From 85293744afb352b912ff36e750fa4c7107f2d99f Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Fri, 30 Oct 2009 15:26:54 -0400 Subject: [PATCH] Add support for option descriptions to SSSDConfig API Addresses https://fedorahosted.org/sssd/ticket/242 related to authconfig integration --- server/config/SSSDConfig.py | 41 ++++++--- server/config/SSSDConfigTest.py | 8 +- server/config/etc/sssd.api.conf | 65 ++++++++-------- server/config/etc/sssd.api.d/sssd-ipa.conf | 6 +- server/config/etc/sssd.api.d/sssd-krb5.conf | 12 ++-- server/config/etc/sssd.api.d/sssd-ldap.conf | 110 +++++++++++++------------- server/config/etc/sssd.api.d/sssd-local.conf | 4 +- server/config/etc/sssd.api.d/sssd-proxy.conf | 4 +- 8 files changed, 130 insertions(+), 120 deletions(-) diff --git a/server/config/SSSDConfig.py b/server/config/SSSDConfig.py index 578f292..8879330 100644 --- a/server/config/SSSDConfig.py +++ b/server/config/SSSDConfig.py @@ -25,6 +25,12 @@ class NoSuchProviderError(SSSDConfigException): pass class NoSuchProviderSubtypeError(SSSDConfigException): pass class ProviderSubtypeInUse(SSSDConfigException): pass +# Indexes +PRIMARY_TYPE = 0 +SUBTYPE = 1 +DESC = 2 +DEFAULT = 3 + class SSSDConfigSchema(RawConfigParser): def __init__(self, schemafile, schemaplugindir): #TODO: get these from a global setting @@ -81,33 +87,38 @@ class SSSDConfigSchema(RawConfigParser): split_option = self._striplist(unparsed_option.split(',')) optionlen = len(split_option) - primarytype = self.type_lookup[split_option[0]] - subtype = self.type_lookup[split_option[1]] + primarytype = self.type_lookup[split_option[PRIMARY_TYPE]] + subtype = self.type_lookup[split_option[SUBTYPE]] + desc = unicode(split_option[DESC]) - if optionlen == 2: + if optionlen == 3: # This option has no defaults parsed_options[option] = \ (primarytype, subtype, + desc, None) - elif optionlen == 3: - if type(split_option[2]) == primarytype: + elif optionlen == 4: + if type(split_option[DEFAULT]) == primarytype: parsed_options[option] = \ (primarytype, subtype, - split_option[2]) + desc, + split_option[DEFAULT]) elif primarytype == list: - if (type(split_option[2]) == subtype): + if (type(split_option[DEFAULT]) == subtype): parsed_options[option] = \ (primarytype, subtype, - [split_option[2]]) + desc, + [split_option[DEFAULT]]) else: try: parsed_options[option] = \ (primarytype, subtype, - [subtype(split_option[2])]) + desc, + [subtype(split_option[DEFAULT])]) except ValueError: raise ParsingError else: @@ -115,15 +126,16 @@ class SSSDConfigSchema(RawConfigParser): parsed_options[option] = \ (primarytype, subtype, - primarytype(split_option[2])) + desc, + primarytype(split_option[DEFAULT])) except ValueError: raise ParsingError - elif optionlen > 3: + elif optionlen > 4: if (primarytype != list): raise ParsingError fixed_options = [] - for x in split_option[2:]: + for x in split_option[DEFAULT:]: if type(x) != subtype: try: fixed_options.extend([subtype(x)]) @@ -134,6 +146,7 @@ class SSSDConfigSchema(RawConfigParser): parsed_options[option] = \ (primarytype, subtype, + desc, fixed_options) else: # Bad config file @@ -155,9 +168,9 @@ class SSSDConfigSchema(RawConfigParser): raise NoSectionError(section) schema_options = self.get_options(section) - defaults = dict([(x,schema_options[x][2]) + defaults = dict([(x,schema_options[x][DEFAULT]) for x in schema_options.keys() - if schema_options[x][2] != None]) + if schema_options[x][DEFAULT] != None]) return defaults diff --git a/server/config/SSSDConfigTest.py b/server/config/SSSDConfigTest.py index 96a650a..f99f672 100644 --- a/server/config/SSSDConfigTest.py +++ b/server/config/SSSDConfigTest.py @@ -239,7 +239,7 @@ class SSSDConfigTestSSSDService(unittest.TestCase): self.assertTrue(options['reconnection_retries'][0] == int, "reconnection_retries should default to 2. " + "list_options specifies %d" % - options['reconnection_retries'][2]) + options['reconnection_retries'][3]) self.assertTrue(type(options['services']) == tuple, "Option values should be a tuple") @@ -408,7 +408,6 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase): 'max_id', 'timeout', 'command', - 'magic_private_groups', 'enumerate', 'cache_credentials', 'store_legacy_passwords', @@ -438,12 +437,12 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase): "Option values should be a tuple") self.assertTrue(options['max_id'][0] == int, - "config_file_version should require an int. " + + "max_id should require an int. " + "list_options is requiring a %s" % options['max_id'][0]) self.assertTrue(options['max_id'][1] == None, - "config_file_version should not require a subtype. " + + "max_id should not require a subtype. " + "list_options is requiring a %s" % options['max_id'][1]) @@ -628,7 +627,6 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase): 'max_id', 'timeout', 'command', - 'magic_private_groups', 'enumerate', 'cache_credentials', 'store_legacy_passwords', diff --git a/server/config/etc/sssd.api.conf b/server/config/etc/sssd.api.conf index de2af83..c7e94a8 100644 --- a/server/config/etc/sssd.api.conf +++ b/server/config/etc/sssd.api.conf @@ -3,52 +3,51 @@ [service] # Options available to all services -debug_level = int, None, 0 -debug_timestamps = bool, None -debug_to_files = bool, None -command = str, None -reconnection_retries = int, None, 3 +debug_level = int, None, Set the verbosity of the debug logging, 0 +debug_timestamps = bool, None, Include timestamps in debug logs +debug_to_files = bool, None, Write debug messages to logfiles +timeout = int, None, Ping timeout before restarting service +command = str, None, Command to start service +reconnection_retries = int, None, Number of times to attempt connection to Data Providers before giving up, 3 [sssd] # Monitor service -services = list, str, nss, pam -domains = list, str -timeout = int, None -sbus_timeout = int, None -re_expression = str, None -full_name_format = str, None +services = list, str, SSSD Services to start, nss, pam +domains = list, str, SSSD Domains to start +sbus_timeout = int, None, Timeout for messages sent over the SBUS +re_expression = str, None, Regex to parse username and domain +full_name_format = str, None, Printf-compatible format for displaying fully-qualified names [nss] # Name service -enum_cache_timeout = int, None -entry_cache_no_wait_timeout = int, None -entry_negative_timeout = int, None -filter_users = list, str, root -filter_groups = list, str, root -filter_users_in_groups = bool, None, true +enum_cache_timeout = int, None, Enumeration cache timeout length (seconds) +entry_cache_no_wait_timeout = int, None, Entry cache background update timeout length (seconds) +entry_negative_timeout = int, None, Negative cache timeout length (seconds) +filter_users = list, str, Users that SSSD should explicitly ignore,root +filter_groups = list, str, Groups that SSSD should explicitly ignore, root +filter_users_in_groups = bool, None, Should filtered users appear in groups, true [pam] # Authentication service -offline_credentials_expiration = int, None +offline_credentials_expiration = int, None, How long to allow cached logins between online logins (days) [provider] #Available provider types -id_provider = str, None -auth_provider = str, None -access_provider = str, None -chpass_provider = str, None +id_provider = str, None, Identity provider +auth_provider = str, None, Authentication provider +access_provider = str, None, Access control provider +chpass_provider = str, None, Password change provider [domain] # Options available to all domains -debug_level = int, None, 0 -command = str, None -min_id = int, None, 1000 -max_id = int, None -timeout = int, None, 0 -magic_private_groups = bool, None, false -enumerate = bool, None, true -cache_credentials = bool, None, false -store_legacy_passwords = bool, None, false -use_fully_qualified_names = bool, None, false -entry_cache_timeout = int, None +debug_level = int, None, Set the verbosity of the debug logging, 0 +command = str, None, Command to start domain +min_id = int, None, Minimum user id, 1000 +max_id = int, None, Maximum user id +timeout = int, None, Ping timeout before restarting domain +enumerate = bool, None, Enable enumerating all users/groups, true +cache_credentials = bool, None, Cache credentials for offline login, false +store_legacy_passwords = bool, None, Store password hashes, false +use_fully_qualified_names = bool, None, Display users/groups in fully-qualified form, false +entry_cache_timeout = int, None, Entry cache timeout length (seconds) diff --git a/server/config/etc/sssd.api.d/sssd-ipa.conf b/server/config/etc/sssd.api.d/sssd-ipa.conf index 3b42111..c9031ce 100644 --- a/server/config/etc/sssd.api.d/sssd-ipa.conf +++ b/server/config/etc/sssd.api.d/sssd-ipa.conf @@ -1,4 +1,4 @@ [provider/ipa] -ipa_domain = str, None -ipa_server = str, None -ipa_hostname = str, None +ipa_domain = str, None, IPA domain +ipa_server = str, None, IPA server address +ipa_hostname = str, None, IPA client hostname diff --git a/server/config/etc/sssd.api.d/sssd-krb5.conf b/server/config/etc/sssd.api.d/sssd-krb5.conf index 85067e9..848da74 100644 --- a/server/config/etc/sssd.api.d/sssd-krb5.conf +++ b/server/config/etc/sssd.api.d/sssd-krb5.conf @@ -1,13 +1,13 @@ [provider/krb5] -krb5_kdcip = str, None -krb5_realm = str, None -krb5_auth_timeout = int, None +krb5_kdcip = str, None, Kerberos server address +krb5_realm = str, None, Kerberos realm +krb5_auth_timeout = int, None, Authentication timeout [provider/krb5/auth] -krb5_ccachedir = str, None -krb5_ccname_template = str, None +krb5_ccachedir = str, None, Directory to store credential caches +krb5_ccname_template = str, None, Location of the user's credential cache [provider/krb5/access] [provider/krb5/chpass] -krb5_changepw_principal = str, None \ No newline at end of file +krb5_changepw_principal = str, None, The principle of the change password service \ No newline at end of file diff --git a/server/config/etc/sssd.api.d/sssd-ldap.conf b/server/config/etc/sssd.api.d/sssd-ldap.conf index 1c094f6..c49c6e2 100644 --- a/server/config/etc/sssd.api.d/sssd-ldap.conf +++ b/server/config/etc/sssd.api.d/sssd-ldap.conf @@ -1,61 +1,61 @@ [provider/ldap] -ldap_uri = str, None, ldap://localhost -ldap_search_base = str, None -ldap_schema = str, None, rfc2307 -ldap_default_bind_dn = str, None -ldap_default_authtok_type = str, None -ldap_default_authtok = str, None -ldap_network_timeout = int, None -ldap_opt_timeout = int, None -ldap_offline_timeout = int, None -ldap_tls_cacert = str, None -ldap_tls_reqcert = str, None -ldap_sasl_mech = str, None -ldap_sasl_authid = str, None -krb5_kdcip = str, None -krb5_realm = str, None -ldap_krb5_keytab = str, None -ldap_krb5_init_creds = bool, None +ldap_uri = str, None, ldap_uri, The URI of the LDAP server +ldap_search_base = str, None, The default base DN +ldap_schema = str, None, The Schema Type in use on the LDAP server, rfc2307 +ldap_default_bind_dn = str, None, The default bind DN +ldap_default_authtok_type = str, None, The type of the authentication token of the default bind DN +ldap_default_authtok = str, None, The authentication token of the default bind DN +ldap_network_timeout = int, None, Length of time to attempt connection +ldap_opt_timeout = int, None, Length of time to attempt synchronous LDAP operations +ldap_offline_timeout = int, None, Length of time between attempts to reconnect while offline +ldap_tls_cacert = str, None, file that contains CA certificates +ldap_tls_reqcert = str, None, Require TLS certificate verification +ldap_sasl_mech = str, None, Specify the sasl mechanism to use +ldap_sasl_authid = str, None, Specify the sasl authorization id to use +krb5_kdcip = str, None, Kerberos server address +krb5_realm = str, None, Kerberos realm +ldap_krb5_keytab = str, None, Kerberos service keytab +ldap_krb5_init_creds = bool, None, Use Kerberos auth for LDAP connection [provider/ldap/id] -ldap_search_timeout = int, None -ldap_enumeration_refresh_timeout = int, None -ldap_id_use_start_tls = bool, None, false -ldap_user_search_base = str, None -ldap_user_search_scope = str, None -ldap_user_search_filter = str, None -ldap_user_object_class = str, None -ldap_user_name = str, None -ldap_user_uid_number = str, None -ldap_user_gid_number = str, None -ldap_user_gecos = str, None -ldap_user_homedir = str, None -ldap_user_shell = str, None -ldap_user_uuid = str, None -ldap_user_principal = str, None -ldap_user_fullname = str, None -ldap_user_member_of = str, None -ldap_user_modify_timestamp = str, None -ldap_user_shadow_last_change = str, None -ldap_user_shadow_min = str, None -ldap_user_shadow_max = str, None -ldap_user_shadow_warning = str, None -ldap_user_shadow_inactive = str, None -ldap_user_shadow_expire = str, None -ldap_user_shadow_flag = str, None -ldap_user_krb_last_pwd_change = str, None -ldap_user_krb_password_expiration = str, None -ldap_pwd_attribute = str, None -ldap_group_search_base = str, None -ldap_group_search_scope = str, None -ldap_group_search_filter = str, None -ldap_group_object_class = str, None -ldap_group_name = str, None -ldap_group_gid_number = str, None -ldap_group_member = str, None -ldap_group_uuid = str, None -ldap_group_modify_timestamp = str, None -ldap_force_upper_case_realm = bool, None +ldap_search_timeout = int, None, Length of time to wait for a search request +ldap_enumeration_refresh_timeout = int, None, Length of time between enumeration updates +ldap_id_use_start_tls = bool, None, Require TLS for ID lookups, false +ldap_user_search_base = str, None, Base DN for user lookups +ldap_user_search_scope = str, None, Scope of user lookups +ldap_user_search_filter = str, None, Filter for user lookups +ldap_user_object_class = str, None, Objectclass for users +ldap_user_name = str, None, Username attribute +ldap_user_uid_number = str, None, UID attribute +ldap_user_gid_number = str, None, Primary GID attribute +ldap_user_gecos = str, None, GECOS attribute +ldap_user_homedir = str, None, Home directory attribute +ldap_user_shell = str, None, Shell attribute +ldap_user_uuid = str, None, UUID attribute +ldap_user_principal = str, None, User principal attribute (for Kerberos) +ldap_user_fullname = str, None, Full Name +ldap_user_member_of = str, None, memberOf attribute +ldap_user_modify_timestamp = str, None, Modification time attribute +ldap_user_shadow_last_change = str, None, Last change time for shadow +ldap_user_shadow_min = str, None, Password Minimum days +ldap_user_shadow_max = str, None, Password Maximum days +ldap_user_shadow_warning = str, None, Password expiration warning time +ldap_user_shadow_inactive = str, None, Account inactivity attribute +ldap_user_shadow_expire = str, None, Password expiration time +ldap_user_shadow_flag = str, None, Shadow passwd flags +ldap_user_krb_last_pwd_change = str, None, Last Kerberos password change time attribute +ldap_user_krb_password_expiration = str, None, Kerberos password expiration time attribute +ldap_pwd_attribute = str, None, Password attribute +ldap_group_search_base = str, None, Base DN for group lookups +ldap_group_search_scope = str, None, Scope for group lookups +ldap_group_search_filter = str, None, Filter for group lookups +ldap_group_object_class = str, None, Objectclass for groups +ldap_group_name = str, None, Groupname attribute +ldap_group_gid_number = str, None, GID attribute +ldap_group_member = str, None, Member attribute +ldap_group_uuid = str, None, Group UUID attribute +ldap_group_modify_timestamp = str, None, Last modification timestamp attribute +ldap_force_upper_case_realm = bool, None, Force upper-case realm names for Kerberos [provider/ldap/auth] diff --git a/server/config/etc/sssd.api.d/sssd-local.conf b/server/config/etc/sssd.api.d/sssd-local.conf index 48ffae2..d90e27d 100644 --- a/server/config/etc/sssd.api.d/sssd-local.conf +++ b/server/config/etc/sssd.api.d/sssd-local.conf @@ -1,8 +1,8 @@ [provider/local] [provider/local/id] -default_shell = str, None, /bin/bash -base_directory = str, None, /home +default_shell = str, None, Default shell, /bin/bash +base_directory = str, None, Base for home directories, /home [provider/local/auth] diff --git a/server/config/etc/sssd.api.d/sssd-proxy.conf b/server/config/etc/sssd.api.d/sssd-proxy.conf index cc34eea..8dc8850 100644 --- a/server/config/etc/sssd.api.d/sssd-proxy.conf +++ b/server/config/etc/sssd.api.d/sssd-proxy.conf @@ -1,7 +1,7 @@ [provider/proxy] [provider/proxy/id] -proxy_lib_name = str, None +proxy_lib_name = str, None, The name of the NSS library to use [provider/proxy/auth] -proxy_pam_target = str, None +proxy_pam_target = str, None, PAM stack to use -- 1.6.2.5