ipa/freeipa-3.0.0.pre1-025-warn-user-if-an-id-range-with-incorrect-size-was-cre.patch

From 378238b14e9faec4b871ff0178aa78e62e9b3580 Mon Sep 17 00:00:00 2001
From: Martin Kosek <mkosek@redhat.com>
Date: Wed, 11 Jul 2012 16:13:25 +0200
Subject: [PATCH 25/79] Warn user if an ID range with incorrect size was
 created

IPA 3.0 introduced range ID objects in replicated space which specify
a range of IDs assigned via DNA plugin. ipa-ldap-updater generates the
default ID range which should correspond with IDs assigned to IPA
users.

However, since correct range size is not known, we should at least
warn that a range with invalid size was created so that user can
amend it.

https://fedorahosted.org/freeipa/ticket/2892
---
 ipalib/constants.py                  |  2 ++
 ipaserver/install/plugins/adtrust.py | 59 ++++++++++++++++++++++++++++++++----
 2 files changed, 55 insertions(+), 6 deletions(-)

diff --git a/ipalib/constants.py b/ipalib/constants.py
index ad6d188692aa3de70cf29d5662d84672054ab4ef..f0f89a3b3ff51e06709809d4d606af96d13a7063 100644
--- a/ipalib/constants.py
+++ b/ipalib/constants.py
@@ -105,6 +105,8 @@ DEFAULT_CONFIG = (
     ('container_trusts', 'cn=trusts'),
     ('container_adtrusts', 'cn=ad,cn=trusts'),
     ('container_ranges', 'cn=ranges,cn=etc'),
+    ('container_dna', 'cn=dna,cn=ipa,cn=etc'),
+    ('container_dna_posix_ids', 'cn=posix-ids,cn=dna,cn=ipa,cn=etc'),
 
     # Ports, hosts, and URIs:
     # FIXME: let's renamed xmlrpc_uri to rpc_xml_uri
diff --git a/ipaserver/install/plugins/adtrust.py b/ipaserver/install/plugins/adtrust.py
index abd676a2bcbec57f59eb6710560281d945cf0cea..c32d82e3a8814840e75c74b86618e4098b2fb351 100644
--- a/ipaserver/install/plugins/adtrust.py
+++ b/ipaserver/install/plugins/adtrust.py
@@ -23,6 +23,8 @@ from ipalib import api, errors
 from ipalib.dn import DN
 from ipapython.ipa_log_manager import *
 
+DEFAULT_ID_RANGE_SIZE = 200000
+
 class update_default_range(PostUpdate):
     """
     Create default ID range for upgraded servers.
@@ -46,18 +48,19 @@ class update_default_range(PostUpdate):
         try:
             (dn, admins_entry) = ldap.get_entry(dn, ['gidnumber'])
         except errors.NotFound:
-            root_logger.error("No local ID range and no admins group found. "
-                              "Cannot create default ID range")
+            root_logger.error("default_range: No local ID range and no admins "
+                              "group found. Cannot create default ID range")
             return (False, False, [])
 
-        base_id = admins_entry['gidnumber'][0]
-        id_range_size = 200000
+        id_range_base_id = admins_entry['gidnumber'][0]
+        id_range_name = '%s_id_range' % api.env.realm
+        id_range_size = DEFAULT_ID_RANGE_SIZE
 
         range_entry = ['objectclass:top',
                        'objectclass:ipaIDrange',
                        'objectclass:ipaDomainIDRange',
-                       'cn:%s_id_range' % api.env.realm,
-                       'ipabaseid:%s' % base_id,
+                       'cn:%s' % id_range_name,
+                       'ipabaseid:%s' % id_range_base_id,
                        'ipaidrangesize:%s' % id_range_size,
                       ]
 
@@ -69,6 +72,50 @@ class update_default_range(PostUpdate):
         range_entry = map(str, range_entry)
         updates[dn] = {'dn' : dn, 'default' : range_entry}
 
+        # Default range entry has a hard-coded range size to 200000 which is
+        # a default range size in ipa-server-install. This could cause issues
+        # if user did not use a default range, but rather defined an own,
+        # bigger range (option --idmax).
+        # We should make our best to check if this is the case and provide
+        # user with an information how to fix it.
+        dn = str(DN(api.env.container_dna_posix_ids, api.env.basedn))
+        search_filter = "objectclass=dnaSharedConfig"
+        attrs = ['dnaHostname', 'dnaRemainingValues']
+        try:
+            (entries, truncated) = ldap.find_entries(search_filter, attrs, dn)
+        except errors.NotFound:
+            root_logger.warning("default_range: no dnaSharedConfig object found. "
+                                "Cannot check default range size.")
+        else:
+            masters = set()
+            remaining_values_sum = 0
+            for entry_dn, entry in entries:
+                hostname = entry.get('dnahostname', [None])[0]
+                if hostname is None or hostname in masters:
+                    continue
+                remaining_values = entry.get('dnaremainingvalues', [''])[0]
+                try:
+                    remaining_values = int(remaining_values)
+                except ValueError:
+                    root_logger.warning("default_range: could not parse "
+                        "remaining values from '%s'", remaining_values)
+                    continue
+                else:
+                    remaining_values_sum += remaining_values
+
+                masters.add(hostname)
+
+            if remaining_values_sum > DEFAULT_ID_RANGE_SIZE:
+                msg = ['could not verify default ID range size',
+                       'Please use the following command to set correct ID range size',
+                       '  $ ipa range-mod %s --range-size=RANGE_SIZE' % id_range_name,
+                       'RANGE_SIZE may be computed from --idstart and --idmax options '
+                       'used during IPA server installation:',
+                       '  RANGE_SIZE = (--idmax) - (--idstart) + 1'
+                      ]
+
+                root_logger.error("default_range: %s", "\n".join(msg))
+
         return (False, True, [updates])
 
 api.register(update_default_range)
-- 
1.7.11.2