#47853 client hangs in add if memberof fails
Closed: Fixed None Opened 5 years ago by lkrispen.

If memberof plugin is enabled and the client adds an entry with a membership attr it hangs if the memberof_postop_add rejects the operation

This seems to be a regression introduced by fix 47810.

Steps to reproduce:
1] enable memberof plugin (use memberof and uniquemember )

2] add a group A
dn: cn=group_sub_A,ou=groups,ou=sub2,ou=suffix_active,dc=example,dc=com
objectClass: groupofuniquenames
objectClass: top
uniqueMember: uid=user.5010,ou=people,ou=suffix_active,dc=example,dc=com

3] add a group B with group A as member, note that objectclass groupofuniquenames does not allow memberof
dn: cn=group_sub_X,ou=groups,ou=sub2,ou=suffix_active,dc=example,dc=com
changetype: add
objectClass: groupofuniquenames
uniqueMember: cn=group_sub_A,ou=groups,ou=sub2,ou=suffix_active,dc=example,dc=com


  • the ldapmodify client now hangs
  • error log contains

[11/Jul/2014:09:38:39 +0200] - Entry "cn=xx_01,ou=People,dc=example,dc=com" -- attribute "memberOf" not allowed
[11/Jul/2014:09:38:39 +0200] memberof-plugin - memberof_postop_add: failed to add dn(cn=group_sub_X,ou=groups,ou=sub2,ou=suffix_active,dc=example,dc=com), error (-1)

  • access log contains

[11/Jul/2014:09:38:39 +0200] conn=30 op=1 ADD dn="cn=group_sub_X,ou=groups,ou=sub2,ou=suffix_active,dc=example,dc=com"
[11/Jul/2014:09:38:39 +0200] conn=Internal op=-1 RESULT err=0 tag=48 nentries=1 etime=0

  • in the DS the add operation is no longer existing, verified with gdb

Looks like DS does finish/abort the operation due to the error in memberof, but does not send a result to the client

Since it's a regression introduced by #47810, setting the priority to 1.3.3 (August).

I can not reproduce the problem on master branch:

I tried this:

dn: cn=group,dc=example,dc=com
changetype: add
objectclass: top
objectclass: groupofuniquenames
cn: group
uniquemember: cn=directory administrators, dc=example,dc=com

adding new entry "cn=group,dc=example,dc=com"
ldap_add: Object class violation (65)

[14/Jul/2014:15:18:42 -0400] - Entry "cn=Directory Administrators,dc=example,dc=com" -- attribute "memberOf" not allowed
[14/Jul/2014:15:18:42 -0400] memberof-plugin - memberof_postop_add: failed to add dn(cn=group,dc=example,dc=com), error (65)

Then I tried (after creating cn=group):

dn: cn=directory administrators, dc=example,dc=com
changetype: modify
add: uniquemember
uniquemember: cn=group,dc=example,dc=com

modifying entry "cn=directory administrators, dc=example,dc=com"
ldap_modify: Object class violation (65)

[14/Jul/2014:15:11:12 -0400] - Entry "cn=group,dc=example,dc=com" -- attribute "memberOf" not allowed
[14/Jul/2014:15:11:13 -0400] memberof-plugin - memberof_postop_modify: failed to add dn (cn=directory administrators,dc=example,dc=com) to target. Error (65)

ldapmodify does not hang in either case, and everything looks correct.

You get an error -1, while I get an error 65. Are there other steps missing to reproduce this, other plugins that need to be configured/enabled?

You're right, if I try with new groups I always get err=65, in my testcase I had some entries existing before enabling memberof.
I can still reproduce with the following steps:

  • import attached memberof.ldif

  • try to add a new group

dn: cn=Z,ou=groups,dc=example,dc=com
changetype: add
objectClass: top
objectClass: groupofuniquenames
uniquemember: cn=Y,ou=groups,dc=example,dc=com

then I get err=-1 and the hang:
- Entry "cn=X,ou=groups,dc=example,dc=com" -- attribute "memberOf" not allowed
[15/Jul/2014:09:28:15 +0200] memberof-plugin - memberof_postop_add: failed to add dn(cn=Z,ou=groups,dc=example,dc=com), error (-1)

I was able to reproduce the hang with the ldif provided. Issue was an invalid error code being set in the pblock, patch attached.

git merge ticket47853
Updating 238d8fe..41f984c
ldap/servers/plugins/memberof/memberof.c | 5 ++---

git push origin master
238d8fe..41f984c master -> master

commit 41f984c
Author: Mark Reynolds mreynolds@redhat.com
Date: Tue Jul 15 10:46:09 2014 -0400

Added missing newline characters

41f984c..068ee18 master -> master
commit 068ee18

Metadata Update from @nhosoi:
- Issue assigned to mreynolds
- Issue set to the milestone: 1.3.3 - 8/14 (August)

3 years ago

Login to comment on this ticket.