Back to bug 1387022

Who When What Removed Added
Noriko Hosoi 2016-10-20 01:58:49 UTC Assignee nhosoi mreynolds
Noriko Hosoi 2016-10-20 02:48:28 UTC CC nhosoi
Noriko Hosoi 2016-10-27 21:20:29 UTC Status NEW POST
Doc Text Cause: Setting the server "size limit" to a very low value

Consequence: When evaluating a group ACI, if the number of matching members exceeds the server size limit
Doc Text , the access is incorrectly denied.

Fix: Do not use the server size limit for ACI group evaluation

Result: Regardless of the number of entries in a group, or server size limit, the group ACI is fully evaluated.
Doc Type If docs needed, set a value Bug Fix
Status POST MODIFIED
Fixed In Version 389-ds-base-1.2.11.15-84.el6
errata-xmlrpc 2016-10-27 21:26:53 UTC Status MODIFIED ON_QA
Simon Pichugin 2016-11-25 13:10:26 UTC Status ON_QA VERIFIED
CC spichugi
Marc Muehlfeld 2017-01-11 17:20:18 UTC Docs Contact mmuehlfe
Marc Muehlfeld 2017-01-19 07:46:05 UTC CC mreynolds
Doc Text Cause: Setting the server "size limit" to a very low value

Consequence: When evaluating a group ACI, if the number of matching members exceeds the server size limit, the access is incorrectly denied.

Fix: Do not use the server size limit for ACI group evaluation

Result: Regardless of the number of entries in a group, or server size limit, the group ACI is fully evaluated.
Group ACIs are now correctly evaluated

Previously, if the number of members in a group in an access control instruction (ACI) exceeded the size limit of the result of the query, Directory Server incorrectly denied access. To fix the problem, the server size limit is no longer applied to the ACI group evaluation, and queries now operate correctly.
Flags needinfo?(mreynolds)
errata-xmlrpc 2017-03-21 00:56:14 UTC Flags needinfo?(mreynolds)
Status VERIFIED RELEASE_PENDING
errata-xmlrpc 2017-03-21 10:23:34 UTC Status RELEASE_PENDING CLOSED
Resolution --- ERRATA
Last Closed 2017-03-21 06:23:34 UTC
Marc Sauton 2017-08-30 23:36:05 UTC CC msauton
Simon Pichugin 2020-09-13 20:56:53 UTC Link ID Github 389ds/389-ds-base/issues/1038

Back to bug 1387022