Bug 1210852

Summary:	aci with wildcard and macro not correctly evaluated
Product:	Red Hat Enterprise Linux 7	Reporter:	Noriko Hosoi <nhosoi>
Component:	389-ds-base	Assignee:	Noriko Hosoi <nhosoi>
Status:	CLOSED ERRATA	QA Contact:	Viktor Ashirov <vashirov>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.0	CC:	amsharma, lkrispen, nhosoi, nkinder, rmeggins
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	389-ds-base-1.3.4.0-1.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-11-19 11:43:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Noriko Hosoi 2015-04-10 17:46:14 UTC

The following aci

aci: (target="ldap:///cn=*/($dn),cn=services,cn=test,dc=example,dc=com")(version 3.0; acl "allow dding of own services"; allow (all) userdn = "ldap:///uid=($dn),ou=People,dc=example,dc=com";)

fails to match the resource cn=test/uid.xxxx,cn=services,cn=test,dc=example,dc=com

Need to investigate if this is expected behaviour or a bug

Comment 3 Noriko Hosoi 2015-08-31 16:38:16 UTC

Hi Ami,

Ludwig would be able to give you deeper insights, but ...
. this target in the aci did not work, which is fixed.
  target="ldap:///cn=*/($dn),cn=services,cn=test,dc=example,dc=com"

Please note that this target was working fine prior to the fix.
  target="ldap:///cn=*,($dn),cn=services,cn=test,dc=example,dc=com"

A sample test case:
ndn: cn=test/uid.xxxx,cn=services,cn=test,dc=example,dc=com
match_this: cn=*/($dn),cn=services,cn=test,dc=example,dc=com

Thanks,
--noriko

Comment 5 Ludwig 2015-09-10 07:13:43 UTC

To verify the fix you should 
- add this aci:
aci: (target="ldap:///cn=*/($dn),cn=services,cn=test,dc=example,dc=com")(version 3.0; acl "allow dding of own serviou=People,dc=example,dc=coces"; allow (all) userdn = "ldap:///uid=($dn),ou=People,dc=example,dc=com";)

-add user entries:
uid=user.1111,ou=People,dc=example,dc=com
uid=user.2222,ou=People,dc=example,dc=com

- add target entries: 
cn=xxx/user.1111,cn=services,cn=test,dc=example,dc=com
cn=yyy/user.1111,cn=services,cn=test,dc=example,dc=com
cn=xxx/user.2222,cn=services,cn=test,dc=example,dc=com

the user should only see the entries containing their userid

Comment 9 Amita Sharma 2015-09-10 13:14:22 UTC

Thanks Ludwig,

If that is the case then I can mark this bug as VERIFIED and open another doc bug.

Comment 10 Amita Sharma 2015-09-10 13:29:53 UTC

Doc Bug :: https://bugzilla.redhat.com/show_bug.cgi?id=1261944

Comment 11 errata-xmlrpc 2015-11-19 11:43:52 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2351.html