pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0057-idranges-raise-an-error-when-local-IPA-ID-range-is-b.patch

590d18
From 887bd5f84d862dfb923c72a60b4491374be34d5f Mon Sep 17 00:00:00 2001
590d18
From: Martin Babinsky <mbabinsk@redhat.com>
590d18
Date: Fri, 7 Aug 2015 15:44:57 +0200
590d18
Subject: [PATCH] idranges: raise an error when local IPA ID range is being
590d18
 modified
590d18
590d18
also show the message about the way UID/GID ranges are managed in FreeIPA in
590d18
the idrange-mod's help message
590d18
590d18
https://fedorahosted.org/freeipa/ticket/4826
590d18
590d18
Reviewed-By: Tomas Babej <tbabej@redhat.com>
590d18
---
590d18
 ipalib/plugins/idrange.py | 52 ++++++++++++++++++++++++++---------------------
590d18
 1 file changed, 29 insertions(+), 23 deletions(-)
590d18
590d18
diff --git a/ipalib/plugins/idrange.py b/ipalib/plugins/idrange.py
590d18
index fb198d79d4c14ffd5f7dc633c9f01a1465ff01d7..2cec05bd8f837fb27803b869bf33fe389126506c 100644
590d18
--- a/ipalib/plugins/idrange.py
590d18
+++ b/ipalib/plugins/idrange.py
590d18
@@ -31,6 +31,20 @@ if api.env.in_server and api.env.context in ['lite', 'server']:
590d18
     except ImportError:
590d18
         _dcerpc_bindings_installed = False
590d18
 
590d18
+ID_RANGE_VS_DNA_WARNING = """=======
590d18
+WARNING:
590d18
+
590d18
+DNA plugin in 389-ds will allocate IDs based on the ranges configured for the
590d18
+local domain. Currently the DNA plugin *cannot* be reconfigured itself based
590d18
+on the local ranges set via this family of commands.
590d18
+
590d18
+Manual configuration change has to be done in the DNA plugin configuration for
590d18
+the new local range. Specifically, The dnaNextRange attribute of 'cn=Posix
590d18
+IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config' has to be
590d18
+modified to match the new range.
590d18
+=======
590d18
+"""
590d18
+
590d18
 __doc__ = _("""
590d18
 ID ranges
590d18
 
590d18
@@ -139,17 +153,8 @@ this domain has the SID S-1-5-21-123-456-789-1010 then 1010 id the RID of the
590d18
 user. RIDs are unique in a domain, 32bit values and are used for users and
590d18
 groups.
590d18
 
590d18
-WARNING:
590d18
-
590d18
-DNA plugin in 389-ds will allocate IDs based on the ranges configured for the
590d18
-local domain. Currently the DNA plugin *cannot* be reconfigured itself based
590d18
-on the local ranges set via this family of commands.
590d18
-
590d18
-Manual configuration change has to be done in the DNA plugin configuration for
590d18
-the new local range. Specifically, The dnaNextRange attribute of 'cn=Posix
590d18
-IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config' has to be
590d18
-modified to match the new range.
590d18
-""")
590d18
+{0}
590d18
+""".format(ID_RANGE_VS_DNA_WARNING))
590d18
 
590d18
 register = Registry()
590d18
 
590d18
@@ -386,17 +391,8 @@ class idrange_add(LDAPCreate):
590d18
 
590d18
     must be given to add a new range for a trusted AD domain.
590d18
 
590d18
-    WARNING:
590d18
-
590d18
-    DNA plugin in 389-ds will allocate IDs based on the ranges configured for the
590d18
-    local domain. Currently the DNA plugin *cannot* be reconfigured itself based
590d18
-    on the local ranges set via this family of commands.
590d18
-
590d18
-    Manual configuration change has to be done in the DNA plugin configuration for
590d18
-    the new local range. Specifically, The dnaNextRange attribute of 'cn=Posix
590d18
-    IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config' has to be
590d18
-    modified to match the new range.
590d18
-    """)
590d18
+{0}
590d18
+""".format(ID_RANGE_VS_DNA_WARNING))
590d18
 
590d18
     msg_summary = _('Added ID range "%(value)s"')
590d18
 
590d18
@@ -670,7 +666,10 @@ class idrange_show(LDAPRetrieve):
590d18
 
590d18
 @register()
590d18
 class idrange_mod(LDAPUpdate):
590d18
-    __doc__ = _('Modify ID range.')
590d18
+    __doc__ = _("""Modify ID range.
590d18
+
590d18
+{0}
590d18
+""".format(ID_RANGE_VS_DNA_WARNING))
590d18
 
590d18
     msg_summary = _('Modified ID range "%(value)s"')
590d18
 
590d18
@@ -688,6 +687,13 @@ class idrange_mod(LDAPUpdate):
590d18
         except errors.NotFound:
590d18
             self.obj.handle_not_found(*keys)
590d18
 
590d18
+        if old_attrs['iparangetype'][0] == 'ipa-local':
590d18
+            raise errors.ExecutionError(
590d18
+                message=_('This command can not be used to change ID '
590d18
+                          'allocation for local IPA domain. Run '
590d18
+                          '`ipa help idrange` for more information')
590d18
+            )
590d18
+
590d18
         is_set = lambda x: (x in entry_attrs) and (entry_attrs[x] is not None)
590d18
         in_updated_attrs = lambda x:\
590d18
             (x in entry_attrs and entry_attrs[x] is not None) or\
590d18
-- 
590d18
2.4.3
590d18