Bug 1118021 - [RFE] Don't return all attributes in rootdse without explicit request
Summary: [RFE] Don't return all attributes in rootdse without explicit request
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: 389-ds-base
Version: 7.0
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: Noriko Hosoi
QA Contact: Viktor Ashirov
Aneta Šteflová Petrová
URL:
Whiteboard:
Depends On:
Blocks: 1185113
TreeView+ depends on / blocked
 
Reported: 2014-07-09 21:10 UTC by Noriko Hosoi
Modified: 2020-09-13 21:01 UTC (History)
4 users (show)

Fixed In Version: 389-ds-base-1.3.3.1-1.el7
Doc Type: Enhancement
Doc Text:
Root DSE searches no longer display operational attributes by default Running the ldapsearch utility with the '-s base -b ""' options now displays only the user attributes and not the operational attributes. Previously, a root DSE search displayed all attributes by default. To ensure compatibility with earlier versions, this update adds the "nsslapd-return-default-opattr" attribute to the root DSE. You can modify the new default behavior by setting "nsslapd-return-default-opattr" in the dse.ldif configuration file as follows: dn: nsslapd-return-default-opattr: supportedsaslmechanisms nsslapd-return-default-opattr: nsBackendSuffix nsslapd-return-default-opattr: subschemasubentry nsslapd-return-default-opattr: supportedldapversion nsslapd-return-default-opattr: supportedcontrol nsslapd-return-default-opattr: ref nsslapd-return-default-opattr: vendorname nsslapd-return-default-opattr: vendorVersion nsslapd-return-default-opattr: namingcontexts nsslapd-return-default-opattr: supportedextension With this configuration, running the ldapsearch utility with '-s base -b ""' displays all attributes by default.
Clone Of:
Environment:
Last Closed: 2015-03-05 09:37:04 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Github 389ds 389-ds-base issues 1093 0 None None None 2020-09-13 21:01:41 UTC
Red Hat Product Errata RHSA-2015:0416 0 normal SHIPPED_LIVE Important: 389-ds-base security, bug fix, and enhancement update 2015-03-05 14:26:33 UTC

Description Noriko Hosoi 2014-07-09 21:10:46 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/47761

A recent change in schema parsing ahd the side effect of changing the behavior of rootdse so that now it does not return all atributes by default.
Although this is more standards complaint it may break clients that are primarily tested against Active Directory.

In FreeIPA we feel we need a way to change the behavior through a cn=config option so that we can return to the old behavior and return all attributes that were previously returned (but not things like modifyTimestamps and such).
Comment 3 Ludwig 2014-10-23 13:40:38 UTC 
Operational attributes are no longer returned by default in rootDSE searches.
verify by 
ldapsearch ... -b "" -s base

and check that operational attributes like supportedcontrol or namincontexts are not returned.

To change default behaviour modify the rootDSE entry "dn: "

ldapmodify
dn: 
changetype: modify
add:nsslapd-return-default-opattr
nsslapd-return-default-opattr: namingContexts
nsslapd-return-default-opattr:supportedControl

repeat the above search
Comment 4 Sankar Ramalingam 2014-11-20 11:39:13 UTC 
[root@vm-idm-035 MMR_WINSYNC]# ldapsearch -p 1189 -h localhost -D "cn=Directory Manager" -w Secret123 -b "" -s base
dn:
objectClass: top
defaultnamingcontext: dc=example,dc=com
dataversion: 020141120112723020141120112723
netscapemdsuffix: cn=ldap://dc=vm-idm-035,dc=lab,dc=eng,dc=pnq,dc=redhat,dc=co
 m:1189

[root@vm-idm-035 MMR_WINSYNC]# ldapmodify -p 1189 -h localhost -D "cn=Directory Manager" -w Secret123 << EOF
dn:
changetype: modify
add:nsslapd-return-default-opattr
nsslapd-return-default-opattr: namingContexts
nsslapd-return-default-opattr:supportedControl
EOF

modifying entry ""

[root@vm-idm-035 MMR_WINSYNC]# ldapsearch -p 1189 -h localhost -D "cn=Directory Manager" -w Secret123 -b "" -s base

dn:
objectClass: top
namingContexts: dc=example,dc=com
namingContexts: dc=passsync,dc=com
defaultnamingcontext: dc=example,dc=com
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 2.16.840.1.113730.3.4.3
supportedControl: 2.16.840.1.113730.3.4.4

SupportedControl and naminContexts information is not shown default. After adding "nsslapd-return-default-opattr" attribute, the ldapsearch shows the values for SupportedControl and naminContexts. Hence, marking the bug as Verified.

Build tested:
[root@vm-idm-035 MMR_WINSYNC]# rpm -qa 389-ds-base
389-ds-base-1.3.3.1-9.el7.x86_64
Comment 5 Sankar Ramalingam 2014-11-24 16:57:50 UTC 
Changed the bug summary since the feature is actually to deny all rootdse attributes by default. You need to explicitly request or modify this attribute "nsslapd-return-default-opattr" to view rootdse entries.
Comment 7 errata-xmlrpc 2015-03-05 09:37:04 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0416.html
Note You need to log in before you can comment on or make changes to this bug.