193 lines
6.3 KiB
Diff
193 lines
6.3 KiB
Diff
From cd5b6cdcf3e6bfc5776f2865f460f608421dfa3f Mon Sep 17 00:00:00 2001
|
|
From: Sumit Bose <sbose@redhat.com>
|
|
Date: Mon, 14 Jun 2021 08:42:21 +0200
|
|
Subject: [PATCH 5/5] Add delattr option
|
|
|
|
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1690920
|
|
---
|
|
doc/adcli.xml | 11 ++++++++
|
|
library/adenroll.c | 66 ++++++++++++++++++++++++++++++++++++++++++++++
|
|
library/adenroll.h | 4 +++
|
|
tools/computer.c | 9 +++++++
|
|
4 files changed, 90 insertions(+)
|
|
|
|
diff --git a/doc/adcli.xml b/doc/adcli.xml
|
|
index 8383aa7..bcf4857 100644
|
|
--- a/doc/adcli.xml
|
|
+++ b/doc/adcli.xml
|
|
@@ -577,6 +577,17 @@ $ adcli update --login-ccache=/tmp/krbcc_123
|
|
adcli options cannot be set with this option.</para>
|
|
</listitem>
|
|
</varlistentry>
|
|
+ <varlistentry>
|
|
+ <term><option>--delattr=<parameter>name</parameter></option></term>
|
|
+ <listitem><para>Remove the LDAP attribute
|
|
+ <option><parameter>name</parameter></option> from the
|
|
+ LDAP host object. This option can be used multiple
|
|
+ times to remove multiple different attributes.</para>
|
|
+ <para>Please note that the account used to update the
|
|
+ host object must have the required privileges to delete
|
|
+ the given attributes. Attributes managed by other adcli
|
|
+ options cannot be removed.</para></listitem>
|
|
+ </varlistentry>
|
|
<varlistentry>
|
|
<term><option>--show-details</option></term>
|
|
<listitem><para>After a successful join print out information
|
|
diff --git a/library/adenroll.c b/library/adenroll.c
|
|
index dd51567..9a06d52 100644
|
|
--- a/library/adenroll.c
|
|
+++ b/library/adenroll.c
|
|
@@ -151,6 +151,7 @@ struct _adcli_enroll {
|
|
int account_disable_explicit;
|
|
char *description;
|
|
char **setattr;
|
|
+ char **delattr;
|
|
};
|
|
|
|
static const char *
|
|
@@ -845,6 +846,39 @@ get_mods_for_attrs (adcli_enroll *enroll, int mod_op)
|
|
return mods;
|
|
}
|
|
|
|
+static LDAPMod **
|
|
+get_del_mods_for_attrs (adcli_enroll *enroll, int mod_op)
|
|
+{
|
|
+ size_t len;
|
|
+ size_t c;
|
|
+ LDAPMod **mods = NULL;
|
|
+
|
|
+ len = _adcli_strv_len (enroll->delattr);
|
|
+ if (len == 0) {
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ mods = calloc (len + 1, sizeof (LDAPMod *));
|
|
+ return_val_if_fail (mods != NULL, NULL);
|
|
+
|
|
+ for (c = 0; c < len; c++) {
|
|
+ mods[c] = calloc (1, sizeof (LDAPMod));
|
|
+ if (mods[c] == NULL) {
|
|
+ ldap_mods_free (mods, 1);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ mods[c]->mod_op = mod_op;
|
|
+ mods[c]->mod_type = strdup (enroll->delattr[c]);
|
|
+ mods[c]->mod_values = NULL;
|
|
+ if (mods[c]->mod_type == NULL) {
|
|
+ ldap_mods_free (mods, 1);
|
|
+ return NULL;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ return mods;
|
|
+}
|
|
|
|
static adcli_result
|
|
create_computer_account (adcli_enroll *enroll,
|
|
@@ -1775,6 +1809,14 @@ update_computer_account (adcli_enroll *enroll)
|
|
}
|
|
}
|
|
|
|
+ if (res == ADCLI_SUCCESS && enroll->delattr != NULL) {
|
|
+ LDAPMod **mods = get_del_mods_for_attrs (enroll, LDAP_MOD_DELETE);
|
|
+ if (mods != NULL) {
|
|
+ res |= update_computer_attribute (enroll, ldap, mods);
|
|
+ ldap_mods_free (mods, 1);
|
|
+ }
|
|
+ }
|
|
+
|
|
if (res != 0)
|
|
_adcli_info ("Updated existing computer account: %s", enroll->computer_dn);
|
|
}
|
|
@@ -3475,6 +3517,30 @@ adcli_enroll_get_setattr (adcli_enroll *enroll)
|
|
return (const char **) enroll->setattr;
|
|
}
|
|
|
|
+adcli_result
|
|
+adcli_enroll_add_delattr (adcli_enroll *enroll, const char *value)
|
|
+{
|
|
+ return_val_if_fail (enroll != NULL, ADCLI_ERR_CONFIG);
|
|
+ return_val_if_fail (value != NULL, ADCLI_ERR_CONFIG);
|
|
+
|
|
+ if (_adcli_strv_has_ex (default_ad_ldap_attrs, value, strcasecmp) == 1) {
|
|
+ _adcli_err ("Attribute [%s] cannot be removed with delattr", value);
|
|
+ return ADCLI_ERR_CONFIG;
|
|
+ }
|
|
+
|
|
+ enroll->delattr = _adcli_strv_add (enroll->delattr, strdup (value),
|
|
+ NULL);
|
|
+ return_val_if_fail (enroll->delattr != NULL, ADCLI_ERR_CONFIG);
|
|
+
|
|
+ return ADCLI_SUCCESS;
|
|
+}
|
|
+
|
|
+const char **
|
|
+adcli_enroll_get_delattr (adcli_enroll *enroll)
|
|
+{
|
|
+ return_val_if_fail (enroll != NULL, NULL);
|
|
+ return (const char **) enroll->delattr;
|
|
+}
|
|
|
|
#ifdef ADENROLL_TESTS
|
|
|
|
diff --git a/library/adenroll.h b/library/adenroll.h
|
|
index 862bb60..e3ada33 100644
|
|
--- a/library/adenroll.h
|
|
+++ b/library/adenroll.h
|
|
@@ -142,6 +142,10 @@ const char ** adcli_enroll_get_setattr (adcli_enroll *enroll);
|
|
adcli_result adcli_enroll_add_setattr (adcli_enroll *enroll,
|
|
const char *value);
|
|
|
|
+const char ** adcli_enroll_get_delattr (adcli_enroll *enroll);
|
|
+adcli_result adcli_enroll_add_delattr (adcli_enroll *enroll,
|
|
+ const char *value);
|
|
+
|
|
bool adcli_enroll_get_is_service (adcli_enroll *enroll);
|
|
void adcli_enroll_set_is_service (adcli_enroll *enroll,
|
|
bool value);
|
|
diff --git a/tools/computer.c b/tools/computer.c
|
|
index af38894..dffeecb 100644
|
|
--- a/tools/computer.c
|
|
+++ b/tools/computer.c
|
|
@@ -115,6 +115,7 @@ typedef enum {
|
|
opt_remove_service_principal,
|
|
opt_description,
|
|
opt_setattr,
|
|
+ opt_delattr,
|
|
opt_use_ldaps,
|
|
opt_account_disable,
|
|
} Option;
|
|
@@ -154,6 +155,7 @@ static adcli_tool_desc common_usages[] = {
|
|
{ opt_remove_service_principal, "remove the given service principal from the account\n" },
|
|
{ opt_description, "add a description to the account\n" },
|
|
{ opt_setattr, "add an attribute with a value\n" },
|
|
+ { opt_delattr, "remove an attribute\n" },
|
|
{ opt_no_password, "don't prompt for or read a password" },
|
|
{ opt_prompt_password, "prompt for a password if necessary" },
|
|
{ opt_stdin_password, "read a password from stdin (until EOF) if\n"
|
|
@@ -341,6 +343,12 @@ parse_option (Option opt,
|
|
warnx ("parsing setattr option failed");
|
|
}
|
|
return ret;
|
|
+ case opt_delattr:
|
|
+ ret = adcli_enroll_add_delattr (enroll, optarg);
|
|
+ if (ret != ADCLI_SUCCESS) {
|
|
+ warnx ("parsing delattr option failed");
|
|
+ }
|
|
+ return ret;
|
|
case opt_use_ldaps:
|
|
adcli_conn_set_use_ldaps (conn, true);
|
|
return ADCLI_SUCCESS;
|
|
@@ -534,6 +542,7 @@ adcli_tool_computer_update (adcli_conn *conn,
|
|
{ "os-service-pack", optional_argument, NULL, opt_os_service_pack },
|
|
{ "description", optional_argument, NULL, opt_description },
|
|
{ "setattr", required_argument, NULL, opt_setattr },
|
|
+ { "delattr", required_argument, NULL, opt_delattr },
|
|
{ "user-principal", optional_argument, NULL, opt_user_principal },
|
|
{ "computer-password-lifetime", optional_argument, NULL, opt_computer_password_lifetime },
|
|
{ "trusted-for-delegation", required_argument, NULL, opt_trusted_for_delegation },
|
|
--
|
|
2.31.1
|
|
|