Xc @ s, d d k l Z d d k l Z l Z d d k Td d k l Z l Z e i i oI e i i d* j o6 y d d k
Z e Z
Wq e j
o
e Z
q Xn e d Z d+ Z d e f d
YZ e i e e d d d d e d d e d d e d d d d g Z d e f d YZ e i e d e f d YZ e i e d e f d YZ e i e d e f d! YZ e i e d" e f d# YZ e i e d$ e f d% YZ! e i e! d& e" f d' YZ# e i e# d( e$ f d) YZ% e i e% d S(, i( t api( t Intt Str( t *( t _t ngettextt litet serverNsA
Groups of users
Manage groups of users. By default, new groups are POSIX groups. You
can add the --nonposix option to the group-add command to mark a new group
as non-POSIX. You can use the --posix argument with the group-mod command
to convert a non-POSIX group into a POSIX group. POSIX groups cannot be
converted to non-POSIX groups.
Every group must have a description.
POSIX groups must have a Group ID (GID) number. Changing a GID is
supported but can have an impact on your file permissions. It is not necessary
to supply a GID when creating a group. IPA will generate one automatically
if it is not provided.
EXAMPLES:
Add a new group:
ipa group-add --desc='local administrators' localadmins
Add a new non-POSIX group:
ipa group-add --nonposix --desc='remote administrators' remoteadmins
Convert a non-POSIX group to posix:
ipa group-mod --posix remoteadmins
Add a new POSIX group with a specific Group ID number:
ipa group-add --gid=500 --desc='unix admins' unixadmins
Add a new POSIX group and let IPA assign a Group ID number:
ipa group-add --desc='printer admins' printeradmins
Remove a group:
ipa group-del unixadmins
To add the "remoteadmins" group to the "localadmins" group:
ipa group-add-member --groups=remoteadmins localadmins
Add a list of users to the "localadmins" group:
ipa group-add-member --users=test1,test2 localadmins
Remove a user from the "localadmins" group:
ipa group-remove-member --users=test2 localadmins
Display information about a named group.
ipa group-show localadmins
External group membership is designed to allow users from trusted domains
to be mapped to local POSIX groups in order to actually use IPA resources.
External members should be added to groups that specifically created as
external and non-POSIX. Such group later should be included into one of POSIX
groups.
An external group member is currently a Security Identifier (SID) as defined by
the trusted domain. When adding external group members, it is possible to
specify them in either SID, or DOM\name, or name@domain format. IPA will attempt
to resolve passed name to SID with the use of Global Catalog of the trusted domain.
Example:
1. Create group for the trusted domain admins' mapping and their local POSIX group:
ipa group-add --desc=' admins external map' ad_admins_external --external
ipa group-add --desc=' admins' ad_admins
2. Add security identifier of Domain Admins of the to the ad_admins_external
group:
ipa group-add-member ad_admins_external --external 'AD\Domain Admins'
3. Allow members of ad_admins_external group to be associated with ad_admins POSIX group:
ipa group-add-member ad_admins --groups ad_admins_external
4. List members of external members of ad_admins_external group to see their SIDs:
ipa group-show ad_admins_external
u adminsu trust adminsu default smb groupt groupc B sz e Z d Z e i i Z e d Z e d Z d g Z
d Z d d d g Z d Z
d d
d d d
d d d g Z d Z h d d g d 6d d d d d g d
6d d g d 6d d d d d g d 6Z e Z e d Z e d Z e d d d d d d d d d d! e d" d# e d$ d% e d
d d& d! e d' d( e d) e d* d d+ d! e d, d( e d- d. d/ f Z RS(0 s
Group object.
R t groupst ipausergroupt ipagroupobjectclassest
posixGroupt mepManagedEntryt ipaExternalGroupt ipagroupsearchfieldst cnt descriptiont gidnumbert membert memberoft memberindirectt memberofindirectt ipaexternalmembert ipauniqueidt usert netgroupt rolet hbacrulet sudorules User Groupss
User Groupt patterns4 ^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$t pattern_errmsgs0 may only include letters, numbers, _, -, . and $t maxlengthi t cli_namet
group_namet labels
Group namet primary_keyt
normalizerc C s
| i S( ( t lower( t value( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/group.pyt s t desct Descriptiont docs Group descriptions
gidnumber?t gidt GIDs( GID (use this option to set it manually)t minvaluei ( t __name__t
__module__t __doc__R t envt container_groupt container_dnR t object_namet object_name_pluralt object_classt object_class_configt possible_objectclassest search_attributes_configt default_attributest uuid_attributet attribute_memberst Truet rdn_is_primary_keyR# t label_singularR R t takes_params( ( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/group.pyR r sJ
s ipaexternalmember*R! t externalR# s External memberR+ sS comma-separated list of members of a trusted domain in DOM\name or name@domain formt csvt flagst no_createt no_updatet no_searcht group_addc
B sx e Z e d Z e d Z e i e d d d d e d d e e d d d d e d d e f Z d Z RS(
s Create a new group.s Added group "%(value)s"t nonposixR! R+ s Create as a non-POSIX groupt defaultRB s: Allow adding external non-IPA members from trusted domainsc O s | d o8 | d i d d | j o t i d d q~ n< | d p0 | d i d d | j o d | d t PROTECTED_GROUPSt ProtectedEntryErrorR t ManagedGroupError(
RR RS RT RW RX t configt def_primary_groupt def_primary_group_dnt group_dnt group_attrs( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/group.pyRY s
c O s6 y t i d | d Wn t i j
o n Xt S( Nt pwpolicy_deli( R t CommandRP t NotFoundR> ( RR RS RT RW RX ( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/group.pyt
post_callback s
( R/ R0 R R1 RZ RY Rz ( ( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/group.pyR_ s t group_modc
B s{ e Z e d Z e d Z e i e d d d d e d e d d d d e d d e f Z d Z d
Z
RS( s Modify a group.s Modified group "%(value)s"t posixR! R+ s change to a POSIX groupRB s? change to support external non-IPA members from trusted domainsRJ c O s
| d t j } d | j o1 | o& t i d d d | d d d qN n d | j o | d p
d | j o | i | d
g \ } } d | d
j o t i n d | d
j o | d o t i qq | d
i d | d
| d
s t external_callback_normalize( t _dcerpc_bindings_installedRP Ry R t ipaservert dcerpct DomainValidatorR t
is_configuredt is_trusted_sid_validRO t get_sid_trusted_domain_objectR t unicodeR t ValidationErrort listt add_external_post_callbackR^ ( RR RS t completedt failedRT RU RW RX Rc t domain_validatort sidst failed_sidst sidt
actual_sidt restore( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/group.pyRz q s:
( R/ R0 R R1 R R\ Rz ( ( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/group.pyR l s t group_remove_memberc B s/ e Z e d Z e f Z d Z d Z RS( s Remove members from a group.c O s | d t j o | d } t i i | } t | d i d g } t | d }
| i |
o2 t i d t |
d d t
d d | q n | S( Ni Rc t member_userR Rd R# u groupt container( Ro R Rx R t setRh t issubsetRP t LastMemberErrort sortedR ( RR RS RT t foundt not_foundRW RX t protected_group_nameRc t
users_leftt
users_deleted( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/group.pyRY s
c O s | | f } d | j o | d } t }
d | j o# d | d j o | d d }
n t d | D | d d s ( R t remove_external_post_callback( RR RS R R RT RU RW RX Rc R R ( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/group.pyRz s
( R/ R0 R R1 R R\ RY Rz ( ( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/group.pyR s t group_detachc B s2 e Z e d Z e i Z e d Z d Z RS( s# Detach a managed group from a user.s0 Detached group "%(value)s" from user "%(value)s"c O s | i i } | i i | | } | i i d i | } y | i | \ } } Wn& t i j
o | i i | n X| i i | d d } | i
| d p | i
| d o# | o t i d t d n | i | \ } } | i i | d d } | i
| d p | i
| d o# | o t i d t d n | d } y> | i
d
}
| |
=h | d 6d d 6} | i | | Wn t j
o n X| i | \ } } | d } y | i
d }
Wn+ t j
o t i d t d n X| |
=| i d
} | i | i i | }
t t |
| } h | d 6d d 6} | i | | t d t d | d S( s#
This requires updating both the user and the group. We first need to
verify that both the user and group can be updated, then we go
about our work. We don't want a situation where only the user or
group can be modified and we're left in a bad state.
R RK t mepmanagedentryR
t infos" not allowed to modify user entriesRf t mepManagedBys# not allowed to modify group entriest mepOriginEntryRe s Not a managed groupi Rc R' i N( Ri t backendRj R t ObjectR~ RP Ry t handle_not_foundt has_objectclasst can_writet ACIErrorR t indexR R t
ValueErrorRg Rh R8 R R t dictR> ( RR RW RX RS Ru t user_dnt
user_attrst
is_managedRv t
objectclassest it update_attrsRr t def_objectclass( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/group.pyt execute sP
( R/ R0 R R1 t outputt standard_valuet
has_outputRZ R ( ( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/group.pyR s ( R R ( u adminsu trust adminsu default smb group(& t ipalibR R R t ipalib.plugins.baseldapR R R2 t in_servert contextt ipaserver.dcerpcR R> R t ImportErrorR^ R1 Ro t
LDAPObjectR t registerR R[ RH t
LDAPDeleteR_ R R{ R R R R t
LDAPAddMemberR t LDAPRemoveMemberR t LDAPQueryR ( ( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/group.pyt sH
N 3
"
C
'
)
D