Red Hat Bugzilla – Bug 864594
anonymous limits are being applied to directory manager
Last modified: 2013-06-24 06:54:48 EDT
This bug is created as a clone of upstream ticket: https://fedorahosted.org/389/ticket/446 Performing an ldapsearch in 389-ds-base-1.2.10.14-1.fc16.x86_64 in a container with > 5000 entries errors with result: 11 Administrative limit exceeded. The dse.ldif is set for appropriately high limits. I am using the Directory Manager user to perform the search. The search is being performed locally but the limit is still getting hit
From the trac ticket: -------------------------------------------------- Here are the exact steps to reproduce the issue: [1] Add the resource limit entry: dn: cn=anonymous limits,dc=example,dc=com cn: anonymous limits objectClass: top objectClass: nscontainer nsLookThroughLimit: 5000 [2] Then add this to cn=config: nsslapd-anonlimitsdn: cn=anonymous limits,dc=example,dc=com [3] Add 5001 entries [4] do a ldapsearch for objectclass=*: ldapsearch -D "cn=directory manager" -w password -xLLL -b "dc=example,dc=com" objectclass=* dn Administrative limit exceeded (11) --------------------------------------------------
$ /usr/lib64/mozldap/ldapsearch -D "cn=directory manager" -w Secret123 -s sub -b "ou=people,dc=anonymousresourcelimit,dc=example,dc=com" uid="anonymous manager" nsLookThroughLimit version: 1 dn: uid=anonymous manager,ou=people,dc=anonymousresourcelimit,dc=example,dc=com nsLookThroughLimit: 10 $ /usr/lib64/mozldap/ldapsearch -D "cn=directory manager" -w Secret123 -s sub -b "ou=people,dc=anonymousresourcelimit,dc=example,dc=com" uid=* dn | grep "dn: " | wc -l 10000 $ echo $? 0 $ rpm -qa | grep 389-ds-base 389-ds-base-1.2.11.15-3.el6.x86_64
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0503.html
Covered in anonymousResourceLimit suite