#47757 Unable to dereference unqiemember attribute because it is dn [#UID] not dn syntax
Closed: Fixed None Opened 5 years ago by jvaughn.

We've had problems with SSSD being slow sometimes, but not others (probably only slow whenver it's caches expired?), and there never seemed to be any obvious cause why, but I think I've tracked it down to problems with dereferencing. We do see errors about dereferencing in the log, but I didn't realize until now what it was referring to - due to how our SSD configuration sections were named, I thought it was a Kerberos issue for a long time...

In theory, a search like this should give us the cn and objectclass of all members of the group, but I get only the attributes of the group itself. Whether I give the "-E 'deref=...'" or not I get the same output. Redacted output below:

ldapsearch [bind username and password stuff, etc] -E 'deref=uniqueMember:cn,objectclass' 'cn=Global System Administrators'
# extended LDIF
#
# LDAPv3
# base <[our base DN]> (default) with scope subtree
# filter: cn=Global System Administrators
# requesting: ALL
# with dereference control
#

# Global System Administrators, Groups, [our base DN]
dn: cn=Global System Administrators,ou=Groups,[our base DN]
control: 1.3.6.1.4.1.4203.666.5.16 false MIQAAAAA
uniqueMember: uid=user1,ou=Users,ou=[Office1],[our base DN]
uniqueMember: uid=user2,ou=Users,ou=[Office2],[our base DN]
uniqueMember: uid=user3,ou=Users,ou=[Office2],[our base DN]
uniqueMember: uid=user4,ou=Users,ou=[Office1],[our base DN]
objectClass: top
objectClass: groupofuniquenames
objectClass: posixgroup
cn: Global System Administrators
gidNumber: 1001002
description: Global System Administrators

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

I posted this to the 389-ds-user-list and Ludwig Krispenz responded and said I should open a ticket, and that if we had performed the query with the control specified as critical "-E '!deref=....' we would get an error the the deref attr needs to be of dn syntax. I did try that, and indeed, it said "A dereference attribute must have DN syntax". Per Ludwig Krispenz, "in 389 ds uniquemember is specified as 'Name and Optional UID' syntax, which is dn [#UID], but the deref plugin just checks for dn syntax."


no cloning, upstream tests can cover this.

I have tested without and with the patch and can confirm that it corrects the behaviour for the query with "-E 'deref=uniqueMember:cn,objectclass'".

Reviewed by Mark (Thanks!!)

Pushed to master:
5fe2892..2dbbb9d master -> master
commit 2dbbb9d

Pushed to 389-ds-base-1.3.4:
19b0d4a..626f2d7 389-ds-base-1.3.4 -> 389-ds-base-1.3.4
commit 626f2d7

Metadata Update from @nhosoi:
- Issue assigned to lkrispen
- Issue set to the milestone: 1.3.4 backlog

2 years ago

Login to comment on this ticket.

Metadata