Hide Forgot
This bug is created as a clone of upstream ticket: https://pagure.io/389-ds-base/issue/49523 #### Issue Description When memberof is enabled it adds 'memberof' attribute to members entries. If a member entry has not the appropriate objectclass to support 'memberof' attribute an ERR is logged. [05/Jan/2018:12:46:22.803032331 +0100] - ERR - oc_check_allowed_sv - Entry "cn=user_1,ou=People,dc=example,dc=com" -- attribute "memberOf" not allowed This is confusing because memberof will catch this violation and may try to repair it. So although this message is alarming, the target entry may finally have the 'memberof' attribute. This is especially confusing since https://pagure.io/389-ds-base/issue/48985 where the repair operation is done by default (if schema is violated) We can not (and should not) eliminate the schema violation message. But memberof should log a additional warning (beside the schema violation msg) stating it repaired the violation. #### Package Version and Platform Any version #### Steps to reproduce 1. Run the attached testcase #### Actual results [05/Jan/2018:12:46:22.803032331 +0100] - ERR - oc_check_allowed_sv - Entry "cn=user_1,ou=People,dc=example,dc=com" -- attribute "memberOf" not allowed #### Expected results [05/Jan/2018:12:46:22.803032331 +0100] - ERR - oc_check_allowed_sv - Entry "cn=user_1,ou=People,dc=example,dc=com" -- attribute "memberOf" not allowed [05/Jan/2018:12:46:22.803032331 +0100] - WARN - memberof-plugin - Entry "cn=user_1,ou=People,dc=example,dc=com" schema violation caugth - repair operation succeeded
[root@qeos-13 memberof_plugin]# pytest -s -v regression_test.py::test_scheme_violation_errors_logged================================================================ test session starts ================================================================= platform linux -- Python 3.6.3, pytest-3.3.2, py-1.5.2, pluggy-0.6.0 -- /opt/rh/rh-python36/root/usr/bin/python3 cachedir: .cache metadata: {'Python': '3.6.3', 'Platform': 'Linux-3.10.0-837.el7.x86_64-x86_64-with-redhat-7.5-Maipo', 'Packages': {'pytest': '3.3.2', 'py': '1.5.2', 'pluggy': '0.6.0'}, 'Plugins': {'metadata': '1.5.1', 'html': '1.16.1'}} 389-ds-base: 1.3.7.5-14.el7 nss: 3.34.0-4.el7 nspr: 4.17.0-1.el7 openldap: 2.4.44-12.el7 svrcore: 4.1.3-2.el7 INFO:regression_test:pattern = .*oc_check_allowed_sv.*uid=user_,ou=People,dc=example,dc=com.*memberOf.*not allowed.* PASSED [100%] ============================================================= 1 passed in 44.70 seconds ============================================================== [root@qeos-13 memberof_plugin]# tail-f /var/log/dirsrv/slapd-master1/errors bash: tail-f: command not found [root@qeos-13 memberof_plugin]# tail -f /var/log/dirsrv/slapd-master1/errors [29/Jan/2018:02:54:18.493721519 -0500] - INFO - ldbm_instance_config_cachememsize_set - force a minimal value 512000 [29/Jan/2018:02:54:18.502513485 -0500] - NOTICE - ldbm_back_start - found 1882792k physical memory [29/Jan/2018:02:54:18.503637342 -0500] - NOTICE - ldbm_back_start - found 1475504k available [29/Jan/2018:02:54:18.504185702 -0500] - NOTICE - ldbm_back_start - cache autosizing: db cache: 47069k [29/Jan/2018:02:54:18.504747775 -0500] - NOTICE - ldbm_back_start - cache autosizing: userRoot entry cache (1 total): 131072k [29/Jan/2018:02:54:18.505698919 -0500] - NOTICE - ldbm_back_start - cache autosizing: userRoot dn cache (1 total): 65536k [29/Jan/2018:02:54:18.506490075 -0500] - NOTICE - ldbm_back_start - total cache size: 239886172 B; [29/Jan/2018:02:54:18.596097668 -0500] - INFO - slapd_daemon - slapd started. Listening on All Interfaces port 39001 for LDAP requests [29/Jan/2018:02:54:18.692715170 -0500] - ERR - oc_check_allowed_sv - Entry "uid=user_,ou=People,dc=example,dc=com" -- attribute "memberOf" not allowed [29/Jan/2018:02:54:18.694605131 -0500] - WARN - memberof-plugin - Entry uid=user_,ou=People,dc=example,dc=com - schema violation caught - repair operation succeeded Hence marking as verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0811