Bug 785257

--timelimit - is difficult to gauge, but suspect it is disregarded as well

the test i ran:
# date; ipa permission-find --name=ManageUser1 --timelimit=1; date
Fri Jan 27 15:17:23 EST 2012
----------------------
88 permissions matched
----------------------
  Permission name: AAA
  Permissions: write

<snip>
.....
<snip>

  Granted to Privilege: Write IPA Configuration
-----------------------------
Number of entries returned 88
-----------------------------
Fri Jan 27 15:17:34 EST 2012


Not sure if the search lasted 1 sec, but printing out 88 entries took 9 sec...

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/2322

timelimit refers only to LDAP search time. You can see the time taken in the DS access log.

Also --permissions if invalid is disregarded.

Actual:
# ipa permission-find --permissions=xyz --all
---------------------
0 permissions matched
---------------------
----------------------------
Number of entries returned 0
----------------------------

Expected: 
message indicating - "ipa: ERROR: invalid 'permissions': "xyz" is not a valid permission"

That's to be expected. The search options are just things to look for to narrow down the search. Not existing should not prevent the search from executing.

Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/8d00d7c13038abc152afbd46c96108753506fb77

--sizelimit is now properly enforced.


As for the --timelimit issue, there is not much more we can do. This is not a standard search, where just one LDAP query is run.

With permission-find, we run:
1. LDAP Search to search for all matching permission objects
2. For all matched objects, we run an LDAP retrieve call to pull ACI data
3. LDAP search is run to also search in ACIs
4. For all matched objects, we run an LDAP retrieve call to pull permission data

This is the reason why the --timelimit cannot be kept as easily as with other *-find commands.

regression test added to rbac permission test suite

Verified using ipa-server-3.0.0-20.el6.x86_64

# ipa permission-find  --attrs=description --permissions=write --type=user --sizelimit=3
---------------------
3 permissions matched
---------------------
  Permission name: ManageUser1
  Permissions: write
  Attributes: carlicense, description
  Type: user

  Permission name: ManageUser2
  Permissions: read, write
  Attributes: carlicense, description
  Type: user

  Permission name: Modify Users
  Permissions: write
  Attributes: givenname, sn, cn, displayname, title, initials, loginshell, gecos, homephone, mobile, pager, facsimiletelephonenumber, telephonenumber, street, roomnumber, l, st, postalcode, manager, secretary, description, carlicense,
              labeleduri, inetuserhttpurl, seealso, employeetype, businesscategory, ou, mepmanagedentry, objectclass
  Type: user
  Granted to Privilege: User Administrators, Modify Users and Reset passwords
----------------------------
Number of entries returned 3
----------------------------


# ipa permission-find  --attrs=description --permissions=write --type=user --sizelimit=2
---------------------
2 permissions matched
---------------------
  Permission name: ManageUser1
  Permissions: write
  Attributes: carlicense, description
  Type: user

  Permission name: Modify Users
  Permissions: write
  Attributes: givenname, sn, cn, displayname, title, initials, loginshell, gecos, homephone, mobile, pager, facsimiletelephonenumber, telephonenumber, street, roomnumber, l, st, postalcode, manager, secretary, description, carlicense,
              labeleduri, inetuserhttpurl, seealso, employeetype, businesscategory, ou, mepmanagedentry, objectclass
  Type: user
  Granted to Privilege: User Administrators, Modify Users and Reset passwords
----------------------------
Number of entries returned 2
----------------------------

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0528.html