Warn user if an ID range with incorrect size was created

IPA 3.0 introduced range ID objects in replicated space which specify
a range of IDs assigned via DNA plugin. ipa-ldap-updater generates the
default ID range which should correspond with IDs assigned to IPA
users.

However, since correct range size is not known, we should at least
warn that a range with invalid size was created so that user can
amend it.

https://fedorahosted.org/freeipa/ticket/2892

1 files changed, 53 insertions, 6 deletions

diff --git a/ipaserver/install/plugins/adtrust.py b/ipaserver/install/plugins/adtrust.py
index abd676a2..c32d82e3 100644
--- a/ipaserver/install/plugins/adtrust.py
+++ b/ipaserver/install/plugins/adtrust.py
@@ -23,6 +23,8 @@ from ipalib import api, errors
 from ipalib.dn import DN
 from ipapython.ipa_log_manager import *
 
+DEFAULT_ID_RANGE_SIZE = 200000
+
 class update_default_range(PostUpdate):
     """
     Create default ID range for upgraded servers.
@@ -46,18 +48,19 @@ class update_default_range(PostUpdate):
         try:
             (dn, admins_entry) = ldap.get_entry(dn, ['gidnumber'])
         except errors.NotFound:
-            root_logger.error("No local ID range and no admins group found. "
-                              "Cannot create default ID range")
+            root_logger.error("default_range: No local ID range and no admins "
+                              "group found. Cannot create default ID range")
             return (False, False, [])
 
-        base_id = admins_entry['gidnumber'][0]
-        id_range_size = 200000
+        id_range_base_id = admins_entry['gidnumber'][0]
+        id_range_name = '%s_id_range' % api.env.realm
+        id_range_size = DEFAULT_ID_RANGE_SIZE
 
         range_entry = ['objectclass:top',
                        'objectclass:ipaIDrange',
                        'objectclass:ipaDomainIDRange',
-                       'cn:%s_id_range' % api.env.realm,
-                       'ipabaseid:%s' % base_id,
+                       'cn:%s' % id_range_name,
+                       'ipabaseid:%s' % id_range_base_id,
                        'ipaidrangesize:%s' % id_range_size,
                       ]
 
@@ -69,6 +72,50 @@ class update_default_range(PostUpdate):
         range_entry = map(str, range_entry)
         updates[dn] = {'dn' : dn, 'default' : range_entry}
 
+        # Default range entry has a hard-coded range size to 200000 which is
+        # a default range size in ipa-server-install. This could cause issues
+        # if user did not use a default range, but rather defined an own,
+        # bigger range (option --idmax).
+        # We should make our best to check if this is the case and provide
+        # user with an information how to fix it.
+        dn = str(DN(api.env.container_dna_posix_ids, api.env.basedn))
+        search_filter = "objectclass=dnaSharedConfig"
+        attrs = ['dnaHostname', 'dnaRemainingValues']
+        try:
+            (entries, truncated) = ldap.find_entries(search_filter, attrs, dn)
+        except errors.NotFound:
+            root_logger.warning("default_range: no dnaSharedConfig object found. "
+                                "Cannot check default range size.")
+        else:
+            masters = set()
+            remaining_values_sum = 0
+            for entry_dn, entry in entries:
+                hostname = entry.get('dnahostname', [None])[0]
+                if hostname is None or hostname in masters:
+                    continue
+                remaining_values = entry.get('dnaremainingvalues', [''])[0]
+                try:
+                    remaining_values = int(remaining_values)
+                except ValueError:
+                    root_logger.warning("default_range: could not parse "
+                        "remaining values from '%s'", remaining_values)
+                    continue
+                else:
+                    remaining_values_sum += remaining_values
+
+                masters.add(hostname)
+
+            if remaining_values_sum > DEFAULT_ID_RANGE_SIZE:
+                msg = ['could not verify default ID range size',
+                       'Please use the following command to set correct ID range size',
+                       '  $ ipa range-mod %s --range-size=RANGE_SIZE' % id_range_name,
+                       'RANGE_SIZE may be computed from --idstart and --idmax options '
+                       'used during IPA server installation:',
+                       '  RANGE_SIZE = (--idmax) - (--idstart) + 1'
+                      ]
+
+                root_logger.error("default_range: %s", "\n".join(msg))
+
         return (False, True, [updates])
 
 api.register(update_default_range)