Bug 566320 - RFE: add exception to removal of attributes in cn=config for aci
Summary: RFE: add exception to removal of attributes in cn=config for aci
Status: CLOSED DUPLICATE of bug 853106
Alias: None
Product: 389
Classification: Retired
Component: Directory Server
Version: 1.2.1
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Rich Megginson
QA Contact: Chandrasekar Kannan
URL:
Whiteboard:
Keywords:
Depends On:
Blocks: 389_1.2.6 639035
TreeView+ depends on / blocked
 
Reported: 2010-02-17 21:50 UTC by Rob Crittenden
Modified: 2015-01-04 23:41 UTC (History)
5 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2012-11-07 18:06:18 UTC


Attachments (Terms of Use)
0001-Bug-566320-RFE-add-exception-to-removal-of-attribute.patch (1.89 KB, patch)
2010-03-26 17:33 UTC, Endi Sukma Dewata
rmeggins: review+
Details | Diff

Description Rob Crittenden 2010-02-17 21:50:53 UTC
Description of problem:

It is not possible to do an online deletion of an attribute from cn=config (probably a good thing).

It would be nice to be able to have an exception that acis can be removed online.

Version-Release number of selected component (if applicable):

389-ds-base-1.2.3-1.fc12.x86_64

Comment 2 Endi Sukma Dewata 2010-03-26 17:33:24 UTC
Created attachment 402899 [details]
0001-Bug-566320-RFE-add-exception-to-removal-of-attribute.patch

The modify_config_dse() has been modified to check the ignore_attr_type() for all types of modify operation.

Comment 3 Rich Megginson 2010-03-26 17:50:40 UTC
To ssh://git.fedorahosted.org/git/389/ds.git
   48d50e8..6e839e9  master -> master

commit 6e839e9cc2acb957dc3435ee46aa9d2942cf1bcc
Author: Endi S. Dewata <edewata@redhat.com>
Date:   Mon Mar 22 17:53:33 2010 -0500
    Fix description: The modify_config_dse() has been modified to
    check the ignore_attr_type() for all types of modify operation.
    Reviewed by: rmeggins (and pushed by)

Comment 4 Amita Sharma 2011-09-12 10:32:58 UTC
which attribute should I try deleting from config?
Please guide.

Comment 5 Rich Megginson 2011-09-12 15:29:35 UTC
The only attributes allowed to be deleted at this time are nsslapd-listenhost and nsslapd-securelistenhost

Comment 8 Rich Megginson 2011-09-14 14:13:38 UTC
I just tried to reproduce - it works fine for me - please also confirm what version of 389-ds-base you are using.

Comment 9 Amita Sharma 2011-09-16 07:15:44 UTC
[root@snmaptest ~]# rpm -qa | grep 389
389-adminutil-1.1.14-1.el6.x86_64
389-adminutil-devel-1.1.14-1.el6.x86_64
389-ds-base-1.2.8.2-1.el6_1.12.x86_64
389-console-1.1.7-1.el6.noarch
389-ds-base-libs-1.2.8.2-1.el6_1.12.x86_64

What is wrong here:
============================
[root@snmaptest ~]# ldapmodify -x -D "cn=directory manager" -w Secret123 -p 34206 -h localhost << EOF
dn: cn=config
changetype: modify
delete: nsslapd-listenhost
EOF

modifying entry "cn=config"
ldap_modify: No such attribute (16)

[root@snmaptest ~]# ldapmodify -x -D "cn=directory manager" -w Secret123 -p 34206 -h localhost << EOF
dn: cn=config
changetype: modify
delete: nsslapd-allowed-to-delete-attrs
EOF

modifying entry "cn=config"
ldap_modify: Server is unwilling to perform (53)
	additional info: Deleting attributes is not allowed

[root@snmaptest ~]# ldapmodify -x -D "cn=directory manager" -w Secret123 -p 34206 -h localhost << EOF
dn: cn=config
changetype: modify
delete: nsslapd-securelistenhost       
EOF

modifying entry "cn=config"
ldap_modify: No such attribute (16)

[root@snmaptest ~]# tail -f /var/log/dirsrv/slapd-c1/access
[16/Sep/2011:12:38:59 +051800] conn=39 op=1 RESULT err=53 tag=103 nentries=0 etime=0
[16/Sep/2011:12:38:59 +051800] conn=39 op=2 UNBIND
[16/Sep/2011:12:38:59 +051800] conn=39 op=2 fd=64 closed - U1
[16/Sep/2011:12:39:18 +051800] conn=40 fd=64 slot=64 connection from ::1 to ::1
[16/Sep/2011:12:39:18 +051800] conn=40 op=0 BIND dn="cn=directory manager" method=128 version=3
[16/Sep/2011:12:39:18 +051800] conn=40 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager"
[16/Sep/2011:12:39:18 +051800] conn=40 op=1 MOD dn="cn=config"
[16/Sep/2011:12:39:18 +051800] conn=40 op=2 UNBIND
[16/Sep/2011:12:39:18 +051800] conn=40 op=2 fd=64 closed - U1
[16/Sep/2011:12:39:18 +051800] conn=40 op=1 RESULT err=16 tag=103 nentries=0 etime=0
^C
[root@snmaptest ~]# tail -f /var/log/dirsrv/slapd-c1/errors
[15/Sep/2011:17:40:30 +051800] - Waiting for 4 database threads to stop
[15/Sep/2011:17:40:31 +051800] - All database threads now stopped
[15/Sep/2011:17:40:31 +051800] - slapd stopped.
[15/Sep/2011:17:40:39 +051800] - 389-Directory/1.2.8.10 B2011.244.2149 starting up
[15/Sep/2011:17:40:39 +051800] - slapd started.  Listening on All Interfaces port 34206 for LDAP requests
[15/Sep/2011:17:40:39 +051800] - Listening on All Interfaces port 34216 for LDAPS requests
[16/Sep/2011:11:56:18 +051800] chaining database - Insufficient 'add' privilege to add the entry 'uid=sghai1,ou=people,o=airius.com'.

[16/Sep/2011:12:38:42 +051800] - Warning: Deleting configuration attribute "nsslapd-listenhost"
[16/Sep/2011:12:39:18 +051800] - Warning: Deleting configuration attribute "nsslapd-securelistenhost"
^C
[root@snmaptest ~]# ldapsearch -h localhost -p 34206 -D "cn=directory manager" -w Secret123 -b "cn=config" | grep nsslapd-listenhost
nsslapd-listenhost:
nsslapd-allowed-to-delete-attrs: nsslapd-listenhost nsslapd-securelistenhost

Comment 10 Rich Megginson 2011-09-16 14:46:24 UTC
(In reply to comment #9)
> [root@snmaptest ~]# rpm -qa | grep 389
> 389-adminutil-1.1.14-1.el6.x86_64
> 389-adminutil-devel-1.1.14-1.el6.x86_64
> 389-ds-base-1.2.8.2-1.el6_1.12.x86_64
> 389-console-1.1.7-1.el6.noarch
> 389-ds-base-libs-1.2.8.2-1.el6_1.12.x86_64
> 
> What is wrong here:
> ============================
> [root@snmaptest ~]# ldapmodify -x -D "cn=directory manager" -w Secret123 -p
> 34206 -h localhost << EOF
> dn: cn=config
> changetype: modify
> delete: nsslapd-listenhost
> EOF
> 
> modifying entry "cn=config"
> ldap_modify: No such attribute (16)
> 
> [root@snmaptest ~]# ldapmodify -x -D "cn=directory manager" -w Secret123 -p
> 34206 -h localhost << EOF
> dn: cn=config
> changetype: modify
> delete: nsslapd-allowed-to-delete-attrs
> EOF
> 
> modifying entry "cn=config"
> ldap_modify: Server is unwilling to perform (53)
>  additional info: Deleting attributes is not allowed
> 
> [root@snmaptest ~]# ldapmodify -x -D "cn=directory manager" -w Secret123 -p
> 34206 -h localhost << EOF
> dn: cn=config
> changetype: modify
> delete: nsslapd-securelistenhost       
> EOF
> 
> modifying entry "cn=config"
> ldap_modify: No such attribute (16)
> 
> [root@snmaptest ~]# tail -f /var/log/dirsrv/slapd-c1/access
> [16/Sep/2011:12:38:59 +051800] conn=39 op=1 RESULT err=53 tag=103 nentries=0
> etime=0
> [16/Sep/2011:12:38:59 +051800] conn=39 op=2 UNBIND
> [16/Sep/2011:12:38:59 +051800] conn=39 op=2 fd=64 closed - U1
> [16/Sep/2011:12:39:18 +051800] conn=40 fd=64 slot=64 connection from ::1 to ::1
> [16/Sep/2011:12:39:18 +051800] conn=40 op=0 BIND dn="cn=directory manager"
> method=128 version=3
> [16/Sep/2011:12:39:18 +051800] conn=40 op=0 RESULT err=0 tag=97 nentries=0
> etime=0 dn="cn=directory manager"
> [16/Sep/2011:12:39:18 +051800] conn=40 op=1 MOD dn="cn=config"
> [16/Sep/2011:12:39:18 +051800] conn=40 op=2 UNBIND
> [16/Sep/2011:12:39:18 +051800] conn=40 op=2 fd=64 closed - U1
> [16/Sep/2011:12:39:18 +051800] conn=40 op=1 RESULT err=16 tag=103 nentries=0
> etime=0
> ^C
> [root@snmaptest ~]# tail -f /var/log/dirsrv/slapd-c1/errors
> [15/Sep/2011:17:40:30 +051800] - Waiting for 4 database threads to stop
> [15/Sep/2011:17:40:31 +051800] - All database threads now stopped
> [15/Sep/2011:17:40:31 +051800] - slapd stopped.
> [15/Sep/2011:17:40:39 +051800] - 389-Directory/1.2.8.10 B2011.244.2149 starting
> up
> [15/Sep/2011:17:40:39 +051800] - slapd started.  Listening on All Interfaces
> port 34206 for LDAP requests
> [15/Sep/2011:17:40:39 +051800] - Listening on All Interfaces port 34216 for
> LDAPS requests
> [16/Sep/2011:11:56:18 +051800] chaining database - Insufficient 'add' privilege
> to add the entry 'uid=sghai1,ou=people,o=airius.com'.
> 
> [16/Sep/2011:12:38:42 +051800] - Warning: Deleting configuration attribute
> "nsslapd-listenhost"
> [16/Sep/2011:12:39:18 +051800] - Warning: Deleting configuration attribute
> "nsslapd-securelistenhost"
> ^C
> [root@snmaptest ~]# ldapsearch -h localhost -p 34206 -D "cn=directory manager"
> -w Secret123 -b "cn=config" | grep nsslapd-listenhost
> nsslapd-listenhost:
> nsslapd-allowed-to-delete-attrs: nsslapd-listenhost nsslapd-securelistenhost

This is as expected.  Since the attribute has no value
nsslapd-listenhost:
you cannot delete it, and it returns the correct error code No such attribute (16).

Try this:
stop slapd
edit dse.ldif - add nsslapd-listenhost: localhost
start slapd
do ldapsearch to confirm the value is listed 
then ldapmodify to delete the value

Comment 11 Amita Sharma 2011-09-21 06:48:58 UTC
[root@snmaptest ~]# ldapsearch -h localhost -p 34206 -D "cn=directory manager" -w Secret123 -b "cn=config" | grep nsslapd-listenhost
nsslapd-listenhost: localhost
nsslapd-allowed-to-delete-attrs: nsslapd-listenhost nsslapd-securelistenhost
[root@snmaptest ~]# ldapmodify -x -D "cn=directory manager" -w Secret123 -p 34206 -h localhost << EOF
> dn: cn=config
> changetype: modify
> delete: nsslapd-listenhost
> EOF
modifying entry "cn=config"

[root@snmaptest ~]# ldapsearch -h localhost -p 34206 -D "cn=directory manager" -w Secret123 -b "cn=config" | grep nsslapd-listenhost
nsslapd-listenhost: localhost
nsslapd-allowed-to-delete-attrs: nsslapd-listenhost nsslapd-securelistenhost
[root@snmaptest ~]# ldapsearch -h localhost -p 34206 -D "cn=directory manager" -w Secret123 -b "cn=config" | grep nsslapd-listenhost
nsslapd-listenhost: localhost
nsslapd-allowed-to-delete-attrs: nsslapd-listenhost nsslapd-securelistenhost
[root@snmaptest ~]# tail -f /var/log/dirsrv/slapd-c1/errors
[21/Sep/2011:12:01:43 +051800] - slapd shutting down - signaling operation threads
[21/Sep/2011:12:01:43 +051800] - slapd shutting down - closing down internal subsystems and plugins
[21/Sep/2011:12:01:43 +051800] - Waiting for 4 database threads to stop
[21/Sep/2011:12:01:43 +051800] - All database threads now stopped
[21/Sep/2011:12:01:43 +051800] - slapd stopped.
[21/Sep/2011:12:02:46 +051800] - 389-Directory/1.2.9.11 B2011.259.2023 starting up
[21/Sep/2011:12:02:46 +051800] - slapd started.  Listening on IPv6 Loopback port 34206 for LDAP requests
[21/Sep/2011:12:02:47 +051800] - Listening on Loopback port 34206 for LDAP requests
[21/Sep/2011:12:02:47 +051800] - Listening on All Interfaces port 34216 for LDAPS requests
[21/Sep/2011:12:03:01 +051800] - Warning: Deleting configuration attribute "nsslapd-listenhost"
^C
[root@snmaptest ~]# tail -f /var/log/dirsrv/slapd-c1/access
[21/Sep/2011:12:03:04 +051800] conn=3 op=1 RESULT err=0 tag=101 nentries=193 etime=0
[21/Sep/2011:12:03:04 +051800] conn=3 op=2 UNBIND
[21/Sep/2011:12:03:04 +051800] conn=3 op=2 fd=64 closed - U1
[21/Sep/2011:12:03:23 +051800] conn=4 fd=64 slot=64 connection from ::1 to ::1
[21/Sep/2011:12:03:23 +051800] conn=4 op=0 BIND dn="cn=directory manager" method=128 version=3
[21/Sep/2011:12:03:23 +051800] conn=4 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager"
[21/Sep/2011:12:03:23 +051800] conn=4 op=1 SRCH base="cn=config" scope=2 filter="(objectClass=*)" attrs=ALL
[21/Sep/2011:12:03:23 +051800] conn=4 op=1 RESULT err=0 tag=101 nentries=193 etime=0
[21/Sep/2011:12:03:23 +051800] conn=4 op=2 UNBIND
[21/Sep/2011:12:03:23 +051800] conn=4 op=2 fd=64 closed - U1
^C
[root@snmaptest ~]# rpm -qa | grep 389
389-adminutil-1.1.14-1.el6.x86_64
389-adminutil-devel-1.1.14-1.el6.x86_64
389-ds-base-libs-1.2.9.11-1.el6.x86_64
389-console-1.1.7-1.el6.noarch
389-ds-base-1.2.9.11-1.el6.x86_64
[root@snmaptest ~]# rpm -qf `which setup-ds.pl`
389-ds-base-1.2.9.11-1.el6.x86_64

But then I restarted the Instances, and then It got actually deleted which is not online :(
[root@snmaptest ~]# ldapsearch -h localhost -p 34206 -D "cn=directory manager" -w Secret123 -b "cn=config" | grep nsslapd-listenhost
nsslapd-listenhost: localhost
nsslapd-allowed-to-delete-attrs: nsslapd-listenhost nsslapd-securelistenhost
[root@snmaptest ~]# service dirsrv restart
Shutting down dirsrv: 
    c1...                                                  [  OK  ]
    c2...                                                  [  OK  ]
    s1...                                                  [  OK  ]
    s2...                                                  [  OK  ]
    snmaptest...                                           [  OK  ]
Starting dirsrv: 
    c1...                                                  [  OK  ]
    c2...                                                  [  OK  ]
    s1...                                                  [  OK  ]
    s2...                                                  [  OK  ]
    snmaptest...                                           [  OK  ]
[root@snmaptest ~]# ldapsearch -h localhost -p 34206 -D "cn=directory manager" -w Secret123 -b "cn=config" | grep nsslapd-listenhost
nsslapd-listenhost:
nsslapd-allowed-to-delete-attrs: nsslapd-listenhost nsslapd-securelistenhost

Please help?

Comment 12 Amita Sharma 2011-09-21 08:10:35 UTC
Thanks to mniranja@redhat.com for highlighting more imp points here :

1. If I re-delete the attribute without a restart, It will give me error as "No such attribute" , but ldapsearch will show the attribute as below:

a). Set the attribute first:
[root@snmaptest ~]# ldapsearch -h localhost -p 34206 -D "cn=directory manager" -w Secret123 -b "cn=config" | grep nsslapd-listenhost
nsslapd-listenhost: localhost
nsslapd-allowed-to-delete-attrs: nsslapd-listenhost nsslapd-securelistenhost

b). Delete the attribute first time:
ldapmodify -x -D "cn=directory manager" -w Secret123 -p 34206 -h localhost << EOF
> dn: cn=config
> changetype: modify
> delete: nsslapd-listenhost
> EOF
modifying entry "cn=config"

c). Try to delete again :
[root@snmaptest ~]# ldapmodify -D "cn=Directory Manager" -w Secret123 -h localhost -p 34206 << EOF
> dn: cn=config
> changetype: modify
> delete: nsslapd-listenhost
> EOF
modifying entry "cn=config"
ldap_modify: No such attribute (16)

d). Try to search the attribute, :
ldapsearch -h localhost -p 34206 -D "cn=directory manager" -w Secret123 -b "cn=config" | grep nsslapd-listenhost
nsslapd-listenhost: localhost
nsslapd-allowed-to-delete-attrs: nsslapd-listenhost nsslapd-securelistenhost

* This is the inconsistency between ldapsearch and ldapdelete.

2. There are few questions :
a. nsslapd-listenhost is the attribute which says that on which hostname the slapd is listening, so when we remove the attribute online, it would still work because slapd is already started using that hostname. Though we are not sure why one would want to delete that attribute,  (as in what's the use case here) 

b. Initially Rob wanted to that for ACI (chk https://bugzilla.redhat.com/show_bug.cgi?id=566320#c0), how these attributes - nsslapd-listenhost nsslapd-securelistenhost, are connected to the acis?

Please guide.

Thanks,
Amita

Comment 13 Rich Megginson 2011-09-21 15:09:30 UTC

(In reply to comment #12)
> Thanks to mniranja@redhat.com for highlighting more imp points here :
> 
> 1. If I re-delete the attribute without a restart, It will give me error as "No
> such attribute" , but ldapsearch will show the attribute as below:
> 
> a). Set the attribute first:
> [root@snmaptest ~]# ldapsearch -h localhost -p 34206 -D "cn=directory manager"
> -w Secret123 -b "cn=config" | grep nsslapd-listenhost
> nsslapd-listenhost: localhost
> nsslapd-allowed-to-delete-attrs: nsslapd-listenhost nsslapd-securelistenhost
> 
> b). Delete the attribute first time:
> ldapmodify -x -D "cn=directory manager" -w Secret123 -p 34206 -h localhost <<
> EOF
> > dn: cn=config
> > changetype: modify
> > delete: nsslapd-listenhost
> > EOF
> modifying entry "cn=config"
> 
> c). Try to delete again :
> [root@snmaptest ~]# ldapmodify -D "cn=Directory Manager" -w Secret123 -h
> localhost -p 34206 << EOF
> > dn: cn=config
> > changetype: modify
> > delete: nsslapd-listenhost
> > EOF
> modifying entry "cn=config"
> ldap_modify: No such attribute (16)
> 
> d). Try to search the attribute, :
> ldapsearch -h localhost -p 34206 -D "cn=directory manager" -w Secret123 -b
> "cn=config" | grep nsslapd-listenhost
> nsslapd-listenhost: localhost
> nsslapd-allowed-to-delete-attrs: nsslapd-listenhost nsslapd-securelistenhost
> 
> * This is the inconsistency between ldapsearch and ldapdelete.
> 
> 2. There are few questions :
> a. nsslapd-listenhost is the attribute which says that on which hostname the
> slapd is listening, so when we remove the attribute online, it would still work
> because slapd is already started using that hostname. Though we are not sure
> why one would want to delete that attribute,  (as in what's the use case here) 

Ok - looks like the bug wasn't completely fixed.  The attribute is deleted, and it will not be in dse.ldif/cn=config upon restart, but it still shows up in ldapsearch after deletion.  So we need to reopen this bug in order to fix the ldapsearch issue.

> 
> b. Initially Rob wanted to that for ACI (chk
> https://bugzilla.redhat.com/show_bug.cgi?id=566320#c0), how these attributes -
> nsslapd-listenhost nsslapd-securelistenhost, are connected to the acis?

acis are handled separately, by a different part of the code, so you should be able to add/modify/delete acis without being affected by this bug.

> 
> Please guide.
> 
> Thanks,
> Amita

Comment 14 Amita Sharma 2011-09-27 07:16:14 UTC
as Rich suggested to mark it as assigned hence marking it as assigned.

Comment 15 Martin Kosek 2012-01-04 13:40:34 UTC
Upstream ticket:
https://fedorahosted.org/389/ticket/92

Comment 16 Noriko Hosoi 2012-11-07 18:06:18 UTC
Please see also https://fedorahosted.org/389/ticket/92.

*** This bug has been marked as a duplicate of bug 853106 ***


Note You need to log in before you can comment on or make changes to this bug.