Bug 1990000 - Attribute Uniqueness Plugin uses wrong subtree on ModRDN
Summary: Attribute Uniqueness Plugin uses wrong subtree on ModRDN
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Directory Server
Classification: Red Hat
Component: 389-ds-base
Version: 11.4
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: DS11.2
: dirsrv-11.5
Assignee: Simon Pichugin
QA Contact: RHDS QE
Marc Muehlfeld
URL:
Whiteboard: sync-to-jira
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2021-08-04 14:21 UTC by mreynolds
Modified: 2022-08-23 17:42 UTC (History)
3 users (show)

Fixed In Version: redhat-ds-11-8050020210917175916.d3df4063
Doc Type: Bug Fix
Doc Text:
Cause: Using the Attribute uniqueness plugin, restricted to one subtree, moving an object with an already existing attribute to this subtree. Consequence: It does not raise any exceptions. It appears that the originating subtree is searched instead. It should raise an exception because the Attribute uniqueness plugin was configured. Fix: On the server-side, make sure that parent and target DNs are searched correctly for the unique. Result: Attribute uniqueness plugin behaves correctly while performing modrdn operation.
Clone Of:
Environment:
Last Closed: 2022-08-23 17:42:21 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github 389ds 389-ds-base issues 4763 0 None None None 2021-09-02 15:56:17 UTC
Red Hat Issue Tracker IDMDS-1530 0 None None None 2021-08-04 14:25:06 UTC
Red Hat Issue Tracker IDMDS-1564 0 None None None 2021-08-24 15:36:54 UTC

Description mreynolds 2021-08-04 14:21:06 UTC
Issue Description
When using the Attribute uniqueness plugin, restricted to one subtree, moving an object with an already existing attribute to this subtree does not raise any exceptions. It appears that the originating subtree is searched instead.

Package Version and Platform:

Platform: Containerized Fedora (tested on 33 and 34)
Package and version: Tested with all versions >= 2.0.2

Steps to Reproduce

Create two container objects e.g ou=c1,dc=example,dc=com and ou=c2,dc=example,dc=com
Create an entry for the attr-uniq plugin restricted to the c1 subtree, restricting (for example) the mail attribute.
Create two objects with the same value for mail in c2 (this should be allowed).
Move one object to c1
Move the second object to c1. This should raise an exeption as another object with the same value for mail already exists in c1 but works without issues.

Additionally, trying to move one of these objects back to c2 raises an exception even though there is no uniqueness constraint on c2.

Expected results
The attr-uniq plugin should prevent invalid move operations.

Additional context

I've tried to get to the root cause of this issue, and debug logs suggest that https://github.com/389ds/389-ds-base/blob/master/ldap/servers/plugins/uiduniq/uid.c#L1395 is called with the old parentDN. However, as this is my first time digging through the codebase I was unable to figure out why this happens.

Comment 1 mreynolds 2021-08-04 14:23:58 UTC
Upstream ticket:

https://github.com/389ds/389-ds-base/issues/4763

Comment 2 Petr Čech 2022-05-25 12:16:07 UTC
As the RHEL 8.5 reached EOL, it makes sense to move this BZ to dirsrv-11.5, which means RHEL 8.6.


Note You need to log in before you can comment on or make changes to this bug.