[SSSD] [PATCH] SDAP: Deref needn't be treated as critical

Lukas Slebodnik lslebodn at redhat.com
Wed Aug 13 13:57:15 UTC 2014


On (13/08/14 10:38), Jakub Hrozek wrote:
>On Wed, Aug 13, 2014 at 10:27:23AM +0200, Lukas Slebodnik wrote:
>> On (13/08/14 10:03), Jakub Hrozek wrote:
>> >On Mon, Aug 11, 2014 at 07:39:29AM +0200, Lukas Slebodnik wrote:
>> >> On (09/08/14 23:05), Simo Sorce wrote:
>> >> >On Sat, 2014-08-09 at 11:54 +0200, Jakub Hrozek wrote:
>> >> >> On Fri, Aug 08, 2014 at 01:08:54PM +0200, Lukas Slebodnik wrote:
>> >> >> > ehlo,
>> >> >> >
>> >> >> > The command line utility ldapsearch does not set option LDAP_CONTROL_X_DEREF as
>> >> >> > critical.
>> >> >> >
>> >> >> > sssd performes similar ldap search as following command:
>> >> >> >   sh-4.2$ ldapsearch -x -LLL -h 172.17.0.7 \
>> >> >> >            -b 'cn=ref_grp1,ou=group,dc=example,dc=com'
>> >> >> >            -E '!deref=member:objectClass,cn,userPassword,gidNumber,member,modify
>> >> >> > Timestamp,modifyTimestamp,uid' \
>> >> >> >             objectClass,cn,userPassword,gidNumber,member,modifyTimestamp,modifyT
>> >> >> > imestamp,uid
>> >> >> > Critical extension is unavailable (12)
>> >> >> > Additional information: critical control unavailable in context
>> >> >> >
>> >> >> > The most important is "exclamation mark" before extensions. It indicates
>> >> >> > criticality. This caused problem when openldap server was older
>> >> >> > openldap-2.4.23-34.el6. Dereference is performed successfully if extension is
>> >> >> > not critical:  -E 'deref=member:objectClass ...
>> >> >> >
>> >> >> > Resolves:
>> >> >> > https://fedorahosted.org/sssd/ticket/2383
>> >> >> >
>> >> >> > oneliner is attached.
>> >> >> >
>> >> >> > LS
>> >> >>
>> >> >> The patch looks good and was confirmed to work by our QE. Also works
>> >> >> fine with my local tests (389-ds-base-1.3.2.16-1.fc20.x86_64 and
>> >> >> openldap-2.4.39-3.fc20.x86_64)
>> >> >
>> >> >And what happens if the server does not give you back the control when
>> >> >it return the results but performs a normal search ?
>> >> >
>> >> If the critical flag is enabled dereferencing will failed and individual
>> >> lookups will be performed on the group.
>> >> 
>> >> This is only problem with old version of openldap (2.4.23-32). The critical
>> >> flag works well with openldap-servers-2.4.39.
>> >> 
>> >> >The reason why the control is marked critical, IIRC, is that we expect
>> >> >to get it back on reply, or it should fail.
>> >> >
>> >> >Shouldn't we rather leave the criticality bit and handle the error (by
>> >> >downgrading to not use deref controls) if the server fails ?
>> >> >
>> >> We do with current master.
>> >> 
>> >> >Simo.
>> >> >
>> >> The surprising is that dereferencing is performed without flag: critical
>> >> 
>> >> $ ldapsearch -x -LLL -h 172.17.0.7 -b 'dc=example,dc=com' -E 'deref=member:uid' cn=ref_grp1
>> >>                                        //                    ^^^
>> >>                                        // As you can see there isn't flag: '!'
>> >> dn: cn=ref_grp1,ou=group,dc=example,dc=com
>> >> # member: <uid=drefuser1>;uid=drefuser1,dc=example,dc=com
>> >> 
>> >> # member: <uid=drefuser2>;uid=drefuser2,dc=example,dc=com
>> >> 
>> >> # member: <uid=drefuser3>;uid=drefuser3,dc=example,dc=com
>> >> 
>> >> objectClass: extensibleObject
>> >> objectClass: groupOfNames
>> >> gidNumber: 10001
>> >> cn: ref_grp1
>> >> member: uid=drefuser1,dc=example,dc=com
>> >> member: uid=drefuser2,dc=example,dc=com
>> >> member: uid=drefuser3,dc=example,dc=com
>> >> 
>> >> LS
>> >
>> >After some more discussion on #sssd, we decided that it would be best to
>> >try dereference with criticality flag and if it fails, disable
>> >dereference altogether.
>> What do you mean by disable dereference altogether?
>
>Same effect as setting ldap_deref_threshold=0
>
>> 
>> >
>> >Do I remember the conversation right?
>> >
>> >Lukas, do you agree and can you prepare a patch?
>> I think we will need just to revert patch from this thread.
>
>What about the problem our QE was seeing with old openldap servers,
>then? Shouldn't we handle it gracefully?

The only problem with old openldap is that deref *DOES NOT* work with critical
flag, but on the other hand sssd returns correct result.
This is a behaviour of sssd master with reverted patch from this thread.

sh-4.2$ getent group -s sss ref_grp1; echo $?
ref_grp1:*:10001:drefuser1,drefuser2,drefuser3,drefuser4,drefuser5,drefuser6,drefuser7,drefuser8,drefuser9,drefuser10,drefuser11,drefuser12
0

and coresponding log files.
[be_get_account_info] (0x0100): Got request for [4098][1][name=ref_grp1]
[be_req_set_domain] (0x0400): Changing request domain from [refLDAP] to [refLDAP]
[sdap_get_groups_next_base] (0x0400): Searching for groups with base [dc=example,dc=com]
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(cn=ref_grp1)(objectclass=groupOfNames)(cn=*)(&(gidNumber=*)(!(gidNum

[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_groups_process] (0x0400): Search for groups, returned 1 results.
[sdap_has_deref_support] (0x0400): The server supports deref method OpenLDAP
[sdap_x_deref_search_send] (0x0400): Dereferencing entry [cn=ref_grp1,ou=group,dc=example,dc=com] using OpenLDAP deref
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [no filter][cn=ref_grp1,ou=group,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Critical extension is unavailable(12), critical control unavailable in context
[sdap_get_generic_done] (0x0100): sdap_get_generic_ext_recv failed [95]: Operation not supported
[sdap_deref_search_done] (0x0040): dereference processing failed [95]: Operation not supported
[sdap_nested_group_deref_direct_done] (0x0020): Error processing direct membership [95]: Operation not supported
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=posixAccount)][uid=drefuser1,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=posixAccount)][uid=drefuser2,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=posixAccount)][uid=drefuser3,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=posixAccount)][uid=drefuser4,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=posixAccount)][uid=drefuser5,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=posixAccount)][uid=drefuser6,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=posixAccount)][uid=drefuser7,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=posixAccount)][uid=drefuser8,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=posixAccount)][uid=drefuser9,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=posixAccount)][uid=drefuser10,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=posixAccount)][uid=drefuser11,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(objectclass=posixAccount)][uid=drefuser12,dc=example,dc=com].
[sdap_get_generic_ext_done] (0x0400): Search result: Success(0), no errmsg set
[sdap_nested_group_recv] (0x0400): 12 users found in the hash table
[sdap_nested_group_recv] (0x0400): 1 groups found in the hash table

LS



More information about the sssd-devel mailing list