Enforce sizelimit in cert-find

The sizelimit option was not being passed into the dogtag
ra_find() command so it always returned all available certificates.

A value of 0 will retain old behavior and return all certificates.

The default value is the LDAP searchsizelimit.

Related: https://pagure.io/freeipa/issue/9331

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>
Reviewed-By: Antonio Torres <antorres@redhat.com>

ipaserver/plugins/cert.py

@@ -1658,6 +1658,13 @@ class cert_find(Search, CertMethod):
             ra_options[name] = value
         if exactly:
             ra_options['exactly'] = True
+        if 'sizelimit' in options:
+            # sizelimit = 0 means return everything, drop it and let
+            # ra_find() handle the value.
+            if options['sizelimit'] > 0:
+                ra_options['sizelimit'] = options['sizelimit']
+        else:
+            ra_options['sizelimit'] = self.api.Backend.ldap2.size_limit
 
         result = collections.OrderedDict()
         complete = bool(ra_options)
@@ -1837,6 +1844,7 @@ class cert_find(Search, CertMethod):
             timelimit = self.api.Backend.ldap2.time_limit
         if sizelimit is None:
             sizelimit = self.api.Backend.ldap2.size_limit
+        options['sizelimit'] = sizelimit
 
         result = collections.OrderedDict()
         truncated = False

ipaserver/plugins/dogtag.py

@@ -1821,11 +1821,12 @@ class ra(rabase.rabase, RestClient):
                                  xml_declaration=True, encoding='UTF-8')
         logger.debug('%s.find(): request: %s', type(self).__name__, payload)
 
+        url = '/ca/rest/certs/search?size=%d' % (
+            options.get('sizelimit', 0x7fffffff))
         # pylint: disable=unused-variable
         status, _, data = dogtag.https_request(
             self.ca_host, 443,
-            url='/ca/rest/certs/search?size=%d' % (
-                 options.get('sizelimit', 0x7fffffff)),
+            url=url,
             client_certfile=None,
             client_keyfile=None,
             cafile=self.ca_cert,