[Freeipa-devel] [PATCH] 0159-0162 ID views in compat tree: ACIs, support for shell, gidNumber, and SSH keys
Alexander Bokovoy
abokovoy at redhat.com
Fri Oct 10 14:38:18 UTC 2014
On Fri, 10 Oct 2014, Petr Vobornik wrote:
> On 10.10.2014 15:36, Alexander Bokovoy wrote:
>> On Fri, 10 Oct 2014, Petr Vobornik wrote:
>>> On 10.10.2014 10:39, Alexander Bokovoy wrote:
>>>> Hi!
>>>>
>>>> I'm resending patches 0159 and 0160, and adding two more:
>>>>
>>>> 0161 -- support user SSH public keys in ID view user overrides
>>>> 0162 -- support gidNumber in ID view user override
>>>>
>>>> SSH public keys to work require support from SSSD and that one is
>>>> currently missing. At least, one add/remove the keys to/from the
>>>> override objects.
>>>>
>>>> Compat tree does not support exporting SSH keys. When accessing the tree
>>>> anonymously, the entry will be filtered out by ACIs but for
>>>> authenticated users we need to explicitly ignore ipaSshPubKey attribute
>>>> in the override, so I'm resending updated slapi-nis patch that only
>>>> adds one more attribute to filter out.
>>>>
>>>
>>> I'm going to prepare Web UI for, 160, 161, 162.
>>>
>>> Q: ipaUserOverride object class contains also 'gecos' attribute. Will
>>> it be handled be CLI and Web UI as well?
>> I'll add another patch for that.
>>
>>>
>>> Comments for these 3 patches:
>>>
>>> 1. VERSION was not bumped
>>>
>>> Patch 160:
>>> Apart form #1, is OK (not sure if #1 is needed for ACK)
>> I wonder if I should bump it in a separate patch that would be the last
>> one in the series, to avoid proliferation of API version numbers? :)
>
> IMHO it should be sufficient. Same outcome as if the patches were squashed.
Yep.
One more update for patch 0161, Petr noticed we need to call super
post_callback() too.
--
/ Alexander Bokovoy
-------------- next part --------------
From bc7eb4c53424412b5488068b49a80f2922f078ab Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy at redhat.com>
Date: Fri, 10 Oct 2014 09:26:13 +0300
Subject: [PATCH 4/9] Allow user overrides to specify SSH public keys
Overrides for users can have SSH public keys. This, however, will not enable
SSH public keys from overrides to be actually used until SSSD gets fixed to
pull them in.
SSSD ticket for SSH public keys in overrides:
https://fedorahosted.org/sssd/ticket/2454
Resolves https://fedorahosted.org/freeipa/ticket/4509
---
API.txt | 6 ++++--
ipalib/plugins/idviews.py | 43 +++++++++++++++++++++++++++++++++++++++++++
2 files changed, 47 insertions(+), 2 deletions(-)
diff --git a/API.txt b/API.txt
index 41b852b..5316ac2 100644
--- a/API.txt
+++ b/API.txt
@@ -2104,7 +2104,7 @@ output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDA
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
output: PrimaryKey('value', None, None)
command: idoverrideuser_add
-args: 2,11,3
+args: 2,12,3
arg: Str('idviewcn', cli_name='idview', multivalue=False, primary_key=True, query=True, required=True)
arg: Str('ipaanchoruuid', attribute=True, cli_name='anchor', multivalue=False, primary_key=True, required=True)
option: Str('addattr*', cli_name='addattr', exclude='webui')
@@ -2112,6 +2112,7 @@ option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui
option: Str('description', attribute=True, cli_name='desc', multivalue=False, required=False)
option: Str('homedirectory', attribute=True, cli_name='homedir', multivalue=False, required=False)
option: Str('ipaoriginaluid', attribute=True, cli_name='ipaoriginaluid', multivalue=False, required=False)
+option: Str('ipasshpubkey', attribute=True, cli_name='sshpubkey', csv=True, multivalue=True, required=False)
option: Str('loginshell', attribute=True, cli_name='shell', multivalue=False, required=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')
option: Str('setattr*', cli_name='setattr', exclude='webui')
@@ -2152,7 +2153,7 @@ output: ListOfEntries('result', (<type 'list'>, <type 'tuple'>), Gettext('A list
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
output: Output('truncated', <type 'bool'>, None)
command: idoverrideuser_mod
-args: 2,14,3
+args: 2,15,3
arg: Str('idviewcn', cli_name='idview', multivalue=False, primary_key=True, query=True, required=True)
arg: Str('ipaanchoruuid', attribute=True, cli_name='anchor', multivalue=False, primary_key=True, query=True, required=True)
option: Str('addattr*', cli_name='addattr', exclude='webui')
@@ -2161,6 +2162,7 @@ option: Str('delattr*', cli_name='delattr', exclude='webui')
option: Str('description', attribute=True, autofill=False, cli_name='desc', multivalue=False, required=False)
option: Str('homedirectory', attribute=True, autofill=False, cli_name='homedir', multivalue=False, required=False)
option: Str('ipaoriginaluid', attribute=True, autofill=False, cli_name='ipaoriginaluid', multivalue=False, required=False)
+option: Str('ipasshpubkey', attribute=True, autofill=False, cli_name='sshpubkey', csv=True, multivalue=True, required=False)
option: Str('loginshell', attribute=True, autofill=False, cli_name='shell', multivalue=False, required=False)
option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')
option: Str('rename', cli_name='rename', multivalue=False, primary_key=True, required=False)
diff --git a/ipalib/plugins/idviews.py b/ipalib/plugins/idviews.py
index afaa6f9..d63a12a 100644
--- a/ipalib/plugins/idviews.py
+++ b/ipalib/plugins/idviews.py
@@ -25,6 +25,8 @@ from ipalib.plugins.hostgroup import get_complete_hostgroup_member_list
from ipalib import api, Str, Int, Flag, _, ngettext, errors, output
from ipalib.constants import IPA_ANCHOR_PREFIX, SID_ANCHOR_PREFIX
from ipalib.plugable import Registry
+from ipalib.util import (normalize_sshpubkey, validate_sshpubkey,
+ convert_sshpubkey_post)
from ipapython.dn import DN
@@ -658,6 +660,7 @@ class idoverrideuser(baseidoverride):
object_class = baseidoverride.object_class + ['ipaUserOverride']
default_attributes = baseidoverride.default_attributes + [
'homeDirectory', 'uidNumber', 'uid', 'ipaOriginalUid', 'loginShell',
+ 'ipaSshPubkey',
]
takes_params = baseidoverride.takes_params + (
@@ -686,6 +689,13 @@ class idoverrideuser(baseidoverride):
Str('ipaoriginaluid?',
flags=['no_option', 'no_output']
),
+ Str('ipasshpubkey*', validate_sshpubkey,
+ cli_name='sshpubkey',
+ label=_('SSH public key'),
+ normalizer=normalize_sshpubkey,
+ csv=True,
+ flags=['no_search'],
+ ),
)
override_object = 'user'
@@ -758,6 +768,13 @@ class idoverrideuser_add(baseidoverride_add):
self.obj.update_original_uid_reference(entry_attrs)
return dn
+ def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
+ dn = super(idoverrideuser_add, self).post_callback(ldap, dn,
+ entry_attrs, *keys, **options)
+ convert_sshpubkey_post(ldap, dn, entry_attrs)
+ return dn
+
+
@register()
class idoverrideuser_del(baseidoverride_del):
@@ -777,6 +794,20 @@ class idoverrideuser_mod(baseidoverride_mod):
# Update the ipaOriginalUid
self.obj.set_anchoruuid_from_dn(dn, entry_attrs)
self.obj.update_original_uid_reference(entry_attrs)
+ if 'objectclass' in entry_attrs:
+ obj_classes = entry_attrs['objectclass']
+ else:
+ _entry_attrs = ldap.get_entry(dn, ['objectclass'])
+ obj_classes = entry_attrs['objectclass'] = _entry_attrs['objectclass']
+
+ if 'ipasshpubkey' in entry_attrs and 'ipasshuser' not in obj_classes:
+ obj_classes.append('ipasshuser')
+ return dn
+
+ def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
+ dn = super(idoverrideuser_mod, self).post_callback(ldap, dn,
+ entry_attrs, *keys, **options)
+ convert_sshpubkey_post(ldap, dn, entry_attrs)
return dn
@@ -786,11 +817,23 @@ class idoverrideuser_find(baseidoverride_find):
msg_summary = ngettext('%(count)d User ID override matched',
'%(count)d User ID overrides matched', 0)
+ def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
+ dn = super(idoverrideuser_find, self).post_callback(ldap, dn,
+ entry_attrs, *keys, **options)
+ convert_sshpubkey_post(ldap, dn, entry_attrs)
+ return dn
+
@register()
class idoverrideuser_show(baseidoverride_show):
__doc__ = _('Display information about an User ID override.')
+ def post_callback(self, ldap, dn, entry_attrs, *keys, **options):
+ dn = super(idoverrideuser_show, self).post_callback(ldap, dn,
+ entry_attrs, *keys, **options)
+ convert_sshpubkey_post(ldap, dn, entry_attrs)
+ return dn
+
@register()
class idoverridegroup_add(baseidoverride_add):
--
2.1.0
More information about the Freeipa-devel
mailing list