', ''):
+            if a.get('sn', '') == b.get('sn', ''):
+                if a.get('uid') == b.get('uid'):
+                    return 0
+                elif a.get('uid') < b.get('uid'):
+                    return -1
+                else:
+                    return 1
+            elif a.get('sn', '') < b.get('sn', ''):
+                return -1
+            else:
+                return 1
+        elif a.get('givenname') < b.get('givenname'):
+            return -1
+        else:
+            return 1
+    elif a.get('uid'):
+        return -1
+    elif b.get('uid'):
+        return 1
+    else:
+        if a.get('cn', '') == b.get('cn', ''):
+            return 0
+        elif a.get('cn', '') < b.get('cn', ''):
+            return -1
+        else:
+            return 1
 
 class Root(controllers.RootController):
 
@@ -484,6 +514,7 @@ class Root(controllers.RootController):
             # Map users into an array of dicts, which can be serialized
             # (so we don't have to do this on each round trip)
             member_dicts = map(lambda member: member.toDict(), members)
+            member_dicts.sort(sort_group_member)
 
             # store a copy of the original group for the update later
             group_data = b64encode(dumps(group_dict))
@@ -649,6 +680,7 @@ class Root(controllers.RootController):
                         'uid', 'cn']),
                     member_dns)
             member_dicts = map(lambda member: member.toDict(), members)
+            member_dicts.sort(sort_group_member)
 
             return dict(group=group_dict, fields=forms.group.GroupFields(),
                     members = member_dicts)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070928/0d7e1173/attachment.bin>

From kmccarth at redhat.com  Fri Sep 28 18:58:59 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Fri, 28 Sep 2007 11:58:59 -0700
Subject: [Freeipa-devel] [PATCH] extract shared dyamic edit code
Message-ID: <20070928185858.GC10276@moon.usersys.redhat.com>

No new code here, just extracting shared code so I can use it on the
useredit page too.

Depends on:
freeipa-221-groupedit_use_dns.patch
freeipa-222-nestedgroups.patch
freeipa-225-editgroupui.patch
freeipa-226-groupmember_sorting.patch

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1191005756 25200
# Node ID 27fb698fd454fe04913c9074c790c3163ca83d47
# Parent  ea4707434a517839c30c6f88f6ad302e91189e48
Extract the shared dynamic edit code.
Rename groupeditsearch.kid to dynamiceditsearch.kid

diff -r ea4707434a51 -r 27fb698fd454 ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Fri Sep 28 09:59:04 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Fri Sep 28 11:55:56 2007 -0700
@@ -444,13 +444,11 @@ class Root(controllers.RootController):
             turbogears.flash("Group add failed: " + str(e) + "<br/>" + str(e.detail))
             return dict(form=group_new_form, tg_template='ipagui.templates.groupnew')
 
-    @expose("ipagui.templates.groupeditsearch")
+    @expose("ipagui.templates.dynamiceditsearch")
     @identity.require(identity.not_anonymous())
     def groupedit_search(self, **kw):
         """Searches for users+groups and displays list of results in a table.
-           This method is used for the ajax search on the group edit page.
-           It's not re-usable because the ajax/dom manipulation is tightly
-           bound to the groupedit page"""
+           This method is used for the ajax search on the group edit page."""
         client.set_krbccache(os.environ["KRB5CCNAME"])
         users = []
         groups = []
diff -r ea4707434a51 -r 27fb698fd454 ipa-server/ipa-gui/ipagui/static/javascript/dynamicedit.js
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/static/javascript/dynamicedit.js	Fri Sep 28 11:55:56 2007 -0700
@@ -0,0 +1,171 @@
+/**
+ * dynamicedit.js
+ *
+ * Shared code, data, and functions for the dynamic add/remove lists on the
+ * edit group/user pages.
+ *
+ * These functions have specific expectations of the page they are used on:
+ *
+ * - If you want to preserve the dn_to_info_hash on round trip:
+ *     - The form must have a 'form_dn_to_info_json' hidden field.
+ *     - The form must have onsubmit="preSubmit()" set in its tag.
+ *     - Restoring the contents of add/remove lists on round trip unfortunately
+ *       can't be shared because it is a mixture of python and javascript.  See
+ *       the bottom part editgroup.kid for example code on this.
+ *
+ * - The page must have a div: 'newmembers'
+ *   that new members are dynamically added to.
+ *
+ * - The page must have a div: 'delmembers'
+ *   that removed members are dynamically added to.
+ *
+ * - Hidden fields called 'dnadd' and 'dndel' will be dynamically created,
+ *   holding the values of the 'dn' passed to addmember() and removemember()
+ *
+ * Other Notes:
+ *
+ * - Many of the fields refer to 'dn'.  There is no intrinsic reason this has
+ *   to be a dn (it can hold any "unique id" for the objects to add/remove)
+ *
+ * - Similarly, the word 'member' is used because the code was originally
+ *   written for editgroup.  A 'member' is just a 'thing' to add/remove.
+ *   On the useredit pages, for example, a 'member' is actually a group.
+ */
+
+// Stored as the values in the dn_to_info_hash
+MemberDisplayInfo = Class.create();
+MemberDisplayInfo.prototype = {
+  initialize: function(name, descr, type) {
+    this.name = name;
+    this.descr = descr;
+    this.type = type;
+  },
+};
+
+
+// this is used for round-trip recontruction of the names.
+// the hidden fields only contain dns.
+var dn_to_info_hash = new Hash();
+
+// used to filter search results.
+// records dns already in the group
+var member_hash = new Hash();
+
+// used to prevent double adding
+// records dns to be added
+var added_hash = new Hash();
+
+// Tracks the div ids that each member belongs to.
+// Since dn's will contain illegal characters for div ids, this is used
+// to map them to the correct div
+var dn_to_member_div_id = new Hash();
+
+
+
+/*
+ * Renders the information about the member into the passed in
+ * element.  This is used by addmember and removemember to
+ * consistently create the dom for the member information
+ * (name, descr) and add icons/font changes correct for each type.
+ */
+function renderMemberInfo(newdiv, info) {
+  if (info.type == "user") {
+    newdiv.appendChild(document.createTextNode(
+      info.name.escapeHTML() + " " + info.descr.escapeHTML() + " "));
+  } else if (info.type == "group") {
+    ital = document.createElement('i');
+    ital.appendChild(document.createTextNode(
+      info.name.escapeHTML() + " " + 
+      info.descr.escapeHTML() + " "));
+    newdiv.appendChild(ital);
+  }
+}
+
+/*
+ * Callback used for afterFinish in scriptaculous effect
+ */
+function removeElement(effect) {
+  Element.remove(effect.element);
+}
+
+function addmember(dn, info) {
+  dn_to_info_hash[dn] = info;
+
+  if ((added_hash[dn] == 1) || (member_hash[dn] == 1)) {
+    return null;
+  }
+  added_hash[dn] = 1;
+
+  var newdiv = document.createElement('div');
+  renderMemberInfo(newdiv, info);
+
+  var undolink = document.createElement('a');
+  undolink.setAttribute('href', '');
+  undolink.setAttribute('onclick',
+    'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' +
+    'added_hash.remove("' + jsStringEscape(dn) + '");' +
+    'return false;');
+  undolink.appendChild(document.createTextNode("undo"));
+  newdiv.appendChild(undolink);
+
+  var dnInfo = document.createElement('input');
+  dnInfo.setAttribute('type', 'hidden');
+  dnInfo.setAttribute('name', 'dnadd');
+  dnInfo.setAttribute('value', dn);
+  newdiv.appendChild(dnInfo);
+
+  newdiv.style.display = 'none';
+  $('newmembers').appendChild(newdiv);
+
+  return newdiv
+}
+
+function addmemberHandler(element, dn, info) {
+  var newdiv = addmember(dn, info)
+  if (newdiv != null) {
+    new Effect.Fade(Element.up(element));
+    new Effect.Appear(newdiv);
+    /* Element.up(element).remove(); */
+  }
+}
+
+function removemember(dn, info) {
+  dn_to_info_hash[dn] = info;
+
+  var newdiv = document.createElement('div');
+  renderMemberInfo(newdiv, info);
+
+  orig_div_id = dn_to_member_div_id[dn];
+  var undolink = document.createElement('a');
+  undolink.setAttribute('href', '');
+  undolink.setAttribute('onclick',
+    'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' +
+    "new Effect.Appear($('" + orig_div_id + "'));" +
+    'return false;');
+  undolink.appendChild(document.createTextNode("undo"));
+  newdiv.appendChild(undolink);
+
+  var dnInfo = document.createElement('input');
+  dnInfo.setAttribute('type', 'hidden');
+  dnInfo.setAttribute('name', 'dndel');
+  dnInfo.setAttribute('value', dn);
+  newdiv.appendChild(dnInfo);
+
+  newdiv.style.display = 'none';
+  $('delmembers').appendChild(newdiv);
+
+  return newdiv
+}
+
+function removememberHandler(element, dn, info) {
+  var newdiv = removemember(dn, info);
+  new Effect.Fade(Element.up(element));
+  new Effect.Appear(newdiv);
+  /* Element.up(element).remove(); */
+}
+
+function preSubmit() {
+  var json = dn_to_info_hash.toJSON();
+  $('form_dn_to_info_json').value = json;
+  return true;
+}
diff -r ea4707434a51 -r 27fb698fd454 ipa-server/ipa-gui/ipagui/templates/dynamiceditsearch.kid
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/ipa-server/ipa-gui/ipagui/templates/dynamiceditsearch.kid	Fri Sep 28 11:55:56 2007 -0700
@@ -0,0 +1,79 @@
+<div xmlns:py="http://purl.org/kid/ns#">
+
+<?python
+from ipagui.helpers import ipahelper
+#
+# This file is used to render the results from an AJAX search onto a page.
+# It has many expectations of the page being rendered into:
+#   - Source page must have included dynamicedit.js and followed all of its
+#     requirements
+#
+?>
+    <div id="search-results-count">
+    </div>
+    <?python
+    criteria_esc = ipahelper.javascript_string_escape(criteria)
+    ?>
+    <script type="text/javascript">
+      search_string = "${criteria_esc}";
+      results_counter = 0;
+    </script>
+    <?python search_div_counter = 1 ?>
+    <div py:for="entities in (users, groups)">
+      <div py:if='(entities != None) and (len(entities) > 0)'>
+          <div py:for="entity in entities" id="search-${search_div_counter}">
+            <?python
+            ent_dn_esc = ipahelper.javascript_string_escape(entity.dn)
+            ent_uid = entity.uid
+            if ent_uid:
+                ent_name = "%s %s" % (entity.givenName, entity.sn)
+                ent_descr = "(%s)" % entity.uid
+                ent_type = "user"
+            else:
+                ent_name = entity.cn
+                ent_descr = "[group]"
+                ent_type = "group"
+            ent_name_esc = ipahelper.javascript_string_escape(ent_name)
+            ent_descr_esc = ipahelper.javascript_string_escape(ent_descr)
+            ent_type_esc = ipahelper.javascript_string_escape(ent_type)
+            ?>
+            <span id="search-info-${search_div_counter}"></span>
+            <script type="text/javascript">
+              if ((added_hash["${ent_dn_esc}"] == 1) ||
+                  (member_hash["${ent_dn_esc}"] == 1)) {
+                $("search-${search_div_counter}").style.display = 'none';
+              } else {
+                results_counter = results_counter + 1;
+              }
+
+              renderMemberInfo($('search-info-${search_div_counter}'),
+                           new MemberDisplayInfo('${ent_name_esc}',
+                                                 '${ent_descr_esc}',
+                                                 '${ent_type_esc}'));
+            </script>
+            <a href=""
+              onclick="addmemberHandler(this, '${ent_dn_esc}',
+                           new MemberDisplayInfo('${ent_name_esc}',
+                                                 '${ent_descr_esc}',
+                                                 '${ent_type_esc}'));
+                      return false;"
+            >add</a>
+            <?python
+            search_div_counter = search_div_counter + 1
+            ?>
+          </div>
+      </div>
+    </div>
+    <script type="text/javascript">
+      if (results_counter == 0) {
+        var message = "No results found for " + search_string;
+      } else {
+        var message =  results_counter + " results found:";
+      }
+      $('search-results-count').appendChild(document.createTextNode(message));
+    </script>
+    <script py:if="counter &lt; 0">
+      $('search-results-count').appendChild(document.createTextNode(
+        " (truncated)"));
+    </script>
+</div>
diff -r ea4707434a51 -r 27fb698fd454 ipa-server/ipa-gui/ipagui/templates/groupeditform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Fri Sep 28 09:59:04 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/groupeditform.kid	Fri Sep 28 11:55:56 2007 -0700
@@ -7,40 +7,12 @@ from ipagui.helpers import ipahelper
 from ipagui.helpers import ipahelper
 ?>
 
+  <script type="text/javascript" charset="utf-8"
+    src="${tg.url('/static/javascript/dynamicedit.js')}"></script>
 
   <?python searchurl = tg.url('/groupedit_search') ?>
 
   <script type="text/javascript">
-
-    // Stored as the values in the dn_to_info_hash
-    MemberDisplayInfo = Class.create();
-    MemberDisplayInfo.prototype = {
-      initialize: function(name, descr, type) {
-        this.name = name;
-        this.descr = descr;
-        this.type = type;
-      },
-    };
-
-
-    // this is used for round-trip recontruction of the names.
-    // the hidden fields only contain dns.
-    var dn_to_info_hash = new Hash();
-
-    // used to filter search results.
-    // records dns already in the group
-    var member_hash = new Hash();
-
-    // used to prevent double adding
-    // records dns to be added
-    var added_hash = new Hash();
-
-    // Tracks the div ids that each member belongs to.
-    // Since dn's will contain illegal characters for div ids, this is used
-    // to map them to the correct div
-    var dn_to_member_div_id = new Hash();
-
-
     function toggleProtectedFields(checkbox) {
       var gidnumberField = $('form_gidnumber');
       if (checkbox.checked) {
@@ -50,108 +22,6 @@ from ipagui.helpers import ipahelper
         gidnumberField.disabled = true;
         $('form_editprotected').value = '';
       }
-    }
-
-    /*
-     * Renders the information about the member into the passed in
-     * element.  This is used by addmember and removemember to
-     * consistently create the dom for the member information
-     * (name, descr) and add icons/font changes correct for each type.
-     */
-    function renderMemberInfo(newdiv, info) {
-      if (info.type == "user") {
-        newdiv.appendChild(document.createTextNode(
-          info.name.escapeHTML() + " " + info.descr.escapeHTML() + " "));
-      } else if (info.type == "group") {
-        ital = document.createElement('i');
-        ital.appendChild(document.createTextNode(
-          info.name.escapeHTML() + " " + 
-          info.descr.escapeHTML() + " "));
-        newdiv.appendChild(ital);
-      }
-    }
-
-    /*
-     * Callback used for afterFinish in scriptaculous effect
-     */
-    function removeElement(effect) {
-      Element.remove(effect.element);
-    }
-
-    function addmember(dn, info) {
-      dn_to_info_hash[dn] = info;
-
-      if ((added_hash[dn] == 1) || (member_hash[dn] == 1)) {
-        return null;
-      }
-      added_hash[dn] = 1;
-
-      var newdiv = document.createElement('div');
-      renderMemberInfo(newdiv, info);
-
-      var undolink = document.createElement('a');
-      undolink.setAttribute('href', '');
-      undolink.setAttribute('onclick',
-        'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' +
-        'added_hash.remove("' + jsStringEscape(dn) + '");' +
-        'return false;');
-      undolink.appendChild(document.createTextNode("undo"));
-      newdiv.appendChild(undolink);
-
-      var dnInfo = document.createElement('input');
-      dnInfo.setAttribute('type', 'hidden');
-      dnInfo.setAttribute('name', 'dnadd');
-      dnInfo.setAttribute('value', dn);
-      newdiv.appendChild(dnInfo);
-
-      newdiv.style.display = 'none';
-      $('newmembers').appendChild(newdiv);
-
-      return newdiv
-    }
-
-    function addmemberHandler(element, dn, info) {
-      var newdiv = addmember(dn, info)
-      if (newdiv != null) {
-        new Effect.Fade(Element.up(element));
-        new Effect.Appear(newdiv);
-        /* Element.up(element).remove(); */
-      }
-    }
-
-    function removemember(dn, info) {
-      dn_to_info_hash[dn] = info;
-
-      var newdiv = document.createElement('div');
-      renderMemberInfo(newdiv, info);
-
-      orig_div_id = dn_to_member_div_id[dn];
-      var undolink = document.createElement('a');
-      undolink.setAttribute('href', '');
-      undolink.setAttribute('onclick',
-        'new Effect.Fade(Element.up(this), {afterFinish: removeElement});' +
-        "new Effect.Appear($('" + orig_div_id + "'));" +
-        'return false;');
-      undolink.appendChild(document.createTextNode("undo"));
-      newdiv.appendChild(undolink);
-
-      var dnInfo = document.createElement('input');
-      dnInfo.setAttribute('type', 'hidden');
-      dnInfo.setAttribute('name', 'dndel');
-      dnInfo.setAttribute('value', dn);
-      newdiv.appendChild(dnInfo);
-
-      newdiv.style.display = 'none';
-      $('delmembers').appendChild(newdiv);
-
-      return newdiv
-    }
-
-    function removememberHandler(element, dn, info) {
-      var newdiv = removemember(dn, info);
-      new Effect.Fade(Element.up(element));
-      new Effect.Appear(newdiv);
-      /* Element.up(element).remove(); */
     }
 
     function enterDoSearch(e) {
@@ -177,12 +47,6 @@ from ipagui.helpers import ipahelper
              parameters: { criteria: $('criteria').value },
              evalScripts: true });
       return false;
-    }
-
-    function preSubmit() {
-      var json = dn_to_info_hash.toJSON();
-      $('form_dn_to_info_json').value = json;
-      return true;
     }
   </script>
 
diff -r ea4707434a51 -r 27fb698fd454 ipa-server/ipa-gui/ipagui/templates/groupeditsearch.kid
--- a/ipa-server/ipa-gui/ipagui/templates/groupeditsearch.kid	Fri Sep 28 09:59:04 2007 -0700
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,73 +0,0 @@
-<div xmlns:py="http://purl.org/kid/ns#">
-
-<?python
-from ipagui.helpers import ipahelper
-?>
-    <div id="search-results-count">
-    </div>
-    <?python
-    criteria_esc = ipahelper.javascript_string_escape(criteria)
-    ?>
-    <script type="text/javascript">
-      search_string = "${criteria_esc}";
-      results_counter = 0;
-    </script>
-    <?python search_div_counter = 1 ?>
-    <div py:for="entities in (users, groups)">
-      <div py:if='(entities != None) and (len(entities) > 0)'>
-          <div py:for="entity in entities" id="search-${search_div_counter}">
-            <?python
-            ent_dn_esc = ipahelper.javascript_string_escape(entity.dn)
-            ent_uid = entity.uid
-            if ent_uid:
-                ent_name = "%s %s" % (entity.givenName, entity.sn)
-                ent_descr = "(%s)" % entity.uid
-                ent_type = "user"
-            else:
-                ent_name = entity.cn
-                ent_descr = "[group]"
-                ent_type = "group"
-            ent_name_esc = ipahelper.javascript_string_escape(ent_name)
-            ent_descr_esc = ipahelper.javascript_string_escape(ent_descr)
-            ent_type_esc = ipahelper.javascript_string_escape(ent_type)
-            ?>
-            <span id="search-info-${search_div_counter}"></span>
-            <script type="text/javascript">
-              if ((added_hash["${ent_dn_esc}"] == 1) ||
-                  (member_hash["${ent_dn_esc}"] == 1)) {
-                $("search-${search_div_counter}").style.display = 'none';
-              } else {
-                results_counter = results_counter + 1;
-              }
-
-              renderMemberInfo($('search-info-${search_div_counter}'),
-                           new MemberDisplayInfo('${ent_name_esc}',
-                                                 '${ent_descr_esc}',
-                                                 '${ent_type_esc}'));
-            </script>
-            <a href=""
-              onclick="addmemberHandler(this, '${ent_dn_esc}',
-                           new MemberDisplayInfo('${ent_name_esc}',
-                                                 '${ent_descr_esc}',
-                                                 '${ent_type_esc}'));
-                      return false;"
-            >add</a>
-            <?python
-            search_div_counter = search_div_counter + 1
-            ?>
-          </div>
-      </div>
-    </div>
-    <script type="text/javascript">
-      if (results_counter == 0) {
-        var message = "No results found for " + search_string;
-      } else {
-        var message =  results_counter + " results found:";
-      }
-      $('search-results-count').appendChild(document.createTextNode(message));
-    </script>
-    <script py:if="counter &lt; 0">
-      $('search-results-count').appendChild(document.createTextNode(
-        " (truncated)"));
-    </script>
-</div>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070928/89d6c7a5/attachment.bin>

From rcritten at redhat.com  Fri Sep 28 20:38:39 2007
From: rcritten at redhat.com (Rob Crittenden)
Date: Fri, 28 Sep 2007 16:38:39 -0400
Subject: [Freeipa-devel] new PyKerberos with delegation
Message-ID: <46FD664F.5080701@redhat.com>

I fixed this way back at the end of August and never sent it out...

The first PyKerberos I built didn't set the GSS_C_DELEG_FLAG flag so 
wouldn't do ticket forwarding. This one adds a patch that sets it.

If you're having problems with the IPA command-line tools try this out.

rob
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PyKerberos-0.1735-2.fc7.src.rpm
Type: application/x-redhat-package-manager
Size: 43812 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070928/dd32679e/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070928/dd32679e/attachment-0001.bin>

From kmacmill at redhat.com  Fri Sep 28 20:46:40 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 28 Sep 2007 16:46:40 -0400
Subject: [Freeipa-devel] [PATCH] Make apache work with selinux
In-Reply-To: <6e5bd8def3659ba1dae9.1190747448@localhost.localdomain>
References: <6e5bd8def3659ba1dae9.1190747448@localhost.localdomain>
Message-ID: <1191012400.12112.48.camel@laptop.local>

On Tue, 2007-09-25 at 15:10 -0400, Karl MacMillan wrote:
> The default configuration of the apache selinux policy doesn't allow
> apache to connect to the turbogears gui. This sets the correct
> boolean to allow that connection.
> 
> Signed-off-by: User "Karl MacMillan <kmacmill at redhat.com>"

Pushed.

Karl



From kmacmill at redhat.com  Fri Sep 28 20:47:12 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 28 Sep 2007 16:47:12 -0400
Subject: [Freeipa-devel] [PATCH] Install the web gui
In-Reply-To: <1190920191.3197.5.camel@localhost.localdomain>
References: <714c69eb34b96afa79fe.1190918654@localhost.localdomain>
	<20070927185436.GE16797@moon.usersys.redhat.com>
	<1190919831.3197.3.camel@localhost.localdomain>
	<1190920191.3197.5.camel@localhost.localdomain>
Message-ID: <1191012432.12112.50.camel@laptop.local>

On Thu, 2007-09-27 at 15:09 -0400, Karl MacMillan wrote:
> On Thu, 2007-09-27 at 15:03 -0400, Karl MacMillan wrote:
> > On Thu, 2007-09-27 at 11:54 -0700, Kevin McCarthy wrote:
> > > Karl MacMillan wrote:
> > > > Install the turbogears web gui including an init script. This
> > > > patch includes a few related changes:
> > > > 
> > > > * create a production configuration
> > > > * rename the web gui startup scrip to ipa-webgui
> > > > * add an init script
> > > > * chkconfig on the ipa-webgui init script
> > > > * make the start script properly daemonize the app when not
> > > >   in a development directory.
> > > > * Install everything to the correct places (/usr/sbin/ipa-webgui
> > > >   and /usr/share/ipa/ipagui mainly).
> > > > 
> > > > There are some things still left to do:
> > > > 
> > > > * Sort out the logging - the config needs to be adjusted so
> > > >   that logging messages end up in /var/log.
> > > 
> > > 
> > > Can we keep start-ipa.py for now, or at least have some kind of
> > > back-door startup to run in a local dir?
> > > 
> > > It makes it much faster to develop the gui if I can run it from my
> > > directory.  :-/
> > > 
> > 
> > ipa-webgui does that for you - it loads dev.cfg and doesn't daemonize.
> > 
> 
> Or it does with this very slightly updated patch :)
> _______________________________________________

Updated patch pushed.

Karl



From kmacmill at redhat.com  Fri Sep 28 20:51:17 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 28 Sep 2007 16:51:17 -0400
Subject: [Freeipa-devel] [PATCH] change groupedit to perform operations
	on dn's for users
In-Reply-To: <20070927183417.GD16797@moon.usersys.redhat.com>
References: <20070927183417.GD16797@moon.usersys.redhat.com>
Message-ID: <1191012677.12112.52.camel@laptop.local>

On Thu, 2007-09-27 at 11:34 -0700, Kevin McCarthy wrote:
> This patch changes the groupedit.kid page to manipulate users using
> their dns.  It adds proper escaping to the dynamically generated
> javascript strings (at the python -> javascript) boundary don't fail if
> they python variable contains a ' or "
> 
> Previously, the uids were being translated into dns using a search.  Now
> the dns come directly from TG, so need to be translated into utf-8.
> 
> Next step is changing the page to work with groups too.
> 

Pushed.

Karl



From kmacmill at redhat.com  Fri Sep 28 20:51:54 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 28 Sep 2007 16:51:54 -0400
Subject: [Freeipa-devel] [PATCH] timelimit parameters
In-Reply-To: <20070927224618.GH16797@moon.usersys.redhat.com>
References: <20070927224618.GH16797@moon.usersys.redhat.com>
Message-ID: <1191012714.12112.54.camel@laptop.local>

On Thu, 2007-09-27 at 15:46 -0700, Kevin McCarthy wrote:
> Make timelimit a parameter in the find methods.
> 

Pushed.

Karl



From kmacmill at redhat.com  Fri Sep 28 20:52:25 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 28 Sep 2007 16:52:25 -0400
Subject: [Freeipa-devel] [PATCH] add missing filters
In-Reply-To: <20070927230729.GI16797@moon.usersys.redhat.com>
References: <20070927230729.GI16797@moon.usersys.redhat.com>
Message-ID: <1191012745.12112.56.camel@laptop.local>

On Thu, 2007-09-27 at 16:07 -0700, Kevin McCarthy wrote:
> I added a couple methods earlier, but neglected to safe_filter the
> filters.  This patch fixes that omission.
> 

Pushed.



From kmacmill at redhat.com  Fri Sep 28 20:57:23 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 28 Sep 2007 16:57:23 -0400
Subject: [Freeipa-devel] Milestone 4 almost done
Message-ID: <1191013043.12112.60.camel@laptop.local>

I'm planning on pushing out a milestone 4 release on Monday after doing
some testing. Other than some pending patches from Kevin, anything else
need to be merged for this release?

Karl



From kmacmill at redhat.com  Fri Sep 28 21:02:22 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 28 Sep 2007 17:02:22 -0400
Subject: [Freeipa-devel] [PATCH] edit nested groups
In-Reply-To: <20070927215535.GG16797@moon.usersys.redhat.com>
References: <20070927215535.GG16797@moon.usersys.redhat.com>
Message-ID: <1191013342.12112.62.camel@laptop.local>

On Thu, 2007-09-27 at 14:55 -0700, Kevin McCarthy wrote:
> This patch adds nested groups support to the UI.  'nough said.  :-)
> 
> Depends on freeipa-221-groupedit_use_dns.patch
> 

Pushed.



From kmacmill at redhat.com  Fri Sep 28 21:08:32 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 28 Sep 2007 17:08:32 -0400
Subject: [Freeipa-devel] [PATCH] refactor for better group member rendering
In-Reply-To: <20070928155848.GA10276@moon.usersys.redhat.com>
References: <20070928155848.GA10276@moon.usersys.redhat.com>
Message-ID: <1191013712.12112.64.camel@laptop.local>

On Fri, 2007-09-28 at 08:58 -0700, Kevin McCarthy wrote:
> This patch improves the group member rendering code, so group members
> and be displayed differently from user members.
> 
> Depends on the patches:
> freeipa-221-groupedit_use_dns.patch
> freeipa-222-nestedgroups.patch
> freeipa-224-missing_filters.patch

pushed.



From kmacmill at redhat.com  Fri Sep 28 21:08:45 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 28 Sep 2007 17:08:45 -0400
Subject: [Freeipa-devel] [PATCH] sort group members
In-Reply-To: <20070928165945.GB10276@moon.usersys.redhat.com>
References: <20070928165945.GB10276@moon.usersys.redhat.com>
Message-ID: <1191013725.12112.66.camel@laptop.local>

On Fri, 2007-09-28 at 09:59 -0700, Kevin McCarthy wrote:
> Sort the group members for the group show and edit pages.
> 

pushed.



From kmacmill at redhat.com  Fri Sep 28 21:08:57 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Fri, 28 Sep 2007 17:08:57 -0400
Subject: [Freeipa-devel] [PATCH] extract shared dyamic edit code
In-Reply-To: <20070928185858.GC10276@moon.usersys.redhat.com>
References: <20070928185858.GC10276@moon.usersys.redhat.com>
Message-ID: <1191013737.12112.68.camel@laptop.local>

On Fri, 2007-09-28 at 11:58 -0700, Kevin McCarthy wrote:
> No new code here, just extracting shared code so I can use it on the
> useredit page too.
> 
> Depends on:
> freeipa-221-groupedit_use_dns.patch
> freeipa-222-nestedgroups.patch
> freeipa-225-editgroupui.patch
> freeipa-226-groupmember_sorting.patch
> 

pushed.



From ssorce at redhat.com  Fri Sep 28 23:05:24 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Fri, 28 Sep 2007 19:05:24 -0400
Subject: [Freeipa-devel] [PATCH] IPv6 support for ipa-kpasswd
Message-ID: <1191020724.3476.44.camel@hopeson>

After listen to a talk yesterday I thought it was going to be easy (and
necessary) to convert ipa-kpasswd to IPV6.
It was indeed easy, this night I coded up this patch which I just tested
and seem to work fine.

Simo.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-221-kpasswd-ipv6.patch
Type: text/x-patch
Size: 4469 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070928/3070847f/attachment.bin>

From kmccarth at redhat.com  Fri Sep 28 23:46:32 2007
From: kmccarth at redhat.com (Kevin McCarthy)
Date: Fri, 28 Sep 2007 16:46:32 -0700
Subject: [Freeipa-devel] [PATCH] add group mgmt to useredit page
Message-ID: <20070928234632.GD10276@moon.usersys.redhat.com>

This patch adds group management to the user edit page.  This allows you
to manage "the groups a user is in" in the same way as you manage "the
users/groups in a group".

It's pushed to demo, so feel free to take a peek.

Still need to add this to the usernew page.

-Kevin

-------------- next part --------------
# HG changeset patch
# User Kevin McCarthy <kmccarth at redhat.com>
# Date 1191020502 25200
# Node ID 0a3bb27f723b0d70253613460b0d266aa1acb36a
# Parent  2a638a7907c4ec9c5b2727ffc2ac787ec4960b01
Add group management to the user edit page.
Added a couple more API calls to make the inverse operations easier.

diff -r 2a638a7907c4 -r 0a3bb27f723b ipa-python/ipaclient.py
--- a/ipa-python/ipaclient.py	Fri Sep 28 14:29:12 2007 -0700
+++ b/ipa-python/ipaclient.py	Fri Sep 28 16:01:42 2007 -0700
@@ -266,6 +266,21 @@ class IPAClient:
 
         return self.transport.remove_users_from_group(user_uids, group_cn)
 
+    def add_groups_to_user(self, group_dns, user_dn):
+        """Given a list of group dn's add them to the user.
+
+           Returns a list of the group dns that were not added.
+        """
+        return self.transport.add_groups_to_user(group_dns, user_dn)
+
+    def remove_groups_from_user(self, group_dns, user_dn):
+        """Given a list of group dn's remove them from the user.
+
+           Returns a list of the group dns that were not removed.
+        """
+
+        return self.transport.remove_groups_from_user(group_dns, user_dn)
+
     def update_group(self,group):
         """Update a group entry."""
 
diff -r 2a638a7907c4 -r 0a3bb27f723b ipa-python/rpcclient.py
--- a/ipa-python/rpcclient.py	Fri Sep 28 14:29:12 2007 -0700
+++ b/ipa-python/rpcclient.py	Fri Sep 28 16:01:42 2007 -0700
@@ -441,6 +441,36 @@ class RPCClient:
     
         return ipautil.unwrap_binary_data(result)
 
+    def add_groups_to_user(self, group_dns, user_dn):
+        """Given a list of group dn's add them to the user.
+
+           Returns a list of the group dns that were not added.
+        """
+        server = self.setup_server()
+        try:
+            result = server.add_groups_to_user(group_dns, user_dn)
+        except xmlrpclib.Fault, fault:
+            raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
+        except socket.error, (value, msg):
+            raise xmlrpclib.Fault(value, msg)
+
+        return ipautil.unwrap_binary_data(result)
+
+    def remove_groups_from_user(self, group_dns, user_dn):
+        """Given a list of group dn's remove them from the user.
+
+           Returns a list of the group dns that were not removed.
+        """
+        server = self.setup_server()
+        try:
+            result = server.remove_groups_from_user(group_dns, user_dn)
+        except xmlrpclib.Fault, fault:
+            raise ipaerror.gen_exception(fault.faultCode, fault.faultString)
+        except socket.error, (value, msg):
+            raise xmlrpclib.Fault(value, msg)
+
+        return ipautil.unwrap_binary_data(result)
+
     def update_group(self,oldgroup,newgroup):
         """Update an existing group. oldgroup and newgroup are dicts of attributes"""
         server = self.setup_server()
diff -r 2a638a7907c4 -r 0a3bb27f723b ipa-server/ipa-gui/ipagui/controllers.py
--- a/ipa-server/ipa-gui/ipagui/controllers.py	Fri Sep 28 14:29:12 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/controllers.py	Fri Sep 28 16:01:42 2007 -0700
@@ -79,6 +79,15 @@ def sort_group_member(a, b):
         else:
             return 1
 
+def sort_by_cn(a, b):
+    """Comparator function used for sorting groups."""
+    if a.get('cn', '') == b.get('cn', ''):
+        return 0
+    elif a.get('cn', '') < b.get('cn', ''):
+        return -1
+    else:
+        return 1
+
 class Root(controllers.RootController):
 
     @expose(template="ipagui.templates.welcome")
@@ -144,6 +153,28 @@ class Root(controllers.RootController):
             turbogears.flash("User add failed: " + str(e))
             return dict(form=user_new_form, tg_template='ipagui.templates.usernew')
 
+    @expose("ipagui.templates.dynamiceditsearch")
+    @identity.require(identity.not_anonymous())
+    def useredit_search(self, **kw):
+        """Searches for groups and displays list of results in a table.
+           This method is used for the ajax search on the user edit page."""
+        client.set_krbccache(os.environ["KRB5CCNAME"])
+        groups = []
+        counter = 0
+        searchlimit = 100
+        criteria = kw.get('criteria')
+        if criteria != None and len(criteria) > 0:
+            try:
+                groups = client.find_groups(criteria.encode('utf-8'), None,
+                        searchlimit)
+                groups_counter = groups[0]
+                groups = groups[1:]
+            except ipaerror.IPAError, e:
+                turbogears.flash("search failed: " + str(e))
+
+        return dict(users=None, groups=groups, criteria=criteria,
+                counter=groups_counter)
+
 
     @expose("ipagui.templates.useredit")
     @identity.require(identity.not_anonymous())
@@ -152,18 +183,26 @@ class Root(controllers.RootController):
         if tg_errors:
             turbogears.flash("There was a problem with the form!")
 
-        try:
-            client.set_krbccache(os.environ["KRB5CCNAME"])
+        client.set_krbccache(os.environ["KRB5CCNAME"])
+        try:
             user = client.get_user_by_uid(uid, user_fields)
             user_dict = user.toDict()
             # Edit shouldn't fill in the password field.
             if user_dict.has_key('userpassword'):
                 del(user_dict['userpassword'])
 
+            user_groups = client.get_groups_by_member(user.dn, ['dn', 'cn'])
+            user_groups_dicts = map(lambda group: group.toDict(), user_groups)
+            user_groups_dicts.sort(sort_by_cn)
+            user_groups_data = b64encode(dumps(user_groups_dicts))
+
             # store a copy of the original user for the update later
             user_data = b64encode(dumps(user_dict))
             user_dict['user_orig'] = user_data
-            return dict(form=user_edit_form, user=user_dict)
+            user_dict['user_groups_data'] = user_groups_data
+
+            return dict(form=user_edit_form, user=user_dict,
+                    user_groups=user_groups_dicts)
         except ipaerror.IPAError, e:
             turbogears.flash("User edit failed: " + str(e))
             raise turbogears.redirect('/usershow', uid=kw.get('uid'))
@@ -178,12 +217,20 @@ class Root(controllers.RootController):
             turbogears.flash("Edit user cancelled")
             raise turbogears.redirect('/usershow', uid=kw.get('uid'))
 
+        # Decode the group data, in case we need to round trip
+        user_groups_dicts = loads(b64decode(kw.get('user_groups_data')))
+
         tg_errors, kw = self.userupdatevalidate(**kw)
         if tg_errors:
             return dict(form=user_edit_form, user=kw,
+                        user_groups=user_groups_dicts,
                         tg_template='ipagui.templates.useredit')
 
         password_change = False
+
+        #
+        # Update the user itself
+        #
         try:
             orig_user_dict = loads(b64decode(kw.get('user_orig')))
 
@@ -210,22 +257,77 @@ class Root(controllers.RootController):
                                       new_user.getValue('sn')))
 
             rv = client.update_user(new_user)
+            #
+            # If the user update succeeds, but below operations fail, we
+            # need to make sure a subsequent submit doesn't try to update
+            # the user again.
+            #
+            kw['user_orig'] = b64encode(dumps(new_user.toDict()))
         except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST), e:
-            if not password_change:
-                turbogears.flash("User update failed: " + str(e))
-                return dict(form=user_edit_form, user=kw,
-                            tg_template='ipagui.templates.useredit')
+            # could be a password change
+            # could be groups change
+            # too much work to figure out unless someone really screams
+            pass
         except ipaerror.IPAError, e:
             turbogears.flash("User update failed: " + str(e))
             return dict(form=user_edit_form, user=kw,
+                        user_groups=user_groups_dicts,
                         tg_template='ipagui.templates.useredit')
 
+        #
+        # Password change
+        #
         try:
             if password_change:
                 rv = client.modifyPassword(kw['uid'], "", kw.get('userpassword'))
         except ipaerror.IPAError, e:
             turbogears.flash("User password change failed: " + str(e))
             return dict(form=user_edit_form, user=kw,
+                        user_groups=user_groups_dicts,
+                        tg_template='ipagui.templates.useredit')
+
+        #
+        # Add groups
+        #
+        failed_adds = []
+        try:
+            dnadds = kw.get('dnadd')
+            if dnadds != None:
+                if not(isinstance(dnadds,list) or isinstance(dnadds,tuple)):
+                    dnadds = [dnadds]
+                failed_adds = client.add_groups_to_user(
+                        utf8_encode_values(dnadds), new_user.dn)
+                kw['dnadd'] = failed_adds
+        except ipaerror.IPAError, e:
+            turbogears.flash("Group update failed: " + str(e))
+            return dict(form=user_edit_form, user=kw,
+                        user_groups=user_groups_dicts,
+                        tg_template='ipagui.templates.useredit')
+
+        #
+        # Remove groups
+        #
+        failed_dels = []
+        try:
+            dndels = kw.get('dndel')
+            if dndels != None:
+                if not(isinstance(dndels,list) or isinstance(dndels,tuple)):
+                    dndels = [dndels]
+                failed_dels = client.remove_groups_from_user(
+                        utf8_encode_values(dndels), new_user.dn)
+                kw['dndel'] = failed_dels
+        except ipaerror.IPAError, e:
+            turbogears.flash("Group update failed: " + str(e))
+            return dict(form=user_edit_form, user=kw,
+                        user_groups=user_groups_dicts,
+                        tg_template='ipagui.templates.useredit')
+
+        if (len(failed_adds) > 0) or (len(failed_dels) > 0):
+            message = "There was an error updating groups.<br />"
+            message += "Failures have been preserved in the add/remove lists."
+            turbogears.flash(message)
+            return dict(form=user_edit_form, user=kw,
+                        user_groups=user_groups_dicts,
                         tg_template='ipagui.templates.useredit')
 
         turbogears.flash("%s updated!" % kw['uid'])
diff -r 2a638a7907c4 -r 0a3bb27f723b ipa-server/ipa-gui/ipagui/forms/user.py
--- a/ipa-server/ipa-gui/ipagui/forms/user.py	Fri Sep 28 14:29:12 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/forms/user.py	Fri Sep 28 16:01:42 2007 -0700
@@ -24,6 +24,8 @@ class UserFields():
     editprotected_hidden = widgets.HiddenField(name="editprotected")
 
     user_orig = widgets.HiddenField(name="user_orig")
+    user_groups_data = widgets.HiddenField(name="user_groups_data")
+    dn_to_info_json = widgets.HiddenField(name="dn_to_info_json")
 
 class UserNewValidator(validators.Schema):
     uid = validators.PlainText(not_empty=True)
@@ -88,6 +90,8 @@ class UserEditForm(widgets.Form):
               UserFields.uidnumber, UserFields.gidnumber,
               UserFields.krbPasswordExpiration_hidden,
               UserFields.editprotected_hidden,
+              UserFields.user_groups_data,
+              UserFields.dn_to_info_json,
               ]
 
     validator = UserEditValidator()
diff -r 2a638a7907c4 -r 0a3bb27f723b ipa-server/ipa-gui/ipagui/templates/useredit.kid
--- a/ipa-server/ipa-gui/ipagui/templates/useredit.kid	Fri Sep 28 14:29:12 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/useredit.kid	Fri Sep 28 16:01:42 2007 -0700
@@ -35,6 +35,6 @@ else:
         Password has expired
     </div>
 
-     ${form.display(action="userupdate", value=user)}
+     ${form.display(action="userupdate", value=user, user_groups=user_groups)}
 </body>
 </html>
diff -r 2a638a7907c4 -r 0a3bb27f723b ipa-server/ipa-gui/ipagui/templates/usereditform.kid
--- a/ipa-server/ipa-gui/ipagui/templates/usereditform.kid	Fri Sep 28 14:29:12 2007 -0700
+++ b/ipa-server/ipa-gui/ipagui/templates/usereditform.kid	Fri Sep 28 16:01:42 2007 -0700
@@ -1,6 +1,16 @@
 <div xmlns:py="http://purl.org/kid/ns#"
   class="simpleroster">
-  <form action="${action}" name="${name}" method="${method}" class="tableform">
+  <form action="${action}" name="${name}" method="${method}" class="tableform"
+    onsubmit="preSubmit()">
+
+<?python
+from ipagui.helpers import ipahelper
+?>
+
+  <script type="text/javascript" charset="utf-8"
+    src="${tg.url('/static/javascript/dynamicedit.js')}"></script>
+
+  <?python searchurl = tg.url('/useredit_search') ?>
 
   <script type="text/javascript">
     function toggleProtectedFields(checkbox) {
@@ -22,6 +32,40 @@
         $('form_editprotected').value = '';
       }
     }
+
+    function enterDoSearch(e) {
+      var keyPressed;
+      if (window.event) {
+        keyPressed = window.event.keyCode;
+      } else {
+        keyPressed = e.which; 
+      }
+
+      if (keyPressed == 13) {
+        return doSearch();
+      } else {
+        return true;
+      }
+    }
+
+    function doSearch() {
+      $('searchresults').update("Searching...");
+      new Ajax.Updater('searchresults',
+          '${searchurl}',
+          {  asynchronous:true,
+             parameters: { criteria: $('criteria').value },
+             evalScripts: true });
+      return false;
+    }
+
+    // override dynamicedit.js version
+    // we don't need to show [group] nor italize groups
+    function renderMemberInfo(newdiv, info) {
+      if (info.type == "group") {
+        newdiv.appendChild(document.createTextNode(
+          info.name.escapeHTML() + " "));
+      }
+    }
   </script>
 
 
@@ -213,6 +257,81 @@
       </tr>
     </table>
 
+    <div>
+      <div class="formsection">Groups</div>
+
+      <div class="floatlist">
+        <div class="floatheader">To Remove:</div>
+        <div id="delmembers">
+        </div>
+      </div>
+
+      <div>
+        <?python div_counter = 1 ?>
+        <div py:for="group in user_groups" id="member-${div_counter}">
+          <?python
+          group_dn = group.get('dn')
+          group_dn_esc = ipahelper.javascript_string_escape(group_dn)
+
+          group_name = group.get('cn')
+          group_descr = "[group]"
+          group_type = "group"
+
+          group_name_esc = ipahelper.javascript_string_escape(group_name)
+          group_descr_esc = ipahelper.javascript_string_escape(group_descr)
+          group_type_esc = ipahelper.javascript_string_escape(group_type)
+          ?>
+          <span id="member-info-${div_counter}"></span>
+          <script type="text/javascript">
+            renderMemberInfo($('member-info-${div_counter}'),
+                         new MemberDisplayInfo('${group_name_esc}',
+                                               '${group_descr_esc}',
+                                               '${group_type_esc}'));
+          </script>
+          <a href="#" 
+            onclick="removememberHandler(this, '${group_dn_esc}',
+                         new MemberDisplayInfo('${group_name_esc}',
+                                               '${group_descr_esc}',
+                                               '${group_type_esc}'));
+                     return false;"
+          >remove</a>
+          <script type="text/javascript">
+            dn_to_member_div_id['${group_dn_esc}'] = "member-${div_counter}";
+            member_hash["${group_dn_esc}"] = 1;
+          </script>
+          <?python
+          div_counter = div_counter + 1
+          ?>
+        </div>
+      </div>
+
+    </div>
+
+    <div style="clear:both">
+      <div class="formsection">Add Groups</div>
+
+      <div class="floatlist">
+        <div class="floatheader">To Add:</div>
+        <div id="newmembers">
+        </div>
+      </div>
+
+      <div>
+        <div id="search">
+          <input id="criteria" type="text" name="criteria"
+            onkeypress="return enterDoSearch(event);" />
+          <input type="button" value="Find"
+            onclick="return doSearch();"
+          />
+        </div>
+        <div id="searchresults">
+        </div>
+      </div>
+    </div>
+
+
+
+
     <table class="formtable" cellpadding="2" cellspacing="0" border="0">
       <tr>
         <th>
@@ -232,9 +351,52 @@
   </form>
 
   <script type="text/javascript">
+    /*
+     * This section restores the contents of the add and remove lists
+     * dynamically if we have to refresh the page
+     */
+    if ($('form_dn_to_info_json').value != "") {
+      dn_to_info_hash = new Hash($('form_dn_to_info_json').value.evalJSON());
+    }
+
     if ($('form_editprotected').value != "") {
       $('toggleprotected_checkbox').checked = true;
       toggleProtectedFields($('toggleprotected_checkbox'));
     }
   </script>
+
+  <?python
+  dnadds = value.get('dnadd', [])
+  if not(isinstance(dnadds,list) or isinstance(dnadds,tuple)):
+      dnadds = [dnadds]
+
+  dndels = value.get('dndel', [])
+  if not(isinstance(dndels,list) or isinstance(dndels,tuple)):
+      dndels = [dndels]
+  ?>
+
+  <script py:for="dnadd in dnadds">
+    <?python
+    dnadd_esc = ipahelper.javascript_string_escape(dnadd)
+    ?>
+    var dn = "${dnadd_esc}";
+    var info = dn_to_info_hash[dn];
+    var newdiv = addmember(dn, info);
+    if (newdiv != null) {
+      newdiv.style.display = 'block';
+    }
+  </script>
+
+  <script py:for="dndel in dndels">
+    <?python
+    dndel_esc = ipahelper.javascript_string_escape(dndel)
+    ?>
+    var dn = "${dndel_esc}";
+    var info = dn_to_info_hash[dn];
+    var newdiv = removemember(dn, info);
+    newdiv.style.display = 'block';
+    orig_div_id = dn_to_member_div_id[dn]
+    $(orig_div_id).style.display = 'none';
+  </script>
+
 </div>
diff -r 2a638a7907c4 -r 0a3bb27f723b ipa-server/xmlrpc-server/funcs.py
--- a/ipa-server/xmlrpc-server/funcs.py	Fri Sep 28 14:29:12 2007 -0700
+++ b/ipa-server/xmlrpc-server/funcs.py	Fri Sep 28 16:01:42 2007 -0700
@@ -899,6 +899,56 @@ class IPAServer:
 
         return failed
 
+    def add_groups_to_user(self, group_dns, user_dn, opts=None):
+        """Given a list of group dn's add them to the user.
+
+           Returns a list of the group dns that were not added.
+        """
+
+        failed = []
+
+        if (isinstance(group_dns, str)):
+            group_dns = [group_dns]
+
+        for group_dn in group_dns:
+            # TODO - change add_member_to_group to take a group_dn
+            try:
+                group = self.get_group_by_dn(group_dn, ['cn'], opts)
+                self.add_member_to_group(user_dn, group.get('cn'), opts)
+            except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST):
+                # User is already in the group
+                failed.append(group_dn)
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
+                # User or the group does not exist
+                failed.append(group_dn)
+
+        return failed
+
+    def remove_groups_from_user(self, group_dns, user_dn, opts=None):
+        """Given a list of group dn's remove them from the user.
+
+           Returns a list of the group dns that were not removed.
+        """
+
+        failed = []
+
+        if (isinstance(group_dns, str)):
+            group_dns = [group_dns]
+
+        for group_dn in group_dns:
+            # TODO - change remove_member_from_group to take a group_dn
+            try:
+                group = self.get_group_by_dn(group_dn, ['cn'], opts)
+                self.remove_member_from_group(user_dn, group.get('cn'), opts)
+            except ipaerror.exception_for(ipaerror.LDAP_EMPTY_MODLIST):
+                # User is not in the group
+                failed.append(group_dn)
+            except ipaerror.exception_for(ipaerror.LDAP_NOT_FOUND):
+                # User or the group does not exist
+                failed.append(group_dn)
+
+        return failed
+
     def update_group (self, oldgroup, newgroup, opts=None):
         """Update a group in LDAP"""
         return self.__update_entry(oldgroup, newgroup, opts)
diff -r 2a638a7907c4 -r 0a3bb27f723b ipa-server/xmlrpc-server/ipaxmlrpc.py
--- a/ipa-server/xmlrpc-server/ipaxmlrpc.py	Fri Sep 28 14:29:12 2007 -0700
+++ b/ipa-server/xmlrpc-server/ipaxmlrpc.py	Fri Sep 28 16:01:42 2007 -0700
@@ -339,6 +339,8 @@ def handler(req, profiling=False):
             h.register_function(f.add_group_to_group)
             h.register_function(f.remove_user_from_group)
             h.register_function(f.remove_users_from_group)
+            h.register_function(f.add_groups_to_user)
+            h.register_function(f.remove_groups_from_user)
             h.register_function(f.update_group)
             h.register_function(f.delete_group)
             h.handle_request(req)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4054 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070928/6ac3efd0/attachment.bin>

From ssorce at redhat.com  Sun Sep 30 17:28:22 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Sun, 30 Sep 2007 13:28:22 -0400
Subject: [Freeipa-devel] Milestone 4 almost done
In-Reply-To: <1191013043.12112.60.camel@laptop.local>
References: <1191013043.12112.60.camel@laptop.local>
Message-ID: <1191173302.3284.3.camel@localhost.localdomain>

On Fri, 2007-09-28 at 16:57 -0400, Karl MacMillan wrote:
> I'm planning on pushing out a milestone 4 release on Monday after doing
> some testing. Other than some pending patches from Kevin, anything else
> need to be merged for this release?

I am still having problems with apache and kerberos

My debugging on the plane turns out to show that a call to the kerberos
library tells back that I have no delegated credentials (but klist shows
the ticket is forwardable).

It would be nice to understand if it is something in my environment that
is wrong or if there is a more general problem and what causes it.

On Monday I hope to have the time to install an F-7 from scratch and see
if I can install and make it working.

Another problem we have and that we ditched so far is installing on
dirty systems. So far we thought we should not support it because we
install on clean systems. Yesterday (always on the plane) I found out
why we are wrong: I hit ctrl-c in the middle of the installation.
Rerunning ipa-server-install didn't work. This is not acceptable IMO.
Not sure if this should impact at all Milestone 4, comments are welcome.

Simo.



From ssorce at redhat.com  Sun Sep 30 20:50:07 2007
From: ssorce at redhat.com (Simo Sorce)
Date: Sun, 30 Sep 2007 16:50:07 -0400
Subject: [Freeipa-devel] [PATCH] do not allow empty passwords
Message-ID: <1191185407.4736.0.camel@hopeson>

see $SUBJECT :)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: freeipa-222-no-empty-pwds.patch
Type: text/x-patch
Size: 2029 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20070930/f5a82493/attachment.bin>

From kmacmill at redhat.com  Sun Sep 30 22:15:49 2007
From: kmacmill at redhat.com (Karl MacMillan)
Date: Sun, 30 Sep 2007 18:15:49 -0400
Subject: [Freeipa-devel] Milestone 4 almost done
In-Reply-To: <1191173302.3284.3.camel@localhost.localdomain>
References: <1191013043.12112.60.camel@laptop.local>
	<1191173302.3284.3.camel@localhost.localdomain>
Message-ID: <1191190549.28109.4.camel@laptop.local>

On Sun, 2007-09-30 at 13:28 -0400, Simo Sorce wrote:
> On Fri, 2007-09-28 at 16:57 -0400, Karl MacMillan wrote:
> > I'm planning on pushing out a milestone 4 release on Monday after doing
> > some testing. Other than some pending patches from Kevin, anything else
> > need to be merged for this release?
> 
> I am still having problems with apache and kerberos
> 
> My debugging on the plane turns out to show that a call to the kerberos
> library tells back that I have no delegated credentials (but klist shows
> the ticket is forwardable).
> 
> It would be nice to understand if it is something in my environment that
> is wrong or if there is a more general problem and what causes it.
> 
> On Monday I hope to have the time to install an F-7 from scratch and see
> if I can install and make it working.
> 

Have you upgraded your mod_auth_kerb and installed the new PyKerberos
that Rob posted Fri? That (and setting my hostname correctly) fixed all
of my problems.

It would be great if you could test everything on Mon. and let me know
if it works. If it does that would mean that at least 3 of us have
everything working - which would count as well tested at this point :)

> Another problem we have and that we ditched so far is installing on
> dirty systems. So far we thought we should not support it because we
> install on clean systems. Yesterday (always on the plane) I found out
> why we are wrong: I hit ctrl-c in the middle of the installation.
> Rerunning ipa-server-install didn't work. This is not acceptable IMO.
> Not sure if this should impact at all Milestone 4, comments are welcome.
> 

The only thing I have to do to reinstall is:

a) stop all of the ipa components
b) delete the dirsrv instance

Does that match your experience? We could automate that, but I hesitate
to delete data. Maybe offer to move aside the dirsrv instance data? Also
- do we _really_ need the guid naming for the dirsrv instance. It is
really a pain and I'm not convinced that we need uniqueness like that.

Also - do we need a convenient way to start/stop all of the IPA related
daemons?

Regardless, let's put some solution on the list of things to do, but not
delay milestone 4.

Karl