pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0069-Upgrade-add-gidnumber-to-trusted-domain-entry.patch

ac7d03
From 54422d3c58ace8496b0bd2fc536365159e6666e6 Mon Sep 17 00:00:00 2001
ac7d03
From: Florence Blanc-Renaud <flo@redhat.com>
ac7d03
Date: Mon, 3 Apr 2017 15:57:47 +0200
ac7d03
Subject: [PATCH] Upgrade: add gidnumber to trusted domain entry
ac7d03
ac7d03
The trusted domain entries created in earlier versions are missing gidnumber.
ac7d03
During upgrade, a new plugin will read the gidnumber of the fallback group
ac7d03
cn=Default SMB Group and add this value to trusted domain entries which do
ac7d03
not have a gidNumber.
ac7d03
ac7d03
https://pagure.io/freeipa/issue/6827
ac7d03
ac7d03
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
ac7d03
---
ac7d03
 install/updates/90-post_upgrade_plugins.update |  1 +
ac7d03
 ipaserver/install/plugins/adtrust.py           | 56 ++++++++++++++++++++++++++
ac7d03
 2 files changed, 57 insertions(+)
ac7d03
ac7d03
diff --git a/install/updates/90-post_upgrade_plugins.update b/install/updates/90-post_upgrade_plugins.update
ac7d03
index 34069e7457dd9690a14c5c055c6d05ad76004d16..8477199e07d6729d5847e58bfa67d061bd1410c2 100644
ac7d03
--- a/install/updates/90-post_upgrade_plugins.update
ac7d03
+++ b/install/updates/90-post_upgrade_plugins.update
ac7d03
@@ -10,6 +10,7 @@ plugin: update_sigden_extdom_broken_config
ac7d03
 plugin: update_sids
ac7d03
 plugin: update_default_range
ac7d03
 plugin: update_default_trust_view
ac7d03
+plugin: update_tdo_gidnumber
ac7d03
 plugin: update_ca_renewal_master
ac7d03
 plugin: update_idrange_type
ac7d03
 plugin: update_pacs
ac7d03
diff --git a/ipaserver/install/plugins/adtrust.py b/ipaserver/install/plugins/adtrust.py
ac7d03
index 42968089f547f61edd2f1223d088a22762a33b70..075f197780edc2aadf42fa82b71e9e2b29e66ea9 100644
ac7d03
--- a/ipaserver/install/plugins/adtrust.py
ac7d03
+++ b/ipaserver/install/plugins/adtrust.py
ac7d03
@@ -22,6 +22,7 @@ from ipalib import Updater
ac7d03
 from ipapython.dn import DN
ac7d03
 from ipapython.ipa_log_manager import root_logger
ac7d03
 from ipaserver.install import sysupgrade
ac7d03
+from ipaserver.install.adtrustinstance import ADTRUSTInstance
ac7d03
 
ac7d03
 register = Registry()
ac7d03
 
ac7d03
@@ -316,3 +317,58 @@ class update_sids(Updater):
ac7d03
 
ac7d03
         sysupgrade.set_upgrade_state('sidgen', 'update_sids', False)
ac7d03
         return False, ()
ac7d03
+
ac7d03
+
ac7d03
+@register()
ac7d03
+class update_tdo_gidnumber(Updater):
ac7d03
+    """
ac7d03
+    Create a gidNumber attribute for Trusted Domain Objects.
ac7d03
+
ac7d03
+    The value is taken from the fallback group defined in cn=Default SMB Group.
ac7d03
+    """
ac7d03
+    def execute(self, **options):
ac7d03
+        ldap = self.api.Backend.ldap2
ac7d03
+
ac7d03
+        # Read the gidnumber of the fallback group
ac7d03
+        dn = DN(('cn', ADTRUSTInstance.FALLBACK_GROUP_NAME),
ac7d03
+                self.api.env.container_group,
ac7d03
+                self.api.env.basedn)
ac7d03
+
ac7d03
+        try:
ac7d03
+            entry = ldap.get_entry(dn, ['gidnumber'])
ac7d03
+            gidNumber = entry.get('gidnumber')
ac7d03
+        except errors.NotFound:
ac7d03
+            self.log.error("{0} not found".format(
ac7d03
+                ADTRUSTInstance.FALLBACK_GROUP_NAME))
ac7d03
+            return False, ()
ac7d03
+
ac7d03
+        if not gidNumber:
ac7d03
+            self.log.error("{0} does not have a gidnumber".format(
ac7d03
+                ADTRUSTInstance.FALLBACK_GROUP_NAME))
ac7d03
+            return False, ()
ac7d03
+
ac7d03
+        # For each trusted domain object, add gidNumber
ac7d03
+        try:
ac7d03
+            tdos = ldap.get_entries(
ac7d03
+                DN(self.api.env.container_adtrusts, self.api.env.basedn),
ac7d03
+                scope=ldap.SCOPE_ONELEVEL,
ac7d03
+                filter="(objectclass=ipaNTTrustedDomain)",
ac7d03
+                attrs_list=['gidnumber'])
ac7d03
+            for tdo in tdos:
ac7d03
+                # if the trusted domain object does not contain gidnumber,
ac7d03
+                # add the default fallback group gidnumber
ac7d03
+                if not tdo.get('gidnumber'):
ac7d03
+                    try:
ac7d03
+                        tdo['gidnumber'] = gidNumber
ac7d03
+                        ldap.update_entry(tdo)
ac7d03
+                        self.log.debug("Added gidnumber {0} to {1}".format(
ac7d03
+                            gidNumber, tdo.dn))
ac7d03
+                    except Exception:
ac7d03
+                        self.log.warning(
ac7d03
+                            "Failed to add gidnumber to {0}".format(tdo.dn))
ac7d03
+
ac7d03
+        except errors.NotFound:
ac7d03
+            self.log.debug("No trusted domain object to update")
ac7d03
+            return False, ()
ac7d03
+
ac7d03
+        return False, ()
ac7d03
-- 
ac7d03
2.9.3
ac7d03