Integrate the rebuild membership feature of the automember DS plugin into IPA CLI and Web UI.
Make sure that user or host membership can be easily rebuilt, based on new or updated automember rules.
Add a new CLI command
ipa automember-rebuild, to rebuild auto
membership for specified entries. Hook the command into web UI
Note that automember rebuild command only adds new membership relationship, it does not remove those that do not match automember rules.
The newly added command will invoke the
automember rebuild membership task, by creating an LDAP entry under
cn=automember rebuild membership,cn=tasks,cn=config. The details of
automember plugin tasks implementation and usage are described
Hook the new command into the web UI: to the user and host pages. Add a new action ‘Rebuild auto membership’, and place it appropriately on these pages.
On the user search facet, add the new action to the action list. This makes it possible to rebuild auto membership for multiple users. Executing the action without selecting any users will run the task for all the users (using –type=group).
On the user details facet, add the new action to the action list. This makes it possible to rebuild automembership for a single user.
On the host search facet, add the new action to the action list. This makes it possible to rebuild auto membership for multiple hosts.
Executing the action without selecting any hosts will run the task for all the hosts (using –type=hostgroup).
On the host details facet, add the new action to the action list. This makes it possible to rebuild automembership for a single host.
ipa automember-rebuild can be used to rebuild membership for all
objects of certain type:
It can also be used to rebuild membership for the specified entries:
Updates and Upgrades#
A new ACI, a permission and a privilege will be created in order to support creation of automember tasks:
Automember Task Administrator, which will contain two permissions listed below
Add Automember Rebuild Membership Task
underlying ACI for the permission listed above
How to Test#
Add a hostgroup:
`` $ ipa hostgroup-add –desc=”Web Servers” webservers``
Add a host:
`` $ ipa host-add web1.example.com –force``
Add an automember rule:
The automember feature is now working for newly added entries. If we add a new host, it will be automatically placed in the appropriate hostgroup:
However, the old host entry for
web1.example.com is still not a
member or the
webservers hostgroup. By introducting the new
automember-rebuild commands, we make it possible:
`` $ ipa automember-rebuild –type=hostgroup``
`` $ ipa automember-rebuild –hosts=web1.example.com``
will run the
automember rebuild membership task and consequently
place the host in the appropriate hostgroup:
The same mechanism applies for users and groups.
See test_automember_plugin.py for the list of test cases.