Bug 1138791

Summary:	Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type
Product:	Red Hat Enterprise Linux 7	Reporter:	Martin Kosek <mkosek>
Component:	ipa	Assignee:	Martin Kosek <mkosek>
Status:	CLOSED ERRATA	QA Contact:	Namita Soman <nsoman>
Severity:	unspecified	Docs Contact:
Priority:	medium
Version:	7.0	CC:	rcritten, sgoveas
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-4.1.0-5.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-03-05 10:13:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Martin Kosek 2014-09-05 15:58:35 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/4221

We should not allow setting --rid-base for ranges of ipa-trust-ad-posix since we do not perform any RID -> UID/GID mappings for this ranges (objects have UID/GID set in AD). Thus, setting RID base makes no sense.

Implementation should also make sure it does not break ipa trust_add command, as it currently sets RID base to 0 by default.

Comment 1 Martin Kosek 2014-11-11 11:19:52 UTC

Fixed upstream:

ipa-4-1:
 * 0b36c109fdf6e27f770a62434e0de8b2b8faa4aa ranges: prohibit setting --rid-
 base with ipa-trust-ad-posix type
 * b5aafa4ddbcf1ca56ba32d6ce0b8c08ace1eea33 unittests: baserid for ipa-ad-
 trust-posix idranges
 * 2983a0dea18ec88f9c0ea293374a6349e33be0d3 ldapupdater: set baserid to 0
 for ipa-ad-trust-posix ranges
 * 0105ef6d3ec07cb3342032306538d8a8b997bc0b idrange: include raw range type
 in output
 * c2ac4a88775274e2cb8f199d104a1393a1d4a81e webui: prohibit setting rid
 base with ipa-trust-ad-posix type


master:
 * 95a492caec03570cb2b6399c97f196245d11c1f4 ranges: prohibit setting --rid-
 base with ipa-trust-ad-posix type
 * feea9047be19acda394b65688dcc41dd064421b8 unittests: baserid for ipa-ad-
 trust-posix idranges
 * 61d98bdc5988b3b13d6cf21139bfef32ea1b0fc9 ldapupdater: set baserid to 0
 for ipa-ad-trust-posix ranges
 * 3d11de4849cc2d7b88da6f2522424842dde68889 idrange: include raw range type
 in output
 * 8248f696275e2e63dab860a25467e2868aa17036 webui: prohibit setting rid
 base with ipa-trust-ad-posix type

Comment 3 Steeve Goveas 2015-01-27 13:53:50 UTC

[root@vm-idm-019 ~]# rpm -q ipa-server 
ipa-server-4.1.0-16.el7.x86_64

[root@vm-idm-019 ~]# ipa idrange-find ADLABS.COM_id_range
---------------
1 range matched
---------------
  Range name: ADLABS.COM_id_range
  First Posix ID of the range: 10000
  Number of IDs in the range: 200000
  Domain SID of the trusted domain: S-1-5-21-3069109027-1612402048-776712048
  Range type: Active Directory trust range with POSIX attributes
----------------------------
Number of entries returned 1
----------------------------

[root@vm-idm-019 ~]# ipa idrange-mod ADLABS.COM_id_range --rid-base 109 
ipa: ERROR: invalid 'ID Range setup': Option rid-base must not be used when IPA range type is ipa-ad-trust-posix

Comment 5 errata-xmlrpc 2015-03-05 10:13:37 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0442.html