New subject: [Bug 9204] slapo-constraint allows anyone to apply Relax control

6 Apr 2020


      https://bugs.openldap.org/show_bug.cgi?id=9204
Bug ID: 9204
           Summary: slapo-constraint allows anyone to apply Relax control
           Product: OpenLDAP
           Version: 2.4.49
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: ---
         Component: overlays
          Assignee: bugs@openldap.org
          Reporter: ryan@openldap.org
  Target Milestone: ---
slapo-constraint doesn't limit who can use the Relax control, beyond the global
limits applied by slapd. In practice, for many modifications this means any
configured constraints are advisory only.
In my opinion this should be considered a bug, in design if not implementation.
I expect many admins would not read the man page closely enough to realize the
behaviour does technically adhere to the letter of what's written there.
Either slapd should require manage privileges for the Relax control globally,
or slapo-constraint should perform a check for manage privilege itself, like
slapo-unique does.
Quoting ando in https://bugs.openldap.org/show_bug.cgi?id=5705#c4:
...
Well, a user with "manage" privileges on related data could bypass 
constraints enforced by slapo-constraint(5) by using the "relax" 
control.  The rationale is that a user with manage privileges could be 
able to repair an entry that needs to violate a constraint for good 
reasons.  Note that the user:

must have enough privileges to do it (manage)

must inform the DSA that intends to violate the constraint (by using


the control)
but such privileges are currently not being required.
-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 9204] New: slapo-constraint allows anyone to apply Relax control