This patch is based on old Pavel's patch.

I am considering applying the patch for master branch only as it changes
an API (adds a new flag) and is a sort of new-functionality-ish.

--
Automatic creation may of User Private Groups (UPG) may not be
wanted at all times. This patch adds a new flag --noprivate to
ipa user-add command to disable it.

https://fedorahosted.org/freeipa/ticket/1131

>From 6dae50f1774db5d68a3bf8aa5c2e5fc924519100 Mon Sep 17 00:00:00 2001
From: Martin Kosek <mko...@redhat.com>
Date: Mon, 16 May 2011 12:56:04 +0200
Subject: [PATCH] A new flag to disable creation of UPG

Automatic creation may of User Private Groups (UPG) may not be
wanted at all times. This patch adds a new flag --noprivate to
ipa user-add command to disable it.

https://fedorahosted.org/freeipa/ticket/1131
---
 API.txt                                |    5 +--
 install/share/user_private_groups.ldif |    2 +-
 install/updates/50-suppress-upg.update |    2 +
 install/updates/Makefile.am            |    1 +
 ipalib/plugins/user.py                 |   53 ++++++++++++++++++++++++-------
 5 files changed, 47 insertions(+), 16 deletions(-)
 create mode 100644 install/updates/50-suppress-upg.update

diff --git a/API.txt b/API.txt
index cd37b670304ce8675aacb619e13fe23d9779a138..b3c41bfaefeb271582e41067158a4acd7f6714dc 100644
--- a/API.txt
+++ b/API.txt
@@ -2524,7 +2524,7 @@ output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), 'User-friendly
 output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
 output: Output('value', <type 'unicode'>, "The primary_key value of the entry, e.g. 'jdoe' for a user")
 command: user_add
-args: 1,30,3
+args: 1,29,3
 arg: Str('uid', attribute=True, cli_name='login', default_from=DefaultFrom(<lambda>, 'givenname', 'sn'), label=Gettext('User login', domain='ipa', localedir=None), maxlength=255, multivalue=False, normalizer=<lambda>, pattern='^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$', pattern_errmsg='may only include letters, numbers, _, -, . and $', primary_key=True, required=True)
 option: Str('givenname', attribute=True, cli_name='first', label=Gettext('First name', domain='ipa', localedir=None), multivalue=False, required=True)
 option: Str('sn', attribute=True, cli_name='last', label=Gettext('Last name', domain='ipa', localedir=None), multivalue=False, required=True)
@@ -2551,8 +2551,7 @@ option: Str('ou', attribute=True, cli_name='orgunit', label=Gettext('Org. Unit',
 option: Str('title', attribute=True, cli_name='title', label=Gettext('Job Title', domain='ipa', localedir=None), multivalue=False, required=False)
 option: Str('manager', attribute=True, cli_name='manager', label=Gettext('Manager', domain='ipa', localedir=None), multivalue=False, required=False)
 option: Str('carlicense', attribute=True, cli_name='carlicense', label=Gettext('Car License', domain='ipa', localedir=None), multivalue=False, required=False)
-option: Str('addattr*', validate_add_attribute, cli_name='addattr', exclude='webui')
-option: Str('setattr*', validate_set_attribute, cli_name='setattr', exclude='webui')
+option: Flag('noprivate', autofill=True, cli_name='noprivate', default=False)
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui', flags=['no_output'])
 option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui', flags=['no_output'])
 option: Str('version?', exclude='webui', flags=['no_option', 'no_output'])
diff --git a/install/share/user_private_groups.ldif b/install/share/user_private_groups.ldif
index 9df729a47207d2ab3dd30f763a73d05b102d882b..41a78ba0b670693280e0bff77c9bc18201f7c34a 100644
--- a/install/share/user_private_groups.ldif
+++ b/install/share/user_private_groups.ldif
@@ -15,7 +15,7 @@ changetype: add
 objectclass: extensibleObject
 cn: UPG Definition
 originScope: cn=users,cn=accounts,$SUFFIX
-originFilter: objectclass=posixAccount
+originFilter: (&(objectclass=posixAccount)(!(description=__no_upg__)))
 managedBase: cn=groups,cn=accounts,$SUFFIX
 managedTemplate: cn=UPG Template,cn=etc,$SUFFIX
 
diff --git a/install/updates/50-suppress-upg.update b/install/updates/50-suppress-upg.update
new file mode 100644
index 0000000000000000000000000000000000000000..42e4257f2b63dccd6068c145ac07d4d0f6479232
--- /dev/null
+++ b/install/updates/50-suppress-upg.update
@@ -0,0 +1,2 @@
+dn: cn=UPG Definition,cn=Managed Entries,cn=plugins,cn=config
+replace: originFilter:objectclass=posixAccount:(&(objectclass=posixAccount)(!(description=__no_upg__)))
diff --git a/install/updates/Makefile.am b/install/updates/Makefile.am
index 5765bf17da71d8f58160c51fab1e432ce249adef..df33dc6d53ba80cc2da833296712d444943cdafe 100644
--- a/install/updates/Makefile.am
+++ b/install/updates/Makefile.am
@@ -16,6 +16,7 @@ app_DATA =				\
 	45-roles.update			\
 	50-lockout-policy.update	\
 	50-groupuuid.update		\
+	50-suppress-upg.update		\
 	$(NULL)
 
 EXTRA_DIST =				\
diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py
index a058ff7ed7768f11e617b0c95b69347cc023986f..1db44e923e38029a7e48ff2dda03bd9a5c176381 100644
--- a/ipalib/plugins/user.py
+++ b/ipalib/plugins/user.py
@@ -63,6 +63,9 @@ from ipalib import _, ngettext
 from ipalib.request import context
 from time import gmtime, strftime
 
+
+NO_UPG_MAGIC = '__no_upg__'
+
 def validate_nsaccountlock(entry_attrs):
     if 'nsaccountlock' in entry_attrs:
         if not isinstance(entry_attrs['nsaccountlock'], basestring):
@@ -70,6 +73,7 @@ def validate_nsaccountlock(entry_attrs):
         if entry_attrs['nsaccountlock'].lower() not in ('true','false'):
             raise errors.ValidationError(name='nsaccountlock', error='must be TRUE or FALSE')
 
+
 class user(LDAPObject):
     """
     User object.
@@ -289,22 +293,35 @@ class user_add(LDAPCreate):
     """
     Add a new user.
     """
-
     msg_summary = _('Added user "%(value)s"')
 
+    takes_options = LDAPCreate.takes_args + (
+        Flag('noprivate',
+            cli_name='noprivate',
+            doc=_('Don\'t create user private group'),
+        ),
+    )
+
     def pre_callback(self, ldap, dn, entry_attrs, attrs_list, *keys, **options):
-        try:
-            # The Managed Entries plugin will allow a user to be created
-            # even if a group has a duplicate name. This would leave a user
-            # without a private group. Check for both the group and the user.
-            self.api.Command['group_show'](keys[-1])
+        if not options.get('noprivate', False):
             try:
-                self.api.Command['user_show'](keys[-1])
-                self.obj.handle_duplicate_entry(*keys)
+                # The Managed Entries plugin will allow a user to be created
+                # even if a group has a duplicate name. This would leave a user
+                # without a private group. Check for both the group and the user.
+                self.api.Command['group_show'](keys[-1])
+                try:
+                    self.api.Command['user_show'](keys[-1])
+                    self.obj.handle_duplicate_entry(*keys)
+                except errors.NotFound:
+                    raise errors.ManagedGroupExistsError(group=keys[-1])
             except errors.NotFound:
-                raise errors.ManagedGroupExistsError(group=keys[-1])
-        except errors.NotFound:
-            pass
+                pass
+        else:
+            # we don't want an user private group to be created for this user
+            # add NO_UPG_MAGIC description attribute to let the DS plugin know
+            entry_attrs.setdefault('description', [])
+            entry_attrs['description'].append(NO_UPG_MAGIC)
+
         validate_nsaccountlock(entry_attrs)
         config = ldap.get_ipa_config()[1]
         if 'ipamaxusernamelength' in config:
@@ -330,7 +347,7 @@ class user_add(LDAPCreate):
 
         if 'gidnumber' not in entry_attrs:
             # gidNumber wasn't specified explicity, find out what it should be
-            if ldap.has_upg():
+            if not options.get('noprivate', False) and ldap.has_upg():
                 # User Private Groups - uidNumber == gidNumber
                 entry_attrs['gidnumber'] = entry_attrs['uidnumber']
             else:
@@ -360,6 +377,18 @@ class user_add(LDAPCreate):
         group_dn = self.api.Object['group'].get_dn(def_primary_group)
         ldap.add_entry_to_group(dn, group_dn)
         self.obj._convert_manager(entry_attrs, **options)
+        # delete description attribute NO_UPG_MAGIC if present
+        if options.get('noprivate', False):
+            if options.get('all', False):
+                (dn, desc_attr) = ldap.get_entry(dn, ['description'])
+                entry_attrs.update(desc_attr)
+            if 'description' in entry_attrs and NO_UPG_MAGIC in entry_attrs['description']:
+                entry_attrs['description'].remove(NO_UPG_MAGIC)
+                kw = {'setattr': '=%s' % ','.join(entry_attrs['description'])}
+                try:
+                    self.api.Command['user_mod'](keys[-1], **kw)
+                except (errors.EmptyModlist, errors.NotFound):
+                    pass
         return dn
 
 api.register(user_add)
-- 
1.7.4.4

_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel

Reply via email to