Hide Forgot
Description of problem: ipa config-mod returns "Configured size limit exceeded" while modifying searchrecordslimit value. Version-Release number of selected component (if applicable): ipa-server-4.4.0-12.el7.x86_64 How reproducible: Always Steps to Reproduce: 1. Setup IPA on latest 7.3 version. 2. Install Latest version of IPA server to it. 3. Execute following commands: # kinit admin 4. Now execute: # ipa config-mod --searchrecordslimit=0 5. Run: # ipa config-mod --searchrecordslimit=1 6. Finally: # ipa config-mod --searchrecordslimit=2 7. Now run: # ipa config-show Actual results: After step6 and step7, Configured size limit exceeded message is displayed. Expected results: No error should be returned, and the modified value should also be set
This is caused by postcallback that is searching for server roles and reach size limit. ipa: DEBUG: WSGI wsgi_execute PublicError: Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 368, in wsgi_execute result = command(*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 451, in __call__ return self.__do_call(*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 479, in __do_call ret = self.run(*args, **options) File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 801, in run return self.execute(*args, **options) File "/usr/lib/python2.7/site-packages/ipaserver/plugins/baseldap.py", line 1333, in execute self, ldap, entry_attrs.dn, entry_attrs, *keys, **options) File "/usr/lib/python2.7/site-packages/ipaserver/plugins/config.py", line 421, in post_callback self.obj.show_servroles_attributes(entry_attrs, **options) File "/usr/lib/python2.7/site-packages/ipaserver/plugins/config.py", line 266, in show_servroles_attributes config = backend.config_retrieve(role) File "/usr/lib/python2.7/site-packages/ipaserver/plugins/serverroles.py", line 130, in config_retrieve result = self._get_enabled_masters(servrole) File "/usr/lib/python2.7/site-packages/ipaserver/plugins/serverroles.py", line 87, in _get_enabled_masters r[u'server_server'] for r in role.status(self.api, server=None) if File "/usr/lib/python2.7/site-packages/ipaserver/servroles.py", line 501, in status api_instance, server=server, attrs_list=('ipaConfigString', 'cn')) File "/usr/lib/python2.7/site-packages/ipaserver/servroles.py", line 205, in status attrs_list=attrs_list) File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1305, in get_entries self.handle_truncated_result(truncated) File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1028, in handle_truncated_result raise errors.SizeLimitExceeded() SizeLimitExceeded: Configured size limit exceeded IMO we should not apply sizelimit on internal searches
Upstream ticket: https://fedorahosted.org/freeipa/ticket/6383
IdM team doesn't have capacity to fix this bug for RHEL 7.4. Moving to next RHEL version. Fixing the bug there will depend on capacity of FreeIPA upstream. Without sufficient justification there is a chance that it will be moved again later.
Unlinking from upstream ticket https://pagure.io/freeipa/issue/6383 because this is only going to address the issue where a user can set a value too low and get stuck.
Upstream ticket: https://fedorahosted.org/freeipa/ticket/6617
master: de8d308 ipaserver config plugin: Increase search records minimum limit ipa-4-6: 59e0c02 ipaserver config plugin: Increase search records minimum limit
ipa-server-version: ipa-server-4.6.4-2.el7.x86_64 Verified the bug on the basis of following observations: 1. Verified that with latest version minimum 'searchrecordslimit' must be at least 10. If we set any value which is either less than '-1' or between '1 to 9' appropriate message is returned. Console: [root@ipaqavmf ~]# rpm -q ipa-server ipa-server-4.6.4-2.el7.x86_64 [root@ipaqavmf ~]# ipa config-mod --searchrecordslimit=-2 ipa: ERROR: invalid 'searchrecordslimit': must be at least 10 [root@ipaqavmf ~]# ipa config-mod --searchrecordslimit=1 ipa: ERROR: invalid 'searchrecordslimit': must be at least 10 [root@ipaqavmf ~]# ipa config-mod --searchrecordslimit=2 ipa: ERROR: invalid 'searchrecordslimit': must be at least 10 [root@ipaqavmf ~]# ipa config-mod --searchrecordslimit=0 Maximum username length: 32 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain: testrelm.test Search time limit: 2 Search size limit: -1 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: FALSE Certificate Subject base: O=TESTRELM.TEST Password Expiration Notification (days): 4 Password plugin features: AllowNThash, KDC:Disable Last Success SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC, nfs:NONE IPA masters: ipaqavmf.testrelm.test IPA CA servers: ipaqavmf.testrelm.test IPA NTP servers: ipaqavmf.testrelm.test IPA CA renewal master: ipaqavmf.testrelm.test IPA master capable of PKINIT: ipaqavmf.testrelm.test [root@ipaqavmf ~]# ipa config-mod --searchrecordslimit=10 Maximum username length: 32 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain: testrelm.test Search time limit: 2 Search size limit: 10 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: FALSE Certificate Subject base: O=TESTRELM.TEST Password Expiration Notification (days): 4 Password plugin features: AllowNThash, KDC:Disable Last Success SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC, nfs:NONE IPA masters: ipaqavmf.testrelm.test IPA CA servers: ipaqavmf.testrelm.test IPA NTP servers: ipaqavmf.testrelm.test IPA CA renewal master: ipaqavmf.testrelm.test IPA master capable of PKINIT: ipaqavmf.testrelm.test [root@ipaqavmf ~]# ipa config-mod --searchrecordslimit=20 Maximum username length: 32 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain: testrelm.test Search time limit: 2 Search size limit: 20 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: FALSE Certificate Subject base: O=TESTRELM.TEST Password Expiration Notification (days): 4 Password plugin features: AllowNThash, KDC:Disable Last Success SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC, nfs:NONE IPA masters: ipaqavmf.testrelm.test IPA CA servers: ipaqavmf.testrelm.test IPA NTP servers: ipaqavmf.testrelm.test IPA CA renewal master: ipaqavmf.testrelm.test IPA master capable of PKINIT: ipaqavmf.testrelm.test [root@ipaqavmf ~]# ipa config-mod --searchrecordslimit=-1 Maximum username length: 32 Home directory base: /home Default shell: /bin/sh Default users group: ipausers Default e-mail domain: testrelm.test Search time limit: 2 Search size limit: -1 User search fields: uid,givenname,sn,telephonenumber,ou,title Group search fields: cn,description Enable migration mode: FALSE Certificate Subject base: O=TESTRELM.TEST Password Expiration Notification (days): 4 Password plugin features: AllowNThash, KDC:Disable Last Success SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023 Default SELinux user: unconfined_u:s0-s0:c0.c1023 Default PAC types: MS-PAC, nfs:NONE IPA masters: ipaqavmf.testrelm.test IPA CA servers: ipaqavmf.testrelm.test IPA NTP servers: ipaqavmf.testrelm.test IPA CA renewal master: ipaqavmf.testrelm.test IPA master capable of PKINIT: ipaqavmf.testrelm.test Thus on the basis of above observations, marking the status of bug to 'VERIFIED'.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3187