|
 |
ac7d03 |
From 54422d3c58ace8496b0bd2fc536365159e6666e6 Mon Sep 17 00:00:00 2001
|
|
|
ac7d03 |
From: Florence Blanc-Renaud <flo@redhat.com>
|
|
|
ac7d03 |
Date: Mon, 3 Apr 2017 15:57:47 +0200
|
|
|
ac7d03 |
Subject: [PATCH] Upgrade: add gidnumber to trusted domain entry
|
|
|
ac7d03 |
|
|
|
ac7d03 |
The trusted domain entries created in earlier versions are missing gidnumber.
|
|
|
ac7d03 |
During upgrade, a new plugin will read the gidnumber of the fallback group
|
|
|
ac7d03 |
cn=Default SMB Group and add this value to trusted domain entries which do
|
|
|
ac7d03 |
not have a gidNumber.
|
|
|
ac7d03 |
|
|
|
ac7d03 |
https://pagure.io/freeipa/issue/6827
|
|
|
ac7d03 |
|
|
|
ac7d03 |
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
ac7d03 |
---
|
|
|
ac7d03 |
install/updates/90-post_upgrade_plugins.update | 1 +
|
|
|
ac7d03 |
ipaserver/install/plugins/adtrust.py | 56 ++++++++++++++++++++++++++
|
|
|
ac7d03 |
2 files changed, 57 insertions(+)
|
|
|
ac7d03 |
|
|
|
ac7d03 |
diff --git a/install/updates/90-post_upgrade_plugins.update b/install/updates/90-post_upgrade_plugins.update
|
|
|
ac7d03 |
index 34069e7457dd9690a14c5c055c6d05ad76004d16..8477199e07d6729d5847e58bfa67d061bd1410c2 100644
|
|
|
ac7d03 |
--- a/install/updates/90-post_upgrade_plugins.update
|
|
|
ac7d03 |
+++ b/install/updates/90-post_upgrade_plugins.update
|
|
|
ac7d03 |
@@ -10,6 +10,7 @@ plugin: update_sigden_extdom_broken_config
|
|
|
ac7d03 |
plugin: update_sids
|
|
|
ac7d03 |
plugin: update_default_range
|
|
|
ac7d03 |
plugin: update_default_trust_view
|
|
|
ac7d03 |
+plugin: update_tdo_gidnumber
|
|
|
ac7d03 |
plugin: update_ca_renewal_master
|
|
|
ac7d03 |
plugin: update_idrange_type
|
|
|
ac7d03 |
plugin: update_pacs
|
|
|
ac7d03 |
diff --git a/ipaserver/install/plugins/adtrust.py b/ipaserver/install/plugins/adtrust.py
|
|
|
ac7d03 |
index 42968089f547f61edd2f1223d088a22762a33b70..075f197780edc2aadf42fa82b71e9e2b29e66ea9 100644
|
|
|
ac7d03 |
--- a/ipaserver/install/plugins/adtrust.py
|
|
|
ac7d03 |
+++ b/ipaserver/install/plugins/adtrust.py
|
|
|
ac7d03 |
@@ -22,6 +22,7 @@ from ipalib import Updater
|
|
|
ac7d03 |
from ipapython.dn import DN
|
|
|
ac7d03 |
from ipapython.ipa_log_manager import root_logger
|
|
|
ac7d03 |
from ipaserver.install import sysupgrade
|
|
|
ac7d03 |
+from ipaserver.install.adtrustinstance import ADTRUSTInstance
|
|
|
ac7d03 |
|
|
|
ac7d03 |
register = Registry()
|
|
|
ac7d03 |
|
|
|
ac7d03 |
@@ -316,3 +317,58 @@ class update_sids(Updater):
|
|
|
ac7d03 |
|
|
|
ac7d03 |
sysupgrade.set_upgrade_state('sidgen', 'update_sids', False)
|
|
|
ac7d03 |
return False, ()
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+@register()
|
|
|
ac7d03 |
+class update_tdo_gidnumber(Updater):
|
|
|
ac7d03 |
+ """
|
|
|
ac7d03 |
+ Create a gidNumber attribute for Trusted Domain Objects.
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ The value is taken from the fallback group defined in cn=Default SMB Group.
|
|
|
ac7d03 |
+ """
|
|
|
ac7d03 |
+ def execute(self, **options):
|
|
|
ac7d03 |
+ ldap = self.api.Backend.ldap2
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ # Read the gidnumber of the fallback group
|
|
|
ac7d03 |
+ dn = DN(('cn', ADTRUSTInstance.FALLBACK_GROUP_NAME),
|
|
|
ac7d03 |
+ self.api.env.container_group,
|
|
|
ac7d03 |
+ self.api.env.basedn)
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ try:
|
|
|
ac7d03 |
+ entry = ldap.get_entry(dn, ['gidnumber'])
|
|
|
ac7d03 |
+ gidNumber = entry.get('gidnumber')
|
|
|
ac7d03 |
+ except errors.NotFound:
|
|
|
ac7d03 |
+ self.log.error("{0} not found".format(
|
|
|
ac7d03 |
+ ADTRUSTInstance.FALLBACK_GROUP_NAME))
|
|
|
ac7d03 |
+ return False, ()
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ if not gidNumber:
|
|
|
ac7d03 |
+ self.log.error("{0} does not have a gidnumber".format(
|
|
|
ac7d03 |
+ ADTRUSTInstance.FALLBACK_GROUP_NAME))
|
|
|
ac7d03 |
+ return False, ()
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ # For each trusted domain object, add gidNumber
|
|
|
ac7d03 |
+ try:
|
|
|
ac7d03 |
+ tdos = ldap.get_entries(
|
|
|
ac7d03 |
+ DN(self.api.env.container_adtrusts, self.api.env.basedn),
|
|
|
ac7d03 |
+ scope=ldap.SCOPE_ONELEVEL,
|
|
|
ac7d03 |
+ filter="(objectclass=ipaNTTrustedDomain)",
|
|
|
ac7d03 |
+ attrs_list=['gidnumber'])
|
|
|
ac7d03 |
+ for tdo in tdos:
|
|
|
ac7d03 |
+ # if the trusted domain object does not contain gidnumber,
|
|
|
ac7d03 |
+ # add the default fallback group gidnumber
|
|
|
ac7d03 |
+ if not tdo.get('gidnumber'):
|
|
|
ac7d03 |
+ try:
|
|
|
ac7d03 |
+ tdo['gidnumber'] = gidNumber
|
|
|
ac7d03 |
+ ldap.update_entry(tdo)
|
|
|
ac7d03 |
+ self.log.debug("Added gidnumber {0} to {1}".format(
|
|
|
ac7d03 |
+ gidNumber, tdo.dn))
|
|
|
ac7d03 |
+ except Exception:
|
|
|
ac7d03 |
+ self.log.warning(
|
|
|
ac7d03 |
+ "Failed to add gidnumber to {0}".format(tdo.dn))
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ except errors.NotFound:
|
|
|
ac7d03 |
+ self.log.debug("No trusted domain object to update")
|
|
|
ac7d03 |
+ return False, ()
|
|
|
ac7d03 |
+
|
|
|
ac7d03 |
+ return False, ()
|
|
|
ac7d03 |
--
|
|
|
ac7d03 |
2.9.3
|
|
|
ac7d03 |
|