Bug 1554720
| Summary: | "Truncated search results" pop-up appears in user details in WebUI [rhel-7.5.z] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Oneata Mircea Teodor <toneata> |
| Component: | 389-ds-base | Assignee: | mreynolds |
| Status: | CLOSED ERRATA | QA Contact: | Viktor Ashirov <vashirov> |
| Severity: | urgent | Docs Contact: | Marc Muehlfeld <mmuehlfe> |
| Priority: | urgent | ||
| Version: | 7.4 | CC: | amsharma, cobrown, frenaud, gparente, hgraham, ipa-maint, mreynolds, msauton, mvarun, nkinder, nsoman, pvoborni, rcritten, rmeggins, sigbjorn, tscherf |
| Target Milestone: | rc | Keywords: | Reopened, ZStream |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | 389-ds-base-1.3.7.5-20 | Doc Type: | Bug Fix |
| Doc Text: |
Previously, Directory Server did not remember when the first operation, bind, or a connection was started. As a consequence, the server applied in certain situations anonymous resource limits to an authenticated client. With this update, Directory Server properly marks authenticated client connections. As a result, it applies the correct resource limits, and authenticated clients no longer get randomly restricted by anonymous resource limits.
|
Story Points: | --- |
| Clone Of: | 1515190 | Environment: | |
| Last Closed: | 2018-05-14 16:09:58 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1515190 | ||
| Bug Blocks: | |||
|
Description
Oneata Mircea Teodor
2018-03-13 08:53:28 UTC
# rpm -qa | grep 389 389-ds-base-libs-1.3.7.5-21.el7.x86_64 389-ds-base-snmp-1.3.7.5-21.el7.x86_64 389-ds-base-1.3.7.5-21.el7.x86_64 389-ds-base-debuginfo-1.3.7.5-21.el7.x86_64 Using https://bugzilla.redhat.com/show_bug.cgi?id=1515190#c23 steps to verify :: [1] Add 6000 users (make note of an entry and its password for step [4]) ldapadd -x -h localhost -p 389 -D "cn=Directory Manager" -w Secret123 -f output.ldif [2] Set up anonymous resource limits ldapmodify -x -h localhost -p 389 -D "cn=Directory Manager" -w Secret123 << EOF dn: cn=config changetype: modify add: nsslapd-anonlimitsdn nsslapd-anonlimitsdn: cn=anonymous-limits,dc=example,dc=com ldapmodify -x -h localhost -p 389 -D "cn=Directory Manager" -w Secret123 << EOF dn: cn=anonymous-limits,dc=example,dc=com changetype: add objectclass: top objectclass: extensibleObject nsLookThroughLimit: 5000 [3] Continuously issue anonymous ldapsearch's that exceed the lookthroughlimit # ldapsearch -xLLL -b dc=example,dc=com objectclass=top > /dev/null [root@qeos-32 export]# ./do-anony.sh Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) Size limit exceeded (4) [4] Then continuously run an authenticated ldapsearch, and make sure we do not get any errors: ldapmodify -x -h localhost -p 389 -D "cn=Directory Manager" -w Secret123 << EOF > dn: uid=test_user,ou=people,dc=example,dc=com > changetype: modify > add: nsSizeLimit > nsSizeLimit: 6000 > EOF modifying entry "uid=test_user,ou=people,dc=example,dc=com" # ldapsearch -xLLL -b dc=example,dc=com -D "uid=test_user,ou=people,dc=example,dc=com" -w password objectclass=top > /dev/null export]# ./do-auth.sh Administrative limit exceeded (11) Failed! This is not fixed, moving to FailedQA These prerequisite steps were missing: # ldapmodify -x -h localhost -p 389 -D "cn=Directory Manager" -w Secret123 << EOF dn: cn=config changetype: modify replace: nssslapd-sizelimit nsslapd-sizelimit: -1 - dn: cn=config,cn=ldbm database,cn=plugins,cn=config changetype: modify replace: nsLookThroughLimit nsLookThroughLimit: -1 Configurations were missing in the steps, tried with following configurations again :: nsslapd-sizelimit: -1 nsLookThroughLimit: -1 At global level and this is working fine now. Marking as verified. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:1380 |