Red Hat Bugzilla – Bug 1151287
dynamically added macro aci is not evaluated on the fly
Last modified: 2015-03-05 04:36:16 EST
This bug is created as a clone of upstream ticket: https://fedorahosted.org/389/ticket/47922 This is a reguression. sample aci> dn: <SUFFIX> aci: (target="ldap:///ou=People, ($dn), <SUFFIX>") (targetattr!="userPassword")(targetfilter=(objectClass=nsManagedPerson)) (version 3.0; acl "Admin access to all users in this and lower domains"; allow (write,read,search) groupdn="ldap:///cn=Domain Administrators, ou=Groups, [$dn], <SUFFIX>";) UserA in the groupdn fails to modify the attributes of UserB which has "objectClass: nsManagedPerson" and under ou=People,($dn),<SUFFIX>. Both UserA and UserB share the same $dn. The modify attempts returns Insufficient access. ldap_modify: Insufficient access ldap_modify: additional info: Insufficient 'write' privilege to the 'sn' attribute of entry 'uid=UserB,ou=people,($dn),<SUFFIX>'. Restarting the server solves this problem and UserA is allowed to modify UserB's attributes.
$ rpm -qa | grep 389 389-ds-base-1.3.3.1-9.el7.x86_64 389-ds-base-debuginfo-1.3.3.1-9.el7.x86_64 389-ds-base-libs-1.3.3.1-9.el7.x86_64 1. I did a fresh install of DS, added test entries. 2. Checked that UserA cannot modify UserB sn attribute: $ ldapmodify -h localhost:389 -D "cn=UserA,ou=People,dc=subdomain1,dc=hostedcompany1,dc=example,dc=com" -w Secret123 dn: cn=UserB,ou=People,dc=subdomain1,dc=hostedcompany1,dc=example,dc=com changetype: modify replace: sn sn: UserB_modified_by_UserA modifying entry "cn=UserB,ou=People,dc=subdomain1,dc=hostedcompany1,dc=example,dc=com" ldap_modify: Insufficient access (50) additional info: Insufficient 'write' privilege to the 'sn' attribute of entry 'cn=userb,ou=people,dc=subdomain1,dc=hostedcompany1,dc=example,dc=com'. 3. Added aci to ou=people,dc=subdomain1,dc=hostedcompany1,dc=example,dc=com: aci: (target="ldap:///ou=People, ($dn), dc=example,dc=com") (targetattr!="userPassword")(targetfilter=(objectClass=inetOrgPerson)) (version 3.0; acl "Admin access to all users in this and lower domains"; allow (write,read,search) groupdn="ldap:///cn=Domain Administrators, ou=Groups, [$dn], dc=example,dc=com";) 4. Checked that UserA can modify UserB sn attribute: $ ldapmodify -h localhost:389 -D "cn=UserA,ou=People,dc=subdomain1,dc=hostedcompany1,dc=example,dc=com" -w Secret123 dn: cn=UserB,ou=People,dc=subdomain1,dc=hostedcompany1,dc=example,dc=com changetype: modify replace: sn sn: UserB_modified_by_UserA modifying entry "cn=UserB,ou=People,dc=subdomain1,dc=hostedcompany1,dc=example,dc=com" $ ldapsearch -o ldif-wrap=no -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w Secret123 -b dc=example,dc=com "(cn=UserB)" sn dn: cn=UserB,ou=People,dc=subdomain1,dc=hostedcompany1,dc=example,dc=com sn: UserB_modified_by_UserA Dynamically added macro aci was evaluated without server restart. Hence marking this bug as VERIFIED.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0416.html