Bug 920597
| Summary: | Possible to add invalid ACI value | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Ján Rusnačko <jrusnack> |
| Component: | 389-ds-base | Assignee: | Rich Megginson <rmeggins> |
| Status: | CLOSED ERRATA | QA Contact: | Viktor Ashirov <vashirov> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | medium | ||
| Version: | 7.0 | CC: | nhosoi, nkinder, sramling |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | 389-ds-base-1.3.3.1-1.el7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-03-05 09:30:18 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Upstream ticket: https://fedorahosted.org/389/ticket/617 Invalid ACIs not accepted. Hence, marking the bug as verified.
[root@vm-idm-035 ~]# ldapmodify -x -p 1189 -h localhost -D "cn=Directory Manager" -w Secret123 << EOF
dn: dc=example,dc=com
changetype: modify
add: aci
aci: (targetattr)*
> EOF
modifying entry "dc=example,dc=com"
ldap_modify: Invalid syntax (21)
additional info: ACL Syntax Error(-5):(targetattr)\2a
[root@vm-idm-035 ~]# ldapmodify -x -p 1189 -h localhost -D "cn=Directory Manager" -w Secret123 << EOF
dn: dc=example,dc=com
changetype: modify
add: aci
aci: Ivalid
EOF
modifying entry "dc=example,dc=com"
ldap_modify: Invalid syntax (21)
additional info: ACL Syntax Error(-5):Ivalid
==> /var/log/dirsrv/slapd-M1/errors <==
[01/Dec/2014:10:09:11 +051800] NSACLPlugin - The ACL target ou=invalid,dc=example,dc=com does not exist
[01/Dec/2014:10:46:29 +051800] NSACLPlugin - ACL Syntax Error(-5):(targetattr)\2a
[01/Dec/2014:10:46:48 +051800] NSACLPlugin - ACL Syntax Error(-5):Ivalid
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0416.html |
Description of problem: Syntax check for ACI seems to work only when "(" is present. Version-Release number of selected component (if applicable): 389-ds-base-1.2.11.15-12.el6_4.x86_64 on RHEL 6.4 How reproducible: always Steps to Reproduce: [jrusnack@dstet ~]$ ldapmodify -h localhost -p 389 -D "cn=directory manager" -w Secret123 <<EOF dn: ou=people,dc=example,dc=com changetype: modify add: aci aci: invalid EOF modifying entry "ou=people,dc=example,dc=com" [jrusnack@dstet ~]$ ldapmodify -h localhost -p 389 -D "cn=directory manager" -w Secret123 <<EOF dn: ou=people,dc=example,dc=com changetype: modify add: aci aci: (invalid EOF modifying entry "ou=people,dc=example,dc=com" ldap_modify: Invalid syntax (21) additional info: ACL Syntax Error(-5):(invalid [jrusnack@dstet ~]$ ldapsearch -h localhost -p 389 -D "cn=directory manager" -w Secret123 -b "ou=people,dc=example,dc=com" -LLL aci dn: ou=People,dc=example,dc=com aci: invalid Actual results: "aci: invalid" is accepted Expected results: "aci: invalid" should be refused with Invalid syntax (21) too.