Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1044194 - Complex filter in a search request doen't work as expected.
Summary: Complex filter in a search request doen't work as expected.
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: 389-ds-base
Version: 7.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Rich Megginson
QA Contact: Viktor Ashirov
Depends On:
TreeView+ depends on / blocked
Reported: 2013-12-17 21:51 UTC by Nathan Kinder
Modified: 2020-09-13 20:46 UTC (History)
2 users (show)

Fixed In Version: 389-ds-base-
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2015-03-05 09:32:53 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github 389ds 389-ds-base issues 858 0 None None None 2020-09-13 20:46:15 UTC
Red Hat Product Errata RHSA-2015:0416 0 normal SHIPPED_LIVE Important: 389-ds-base security, bug fix, and enhancement update 2015-03-05 14:26:33 UTC

Description Nathan Kinder 2013-12-17 21:51:32 UTC
This bug is created as a clone of upstream ticket:


Please find below the reproducer details with the examples.

Complex filter example:

"(&(&(uid=test1)(cn=t1 est))(&(gidnumber=20))(uidnumber=2558)(&(sn=est)))"

In the above filter as you can see, the "uidnumber=2558" sub filter is not associated with ant Boolean operator ( AND or OR or NOT) which results in missing this sub filter from the filter after decoding process. The error log details are given below.
[23/Sep/2013:04:42:58 +051800] index_subsys_assign_filter_decoders - before: (&(&(uid=test1)(cn=t1 est))(&(gidNumber=20))(uidNumber=2558)(&(sn=est)))
>>> The index subsystem takes the complex filter as argument for the decoding.
[23/Sep/2013:04:42:58 +051800] - slapi_filter_free type 0xA0
[23/Sep/2013:04:42:58 +051800] - slapi_filter_free type 0xA0
[23/Sep/2013:04:42:58 +051800] - slapi_filter_free type 0xA0
[23/Sep/2013:04:42:58 +051800] index_subsys_assign_filter_decoders -  after: (&(uid=test1)(cn=t1 est)(gidNumber=20)(sn=est))
>>> After decoding as you can see in the above line, the "uidnumber=2558" is missing which is not going to be considered during the database search.

Here, as the whole of complex filter is preceded by a outer "&" operator, Why the sub filter in this case is being ignored  from the search request?.

Comment 2 Amita Sharma 2014-12-29 07:37:00 UTC
[root@dhcp201-126 ~]# ldapadd -x -h localhost -p 389 -D "cn=Directory Manager" -w Secret123  << EOF
> dn: uid=test1,dc=example,dc=com
> cn: t1 est
> sn: est
> givenname: ams
> gidnumber: 20
> uidnumber: 2558
> objectclass: top
> objectclass: person
> objectclass: organizationalPerson
> objectclass: inetOrgPerson
> objectClass: posixAccount
> uid: test1
> mail: ams@example.com
> homeDirectory: /home/test1
> userpassword: Secret123
adding new entry "uid=test1,dc=example,dc=com"

[root@dhcp201-126 ~]# ldapsearch -LLL -D "cn=directory manager" -w Secret123 -p 389 -h localhost -b  "dc=example,dc=com" "(&(&(uid=test1)(cn=t1 est))(&(gidnumber=20))(uidnumber=2558)(&(sn=est)))"
dn: uid=test1,dc=example,dc=com
cn: t1 est
sn: est
givenName: ams
gidNumber: 20
uidNumber: 2558
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
uid: test1
mail: ams@example.com
homeDirectory: /home/test1
userPassword:: e1NTSEF9bVBaTldhRTl0dGRiZ3pLZ1FsQzFzczR2OUJ6bkNQang5QU1heXc9PQ=

worked as expected, hence VERIFIED.

Comment 4 errata-xmlrpc 2015-03-05 09:32:53 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.