Bug 2170221
| Summary: | Boolean attributes should be case insensitive [rhel-7.9.z] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Simon Pichugin <spichugi> |
| Component: | 389-ds-base | Assignee: | LDAP Maintainers <idm-ds-dev-bugs> |
| Status: | CLOSED ERRATA | QA Contact: | LDAP QA Team <idm-ds-qe-bugs> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.9 | CC: | bsmejkal, idm-ds-dev-bugs, kpfleming, mreynolds |
| Target Milestone: | rc | Keywords: | Triaged, ZStream |
| Target Release: | 7.9 | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | 389-ds-base-1.3.11.1-1.el7_9 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-03-07 09:55:00 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
===================================================================================== test session starts =====================================================================================
platform linux -- Python 3.6.8, pytest-5.4.3, py-1.11.0, pluggy-0.13.1 -- /usr/bin/python3
cachedir: .pytest_cache
metadata: {'Python': '3.6.8', 'Platform': 'Linux-3.10.0-1160.87.1.el7.x86_64-x86_64-with-redhat-7.9-Maipo', 'Packages': {'pytest': '5.4.3', 'py': '1.11.0', 'pluggy': '0.13.1'}, 'Plugins': {'libfaketime': '0.1.2', 'flaky': '3.7.0', 'metadata': '1.11.0', 'html': '3.2.0'}}
389-ds-base: 1.3.11.1-1.el7_9
nss: 3.79.0-4.el7_9
nspr: 4.34.0-3.1.el7_9
openldap: 2.4.44-25.el7_9
cyrus-sasl: 2.1.26-24.el7_9
FIPS: disabled
rootdir: /mnt/tests/rhds/tests/upstream/ds/dirsrvtests, inifile: pytest.ini
plugins: libfaketime-0.1.2, flaky-3.7.0, metadata-1.11.0, html-3.2.0
collected 6 items
dirsrvtests/tests/suites/syntax/acceptance_test.py::test_valid PASSED [ 16%]
dirsrvtests/tests/suites/syntax/acceptance_test.py::test_invalid_uidnumber PASSED [ 33%]
dirsrvtests/tests/suites/syntax/acceptance_test.py::test_invalid_dn_syntax_crash PASSED [ 50%]
dirsrvtests/tests/suites/syntax/acceptance_test.py::test_dn_syntax_spaces_delete[props0-cn=\\20leadingSpace,ou=Groups,dc=example,dc=com] PASSED [ 66%]
dirsrvtests/tests/suites/syntax/acceptance_test.py::test_dn_syntax_spaces_delete[props1-cn=trailingSpace\\20,ou=Groups,dc=example,dc=com] PASSED [ 83%]
dirsrvtests/tests/suites/syntax/acceptance_test.py::test_boolean_case PASSED [100%]
===================================================================================== 6 passed in 54.35s ======================================================================================
Hence marking Verified: Tested.
As per comment #c6 marking as VERIFIED. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (389-ds-base bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:1100 |
Issue Description RFC 4517 #3.3.3 defines the Boolean Attribute with OID 1.3.6.1.4.1.1466.115.121.1.7 in the ABNF Boolean = "TRUE" / "FALSE" RFC 4517 #3.3.3 refers to RFC 4512 #1.4 for the syntax definition, which further refers to RFC 4234 which defines ABNF as an case insensitive syntax - as does RFC 7405 #1 which enhances RFC 4234 with a case sensitive description. Package Version and Platform: RHEL 7.9 Package and version: 389-ds-base-1.3.10.2-16.el7_9.x86_64 Browser firefox Steps to reproduce the behavior: To a default installation add the following schema definition [user@host ~]$ sudo -- cat /etc/dirsrv/slapd-ldap1-dev/schema/99user.ldif # user schema ################################################################################ dn: cn=schema # ################################################################################ # attributetypes: ( 1.3.6.1.4.1.59369.1.1 NAME 'emailVerified' DESC 'User has successfully verified his/her current email' SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE USAGE userApplications X-ORIGIN ('APA-IT defined' 'user defined') ) # ################################################################################ # objectclasses: ( 1.3.6.1.4.1.59369.2.1 NAME 'apaitIamPerson' SUP inetOrgPerson AUXILIARY MAY (emailVerified) X-ORIGIN ('APA-IT defined' 'user defined') ) [user@host ~]$ Create at some path an apaitIamPerson object without our new attribute Try to run ldapmodify with the following input [user@host ~]$ cat meins.ldif dn: uid=user,ou=users,dc=top changetype: modify replace: emailVerified emailVerified: false - [user@host ~]$ ds-389 will respond with ldap_initialize( ldaps://host:636/??base ) replace emailVerified: false modifying entry "uid=user,ou=users,dc=top" ldap_modify: Invalid syntax (21) additional info: emailVerified: value #0 invalid per syntax Expected results Boolean values are treated case-insensitive ldap_initialize( ldaps://host:636/??base ) replace emailVerified: false modifying entry "dn: uid=user,ou=users,dc=top" modify complete Additional context ds-389 is used as user federation storage in our Keycloak (KC) installation configured with vendor typ rhds. KC 19.0.3 sends lowercase bools - at least for the emailVerified user attribute - which are unfortunately rejected.