openldap-bugs July 2011

openldap-bugs@openldap.org

23 participants
60 discussions

(ITS#6985) sssvlv / greaterThanOrEqual problem
by ctcard＠hotmail.com 05 Jul '11

05 Jul '11

Full_Name: Chris Card Version: HEAD (on 30 June 2011) OS: Centos 5.4 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (91.194.158.133) I am running slapd built from HEAD on June 30th 2011, with back-sql backend, and pcache and sssvlv overlays. I am submitting a search request with vlv and sort controls. In the sort control I am specifying attributeType cn and orderingRule caseIgnoreOrderingMatch. If I specify 'd' as the greaterThanOrEqual value of the vlv control, beforeCount 0 and afterCount 4, I get 5 entries with the following cns returned: Dave Smith Fiona Smith Glynis Smith Jane Smith Jennifer Smith If I specify 'g' in greaterThanOrEqual I get: Glynis Smith Jane Smith Jennifer Smith Jim Smith Mark Smith But if I specify 'f' I get no entries returned.

1 0

Re: (ITS#6984) Enable draft-wahl-ldap-session in RE24
by masarati＠aero.polimi.it 04 Jul '11

04 Jul '11

> Full_Name: Michael Ströder > Version: 2.4.x > OS: > URL: > Submission from: (NULL) (84.128.228.27) > > > It seems there is support for draft-wahl-ldap-session in OpenLDAP's source > since > 2007 but it seems not to be enabled in a default build. It's hidden behind > ifdef-statements and one has to use -DLDAP_DEVEL when compiling which is > not > supposed to work with RE24. > > I've tested it with HEAD and I'd be glad this could be enabled for > standard > builds in 2.4 series. As far as I understand, support is complete and conforms to draft as of the time it was implemented. Since the draft expired, it has never been released. Moreover, I sent the author some comments about how the draft could be improved, IMHO, but received no answer (I don't recall whether the discussion was in ldapext or personal, though). If it can be useful, I surely favour its release, provided this complies with the project's policy towards support for expired drafts. p.

1 0

(ITS#6984) Enable draft-wahl-ldap-session in RE24
by michael＠stroeder.com 04 Jul '11

04 Jul '11

Full_Name: Michael Ströder Version: 2.4.x OS: URL: Submission from: (NULL) (84.128.228.27) It seems there is support for draft-wahl-ldap-session in OpenLDAP's source since 2007 but it seems not to be enabled in a default build. It's hidden behind ifdef-statements and one has to use -DLDAP_DEVEL when compiling which is not supposed to work with RE24. I've tested it with HEAD and I'd be glad this could be enabled for standard builds in 2.4 series. Ciao, Michael.

1 0

(ITS#6983) modrdn operations on hdb databases create duplicate return results
by quanah＠zimbra.com 02 Jul '11

02 Jul '11

Full_Name: Quanah Gibson-Mount Version: 2.4.25 OS: Linux 2.6 URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (75.111.45.108) When a modrdn operation is done on a subtree (I.e., subtree rename), the result is that back-hdb will return certain entries in that subtree multiple times. Stopping and restarting slapd fixes the behavior. Example: ldapsearch -x -v -H 'ldap://HOST ' -w PASSWORD -D 'uid=zimbra,cn=admins,cn=zimbra' -b "dc=NEWDOMAIN,dc=COM" ldap_initialize( ldap://HOST:389/??base ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <dc=NEWDOMAIN,dc=COM> with scope subtree # filter: (objectclass=*) # requesting: ALL # # d-fashion.be dn: dc=NEWDOMAIN,dc=COM o: NEWDOMAIN.com domain zimbraDomainName: NEWDOMAIN.COM zimbraDomainStatus: active zimbraPublicServiceHostname: mail.domain.com zimbraId: affb06b8-79bc-430a-adf7-411cc45e8f00 zimbraMailStatus: enabled objectClass: dcObject objectClass: organization objectClass: zimbraDomain zimbraDomainType: local dc: NEWDOMAIN zimbraPreAuthKey: PRIVATE # people, NEWDOMAIN.COM dn: ou=people,dc=NEWDOMAIN,dc=COM ou: people objectClass: organizationalRole cn: people # people, NEWDOMAIN.COM dn: ou=people,dc=NEWDOMAIN,dc=COM ou: people objectClass: organizationalRole cn: people

1 0

Re: ITS#6873
by masarati＠aero.polimi.it 01 Jul '11

01 Jul '11

> masarati(a)aero.polimi.it wrote: >> Fixed in master, please test. > > Sorry, last message went to wrong ITS. > > But also seems to work now...thanks... :-) > > $ ldapmodify -x -H ldap://localhost:2071 -D > "uid=diradm,ou=schulung,dc=stroeder,dc=local" -e relax -w testsecret -f > authtime_mod.ldif > modifying entry "cn=test1,ou=schulung,dc=stroeder,dc=local" > > -------------------------- authtime_mod.ldif -------------------------- > dn: cn=test1,ou=schulung,dc=stroeder,dc=local > changetype: modify > replace: authTimestamp > authTimestamp: 20110701165029Z Good, I only tested this one. Those were easy fixes, sorry I overlooked them for such a long time. p.

1 0

Re: (ITS#6830) slapo-ppolicy.5 has incorrect schema fragments
by michael＠stroeder.com 01 Jul '11

01 Jul '11

hyc(a)symas.com wrote: > Andrew Findlay wrote: >> On Thu, Jun 09, 2011 at 01:45:17AM -0700, Howard Chu wrote: >> >>> I note that in ppolicy.c we have: >>> >>> { "( 1.3.6.1.4.1.42.2.27.8.1.17 " >>> "NAME ( 'pwdAccountLockedTime' ) " >>> "DESC 'The time an user account was locked' " >>> "EQUALITY generalizedTimeMatch " >>> "ORDERING generalizedTimeOrderingMatch " >>> "SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 " >>> "SINGLE-VALUE " >>> #if 0 >>> /* Not until Relax control is released */ >>> "NO-USER-MODIFICATION " >>> #endif >>> "USAGE directoryOperation )", >>> >>> We have in fact released support for the Relax control, so it's >>> probably time to unifdef these bits and go back to the documented >>> behavior. >> >> That seems reasonable in the long term, though it will break many sites' >> existing password management procedures. The change will have to be >> mentioned in the updated manpage, noting the version at which it takes >> effect. >> >> Should I produce an updated version of the manpage patch? > > Well since you raise the question, what do you think is the more sensible > approach to all of this? I was the one who argued in ldapext that these > attributes should be no-user-modification but perhaps that makes them too > inconvenient to administer. Given the fact that the Relax Rules control still has .666 OID it cannot be used (see my related messages to openldap-devel and ietf-ldapext). At least what's always being said about .666 OIDs... Ciao, Michael.

1 0

Re: ITS#6873
by michael＠stroeder.com 01 Jul '11

01 Jul '11

masarati(a)aero.polimi.it wrote: > Fixed in master, please test. Sorry, last message went to wrong ITS. But also seems to work now...thanks... :-) $ ldapmodify -x -H ldap://localhost:2071 -D "uid=diradm,ou=schulung,dc=stroeder,dc=local" -e relax -w testsecret -f authtime_mod.ldif modifying entry "cn=test1,ou=schulung,dc=stroeder,dc=local" -------------------------- authtime_mod.ldif -------------------------- dn: cn=test1,ou=schulung,dc=stroeder,dc=local changetype: modify replace: authTimestamp authTimestamp: 20110701165029Z

1 0

ITS#6886
by michael＠stroeder.com 01 Jul '11

01 Jul '11

masarati(a)aero.polimi.it wrote: > Fixed in master, please test. Seems to work now...thanks... :-) *** ldap://localhost:2071 - SimpleLDAPObject.extop (('1.3.6.1.4.1.1466.101.119.1', '0/\x80)cn=test1,ou=schulung,dc=stroeder,dc=local\x81\x02\x1c ', None, None),{}) => result: 2 *** ldap://localhost:2071 - SimpleLDAPObject.result4 ((2, 1, -1, 1, 1, 1),{}) => result: (120, [], 2, [], '1.3.6.1.4.1.1466.101.119.1', '0\x04\x81\x02\x1c ') Response TTL: 7200

1 0

Re: ITS#6873
by michael＠stroeder.com 01 Jul '11

01 Jul '11

1 0

(ITS#6982) libutil md5 incorrect sizeof
by quanah＠OpenLDAP.org 01 Jul '11

01 Jul '11

Full_Name: Quanah Gibson-Mount Version: 2.4.25 OS: NA URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (75.111.45.108) Line 188 in liblutil/md5.c is wrong. It has: memset(ctx, '\0', sizeof(ctx)); /* In case it's sensitive */ It should be: memset(ctx, '\0', sizeof(*ctx)); /* In case it's sensitive */

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs July 2011