On Thu, 31 Jan 2013, Martin Kosek wrote:
When ipa-adtrust-install is run, check if there are any objects
that need to have SID generated. If yes, interactively ask the user
if the sidgen task should be run.
https://fedorahosted.org/freeipa/ticket/3195
From bd6512628d83d1f4bdfc9f414689c8a67bd01c7c Mon Sep 17 00:00:00 2001
From: Martin Kosek <mko...@redhat.com>
Date: Thu, 31 Jan 2013 15:08:08 +0100
Subject: [PATCH] ipa-adtrust-install should ask for SID generation
When ipa-adtrust-install is run, check if there are any objects
that need have SID generated. If yes, interactively ask the user
if the sidgen task should be run.
https://fedorahosted.org/freeipa/ticket/3195
---
install/tools/ipa-adtrust-install | 42 +++++++++++++++++++++++++++++++++------
1 file changed, 36 insertions(+), 6 deletions(-)
diff --git a/install/tools/ipa-adtrust-install
b/install/tools/ipa-adtrust-install
index
17f2f0e98d08863c9e48595d219bffb148490921..e127fd63e9a43b2630325d1fc3aa645f2ef8951a
100755
--- a/install/tools/ipa-adtrust-install
+++ b/install/tools/ipa-adtrust-install
@@ -275,12 +275,6 @@ def main():
ip_address = str(ip)
root_logger.debug("will use ip_address: %s\n", ip_address)
- if not options.unattended:
- print ""
- print "The following operations may take some minutes to complete."
- print "Please wait until the prompt is returned."
- print ""
-
admin_password = options.admin_password
if not (options.unattended or admin_password):
admin_password = read_admin_password(options.admin_name)
@@ -320,6 +314,42 @@ def main():
set_and_check_netbios_name(options.netbios_name,
options.unattended)
+ if not options.unattended and not options.add_sids:
+ # The filter corresponds to ipa_sidgen_task.c LDAP search filter
+ filter = '(&(objectclass=ipaobject)(!(objectclass=mepmanagedentry))' \
+ '(|(objectclass=posixaccount)(objectclass=posixgroup)' \
+ '(objectclass=ipaidobject))(!(ipantsecurityidentifier=*)))'
+ try:
+ (entries, truncated) =
api.Backend.ldap2.find_entries(filter=filter,
+ base_dn=api.env.basedn, attrs_list=[''])
+ except errors.NotFound:
+ # All objects have SIDs assigned
+ pass
+ except (errors.DatabaseError, errors.NetworkError), e:
+ print "Could not retrieve a list of entries that needs a SID
generation:"
+ print " %s" % e
+ else:
+ object_count = len(entries)
+ if object_count > 0:
+ print ""
+ print "%d existing users or groups do not have a SID identifier
assigned." \
+ % len(entries)
+ print "Installer can run a task to have ipa-sidgen Directory Server
plugin generate"
+ print "the SID identifier for all these users. Please note, the in
case of a high"
+ print "number of users and groups, the operation might lead to high
replication"
+ print "traffic and performance degradation. Refer to
ipa-adtrust-install(1) man page"
+ print "for details."
+ print ""
+ if ipautil.user_input("Do you want to run the ipa-sidgen
task?", default=False,
+ allow_empty=False):
+ options.add_sids = True
I would still run this check in options.unattended mode and reported
warning, for accounting purposes.
Could you please make so?
--
/ Alexander Bokovoy
_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
