Xc @ s d d k l Z l Z l Z d d k Z d d k l Z l Z d d k l Z l Z l
Z
l Z l Z l
Z
d d k Td d k l Z d d k l Z l Z d d k l Z d d k l Z d d
k l Z d d k Z d d k l Z l Z l Z e i i o3 e i i d< j o d d k l Z d d k! Z! n e d Z" d Z# d Z$ e d d e d e d d e d f Z% e d
d e d e d d e d e d d e d e d d e d e d d e d f Z& e i' e i( d Z) d! Z* d" Z+ d# Z, d$ Z- d% Z. d& d' Z/ d( e0 f d) YZ1 e i2 e1 d* e3 f d+ YZ4 e i2 e4 d, e5 f d- YZ6 e i2 e6 d. e7 f d/ YZ8 e i2 e8 d0 e9 f d1 YZ: e i2 e: d2 e; f d3 YZ< e i2 e< d4 e= f d5 YZ> e i2 e> d6 e= f d7 YZ? e i2 e? d8 e= f d9 YZ@ e i2 e@ d: e= f d; YZA e i2 eA d S(= i( t gmtimet strftimet strptimeN( t apit errors( t Flagt Intt Passwordt Strt Boolt Bytes( t *( t context( t _t ngettext( t output( t ipa_generate_password( t Email( t normalize_sshpubkeyt validate_sshpubkeyt convert_sshpubkey_postt litet server( t ldap2s
Users
Manage user entries. All users are POSIX users.
IPA supports a wide range of username formats, but you need to be aware of any
restrictions that may apply to your particular environment. For example,
usernames that start with a digit or usernames that exceed a certain length
may cause problems for some UNIX systems.
Use 'ipa config-mod' to change the username format allowed by IPA tools.
Disabling a user account prevents that user from obtaining new Kerberos
credentials. It does not invalidate any credentials that have already
been issued.
Password management is not a part of this module. For more information
about this topic please see: ipa help passwd
Account lockout on password failure happens per IPA master. The user-status
command can be used to identify which master the user is locked out on.
It is on that master the administrator must unlock the user.
EXAMPLES:
Add a new user:
ipa user-add --first=Tim --last=User --password tuser1
Find all users whose entries include the string "Tim":
ipa user-find Tim
Find all users with "Tim" as the first name:
ipa user-find --first=Tim
Disable a user account:
ipa user-disable tuser1
Enable a user account:
ipa user-enable tuser1
Delete a user:
ipa user-del tuser1
t
__no_upg__i t
has_keytabt labels Kerberos keys availables sshpubkeyfp*s SSH public key fingerprintt Servert krbloginfailedcounts
Failed loginst krblastsuccessfulauths Last successful authenticationt krblastfailedauths Last failed authenticationt nows Time nows _,.@+-=c C s d | j o | d } t | t t f p_ t | t p t i d d n | i d j o" t i d d d t d q q n d S( Nt
nsaccountlockt attrt truet falset namet errors must be TRUE or FALSE( R" R# ( t
isinstancet boolR t
basestringR t OnlyOneValueAllowedt lowert ValidationErrorR
( t entry_attrsR ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyt validate_nsaccountlockt s
c C sF d | j o t | d R4 ( t ugettextR3 R= R: ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyt validate_principal s c C s& t | \ } } t d | | f S( s
Ensure that the name in the principal is lower-case. The realm is
upper-case by convention but it isn't required.
The principal is validated at this point.
s %s@%s( R> t unicode( R3 R= R: ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyt normalize_principal s u adminsc C s t i i d | } | d } g } | D]$ } | d p | | d d q* q* ~ } | | g j o( t i d | d t d d | n d
S( s{
Ensure the last enabled member of a protected group cannot be deleted or
disabled by raising LastMemberError.
t in_groupt resultR t uidi t keyR u groupt containerN( R t Commandt user_findR t LastMemberErrorR
( R= t protected_group_nameRD t _[1]t entryt
enabled_users( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyt check_protected_member s
8R= c * B s e Z d Z e i i Z e d Z e d Z d g Z
d Z d g Z d g Z
d Z d d d
d d d
d d d d d d d d g Z d d d
d d d d d d d
d d g Z d Z h d d d d d g d 6d d d d d g d 6Z e Z e Z d d g Z e d! Z e d" Z e d d# d$ d% d& d' d( d) d* d+ e d, d- e d. d/ d0 d1 e d d) d2 d+ e d3 e d
d) d4 d+ e d5 e d6 d+ e d7 d. d8 d9 e e d: d+ e d; d. d< d9 e e d= d+ e d> d. d? d9 e e d@ d) dA d+ e dB e dC d+ e dD d. dE d9 e e dF d) dG d+ e dH e dI e d) dJ d+ e dK d. dL d9 e dM dN g d0 dO e dP d) dQ d+ e dR e dS d) dT d+ e dU dV e dW dX dY e dZ dV e d[ dM d d^ e e d_ d+ e d` dM d e d
d) d d+ e db dV e dc d9 e d^ e dd de e d d+ e df dV e dg dd de d^ e d9 e e dh d) di d+ e dj e dk d) dl d+ e dm e dn d) do d+ e dp e dq d+ e dr e ds d) dt d+ e du e dv d+ e dw e dx d+ e dy e dz d) d{ d+ e d| e d} d) d~ d+ e d e d d+ e d e d d+ e d e d d+ e d e d d+ e d dM d g e d e! d) d d+ e d d0 e" d e dM d\ g f Z# d d Z% d Z& d Z' RS( s
User object.
R= t userst posixaccountt ipauserobjectclassest meporiginentryt krbticketpolicyauxt ipausersearchfieldsRE t givennamet snt
homedirectoryt
loginshellt uidnumbert gidnumbert mailt out telephonenumbert titlet memberofR t memberofindirectt sshpubkeyfpt ipauniqueidt groupt netgroupt rolet hbacrulet sudorulet userpasswordt has_passwordt krbprincipalkeyR t Userst Usert patterns4 ^[a-zA-Z0-9_.][a-zA-Z0-9_.-]{0,252}[a-zA-Z0-9_.$-]?$t pattern_errmsgs0 may only include letters, numbers, _, -, . and $t maxlengthi t cli_namet loginR s
User logint primary_keyt default_fromc C s | d | S( i ( ( RV RW ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyt s t
normalizerc C s
| i S( ( R* ( t value( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyRu s t firsts
First namet lasts Last namet cns Full namec C s d | | f S( s %s %s( ( RV RW ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyRu s t autofills displayname?s Display namec C s d | | f S( s %s %s( ( RV RW ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyRu s s initials?t Initialsc C s d | d | d f S( s %c%ci ( ( RV RW ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyRu s s homedirectory?t homedirs Home directorys gecos?s GECOS fieldc C s d | | f S( s %s %s( ( RV RW ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyRu s s loginshell?t shells Login shells krbprincipalname?R3 s Kerberos principalc C s d | i t i i f S( s %s@%s( R* R R9 R: ( RE ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyRu s t flagst no_updatec C s
t | S( ( RB ( Rw ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyRu s s mail*t emails
Email addresss
userpassword?t passwordR t docs Prompt to set the user passwordt excludet webuis random?s Generate a random user passwordt no_searcht virtual_attributet defaults randompassword?s Random passwordt no_createt UIDs7 User ID Number (system will assign one if not provided)t minvaluei t GIDs Group ID Numbers street?t streets Street addresss l?t cityt Citys st?t states State/Provinces postalcode?t ZIPs telephonenumber*t phones Telephone Numbers mobile*s Mobile Telephone Numbers pager*s Pager Numbers facsimiletelephonenumber*t faxs
Fax Numbers ou?t orgunits Org. Units title?s Job Titles manager?t Managers carlicense?s Car Licenses nsaccountlock?s Account disabledt no_options
ipasshpubkey*t sshpubkeys SSH public keyt csvc C sM | p | i i d } n | i d d g d } | o g } t | t t f p
| g } n x | D] } t | t os d | j o | o | d | } n t | p/ t i
d d d t d t d | n | i
| qn t | p/ t i
d d d t d t d | n | i
| qn W| S| S(
Ni t ipadefaultemaildomaini R2 u @R$ R R% s invalid e-mail format: %(email)s( t backendt get_ipa_configt getR4 R& t listt tupleR( R R R+ R
t dictt append( t selfR t configt
defaultdomaint
norm_emailt m( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyt _normalize_and_validate_emailu s(
/
/c
C s | p d St | t p
| g } n y t | i t i i } x t t | D]v } t | | t o | | i
| o qW n | i i | i
i | | | i d g | i \ } } | | | R4 R" R! R< t masterR; t
other_ldapt et newresultRM R! t newtimet time_format( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyR + s !
)
!
$
( R R R
R R t standard_list_of_entriesR* R% R
t status_output_paramsR ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyR3 s
( R s server(B RF R R R t stringt ipalibR R R R R R R R
t ipalib.plugins.baseldapt ipalib.requestR R
R R t ipapython.ipautilR t ipapython.ipavalidateR R t ipalib.utilR R R R9 t in_servert ipaserver.plugins.ldap2R RB R R R R RR t digitst
ascii_lettersR R- R1 R> R@ RB RO t
LDAPObjectR= t registerR R t
LDAPDeleteR R R R% RI R& R R- R' R+ R. R3 ( ( ( s7 /usr/lib/python2.6/site-packages/ipalib/plugins/user.pyt sv .
)
4
+
p