--_000_AM4PR0101MB19549BBC7F2AB2947F4C5505BBF10AM4PR0101MB1954_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello Howard, Thanks again. This strangely enough works with 2.4.40 version , previously = I was using 2.4.31. ________________________________ From: Howard Chu <hyc(a)symas.comSent: Tuesday, September 13, 2016 9:23:07 PM To: Maria Blagoeva; openldap-its(a)OpenLDAP.org Subject: Re: (ITS#8501) OpenLdap not RFC 2891 complaint Maria Blagoeva wrote: e rule g is he ActiveDirectory is not RFC-compliant. And when no MatchingRule exists for an attribute, matching cannot be performed. That is part of RFC4511 so there's no need to state it here. ----- le ----- rdering (cn=3Dccc*))' -H d in stack,dc=3Dorg" -x t ust -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/ --_000_AM4PR0101MB19549BBC7F2AB2947F4C5505BBF10AM4PR0101MB1954_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html<head<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-= 1"<meta name=3D"Generator" content=3D"Microsoft Exchange Server"<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; pad= ding-left: 4pt; border-left: #800000 2px solid; } --></style</head<body<meta content=3D"text/html; charset=3DUTF-8"<style type=3D"text/css" style=3D""<!-- p {margin-top:0; margin-bottom:0} --</style<div dir=3D"ltr"<div id=3D"x_divtagdefaultwrapper" style=3D"font-size:12pt; color:#000000; = background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif"<p>Hello Howard,</p<p><br</p<p>Thanks again. This strangely enough works with 2.4.40 version , previous= ly I was using 2.4.31.<br</p</div<hr tabindex=3D"-1" style=3D"display:inline-block; width:98%"<div id=3D"x_divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" = color=3D"#000000" style=3D"font-size:11pt"><b>From:</b> Howard Chu &lt;hyc@= symas.com&gt;<br<b>Sent:</b> Tuesday, September 13, 2016 9:23:07 PM<br<b>To:</b> Maria Blagoeva; openldap-its(a)OpenLDAP.org&lt;br<b>Subject:</b> Re: (ITS#8501) OpenLdap not RFC 2891 complaint</font<div>&nbsp;</div</div</div<font size=3D"2"><span style=3D"font-size:10pt;"<div class=3D"PlainText">Maria Blagoeva wrote:<br&gt; Hello Howard,<br&gt;<br&gt;<br&gt; And just one more follow-up question, if you do not mind, just to have= the<br&gt; full picture. The way the RFC is construct, it seems that if the order= ing rule<br&gt; is omitted in the request one that is defined must be used, but if not= hing is<br&gt; defined in the schema nothing will be used, but I do not understand wh= y the<br&gt; openlap will fail than. Exactly the same request works fine with<br&gt; ActiveDirectory server.<br<brActiveDirectory is not RFC-compliant.<br<br&gt; The quotes from the RFC directly:<br<br&gt; The MatchingRuleId, as defined in section 4.1.9 of [LDAPv3], SHOULD<br= &gt;&nbsp;&nbsp;&nbsp; be one that is valid for the attribute type it appli= es to.&nbsp; If it is<br&gt;&nbsp;&nbsp;&nbsp; not, the server will return inappropriateMatching.<b= r<br&gt;&nbsp; If the orderingRule is omitted, the ordering MatchingRule define= d for<br&gt;&nbsp;&nbsp;&nbsp; use with this attribute MUST be used.<br<brAnd when no MatchingRule exists for an attribute, matching cannot be <brperformed. That is part of RFC4511 so there's no need to state it here.<br<br&gt; Thanks again for your insights.<br&gt;<br&gt;<br&gt; ----------------------------------------------------------------------= --------<br&gt; *From:* Maria Blagoeva<br&gt; *Sent:* Tuesday, September 13, 2016 8:50:45 AM<br&gt; *To:* Howard Chu; openldap-its(a)OpenLDAP.org&lt;br&gt; *Subject:* Re: (ITS#8501) OpenLdap not RFC 2891 complaint<br&gt;<br&gt;<br&gt; Hello Howard,<br&gt;<br&gt;<br&gt; This means I need to patch the openldap instance or a default ordering= rule<br&gt; can be set for that attribute on the fly? Thanks again for your help a= nd<br&gt; assistance.<br&gt;<br&gt;<br&gt; BR,<br&gt;<br&gt; Maria<br&gt;<br&gt; ----------------------------------------------------------------------= --------<br&gt; *From:* Howard Chu &amp;lt;hyc(a)symas.com&amp;gt;&lt;br&gt; *Sent:* Monday, September 12, 2016 6:31:25 PM<br&gt; *To:* Maria Blagoeva; openldap-its(a)OpenLDAP.org&lt;br&gt; *Subject:* Re: (ITS#8501) OpenLdap not RFC 2891 complaint<br&gt;<br&gt; mblagoeva(a)axway.com wrote:<br&gt;&gt; Full_Name: Maria Blagoeva<br&gt;&gt; Version: openldap-2.4.31/debian/build/servers/slapd<br&gt;&gt; OS: docker image with&nbsp; 3.10.0-327.28.2.el7.x86_64<br&gt;&gt; URL: <a href=3D"ftp://ftp.openldap.org/incoming/">ftp://ftp.openld= ap.org/incoming/</a><br&gt;&gt; Submission from: (NULL) (194.88.228.86)<br&gt;&gt;<br&gt;&gt;<br&gt;&gt; It seems that openldap as of 2.4.31 is not RFC complaint<br&gt;&gt; (<a href=3D"https://www.ietf.org/rfc/rfc2891.txt">https://www.ietf= .org/rfc/rfc2891.txt</a>) due to failure in response when ordering<br&gt;&gt; match rule is empty while doing server side sorting. Example below= :<br&gt;<br&gt; False. OpenLDAP is completely correct and RFC-compliant in its behavio= r.<br&gt;<br&gt;&gt; empty ordering rule:<br&gt;&gt;<br&gt;&gt; ldapsearch -E sss=3Dcn '(cn=3Dccc*)' cn' (&amp;(objectClass=3Dinet= OrgPerson)(cn=3Dccc*))' -H<br&gt;&gt; ldap://IP:389 -b &quot;ou=3DUsers,dc=3Dopenstack,dc=3Dorg&quot; -D= &quot;cn=3Daaa1,<br&gt;&gt; ou=3DUsers,dc=3Dopenstack,dc=3Dorg&quot; -x -W<br&gt;&gt; # extended LDIF<br&gt;&gt; #<br&gt;&gt; # LDAPv3<br&gt;&gt; # base &lt;ou=3DUsers,dc=3Dopenstack,dc=3Dorg&gt; with scope subtr= ee<br&gt;&gt; # filter: (cn=3Dccc*)<br&gt;&gt; # requesting: cn (&amp;(objectClass=3DinetOrgPerson)(cn=3Dccc*))<b= r&gt;&gt; # with server side sorting control<br&gt;&gt; #<br&gt;&gt;<br&gt;&gt; # search result<br&gt;&gt; search: 2<br&gt;&gt; result: 18 Inappropriate matching<br&gt;&gt; text: serverSort control: No ordering rule<br&gt;<br&gt; This result is correct since the cn attribute has no ordering rule def= ined in<br&gt; the schema.<br&gt;&gt;<br&gt;&gt; # numResponses: 1<br&gt;&gt;<br&gt;&gt; caseIgnoreOrderingMatch ordering rule:<br&gt;&gt;<br&gt;&gt; ldapsearch -E sss=3Dcn:caseIgnoreOrderingMatch '(cn=3Dccc*)' cn'<b= r&gt;&gt; (&amp;(objectClass=3DinetOrgPerson)(cn=3Dccc*))' -H ldap://IP:389 = -b<br&gt;&gt; &quot;ou=3DUsers,dc=3Dopenstack,dc=3Dorg&quot; -D &quot;c3D3Daaa1,= ou=3DUsers,dc=3Dopenstack,dc=3Dorg&quot; -x<br&gt;&gt; -W<br&gt;&gt; # extended LDIF<br&gt;&gt; #<br&gt;&gt; # LDAPv3<br&gt;&gt; # base &lt;ou=3DUsers,dc=3Dopenstack,dc=3Dorg&gt; with scope subtr= ee<br&gt;&gt; # filter: (cn=3Dccc*)<br&gt;&gt; # requesting: cn (&amp;(objectClass=3DinetOrgPerson)(cn=3Dccc*))<b= r&gt;&gt; # with server side sorting control<br&gt;&gt; #<br&gt;&gt;<br&gt;&gt; # ccc0, Users, openstack.org<br&gt;&gt; dn: cn=3Dccc0,ou=3DUsers,dc=3Dopenstack,dc=3Dorg<br&gt;&gt; # search result<br&gt;&gt; search: 2<br&gt;&gt; result: 0 Success<br&gt;&gt; control: 1.2.840.113556.1.4.474 false MAMKAQA=3D<br&gt;&gt; sortResult: (0) Success<br&gt;&gt;<br&gt;&gt;<br&gt;&gt; however the RFC states that the orderingRule is OPTIONAL as below:= <br&gt;&gt;<br&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SortKeyList ::=3D SEQUENCE OF = SEQUENCE {<br&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&= nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; attributeType&nbsp;&nbsp; AttributeDesc= ription,<br&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&= nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; orderingRule&nbsp;&nbsp;&nbsp; [0] Matc= hingRuleId OPTIONAL,<br&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&= nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; reverseOrder&nbsp;&nbsp;&nbsp; [1] BOOL= EAN DEFAULT FALSE }<br&gt;&gt;<br&gt;&gt; however openldap fails to return entries.<br&gt;<br&gt; The rule is optional in the control itself, but a valid ordering rule = must<br&gt; exist somewhere. Since the attribute schema doesn't define one then yo= u must<br&gt; provide one yourself.<br&gt;<br&gt; Closing this ITS.<br&gt;<br&gt; --<br&gt;&nbsp;&nbsp;&nbsp; -- Howard Chu<br&gt;&nbsp;&nbsp;&nbsp; CTO, Symas Corp.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;= &nbsp;&nbsp;&nbsp;&nbsp; <a href=3D"http://www.symas.com">http://www.symas.= com</a><br&gt;&nbsp;&nbsp;&nbsp; Director, Highland Sun&nbsp;&nbsp;&nbsp;&nbsp; <a hr= ef=3D"http://highlandsun.com/hyc/">http://highlandsun.com/hy...&gt;&nbsp;&nbsp;&nbsp; Chief Architect, OpenLDAP&nbsp; <a href=3D"http://ww= w.openldap.org/project/">http://www.openldap.org/project/</a&g...<br<br-- <br&nbsp;&nbsp; -- Howard Chu<br&nbsp;&nbsp; CTO, Symas Corp.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs= p;&nbsp;&nbsp; <a href=3D"http://www.symas.com">http://www.symas.com</a><br= &nbsp;&nbsp; Director, Highland Sun&nbsp;&nbsp;&nbsp;&nbsp; <a href=3D"http= ://highlandsun.com/hyc/">http://highlandsun.com/hyc/</a><br&nbsp;&nbsp; Chief Architect, OpenLDAP&nbsp; <a href=3D"http://www.openldap= .org/project/">http://www.openldap.org/project/</a><br</div</span></font</body</html --_000_AM4PR0101MB19549BBC7F2AB2947F4C5505BBF10AM4PR0101MB1954_--