From 67875c3b75ad1af493ff5930f9c5fd5e9797b775 Mon Sep 17 00:00:00 2001
From: Thomas Woerner <twoerner@redhat.com>
Date: Oct 12 2018 07:50:29 +0000
Subject: Find orphan automember rules
If groups or hostgroups have been removed after automember rules have been
created using them, then automember-rebuild, automember-add, host-add and
more commands could fail.
A new command has been added to the ipa tool:
ipa automember-find-orphans --type={hostgroup,group} [--remove]
This command retuns the list of orphan automember rules in the same way as
automember-find. With the --remove option the orphan rules are also removed.
The IPA API version has been increased and a test case has been added.
Using ideas from a patch by: Rob Crittenden <rcritten@redhat.com>
See: https://pagure.io/freeipa/issue/6476
Signed-off-by: Thomas Woerner <twoerner@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
---
diff --git a/API.txt b/API.txt
index 49216cb..93e1a38 100644
--- a/API.txt
+++ b/API.txt
@@ -186,6 +186,20 @@ output: Output('count', type=[<type 'int'>])
output: ListOfEntries('result')
output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
output: Output('truncated', type=[<type 'bool'>])
+command: automember_find_orphans/1
+args: 1,7,4
+arg: Str('criteria?')
+option: Flag('all', autofill=True, cli_name='all', default=False)
+option: Str('description?', autofill=False, cli_name='desc')
+option: Flag('pkey_only?', autofill=True, default=False)
+option: Flag('raw', autofill=True, cli_name='raw', default=False)
+option: Flag('remove?', autofill=True, default=False)
+option: StrEnum('type', values=[u'group', u'hostgroup'])
+option: Str('version?')
+output: Output('count', type=[<type 'int'>])
+output: ListOfEntries('result')
+output: Output('summary', type=[<type 'unicode'>, <type 'NoneType'>])
+output: Output('truncated', type=[<type 'bool'>])
command: automember_mod/1
args: 1,9,3
arg: Str('cn', cli_name='automember_rule')
@@ -6503,6 +6517,7 @@ default: automember_default_group_set/1
default: automember_default_group_show/1
default: automember_del/1
default: automember_find/1
+default: automember_find_orphans/1
default: automember_mod/1
default: automember_rebuild/1
default: automember_remove_condition/1
diff --git a/VERSION.m4 b/VERSION.m4
index f437ef0..9d5532c 100644
--- a/VERSION.m4
+++ b/VERSION.m4
@@ -83,8 +83,8 @@ define(IPA_DATA_VERSION, 20100614120000)
# #
########################################################
define(IPA_API_VERSION_MAJOR, 2)
-define(IPA_API_VERSION_MINOR, 229)
-# Last change: Added the Certificate parameter
+define(IPA_API_VERSION_MINOR, 230)
+# Last change: Added `automember-find-orphans' command
########################################################
diff --git a/ipaserver/plugins/automember.py b/ipaserver/plugins/automember.py
index a502aea..a7f468d 100644
--- a/ipaserver/plugins/automember.py
+++ b/ipaserver/plugins/automember.py
@@ -117,6 +117,11 @@ EXAMPLES:
Find all of the automember rules:
ipa automember-find
""") + _("""
+ Find all of the orphan automember rules:
+ ipa automember-find-orphans --type=hostgroup
+ Find all of the orphan automember rules and remove them:
+ ipa automember-find-orphans --type=hostgroup --remove
+""") + _("""
Display a automember rule:
ipa automember-show --type=hostgroup webservers
ipa automember-show --type=group devel
@@ -817,3 +822,58 @@ class automember_rebuild(Method):
result=result,
summary=unicode(summary),
value=pkey_to_value(None, options))
+
+
+@register()
+class automember_find_orphans(LDAPSearch):
+ __doc__ = _("""
+ Search for orphan automember rules. The command might need to be run as
+ a privileged user user to get all orphan rules.
+ """)
+ takes_options = group_type + (
+ Flag(
+ 'remove?',
+ doc=_("Remove orphan automember rules"),
+ ),
+ )
+
+ msg_summary = ngettext(
+ '%(count)d rules matched', '%(count)d rules matched', 0
+ )
+
+ def execute(self, *keys, **options):
+ results = super(automember_find_orphans, self).execute(*keys,
+ **options)
+
+ remove_option = options.get('remove')
+ pkey_only = options.get('pkey_only', False)
+ ldap = self.obj.backend
+ orphans = []
+ for entry in results["result"]:
+ am_dn_entry = entry['automembertargetgroup'][0]
+ # Make DN for --raw option
+ if not isinstance(am_dn_entry, DN):
+ am_dn_entry = DN(am_dn_entry)
+ try:
+ ldap.get_entry(am_dn_entry)
+ except errors.NotFound:
+ if pkey_only:
+ # For pkey_only remove automembertargetgroup
+ del(entry['automembertargetgroup'])
+ orphans.append(entry)
+ if remove_option:
+ ldap.delete_entry(entry['dn'])
+
+ results["result"][:] = orphans
+ results["count"] = len(orphans)
+ return results
+
+ def pre_callback(self, ldap, filters, attrs_list, base_dn, scope, *args,
+ **options):
+ assert isinstance(base_dn, DN)
+ scope = ldap.SCOPE_SUBTREE
+ ndn = DN(('cn', options['type']), base_dn)
+ if options.get('pkey_only', False):
+ # For pkey_only add automembertargetgroup
+ attrs_list.append('automembertargetgroup')
+ return filters, ndn, scope
diff --git a/ipatests/test_xmlrpc/test_automember_plugin.py b/ipatests/test_xmlrpc/test_automember_plugin.py
index ffbc911..c83e11a 100644
--- a/ipatests/test_xmlrpc/test_automember_plugin.py
+++ b/ipatests/test_xmlrpc/test_automember_plugin.py
@@ -715,3 +715,51 @@ class TestMultipleAutomemberConditions(XMLRPC_test):
defaultgroup1.ensure_missing()
defaulthostgroup1.ensure_missing()
+
+
+@pytest.mark.tier1
+class TestAutomemberFindOrphans(XMLRPC_test):
+ def test_create_deps_for_find_orphans(self, hostgroup1, host1,
+ automember_hostgroup):
+ """ Create host, hostgroup, and automember tracker for this class
+ of tests. """
+
+ # Create hostgroup1 and automember rule with condition
+ hostgroup1.ensure_exists()
+ host1.ensure_exists()
+
+ # Manually create automember rule and condition, racker will try to
+ # remove the automember rule in the end, which is failing as the rule
+ # is already removed
+ api.Command['automember_add'](hostgroup1.cn, type=u'hostgroup')
+ api.Command['automember_add_condition'](
+ hostgroup1.cn,
+ key=u'fqdn', type=u'hostgroup',
+ automemberinclusiveregex=[hostgroup_include_regex]
+ )
+
+ hostgroup1.retrieve()
+
+ def test_find_orphan_automember_rules(self, hostgroup1):
+ """ Remove hostgroup1, find and remove obsolete automember rules. """
+ # Remove hostgroup1
+
+ hostgroup1.ensure_missing()
+
+ # Find obsolete automember rules
+ result = api.Command['automember_find_orphans'](type=u'hostgroup')
+ assert result['count'] == 1
+
+ # Find and remove obsolete automember rules
+ result = api.Command['automember_find_orphans'](type=u'hostgroup',
+ remove=True)
+ assert result['count'] == 1
+
+ # Find obsolete automember rules
+ result = api.Command['automember_find_orphans'](type=u'hostgroup')
+ assert result['count'] == 0
+
+ # Final cleanup of automember rule if it still exists
+ with raises_exact(errors.NotFound(
+ reason=u'%s: Automember rule not found' % hostgroup1.cn)):
+ api.Command['automember_del'](hostgroup1.cn, type=u'hostgroup')