Bug 247413 - Incorrect error on multiple identical value add
Incorrect error on multiple identical value add
Status: CLOSED CURRENTRELEASE
Product: 389
Classification: Community
Component: Database - General (Show other bugs)
1.1.0
All Linux
medium Severity low
: ---
: ---
Assigned To: Noriko Hosoi
Viktor Ashirov
: Reopened
Depends On:
Blocks: 434914 389_1.3.0
  Show dependency treegraph
 
Reported: 2007-07-09 02:04 EDT by Andrew Bartlett
Modified: 2015-12-07 11:42 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-12-07 11:42:46 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
git diff ldap/servers/slapd/valueset.c (1.68 KB, patch)
2010-01-27 20:21 EST, Noriko Hosoi
nhosoi: review?
rmeggins: review+
Details | Diff

  None (edit)
Description Andrew Bartlett 2007-07-09 02:04:15 EDT
Description of problem:
When performing an ldapmodify such as:  

dn: cn=ldaptest2computer,cn=computers," + base_dn + "
changetype: modify
replace: servicePrincipalName
servicePrincipalName: host/ldaptest2computer
servicePrincipalName: host/ldaptest2computer
servicePrincipalName: cifs/ldaptest2computer

The error return is LDAP_OPERATIONS_ERROR not LDAP_TYPE_OR_VALUE_EXISTS

Version-Release number of selected component (if applicable):
cvs

How reproducible:
every time (using samba testsuite)

Steps to Reproduce:
1. build Samba4
2. TEST_LDAP=yes FEDORA_DS_PREFIX=/path/to/fedora-ds make test TESTS="ejs ldap"
3. failure in ejs ldap script.  
  
Actual results:
Incorrect error code, asserting in ldap.js script

Expected results:
Samba's assertion on correct error return should pass

Additional info:

It appears that the routines try and return the correct error in this case, but
somthing goes wrong.  I've not debugged that part yet, nor split this down into
a smaller testcase.
Comment 4 Noriko Hosoi 2008-12-11 20:15:48 EST
I'm running the test on the server built from the latest source code on Fedora-9.  It looks the similar test returns the expected error code LDAP_TYPE_OR_VALUE_EXISTS.

$ ldapmodify -D "cn=Directory Manager" -w <pw>
dn: uid=AThorne515, ou=Product Development, dc=example,dc=com
changetype: modify
replace: description
description: description 1
description: description 1
description: description 2

modifying entry uid=AThorne515, ou=Product Development, dc=example,dc=com
ldap_modify: Type or value exists

Is this bug still observed in your environment?  If yes, can we have more details to reproduce the problem such as the schema for servicePrincipalName?

Thanks and sorry for this slow response...
--noriko
Comment 5 Andrew Bartlett 2009-01-06 22:59:22 EST
Sadly the scripts we use to initialise a Fedora DS backed in Samba4 have since broken, so this test is harder to reproduce.  

I suspect the next step would be to checkout Samba4 from the date of the report, and hope it can still setup a modern Fedora DS.
Comment 6 Noriko Hosoi 2009-01-15 18:33:53 EST
Thank you for the update, Andrew.  Any luck to restore the script?

We are having a final bug council for DS8.1 tomorrow (1/16).  If we miss it, the target of this bug would be 8.2...
Comment 7 Chandrasekar Kannan 2009-01-19 19:12:12 EST
per bug council, closing with insufficient_data
Comment 8 Andrew Bartlett 2009-02-01 18:40:59 EST
I've been away at conferences and a well-earned holiday, so I've not had any time to look into this.  

Seeing that there is interest in trying to fix this one day, I would like to keep this open and hope I get the time to check out the test script.
Comment 9 Rich Megginson 2009-04-09 13:50:29 EDT
I'm assuming this feature is required for AD/Samba4 integration
Comment 10 Noriko Hosoi 2009-08-19 16:22:12 EDT
Hi Andrew,

389 Directory Server 1.2.1 has been released.  Could it be possible to run your test script against the newly released version?  
Thanks a lot, in advance...
--noriko

http://directory.fedoraproject.org/
389 Directory Server 1.2.1 is now available (August 17, 2009)

We are pleased to announce the availability of 389 Directory Server 1.2.1. This is the first officially branded 389 release. The binary packages available for download will replace the Fedora DS packages when installed with yum. This release contains several new features and several bug fixes.

    * See the Release Notes for more information
Comment 11 Andrew Bartlett 2009-08-24 19:10:30 EDT
As soon as Endi makes Samba4's make test run against Fedora DS again, we should be able to test this pretty easily.
Comment 12 Endi Sukma Dewata 2010-01-25 18:36:02 EST
Hi, the problem seems to reappear on the latest DS from repository (1.2.6.a1.git0e9fd8b) on F12.

To reproduce the problem add the following entry into DS:

$ ldapadd -h localhost -p 389 -x -D "cn=Directory Manager" -w Secret123
dn: ou=test,dc=example,dc=com
objectClass: organizationalUnit
ou: test

Then replace an attribute with multiple identical value:

$ ldapmodify -h localhost -p 389 -x -D "cn=Directory Manager" -w Secret123
dn: ou=test,dc=example,dc=com
changetype: modify
replace: description
description: test
description: test

modifying entry "ou=test,dc=example,dc=com"
ldap_modify: Operations error (1)

Note that the return value is "Operations error" instead of "Type or value exists".
Comment 13 Noriko Hosoi 2010-01-27 20:21:18 EST
Created attachment 387210 [details]
git diff ldap/servers/slapd/valueset.c

[Fix Description] API valueset_replace used to override any
error from the lower layer with LDAP_OPERATIONS_ERROR. If
the error is LDAP_TYPE_OR_VALUE_EXISTS, the error is now
returned as is.
Comment 14 Rich Megginson 2010-01-27 23:03:12 EST
Comment on attachment 387210 [details]
git diff ldap/servers/slapd/valueset.c

Looks good.

Are there perhaps other LDAP error codes that could be returned by valuetree_add_valuearray() that we don't want to override?
Comment 15 Noriko Hosoi 2010-01-28 13:04:54 EST
I tried several error cases.  It looks the server is returning valid errors.  Could there be any other cases I'd better try before checking this in?

1) replace an attribute (non-existing) with multiple identical values (this bug)
dn: uid=LNestor999,ou=Product Development,dc=example,dc=com
changetype: modify
replace: description  
description: test
description: test

modifying entry uid=LNestor999,ou=Product Development,dc=example,dc=com
ldap_modify: Type or value exists
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
2) modify non-existing entry
dn: uid=LNestor,ou=Product Development,dc=example,dc=com
changetype: modify
add: description
description: test
description: test

modifying entry uid=LNestor,ou=Product Development,dc=example,dc=com
ldap_modify: No such object
ldap_modify: matched: ou=product development,dc=example,dc=com
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
3) add an attribute-value pair (existing)
dn: uid=LNestor999,ou=Product Development,dc=example,dc=com
changetype: modify
add: description 
description: test

modifying entry uid=LNestor999,ou=Product Development,dc=example,dc=com
ldap_modify: Type or value exists
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
4) delete a non-existing attribute value pair
dn: uid=LNestor999,ou=Product Development,dc=example,dc=com
changetype: modify
delete: description
description: test

modifying entry uid=LNestor999,ou=Product Development,dc=example,dc=com
ldap_modify: No such attribute
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
5) add/replace a not-allowed attribute type
dn: uid=LNestor999,ou=Product Development,dc=example,dc=com
changetype: modify
replace: owner
owner: test

modifying entry uid=LNestor999,ou=Product Development,dc=example,dc=com
ldap_modify: Object class violation
ldap_modify: additional info: attribute "owner" not allowed
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
6) add/replace a non-UTF8 characters
dn: uid=LNestor999,ou=Product Development,dc=example,dc=com
changetype: modify
replace: description
description: ニュース特集

modifying entry uid=LNestor999,ou=Product Development,dc=example,dc=com
ldap_modify: Invalid syntax
ldap_modify: additional info: description: value #0 invalid per syntax
Comment 16 Rich Megginson 2010-01-28 13:30:04 EST
Ok - looks good.  Looks like the only return values from valuetree_add_valuearray() are one of those LDAP error codes.
Comment 17 Noriko Hosoi 2010-01-28 13:39:22 EST
Thanks to Rich for his reviews and comments.

Pushed to master.

$ git merge work
Updating 3fdcbdd..246527f
Fast forward
 ldap/servers/slapd/valueset.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)
$ git push
Counting objects: 11, done.
Delta compression using 4 threads.
Compressing objects: 100% (6/6), done.
Writing objects: 100% (6/6), 928 bytes, done.
Total 6 (delta 4), reused 0 (delta 0)
To ssh://git.fedorahosted.org/git/389/ds.git
   3fdcbdd..246527f  master -> master
Comment 18 Jenny Galipeau 2010-06-01 15:11:54 EDT
verified - RHEL 4

version:
redhat-ds-base-8.2.0-2010053104.el4dsrv

1.  added ou
ldapmodify -x -h jgalipea-rhel4.idm.lab.bos.redhat.com -p 389 -D "cn=Directory Manager" -w Secret123 -ac -f addou.ldif
adding new entry "ou=test,dc=example,dc=com"

2. ldapmodify -x -h jgalipea-rhel4.idm.lab.bos.redhat.com -p 389 -D "cn=Directory Manager" -w Secret123 -f modifyou.ldif 
modifying entry "ou=test,dc=example,dc=com"
ldap_modify: Type or value exists (20)

Note You need to log in before you can comment on or make changes to this bug.