Bug 837039 - mod_ldap caches negative results [NEEDINFO]
mod_ldap caches negative results
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: httpd (Show other bugs)
i386 Linux
unspecified Severity low
: rc
: ---
Assigned To: Web Stack Team
BaseOS QE - Apps
Depends On:
Blocks: 1049888
  Show dependency treegraph
Reported: 2012-07-02 11:02 EDT by Tessio F
Modified: 2014-02-04 10:06 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2013-12-02 10:52:03 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
jkaluza: needinfo? (tessiof)

Attachments (Terms of Use)

  None (edit)
Description Tessio F 2012-07-02 11:02:23 EDT
Description of problem: mod_ldap caches negative results, unlike specified in documentation: "Negative results (i.e., unsuccessful searches, or searches that did not result in a successful bind) are not cached."

Version-Release number of selected component (if applicable):

How reproducible: See steps below.

Steps to Reproduce:
1.Configure ldap authentication with mod_authnz_ldap. Set require ldap-group. Restart httpd. 
2. Try to log with user1 that do not belong to group. Log with authorized user2 (ie. belongs to group).
3. Put user1 in group and try again. Log fails. tcpdump show no LDAP authentication attempt. 
4. Repeat 2-3 with LDAPCacheEntries set to 0. Everything work as expected.
Actual results: mod_ldap caches negative results

Expected results: do not cache negative results

Additional info:
Comment 1 Joe Orton 2012-07-02 11:50:55 EDT
Hi, please confirm the package version used, and note that Bugzilla is not a support mechanism - if you need help with production support issues please contact Red Hat Support.
Comment 2 Tessio F 2012-07-03 10:39:07 EDT
Package: mod_authz_ldap-0.26-11.el5.i386

I'm not asking for support, I'm only saying that it works differently than documented.. so it's a bug.
Comment 3 Jan Kaluža 2012-10-03 04:25:03 EDT

I've tried to reproduce your problem and I have few questions.

1. Do you use mod_authz_ldap or mod_authnz_ldap? "require ldap-group" can't be used with mod_authz_ldap, but from Comment 2 I understand that you are using that module.

2. Could you please paste here your httpd configuration related to LDAP so I will be able to reproduce it?
Comment 4 Joe Orton 2013-12-02 10:52:03 EST
We lack sufficient reproduction information for this bug, and it is therefore being closed.

If you need further assistance, please contact your Red Hat support representative.

Note You need to log in before you can comment on or make changes to this bug.