Red Hat Bugzilla – Bug 785257
ipa permission-find --sizelimit is disregarded
Last modified: 2013-08-19 10:15:45 EDT
Description of problem: help indicates: --sizelimit=INT Maximum number of entries returned There are 16 permissions that match attr=description. Used sizelimit to bring back only 5. ipa permission-find --attr=description --sizelimit=5 But it still brought back all 16. Version-Release number of selected component (if applicable): ipa-server-2.2.0-101.20120123T0157zgit64cf8a4.el6.x86_64 How reproducible: always Steps to Reproduce: 1.Find how many permissions match a filter like attr=description: ipa permission-find --attr=description 2. Now limit the number of entries retunr using sizelimit ipa permission-find --attr=description --sizelimit=5 Actual results: All matching permissions are listed Expected results: Only 5 permissions should be listed Additional info:
--timelimit - is difficult to gauge, but suspect it is disregarded as well the test i ran: # date; ipa permission-find --name=ManageUser1 --timelimit=1; date Fri Jan 27 15:17:23 EST 2012 ---------------------- 88 permissions matched ---------------------- Permission name: AAA Permissions: write <snip> ..... <snip> Granted to Privilege: Write IPA Configuration ----------------------------- Number of entries returned 88 ----------------------------- Fri Jan 27 15:17:34 EST 2012 Not sure if the search lasted 1 sec, but printing out 88 entries took 9 sec...
Upstream ticket: https://fedorahosted.org/freeipa/ticket/2322
timelimit refers only to LDAP search time. You can see the time taken in the DS access log.
Also --permissions if invalid is disregarded. Actual: # ipa permission-find --permissions=xyz --all --------------------- 0 permissions matched --------------------- ---------------------------- Number of entries returned 0 ---------------------------- Expected: message indicating - "ipa: ERROR: invalid 'permissions': "xyz" is not a valid permission"
That's to be expected. The search options are just things to look for to narrow down the search. Not existing should not prevent the search from executing.
Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/8d00d7c13038abc152afbd46c96108753506fb77 --sizelimit is now properly enforced. As for the --timelimit issue, there is not much more we can do. This is not a standard search, where just one LDAP query is run. With permission-find, we run: 1. LDAP Search to search for all matching permission objects 2. For all matched objects, we run an LDAP retrieve call to pull ACI data 3. LDAP search is run to also search in ACIs 4. For all matched objects, we run an LDAP retrieve call to pull permission data This is the reason why the --timelimit cannot be kept as easily as with other *-find commands.
regression test added to rbac permission test suite
Verified using ipa-server-3.0.0-20.el6.x86_64 # ipa permission-find --attrs=description --permissions=write --type=user --sizelimit=3 --------------------- 3 permissions matched --------------------- Permission name: ManageUser1 Permissions: write Attributes: carlicense, description Type: user Permission name: ManageUser2 Permissions: read, write Attributes: carlicense, description Type: user Permission name: Modify Users Permissions: write Attributes: givenname, sn, cn, displayname, title, initials, loginshell, gecos, homephone, mobile, pager, facsimiletelephonenumber, telephonenumber, street, roomnumber, l, st, postalcode, manager, secretary, description, carlicense, labeleduri, inetuserhttpurl, seealso, employeetype, businesscategory, ou, mepmanagedentry, objectclass Type: user Granted to Privilege: User Administrators, Modify Users and Reset passwords ---------------------------- Number of entries returned 3 ---------------------------- # ipa permission-find --attrs=description --permissions=write --type=user --sizelimit=2 --------------------- 2 permissions matched --------------------- Permission name: ManageUser1 Permissions: write Attributes: carlicense, description Type: user Permission name: Modify Users Permissions: write Attributes: givenname, sn, cn, displayname, title, initials, loginshell, gecos, homephone, mobile, pager, facsimiletelephonenumber, telephonenumber, street, roomnumber, l, st, postalcode, manager, secretary, description, carlicense, labeleduri, inetuserhttpurl, seealso, employeetype, businesscategory, ou, mepmanagedentry, objectclass Type: user Granted to Privilege: User Administrators, Modify Users and Reset passwords ---------------------------- Number of entries returned 2 ----------------------------
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0528.html