Bug 1258996 - Some filters in RHDS10 are not working fine.
Some filters in RHDS10 are not working fine.
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: 389-ds-base (Show other bugs)
Unspecified Unspecified
urgent Severity urgent
: rc
: ---
Assigned To: Noriko Hosoi
Viktor Ashirov
: ZStream
Depends On:
Blocks: 1133060 1259999
  Show dependency treegraph
Reported: 2015-09-01 13:12 EDT by German Parente
Modified: 2015-11-19 06:44 EST (History)
5 users (show)

See Also:
Fixed In Version: 389-ds-base-
Doc Type: Bug Fix
Doc Text:
Complex filters in a search request did not work as expected. Now, the filter optimization no longer mistakenly ignores certain complex subfilters.
Story Points: ---
Clone Of:
: 1259999 (view as bug list)
Last Closed: 2015-11-19 06:44:11 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:2351 normal SHIPPED_LIVE 389-ds-base bug fix and enhancement update 2015-11-19 05:28:44 EST

  None (edit)
Description German Parente 2015-09-01 13:12:20 EDT
Description of problem:

export to ldif in RHDS9, re-import in RHDS10, fresh installs. Certain queries are not working as expected. Seems as if RHDS10 is ignoring some clauses of the filter.

Version-Release number of selected component (if applicable): 389-ds-base-

How reproducible: always

Steps to Reproduce:

1. schemacheck: off + syntaxcheck: off 

2. Import this ldif file in both rhds9 and rhds10 instances:

dn: o=redhat
objectClass: top
objectClass: organization
o: redhat

dn: ou=People,o=redhat
objectClass: top
objectClass: organizationalunit
ou: people

dn: uid=german.parente,ou=People,o=redhat
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: person
objectClass: top
ou: test
manager: test.manager
uid: german.parente
sn: parente
c: SE
givenName: german
o: redhat.com
l: EU
cn: German Parente

dn: uid=test.user,ou=People,o=redhat
givenName: Tester
objectClass: top
objectClass: inetorgperson
objectClass: organizationalPerson
objectClass: person
ou: test
mail: test@redhat.com
uid: test.user
cn: Test User
manager: test
o: redhat.com
l: EU
description: Login user
sn: Test user
c: SE

3. Do this query: 

ldapsearch -xLLL -p 2389 -h localhost -D "cn=directory manager" -w secret12 -b "o=redhat" '(&(objectclass=person)(&(|(l=EU)(l=AP)(l=NA))(|(C=SE)(c=DE)))(|(uid=*test*)(cn=*test*))(!(telephone=*)))' dn

Actual results:

in RHDS9 => 
dn: uid=test.user,ou=People,o=redhat

in RHDS10 => 
dn: uid=german.parente,ou=People,o=redhat
dn: uid=test.user,ou=People,o=redhat

Expected results:

only "dn: uid=test.user,ou=People,o=redhat"

Because the clause 


that is one of the four &'s is false for "uid=german.parente".

Additional info:

If I remove, in RHDS10 the 4th clause of the &, that is to say, "(!(telephone=*))" the results are fine.

Sorry that I have not been able to debug this more deeply.
Comment 2 Noriko Hosoi 2015-09-01 14:05:49 EDT
Thank you, German.  I could reproduce the problem.  Very odd...  Investigating...
Comment 3 Noriko Hosoi 2015-09-01 17:46:44 EDT
Upstream ticket:
Comment 10 Amita Sharma 2015-09-08 03:21:19 EDT
[root@dhcp201-167 export]# ldapadd -x -h localhost -p 389 -D "cn=directory manager" -w Secret123 -f /export/sample.ldif
adding new entry "o=redhat"

adding new entry "ou=People,o=redhat"

adding new entry "uid=german.parente,ou=People,o=redhat"

adding new entry "uid=test.user,ou=People,o=redhat"

[root@dhcp201-167 export]# ldapsearch -xLLL -p 389 -h localhost -D "cn=Directory Manager" -w Secret123 -b "o=redhat" '(&(objectclass=person)(&(|(l=EU)(l=AP)(l=NA))(|(C=SE)(c=DE)))(|(uid=*test*)(cn=*test*))(!(telephone=*)))' dn
dn: uid=test.user,ou=People,o=redhat

[root@dhcp201-167 export]# rpm -qa | grep 389

Comment 11 errata-xmlrpc 2015-11-19 06:44:11 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.