On (13/08/14 10:38), Jakub Hrozek wrote:
On Wed, Aug 13, 2014 at 10:27:23AM +0200, Lukas Slebodnik wrote:
> On (13/08/14 10:03), Jakub Hrozek wrote:
> >On Mon, Aug 11, 2014 at 07:39:29AM +0200, Lukas Slebodnik wrote:
> >> On (09/08/14 23:05), Simo Sorce wrote:
> >> >On Sat, 2014-08-09 at 11:54 +0200, Jakub Hrozek wrote:
> >> >> On Fri, Aug 08, 2014 at 01:08:54PM +0200, Lukas Slebodnik wrote:
> >> >> > ehlo,
> >> >> >
> >> >> > The command line utility ldapsearch does not set option
LDAP_CONTROL_X_DEREF as
> >> >> > critical.
> >> >> >
> >> >> > sssd performes similar ldap search as following command:
> >> >> > sh-4.2$ ldapsearch -x -LLL -h 172.17.0.7 \
> >> >> > -b
'cn=ref_grp1,ou=group,dc=example,dc=com'
> >> >> > -E
'!deref=member:objectClass,cn,userPassword,gidNumber,member,modify
> >> >> > Timestamp,modifyTimestamp,uid' \
> >> >> >
objectClass,cn,userPassword,gidNumber,member,modifyTimestamp,modifyT
> >> >> > imestamp,uid
> >> >> > Critical extension is unavailable (12)
> >> >> > Additional information: critical control unavailable in
context
> >> >> >
> >> >> > The most important is "exclamation mark" before
extensions. It indicates
> >> >> > criticality. This caused problem when openldap server was
older
> >> >> > openldap-2.4.23-34.el6. Dereference is performed successfully
if extension is
> >> >> > not critical: -E 'deref=member:objectClass ...
> >> >> >
> >> >> > Resolves:
> >> >> >
https://fedorahosted.org/sssd/ticket/2383
> >> >> >
> >> >> > oneliner is attached.
> >> >> >
> >> >> > LS
> >> >>
> >> >> The patch looks good and was confirmed to work by our QE. Also
works
> >> >> fine with my local tests (389-ds-base-1.3.2.16-1.fc20.x86_64 and
> >> >> openldap-2.4.39-3.fc20.x86_64)
> >> >
> >> >And what happens if the server does not give you back the control when
> >> >it return the results but performs a normal search ?
> >> >
> >> If the critical flag is enabled dereferencing will failed and individual
> >> lookups will be performed on the group.
> >>
> >> This is only problem with old version of openldap (2.4.23-32). The critical
> >> flag works well with openldap-servers-2.4.39.
> >>
> >> >The reason why the control is marked critical, IIRC, is that we expect
> >> >to get it back on reply, or it should fail.
> >> >
> >> >Shouldn't we rather leave the criticality bit and handle the error
(by
> >> >downgrading to not use deref controls) if the server fails ?
> >> >
> >> We do with current master.
> >>
> >> >Simo.
> >> >
> >> The surprising is that dereferencing is performed without flag: critical
> >>
> >> $ ldapsearch -x -LLL -h 172.17.0.7 -b 'dc=example,dc=com' -E
'deref=member:uid' cn=ref_grp1
> >> // ^^^
> >> // As you can see there isn't
flag: '!'
> >> dn: cn=ref_grp1,ou=group,dc=example,dc=com
> >> # member: <uid=drefuser1>;uid=drefuser1,dc=example,dc=com
> >>
> >> # member: <uid=drefuser2>;uid=drefuser2,dc=example,dc=com
> >>
> >> # member: <uid=drefuser3>;uid=drefuser3,dc=example,dc=com
> >>
> >> objectClass: extensibleObject
> >> objectClass: groupOfNames
> >> gidNumber: 10001
> >> cn: ref_grp1
> >> member: uid=drefuser1,dc=example,dc=com
> >> member: uid=drefuser2,dc=example,dc=com
> >> member: uid=drefuser3,dc=example,dc=com
> >>
> >> LS
> >
> >After some more discussion on #sssd, we decided that it would be best to
> >try dereference with criticality flag and if it fails, disable
> >dereference altogether.
> What do you mean by disable dereference altogether?
Same effect as setting ldap_deref_threshold=0
>
> >
> >Do I remember the conversation right?
> >
> >Lukas, do you agree and can you prepare a patch?
> I think we will need just to revert patch from this thread.
What about the problem our QE was seeing with old openldap servers,
then? Shouldn't we handle it gracefully?
The only problem with old openldap is that deref *DOES NOT* work with critical
flag, but on the other hand sssd returns correct result.
This is a behaviour of sssd master with reverted patch from this thread.
sh-4.2$ getent group -s sss ref_grp1; echo $?
ref_grp1:*:10001:drefuser1,drefuser2,drefuser3,drefuser4,drefuser5,drefuser6,drefuser7,drefuser8,drefuser9,drefuser10,drefuser11,drefuser12
0
and coresponding log files.
[be_get_account_info] (0x0100): Got request for [4098][1][name=ref_grp1]
[be_req_set_domain] (0x0400): Changing request domain from [refLDAP] to [refLDAP]
[sdap_get_groups_next_base] (0x0400): Searching for groups with base [dc=example,dc=com]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(&(cn=ref_grp1)(objectclass=groupOfNames)(cn=*)(&(gidNumber=*)(!(gidNum
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_groups_process] (0x0400): Search for groups, returned 1 results.
[sdap_has_deref_support] (0x0400): The server supports deref method OpenLDAP
[sdap_x_deref_search_send] (0x0400): Dereferencing entry
[cn=ref_grp1,ou=group,dc=example,dc=com] using OpenLDAP deref
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [no
filter][cn=ref_grp1,ou=group,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Critical extension is
unavailable(12), critical control unavailable in context
[sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [95]: Operation not
supported
[sdap_deref_search_done] (0x0040): dereference processing failed [95]: Operation not
supported
[sdap_nested_group_deref_direct_done] (0x0020): Error processing direct membership [95]:
Operation not supported
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(objectclass=posixAccount)][uid=drefuser1,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(objectclass=posixAccount)][uid=drefuser2,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(objectclass=posixAccount)][uid=drefuser3,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(objectclass=posixAccount)][uid=drefuser4,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(objectclass=posixAccount)][uid=drefuser5,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(objectclass=posixAccount)][uid=drefuser6,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(objectclass=posixAccount)][uid=drefuser7,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(objectclass=posixAccount)][uid=drefuser8,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(objectclass=posixAccount)][uid=drefuser9,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(objectclass=posixAccount)][uid=drefuser10,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(objectclass=posixAccount)][uid=drefuser11,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with
[(objectclass=posixAccount)][uid=drefuser12,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_nested_group_recv] (0x0400): 12 users found in the hash table
[sdap_nested_group_recv] (0x0400): 1 groups found in the hash table
LS