John Dennis <jden...@redhat.com>

Looking to carve out IT costs?
>From eda845c33c20259cce39621b707906808b2b9335 Mon Sep 17 00:00:00 2001
From: John Dennis <jden...@redhat.com>
Date: Fri, 31 Aug 2012 08:16:49 -0400
Subject: [PATCH 81] ipa user-find --manager does not find matches
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit

The manager LDAP attribute is a dn pointing inside the user
container. When passed on the command it is typically a bare user
uid. The search filter will only succeed if the bare uid is converted
to a full dn because that is what is stored in the value for the
manager attribute.

The search failure is solved by calling _normalize_manager() which
does the conversion to a dn (if not already a dn).

It feels like this type of conversion should be performed in the pre
callback which allows one to modify the filter. But when the pre
callback is invoked it's complex string with the manager attribute
already inserted. This is because the LDAPSearch.execute() method
processes the options dict and constructs a filter component for each
key/value in the options dict prior to invoking the pre callback. If
we wanted to modify the manager value in the filter in the pre
callback we would have to decompose the filter string, perform dn
checking and then reassemble the filter. It's much cleaner to perform
the dn operations on the manager value before it gets embedded into
what otherwise might be a very complex filter. This is the reason why
the normalization is perfored in the execute method as opposed to the
pre callback. Other classes do similar things in their execute methods
as opposed to their callbacks's, selinuxusermap_find is one example.

 ipalib/plugins/user.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py
index d0f7da2..c024e85 100644
--- a/ipalib/plugins/user.py
+++ b/ipalib/plugins/user.py
@@ -642,6 +642,13 @@ class user_find(LDAPSearch):
+    def execute(self, *args, **options):
+        # assure the manager attr is a dn, not just a bare uid
+        manager = options.get('manager')
+        if manager is not None:
+            options['manager'] = self.obj._normalize_manager(manager)
+        return super(user_find, self).execute(self, *args, **options)
     def pre_callback(self, ldap, filter, attrs_list, base_dn, scope, *keys, **options):
         assert isinstance(base_dn, DN)
         if options.get('whoami'):

Freeipa-devel mailing list

Reply via email to