From 0dfd5704e3e9c744e3a5fbf0d7ec5acf560bb371 Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Aug 22 2016 12:05:33 +0000
Subject: trust: make sure ID range is created for the child domain even if it exists


ID ranges for child domains of a forest trust were created incorrectly
in FreeIPA 4.4.0 due to refactoring of -- if the domain was already
existing, we never attempted to create the ID range for it.

At the same time, when domain was missing, we attempted to add ID range
and passed both forest root and the child domain names to add_range().
However, add_range() only looks at the first positional argument which
was the forest root name. That ID range always exists (it is created
before child domains are processed).

Modify the code to make sure child domain name is passed as the first
positional argument. In addition, the oddjob helper should explicitly
set context='server' so that idrange code will be able to see and use
ipaserver/dcerpc.py helpers.

Resolves: https://fedorahosted.org/freeipa/ticket/5738
Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>

---

diff --git a/install/oddjob/com.redhat.idm.trust-fetch-domains b/install/oddjob/com.redhat.idm.trust-fetch-domains
index 6a2171d..1038b30 100755
--- a/install/oddjob/com.redhat.idm.trust-fetch-domains
+++ b/install/oddjob/com.redhat.idm.trust-fetch-domains
@@ -93,7 +93,7 @@ env._bootstrap(context='server', debug=options.debug, log=None)
 env._finalize_core(**dict(DEFAULT_CONFIG))
 
 # Initialize the API with the proper debug level
-api.bootstrap(context='server', debug=env.debug, log=None)
+api.bootstrap(in_server=True, debug=env.debug, log=None, context='server')
 api.finalize()
 
 # Only import trust plugin after api is initialized or internal imports
diff --git a/ipalib/plugins/trust.py b/ipalib/plugins/trust.py
index d6b3e11..b1dd9e3 100644
--- a/ipalib/plugins/trust.py
+++ b/ipalib/plugins/trust.py
@@ -1587,14 +1587,19 @@ def add_new_domains_from_trust(myapi, trustinstance, trust_entry, domains, **opt
             if 'raw' in options:
                 dom['raw'] = options['raw']
 
-            res = myapi.Command.trustdomain_add(trust_name, name, **dom)
-            result.append(res['result'])
+            try:
+                res = myapi.Command.trustdomain_add(trust_name, name, **dom)
+                result.append(res['result'])
+            except errors.DuplicateEntry:
+                # Ignore updating duplicate entries
+                pass
 
             if idrange_type != u'ipa-ad-trust-posix':
                 range_name = name.upper() + '_id_range'
                 dom['range_type'] = u'ipa-ad-trust'
-                add_range(myapi, trustinstance, range_name, dom['ipanttrusteddomainsid'],
-                          trust_name, name, **dom)
+                add_range(myapi, trustinstance,
+                          range_name, dom['ipanttrusteddomainsid'],
+                          name, **dom)
         except errors.DuplicateEntry:
             # Ignore updating duplicate entries
             pass