Bug 1183820 - Windows Sync accidentally cleared raw_entry
Summary: Windows Sync accidentally cleared raw_entry
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: 389-ds-base   
(Show other bugs)
Version: 6.0
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: rc
: ---
Assignee: Noriko Hosoi
QA Contact: Viktor Ashirov
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-01-19 22:20 UTC by Noriko Hosoi
Modified: 2015-07-22 06:36 UTC (History)
5 users (show)

Fixed In Version: 389-ds-base-1.2.11.15-51.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-07-22 06:36:51 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:1326 normal SHIPPED_LIVE 389-ds-base bug fix and enhancement update 2015-07-20 17:53:07 UTC

Description Noriko Hosoi 2015-01-19 22:20:08 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/47989

commit f6397113666f06848412bb12f754f04258cfa5fa added the following clean up call to windows_search_entry_ext, which set NULL before the stashed raw_entry is refered in the winsync callbacks.
+               /* clear it here in case the search fails and
+                  we are left with a bogus old entry */
+               windows_private_set_raw_entry(conn->agmt, NULL);

Comment 1 Sankar Ramalingam 2015-01-20 09:34:50 UTC
Please add verification steps.

Comment 2 Noriko Hosoi 2015-01-20 18:39:41 UTC
(In reply to Sankar Ramalingam from comment #1)
> Please add verification steps.

Test cases run by Viktor:
https://bugzilla.redhat.com/show_bug.cgi?id=1118060#c5

[2.1] Disable account on DS: 
$ sudo ns-inactivate.pl -Z M1  -D "cn=Directory Manager" -w Secret123 -I uid=posixusr0,ou=dswinsync,dc=example,dc=com
ldap_add: Already exists (68)
ldap_add: Already exists (68)
ldap_add: Already exists (68)
ldap_add: Already exists (68)
ldap_add: Already exists (68)
uid=posixusr0,ou=dswinsync,dc=example,dc=com inactivated.

On AD it becomes disabled:
$ ldapsearch -o ldif-wrap=no -LLL -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123  -H ldap://win2k8.adrelm.com -b dc=adrelm,dc=com cn=posixusr0 userAccountControl
dn: CN=posixusr0,OU=adsync,DC=adrelm,DC=com
userAccountControl: 514

Enable account on DS: 
$ sudo ns-activate.pl -Z M1  -D "cn=Directory Manager" -w Secret123 -I uid=posixusr0,ou=dswinsync,dc=example,dc=com
uid=posixusr0,ou=dswinsync,dc=example,dc=com activated.

On AD it's still disabled:
$ ldapsearch -o ldif-wrap=no -LLL -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123  -H ldap://win2k8.adrelm.com -b dc=adrelm,dc=com cn=posixusr0 userAccountControl
dn: CN=posixusr0,OU=adsync,DC=adrelm,DC=com
userAccountControl: 514

And after sync, on DS:
$ sudo ns-accountstatus.pl -Z M1  -D "cn=Directory Manager" -w Secret123 -I uid=posixusr1,ou=dswinsync,dc=example,dc=com
uid=posixusr1,ou=dswinsync,dc=example,dc=com inactivated (probably directly).

In other words, if account was inactivated on DS, it cannot be reactivated again from DS.
<== this issue should have been fixed.

[2.2] Disable account on AD: 
Before change:
$ sudo ns-accountstatus.pl -Z M1  -D "cn=Directory Manager" -w Secret123 -I uid=posixusr0,ou=dswinsync,dc=example,dc=com
uid=posixusr0,ou=dswinsync,dc=example,dc=com  activated.

Disable account on AD: 
$ ldapmodify -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123  -H ldap://win2k8.adrelm.com << EOF
dn: CN=posixusr0,OU=adsync,DC=adrelm,DC=com
changetype: modify
replace: userAccountControl
userAccountControl: 514
EOF
modifying entry "CN=posixusr0,OU=adsync,DC=adrelm,DC=com"

After sync, on DS:
$ sudo ns-accountstatus.pl -Z M1  -D "cn=Directory Manager" -w Secret123 -I uid=posixusr0,ou=dswinsync,dc=example,dc=com
uid=posixusr0,ou=dswinsync,dc=example,dc=com inactivated (probably directly).

Enable account on AD:
$ ldapmodify -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123  -H ldap://win2k8.adrelm.com << EOF
dn: CN=posixusr0,OU=adsync,DC=adrelm,DC=com
changetype: modify
replace: userAccountControl
userAccountControl: 512 
EOF

After sync, on DS:
$ sudo ns-accountstatus.pl -Z M1  -D "cn=Directory Manager" -w Secret123 -I uid=posixusr0,ou=dswinsync,dc=example,dc=com
uid=posixusr0,ou=dswinsync,dc=example,dc=com  activated.

Comment 4 Viktor Ashirov 2015-04-12 15:28:44 UTC
Build tested:                                                                                                                                                                                                                                                                     
389-ds-base-1.2.11.15-53.el6.x86_64                                                                                                                                                                                                                                               
                                                                                                                                                                                                                                                                                  
[2.1] Disable account on DS:                                                                                                                                                                                                                                                      
# ./ns-inactivate.pl -D "cn=Directory Manager" -w Secret123 -I uid=posixusr0,ou=dswinsync,dc=example,dc=com                                                                                                                                                                       
uid=posixusr0,ou=dswinsync,dc=example,dc=com inactivated.                                                                                                                                                                                                                         
                                                                                                                                                                                                                                                                                  
On AD it becomes disabled:                                                                                                                                                                                                                                                        
# ldapsearch -o ldif-wrap=no -LLL -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123  -H ldap://win2k8.adrelm.com -b dc=adrelm,dc=com cn=posixusr0 userAccountControl                                                                                                   
dn: CN=posixusr0,CN=Users,DC=adrelm,DC=com                                                                                                                                                                                                                                        
userAccountControl: 546                                                                                                                                                                                                                                                           
                                                                                                                                                                                                                                                                                  
Enable account on DS:                                                                                                                                                                                                                                                             
# ./ns-activate.pl -D "cn=Directory Manager" -w Secret123 -I uid=posixusr0,ou=dswinsync,dc=example,dc=com                                                                                                                                                                         
uid=posixusr0,ou=dswinsync,dc=example,dc=com activated.                                                                                                                                                                                                                           
                                                                                                                                                                                                                                                                                  
On AD it's also enabled:                                                                                                                                                                                                                                                          
# ldapsearch -o ldif-wrap=no -LLL -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123  -H ldap://win2k8.adrelm.com -b dc=adrelm,dc=com cn=posixusr0 userAccountControl                                                                                                   
dn: CN=posixusr0,CN=Users,DC=adrelm,DC=com                                                                                                                                                                                                                                        
userAccountControl: 544                                                                                                                                                                                                                                                           
                                                                                                                                                                                                                                                                                  
And after sync, on DS:                                                                                                                                                                                                                                                            
# ./ns-accountstatus.pl -D "cn=Directory Manager" -w Secret123 -I uid=posixusr0,ou=dswinsync,dc=example,dc=com                                                                                                                                                                    
uid=posixusr0,ou=dswinsync,dc=example,dc=com  activated.                                                                                                                                                                                                                          
                                                                                                                                                                                                                                                                                  
Issue has been fixed.                                                                                                                                                                                                                                                             
                                                                                                                                                                                                                                                                                  
[2.2] Disable account on AD:                                                                                                                                                                                                                                                      
Before change:                                                                                                                                                                                                                                                                    
# ./ns-accountstatus.pl -D "cn=Directory Manager" -w Secret123 -I uid=posixusr0,ou=dswinsync,dc=example,dc=com                                                                                                                                                                    
uid=posixusr0,ou=dswinsync,dc=example,dc=com  activated.                                                                                                                                                                                                                          
                                                                                                                                                                                                                                                                                  
Disable account on AD:                                                                                                                                                                                                                                                            
# ldapmodify -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123  -H ldap://win2k8.adrelm.com << EOF                                                                                                                                                                     
dn: CN=posixusr0,CN=Users,DC=adrelm,DC=com                                                                                                                                                                                                                                        
changetype: modify                                                                                                                                                                                                                                                                
replace: userAccountControl                                                                                                                                                                                                                                                       
userAccountControl: 514                                                                                                                                                                                                                                                           
EOF                                                                                                                                                                                                                                                                               
modifying entry "CN=posixusr0,CN=Users,DC=adrelm,DC=com"                                                                                                                                                                                                                          
                                                                                                                                                                                                                                                                                  
After sync, on DS:                                                                                                                                                                                                                                                                
# ./ns-accountstatus.pl  -D "cn=Directory Manager" -w Secret123 -I uid=posixusr0,ou=dswinsync,dc=example,dc=com                                                                                                                                                                   
uid=posixusr0,ou=dswinsync,dc=example,dc=com inactivated (probably directly).                                                                                                                                                                                                     
                                                                                                                                                                                                                                                                                  
Enable account on AD:                                                                                                                                                                                                                                                             
# ldapmodify -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123  -H ldap://win2k8.adrelm.com << EOF                                                                                                                                                                     
dn: CN=posixusr0,CN=Users,DC=adrelm,DC=com                                                                                                                                                                                                                                        
changetype: modify                                                                                                                                                                                                                                                                
replace: userAccountControl                                                                                                                                                                                                                                                       
userAccountControl: 512                                                                                                                                                                                                                                                           
EOF                                                                                                                                                                                                                                                                               
modifying entry "CN=posixusr0,CN=Users,DC=adrelm,DC=com"                                                                                                                                                                                                                          
                                                                                                                                                                                                                                                                                  
After sync, on DS:                                                                                                                                                                                                                                                                
# ./ns-accountstatus.pl  -D "cn=Directory Manager" -w Secret123 -I uid=posixusr0,ou=dswinsync,dc=example,dc=com                                                                                                                                                                   
uid=posixusr0,ou=dswinsync,dc=example,dc=com  activated.                                                                                                                                                                                                                          
                                                                                                                                                                                                                                                                                  
Issue in [2.1] has been fixed, marking as VERIFIED.

Comment 5 errata-xmlrpc 2015-07-22 06:36:51 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1326.html


Note You need to log in before you can comment on or make changes to this bug.