From 378238b14e9faec4b871ff0178aa78e62e9b3580 Mon Sep 17 00:00:00 2001 From: Martin Kosek Date: Wed, 11 Jul 2012 16:13:25 +0200 Subject: [PATCH 25/79] Warn user if an ID range with incorrect size was created IPA 3.0 introduced range ID objects in replicated space which specify a range of IDs assigned via DNA plugin. ipa-ldap-updater generates the default ID range which should correspond with IDs assigned to IPA users. However, since correct range size is not known, we should at least warn that a range with invalid size was created so that user can amend it. https://fedorahosted.org/freeipa/ticket/2892 --- ipalib/constants.py | 2 ++ ipaserver/install/plugins/adtrust.py | 59 ++++++++++++++++++++++++++++++++---- 2 files changed, 55 insertions(+), 6 deletions(-) diff --git a/ipalib/constants.py b/ipalib/constants.py index ad6d188692aa3de70cf29d5662d84672054ab4ef..f0f89a3b3ff51e06709809d4d606af96d13a7063 100644 --- a/ipalib/constants.py +++ b/ipalib/constants.py @@ -105,6 +105,8 @@ DEFAULT_CONFIG = ( ('container_trusts', 'cn=trusts'), ('container_adtrusts', 'cn=ad,cn=trusts'), ('container_ranges', 'cn=ranges,cn=etc'), + ('container_dna', 'cn=dna,cn=ipa,cn=etc'), + ('container_dna_posix_ids', 'cn=posix-ids,cn=dna,cn=ipa,cn=etc'), # Ports, hosts, and URIs: # FIXME: let's renamed xmlrpc_uri to rpc_xml_uri diff --git a/ipaserver/install/plugins/adtrust.py b/ipaserver/install/plugins/adtrust.py index abd676a2bcbec57f59eb6710560281d945cf0cea..c32d82e3a8814840e75c74b86618e4098b2fb351 100644 --- a/ipaserver/install/plugins/adtrust.py +++ b/ipaserver/install/plugins/adtrust.py @@ -23,6 +23,8 @@ from ipalib import api, errors from ipalib.dn import DN from ipapython.ipa_log_manager import * +DEFAULT_ID_RANGE_SIZE = 200000 + class update_default_range(PostUpdate): """ Create default ID range for upgraded servers. @@ -46,18 +48,19 @@ class update_default_range(PostUpdate): try: (dn, admins_entry) = ldap.get_entry(dn, ['gidnumber']) except errors.NotFound: - root_logger.error("No local ID range and no admins group found. " - "Cannot create default ID range") + root_logger.error("default_range: No local ID range and no admins " + "group found. Cannot create default ID range") return (False, False, []) - base_id = admins_entry['gidnumber'][0] - id_range_size = 200000 + id_range_base_id = admins_entry['gidnumber'][0] + id_range_name = '%s_id_range' % api.env.realm + id_range_size = DEFAULT_ID_RANGE_SIZE range_entry = ['objectclass:top', 'objectclass:ipaIDrange', 'objectclass:ipaDomainIDRange', - 'cn:%s_id_range' % api.env.realm, - 'ipabaseid:%s' % base_id, + 'cn:%s' % id_range_name, + 'ipabaseid:%s' % id_range_base_id, 'ipaidrangesize:%s' % id_range_size, ] @@ -69,6 +72,50 @@ class update_default_range(PostUpdate): range_entry = map(str, range_entry) updates[dn] = {'dn' : dn, 'default' : range_entry} + # Default range entry has a hard-coded range size to 200000 which is + # a default range size in ipa-server-install. This could cause issues + # if user did not use a default range, but rather defined an own, + # bigger range (option --idmax). + # We should make our best to check if this is the case and provide + # user with an information how to fix it. + dn = str(DN(api.env.container_dna_posix_ids, api.env.basedn)) + search_filter = "objectclass=dnaSharedConfig" + attrs = ['dnaHostname', 'dnaRemainingValues'] + try: + (entries, truncated) = ldap.find_entries(search_filter, attrs, dn) + except errors.NotFound: + root_logger.warning("default_range: no dnaSharedConfig object found. " + "Cannot check default range size.") + else: + masters = set() + remaining_values_sum = 0 + for entry_dn, entry in entries: + hostname = entry.get('dnahostname', [None])[0] + if hostname is None or hostname in masters: + continue + remaining_values = entry.get('dnaremainingvalues', [''])[0] + try: + remaining_values = int(remaining_values) + except ValueError: + root_logger.warning("default_range: could not parse " + "remaining values from '%s'", remaining_values) + continue + else: + remaining_values_sum += remaining_values + + masters.add(hostname) + + if remaining_values_sum > DEFAULT_ID_RANGE_SIZE: + msg = ['could not verify default ID range size', + 'Please use the following command to set correct ID range size', + ' $ ipa range-mod %s --range-size=RANGE_SIZE' % id_range_name, + 'RANGE_SIZE may be computed from --idstart and --idmax options ' + 'used during IPA server installation:', + ' RANGE_SIZE = (--idmax) - (--idstart) + 1' + ] + + root_logger.error("default_range: %s", "\n".join(msg)) + return (False, True, [updates]) api.register(update_default_range) -- 1.7.11.2