Bug 1118021

Summary:	[RFE] Don't return all attributes in rootdse without explicit request
Product:	Red Hat Enterprise Linux 7	Reporter:	Noriko Hosoi <nhosoi>
Component:	389-ds-base	Assignee:	Noriko Hosoi <nhosoi>
Status:	CLOSED ERRATA	QA Contact:	Viktor Ashirov <vashirov>
Severity:	unspecified	Docs Contact:	Aneta Šteflová Petrová <apetrova>
Priority:	medium
Version:	7.0	CC:	lkrispen, nkinder, rmeggins, tcapek
Target Milestone:	rc	Keywords:	FutureFeature
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	389-ds-base-1.3.3.1-1.el7	Doc Type:	Enhancement
Doc Text:	Root DSE searches no longer display operational attributes by default Running the ldapsearch utility with the '-s base -b ""' options now displays only the user attributes and not the operational attributes. Previously, a root DSE search displayed all attributes by default. To ensure compatibility with earlier versions, this update adds the "nsslapd-return-default-opattr" attribute to the root DSE. You can modify the new default behavior by setting "nsslapd-return-default-opattr" in the dse.ldif configuration file as follows: dn: nsslapd-return-default-opattr: supportedsaslmechanisms nsslapd-return-default-opattr: nsBackendSuffix nsslapd-return-default-opattr: subschemasubentry nsslapd-return-default-opattr: supportedldapversion nsslapd-return-default-opattr: supportedcontrol nsslapd-return-default-opattr: ref nsslapd-return-default-opattr: vendorname nsslapd-return-default-opattr: vendorVersion nsslapd-return-default-opattr: namingcontexts nsslapd-return-default-opattr: supportedextension With this configuration, running the ldapsearch utility with '-s base -b ""' displays all attributes by default.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-03-05 09:37:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1185113

Description Noriko Hosoi 2014-07-09 21:10:46 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/47761

A recent change in schema parsing ahd the side effect of changing the behavior of rootdse so that now it does not return all atributes by default.
Although this is more standards complaint it may break clients that are primarily tested against Active Directory.

In FreeIPA we feel we need a way to change the behavior through a cn=config option so that we can return to the old behavior and return all attributes that were previously returned (but not things like modifyTimestamps and such).

Comment 3 Ludwig 2014-10-23 13:40:38 UTC

Operational attributes are no longer returned by default in rootDSE searches.
verify by 
ldapsearch ... -b "" -s base

and check that operational attributes like supportedcontrol or namincontexts are not returned.

To change default behaviour modify the rootDSE entry "dn: "

ldapmodify
dn: 
changetype: modify
add:nsslapd-return-default-opattr
nsslapd-return-default-opattr: namingContexts
nsslapd-return-default-opattr:supportedControl

repeat the above search

Comment 4 Sankar Ramalingam 2014-11-20 11:39:13 UTC

[root@vm-idm-035 MMR_WINSYNC]# ldapsearch -p 1189 -h localhost -D "cn=Directory Manager" -w Secret123 -b "" -s base
dn:
objectClass: top
defaultnamingcontext: dc=example,dc=com
dataversion: 020141120112723020141120112723
netscapemdsuffix: cn=ldap://dc=vm-idm-035,dc=lab,dc=eng,dc=pnq,dc=redhat,dc=co
 m:1189

[root@vm-idm-035 MMR_WINSYNC]# ldapmodify -p 1189 -h localhost -D "cn=Directory Manager" -w Secret123 << EOF
dn:
changetype: modify
add:nsslapd-return-default-opattr
nsslapd-return-default-opattr: namingContexts
nsslapd-return-default-opattr:supportedControl
EOF

modifying entry ""

[root@vm-idm-035 MMR_WINSYNC]# ldapsearch -p 1189 -h localhost -D "cn=Directory Manager" -w Secret123 -b "" -s base

dn:
objectClass: top
namingContexts: dc=example,dc=com
namingContexts: dc=passsync,dc=com
defaultnamingcontext: dc=example,dc=com
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4

SupportedControl and naminContexts information is not shown default. After adding "nsslapd-return-default-opattr" attribute, the ldapsearch shows the values for SupportedControl and naminContexts. Hence, marking the bug as Verified.

Build tested:
[root@vm-idm-035 MMR_WINSYNC]# rpm -qa 389-ds-base
389-ds-base-1.3.3.1-9.el7.x86_64

Comment 5 Sankar Ramalingam 2014-11-24 16:57:50 UTC

Changed the bug summary since the feature is actually to deny all rootdse attributes by default. You need to explicitly request or modify this attribute "nsslapd-return-default-opattr" to view rootdse entries.

Comment 7 errata-xmlrpc 2015-03-05 09:37:04 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0416.html