From bd74150aa28f92b0980f5a803d3591a118628e8f Mon Sep 17 00:00:00 2001
From: Alexander Bokovoy <abokovoy@redhat.com>
Date: Nov 01 2016 10:25:15 +0000
Subject: trustdomain-del: fix the way how subdomain is searched


With FreeIPA 4.4 we moved child domains behind the 'trustdomain' topic.
Update 'ipa trustdomain-del' command to properly calculate DN to the
actual child domain and handle the case when it is missing correctly.

Fixes https://fedorahosted.org/freeipa/ticket/6445

Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>

---

diff --git a/ipaserver/plugins/trust.py b/ipaserver/plugins/trust.py
index 6e6f6c5..68725d3 100644
--- a/ipaserver/plugins/trust.py
+++ b/ipaserver/plugins/trust.py
@@ -1614,13 +1614,16 @@ class trustdomain_del(LDAPDelete):
         # to always receive empty keys. We need to catch the case when root domain is being deleted
 
         for domain in keys[1]:
-            # Fetch the trust to verify that the entered domain is trusted
-            self.api.Command.trust_show(domain)
+            try:
+                self.obj.get_dn_if_exists(keys[0], domain, trust_type=u'ad')
+            except errors.NotFound:
+                if keys[0].lower() == domain:
+                    raise errors.ValidationError(
+                        name='domain',
+                        error=_("cannot delete root domain of the trust, "
+                                "use trust-del to delete the trust itself"))
+                self.obj.handle_not_found(keys[0], domain)
 
-            if keys[0].lower() == domain:
-                raise errors.ValidationError(name='domain',
-                    error=_("cannot delete root domain of the trust, "
-                            "use trust-del to delete the trust itself"))
             try:
                 res = self.api.Command.trustdomain_enable(keys[0], domain)
             except errors.AlreadyActive: