From a5bb758978ffdccc5a985487d57856290428abf1 Mon Sep 17 00:00:00 2001
From: Tomas Babej <tbabej@redhat.com>
Date: Jul 02 2014 14:12:05 +0000
Subject: ipaldap: Override conversion of nsds5replicalast{update,init}{start,end}


The replication related attributes with generalized time syntax have
special behaviour implemented in 389, as follows:

In case they are explicitly requested for and not set, 0 is returned.

However, 0 is not a valid value for LDAP Generalized time. Thus
we need to add these attributes to the _SYNTAX_OVERRIDE dictionary,
overriding their conversion to datetime and converting them to
string instead, which perserves the old behaviour expected by the
replication codebase.

https://fedorahosted.org/freeipa/ticket/4350

Reviewed-By: Martin Kosek <mkosek@redhat.com>

---

diff --git a/ipapython/ipaldap.py b/ipapython/ipaldap.py
index 21706cf..44918c3 100644
--- a/ipapython/ipaldap.py
+++ b/ipapython/ipaldap.py
@@ -263,6 +263,10 @@ class IPASimpleLDAPObject(object):
         'idnssoamname':    DNSName,
         'idnssoarname':    DNSName,
         'dnszoneidnsname': DNSName,
+        'nsds5replicalastupdatestart': unicode,
+        'nsds5replicalastupdateend': unicode,
+        'nsds5replicalastinitstart': unicode,
+        'nsds5replicalastinitend': unicode,
     })
     _SINGLE_VALUE_OVERRIDE = CIDict({
         'nsslapd-ssl-check-hostname': True,