Bug 837039

Summary:	mod_ldap caches negative results
Product:	Red Hat Enterprise Linux 5	Reporter:	Tessio F <tessiof>
Component:	httpd	Assignee:	Luboš Uhliarik <luhliari>
Status:	CLOSED INSUFFICIENT_DATA	QA Contact:	BaseOS QE - Apps <qe-baseos-apps>
Severity:	low	Docs Contact:
Priority:	unspecified
Version:	5.10	CC:	jkaluza, jorton, lmiksik, prc
Target Milestone:	rc
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-12-02 15:52:03 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1049888

Description Tessio F 2012-07-02 15:02:23 UTC

Description of problem: mod_ldap caches negative results, unlike specified in documentation: "Negative results (i.e., unsuccessful searches, or searches that did not result in a successful bind) are not cached."


Version-Release number of selected component (if applicable):


How reproducible: See steps below.

Steps to Reproduce:
1.Configure ldap authentication with mod_authnz_ldap. Set require ldap-group. Restart httpd. 
2. Try to log with user1 that do not belong to group. Log with authorized user2 (ie. belongs to group).
3. Put user1 in group and try again. Log fails. tcpdump show no LDAP authentication attempt. 
4. Repeat 2-3 with LDAPCacheEntries set to 0. Everything work as expected.
  
Actual results: mod_ldap caches negative results


Expected results: do not cache negative results


Additional info:

Comment 1 Joe Orton 2012-07-02 15:50:55 UTC

Hi, please confirm the package version used, and note that Bugzilla is not a support mechanism - if you need help with production support issues please contact Red Hat Support.

Comment 2 Tessio F 2012-07-03 14:39:07 UTC

Package: mod_authz_ldap-0.26-11.el5.i386

I'm not asking for support, I'm only saying that it works differently than documented.. so it's a bug.

Comment 3 Jan Kaluža 2012-10-03 08:25:03 UTC

Hi,

I've tried to reproduce your problem and I have few questions.

1. Do you use mod_authz_ldap or mod_authnz_ldap? "require ldap-group" can't be used with mod_authz_ldap, but from Comment 2 I understand that you are using that module.

2. Could you please paste here your httpd configuration related to LDAP so I will be able to reproduce it?

Comment 4 Joe Orton 2013-12-02 15:52:03 UTC

We lack sufficient reproduction information for this bug, and it is therefore being closed.

If you need further assistance, please contact your Red Hat support representative.

Comment 5 Red Hat Bugzilla 2023-09-14 23:56:58 UTC

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 500 days