openldap-bugs October 2008

openldap-bugs@openldap.org

36 participants
187 discussions

Re: (ITS#5751) undefined value in slapo-constraint with bad filter
by ando＠sys-net.it 19 Oct '08

19 Oct '08

michael(a)stroeder.com wrote: > hyc(a)symas.com wrote: >> h.b.furuseth(a)usit.uio.no wrote: >>> Full_Name: Hallvard B Furuseth >>> Version: HEAD, RE24 >>> OS: >>> URL: >>> Submission from: (NULL) (129.240.6.233) >>> Submitted by: hallvard >>> >>> >>> overlays/constraint.c:constraint_violation() uses and maybe returns an >>> undefined value in 'rc' if the filter is bad (nop.ors_filter == NULL). >>> >>> I have no idea what rc should be in this case. >>> >>> Introduced in constraint.c 1.18 (OpenLDAP 2.4.12). >> Probably should just set rc=LDAP_SUCCESS in this case. The constraint is >> invalid, so it cannot be violated. > > Hmm, I'd prefer a strong indication that the constraint is invalid. > > If it can be proven that the filter is bad slapo-constraint should > probably stop during startup with an appropriate message. Otherwise > returning constraintViolation would be appropriate either since the LDAP > client fails then and it makes admins search for the cause of it. I concur. I've made slapo-constraint(5) return LDAP_OTHER, so it's clear that there's something wrong. Returning LDAP_CONSTRAINT_VIOLATION would have erroneously indicated that the value was not allowed but everything was working fine. Please test. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5752) ldapadd/ldapmodify do not follow referrals
by ando＠sys-net.it 19 Oct '08

19 Oct '08

That's by design. Since following referrals non-anonymously is inherently unsafe, automatically chasing referrals implies allowing the user to either (a) acknowledge automatic chasing based on the referral's value, or (b) be prompted for the correct credentials. I don't see too much difference between this and requiring the user to manually chase referrals. The right solution to your problem consists in configuring your slapd with slapo-chain(5) in order to delegate referral chasing to the DSA. In that case, automatic chasing would be performed within a well-agreed authentication/authorization pattern, and the client wouldn't even know a referral was returned. I'd consider this ITS closed, unless you intend to provide a patch that (optionally) implements (a) and (b) above. p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

(ITS#5753) Command-line tools: Handling of -x and -D vs. -Y and -U
by michael＠stroeder.com 19 Oct '08

19 Oct '08

Full_Name: Michael Ströder Version: HEAD OS: Linux URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (84.163.121.52) Currently the command-line tools require to explicitly use command-line option -x for a simple bind even when -D <bind-dn> is already given as command-line argument. This sometimes confuses users. So I'd like to propose that 1. -x is automagically assumed if -D is given at the command-line and no other SASL-related arguments like -Y or -U etc. are defined, 2. setting the bind-DN with -D should still be usable when -Y is explicitly defined. I'm not sure whether this could also be automagically done if -U is given as command-line argument since still one would have to specify the SASL mech with -Y. Ciao, Michael.

1 0

(ITS#5752) ldapadd/ldapmodify do not follow referrals
by setzer＠webix.de 19 Oct '08

19 Oct '08

Full_Name: Christian Setzer Version: slapd 2.3.30-5+etch2 OS: debian etch/lenny URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (62.214.143.132) i have a master ldap server (ldap.domain.ape) and a slave(kontakte.affenfels.ape). the slave server only holds the referral for ou=contacts,dc=domain,dc=de. on the master i created a referral object dn: ou=contacts,dc=domain,dc=de objectClass: referral objectClass: extensibleObject ou: contacts ref: ldap://kontakte.domain.ape/ou=contacts,dc=domain,dc=de now i want to add a new entry to ou=contacts,dc=domain,dc=de i use ldapadd for that. the following message i get. root@ldap.domain.ape:~ > ldapadd -x -D "cn=admin,dc=domain,dc=de" -h ldap.domain.ape -p 389 -f ldap_contacts_referral.ldif -MM -W -ZZ Enter LDAP Password: adding new entry "cn=user,ou=personal,ou=contacts,dc=domain,dc=de" ldap_add: Referral (10) matched DN: ou=contacts,dc=domain,dc=de referrals: ldap://kontakte.domain.ape/ou=contacts,dc=domain,dc=de root@ldap.domain.ape:~ > cat ldap_contacts_referral.ldif dn: cn=user,ou=personal,ou=contacts,dc=domain,dc=de objectClass: organizationalRole cn: user the syslog. Oct 19 13:47:35 ldap slapd[1262]: >>> dnPrettyNormal: <cn=user,ou=personal,ou=contacts,dc=domain,dc=de> Oct 19 13:47:35 ldap slapd[1262]: <<< dnPrettyNormal: <cn=user,ou=personal,ou=contacts,dc=domain,dc=de>, <cn=user,ou=personal,ou=contacts,dc=domain,dc=de> Oct 19 13:47:35 ldap slapd[1262]: do_add: dn (cn=user,ou=personal,ou=contacts,dc=domain,dc=de) Oct 19 13:47:35 ldap slapd[1262]: => get_ctrls Oct 19 13:47:35 ldap slapd[1262]: => get_ctrls: oid="2.16.840.1.113730.3.4.2" (critical) Oct 19 13:47:35 ldap slapd[1262]: <= get_ctrls: n=1 rc=0 err="" Oct 19 13:47:35 ldap slapd[1262]: conn=530 op=2 ADD dn="cn=user,ou=personal,ou=contacts,dc=domain,dc=de" Oct 19 13:47:35 ldap slapd[1262]: slap_global_control: unavailable control: 2.16.840.1.113730.3.4.2 Oct 19 13:47:35 ldap slapd[1262]: ==> bdb_add: cn=user,ou=personal,ou=contacts,dc=domain,dc=de Oct 19 13:47:35 ldap slapd[1262]: oc_check_required entry (cn=user,ou=personal,ou=contacts,dc=domain,dc=de), objectClass "organizationalRole" Oct 19 13:47:35 ldap slapd[1262]: oc_check_allowed type "objectClass" Oct 19 13:47:35 ldap slapd[1262]: oc_check_allowed type "cn" Oct 19 13:47:35 ldap slapd[1262]: oc_check_allowed type "structuralObjectClass" Oct 19 13:47:35 ldap slapd[1262]: oc_check_allowed type "entryUUID" Oct 19 13:47:35 ldap slapd[1262]: oc_check_allowed type "creatorsName" Oct 19 13:47:35 ldap slapd[1262]: oc_check_allowed type "createTimestamp" Oct 19 13:47:35 ldap slapd[1262]: oc_check_allowed type "entryCSN" Oct 19 13:47:35 ldap slapd[1262]: oc_check_allowed type "modifiersName" Oct 19 13:47:35 ldap slapd[1262]: oc_check_allowed type "modifyTimestamp" Oct 19 13:47:35 ldap slapd[1262]: bdb_dn2entry("cn=user,ou=personal,ou=contacts,dc=domain,dc=de") Oct 19 13:47:35 ldap slapd[1262]: => bdb_dn2id("ou=personal,ou=contacts,dc=domain,dc=de") Oct 19 13:47:35 ldap slapd[1262]: <= bdb_dn2id: get failed: DB_NOTFOUND: No matching key/data pair found (-30990) Oct 19 13:47:35 ldap slapd[1262]: bdb_add: parent does not exist Oct 19 13:47:35 ldap slapd[1262]: send_ldap_result: conn=530 op=2 p=3 Oct 19 13:47:35 ldap slapd[1262]: daemon: select: listen=7 active_threads=0 tvp=NULL Oct 19 13:47:35 ldap slapd[1262]: daemon: select: listen=8 active_threads=0 tvp=NULL Oct 19 13:47:35 ldap slapd[1262]: daemon: select: listen=9 active_threads=0 tvp=NULL Oct 19 13:47:35 ldap slapd[1262]: send_ldap_result: err=10 matched="ou=contacts,dc=domain,dc=de" text="" Oct 19 13:47:35 ldap slapd[1262]: send_ldap_result: referral="ldap://kontakte.host.ape/ou=contacts,dc=domain,dc=de" Oct 19 13:47:35 ldap slapd[1262]: send_ldap_response: msgid=3 tag=105 err=10 Oct 19 13:47:35 ldap slapd[1262]: send_ldap_response: ref="ldap://kontakte.host.ape/ou=contacts,dc=domain,dc=de" Oct 19 13:47:35 ldap slapd[1262]: conn=530 op=2 RESULT tag=105 err=10 text= Oct 19 13:47:35 ldap slapd[1262]: daemon: activity on 1 descriptor Oct 19 13:47:35 ldap slapd[1262]: daemon: activity on: when i try to add an entry via the "ldap admin tool" and say that i want to use auth instead of anonymous it works. but with ldapadd it doesnt cause the ldaptools do not follow referrals right. so normally it should be possible to add entries to the referral server with the master ldap.

1 0

Re: (ITS#5751) undefined value in slapo-constraint with bad filter
by michael＠stroeder.com 19 Oct '08

19 Oct '08

hyc(a)symas.com wrote: > h.b.furuseth(a)usit.uio.no wrote: >> Full_Name: Hallvard B Furuseth >> Version: HEAD, RE24 >> OS: >> URL: >> Submission from: (NULL) (129.240.6.233) >> Submitted by: hallvard >> >> >> overlays/constraint.c:constraint_violation() uses and maybe returns an >> undefined value in 'rc' if the filter is bad (nop.ors_filter == NULL). >> >> I have no idea what rc should be in this case. >> >> Introduced in constraint.c 1.18 (OpenLDAP 2.4.12). > > Probably should just set rc=LDAP_SUCCESS in this case. The constraint is > invalid, so it cannot be violated. Hmm, I'd prefer a strong indication that the constraint is invalid. If it can be proven that the filter is bad slapo-constraint should probably stop during startup with an appropriate message. Otherwise returning constraintViolation would be appropriate either since the LDAP client fails then and it makes admins search for the cause of it. Ciao, Michael.

1 0

R: Re: (ITS#5744) Automatically close issues when no feedback is received within a reasonable time
by ando＠sys-net.it 19 Oct '08

19 Oct '08

----- Hallvard B Furuseth <h.b.furuseth(a)usit.uio.no> ha scritto: > ando(a)sys-net.it writes: > > My point is about tickets opened with only partial information, answered > > with a request for clarification that never comes in: 5712, 5652, 5651, ... > > Hm, you've marked ITS#5651 Feedback even though it contains no feedback > request. If you sent one privately, I suggest you re-send via ITS. No, the request was with ITS#5652: same poster, almost same problem, same feedback... p. Ing. Pierangelo Masarati OpenLDAP Core Team SysNet s.r.l. via Dossi, 8 - 27100 Pavia - ITALIA http://www.sys-net.it ----------------------------------- Office: +39 02 23998309 Mobile: +39 333 4963172 Fax: +39 0382 476497 Email: ando(a)sys-net.it -----------------------------------

1 0

Re: (ITS#5751) undefined value in slapo-constraint with bad filter
by hyc＠symas.com 18 Oct '08

18 Oct '08

h.b.furuseth(a)usit.uio.no wrote: > Full_Name: Hallvard B Furuseth > Version: HEAD, RE24 > OS: > URL: > Submission from: (NULL) (129.240.6.233) > Submitted by: hallvard > > > overlays/constraint.c:constraint_violation() uses and maybe returns an > undefined value in 'rc' if the filter is bad (nop.ors_filter == NULL). > > I have no idea what rc should be in this case. > > Introduced in constraint.c 1.18 (OpenLDAP 2.4.12). Probably should just set rc=LDAP_SUCCESS in this case. The constraint is invalid, so it cannot be violated. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

Re: (ITS#5744) Automatically close issues when no feedback is received within a reasonable time
by h.b.furuseth＠usit.uio.no 18 Oct '08

18 Oct '08

ando(a)sys-net.it writes: > My point is about tickets opened with only partial information, answered > with a request for clarification that never comes in: 5712, 5652, 5651, ... Hm, you've marked ITS#5651 Feedback even though it contains no feedback request. If you sent one privately, I suggest you re-send via ITS. -- Hallvard

1 0

(ITS#5751) undefined value in slapo-constraint with bad filter
by h.b.furuseth＠usit.uio.no 18 Oct '08

18 Oct '08

Full_Name: Hallvard B Furuseth Version: HEAD, RE24 OS: URL: Submission from: (NULL) (129.240.6.233) Submitted by: hallvard overlays/constraint.c:constraint_violation() uses and maybe returns an undefined value in 'rc' if the filter is bad (nop.ors_filter == NULL). I have no idea what rc should be in this case. Introduced in constraint.c 1.18 (OpenLDAP 2.4.12).

1 0

(ITS#5750) Do not strip bitstring zeros in Name and Optional UID
by h.b.furuseth＠usit.uio.no 18 Oct '08

18 Oct '08

Full_Name: Hallvard B Furuseth Version: HEAD, RE24 OS: URL: Submission from: (NULL) (129.240.6.233) Submitted by: hallvard All bitstring bits are significant, but schema_init.c:nameUIDPretty() strips initial zeros from the bitstring in syntax Name and Optional UID. It was incompletely fixed in schema_init.c 1.247 (OpenLDAP 2.1.11) after <http://www.openldap.org/lists/openldap-devel/200301/msg00005.html>.

1 0

← Newer
1
...
8
9
10
11
12
13
14
...
19
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs October 2008