|
 |
99b6f7 |
From bcf89f59d86f4031f3b2ea39dc1dff9484d81e67 Mon Sep 17 00:00:00 2001
|
|
|
99b6f7 |
From: Tomas Babej <tbabej@redhat.com>
|
|
|
99b6f7 |
Date: Thu, 21 Nov 2013 14:44:42 +0100
|
|
|
99b6f7 |
Subject: [PATCH 5/6] trusts: Do not pass base-id to the subdomain ranges
|
|
|
99b6f7 |
|
|
|
99b6f7 |
For trusted domains base id is calculated using a murmur3 hash of the
|
|
|
99b6f7 |
domain Security Identifier (SID). During trust-add we create ranges for
|
|
|
99b6f7 |
forest root domain and other forest domains. Since --base-id explicitly
|
|
|
99b6f7 |
overrides generated base id for forest root domain, its value should not
|
|
|
99b6f7 |
be passed to other forest domains' ranges -- their base ids must be
|
|
|
99b6f7 |
calculated based on their SIDs.
|
|
|
99b6f7 |
|
|
|
99b6f7 |
In case base id change for non-root forest domains is required, it can
|
|
|
99b6f7 |
be done manually through idrange-mod command after the trust is
|
|
|
99b6f7 |
established.
|
|
|
99b6f7 |
|
|
|
99b6f7 |
https://fedorahosted.org/freeipa/ticket/4041
|
|
|
99b6f7 |
---
|
|
|
99b6f7 |
ipalib/plugins/trust.py | 5 +++++
|
|
|
99b6f7 |
1 file changed, 5 insertions(+)
|
|
|
99b6f7 |
|
|
|
99b6f7 |
diff --git a/ipalib/plugins/trust.py b/ipalib/plugins/trust.py
|
|
|
99b6f7 |
index 32a93834394273c9f896ff5fd17bfcc753fe7b8e..5ba0905030c700c7f63003eef25891c52330934b 100644
|
|
|
99b6f7 |
--- a/ipalib/plugins/trust.py
|
|
|
99b6f7 |
+++ b/ipalib/plugins/trust.py
|
|
|
99b6f7 |
@@ -375,6 +375,11 @@ def execute(self, *keys, **options):
|
|
|
99b6f7 |
passed_options = options
|
|
|
99b6f7 |
passed_options.update(range_type=created_range_type)
|
|
|
99b6f7 |
|
|
|
99b6f7 |
+ # Do not pass the base id to the subdomains since it would
|
|
|
99b6f7 |
+ # clash with the root level domain
|
|
|
99b6f7 |
+ if 'base_id' in passed_options:
|
|
|
99b6f7 |
+ del passed_options['base_id']
|
|
|
99b6f7 |
+
|
|
|
99b6f7 |
# Try to add the range for each subdomain
|
|
|
99b6f7 |
try:
|
|
|
99b6f7 |
self.add_range(range_name, dom_sid, *keys,
|
|
|
99b6f7 |
--
|
|
|
99b6f7 |
1.8.3.1
|
|
|
99b6f7 |
|