IPA ID Override classes for users and groups

[madhuriupadhye]

Add sub classes for IPA ID override for users
and groups.

[justin-stephenson]

Ack tests with the examples provided are passing for me.

[email protected](KnownTopology.IPA)
+def test_idview_override(client: Client, ipa: IPA):
+    ipa.idview("newview1").add(description="This is a new view")
+    ipa.idview("newview1").apply(hosts=f"{client.host.hostname}")
+    ipa.user("user-1").add().iduseroverride().add_override("newview1", uid=1344567)
+    client.sssd.restart()
+    lookup1 = client.tools.id("user-1")
+    assert lookup1.user.id == 1344567
+
[email protected](KnownTopology.IPA)
+def test_idview_views(ipa: IPA):
+    ipa.idview("newview").add(description="This is a new view")
+    ipa.idview("newview").apply(hosts="client.test")
+    ipa.idview("newview").delete()



tests/test_ipa.py::test_idview_override (ipa) PASSED                                    [ 50%]
tests/test_ipa.py::test_idview_views (ipa) PASSED                                       [100%]

[danlavu]

Some minor changes and one question about the clean data, I think we may have a function for it.

[danlavu]

sssd-test-framework/sssd_test_framework/misc/__init__.py

Line 67 in 824b493

def to_list(value: Any | list[Any] | None) -> list[Any]:

Is it possible that one of these functions cleans the data? If it doesn't, will it make sense that we had a function here?

[madhuriupadhye]

We can add as most of all ipa *-show or ipa *-find command give us output in following format where ----- are unnecessary in result.

[root@client ~]# ipa idoverrideuser-find newview1 user-2
--------------------------
1 User ID override matched
--------------------------
  Anchor to override: user-2
  User login: newuser
  UID: 1234567
  GECOS: This is the ID user override
  GID: 7654321
  Home directory: /home/newhomedir
  Login shell: /bin/newloginshell
----------------------------
Number of entries returned 1
----------------------------

[danlavu]

We can add as most of all ipa *-show or ipa *-find command give us output in following format where ----- are unnecessary in result.

So Pavel converts the output into a dict of lists. I'd like to see the same method used, so instead of a list, a dict[str, list[str]]

The output in the same for all of the ipa commands it seems, can we make this consistent?

[root@master /]# ipa user-find admin --raw
--------------
1 user matched
--------------
  dn: uid=admin,cn=users,cn=accounts,dc=ipa,dc=test
  uid: admin
  sn: Administrator
  cn: Administrator
  homedirectory: /home/admin
  gecos: Administrator
  loginshell: /bin/bash
  krbprincipalname: [email protected]
  krbprincipalname: [email protected]
  uidnumber: 1636200000
  gidnumber: 1636200000
  nsaccountlock: FALSE
  ipaNTSecurityIdentifier: S-1-5-21-1061865485-3290583131-1435945682-500
  ipaUniqueID: 98064296-fc8b-11ef-9e81-ae6dd4cde335
  krbExtraData: AAKs+cxnYWRtaW5ASVBBLlRFU1QA
  krbLastAdminUnlock: 20250309021404Z
  krbLastPwdChange: 20250309021508Z
  krbPwdPolicyReference: cn=pw-never-expires,cn=IPA.TEST,cn=kerberos,dc=ipa,dc=test
  memberOf: cn=admins,cn=groups,cn=accounts,dc=ipa,dc=test
  memberOf: cn=Replication Administrators,cn=privileges,cn=pbac,dc=ipa,dc=test
  memberOf: cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=Modify DNA Range,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=Read Replication Changelog Configuration,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=Write Replication Changelog Configuration,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=Read DNA Range,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=Read domain level,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=System: Add Topology Segments,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=System: Modify Topology Segments,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=System: Read Topology Segments,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=System: Remove Topology Segments,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=Host Enrollment,cn=privileges,cn=pbac,dc=ipa,dc=test
  memberOf: cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=ipa,dc=test
  memberOf: cn=trust admins,cn=groups,cn=accounts,dc=ipa,dc=test
  memberOf: cn=pw-never-expires,cn=groups,cn=accounts,dc=ipa,dc=test
  objectClass: top
  objectClass: person
  objectClass: posixaccount
  objectClass: krbprincipalaux
  objectClass: krbticketpolicyaux
  objectClass: inetuser
  objectClass: ipaobject
  objectClass: ipasshuser
  objectClass: ipaSshGroupOfPubKeys
  objectClass: ipaNTUserAttrs
----------------------------
Number of entries returned 1
----------------------------

    def get(self, attrs: list[str] | None = None) -> dict[str, list[str]] | None:
        """
        Get IPA object attributes.

        :param attrs: If set, only requested attributes are returned, defaults to None
        :type attrs: list[str] | None, optional
        :return: Dictionary with attribute name as a key or None if no such attribute is found.
        :rtype: dict[str, list[str]] | None
        """
        cmd = self._exec("show", ["--all", "--raw"], raise_on_error=False)

        # ipa output starts with space
        lines = dedent(cmd.stdout).splitlines()

        if lines is None or len(lines) == 0:
            return None

        # Remove first line that contains the object name and not attribute
        return attrs_parse(lines[1:], attrs)

def attrs_parse(lines: list[str], attrs: list[str] | None = None) -> dict[str, list[str]]:
    """
    Parse LDAP attributes from output.

    :param lines: Output.
    :type lines: list[str]
    :param attrs: If set, only requested attributes are returned, defaults to None
    :type attrs: list[str] | None, optional
    :return: Dictionary with attribute name as a key.
    :rtype: dict[str, list[str]]
    """

[madhuriupadhye]

Got an idea, updating

[alexey-tikhonov]

Ack tests with the examples provided are passing for me.

[email protected](KnownTopology.IPA)
+def test_idview_override(client: Client, ipa: IPA):
+    ipa.idview("newview1").add(description="This is a new view")

Where is idview() method added?

I pinned this branch and added this test (SSSD/sssd@4914992) and it failed for me with:

E       AttributeError: 'IPA' object has no attribute 'idview'

What did I miss?

[danlavu]

What did I miss?

this PR needs #146

[alexey-tikhonov]

What did I miss?

this PR needs #146

Hm... what sense does it make to split over 2 PRs?

[danlavu]

Hm... what sense does it make to split over 2 PRs?

It doesn't, learning experience, I mentioned that it should be in one PR, two commits next time.