Bug 1258996

Summary:	Some filters in RHDS10 are not working fine.
Product:	Red Hat Enterprise Linux 7	Reporter:	German Parente <gparente>
Component:	389-ds-base	Assignee:	Noriko Hosoi <nhosoi>
Status:	CLOSED ERRATA	QA Contact:	Viktor Ashirov <vashirov>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	7.1	CC:	amsharma, dzhukous, msauton, nkinder, rmeggins
Target Milestone:	rc	Keywords:	ZStream
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	389-ds-base-1.3.4.0-15.el7	Doc Type:	Bug Fix
Doc Text:	Complex filters in a search request did not work as expected. Now, the filter optimization no longer mistakenly ignores certain complex subfilters.	Story Points:	---
Clone Of:
Clones:	1259999 (view as bug list)		Environment:
Last Closed:	2015-11-19 11:44:11 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1133060, 1259999

Description German Parente 2015-09-01 17:12:20 UTC

Description of problem:

export to ldif in RHDS9, re-import in RHDS10, fresh installs. Certain queries are not working as expected. Seems as if RHDS10 is ignoring some clauses of the filter.

Version-Release number of selected component (if applicable): 389-ds-base-1.3.3.1-20

How reproducible: always

Steps to Reproduce:

1. schemacheck: off + syntaxcheck: off 

2. Import this ldif file in both rhds9 and rhds10 instances:

-----------------------------------
dn: o=redhat
objectClass: top
objectClass: organization
o: redhat

dn: ou=People,o=redhat
objectClass: top
objectClass: organizationalunit
ou: people

dn: uid=german.parente,ou=People,o=redhat
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: person
objectClass: top
ou: test
manager: test.manager
uid: german.parente
sn: parente
c: SE
givenName: german
o: redhat.com
l: EU
cn: German Parente

dn: uid=test.user,ou=People,o=redhat
givenName: Tester
objectClass: top
objectClass: inetorgperson
objectClass: organizationalPerson
objectClass: person
ou: test
mail: test
uid: test.user
cn: Test User
manager: test
o: redhat.com
l: EU
description: Login user
sn: Test user
c: SE
-----------------------------------

3. Do this query: 

ldapsearch -xLLL -p 2389 -h localhost -D "cn=directory manager" -w secret12 -b "o=redhat" '(&(objectclass=person)(&(|(l=EU)(l=AP)(l=NA))(|(C=SE)(c=DE)))(|(uid=*test*)(cn=*test*))(!(telephone=*)))' dn


Actual results:

in RHDS9 => 
dn: uid=test.user,ou=People,o=redhat

in RHDS10 => 
dn: uid=german.parente,ou=People,o=redhat
dn: uid=test.user,ou=People,o=redhat

Expected results:

only "dn: uid=test.user,ou=People,o=redhat"

Because the clause 

(|(uid=*test*)(cn=*test*))

that is one of the four &'s is false for "uid=german.parente".

Additional info:

If I remove, in RHDS10 the 4th clause of the &, that is to say, "(!(telephone=*))" the results are fine.

Sorry that I have not been able to debug this more deeply.

Comment 2 Noriko Hosoi 2015-09-01 18:05:49 UTC

Thank you, German.  I could reproduce the problem.  Very odd...  Investigating...

Comment 3 Noriko Hosoi 2015-09-01 21:46:44 UTC

Upstream ticket:
https://fedorahosted.org/389/ticket/48265

Comment 10 Amita Sharma 2015-09-08 07:21:19 UTC

[root@dhcp201-167 export]# ldapadd -x -h localhost -p 389 -D "cn=directory manager" -w Secret123 -f /export/sample.ldif
adding new entry "o=redhat"

adding new entry "ou=People,o=redhat"

adding new entry "uid=german.parente,ou=People,o=redhat"

adding new entry "uid=test.user,ou=People,o=redhat"

[root@dhcp201-167 export]# ldapsearch -xLLL -p 389 -h localhost -D "cn=Directory Manager" -w Secret123 -b "o=redhat" '(&(objectclass=person)(&(|(l=EU)(l=AP)(l=NA))(|(C=SE)(c=DE)))(|(uid=*test*)(cn=*test*))(!(telephone=*)))' dn
dn: uid=test.user,ou=People,o=redhat

[root@dhcp201-167 export]# rpm -qa | grep 389
389-ds-base-devel-1.3.4.0-15.el7.x86_64
389-ds-base-libs-1.3.4.0-15.el7.x86_64
389-ds-base-1.3.4.0-15.el7.x86_64
389-ds-base-debuginfo-1.3.4.0-15.el7.x86_64

Hence VERIFIED.

Comment 11 errata-xmlrpc 2015-11-19 11:44:11 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2351.html