Bug 1381535

Summary:	ipa config-mod returns "Configured size limit exceeded" while modifying searchrecordslimit value.
Product:	Red Hat Enterprise Linux 7	Reporter:	Nikhil Dehadrai <ndehadra>
Component:	ipa	Assignee:	IPA Maintainers <ipa-maint>
Status:	CLOSED ERRATA	QA Contact:	Kaleem <ksiddiqu>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.3	CC:	abiagion, pasik, pvoborni, rcritten
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-4.6.4-2.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-10-30 10:55:57 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description Nikhil Dehadrai 2016-10-04 11:52:09 UTC

Description of problem:
ipa config-mod returns "Configured size limit exceeded" while modifying searchrecordslimit value.

Version-Release number of selected component (if applicable):
ipa-server-4.4.0-12.el7.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Setup IPA on latest 7.3 version.
2. Install Latest version of IPA server to it. 
3. Execute following commands:
# kinit admin

4. Now execute: 
# ipa config-mod --searchrecordslimit=0

5. Run:
# ipa config-mod --searchrecordslimit=1

6. Finally:
# ipa config-mod --searchrecordslimit=2

7. Now run:
# ipa config-show

Actual results:
After step6 and step7, Configured size limit exceeded message is displayed.

Expected results:
No error should be returned, and the modified value should also be set

Comment 2 Martin Bašti 2016-10-04 11:57:59 UTC

This is caused by postcallback that is searching for server roles and reach size limit.

 ipa: DEBUG: WSGI wsgi_execute PublicError: Traceback (most recent call last):
   File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 368, in wsgi_execute
     result = command(*args, **options)
   File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 451, in __call__
     return self.__do_call(*args, **options)
   File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 479, in __do_call
     ret = self.run(*args, **options)
   File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 801, in run
     return self.execute(*args, **options)
   File "/usr/lib/python2.7/site-packages/ipaserver/plugins/baseldap.py", line 1333, in execute
     self, ldap, entry_attrs.dn, entry_attrs, *keys, **options)
   File "/usr/lib/python2.7/site-packages/ipaserver/plugins/config.py", line 421, in post_callback
     self.obj.show_servroles_attributes(entry_attrs, **options)
   File "/usr/lib/python2.7/site-packages/ipaserver/plugins/config.py", line 266, in show_servroles_attributes
     config = backend.config_retrieve(role)
   File "/usr/lib/python2.7/site-packages/ipaserver/plugins/serverroles.py", line 130, in config_retrieve
     result = self._get_enabled_masters(servrole)
   File "/usr/lib/python2.7/site-packages/ipaserver/plugins/serverroles.py", line 87, in _get_enabled_masters
     r[u'server_server'] for r in role.status(self.api, server=None) if
   File "/usr/lib/python2.7/site-packages/ipaserver/servroles.py", line 501, in status
     api_instance, server=server, attrs_list=('ipaConfigString', 'cn'))
   File "/usr/lib/python2.7/site-packages/ipaserver/servroles.py", line 205, in status
     attrs_list=attrs_list)
   File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1305, in get_entries
     self.handle_truncated_result(truncated)
   File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1028, in handle_truncated_result
     raise errors.SizeLimitExceeded()
 SizeLimitExceeded: Configured size limit exceeded


IMO we should not apply sizelimit on internal searches

Comment 5 Martin Bašti 2016-10-06 09:07:42 UTC

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/6383

Comment 7 Petr Vobornik 2017-04-06 16:08:33 UTC

IdM team doesn't have capacity to fix this bug for RHEL 7.4. Moving to next RHEL version. Fixing the bug there will depend on capacity of FreeIPA upstream. Without sufficient  justification there is a chance that it will be moved again later.

Comment 10 Armando Biagioni Neto 2018-06-18 15:12:31 UTC

Unlinking from upstream ticket https://pagure.io/freeipa/issue/6383 because this is only going to address the issue where a user can set a value too low and get stuck.

Comment 11 Armando Biagioni Neto 2018-06-18 15:24:12 UTC

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/6617

Comment 12 Rob Crittenden 2018-06-21 20:03:30 UTC

master:

    de8d308 ipaserver config plugin: Increase search records minimum limit

ipa-4-6:

    59e0c02 ipaserver config plugin: Increase search records minimum limit

Comment 14 Nikhil Dehadrai 2018-07-18 12:17:22 UTC

ipa-server-version: ipa-server-4.6.4-2.el7.x86_64

Verified the bug on the basis of following observations:
1. Verified that with latest version minimum 'searchrecordslimit' must be at least 10. If we set any value which is either less than '-1' or between '1 to 9' appropriate message is returned.

Console:
[root@ipaqavmf ~]# rpm -q ipa-server
ipa-server-4.6.4-2.el7.x86_64

[root@ipaqavmf ~]# ipa config-mod --searchrecordslimit=-2
ipa: ERROR: invalid 'searchrecordslimit': must be at least 10

[root@ipaqavmf ~]# ipa config-mod --searchrecordslimit=1
ipa: ERROR: invalid 'searchrecordslimit': must be at least 10

[root@ipaqavmf ~]# ipa config-mod --searchrecordslimit=2
ipa: ERROR: invalid 'searchrecordslimit': must be at least 10

[root@ipaqavmf ~]# ipa config-mod --searchrecordslimit=0
  Maximum username length: 32
  Home directory base: /home
  Default shell: /bin/sh
  Default users group: ipausers
  Default e-mail domain: testrelm.test
  Search time limit: 2
  Search size limit: -1
  User search fields: uid,givenname,sn,telephonenumber,ou,title
  Group search fields: cn,description
  Enable migration mode: FALSE
  Certificate Subject base: O=TESTRELM.TEST
  Password Expiration Notification (days): 4
  Password plugin features: AllowNThash, KDC:Disable Last Success
  SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023
  Default SELinux user: unconfined_u:s0-s0:c0.c1023
  Default PAC types: MS-PAC, nfs:NONE
  IPA masters: ipaqavmf.testrelm.test
  IPA CA servers: ipaqavmf.testrelm.test
  IPA NTP servers: ipaqavmf.testrelm.test
  IPA CA renewal master: ipaqavmf.testrelm.test
  IPA master capable of PKINIT: ipaqavmf.testrelm.test

[root@ipaqavmf ~]# ipa config-mod --searchrecordslimit=10
  Maximum username length: 32
  Home directory base: /home
  Default shell: /bin/sh
  Default users group: ipausers
  Default e-mail domain: testrelm.test
  Search time limit: 2
  Search size limit: 10
  User search fields: uid,givenname,sn,telephonenumber,ou,title
  Group search fields: cn,description
  Enable migration mode: FALSE
  Certificate Subject base: O=TESTRELM.TEST
  Password Expiration Notification (days): 4
  Password plugin features: AllowNThash, KDC:Disable Last Success
  SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023
  Default SELinux user: unconfined_u:s0-s0:c0.c1023
  Default PAC types: MS-PAC, nfs:NONE
  IPA masters: ipaqavmf.testrelm.test
  IPA CA servers: ipaqavmf.testrelm.test
  IPA NTP servers: ipaqavmf.testrelm.test
  IPA CA renewal master: ipaqavmf.testrelm.test
  IPA master capable of PKINIT: ipaqavmf.testrelm.test

[root@ipaqavmf ~]# ipa config-mod --searchrecordslimit=20
  Maximum username length: 32
  Home directory base: /home
  Default shell: /bin/sh
  Default users group: ipausers
  Default e-mail domain: testrelm.test
  Search time limit: 2
  Search size limit: 20
  User search fields: uid,givenname,sn,telephonenumber,ou,title
  Group search fields: cn,description
  Enable migration mode: FALSE
  Certificate Subject base: O=TESTRELM.TEST
  Password Expiration Notification (days): 4
  Password plugin features: AllowNThash, KDC:Disable Last Success
  SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023
  Default SELinux user: unconfined_u:s0-s0:c0.c1023
  Default PAC types: MS-PAC, nfs:NONE
  IPA masters: ipaqavmf.testrelm.test
  IPA CA servers: ipaqavmf.testrelm.test
  IPA NTP servers: ipaqavmf.testrelm.test
  IPA CA renewal master: ipaqavmf.testrelm.test
  IPA master capable of PKINIT: ipaqavmf.testrelm.test

[root@ipaqavmf ~]# ipa config-mod --searchrecordslimit=-1
  Maximum username length: 32
  Home directory base: /home
  Default shell: /bin/sh
  Default users group: ipausers
  Default e-mail domain: testrelm.test
  Search time limit: 2
  Search size limit: -1
  User search fields: uid,givenname,sn,telephonenumber,ou,title
  Group search fields: cn,description
  Enable migration mode: FALSE
  Certificate Subject base: O=TESTRELM.TEST
  Password Expiration Notification (days): 4
  Password plugin features: AllowNThash, KDC:Disable Last Success
  SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023
  Default SELinux user: unconfined_u:s0-s0:c0.c1023
  Default PAC types: MS-PAC, nfs:NONE
  IPA masters: ipaqavmf.testrelm.test
  IPA CA servers: ipaqavmf.testrelm.test
  IPA NTP servers: ipaqavmf.testrelm.test
  IPA CA renewal master: ipaqavmf.testrelm.test
  IPA master capable of PKINIT: ipaqavmf.testrelm.test

Thus on the basis of above observations, marking the status of bug to 'VERIFIED'.

Comment 17 errata-xmlrpc 2018-10-30 10:55:57 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3187