Blame SOURCES/ansible-freeipa-1.6.3-ipaserver-ipareplica-Always-generate-SIDs_PR866_RHBZ#2132971.patch

e788bc
diff -up ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_prepare.py.always_sids ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_prepare.py
e788bc
--- ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_prepare.py.always_sids	2022-01-27 14:05:04.000000000 +0100
e788bc
+++ ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_prepare.py	2022-10-07 16:51:35.750411448 +0200
e788bc
@@ -182,6 +182,9 @@ options:
e788bc
   skip_conncheck:
e788bc
     description: Skip connection check to remote master
e788bc
     required: yes
e788bc
+  sid_generation_always:
e788bc
+    description: Enable SID generation always
e788bc
+    required: yes
e788bc
 author:
e788bc
     - Thomas Woerner
e788bc
 '''
e788bc
@@ -275,6 +278,8 @@ def main():
e788bc
             # additional
e788bc
             server=dict(required=True),
e788bc
             skip_conncheck=dict(required=False, type='bool'),
e788bc
+            sid_generation_always=dict(required=False, type='bool',
e788bc
+                                       default=False),
e788bc
         ),
e788bc
         supports_check_mode=True,
e788bc
     )
e788bc
@@ -350,6 +355,7 @@ def main():
e788bc
     #     '_hostname_overridden')
e788bc
     options.server = ansible_module.params.get('server')
e788bc
     options.skip_conncheck = ansible_module.params.get('skip_conncheck')
e788bc
+    sid_generation_always = ansible_module.params.get('sid_generation_always')
e788bc
 
e788bc
     # init #
e788bc
 
e788bc
@@ -755,7 +761,7 @@ def main():
e788bc
 
e788bc
         ansible_log.debug("-- CHECK ADTRUST --")
e788bc
 
e788bc
-        if options.setup_adtrust:
e788bc
+        if options.setup_adtrust or sid_generation_always:
e788bc
             adtrust.install_check(False, options, remote_api)
e788bc
 
e788bc
     except errors.ACIError:
e788bc
diff -up ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_setup_adtrust.py.always_sids ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_setup_adtrust.py
e788bc
--- ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_setup_adtrust.py.always_sids	2022-01-27 14:05:04.000000000 +0100
e788bc
+++ ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_setup_adtrust.py	2022-10-07 16:44:59.008094369 +0200
e788bc
@@ -71,6 +71,9 @@ options:
e788bc
   setup_ca:
e788bc
     description: Configure a dogtag CA
e788bc
     required: no
e788bc
+  setup_adtrust:
e788bc
+    description: Configure AD trust capability
e788bc
+    required: yes
e788bc
   config_master_host_name:
e788bc
     description: The config master_host_name setting
e788bc
     required: no
e788bc
@@ -112,6 +115,7 @@ def main():
e788bc
             ccache=dict(required=True),
e788bc
             _top_dir=dict(required=True),
e788bc
             setup_ca=dict(required=True, type='bool'),
e788bc
+            setup_adtrust=dict(required=True, type='bool'),
e788bc
             config_master_host_name=dict(required=True),
e788bc
         ),
e788bc
         supports_check_mode=True,
e788bc
@@ -140,6 +144,7 @@ def main():
e788bc
     os.environ['KRB5CCNAME'] = ccache
e788bc
     options._top_dir = ansible_module.params.get('_top_dir')
e788bc
     options.setup_ca = ansible_module.params.get('setup_ca')
e788bc
+    options.setup_adtrust = ansible_module.params.get('setup_adtrust')
e788bc
     config_master_host_name = ansible_module.params.get(
e788bc
         'config_master_host_name')
e788bc
     adtrust.netbios_name = ansible_module.params.get('adtrust_netbios_name')
e788bc
diff -up ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_test.py.always_sids ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_test.py
e788bc
--- ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_test.py.always_sids	2022-01-27 14:05:04.000000000 +0100
e788bc
+++ ansible-freeipa-1.6.3/roles/ipareplica/library/ipareplica_test.py	2022-10-07 16:50:45.621497736 +0200
e788bc
@@ -144,7 +144,7 @@ from ansible.module_utils.ansible_ipa_re
e788bc
     ansible_module_get_parsed_ip_addresses, service,
e788bc
     redirect_stdout, create_ipa_conf, ipautil,
e788bc
     x509, validate_domain_name, common_check,
e788bc
-    IPA_PYTHON_VERSION
e788bc
+    IPA_PYTHON_VERSION, adtrustinstance
e788bc
 )
e788bc
 
e788bc
 
e788bc
@@ -271,6 +271,14 @@ def main():
e788bc
     #    #  options.setup_adtrust = False
e788bc
     #    #  ansible_module.warn(msg="adtrust is not supported, disabling")
e788bc
 
e788bc
+    sid_generation_always = False
e788bc
+    if not options.setup_adtrust:
e788bc
+        # pylint: disable=deprecated-method
e788bc
+        argspec = inspect.getargspec(adtrustinstance.ADTRUSTInstance.__init__)
e788bc
+        # pylint: enable=deprecated-method
e788bc
+        if "fulltrust" in argspec.args:
e788bc
+            sid_generation_always = True
e788bc
+
e788bc
     # if options.setup_kra and not kra_imported:
e788bc
     #    # if "kra" not in options._allow_missing:
e788bc
     #    ansible_module.fail_json(msg="kra can not be imported")
e788bc
@@ -472,6 +480,7 @@ def main():
e788bc
         # additional
e788bc
         client_enrolled=client_enrolled,
e788bc
         change_master_for_certmonger=change_master_for_certmonger,
e788bc
+        sid_generation_always=sid_generation_always
e788bc
     )
e788bc
 
e788bc
 
e788bc
diff -up ansible-freeipa-1.6.3/roles/ipareplica/module_utils/ansible_ipa_replica.py.always_sids ansible-freeipa-1.6.3/roles/ipareplica/module_utils/ansible_ipa_replica.py
e788bc
--- ansible-freeipa-1.6.3/roles/ipareplica/module_utils/ansible_ipa_replica.py.always_sids	2022-01-27 14:05:04.000000000 +0100
e788bc
+++ ansible-freeipa-1.6.3/roles/ipareplica/module_utils/ansible_ipa_replica.py	2022-10-07 16:54:27.707115487 +0200
e788bc
@@ -46,7 +46,8 @@ __all__ = ["contextlib", "dnsexception",
e788bc
            "common_check", "current_domain_level",
e788bc
            "check_domain_level_is_supported", "promotion_check_ipa_domain",
e788bc
            "SSSDConfig", "CalledProcessError", "timeconf", "ntpinstance",
e788bc
-           "dnsname", "kernel_keyring", "krbinstance"]
e788bc
+           "dnsname", "kernel_keyring", "krbinstance",
e788bc
+           "adtrustinstance"]
e788bc
 
e788bc
 import sys
e788bc
 
e788bc
@@ -105,6 +106,7 @@ else:
e788bc
             adtrust, bindinstance, ca, certs, dns, dsinstance, httpinstance,
e788bc
             installutils, kra, krbinstance,
e788bc
             otpdinstance, custodiainstance, service, upgradeinstance)
e788bc
+        from ipaserver.install import adtrustinstance
e788bc
         try:
e788bc
             from ipaserver.masters import (
e788bc
                 find_providing_servers, find_providing_server)
e788bc
diff -up ansible-freeipa-1.6.3/roles/ipareplica/tasks/install.yml.always_sids ansible-freeipa-1.6.3/roles/ipareplica/tasks/install.yml
e788bc
--- ansible-freeipa-1.6.3/roles/ipareplica/tasks/install.yml.always_sids	2022-01-27 14:05:04.000000000 +0100
e788bc
+++ ansible-freeipa-1.6.3/roles/ipareplica/tasks/install.yml	2022-10-07 16:44:59.008094369 +0200
e788bc
@@ -748,13 +748,15 @@
e788bc
       ccache: "{{ result_ipareplica_prepare.ccache }}"
e788bc
       _top_dir: "{{ result_ipareplica_prepare._top_dir }}"
e788bc
       setup_ca: "{{ result_ipareplica_prepare.config_setup_ca }}"
e788bc
+      setup_adtrust: "{{ result_ipareplica_test.setup_adtrust }}"
e788bc
       config_master_host_name:
e788bc
         "{{ result_ipareplica_prepare.config_master_host_name }}"
e788bc
       adtrust_netbios_name:
e788bc
         "{{ result_ipareplica_prepare.adtrust_netbios_name }}"
e788bc
       adtrust_reset_netbios_name:
e788bc
         "{{ result_ipareplica_prepare.adtrust_reset_netbios_name }}"
e788bc
-    when: result_ipareplica_test.setup_adtrust
e788bc
+    when: result_ipareplica_test.setup_adtrust or
e788bc
+          result_ipareplica_test.sid_generation_always
e788bc
 
e788bc
   - name: Install - Enable IPA
e788bc
     ipareplica_enable_ipa:
e788bc
diff -up ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_prepare.py.always_sids ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_prepare.py
e788bc
--- ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_prepare.py.always_sids	2022-01-27 14:05:04.000000000 +0100
e788bc
+++ ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_prepare.py	2022-10-07 16:47:45.005808635 +0200
e788bc
@@ -141,6 +141,9 @@ options:
e788bc
   setup_ca:
e788bc
     description: Configure a dogtag CA
e788bc
     required: yes
e788bc
+  sid_generation_always:
e788bc
+    description: Enable SID generation always
e788bc
+    required: yes
e788bc
   _hostname_overridden:
e788bc
     description: The installer _hostname_overridden setting
e788bc
     required: yes
e788bc
@@ -213,6 +216,8 @@ def main():
e788bc
 
e788bc
             # additional
e788bc
             setup_ca=dict(required=False, type='bool', default=False),
e788bc
+            sid_generation_always=dict(required=False, type='bool',
e788bc
+                                       default=False),
e788bc
             _hostname_overridden=dict(required=False, type='bool',
e788bc
                                       default=False),
e788bc
         ),
e788bc
@@ -279,6 +284,7 @@ def main():
e788bc
     options.setup_ca = ansible_module.params.get('setup_ca')
e788bc
     options._host_name_overridden = ansible_module.params.get(
e788bc
         '_hostname_overridden')
e788bc
+    sid_generation_always = ansible_module.params.get('sid_generation_always')
e788bc
     options.kasp_db_file = None
e788bc
 
e788bc
     # init ##################################################################
e788bc
@@ -371,7 +377,7 @@ def main():
e788bc
             logger.debug('Starting Directory Server')
e788bc
             services.knownservices.dirsrv.start(instance_name)
e788bc
 
e788bc
-        if options.setup_adtrust:
e788bc
+        if options.setup_adtrust or sid_generation_always:
e788bc
             with redirect_stdout(ansible_log):
e788bc
                 adtrust.install_check(False, options, api)
e788bc
 
e788bc
diff -up ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_test.py.always_sids ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_test.py
e788bc
--- ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_test.py.always_sids	2022-01-27 14:05:04.000000000 +0100
e788bc
+++ ansible-freeipa-1.6.3/roles/ipaserver/library/ipaserver_test.py	2022-10-07 16:46:12.413968014 +0200
e788bc
@@ -226,7 +226,7 @@ from ansible.module_utils.ansible_ipa_se
e788bc
     read_cache, ca, tasks, check_ldap_conf, timeconf, httpinstance,
e788bc
     check_dirsrv, ScriptError, get_fqdn, verify_fqdn, BadHostError,
e788bc
     validate_domain_name, load_pkcs12, IPA_PYTHON_VERSION,
e788bc
-    encode_certificate, check_available_memory
e788bc
+    encode_certificate, check_available_memory, adtrustinstance
e788bc
 )
e788bc
 from ansible.module_utils import six
e788bc
 
e788bc
@@ -395,12 +395,16 @@ def main():
e788bc
 
e788bc
     # version specific ######################################################
e788bc
 
e788bc
-    if options.setup_adtrust and not adtrust_imported:
e788bc
-        # if "adtrust" not in options._allow_missing:
e788bc
-        ansible_module.fail_json(msg="adtrust can not be imported")
e788bc
-        # else:
e788bc
-        #   options.setup_adtrust = False
e788bc
-        #   ansible_module.warn(msg="adtrust is not supported, disabling")
e788bc
+    sid_generation_always = False
e788bc
+    if not options.setup_adtrust:
e788bc
+        # pylint: disable=deprecated-method
e788bc
+        argspec = inspect.getargspec(adtrustinstance.ADTRUSTInstance.__init__)
e788bc
+        # pylint: enable=deprecated-method
e788bc
+        if "fulltrust" in argspec.args:
e788bc
+            sid_generation_always = True
e788bc
+    else:
e788bc
+        if not adtrust_imported:
e788bc
+            ansible_module.fail_json(msg="adtrust can not be imported")
e788bc
 
e788bc
     if options.setup_kra and not kra_imported:
e788bc
         # if "kra" not in options._allow_missing:
e788bc
@@ -522,7 +526,8 @@ def main():
e788bc
                     "You cannot specify an --enable-compat option without the "
e788bc
                     "--setup-adtrust option")
e788bc
 
e788bc
-            if self.netbios_name:
e788bc
+            # Deactivate test for new IPA SID generation
e788bc
+            if self.netbios_name and not sid_generation_always:
e788bc
                 raise RuntimeError(
e788bc
                     "You cannot specify a --netbios-name option without the "
e788bc
                     "--setup-adtrust option")
e788bc
@@ -1079,7 +1084,8 @@ def main():
e788bc
                              ntp_pool=options.ntp_pool,
e788bc
                              # additional
e788bc
                              _installation_cleanup=_installation_cleanup,
e788bc
-                             domainlevel=options.domainlevel)
e788bc
+                             domainlevel=options.domainlevel,
e788bc
+                             sid_generation_always=sid_generation_always)
e788bc
 
e788bc
 
e788bc
 if __name__ == '__main__':
e788bc
diff -up ansible-freeipa-1.6.3/roles/ipaserver/tasks/install.yml.always_sids ansible-freeipa-1.6.3/roles/ipaserver/tasks/install.yml
e788bc
--- ansible-freeipa-1.6.3/roles/ipaserver/tasks/install.yml.always_sids	2022-01-27 14:05:04.000000000 +0100
e788bc
+++ ansible-freeipa-1.6.3/roles/ipaserver/tasks/install.yml	2022-10-07 16:48:36.946719227 +0200
e788bc
@@ -191,6 +191,7 @@
e788bc
       secondary_rid_base: "{{ ipaserver_secondary_rid_base | default(omit) }}"
e788bc
       ### additional ###
e788bc
       setup_ca: "{{ result_ipaserver_test.setup_ca }}"
e788bc
+      sid_generation_always: "{{ result_ipaserver_test.sid_generation_always }}"
e788bc
       _hostname_overridden: "{{ result_ipaserver_test._hostname_overridden }}"
e788bc
     register: result_ipaserver_prepare
e788bc
 
e788bc
@@ -392,7 +393,8 @@
e788bc
         adtrust_netbios_name: "{{ result_ipaserver_prepare.adtrust_netbios_name }}"
e788bc
         adtrust_reset_netbios_name:
e788bc
           "{{ result_ipaserver_prepare.adtrust_reset_netbios_name }}"
e788bc
-      when: result_ipaserver_test.setup_adtrust
e788bc
+      when: result_ipaserver_test.setup_adtrust or
e788bc
+            result_ipaserver_test.sid_generation_always
e788bc
 
e788bc
     - name: Install - Set DS password
e788bc
       ipaserver_set_ds_password: