[SSSD] [PATCH] SDAP: Deref needn't be treated as critical

Jakub Hrozek jhrozek at redhat.com
Sat Aug 9 09:54:11 UTC 2014


On Fri, Aug 08, 2014 at 01:08:54PM +0200, Lukas Slebodnik wrote:
> ehlo,
> 
> The command line utility ldapsearch does not set option LDAP_CONTROL_X_DEREF as
> critical.
> 
> sssd performes similar ldap search as following command:
>   sh-4.2$ ldapsearch -x -LLL -h 172.17.0.7 \
>            -b 'cn=ref_grp1,ou=qagroup,dc=example,dc=com'
>            -E '!deref=member:objectClass,cn,userPassword,gidNumber,member,modify
> Timestamp,modifyTimestamp,uid' \
>             objectClass,cn,userPassword,gidNumber,member,modifyTimestamp,modifyT
> imestamp,uid
> Critical extension is unavailable (12)
> Additional information: critical control unavailable in context
> 
> The most important is "exclamation mark" before extensions. It indicates
> criticality. This caused problem when openldap server was older
> openldap-2.4.23-34.el6. Dereference is performed successfully if extension is
> not critical:  -E 'deref=member:objectClass ...
> 
> Resolves:
> https://fedorahosted.org/sssd/ticket/2383
> 
> oneliner is attached.
> 
> LS

The patch looks good and was confirmed to work by our QE. Also works
fine with my local tests (389-ds-base-1.3.2.16-1.fc20.x86_64 and
openldap-2.4.39-3.fc20.x86_64)



More information about the sssd-devel mailing list