File: //usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyc
�
F>,_c @ s, d Z d d l Z d d l Z d d l Z d d l Z d d l m Z d e f d � � YZ d e f d � � YZ d e f d
� � YZ
d e f d � � YZ d
e f d � � YZ d e f d � � YZ
d e f d � � YZ d e f d � � YZ d e f d � � YZ d e f d � � YZ d e f d � � YZ d e f d � � YZ d e f d � � YZ d e f d � � YZ d! e f d" � � YZ d# e f d$ � � YZ d% Z d& Z e j e e d' e �Z e j d( d) k r�e j Z n e j Z ipe d* � d+ 6e d* � d, 6e d- � d. 6e d/ � d0 6e d1 � d2 6e d3 � d4 6e d5 � d6 6e d7 � d8 6e d9 � d: 6e d; � d< 6e d= � d> 6e d? � d@ 6e dA � dB 6e dC � dD 6e dE � dF 6e dG � dH 6e dI � dJ 6e dK � dL 6e dM � dN 6e dO � dP 6e dQ � dR 6e dS � dT 6e dU � dV 6e dW � dX 6e dY � dZ 6e d[ � d\ 6e d] � d^ 6e d_ � d` 6e da � db 6e dc � dd 6e de � df 6e dg � dh 6e di � dj 6e dk � dl 6e dm � dn 6e do � dp 6e dq � dr 6e ds � dt 6e du � dv 6e dw � dx 6e dy � dz 6e d{ � d| 6e d} � d~ 6e d � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d_ � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d| 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d� � d� 6e d � d6e d� d6e d� � d6e d� � d6e d� � d6e d� � d6e d� � d6e d� � d 6e d
� d 6e d � d
6e d� d6e d� d6e d� d6e d� d6e d� d6e d� d6e d� d6e d � d 6e d � d 6e d � d!6e d"� d#6e d$� d%6e dI � dJ 6e dG � dH 6e d&� d'6e d(� d)6e d*� d+6e d,� d-6e d.� d/6e d0� d16e d� d26e d� d36e d4� d56e d6� d76e d8� d96e d:� d;6e d<� d=6e d>� d?6e d@� dA6e dB� dC6e dD� dE6e dF� dG6e dH� dI6e dJ� dK6e dL� dM6e dN� dO6e dP� dQ6e dR� dS6e dT� dU6e dV� dW6e dX� dY6e dZ� d[6e d\� d]6e d^� d_6e d`� da6e dB� db6e dc� dd6e de� df6e dg� dh6e di� dj6e dk� dl6e dm� dn6e do� dp6e dq� dr6e ds� dt6e du� dv6e dw� dx6e dy� dz6e d{� d|6e d}� d~6e d� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d 6e d� d6e d� d6e d� d6e d� d6e d � d
6e d � d 6e d
� d6e d� d6e d� d6e d� d6e d� d6e d� d6e d� d6e d� d 6e d � d 6e d � d 6e d!� d"6e d#� d$6e d%� d&6e d'� d(6e d)� d*6e d+� d,6e d-� d.6e d/� d06e d1� d26e d3� d46e d5� d66e d7� d86e d9� d:6e d;� d<6e d=� d>6e d?� d@6e dA� dB6e dC� dD6e dE� dF6e dG� dH6e dI� dJ6e dK� dL6e dM� dN6e dO� dP6e dQ� dR6e dS� dT6e dU� dV6e dW� dX6e dY� dZ6e d[� d\6e d]� d^6e d_� d`6e da� db6e d� dc6e dd� de6e df� dg6e dh� di6e dj� dk6e dl� dm6e dn� do6e dp� dq6e dr� ds6e dt� du6e dv� dw6e dx� dy6e dz� d{6e d|� d}6e d~� d6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e dc� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� dx 6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6e d�� d�6Z d�� Z d�� Z! d�e f d�� � YZ" d�e# f d�� � YZ$ d�e$ f d�� � YZ% d�e$ f d�� � YZ& d�e f d�� � YZ' d S( s,
Created on Sep 18, 2009
@author: sgallagh
i����Ni ( t SSSDChangeConft SSSDConfigExceptionc B s e Z RS( ( t __name__t
__module__( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR s t ParsingErrorc B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR s t AlreadyInitializedErrorc B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR s t NotInitializedErrorc B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR s t NoOutputFileErrorc B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR s t NoServiceErrorc B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR s t NoSectionErrorc B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR s t
NoOptionErrorc B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR
s t ServiceNotRecognizedErrorc B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR s t ServiceAlreadyExistsc B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR s t
NoDomainErrorc B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR
s t DomainNotRecognizedc B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR s t DomainAlreadyExistsErrorc B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR s t NoSuchProviderErrorc B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR s t NoSuchProviderSubtypeErrorc B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR s t ProviderSubtypeInUsec B s e Z RS( ( R R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR s t
sss_daemons /usr/share/localet fallbacki i s& Set the verbosity of the debug loggingt debugt debug_levels Include timestamps in debug logst debug_timestampss0 Include microseconds in timestamps in debug logst debug_microsecondss Write debug messages to logfilest debug_to_filess* Watchdog timeout before restarting servicet timeouts Command to start servicet commands7 Number of times to attempt connection to Data Providerst reconnection_retriessC The number of file descriptors that may be opened by this respondert fd_limits4 Idle time before automatic disconnection of a clientt client_idle_timeouts4 Idle time before automatic shutdown of the respondert responder_idle_timeouts> Always query all the caches before querying the Data Providerst cache_firsts SSSD Services to startt servicess SSSD Domains to startt domainss' Timeout for messages sent over the SBUSt sbus_timeouts" Regex to parse username and domaint
re_expressions= Printf-compatible format for displaying fully-qualified namest full_name_formatsP Directory on the filesystem where SSSD should store Kerberos replay cache files.t krb5_rcache_dirs2 Domain to add to names without a domain component.t default_domain_suffixs The user to drop privileges tot users Tune certificate verificationt certificate_verificationsF All spaces in group or user names will be replaced with this charactert override_spaces2 Tune sssd to honor or ignore netlink state changest disable_netlinks+ Enable or disable the implicit files domaint enable_files_domains/ A specific order of the domains to be looked upt domain_resolution_orders* Enumeration cache timeout length (seconds)t enum_cache_timeouts6 Entry cache background update timeout length (seconds)t entry_cache_no_wait_timeouts' Negative cache timeout length (seconds)t entry_negative_timeouts- Files negative cache timeout length (seconds)t local_negative_timeouts( Users that SSSD should explicitly ignoret filter_userss) Groups that SSSD should explicitly ignoret
filter_groupss& Should filtered users appear in groupst filter_users_in_groupss> The value of the password field the NSS provider should returnt pwfieldsA Override homedir value from the identity provider with this valuet override_homedirsI Substitute empty homedir value from the identity provider with this valuet fallback_homedirs? Override shell value from the identity provider with this valuet override_shells3 The list of shells users are allowed to log in witht allowed_shellssL The list of shells that will be vetoed, and replaced with the fallback shellt
vetoed_shellssV If a shell stored in central directory is allowed but not available, use this fallbackt shell_fallbacks. Shell to use if the provider does not list onet
default_shells. How long will be in-memory cache records validt memcache_timeouts? List of user attributes the NSS responder is allowed to publisht user_attributess< How long to allow cached logins between online logins (days)t offline_credentials_expirations8 How many failed logins attempts are allowed when offlinet offline_failed_login_attemptssU How long (minutes) to deny login after offline_failed_login_attempts has been reachedt offline_failed_login_delaysE What kind of messages are displayed to the user during authenticationt
pam_verbositys( Filter PAM responses sent to the pam_ssst pam_response_filtersE How many seconds to keep identity information cached for PAM requestst pam_id_timeoutsF How many days before password expiration a warning should be displayedt pam_pwd_expiration_warnings# List of trusted uids or user's namet pam_trusted_userss4 List of domains accessible even for untrusted users.t pam_public_domainss- Message printed when user account is expired.t pam_account_expired_messages, Message printed when user account is locked.t pam_account_locked_messages1 Allow certificate based/Smartcard authentication.t
pam_cert_auths2 Path to certificate database with PKCS#11 modules.t pam_cert_db_paths: How many seconds will pam_sss wait for p11_child to finisht p11_child_timeouts? Which PAM services are permitted to contact application domainst pam_app_servicess% Allowed services for using smartcardst pam_p11_allowed_servicess; Whether to evaluate the time-based attributes in sudo rulest
sudo_timeds; If true, SSSD will switch back to lower-wins ordering logict sudo_inverse_ordersf Maximum number of rules that can be refreshed at once. If this is exceeded, full refresh is performed.t sudo_thresholdt autofs_negative_timeouts@ Whether to hash host names and addresses in the known_hosts filet ssh_hash_known_hostssZ How many seconds to keep a host in the known_hosts file after its host keys were requestedt ssh_known_hosts_timeouts* Path to storage of trusted CA certificatest ca_dbs> List of UIDs or user names allowed to access the PAC respondert allowed_uidss) How long the PAC data is considered validt pac_lifetimesC List of UIDs or user names allowed to access the InfoPipe responders: List of user attributes the InfoPipe is allowed to publishs0 The provider where the secrets will be stored int providers/ The maximum allowed number of nested containerst containers_nest_levels0 The maximum number of secrets that can be storedt max_secretss8 The maximum number of secrets that can be stored per UIDt max_uid_secretss1 The maximum payload size of a secret in kilobytest max_payload_sizes' The URL Custodia server is listening ont proxy_urls: The method to use when authenticating to a Custodia servert auth_typesj The name of the headers that will be added into a HTTP request with the value defined in auth_header_valuet auth_header_names5 The value sssd-secrets would use for auth_header_namet auth_header_valuesS The list of the headers to forward to the Custodia server together with the requestt forward_headerssM The username to use when authenticating to a Custodia server using basic_autht usernamesM The password to use when authenticating to a Custodia server using basic_autht passwordsG If true peer's certificate is verified if proxy_url uses https protocolt verify_peerse If false peer's certificate may contain different hostname than proxy_url when https protocol is usedt verify_hostsE Path to directory where certificate authority certificates are storedt capaths/ Path to file containing server's CA certificatet cacerts, Path to file containing client's certificatet certs, Path to file containing client's private keyt keys Identity providert id_providers Authentication providert
auth_providers Access control providert access_providers Password change providert chpass_providers
SUDO providert
sudo_providers Autofs providert autofs_providers Host identity providert hostid_providers SELinux providert selinux_providers Session management providert session_providers9 Whether the domain is usable by the OS or by applicationst domain_types Minimum user IDt min_ids Maximum user IDt max_ids# Enable enumerating all users/groupst enumerates# Cache credentials for offline logint cache_credentialss Store password hashest store_legacy_passwordss, Display users/groups in fully-qualified formt use_fully_qualified_namess, Don't include group members in group lookupst ignore_group_memberss$ Entry cache timeout length (seconds)t entry_cache_timeoutsH Restrict or prefer a specific address family when performing DNS lookupst lookup_family_ordersB How long to keep cached entries after last successful login (days)t account_cache_expirationsF How long to wait for replies from DNS when resolving servers (seconds)t dns_resolver_timeouts. The domain part of service discovery DNS queryt dns_discovery_domains= Override GID value from the identity provider with this valuet override_gids! Treat usernames as case sensitivet case_sensitivet entry_cache_user_timeoutt entry_cache_group_timeoutt entry_cache_netgroup_timeoutt entry_cache_service_timeoutt entry_cache_autofs_timeoutt entry_cache_sudo_timeouts; How often should expired entries be refreshed in backgroundt refresh_expired_intervals6 Whether to automatically update the client's DNS entryt
dyndns_updates< The TTL to apply to the client's DNS entry after updating itt
dyndns_ttls= The interface whose IP should be used for dynamic DNS updatest dyndns_ifaces7 How often to periodically update the client's DNS entryt dyndns_refresh_intervalsD Whether the provider should explicitly update the PTR record as wellt dyndns_update_ptrs8 Whether the nsupdate utility should default to using TCPt dyndns_force_tcpsD What kind of authentication should be used to perform the DNS updatet dyndns_auths6 Override the DNS server used to perform the DNS updatet
dyndns_servers& Control enumeration of trusted domainst subdomain_enumerates- How often should subdomains list be refreshedt subdomain_refresh_intervals9 List of options that should be inherited into a subdomaint subdomain_inherits Default subdomain homedir valuet subdomain_homedirsA How long can cached credentials be used for cached authenticationt cached_auth_timeouts8 Whether to automatically create private groups for userst auto_private_groupss
IPA domaint
ipa_domains IPA server addresst
ipa_servers Address of backup IPA servert ipa_backup_servers IPA client hostnamet ipa_hostnamesA Whether to automatically update the client's DNS entry in FreeIPAt ipa_dyndns_updatet ipa_dyndns_ttlt ipa_dyndns_ifaces$ Search base for HBAC related objectst ipa_hbac_search_basesK The amount of time between lookups of the HBAC rules against the IPA servert ipa_hbac_refreshsX The amount of time in seconds between lookups of the SELinux maps against the IPA servert ipa_selinux_refreshs; If set to false, host argument given by PAM will be ignoredt ipa_hbac_support_srchosts1 The automounter location this IPA client is usingt ipa_automount_locations7 Search base for object containing info about IPA domaint ipa_master_domain_search_bases7 Search base for objects containing info about ID rangest ipa_ranges_search_bases3 Enable DNS sites - location based service discoveryt ipa_enable_dns_sitess Search base for view containerst ipa_views_search_bases Objectclass for view containerst ipa_view_classs# Attribute with the name of the viewt
ipa_view_names Objectclass for override objectst ipa_override_object_classs3 Attribute with the reference to the original objectt ipa_anchor_uuids% Objectclass for user override objectst ipa_user_override_object_classs& Objectclass for group override objectst ipa_group_override_object_classs/ Search base for Desktop Profile related objectst ipa_deskprofile_search_basesa The amount of time in seconds between lookups of the Desktop Profile rules against the IPA servert ipa_deskprofile_refreshs� The amount of time in minutes between lookups of Desktop Profiles rules against the IPA server when the last request did not find any rulet ipa_deskprofile_request_intervals Active Directory domaint ad_domains Enabled Active Directory domainst ad_enabled_domainss Active Directory server addresst ad_servers& Active Directory backup server addresst ad_backup_servers Active Directory client hostnamet ad_hostnamet ad_enable_dns_sitess* LDAP filter to determine access privilegest ad_access_filters- Whether to use the Global Catalog for lookupst ad_enable_gcs+ Operation mode for GPO-based access controlt ad_gpo_access_controlsP The amount of time between lookups of the GPO policy files against the AD servert ad_gpo_cache_timeoutsQ PAM service names that map to the GPO (Deny)InteractiveLogonRight policy settingst ad_gpo_map_interactivesW PAM service names that map to the GPO (Deny)RemoteInteractiveLogonRight policy settingst ad_gpo_map_remote_interactivesM PAM service names that map to the GPO (Deny)NetworkLogonRight policy settingst ad_gpo_map_networksK PAM service names that map to the GPO (Deny)BatchLogonRight policy settingst ad_gpo_map_batchsM PAM service names that map to the GPO (Deny)ServiceLogonRight policy settingst ad_gpo_map_services> PAM service names for which GPO-based access is always grantedt ad_gpo_map_permits= PAM service names for which GPO-based access is always deniedt ad_gpo_map_denysJ Default logon right (or permit/deny) to use for unmapped PAM service namest ad_gpo_default_rights* a particular site to be used by the clientt ad_sitesI Maximum age in days before the machine account password should be renewedt' ad_maximum_machine_account_password_ages2 Option for tuning the machine account renewal taskt( ad_machine_account_password_renewal_optss3 Use LDAPS port for LDAP and Global Catalog requestst ad_use_ldapss Kerberos server addresst
krb5_kdcipt krb5_servers Kerberos backup server addresst krb5_backup_servers Kerberos realmt
krb5_realms Authentication timeoutt krb5_auth_timeouts Whether to create kdcinfo filest krb5_use_kdcinfos" Where to drop krb5 config snippetst krb5_confd_paths$ Directory to store credential cachest krb5_ccachedirs' Location of the user's credential cachet krb5_ccname_templates. Location of the keytab to validate credentialst krb5_keytabs Enable credential validationt
krb5_validates9 Store password if offline for later online authenticationt krb5_store_password_if_offlines Renewable lifetime of the TGTt krb5_renewable_lifetimes Lifetime of the TGTt
krb5_lifetimes# Time between two checks for renewalt krb5_renew_intervals Enables FASTt
krb5_use_fasts% Selects the principal to use for FASTt krb5_fast_principals" Enables principal canonicalizationt krb5_canonicalizes Enables enterprise principalst krb5_use_enterprise_principals5 A mapping from user names to Kerberos principal namest
krb5_map_usersE Server where the change password service is running if not on the KDCt krb5_kpasswdt krb5_backup_kpasswds$ ldap_uri, The URI of the LDAP servert ldap_uris+ ldap_backup_uri, The URI of the LDAP servert ldap_backup_uris The default base DNt ldap_search_bases2 The Schema Type in use on the LDAP server, rfc2307t ldap_schemas! Mode used to change user passwordt ldap_pwmodify_modes The default bind DNt ldap_default_bind_dns; The type of the authentication token of the default bind DNt ldap_default_authtok_types/ The authentication token of the default bind DNt ldap_default_authtoks$ Length of time to attempt connectiont ldap_network_timeouts5 Length of time to attempt synchronous LDAP operationst ldap_opt_timeouts: Length of time between attempts to reconnect while offlinet ldap_offline_timeouts' Use only the upper case for realm namest ldap_force_upper_case_realms" File that contains CA certificatest ldap_tls_cacerts Path to CA certificate directoryt ldap_tls_cacertdirs) File that contains the client certificatet
ldap_tls_certs! File that contains the client keyt ldap_tls_keys List of possible ciphers suitest ldap_tls_cipher_suites$ Require TLS certificate verificationt ldap_tls_reqcerts! Specify the sasl mechanism to uset ldap_sasl_mechs( Specify the sasl authorization id to uset ldap_sasl_authids+ Specify the sasl authorization realm to uset ldap_sasl_realms3 Specify the minimal SSF for LDAP sasl authorizationt ldap_sasl_minssfs3 Specify the maximal SSF for LDAP sasl authorizationt ldap_sasl_maxssfs Kerberos service keytabt ldap_krb5_keytabs% Use Kerberos auth for LDAP connectiont ldap_krb5_init_credss Follow LDAP referralst ldap_referralss# Lifetime of TGT for LDAP connectiont ldap_krb5_ticket_lifetimes How to dereference aliasest
ldap_derefs$ Service name for DNS service lookupst ldap_dns_service_names8 The number of records to retrieve in a single LDAP queryt ldap_page_sizesB The number of members that must be missing to trigger a full dereft ldap_deref_thresholdsi Whether the LDAP library should perform a reverse lookup to canonicalize the host name during a SASL bindt ldap_sasl_canonicalizes entryUSN attributet ldap_entry_usns lastUSN attributet ldap_rootdse_last_usnsG How long to retain a connection to the LDAP server before disconnectingt" ldap_connection_expiration_timeouts Disable the LDAP paging controlt ldap_disable_pagings( Disable Active Directory range retrievalt ldap_disable_range_retrievals+ Length of time to wait for a search requestt ldap_search_timeouts0 Length of time to wait for a enumeration requestt ldap_enumeration_search_timeouts* Length of time between enumeration updatest ldap_enumeration_refresh_timeouts% Length of time between cache cleanupst ldap_purge_cache_timeouts Require TLS for ID lookupst ldap_id_use_start_tlss2 Use ID-mapping of objectSID instead of pre-set IDst ldap_id_mappings Base DN for user lookupst ldap_user_search_bases Scope of user lookupst ldap_user_search_scopes Filter for user lookupst ldap_user_search_filters Objectclass for userst ldap_user_object_classs Username attributet ldap_user_names
UID attributet ldap_user_uid_numbers Primary GID attributet ldap_user_gid_numbers GECOS attributet ldap_user_gecoss Home directory attributet ldap_user_home_directorys Shell attributet ldap_user_shells UUID attributet ldap_user_uuids objectSID attributet ldap_user_objectsids7 Active Directory primary group attribute for ID-mappingt ldap_user_primary_groups' User principal attribute (for Kerberos)t ldap_user_principals Full Namet ldap_user_fullnames memberOf attributet ldap_user_member_ofs Modification time attributet ldap_user_modify_timestamps shadowLastChange attributet ldap_user_shadow_last_changes shadowMin attributet ldap_user_shadow_mins shadowMax attributet ldap_user_shadow_maxs shadowWarning attributet ldap_user_shadow_warnings shadowInactive attributet ldap_user_shadow_inactives shadowExpire attributet ldap_user_shadow_expires shadowFlag attributet ldap_user_shadow_flags) Attribute listing authorized PAM servicest ldap_user_authorized_services) Attribute listing authorized server hostst ldap_user_authorized_hosts* Attribute listing authorized server rhostst ldap_user_authorized_rhosts krbLastPwdChange attributet ldap_user_krb_last_pwd_changes krbPasswordExpiration attributet! ldap_user_krb_password_expirationsB Attribute indicating that server side password policies are activet ldap_pwd_attributes accountExpires attribute of ADt ldap_user_ad_account_expiress" userAccountControl attribute of ADt! ldap_user_ad_user_account_controls nsAccountLock attributet ldap_ns_account_locks loginDisabled attribute of NDSt ldap_user_nds_login_disableds$ loginExpirationTime attribute of NDSt# ldap_user_nds_login_expiration_times$ loginAllowedTimeMap attribute of NDSt$ ldap_user_nds_login_allowed_time_maps SSH public key attributet ldap_user_ssh_public_keys9 attribute listing allowed authentication types for a usert ldap_user_auth_types5 attribute containing the X509 certificate of the usert ldap_user_certificates2 attribute containing the email address of the usert ldap_user_emails@ A list of extra attributes to download along with the user entryt ldap_user_extra_attrss Base DN for group lookupst ldap_group_search_bases Objectclass for groupst ldap_group_object_classs
Group namet ldap_group_names Group passwordt ldap_group_pwds
GID attributet ldap_group_gid_numbers Group member attributet ldap_group_members Group UUID attributet ldap_group_uuidt ldap_group_objectsids& Modification time attribute for groupst ldap_group_modify_timestamps! Type of the group and other flagst ldap_group_types( The LDAP group external member attributet ldap_group_external_members& Maximum nesting level SSSD will followt ldap_group_nesting_levels Base DN for netgroup lookupst ldap_netgroup_search_bases Objectclass for netgroupst ldap_netgroup_object_classs
Netgroup namet ldap_netgroup_names Netgroups members attributet ldap_netgroup_members Netgroup triple attributet ldap_netgroup_triples) Modification time attribute for netgroupst ldap_netgroup_modify_timestamps Base DN for service lookupst ldap_service_search_bases Objectclass for servicest ldap_service_object_classs Service name attributet ldap_service_names Service port attributet ldap_service_ports Service protocol attributet ldap_service_protos Lower bound for ID-mappingt ldap_idmap_range_mins Upper bound for ID-mappingt ldap_idmap_range_maxs, Number of IDs for each slice when ID-mappingt ldap_idmap_range_sizes/ Use autorid-compatible algorithm for ID-mappingt ldap_idmap_autorid_compats) Name of the default domain for ID-mappingt ldap_idmap_default_domains( SID of the default domain for ID-mappingt ldap_idmap_default_domain_sids Number of secondary slicest ldap_idmap_helper_table_sizes1 Use LDAP_MATCHING_RULE_IN_CHAIN for group lookupst& ldap_groups_use_matching_rule_in_chains5 Use LDAP_MATCHING_RULE_IN_CHAIN for initgroup lookupst* ldap_initgroups_use_matching_rule_in_chains Whether to use Token-Groupst ldap_use_tokengroupss7 Set lower boundary for allowed IDs from the LDAP servert ldap_min_ids7 Set upper boundary for allowed IDs from the LDAP servert ldap_max_ids DN for ppolicy queriest ldap_pwdlockout_dns; How many maximum entries to fetch during a wildcard requestt wildcard_limits* Policy to evaluate the password expirationt ldap_pwd_policyt ldap_access_filtersC Which attributes shall be used to evaluate if an account is expiredt ldap_account_expire_policys5 Which rules should be used to evaluate access controlt ldap_access_orders8 URI of an LDAP server where password changes are allowedt ldap_chpass_uris> URI of a backup LDAP server where password changes are allowedt ldap_chpass_backup_uris0 DNS service name for LDAP password change servert ldap_chpass_dns_service_namesT Whether to update the ldap_user_shadow_last_change attribute after a password changet ldap_chpass_update_last_changes Base DN for sudo rules lookupst ldap_sudo_search_bases Automatic full refresh periodt ldap_sudo_full_refresh_intervals Automatic smart refresh periodt ldap_sudo_smart_refresh_intervals= Whether to filter rules by hostname, IP addresses and networkt ldap_sudo_use_host_filtersR Hostnames and/or fully qualified domain names of this machine to filter sudo rulest ldap_sudo_hostnamessF IPv4 or IPv6 addresses or network of this machine to filter sudo rulest ldap_sudo_ipsA Whether to include rules that contains netgroup in host attributet ldap_sudo_include_netgroupssK Whether to include rules that contains regular expression in host attributet ldap_sudo_include_regexps Object class for sudo rulest ldap_sudorule_object_classs Sudo rule namet ldap_sudorule_names Sudo rule command attributet ldap_sudorule_commands Sudo rule host attributet ldap_sudorule_hosts Sudo rule user attributet ldap_sudorule_users Sudo rule option attributet ldap_sudorule_options Sudo rule runas attributet ldap_sudorule_runass Sudo rule runasuser attributet ldap_sudorule_runasusers Sudo rule runasgroup attributet ldap_sudorule_runasgroups Sudo rule notbefore attributet ldap_sudorule_notbefores Sudo rule notafter attributet ldap_sudorule_notafters Sudo rule order attributet ldap_sudorule_orders! Object class for automounter mapst ldap_autofs_map_object_classs Automounter map name attributet ldap_autofs_map_names( Object class for automounter map entriest ldap_autofs_entry_object_classs# Automounter map entry key attributet ldap_autofs_entry_keys% Automounter map entry value attributet ldap_autofs_entry_values# Base DN for automounter map lookupst ldap_autofs_search_bases% Comma separated list of allowed userst simple_allow_userss( Comma separated list of prohibited userst simple_deny_userss Default shell, /bin/bashs Base for home directoriest base_directorys' The number of preforked proxy children.t proxy_max_childrens" The name of the NSS library to uset proxy_lib_names> Whether to look up canonical group name from cache if possiblet proxy_fast_aliass PAM stack to uset proxy_pam_targets Path of passwd file sources.t passwd_filess Path of group file sources.t group_filesc C s g | D] } | j � ^ q S( N( t strip( t lt x( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt striplist� s c C s7 g } x* | D]" } | | k r
| j | � q
q
W| S( N( t append( t options1t options2t overlapt option( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt options_overlap� s
t SSSDConfigSchemac B s> e Z d � Z d � Z d � Z d � Z d � Z d � Z RS( c C s? t j | � | s d } n | s+ d } n yy t | d � � } | j | � Wd QXxM t d � t j | � � D]0 } t | d | � � } | j | � Wd QXqo WWn* t k
r� � n t k
r� t � n Xi t
d 6t d 6t j
d d k r� t n t d
6t d 6t d 6t d
6d d 6| _ i t d 6t d 6| _ d S( Ns /usr/share/sssd/sssd.api.confs /usr/share/sssd/sssd.api.dt rc S s t j d | � S( Ns ^sssd-.*\.conf$( t ret search( t f( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt <lambda>� s t /t boolt inti i t longt floatt strt listt Nonet falset true( R t __init__t opent readfpt filtert ost listdirt IOErrort SyntaxErrorR R� R� t syst version_infoR� R� R� R� R� t type_lookupt Falset Truet bool_lookup( t selft
schemafilet schemaplugindirt fdt file( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� � s6
c C s� | j | � s t � n | j | � } d } d } d } d } i } x�| j | � D]w} | d } t | j d � � }
t |
� } | j |
| } | j |
| }
| j |
| } | d t k r� t | d } n d } | d k r | |
| | d f | | d <qU | d k r�t |
| � | k rR| |
| | |
| f | | d <q�| t k r<t |
| � |
k r�| |
| | |
| g f | | d <q�y� |
t
k r�t |
| � t k r�| |
| | | j |
| j � g f | | d <n* | |
| | |
|
| � g f | | d <Wq�t k
r8t � q�Xq�y~ | t
k r�t |
| � t k r�| |
| | | j |
| j � f | | d <n' | |
| | | |
| � f | | d <Wq�t k
r�t � q�XqU | d k r�| t k r�t � n g } x� |
| D]� } t | � |
k r�yT |
t
k rXt | � t k rX| j | j � } n |
| � } | j | g � Wq�t k
r�t � q�Xq | j | g � q W| |
| | | f | | d <qU t � qU W| S( Ni i i i t valuet ,t namei ( t has_sectionR t optionst strip_comments_emptyR� t splitt lenR� R� t option_stringsR� t typeR� R� R� t lowert
ValueErrorR t extend( R� t sectionR� t PRIMARY_TYPEt SUBTYPEt MANDATORYt DEFAULTt parsed_optionsR� t unparsed_optiont split_optiont optionlent primarytypet subtypet mandatoryt desct
fixed_optionsR� t newvalue( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt get_options s�
("
%
c C sZ | j | � s t | � � n | j | | � sI t d | | f � � n | j | � | S( Ns Section [%s] has no option [%s]( R� R t
has_optionR
R� ( R� R� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt
get_option� s c C sx | j | � s t | � � n | j | � } t g | j � D]. } | | d d k r= | | | d f ^ q= � } | S( Ni ( R� R R� t dictt keysR� ( R� R� t schema_optionsR� t defaults( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt get_defaults� s 1c C s_ g | j � D]H } | d d k r
| d j d � r
| d j d � r
| d ^ q
} | S( NR� t servicet domainRX ( t sectionst
startswith( R� R� t service_list( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt get_services� s
$c C s� i } x� | j � D]~ } | d j d � } | d d k r t | � d k r� | d | k ro g | | d <n | | d j | d g � q� q q Wx( | j � D] } t | | � | | <q� W| S( NR� R� i RX i i i ( R� R� R� R� R� t tuple( R� t providersR� t splitsectionRi ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt
get_providers� s &( R R R� R� R� R� R� R� ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� � s ' v t SSSDConfigObjectc B s5 e Z d � Z d � Z d � Z d � Z d � Z RS( c C s d | _ i | _ d S( N( R� R� R� ( R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� � s c C s | j S( s�
Return the name of the object
=== Returns ===
The domain name
=== Errors ===
No errors
( R� ( R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt get_name� s
c C s0 | | j j � k r | j | St | � � d S( s
Return the value of an service option
optionname:
The option to get.
=== Returns ===
The value for the requested option.
=== Errors ===
NoOptionError:
The specified option was not listed in the service
N( R� R� R
( R� t
optionname( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� � s c C s | j S( s�
Return a dictionary of name/value pairs for this object
=== Returns ===
A dictionary of name/value pairs currently in use for this object
=== Errors ===
No errors
( R� ( R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt get_all_options� s
c C s | | j k r | j | =n d S( s�
Remove an option from the object. If the option does not exist, it is ignored.
=== Returns ===
No return value.
=== Errors ===
No errors
N( R� ( R� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt
remove_option� s
( R R R� R� R� R� R� ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� � s
t SSSDServicec B s; e Z d Z d � Z d � Z d � Z d � Z d � Z RS( s3
Object to manipulate SSSD service options
c C s� t j | � t | t � s/ t | � t k r8 t � n | j | � sV t | � � n | | _ | | _
i | _ g | _ | j j
| j
j d � � | j j
| j
j | j � � d S( s\
Create a new SSSDService, setting its defaults to those found in the
schema. This constructor should not be used directly. Use
SSSDConfig.new_service() instead.
name:
The service name
apischema:
An SSSDConfigSchema? object created by SSSDConfig.__init__()
=== Returns ===
The newly-created SSSDService object.
=== Errors ===
TypeError:
The API schema passed in was unusable or the name was not a string.
ServiceNotRecognizedError:
The service was not listed in the schema
R� N( R� R� t
isinstanceR� R� R� t TypeErrorR� R R� t schemaR� t hidden_optionst updateR� ( R� t servicenamet apischema( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� � s
" c C sK i } | j j d � } | j | � | j j | j � } | j | � | S( sI
List options for the service, including the mandatory flag.
=== Returns ===
A dictionary of configurable options. This dictionary is keyed on the
option name with a tuple of the variable type, subtype ('None' if the
type is not a collection type), whether it is mandatory, the
translated option description, and the default value (or 'None') as
the value.
Example:
{ 'enumerate' :
(bool, None, False, u'Enable enumerating all users/groups', True) }
=== Errors ===
No errors
R� ( R� R� R� R� ( R� R� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt list_options_with_mandatory# s
c C sc | j � } i } xJ | j � D]< } | | d | | d | | d | | d f | | <q W| S( s
List all options that apply to this service
=== Returns ===
A dictionary of configurable options. This dictionary is keyed on the
option name with a tuple of the variable type, subtype ('None' if the
type is not a collection type), the translated option description, and
the default value (or 'None') as the value.
Example:
{ 'services' :
(list, str, u'SSSD Services to start', ['nss', 'pam']) }
=== Errors ===
No Errors
i i i i ( R� R� ( R� R� t filtered_optionsRi ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt list_options@ s
:c C st | j � } i } x[ | j � D]M } | | d r | | d | | d | | d | | d f | | <q q W| S( s
List all mandatory options that apply to this service
=== Returns ===
A dictionary of configurable options. This dictionary is keyed on the
option name with a tuple of the variable type, subtype ('None' if the
type is not a collection type), the translated option description, and
the default value (or 'None') as the value.
Example:
{ 'services' :
(list, str, u'SSSD Services to start', ['nss', 'pam']) }
=== Errors ===
No Errors
i i i i i ( R� R� ( R� R� R� Ri ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt list_mandatory_options[ s =c C s� | j j | j | � r3 | j j | j | � } nf | j j d | � r` | j j d | � } n9 | | j k r� | | j | <d St d | j | f � � | d k r� | j | � d St } | d t
k rt | � t
k rt | � t k rt
| j d � � } q| g } n t | � | d k r y� | d t k rht | � t k rh| j j | j � } nD | d t k r�t | � t k r�t | d � } n | d | � } Wn- t k
r�t } n t k
r�t } n X| r t d | d | t | � f � � q n t | � t
k r�yz g } xm | D]e } | d t k ryt | � t k ry| j | j j | j � g � q.| j | d | � g � q.WWn- t k
r�t } n t k
r�t } n X| r�t d | d � � n | } n | | j | <d S( s
Set a service option to the specified value (or values)
optionname:
The option to change
value:
The value to set. This may be a single value or a list of values. If
it is set to None, it resets the option to its default.
=== Returns ===
No return value
=== Errors ===
NoOptionError:
The specified option is not listed in the schema
TypeError:
The value specified was not of the expected type
R� Ns Section [%s] has no option [%s]i R� s Expected %s for %s, received %si s Expected %s( R� R� R� R� R� R� R
R� R� R� R� R� R� R� R� R� R� R� R� R� R� t KeyErrorR� R� ( R� R� R� t
option_schemat raise_errorR� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt
set_optionw s\
" ""
#
#"
( R R t __doc__R� R� R� R� R� ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� � s + t
SSSDDomainc B st e Z d Z d � Z d � Z d � Z d � Z d � Z d d � Z d � Z
d � Z d � Z d
� Z
d � Z RS(
s2
Object to manipulate SSSD domain options
c C s� t j | � t | t � s/ t | � t k r8 t � n | | _ | | _ t | _
d | _ g | _
i | _ | j j | j j d � � | j j | j j d � � d S( s
Creates a new, empty SSSDDomain. This domain is inactive by default.
This constructor should not be used directly. Use
SSSDConfig.new_domain() instead.
name:
The domain name.
apischema:
An SSSDConfigSchema object created by SSSDConfig.__init__()
=== Returns ===
The newly-created SSSDDomain object.
=== Errors ===
TypeError:
apischema was not an SSSDConfigSchema object or domainname was not
a string
RX R� N( R� R� R� R� R� R� R� R� R� R� t activeR� t oldnameR� R� R� R� ( R� t
domainnameR� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� � s
" c C s t | � | _ d S( sd
Enable or disable this domain
active:
Boolean value. If True, this domain will be added to the active
domains list when it is saved. If False, it will be removed from the
active domains list when it is saved.
=== Returns ===
No return value
=== Errors ===
No errors
N( R� R� ( R� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt
set_active� s c C s� i } | j | j j d � � | j | j j d � � xc | j D]X \ } } | j j d | � } | j | � | j j d | | f � } | j | � qB W| S( sg
List options for the currently-configured providers, including the
mandatory flag
=== Returns ===
A dictionary of configurable options. This dictionary is keyed on the
option name with a tuple of the variable type, subtype ('None' if the
type is not a collection type), whether it is mandatory, the
translated option description, and the default value (or 'None') as
the value.
Example:
{ 'enumerate' :
(bool, None, False, u'Enable enumerating all users/groups', True) }
=== Errors ===
No errors
RX R� s provider/%ss provider/%s/%s( R� R� R� R� ( R� R� RX t providertypeR� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� s
c C sc | j � } i } xJ | j � D]< } | | d | | d | | d | | d f | | <q W| S( s$
List options available for the currently-configured providers.
=== Returns ===
A dictionary of configurable options. This dictionary is keyed on the
option name with a tuple of the variable type, subtype ('None' if the
type is not a collection type), the translated option description, and
the default value (or 'None') as the value.
Example:
{ 'enumerate' :
(bool, None, u'Enable enumerating all users/groups', True) }
=== Errors ===
No errors
i i i i ( R� R� ( R� R� R� Ri ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� , s
:c C st | j � } i } x[ | j � D]M } | | d r | | d | | d | | d | | d f | | <q q W| S( s$
List mandatory options for the currently-configured providers.
=== Returns ===
A dictionary of configurable options. This dictionary is keyed on the
option name with a tuple of the variable type, subtype ('None' if the
type is not a collection type), the translated option description, and
the default value (or 'None') as the value.
Example:
{ 'enumerate' :
(bool, None, u'Enable enumerating all users/groups', True) }
=== Errors ===
No errors
i i i i i ( R� R� ( R� R� R� Ri ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� G s =c C s� | j j d | � } | rB | j | j j d | | f � � n: | j � } x+ | | D] } | j | j | | � � qY W| S( s�
If provider_type is specified, list all options applicable to that
target, otherwise list all possible options available for a provider.
type:
Provider backend type. (e.g. local, ldap, krb5, etc.)
provider_type:
Subtype of the backend type. (e.g. id, auth, access, chpass)
=== Returns ===
A dictionary of configurable options for the specified provider type.
This dictionary is keyed on the option name with a tuple of the
variable type, subtype ('None' if the type is not a collection type),
the translated option description, and the default value (or 'None')
as the value.
=== Errors ===
NoSuchProviderError:
The specified provider is not listed in the schema or plugins
NoSuchProviderSubtypeError:
The specified provider subtype is not listed in the schema
s provider/%ss provider/%s/%s( R� R� R� t list_providerst list_provider_options( R� RX t
provider_typeR� t known_providers( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� c s c C s
| j j � S( s>
Return a dictionary of providers.
=== Returns ===
Returns a dictionary of providers, keyed on the primary type, with the
value being a tuple of the subtypes it supports.
Example:
{ 'ldap' : ('id', 'auth', 'chpass') }
=== Errors ===
No Errors
( R� R� ( R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� � s c
C s | j � } | | j � k r: t d | j | f � � n | d k rW | j | � d S| | } t } | d t k r� t | � t k r� t | � t k r� t
| j d � � } q� | g } n t | � | d k r�y� | d t k rt | � t k r| j
j | j � } nD | d t k rGt | � t k rGt | d � } n | d | � } Wn- t k
rqt } n t k
r�t } n X| r�t d | d | t | � f � � q�n t | � t k r�yz g } xm | D]e } | d t k r$t | � t k r$| j | j
j | j � g � q�| j | d | � g � q�WWn- t k
r\t } n t k
rrt } n X| r�t d | d � � n | } n | j d � } | d k r�| | } y | j | | � Wq�t k
r�t � q�Xn
| | j | <d S( s
Set a domain option to the specified value (or values)
option:
The option to change.
value:
The value to set. This may be a single value or a list of values.
If it is set to None, it resets the option to its default.
=== Returns ===
No return value.
=== Errors ===
NoOptionError:
The specified option is not listed in the schema
TypeError:
The value specified was not of the expected type
s Section [%s] has no option [%s]Ni R� s Expected %s for %s, received %si s Expected %st _provider( R� R� R
R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� R� t rfindt add_providerR R� (
R� R� R� R� R� R� R� R� t is_providerRX ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� � sf
" "
#
#"
c C s@ t | � t k r t � n | j s3 | j | _ n | | _ d S( s�
Change the name of the domain
newname:
New name for this domain
=== Returns ===
No return value.
=== Errors ===
TypeError:
newname was not a string
N( R� R� R� R� R� ( R� t newname( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt set_name� s
c C sG | j � } | | j � k r@ | | | k rF t | � � qF n t � g | j D] } | d | k rP | ^ qP } t | � d k r� t � n t | � d k r� | d d | k r� t | d d � � q� n | j j | | f g � d | } | | j | <| j j | j
j d | � � | j j | j
j d | | f � � d S( sH
Add a new provider type to the domain
type:
Provider backend type. (e.g. local, ldap, krb5, etc.)
subtype:
Subtype of the backend type. (e.g. id, auth, chpass)
=== Returns ===
No return value.
=== Errors ===
ProviderSubtypeInUse:
Another backend is already providing this subtype
NoSuchProviderError:
The specified provider is not listed in the schema or plugins
NoSuchProviderSubtypeError:
The specified provider subtype is not listed in the schema
i i s %s_providers provider/%ss provider/%s/%sN( R� R� R R R� R� R R� R� R� R� R� ( R� RX R� t configured_providersR� t with_this_typet option_name( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� s& ,
c
C s< d } x- | j D]" \ } } | | k r, Pn d } q W| s@ d S| j | | � } xz | j D]o \ } } | | f | | f k r� q\ n | j | | � } t | j � | j � � } x | D]
} | | =q� Wq\ Wx* | D]" } | | j k r� | j | =q� q� Wd | } | | j k r"| j | =n | j j | | f � d S( s
Remove a provider from the domain. If the provider is not present, it
is ignored.
provider_type:
Subtype of the backend type. (e.g. id, auth, chpass)
=== Returns ===
No return value.
=== Errors ===
No Errors
Ns %s_provider( R� R� R� R� R� R� t remove(
R� R� RX t ptypeR� t provt provider_optionsR� t optR� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt remove_provider= s,
N( R R R� R� R� R� R� R� R� R� R� R� R R� R ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� � s % $ ' [ 1t
SSSDConfigc B s� e Z d Z d d d � Z d d � Z d � Z d d � Z d � Z d � Z d � Z
d � Z d � Z d
� Z
d � Z d � Z d
� Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z d � Z RS( sQ
class SSSDConfig
Primary class for operating on SSSD configurations
c C s> t j | � t | | � | _ d | _ t | _ d | _ d S( s+
Initialize the SSSD config parser/editor. This constructor does not
open or create a config file. If the schemafile and schemaplugindir
are not passed, it will use the system defaults.
schemafile:
The path to the API schema config file. Usually
/usr/share/sssd/sssd.api.conf
schemaplugindir:
The path the directory containing the provider schema config files.
Usually /usr/share/sssd/sssd.api.d
=== Returns ===
The newly-created SSSDConfig object.
=== Errors ===
IOError:
Exception raised when the schema file could not be opened for
reading.
ParsingError:
The main schema file or one of those in the plugin directory could
not be parsed.
i N( R R� R� R� R� t
configfileR� t initializedt API_VERSION( R� R� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR� w s
c C s� | j r t � n | s! d } n t | d � �( } y | j | � Wn
t � n XWd QX| | _ t | _ y4 t | j d d � � | j k r� t d � � n Wn t
k
r� n Xd S( s�
Read in a config file, populating all of the service and domain
objects with the read values.
configfile:
The path to the SSSD config file. If not specified, use the system
default, usually /etc/sssd.conf
=== Returns ===
No return value
=== Errors ===
IOError:
Exception raised when the file could not be opened for reading
ParsingError:
Exception raised when errors occur attempting to parse a file.
AlreadyInitializedError:
This SSSDConfig object was already initialized by a call to
import_config() or new_config()
s /etc/sssd/sssd.confR� Nt sssdt config_file_versions Wrong config_file_version( R R R� R� R R R� R� t getR
R� ( R� R R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt
import_config� s !
c C sH | j r t � n t | _ x& | j j � D] } | j | � } q+ Wd S( s/
Initialize the SSSDConfig object with the defaults from the schema.
=== Returns ===
No return value
=== Errors ===
AlreadyInitializedError:
This SSSDConfig object was already initialized by a call to
import_config() or new_config()
N( R R R� R� R� t new_service( R� R� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt
new_config� s
c C s� | j s t � n | d k rB | j d k r6 t � n | j } n t j d � } t | d � �/ } | j | j � j
d � } | j | � Wd QXt j | � d S( s�
Write out the configuration to a file.
outputfile:
The path to write the new config file. If it is not specified, it
will use the path specified by the import() call.
=== Returns ===
No return value
=== Errors ===
IOError:
Exception raised when the file could not be opened for writing
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
NoOutputFileError:
No outputfile was specified and this SSSDConfig object was not
initialized by import()
i t wbs utf-8N( R R R� R R R� t umaskR� t dumpt optst encodet write( R� t
outputfilet old_umaskt oft output( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR � s c C s� | j s t � n | j d d � r� t | j d d � j d � � } t j | � } d | k rj | d =n | j � } x* t | � D] } | | k r� | | =q� q� Wt | � } n g } | S( s
Return a list of all active services.
=== Returns ===
The list of active services.
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
R R! R� t (
R R R� R� R R� R� t fromkeyst
list_servicesR� ( R� t active_servicest service_dictt configured_servicest srv( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt list_active_services� s !
c C s} | j s t � n | j d d � rH t | j d d � j d � � } n g } g | j � D] } | | k r[ | ^ q[ } | S( s
Return a list of all disabled services.
=== Returns ===
The list of inactive services.
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
R R! R� ( R R R� R� R R� R ( R� R! R� R! ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt list_inactive_services s $c C sL | j s t � n g | j � D]# } | d j d � s | d ^ q } | S( s
Retrieve a list of known services.
=== Returns ===
The list of known services.
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
R� R� ( R R R� R� ( R� R� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR 5 s
#c C s� | j s t � n | j | � s* t � n t | | j � } xP | j | j | � � D]6 } y | j | d | d � WqU t k
r� qU XqU W| S( s�
Get an SSSDService object to edit a service.
name:
The name of the service to return.
=== Returns ===
An SSSDService instance containing the current state of a service in
the SSSDConfig
=== Errors ===
NoServiceError:
There is no such service with the specified name in the SSSDConfig.
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
R� R� (
R R R� R R� R� R� R� R� R
( R� R� R� R ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt get_serviceH s
c C sS | j s t � n | j | � r0 t | � � n t | | j � } | j | � | S( s�
Create a new service from the defaults and return the SSSDService
object for it. This function will also add this service to the list of
active services in the [SSSD] section.
name:
The name of the service to create and return.
=== Returns ===
The newly-created SSSDService object
=== Errors ===
ServiceNotRecognizedError:
There is no such service in the schema.
ServiceAlreadyExistsError:
The service being created already exists in the SSSDConfig object.
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
( R R R� R R� R� t save_service( R� R� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR j s
c C s� | j s t � n | | j � k r- t � n | j d d � d } | s` | j d d | � d St j t | d j d � � � } d | k r� | d =n d | | <| j d d d j | j � � � d S( s�
Activate a service
name:
The name of the service to activate
=== Returns ===
No return value
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
NoServiceError:
There is no such service with the specified name in the SSSDConfig.
R R! i NR� R� R s , (
R R R R t get_option_indext setR� R R� R� R� t joinR� ( R� R� t itemR" ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt activate_service� s "
c C s� | j s t � n | | j � k r- t � n | j d d � d } | s` | j d d d � d St j t | d j d � � � } d | k r� | d =n | | k r� | | =n | j d d d j
| j � � � d S( s�
Deactivate a service
name:
The name of the service to deactivate
=== Returns ===
No return value
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
NoServiceError:
There is no such service with the specified name in the SSSDConfig.
R R! i R NR� R� s , ( R R R R R) R* R� R R� R� R+ R� ( R� R� R, R" ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt deactivate_service� s "
c C s& | j s t � n | j d | � d S( s�
Remove a service from the SSSDConfig object. This function will also
remove this service from the list of active services in the [SSSD]
section. Has no effect if the service does not exist.
=== Returns ===
No return value
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
R� N( R R t
delete_option( R� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt delete_service� s c C s� | j s t � n t | t � s* t � n | j � } | j d | � } g } x� | j � j � D]v \ } } t | � t
k r� d j | � } n | d k r� | j | � } n | j
i d d 6| d 6t | � d 6� qa W| j | | | � d S( s�
Save the changes made to the service object back to the SSSDConfig
object.
service_object:
The SSSDService object to save to the configuration.
=== Returns ===
No return value
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
TypeError:
service_object was not of the type SSSDService
R� s , R R� R� R� R� N( R R R� R� R� R� R/ R� t itemsR� R� R+ t _get_debug_level_valR� R� t add_section( R� R� R� t indext addkwR� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR( � s c C s� | j s t � n | j d d � r� t | j d d � j d � � } t j | � } d | k rj | d =n | j � } x* t | � D] } | | k r� | | =q� q� Wt | � } n g } | S( s
Return a list of all active domains.
=== Returns ===
The list of configured, active domains.
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
R R" R� R (
R R R� R� R R� R� R t list_domainsR� ( R� t active_domainst domain_dictt configured_domainst dom( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt list_active_domains s !
c C s} | j s t � n | j d d � rH t | j d d � j d � � } n g } g | j � D] } | | k r[ | ^ q[ } | S( s.
Return a list of all configured, but disabled domains.
=== Returns ===
The list of configured, inactive domains.
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
R R" R� ( R R R� R� R R� R6 ( R� R7 R� R" ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt list_inactive_domains: s $c C sP | j s t � n g | j � D]' } | d j d � r | d d ^ q } | S( sL
Return a list of all configured domains, including inactive domains.
=== Returns ===
The list of configured domains, both active and inactive.
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
R� s domain/i ( R R R� R� ( R� R� R" ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR6 R s :c C se | j s t � n | j d | � s4 t | � � n t | | j � } g | j | j d | � � D]3 } | d j d � d k rc | d | d f ^ qc } x< | D]4 \ } } y | j | | � Wq� t
k
r� q� Xq� Wxq | j | j d | � � D]S } | d | d f | k r� y | j | d | d � WqKt
k
rGqKXq� q� W| j | � | _ | S( s�
Get an SSSDDomain object to edit a domain.
name:
The name of the domain to return.
=== Returns ===
An SSSDDomain instance containing the current state of a domain in the
SSSDConfig
=== Errors ===
NoDomainError:
There is no such domain with the specified name in the SSSDConfig.
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
s domain/%sR� R� i R� (
R R R� R
R� R� R� R� R� R� R
t is_domain_activeR� ( R� R� R� R� R� R� R� R ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt
get_domainc s( #3
#
c C sQ | j s t � n | j d | � r. t � n t | | j � } | j | � | S( s�
Create a new, empty domain and return the SSSDDomain object for it.
name:
The name of the domain to create and return.
=== Returns ===
The newly-created SSSDDomain object
=== Errors ===
DomainAlreadyExistsError:
The service being created already exists in the SSSDConfig object.
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
s domain/%s( R R R� R R� R� t save_domain( R� R� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt
new_domain� s
c C s= | j s t � n | | j � k r- t � n | | j � k S( s�
Is a particular domain set active
name:
The name of the configured domain to check
=== Returns ===
True if the domain is active, False if it is inactive
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
NoDomainError:
No domain by this name is configured
( R R R6 R
R; ( R� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR= � s
c C s� | j s t � n | | j � k r- t � n | j d d � d } | s` | j d d | � d St j t | d j d � � � } d | k r� | d =n d | | <| j d d d j | j � � � d S( s�
Activate a configured domain
name:
The name of the configured domain to activate
=== Returns ===
No return value
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
NoDomainError:
No domain by this name is configured
R R" i NR� R� R s , (
R R R6 R
R) R* R� R R� R� R� R+ R� ( R� R� R, R8 ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt activate_domain� s "
c C s� | j s t � n | | j � k r- t � n | j d d � d } | s` | j d d d � d St j t | d j d � � � } d | k r� | d =n | | k r� | | =n | j d d d j
| j � � � d S( s�
Deactivate a configured domain
name:
The name of the configured domain to deactivate
=== Returns ===
No return value
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
NoDomainError:
No domain by this name is configured
R R" i R NR� R� s , ( R R R6 R
R) R* R� R R� R� R+ R� ( R� R� R, R8 ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt deactivate_domain� s "
c C s7 | j s t � n | j | � | j d d | � d S( s�
Remove a domain from the SSSDConfig object. This function will also
remove this domain from the list of active domains in the [SSSD]
section, if it is there.
=== Returns ===
No return value
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
R� s domain/%sN( R R RB R/ ( R� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt
delete_domain s
c C s� | j s t � n t | t � s* t � n | j � } d } | j r� | j | k r� | j | j � | j d d | j � } d | _ n d | } | j
| j d | � \ } } | | j � k r� | j
| g � n xa | j | � D]P } | d d k r� | d | j � k r6| j | d d | d t � q6q� q� Wx{ | j � j � D]g \ } } t | � t k r}d j | � } n | d k r�| j | � } n | j | | t | � � qMW| j r�| j | � n
| j | � d S(
s9
Save the changes made to the domain object back to the SSSDConfig
object. If this domain is marked active, ensure it is present in the
active domain list in the [SSSD] section
domain_object:
The SSSDDomain object to save to the configuration.
=== Returns ===
No return value
=== Errors ===
NotInitializedError:
This SSSDConfig object has not had import_config() or new_config()
run on it yet.
TypeError:
domain_object was not of type SSSDDomain
R� s domain/%sR� R� R� R� s , R N( R R R� R� R� R� R� R� RB R/ t findOptsR R6 R3 R� R� t delete_option_subtreeR� R1 R� R� R+ R2 R* R� R� RA ( R� R� R� t oldindext sectionnamet not section_subtreeR� R� ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR? 5 s8
( N( R R R� R� R� R R R R% R& R R' R R- R. R0 R( R; R< R6 R> R@ R= RA RB RC R? ( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyR
r s0 - $ " " * * * " 5 * * (( R� R� t gettextR� R� t
ipachangeconfR t ExceptionR R R R R R R R
R R R
R R R R R t PACKAGEt LOCALEDIRt translationR� R� t _t ugettextR� R� R� R� t objectR� R� R� R
( ( ( s7 /usr/lib/python2.7/site-packages/SSSDConfig/__init__.pyt <module> s(
�<�� �