mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-24 16:10:02 -06:00
Warn user if an ID range with incorrect size was created
IPA 3.0 introduced range ID objects in replicated space which specify a range of IDs assigned via DNA plugin. ipa-ldap-updater generates the default ID range which should correspond with IDs assigned to IPA users. However, since correct range size is not known, we should at least warn that a range with invalid size was created so that user can amend it. https://fedorahosted.org/freeipa/ticket/2892
This commit is contained in:
parent
34f8ff4793
commit
378238b14e
@ -105,6 +105,8 @@ DEFAULT_CONFIG = (
|
||||
('container_trusts', 'cn=trusts'),
|
||||
('container_adtrusts', 'cn=ad,cn=trusts'),
|
||||
('container_ranges', 'cn=ranges,cn=etc'),
|
||||
('container_dna', 'cn=dna,cn=ipa,cn=etc'),
|
||||
('container_dna_posix_ids', 'cn=posix-ids,cn=dna,cn=ipa,cn=etc'),
|
||||
|
||||
# Ports, hosts, and URIs:
|
||||
# FIXME: let's renamed xmlrpc_uri to rpc_xml_uri
|
||||
|
@ -23,6 +23,8 @@ from ipalib import api, errors
|
||||
from ipalib.dn import DN
|
||||
from ipapython.ipa_log_manager import *
|
||||
|
||||
DEFAULT_ID_RANGE_SIZE = 200000
|
||||
|
||||
class update_default_range(PostUpdate):
|
||||
"""
|
||||
Create default ID range for upgraded servers.
|
||||
@ -46,18 +48,19 @@ class update_default_range(PostUpdate):
|
||||
try:
|
||||
(dn, admins_entry) = ldap.get_entry(dn, ['gidnumber'])
|
||||
except errors.NotFound:
|
||||
root_logger.error("No local ID range and no admins group found. "
|
||||
"Cannot create default ID range")
|
||||
root_logger.error("default_range: No local ID range and no admins "
|
||||
"group found. Cannot create default ID range")
|
||||
return (False, False, [])
|
||||
|
||||
base_id = admins_entry['gidnumber'][0]
|
||||
id_range_size = 200000
|
||||
id_range_base_id = admins_entry['gidnumber'][0]
|
||||
id_range_name = '%s_id_range' % api.env.realm
|
||||
id_range_size = DEFAULT_ID_RANGE_SIZE
|
||||
|
||||
range_entry = ['objectclass:top',
|
||||
'objectclass:ipaIDrange',
|
||||
'objectclass:ipaDomainIDRange',
|
||||
'cn:%s_id_range' % api.env.realm,
|
||||
'ipabaseid:%s' % base_id,
|
||||
'cn:%s' % id_range_name,
|
||||
'ipabaseid:%s' % id_range_base_id,
|
||||
'ipaidrangesize:%s' % id_range_size,
|
||||
]
|
||||
|
||||
@ -69,6 +72,50 @@ class update_default_range(PostUpdate):
|
||||
range_entry = map(str, range_entry)
|
||||
updates[dn] = {'dn' : dn, 'default' : range_entry}
|
||||
|
||||
# Default range entry has a hard-coded range size to 200000 which is
|
||||
# a default range size in ipa-server-install. This could cause issues
|
||||
# if user did not use a default range, but rather defined an own,
|
||||
# bigger range (option --idmax).
|
||||
# We should make our best to check if this is the case and provide
|
||||
# user with an information how to fix it.
|
||||
dn = str(DN(api.env.container_dna_posix_ids, api.env.basedn))
|
||||
search_filter = "objectclass=dnaSharedConfig"
|
||||
attrs = ['dnaHostname', 'dnaRemainingValues']
|
||||
try:
|
||||
(entries, truncated) = ldap.find_entries(search_filter, attrs, dn)
|
||||
except errors.NotFound:
|
||||
root_logger.warning("default_range: no dnaSharedConfig object found. "
|
||||
"Cannot check default range size.")
|
||||
else:
|
||||
masters = set()
|
||||
remaining_values_sum = 0
|
||||
for entry_dn, entry in entries:
|
||||
hostname = entry.get('dnahostname', [None])[0]
|
||||
if hostname is None or hostname in masters:
|
||||
continue
|
||||
remaining_values = entry.get('dnaremainingvalues', [''])[0]
|
||||
try:
|
||||
remaining_values = int(remaining_values)
|
||||
except ValueError:
|
||||
root_logger.warning("default_range: could not parse "
|
||||
"remaining values from '%s'", remaining_values)
|
||||
continue
|
||||
else:
|
||||
remaining_values_sum += remaining_values
|
||||
|
||||
masters.add(hostname)
|
||||
|
||||
if remaining_values_sum > DEFAULT_ID_RANGE_SIZE:
|
||||
msg = ['could not verify default ID range size',
|
||||
'Please use the following command to set correct ID range size',
|
||||
' $ ipa range-mod %s --range-size=RANGE_SIZE' % id_range_name,
|
||||
'RANGE_SIZE may be computed from --idstart and --idmax options '
|
||||
'used during IPA server installation:',
|
||||
' RANGE_SIZE = (--idmax) - (--idstart) + 1'
|
||||
]
|
||||
|
||||
root_logger.error("default_range: %s", "\n".join(msg))
|
||||
|
||||
return (False, True, [updates])
|
||||
|
||||
api.register(update_default_range)
|
||||
|
Loading…
Reference in New Issue
Block a user