From 85293744afb352b912ff36e750fa4c7107f2d99f Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Fri, 30 Oct 2009 15:26:54 -0400
Subject: [PATCH] Add support for option descriptions to SSSDConfig API

Addresses https://fedorahosted.org/sssd/ticket/242 related to
authconfig integration
---
 server/config/SSSDConfig.py                  |   41 ++++++---
 server/config/SSSDConfigTest.py              |    8 +-
 server/config/etc/sssd.api.conf              |   65 ++++++++--------
 server/config/etc/sssd.api.d/sssd-ipa.conf   |    6 +-
 server/config/etc/sssd.api.d/sssd-krb5.conf  |   12 ++--
 server/config/etc/sssd.api.d/sssd-ldap.conf  |  110 +++++++++++++-------------
 server/config/etc/sssd.api.d/sssd-local.conf |    4 +-
 server/config/etc/sssd.api.d/sssd-proxy.conf |    4 +-
 8 files changed, 130 insertions(+), 120 deletions(-)

diff --git a/server/config/SSSDConfig.py b/server/config/SSSDConfig.py
index 578f292..8879330 100644
--- a/server/config/SSSDConfig.py
+++ b/server/config/SSSDConfig.py
@@ -25,6 +25,12 @@ class NoSuchProviderError(SSSDConfigException): pass
 class NoSuchProviderSubtypeError(SSSDConfigException): pass
 class ProviderSubtypeInUse(SSSDConfigException): pass
 
+# Indexes
+PRIMARY_TYPE = 0
+SUBTYPE = 1
+DESC = 2
+DEFAULT = 3
+
 class SSSDConfigSchema(RawConfigParser):
     def __init__(self, schemafile, schemaplugindir):
         #TODO: get these from a global setting
@@ -81,33 +87,38 @@ class SSSDConfigSchema(RawConfigParser):
             split_option = self._striplist(unparsed_option.split(','))
             optionlen = len(split_option)
 
-            primarytype = self.type_lookup[split_option[0]]
-            subtype = self.type_lookup[split_option[1]]
+            primarytype = self.type_lookup[split_option[PRIMARY_TYPE]]
+            subtype = self.type_lookup[split_option[SUBTYPE]]
+            desc = unicode(split_option[DESC])
 
-            if optionlen == 2:
+            if optionlen == 3:
                 # This option has no defaults
                 parsed_options[option] = \
                     (primarytype,
                      subtype,
+                     desc,
                      None)
-            elif optionlen == 3:
-                if type(split_option[2]) == primarytype:
+            elif optionlen == 4:
+                if type(split_option[DEFAULT]) == primarytype:
                     parsed_options[option] = \
                         (primarytype,
                          subtype,
-                         split_option[2])
+                         desc,
+                         split_option[DEFAULT])
                 elif primarytype == list:
-                    if (type(split_option[2]) == subtype):
+                    if (type(split_option[DEFAULT]) == subtype):
                         parsed_options[option] = \
                             (primarytype,
                              subtype,
-                             [split_option[2]])
+                             desc,
+                             [split_option[DEFAULT]])
                     else:
                         try:
                             parsed_options[option] = \
                                 (primarytype,
                                  subtype,
-                                 [subtype(split_option[2])])
+                                 desc,
+                                 [subtype(split_option[DEFAULT])])
                         except ValueError:
                             raise ParsingError
                 else:
@@ -115,15 +126,16 @@ class SSSDConfigSchema(RawConfigParser):
                         parsed_options[option] = \
                             (primarytype,
                              subtype,
-                             primarytype(split_option[2]))
+                             desc,
+                             primarytype(split_option[DEFAULT]))
                     except ValueError:
                         raise ParsingError
 
-            elif optionlen > 3:
+            elif optionlen > 4:
                 if (primarytype != list):
                     raise ParsingError
                 fixed_options = []
-                for x in split_option[2:]:
+                for x in split_option[DEFAULT:]:
                     if type(x) != subtype:
                         try:
                             fixed_options.extend([subtype(x)])
@@ -134,6 +146,7 @@ class SSSDConfigSchema(RawConfigParser):
                 parsed_options[option] = \
                     (primarytype,
                      subtype,
+                     desc,
                      fixed_options)
             else:
                 # Bad config file
@@ -155,9 +168,9 @@ class SSSDConfigSchema(RawConfigParser):
             raise NoSectionError(section)
 
         schema_options = self.get_options(section)
-        defaults = dict([(x,schema_options[x][2])
+        defaults = dict([(x,schema_options[x][DEFAULT])
                          for x in schema_options.keys()
-                         if schema_options[x][2] != None])
+                         if schema_options[x][DEFAULT] != None])
 
         return defaults
 
diff --git a/server/config/SSSDConfigTest.py b/server/config/SSSDConfigTest.py
index 96a650a..f99f672 100644
--- a/server/config/SSSDConfigTest.py
+++ b/server/config/SSSDConfigTest.py
@@ -239,7 +239,7 @@ class SSSDConfigTestSSSDService(unittest.TestCase):
         self.assertTrue(options['reconnection_retries'][0] == int,
                         "reconnection_retries should default to 2. " +
                         "list_options specifies %d" %
-                        options['reconnection_retries'][2])
+                        options['reconnection_retries'][3])
 
         self.assertTrue(type(options['services']) == tuple,
                         "Option values should be a tuple")
@@ -408,7 +408,6 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
             'max_id',
             'timeout',
             'command',
-            'magic_private_groups',
             'enumerate',
             'cache_credentials',
             'store_legacy_passwords',
@@ -438,12 +437,12 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
                         "Option values should be a tuple")
 
         self.assertTrue(options['max_id'][0] == int,
-                        "config_file_version should require an int. " +
+                        "max_id should require an int. " +
                         "list_options is requiring a %s" %
                         options['max_id'][0])
 
         self.assertTrue(options['max_id'][1] == None,
-                        "config_file_version should not require a subtype. " +
+                        "max_id should not require a subtype. " +
                         "list_options is requiring a %s" %
                         options['max_id'][1])
 
@@ -628,7 +627,6 @@ class SSSDConfigTestSSSDDomain(unittest.TestCase):
             'max_id',
             'timeout',
             'command',
-            'magic_private_groups',
             'enumerate',
             'cache_credentials',
             'store_legacy_passwords',
diff --git a/server/config/etc/sssd.api.conf b/server/config/etc/sssd.api.conf
index de2af83..c7e94a8 100644
--- a/server/config/etc/sssd.api.conf
+++ b/server/config/etc/sssd.api.conf
@@ -3,52 +3,51 @@
 
 [service]
 # Options available to all services
-debug_level = int, None, 0
-debug_timestamps = bool, None
-debug_to_files = bool, None
-command = str, None
-reconnection_retries = int, None, 3
+debug_level = int, None, Set the verbosity of the debug logging, 0
+debug_timestamps = bool, None, Include timestamps in debug logs
+debug_to_files = bool, None, Write debug messages to logfiles
+timeout = int, None, Ping timeout before restarting service
+command = str, None, Command to start service
+reconnection_retries = int, None, Number of times to attempt connection to Data Providers before giving up, 3
 
 [sssd]
 # Monitor service
-services = list, str, nss, pam
-domains = list, str
-timeout = int, None
-sbus_timeout = int, None
-re_expression = str, None
-full_name_format = str, None
+services = list, str, SSSD Services to start, nss, pam
+domains = list, str, SSSD Domains to start
+sbus_timeout = int, None, Timeout for messages sent over the SBUS
+re_expression = str, None, Regex to parse username and domain
+full_name_format = str, None, Printf-compatible format for displaying fully-qualified names
 
 [nss]
 # Name service
-enum_cache_timeout = int, None
-entry_cache_no_wait_timeout = int, None
-entry_negative_timeout = int, None
-filter_users = list, str, root
-filter_groups = list, str, root
-filter_users_in_groups = bool, None, true
+enum_cache_timeout = int, None, Enumeration cache timeout length (seconds)
+entry_cache_no_wait_timeout = int, None, Entry cache background update timeout length (seconds)
+entry_negative_timeout = int, None, Negative cache timeout length (seconds)
+filter_users = list, str, Users that SSSD should explicitly ignore,root
+filter_groups = list, str, Groups that SSSD should explicitly ignore, root
+filter_users_in_groups = bool, None, Should filtered users appear in groups, true
 
 [pam]
 # Authentication service
-offline_credentials_expiration = int, None
+offline_credentials_expiration = int, None, How long to allow cached logins between online logins (days)
 
 [provider]
 #Available provider types
-id_provider = str, None
-auth_provider = str, None
-access_provider = str, None
-chpass_provider = str, None
+id_provider = str, None, Identity provider
+auth_provider = str, None, Authentication provider
+access_provider = str, None, Access control provider
+chpass_provider = str, None, Password change provider
 
 [domain]
 # Options available to all domains
-debug_level = int, None, 0
-command = str, None
-min_id = int, None, 1000
-max_id = int, None
-timeout = int, None, 0
-magic_private_groups = bool, None, false
-enumerate = bool, None, true
-cache_credentials = bool, None, false
-store_legacy_passwords = bool, None, false
-use_fully_qualified_names = bool, None, false
-entry_cache_timeout = int, None
+debug_level = int, None, Set the verbosity of the debug logging, 0
+command = str, None, Command to start domain
+min_id = int, None, Minimum user id, 1000
+max_id = int, None, Maximum user id
+timeout = int, None, Ping timeout before restarting domain
+enumerate = bool, None, Enable enumerating all users/groups, true
+cache_credentials = bool, None, Cache credentials for offline login, false
+store_legacy_passwords = bool, None, Store password hashes, false
+use_fully_qualified_names = bool, None, Display users/groups in fully-qualified form, false
+entry_cache_timeout = int, None, Entry cache timeout length (seconds)
 
diff --git a/server/config/etc/sssd.api.d/sssd-ipa.conf b/server/config/etc/sssd.api.d/sssd-ipa.conf
index 3b42111..c9031ce 100644
--- a/server/config/etc/sssd.api.d/sssd-ipa.conf
+++ b/server/config/etc/sssd.api.d/sssd-ipa.conf
@@ -1,4 +1,4 @@
 [provider/ipa]
-ipa_domain = str, None
-ipa_server = str, None
-ipa_hostname = str, None
+ipa_domain = str, None, IPA domain
+ipa_server = str, None, IPA server address
+ipa_hostname = str, None, IPA client hostname
diff --git a/server/config/etc/sssd.api.d/sssd-krb5.conf b/server/config/etc/sssd.api.d/sssd-krb5.conf
index 85067e9..848da74 100644
--- a/server/config/etc/sssd.api.d/sssd-krb5.conf
+++ b/server/config/etc/sssd.api.d/sssd-krb5.conf
@@ -1,13 +1,13 @@
 [provider/krb5]
-krb5_kdcip = str, None
-krb5_realm = str, None
-krb5_auth_timeout = int, None
+krb5_kdcip = str, None, Kerberos server address
+krb5_realm = str, None, Kerberos realm
+krb5_auth_timeout = int, None, Authentication timeout
 
 [provider/krb5/auth]
-krb5_ccachedir = str, None
-krb5_ccname_template = str, None
+krb5_ccachedir = str, None, Directory to store credential caches
+krb5_ccname_template = str, None, Location of the user's credential cache
 
 [provider/krb5/access]
 
 [provider/krb5/chpass]
-krb5_changepw_principal = str, None
\ No newline at end of file
+krb5_changepw_principal = str, None, The principle of the change password service
\ No newline at end of file
diff --git a/server/config/etc/sssd.api.d/sssd-ldap.conf b/server/config/etc/sssd.api.d/sssd-ldap.conf
index 1c094f6..c49c6e2 100644
--- a/server/config/etc/sssd.api.d/sssd-ldap.conf
+++ b/server/config/etc/sssd.api.d/sssd-ldap.conf
@@ -1,61 +1,61 @@
 [provider/ldap]
-ldap_uri = str, None, ldap://localhost
-ldap_search_base = str, None
-ldap_schema = str, None, rfc2307
-ldap_default_bind_dn = str, None
-ldap_default_authtok_type = str, None
-ldap_default_authtok = str, None
-ldap_network_timeout = int, None
-ldap_opt_timeout = int, None
-ldap_offline_timeout = int, None
-ldap_tls_cacert = str, None
-ldap_tls_reqcert = str, None
-ldap_sasl_mech = str, None
-ldap_sasl_authid = str, None
-krb5_kdcip = str, None
-krb5_realm = str, None
-ldap_krb5_keytab = str, None
-ldap_krb5_init_creds = bool, None
+ldap_uri = str, None, ldap_uri, The URI of the LDAP server
+ldap_search_base = str, None, The default base DN
+ldap_schema = str, None, The Schema Type in use on the LDAP server, rfc2307
+ldap_default_bind_dn = str, None, The default bind DN
+ldap_default_authtok_type = str, None, The type of the authentication token of the default bind DN
+ldap_default_authtok = str, None, The authentication token of the default bind DN
+ldap_network_timeout = int, None, Length of time to attempt connection
+ldap_opt_timeout = int, None, Length of time to attempt synchronous LDAP operations
+ldap_offline_timeout = int, None, Length of time between attempts to reconnect while offline
+ldap_tls_cacert = str, None, file that contains CA certificates
+ldap_tls_reqcert = str, None, Require TLS certificate verification
+ldap_sasl_mech = str, None, Specify the sasl mechanism to use
+ldap_sasl_authid = str, None, Specify the sasl authorization id to use
+krb5_kdcip = str, None, Kerberos server address
+krb5_realm = str, None, Kerberos realm
+ldap_krb5_keytab = str, None, Kerberos service keytab
+ldap_krb5_init_creds = bool, None, Use Kerberos auth for LDAP connection
 
 [provider/ldap/id]
-ldap_search_timeout = int, None
-ldap_enumeration_refresh_timeout = int, None
-ldap_id_use_start_tls = bool, None, false
-ldap_user_search_base = str, None
-ldap_user_search_scope = str, None
-ldap_user_search_filter = str, None
-ldap_user_object_class = str, None
-ldap_user_name = str, None
-ldap_user_uid_number = str, None
-ldap_user_gid_number = str, None
-ldap_user_gecos = str, None
-ldap_user_homedir = str, None
-ldap_user_shell = str, None
-ldap_user_uuid = str, None
-ldap_user_principal = str, None
-ldap_user_fullname = str, None
-ldap_user_member_of = str, None
-ldap_user_modify_timestamp = str, None
-ldap_user_shadow_last_change = str, None
-ldap_user_shadow_min = str, None
-ldap_user_shadow_max = str, None
-ldap_user_shadow_warning = str, None
-ldap_user_shadow_inactive = str, None
-ldap_user_shadow_expire = str, None
-ldap_user_shadow_flag = str, None
-ldap_user_krb_last_pwd_change = str, None
-ldap_user_krb_password_expiration = str, None
-ldap_pwd_attribute = str, None
-ldap_group_search_base = str, None
-ldap_group_search_scope = str, None
-ldap_group_search_filter = str, None
-ldap_group_object_class = str, None
-ldap_group_name = str, None
-ldap_group_gid_number = str, None
-ldap_group_member = str, None
-ldap_group_uuid = str, None
-ldap_group_modify_timestamp = str, None
-ldap_force_upper_case_realm = bool, None
+ldap_search_timeout = int, None, Length of time to wait for a search request
+ldap_enumeration_refresh_timeout = int, None, Length of time between enumeration updates
+ldap_id_use_start_tls = bool, None, Require TLS for ID lookups, false
+ldap_user_search_base = str, None, Base DN for user lookups
+ldap_user_search_scope = str, None, Scope of user lookups
+ldap_user_search_filter = str, None, Filter for user lookups
+ldap_user_object_class = str, None, Objectclass for users
+ldap_user_name = str, None, Username attribute
+ldap_user_uid_number = str, None, UID attribute
+ldap_user_gid_number = str, None, Primary GID attribute
+ldap_user_gecos = str, None, GECOS attribute
+ldap_user_homedir = str, None, Home directory attribute
+ldap_user_shell = str, None, Shell attribute
+ldap_user_uuid = str, None, UUID attribute
+ldap_user_principal = str, None, User principal attribute (for Kerberos)
+ldap_user_fullname = str, None, Full Name
+ldap_user_member_of = str, None, memberOf attribute
+ldap_user_modify_timestamp = str, None, Modification time attribute
+ldap_user_shadow_last_change = str, None, Last change time for shadow
+ldap_user_shadow_min = str, None, Password Minimum days
+ldap_user_shadow_max = str, None, Password Maximum days
+ldap_user_shadow_warning = str, None, Password expiration warning time
+ldap_user_shadow_inactive = str, None, Account inactivity attribute
+ldap_user_shadow_expire = str, None, Password expiration time
+ldap_user_shadow_flag = str, None, Shadow passwd flags
+ldap_user_krb_last_pwd_change = str, None, Last Kerberos password change time attribute
+ldap_user_krb_password_expiration = str, None, Kerberos password expiration time attribute
+ldap_pwd_attribute = str, None, Password attribute
+ldap_group_search_base = str, None, Base DN for group lookups
+ldap_group_search_scope = str, None, Scope for group lookups
+ldap_group_search_filter = str, None, Filter for group lookups
+ldap_group_object_class = str, None, Objectclass for groups
+ldap_group_name = str, None, Groupname attribute
+ldap_group_gid_number = str, None, GID attribute
+ldap_group_member = str, None, Member attribute
+ldap_group_uuid = str, None, Group UUID attribute
+ldap_group_modify_timestamp = str, None, Last modification timestamp attribute
+ldap_force_upper_case_realm = bool, None, Force upper-case realm names for Kerberos
 
 [provider/ldap/auth]
 
diff --git a/server/config/etc/sssd.api.d/sssd-local.conf b/server/config/etc/sssd.api.d/sssd-local.conf
index 48ffae2..d90e27d 100644
--- a/server/config/etc/sssd.api.d/sssd-local.conf
+++ b/server/config/etc/sssd.api.d/sssd-local.conf
@@ -1,8 +1,8 @@
 [provider/local]
 
 [provider/local/id]
-default_shell = str, None, /bin/bash
-base_directory = str, None, /home
+default_shell = str, None, Default shell, /bin/bash
+base_directory = str, None, Base for home directories, /home
 
 [provider/local/auth]
 
diff --git a/server/config/etc/sssd.api.d/sssd-proxy.conf b/server/config/etc/sssd.api.d/sssd-proxy.conf
index cc34eea..8dc8850 100644
--- a/server/config/etc/sssd.api.d/sssd-proxy.conf
+++ b/server/config/etc/sssd.api.d/sssd-proxy.conf
@@ -1,7 +1,7 @@
 [provider/proxy]
 
 [provider/proxy/id]
-proxy_lib_name = str, None
+proxy_lib_name = str, None, The name of the NSS library to use
 
 [provider/proxy/auth]
-proxy_pam_target = str, None
+proxy_pam_target = str, None, PAM stack to use
-- 
1.6.2.5

