Red Hat Bugzilla – Bug 1138791
Prohibit setting --rid-base for ranges of ipa-trust-ad-posix type
Last modified: 2015-03-05 05:13:37 EST
This bug is created as a clone of upstream ticket: https://fedorahosted.org/freeipa/ticket/4221 We should not allow setting --rid-base for ranges of ipa-trust-ad-posix since we do not perform any RID -> UID/GID mappings for this ranges (objects have UID/GID set in AD). Thus, setting RID base makes no sense. Implementation should also make sure it does not break ipa trust_add command, as it currently sets RID base to 0 by default.
Fixed upstream: ipa-4-1: * 0b36c109fdf6e27f770a62434e0de8b2b8faa4aa ranges: prohibit setting --rid- base with ipa-trust-ad-posix type * b5aafa4ddbcf1ca56ba32d6ce0b8c08ace1eea33 unittests: baserid for ipa-ad- trust-posix idranges * 2983a0dea18ec88f9c0ea293374a6349e33be0d3 ldapupdater: set baserid to 0 for ipa-ad-trust-posix ranges * 0105ef6d3ec07cb3342032306538d8a8b997bc0b idrange: include raw range type in output * c2ac4a88775274e2cb8f199d104a1393a1d4a81e webui: prohibit setting rid base with ipa-trust-ad-posix type master: * 95a492caec03570cb2b6399c97f196245d11c1f4 ranges: prohibit setting --rid- base with ipa-trust-ad-posix type * feea9047be19acda394b65688dcc41dd064421b8 unittests: baserid for ipa-ad- trust-posix idranges * 61d98bdc5988b3b13d6cf21139bfef32ea1b0fc9 ldapupdater: set baserid to 0 for ipa-ad-trust-posix ranges * 3d11de4849cc2d7b88da6f2522424842dde68889 idrange: include raw range type in output * 8248f696275e2e63dab860a25467e2868aa17036 webui: prohibit setting rid base with ipa-trust-ad-posix type
[root@vm-idm-019 ~]# rpm -q ipa-server ipa-server-4.1.0-16.el7.x86_64 [root@vm-idm-019 ~]# ipa idrange-find ADLABS.COM_id_range --------------- 1 range matched --------------- Range name: ADLABS.COM_id_range First Posix ID of the range: 10000 Number of IDs in the range: 200000 Domain SID of the trusted domain: S-1-5-21-3069109027-1612402048-776712048 Range type: Active Directory trust range with POSIX attributes ---------------------------- Number of entries returned 1 ---------------------------- [root@vm-idm-019 ~]# ipa idrange-mod ADLABS.COM_id_range --rid-base 109 ipa: ERROR: invalid 'ID Range setup': Option rid-base must not be used when IPA range type is ipa-ad-trust-posix
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0442.html