Skip to content

Enhanced IPA Role with HBAC Support and Unified IPA Search Helper#190

Merged
madhuriupadhye merged 1 commit into
SSSD:masterfrom
madhuriupadhye:hbac
Oct 15, 2025
Merged

Enhanced IPA Role with HBAC Support and Unified IPA Search Helper#190
madhuriupadhye merged 1 commit into
SSSD:masterfrom
madhuriupadhye:hbac

Conversation

@madhuriupadhye

@madhuriupadhye madhuriupadhye commented Jun 5, 2025

Copy link
Copy Markdown
Contributor
Adds comprehensive Host-Based Access Control (HBAC) management and
search capabilities to the IPA role.

Key additions:
        IPAHBACService: Manage HBAC services used in access control policies.
        IPAHBACServiceGroup: Group HBAC services for more flexible policy definitions.
        IPAHostGroup: Manage host groups, including retrieval and searching capabilities.
        IPAHBAC: Manage HBAC rules, including creation, modification, enabling/disabling, and access testing.

Unified Search Helper:
        Introduction of the ipa_search static method inside the main IPA role class that provides:
        A generic IPA CLI command execution and output parsing framework.
        Simplifies search logic across IPA entity classes like HBACService, HBACServiceGroup, HostGroup, and HBAC.
        Returns consistent, flat lists of attribute values from search results.
        Standardizes use of the --all option and multi-block output parsing.

@justin-stephenson justin-stephenson self-assigned this Jun 5, 2025
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
@madhuriupadhye
madhuriupadhye force-pushed the hbac branch 2 times, most recently from c888a3f to 2989749 Compare July 4, 2025 14:51
@justin-stephenson

Copy link
Copy Markdown
Contributor

Please fix flake8 issues:

lint: commands[0]> flake8 sssd_test_framework tests
 sssd_test_framework/roles/ipa.py:354:120: E501 line too long (127 > 119 characters)
 sssd_test_framework/roles/ipa.py:356:120: E501 line too long (134 > 119 characters)
 sssd_test_framework/roles/ipa.py:358:120: E501 line too long (127 > 119 characters)
 sssd_test_framework/roles/ipa.py:362:120: E501 line too long (127 > 119 characters)
 sssd_test_framework/roles/ipa.py:363:120: E501 line too long (143 > 119 characters)
 sssd_test_framework/roles/ipa.py:365:120: E501 line too long (127 > 119 characters)
 sssd_test_framework/roles/ipa.py:366:120: E501 line too long (143 > 119 characters)
 sssd_test_framework/roles/ipa.py:391:32: E231 missing whitespace after ':'
 sssd_test_framework/roles/ipa.py:394:1: E302 expected 2 blank lines, found 1
 sssd_test_framework/roles/ipa.py:2793:10: W292 no newline at end of file

@danlavu danlavu left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this still a cursory review? If it is, everything looks good, I just have a question about why info method output. If not, I need a little more time to review it.

Comment thread sssd_test_framework/roles/ipa.py Outdated
@madhuriupadhye
madhuriupadhye force-pushed the hbac branch 2 times, most recently from 9082329 to 6fde099 Compare September 30, 2025 15:12
@madhuriupadhye madhuriupadhye changed the title HBAC class Enhanced IPA Role with HBAC Support and Unified IPA Search Helper Sep 30, 2025
@madhuriupadhye
madhuriupadhye marked this pull request as ready for review September 30, 2025 15:15
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py
@danlavu danlavu added the Enhancement New feature or request label Oct 2, 2025

@danlavu danlavu left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Other than the docstring fixes, it looks great, thank you.

Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py
Comment thread sssd_test_framework/roles/ipa.py

@justin-stephenson justin-stephenson left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack, LGTM. Thank you.

danlavu
danlavu previously approved these changes Oct 9, 2025

@danlavu danlavu left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One minor phrasing, otherwise it looks great, thank you!

Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
Comment thread sssd_test_framework/roles/ipa.py Outdated
@madhuriupadhye
madhuriupadhye force-pushed the hbac branch 2 times, most recently from 2d1098e to 1ab29cf Compare October 13, 2025 13:38
Adds comprehensive Host-Based Access Control (HBAC) management and
search capabilities to the IPA role in the SSSD test framework.

Key additions:
	IPAHBACService: Manage HBAC services used in access control policies.
	IPAHBACServiceGroup: Group HBAC services for more flexible policy definitions.
	IPAHostGroup: Manage host groups, including retrieval and searching capabilities.
	IPAHBAC: Manage HBAC rules, including creation, modification, enabling/disabling, and access testing.

Unified Search Helper:
	Introduction of the ipa_search static method inside the main IPA role class that provides:
	A generic IPA CLI command execution and output parsing framework.
	Simplifies search logic across IPA entity classes like HBACService, HBACServiceGroup, HostGroup, and HBAC.
	Returns consistent, flat lists of attribute values from search results.
	Standardizes use of the --all option and multi-block output parsing.

Signed-off-by: Madhuri Upadhye <[email protected]>
@madhuriupadhye
madhuriupadhye merged commit c6774d5 into SSSD:master Oct 15, 2025
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Enhancement New feature or request Waiting for review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants