|
 |
590d18 |
From 366a208f9d7bbbf637d192d1dfcab4482f69c441 Mon Sep 17 00:00:00 2001
|
|
|
590d18 |
From: "Endi S. Dewata" <edewata@redhat.com>
|
|
|
590d18 |
Date: Tue, 11 Aug 2015 08:19:59 +0200
|
|
|
590d18 |
Subject: [PATCH] Added CLI param and ACL for vault service operations.
|
|
|
590d18 |
|
|
|
590d18 |
The CLIs to manage vault owners and members have been modified
|
|
|
590d18 |
to accept services with a new parameter.
|
|
|
590d18 |
|
|
|
590d18 |
A new ACL has been added to allow a service to create its own
|
|
|
590d18 |
service container.
|
|
|
590d18 |
|
|
|
590d18 |
https://fedorahosted.org/freeipa/ticket/5172
|
|
|
590d18 |
|
|
|
590d18 |
Reviewed-By: Jan Cholasta <jcholast@redhat.com>
|
|
|
590d18 |
Reviewed-By: Martin Kosek <mkosek@redhat.com>
|
|
|
590d18 |
---
|
|
|
590d18 |
API.txt | 12 ++-
|
|
|
590d18 |
VERSION | 4 +-
|
|
|
590d18 |
install/share/vault.update | 1 +
|
|
|
590d18 |
ipalib/plugins/vault.py | 177 +++++++++++++++++++++------------------------
|
|
|
590d18 |
4 files changed, 94 insertions(+), 100 deletions(-)
|
|
|
590d18 |
|
|
|
590d18 |
diff --git a/API.txt b/API.txt
|
|
|
590d18 |
index 2e19d6b2f1e16cc1c89d71ed7d443145426a28e3..71df3a56595a012e6382414ad4453d30ede8155b 100644
|
|
|
590d18 |
--- a/API.txt
|
|
|
590d18 |
+++ b/API.txt
|
|
|
590d18 |
@@ -5434,13 +5434,14 @@ output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDA
|
|
|
590d18 |
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
|
|
590d18 |
output: PrimaryKey('value', None, None)
|
|
|
590d18 |
command: vault_add_member
|
|
|
590d18 |
-args: 1,9,3
|
|
|
590d18 |
+args: 1,10,3
|
|
|
590d18 |
arg: Str('cn', attribute=True, cli_name='name', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.-]+$', primary_key=True, query=True, required=True)
|
|
|
590d18 |
option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
|
|
|
590d18 |
option: Str('group*', alwaysask=True, cli_name='groups', csv=True)
|
|
|
590d18 |
option: Flag('no_members', autofill=True, default=False, exclude='webui')
|
|
|
590d18 |
option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')
|
|
|
590d18 |
option: Str('service?')
|
|
|
590d18 |
+option: Str('services', alwaysask=True, cli_name='services', csv=True, multivalue=True, required=False)
|
|
|
590d18 |
option: Flag('shared?', autofill=True, default=False)
|
|
|
590d18 |
option: Str('user*', alwaysask=True, cli_name='users', csv=True)
|
|
|
590d18 |
option: Str('username?', cli_name='user')
|
|
|
590d18 |
@@ -5449,13 +5450,14 @@ output: Output('completed', <type 'int'>, None)
|
|
|
590d18 |
output: Output('failed', <type 'dict'>, None)
|
|
|
590d18 |
output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
|
|
|
590d18 |
command: vault_add_owner
|
|
|
590d18 |
-args: 1,9,3
|
|
|
590d18 |
+args: 1,10,3
|
|
|
590d18 |
arg: Str('cn', attribute=True, cli_name='name', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.-]+$', primary_key=True, query=True, required=True)
|
|
|
590d18 |
option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
|
|
|
590d18 |
option: Str('group*', alwaysask=True, cli_name='groups', csv=True)
|
|
|
590d18 |
option: Flag('no_members', autofill=True, default=False, exclude='webui')
|
|
|
590d18 |
option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')
|
|
|
590d18 |
option: Str('service?')
|
|
|
590d18 |
+option: Str('services', alwaysask=True, cli_name='services', csv=True, multivalue=True, required=False)
|
|
|
590d18 |
option: Flag('shared?', autofill=True, default=False)
|
|
|
590d18 |
option: Str('user*', alwaysask=True, cli_name='users', csv=True)
|
|
|
590d18 |
option: Str('username?', cli_name='user')
|
|
|
590d18 |
@@ -5547,13 +5549,14 @@ output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDA
|
|
|
590d18 |
output: Output('summary', (<type 'unicode'>, <type 'NoneType'>), None)
|
|
|
590d18 |
output: PrimaryKey('value', None, None)
|
|
|
590d18 |
command: vault_remove_member
|
|
|
590d18 |
-args: 1,9,3
|
|
|
590d18 |
+args: 1,10,3
|
|
|
590d18 |
arg: Str('cn', attribute=True, cli_name='name', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.-]+$', primary_key=True, query=True, required=True)
|
|
|
590d18 |
option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
|
|
|
590d18 |
option: Str('group*', alwaysask=True, cli_name='groups', csv=True)
|
|
|
590d18 |
option: Flag('no_members', autofill=True, default=False, exclude='webui')
|
|
|
590d18 |
option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')
|
|
|
590d18 |
option: Str('service?')
|
|
|
590d18 |
+option: Str('services', alwaysask=True, cli_name='services', csv=True, multivalue=True, required=False)
|
|
|
590d18 |
option: Flag('shared?', autofill=True, default=False)
|
|
|
590d18 |
option: Str('user*', alwaysask=True, cli_name='users', csv=True)
|
|
|
590d18 |
option: Str('username?', cli_name='user')
|
|
|
590d18 |
@@ -5562,13 +5565,14 @@ output: Output('completed', <type 'int'>, None)
|
|
|
590d18 |
output: Output('failed', <type 'dict'>, None)
|
|
|
590d18 |
output: Entry('result', <type 'dict'>, Gettext('A dictionary representing an LDAP entry', domain='ipa', localedir=None))
|
|
|
590d18 |
command: vault_remove_owner
|
|
|
590d18 |
-args: 1,9,3
|
|
|
590d18 |
+args: 1,10,3
|
|
|
590d18 |
arg: Str('cn', attribute=True, cli_name='name', maxlength=255, multivalue=False, pattern='^[a-zA-Z0-9_.-]+$', primary_key=True, query=True, required=True)
|
|
|
590d18 |
option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
|
|
|
590d18 |
option: Str('group*', alwaysask=True, cli_name='groups', csv=True)
|
|
|
590d18 |
option: Flag('no_members', autofill=True, default=False, exclude='webui')
|
|
|
590d18 |
option: Flag('raw', autofill=True, cli_name='raw', default=False, exclude='webui')
|
|
|
590d18 |
option: Str('service?')
|
|
|
590d18 |
+option: Str('services', alwaysask=True, cli_name='services', csv=True, multivalue=True, required=False)
|
|
|
590d18 |
option: Flag('shared?', autofill=True, default=False)
|
|
|
590d18 |
option: Str('user*', alwaysask=True, cli_name='users', csv=True)
|
|
|
590d18 |
option: Str('username?', cli_name='user')
|
|
|
590d18 |
diff --git a/VERSION b/VERSION
|
|
|
590d18 |
index ca43f3e0c06880d355c068514134187c5edda175..69351a8fa8e27c884c130ab49d3fab541cd09ff9 100644
|
|
|
590d18 |
--- a/VERSION
|
|
|
590d18 |
+++ b/VERSION
|
|
|
590d18 |
@@ -90,5 +90,5 @@ IPA_DATA_VERSION=20100614120000
|
|
|
590d18 |
# #
|
|
|
590d18 |
########################################################
|
|
|
590d18 |
IPA_API_VERSION_MAJOR=2
|
|
|
590d18 |
-IPA_API_VERSION_MINOR=148
|
|
|
590d18 |
-# Last change: ftweedal - add --out option to user-show
|
|
|
590d18 |
+IPA_API_VERSION_MINOR=149
|
|
|
590d18 |
+# Last change: edewata - Added CLI param and ACL for vault service operations
|
|
|
590d18 |
diff --git a/install/share/vault.update b/install/share/vault.update
|
|
|
590d18 |
index 61a8940b544fbc839b931f337389ac35dc2d1ffa..14421b5189efe9b3d9491e845e74debca6e18941 100644
|
|
|
590d18 |
--- a/install/share/vault.update
|
|
|
590d18 |
+++ b/install/share/vault.update
|
|
|
590d18 |
@@ -8,6 +8,7 @@ default: objectClass: top
|
|
|
590d18 |
default: objectClass: ipaVaultContainer
|
|
|
590d18 |
default: cn: vaults
|
|
|
590d18 |
default: aci: (target="ldap:///cn=*,cn=users,cn=vaults,cn=kra,$SUFFIX")(version 3.0; acl "Allow users to create private container"; allow (add) userdn = "ldap:///uid=($$attr.cn),cn=users,cn=accounts,$SUFFIX";)
|
|
|
590d18 |
+default: aci: (target="ldap:///cn=*,cn=services,cn=vaults,cn=kra,$SUFFIX")(version 3.0; acl "Allow services to create private container"; allow (add) userdn = "ldap:///krbprincipalname=($$attr.cn)@$REALM,cn=services,cn=accounts,$SUFFIX";)
|
|
|
590d18 |
default: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Container owners can manage vaults in the container"; allow(read, search, compare, add, delete) userattr="parent[1].owner#USERDN";)
|
|
|
590d18 |
default: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Indirect container owners can manage vaults in the container"; allow(read, search, compare, add, delete) userattr="parent[1].owner#GROUPDN";)
|
|
|
590d18 |
default: aci: (targetfilter="(objectClass=ipaVault)")(targetattr="*")(version 3.0; acl "Vault members can access the vault"; allow(read, search, compare) userattr="member#USERDN";)
|
|
|
590d18 |
diff --git a/ipalib/plugins/vault.py b/ipalib/plugins/vault.py
|
|
|
590d18 |
index ac608f5c7e2779da138c75a0f02bd5546f4aeffd..01c6096335d47b337253d4f2d1e0571200383c7a 100644
|
|
|
590d18 |
--- a/ipalib/plugins/vault.py
|
|
|
590d18 |
+++ b/ipalib/plugins/vault.py
|
|
|
590d18 |
@@ -44,7 +44,7 @@ from ipalib.crud import PKQuery, Retrieve, Update
|
|
|
590d18 |
from ipalib.plugable import Registry
|
|
|
590d18 |
from ipalib.plugins.baseldap import LDAPObject, LDAPCreate, LDAPDelete,\
|
|
|
590d18 |
LDAPSearch, LDAPUpdate, LDAPRetrieve, LDAPAddMember, LDAPRemoveMember,\
|
|
|
590d18 |
- pkey_to_value
|
|
|
590d18 |
+ LDAPModMember, pkey_to_value
|
|
|
590d18 |
from ipalib.request import context
|
|
|
590d18 |
from ipalib.plugins.user import split_principal
|
|
|
590d18 |
from ipalib import _, ngettext
|
|
|
590d18 |
@@ -93,122 +93,91 @@ The secret can only be retrieved using the private key.
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
EXAMPLES:
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
- List private vaults:
|
|
|
590d18 |
+ List vaults:
|
|
|
590d18 |
ipa vault-find
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
- List service vaults:
|
|
|
590d18 |
- ipa vault-find --service <service name>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- List shared vaults:
|
|
|
590d18 |
- ipa vault-find --shared
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- List user vaults:
|
|
|
590d18 |
- ipa vault-find --user <username>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Add a private vault:
|
|
|
590d18 |
+ Add a standard vault:
|
|
|
590d18 |
ipa vault-add <name>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Add a service vault:
|
|
|
590d18 |
- ipa vault-add <name> --service <service name>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Add a shared vault:
|
|
|
590d18 |
- ipa vault-add <ame> --shared
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Add a user vault:
|
|
|
590d18 |
- ipa vault-add <name> --user <username>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
Add a symmetric vault:
|
|
|
590d18 |
- ipa vault-add <name> --type symmetric --password-file password.txt
|
|
|
590d18 |
+ ipa vault-add <name>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
+ --type symmetric --password-file password.txt
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
Add an asymmetric vault:
|
|
|
590d18 |
- ipa vault-add <name> --type asymmetric --public-key-file public.pem
|
|
|
590d18 |
+ ipa vault-add <name>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
+ --type asymmetric --public-key-file public.pem
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
- Show a private vault:
|
|
|
590d18 |
+ Show a vault:
|
|
|
590d18 |
ipa vault-show <name>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
- Show a service vault:
|
|
|
590d18 |
- ipa vault-show <name> --service <service name>
|
|
|
590d18 |
+ Modify a vault:
|
|
|
590d18 |
+ ipa vault-mod <name>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
+ --desc <description>
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
- Show a shared vault:
|
|
|
590d18 |
- ipa vault-show <name> --shared
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Show a user vault:
|
|
|
590d18 |
- ipa vault-show <name> --user <username>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Modify a private vault:
|
|
|
590d18 |
- ipa vault-mod <name> --desc <description>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Modify a service vault:
|
|
|
590d18 |
- ipa vault-mod <name> --service <service name> --desc <description>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Modify a shared vault:
|
|
|
590d18 |
- ipa vault-mod <name> --shared --desc <description>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Modify a user vault:
|
|
|
590d18 |
- ipa vault-mod <name> --user <username> --desc <description>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Delete a private vault:
|
|
|
590d18 |
+ Delete a vault:
|
|
|
590d18 |
ipa vault-del <name>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Delete a service vault:
|
|
|
590d18 |
- ipa vault-del <name> --service <service name>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Delete a shared vault:
|
|
|
590d18 |
- ipa vault-del <name> --shared
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Delete a user vault:
|
|
|
590d18 |
- ipa vault-del <name> --user <username>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
Display vault configuration:
|
|
|
590d18 |
ipa vaultconfig-show
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
- Archive data into private vault:
|
|
|
590d18 |
- ipa vault-archive <name> --in <input file>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Archive data into service vault:
|
|
|
590d18 |
- ipa vault-archive <name> --service <service name> --in <input file>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Archive data into shared vault:
|
|
|
590d18 |
- ipa vault-archive <name> --shared --in <input file>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Archive data into user vault:
|
|
|
590d18 |
- ipa vault-archive <name> --user <username> --in <input file>
|
|
|
590d18 |
+ Archive data into standard vault:
|
|
|
590d18 |
+ ipa vault-archive <name>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
+ --in <input file>
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
Archive data into symmetric vault:
|
|
|
590d18 |
- ipa vault-archive <name> --in <input file>
|
|
|
590d18 |
+ ipa vault-archive <name>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
+ --in <input file>
|
|
|
590d18 |
+ --password-file password.txt
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
Archive data into asymmetric vault:
|
|
|
590d18 |
- ipa vault-archive <name> --in <input file>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Retrieve data from private vault:
|
|
|
590d18 |
- ipa vault-retrieve <name> --out <output file>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Retrieve data from service vault:
|
|
|
590d18 |
- ipa vault-retrieve <name> --service <service name> --out <output file>
|
|
|
590d18 |
-""") + _("""
|
|
|
590d18 |
- Retrieve data from shared vault:
|
|
|
590d18 |
- ipa vault-retrieve <name> --shared --out <output file>
|
|
|
590d18 |
+ ipa vault-archive <name>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
+ --in <input file>
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
- Retrieve data from user vault:
|
|
|
590d18 |
- ipa vault-retrieve <name> --user <username> --out <output file>
|
|
|
590d18 |
+ Retrieve data from standard vault:
|
|
|
590d18 |
+ ipa vault-retrieve <name>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
+ --out <output file>
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
Retrieve data from symmetric vault:
|
|
|
590d18 |
- ipa vault-retrieve <name> --out data.bin
|
|
|
590d18 |
+ ipa vault-retrieve <name>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
+ --out <output file>
|
|
|
590d18 |
+ --password-file password.txt
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
Retrieve data from asymmetric vault:
|
|
|
590d18 |
- ipa vault-retrieve <name> --out data.bin --private-key-file private.pem
|
|
|
590d18 |
+ ipa vault-retrieve <name>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
+ --out <output file> --private-key-file private.pem
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
- Add a vault owner:
|
|
|
590d18 |
- ipa vault-add-owner <name> --users <usernames>
|
|
|
590d18 |
+ Add vault owners:
|
|
|
590d18 |
+ ipa vault-add-owner <name>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
+ [--users <users>] [--groups <groups>] [--services <services>]
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
- Delete a vault owner:
|
|
|
590d18 |
- ipa vault-remove-owner <name> --users <usernames>
|
|
|
590d18 |
+ Delete vault owners:
|
|
|
590d18 |
+ ipa vault-remove-owner <name>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
+ [--users <users>] [--groups <groups>] [--services <services>]
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
- Add a vault member:
|
|
|
590d18 |
- ipa vault-add-member <name> --users <usernames>
|
|
|
590d18 |
+ Add vault members:
|
|
|
590d18 |
+ ipa vault-add-member <name>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
+ [--users <users>] [--groups <groups>] [--services <services>]
|
|
|
590d18 |
""") + _("""
|
|
|
590d18 |
- Delete a vault member:
|
|
|
590d18 |
- ipa vault-remove-member <name> --users <usernames>
|
|
|
590d18 |
+ Delete vault members:
|
|
|
590d18 |
+ ipa vault-remove-member <name>
|
|
|
590d18 |
+ [--user <user>|--service <service>|--shared]
|
|
|
590d18 |
+ [--users <users>] [--groups <groups>] [--services <services>]
|
|
|
590d18 |
""")
|
|
|
590d18 |
|
|
|
590d18 |
|
|
|
590d18 |
@@ -285,8 +254,8 @@ class vault(LDAPObject):
|
|
|
590d18 |
'ipavaulttype',
|
|
|
590d18 |
]
|
|
|
590d18 |
attribute_members = {
|
|
|
590d18 |
- 'owner': ['user', 'group'],
|
|
|
590d18 |
- 'member': ['user', 'group'],
|
|
|
590d18 |
+ 'owner': ['user', 'group', 'service'],
|
|
|
590d18 |
+ 'member': ['user', 'group', 'service'],
|
|
|
590d18 |
}
|
|
|
590d18 |
|
|
|
590d18 |
label = _('Vaults')
|
|
|
590d18 |
@@ -340,6 +309,11 @@ class vault(LDAPObject):
|
|
|
590d18 |
label=_('Owner groups'),
|
|
|
590d18 |
flags=['no_create', 'no_update', 'no_search'],
|
|
|
590d18 |
),
|
|
|
590d18 |
+ Str(
|
|
|
590d18 |
+ 'owner_service?',
|
|
|
590d18 |
+ label=_('Owner services'),
|
|
|
590d18 |
+ flags=['no_create', 'no_update', 'no_search'],
|
|
|
590d18 |
+ ),
|
|
|
590d18 |
)
|
|
|
590d18 |
|
|
|
590d18 |
def get_dn(self, *keys, **options):
|
|
|
590d18 |
@@ -1432,8 +1406,23 @@ class vault_retrieve_internal(PKQuery):
|
|
|
590d18 |
return response
|
|
|
590d18 |
|
|
|
590d18 |
|
|
|
590d18 |
+class VaultModMember(LDAPModMember):
|
|
|
590d18 |
+ def get_options(self):
|
|
|
590d18 |
+ for param in super(VaultModMember, self).get_options():
|
|
|
590d18 |
+ if param.name == 'service' and param not in vault_options:
|
|
|
590d18 |
+ param = param.clone_rename('services')
|
|
|
590d18 |
+ yield param
|
|
|
590d18 |
+
|
|
|
590d18 |
+ def get_member_dns(self, **options):
|
|
|
590d18 |
+ if 'services' in options:
|
|
|
590d18 |
+ options['service'] = options.pop('services')
|
|
|
590d18 |
+ else:
|
|
|
590d18 |
+ options.pop('service', None)
|
|
|
590d18 |
+ return super(VaultModMember, self).get_member_dns(**options)
|
|
|
590d18 |
+
|
|
|
590d18 |
+
|
|
|
590d18 |
@register()
|
|
|
590d18 |
-class vault_add_owner(LDAPAddMember):
|
|
|
590d18 |
+class vault_add_owner(VaultModMember, LDAPAddMember):
|
|
|
590d18 |
__doc__ = _('Add owners to a vault.')
|
|
|
590d18 |
|
|
|
590d18 |
takes_options = LDAPAddMember.takes_options + vault_options
|
|
|
590d18 |
@@ -1457,7 +1446,7 @@ class vault_add_owner(LDAPAddMember):
|
|
|
590d18 |
|
|
|
590d18 |
|
|
|
590d18 |
@register()
|
|
|
590d18 |
-class vault_remove_owner(LDAPRemoveMember):
|
|
|
590d18 |
+class vault_remove_owner(VaultModMember, LDAPRemoveMember):
|
|
|
590d18 |
__doc__ = _('Remove owners from a vault.')
|
|
|
590d18 |
|
|
|
590d18 |
takes_options = LDAPRemoveMember.takes_options + vault_options
|
|
|
590d18 |
@@ -1481,14 +1470,14 @@ class vault_remove_owner(LDAPRemoveMember):
|
|
|
590d18 |
|
|
|
590d18 |
|
|
|
590d18 |
@register()
|
|
|
590d18 |
-class vault_add_member(LDAPAddMember):
|
|
|
590d18 |
+class vault_add_member(VaultModMember, LDAPAddMember):
|
|
|
590d18 |
__doc__ = _('Add members to a vault.')
|
|
|
590d18 |
|
|
|
590d18 |
takes_options = LDAPAddMember.takes_options + vault_options
|
|
|
590d18 |
|
|
|
590d18 |
|
|
|
590d18 |
@register()
|
|
|
590d18 |
-class vault_remove_member(LDAPRemoveMember):
|
|
|
590d18 |
+class vault_remove_member(VaultModMember, LDAPRemoveMember):
|
|
|
590d18 |
__doc__ = _('Remove members from a vault.')
|
|
|
590d18 |
|
|
|
590d18 |
takes_options = LDAPRemoveMember.takes_options + vault_options
|
|
|
590d18 |
--
|
|
|
590d18 |
2.4.3
|
|
|
590d18 |
|