Full_Name: Arvid Requate Version: 2.4.35 OS: Debian / UCS URL: http://apt.univention.de/download/temp/openldap/ Submission from: (NULL) (82.198.197.8)

After adjusting a matching rule of an attribute ldapsearch for existing attribute values returns unexpected results. As an example the log file and the script provided in the URL show what happened:

A) Start with the normal inetorgperson.schema.

1. create a inetOrgPerson object with and uppercase string in "carLicense" 2. search for the attributes in with different filters (normal and extensive matching) 3. change the EQUALITY matching rule for that attribute from caseIgnoreMatch to caseExactMatch (either in slapd.conf and restart or in cn=config without restart). 4. search again.

Expected result A.1: the normal search for the uppercase value should return the value The log file shows: the search for the uppercase value returns no result

Expected result A.2: the normal search for the lowercase value should return no result The log file shows: the search for the lowercase value returns a result

The same holds for the extensible :caseExactMatch: search.

B) The second, morempreressive, inverse test shows that this behaviour depends on the matching rule that was in place at the time the obejct gets created:

Starting now with a caseExactMatch EQUALITY matching rule for "carLicense" I repeat the test above:

1. create a inetOrgPerson object with and uppercase string in "carLicense" 2. search for the attributes in with different filters (normal and extensive matching) 3. change the EQUALITY matching rule for that attribute from caseExactMatch to caseIgnoreMatch (either in slapd.conf and restart or in cn=config without restart). 4. search again.

Expected result B.1: the normal search for the uppercase value should return the value The log file shows: the search for the uppercase value returns no result

Expected result B.2: the normal search for the lowercase value should return the value The log file shows: the search for the lowercase value returns no result

Expected result B.3: the :caseIgnoreMatch: extensible filter should find the value The log file shows: the search for the lowerca v value returns no result

The provided shell script works by changing the schema directly via cn=config, but the same results can be found when using static configuration+schema files and restarting slapd after each schema modification.

No index was configured for the "carLicense" attribute and a bdb backend was used. See the cn=config.ldif provided.