Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
In current RHEL 6.4 DS it is possible to add non-existent user to member attribute of group (same goes for seeAlso attribute and probably others). This happens even with referential integrity plugin enabled, which makes it difficult to keep referential integrity of DB intact.
I would expect either non-existent user is denied always, or referential integrity plugin denying such additions to tracked attributes.
Version-Release number of selected component (if applicable):
389-ds-base-1.2.11.15-29.el6.x86_64
How reproducible:
always
Steps to Reproduce:
[jrusnack@dhcp-31-42 workspace]$ ldapmodify -D "cn=directory manager" -w Secret123 -a <<EOF
dn: cn=referential integrity postoperation,cn=plugins,cn=config
changetype: modify
replace: nsslapd-pluginEnabled
nsslapd-pluginEnabled: on
EOF
modifying entry "cn=referential integrity postoperation,cn=plugins,cn=config"
[jrusnack@dhcp-31-42 workspace]$ sudo service dirsrv restart
Shutting down dirsrv:
dhcp-31-42... [ OK ]
Starting dirsrv:
dhcp-31-42... [ OK ]
[jrusnack@dhcp-31-42 workspace]$ ldapmodify -D "cn=directory manager" -w Secret123 -a <<EOF
dn: cn=testgroup,ou=groups,dc=example,dc=com
objectclass: top
objectclass: groupOfNames
cn: testgroup
member: uid=invalid
EOF
adding new entry "cn=testgroup,ou=groups,dc=example,dc=com"
[jrusnack@dhcp-31-42 workspace]$ ldapsearch -LLL -D "cn=directory manager" -w Secret123 -b "cn=testgroup,ou=groups,dc=example,dc=com"
dn: cn=testgroup,ou=Groups,dc=example,dc=com
objectClass: top
objectClass: groupOfNames
cn: testgroup
member: uid=invalid
[jrusnack@dhcp-31-42 workspace]$ ldapsearch -LLL -D "cn=directory manager" -w Secret123 -b "cn=referential integrity postoperation,cn=plugins,cn=config"
dn: cn=referential integrity postoperation,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: extensibleObject
cn: referential integrity postoperation
nsslapd-pluginPath: libreferint-plugin
nsslapd-pluginInitfunc: referint_postop_init
nsslapd-pluginType: postoperation
nsslapd-pluginEnabled: on
nsslapd-pluginprecedence: 40
nsslapd-pluginarg0: 0
nsslapd-pluginarg1: /var/log/dirsrv/slapd-dhcp-31-42/referint
nsslapd-pluginarg2: 0
nsslapd-pluginarg3: member
nsslapd-pluginarg4: uniquemember
nsslapd-pluginarg5: owner
nsslapd-pluginarg6: seeAlso
nsslapd-plugin-depends-on-type: database
nsslapd-pluginId: referint
nsslapd-pluginVersion: 1.2.11.15
nsslapd-pluginVendor: 389 Project
nsslapd-pluginDescription: referential integrity plugin
Actual result:
Member attribute of cn=testgroup cotains invalid reference to uid=invalid, even with referential plugin enabled and member attribute checked by the plugin for referential integrity.
This is not the way that referential integrity was designed to work. Here is how it is explained in the Admin Guide:
"By default, when the Referential Integrity Plug-in is enabled, it performs integrity updates on the member, uniquemember, owner, and seeAlso attributes immediately after a delete or rename operation."
Note that ADD and MOD operations do not trigger referential integrity. Changing the default behavior would cause backwards compatibility issues. An enhancement to allow one to enable referential integrity checking for ADD and MOD operations could be developed, but I'd prefer to only go down that route if we have a customer business case for it.
Closing as WONTFIX.
Description of problem: In current RHEL 6.4 DS it is possible to add non-existent user to member attribute of group (same goes for seeAlso attribute and probably others). This happens even with referential integrity plugin enabled, which makes it difficult to keep referential integrity of DB intact. I would expect either non-existent user is denied always, or referential integrity plugin denying such additions to tracked attributes. Version-Release number of selected component (if applicable): 389-ds-base-1.2.11.15-29.el6.x86_64 How reproducible: always Steps to Reproduce: [jrusnack@dhcp-31-42 workspace]$ ldapmodify -D "cn=directory manager" -w Secret123 -a <<EOF dn: cn=referential integrity postoperation,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: on EOF modifying entry "cn=referential integrity postoperation,cn=plugins,cn=config" [jrusnack@dhcp-31-42 workspace]$ sudo service dirsrv restart Shutting down dirsrv: dhcp-31-42... [ OK ] Starting dirsrv: dhcp-31-42... [ OK ] [jrusnack@dhcp-31-42 workspace]$ ldapmodify -D "cn=directory manager" -w Secret123 -a <<EOF dn: cn=testgroup,ou=groups,dc=example,dc=com objectclass: top objectclass: groupOfNames cn: testgroup member: uid=invalid EOF adding new entry "cn=testgroup,ou=groups,dc=example,dc=com" [jrusnack@dhcp-31-42 workspace]$ ldapsearch -LLL -D "cn=directory manager" -w Secret123 -b "cn=testgroup,ou=groups,dc=example,dc=com" dn: cn=testgroup,ou=Groups,dc=example,dc=com objectClass: top objectClass: groupOfNames cn: testgroup member: uid=invalid [jrusnack@dhcp-31-42 workspace]$ ldapsearch -LLL -D "cn=directory manager" -w Secret123 -b "cn=referential integrity postoperation,cn=plugins,cn=config" dn: cn=referential integrity postoperation,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject cn: referential integrity postoperation nsslapd-pluginPath: libreferint-plugin nsslapd-pluginInitfunc: referint_postop_init nsslapd-pluginType: postoperation nsslapd-pluginEnabled: on nsslapd-pluginprecedence: 40 nsslapd-pluginarg0: 0 nsslapd-pluginarg1: /var/log/dirsrv/slapd-dhcp-31-42/referint nsslapd-pluginarg2: 0 nsslapd-pluginarg3: member nsslapd-pluginarg4: uniquemember nsslapd-pluginarg5: owner nsslapd-pluginarg6: seeAlso nsslapd-plugin-depends-on-type: database nsslapd-pluginId: referint nsslapd-pluginVersion: 1.2.11.15 nsslapd-pluginVendor: 389 Project nsslapd-pluginDescription: referential integrity plugin Actual result: Member attribute of cn=testgroup cotains invalid reference to uid=invalid, even with referential plugin enabled and member attribute checked by the plugin for referential integrity.