URL: https://github.com/freeipa/freeipa/pull/6015 Author: rcritten Title: #6015: Don't store entries with a usercertificate in the LDAP cache Action: opened
PR body: """ Don't store entries with a usercertificate in the LDAP cache
usercertificate often has a subclass and both the plain and subclassed (binary) values are queried. I'm concerned that they are used more or less interchangably in places so not caching these entries is the safest path forward for now until we can dedicate the time to find all usages, determine their safety and/or perhaps handle this gracefully within the cache now.
What we see in this bug is that usercertificate;binary holds the first certificate value but a user-mod is done with setattr usercertificate=<new_cert>. Since there is no usercertificate value (remember, it's usercertificate;binary) a replace is done and 389-ds wipes the existing value as we've asked it to.
I'm not comfortable with simply treating them the same because in LDAP they are not.
https://pagure.io/freeipa/issue/8986
Signed-off-by: Rob Crittenden rcritten@redhat.com """
To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6015/head:pr6015 git checkout pr6015
URL: https://github.com/freeipa/freeipa/pull/6015 Author: rcritten Title: #6015: Don't store entries with a usercertificate in the LDAP cache Action: closed
To pull the PR as Git branch: git remote add ghfreeipa https://github.com/freeipa/freeipa git fetch ghfreeipa pull/6015/head:pr6015 git checkout pr6015
freeipa-devel@lists.fedorahosted.org