Issue 6986 - conversion to run-time configuration (RTC) for slapo-constraint
Summary: conversion to run-time configuration (RTC) for slapo-constraint
Status: VERIFIED FIXED
Alias: None
Product: OpenLDAP
Classification: Unclassified
Component: slapd (show other issues)
Version: 2.4.26
Hardware: All All
: --- normal
Target Milestone: ---
Assignee: OpenLDAP project
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-07-05 21:22 UTC by florian.dufner@uni-ulm.de
Modified: 2014-08-01 21:04 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this issue.
Description florian.dufner@uni-ulm.de 2011-07-05 21:22:07 UTC
Full_Name: Florian Dufner
Version: 2.4.26
OS: SunOS sun 5.10 i86pc
URL: 
Submission from: (NULL) (91.16.117.246)


Conversion to run-time configuration (RTC) does not work with every
configuration option of slapo-constraint.

Problem #1: (count constraints)
constraint_attribute mail count 1
is converted to
olcConstraintAttribute:: bWFpbCBjb3VudCA=

The attribute is garbled after conversion. slapd will not run until this is
fixed.

Problem #2: (restrict parameter)
constraint_attribute mail regex ^[[:alnum:].-]+@host$
restrict="ldap:///ou=people,dc=host??sub?(objectClass=posixAccount)"
is converted to
olcConstraintAttribute: mail regex ^[[:alnum:].-]+@host$ restr
 ict="restrict=ldap:///ou=people,dc=host??sub?(obj
 ectClass=posixAccount)"

The complete restrict parameter from the old configuration format (including
"restrict=") is appended after a "restrict=".
slapd will not run until this is fixed.
Comment 1 Quanah Gibson-Mount 2011-07-07 02:12:14 UTC
--On Tuesday, July 05, 2011 9:22 PM +0000 florian.dufner@uni-ulm.de wrote:

> Full_Name: Florian Dufner
> Version: 2.4.26
> OS: SunOS sun 5.10 i86pc
> URL:
> Submission from: (NULL) (91.16.117.246)
>
>
> Conversion to run-time configuration (RTC) does not work with every
> configuration option of slapo-constraint.
>
> Problem #1: (count constraints)
> constraint_attribute mail count 1
> is converted to
> olcConstraintAttribute:: bWFpbCBjb3VudCA=

This is base-64 encoded, not garbage.  I suggest you base-64 decode it to 
see the actual value.

> The attribute is garbled after conversion. slapd will not run until this
> is fixed.
>
> Problem #2: (restrict parameter)
> constraint_attribute mail regex ^[[:alnum:].-]+@host$
> restrict="ldap:///ou=people,dc=host??sub?(objectClass=posixAccount)"
> is converted to
> olcConstraintAttribute: mail regex ^[[:alnum:].-]+@host$ restr
>  ict="restrict=ldap:///ou=people,dc=host??sub?(obj
>  ectClass=posixAccount)"
>
> The complete restrict parameter from the old configuration format
> (including "restrict=") is appended after a "restrict=".
> slapd will not run until this is fixed.
>

This sounds valid.

--Quanah

--

Quanah Gibson-Mount
Sr. Member of Technical Staff
Zimbra, Inc
A Division of VMware, Inc.
--------------------
Zimbra ::  the leader in open source messaging and collaboration

Comment 2 florian.dufner@uni-ulm.de 2011-07-07 05:25:35 UTC
Am 07.07.2011 04:12, schrieb Quanah Gibson-Mount:
>> Problem #1: (count constraints)
>> constraint_attribute mail count 1
>> is converted to
>> olcConstraintAttribute:: bWFpbCBjb3VudCA=
> 
> This is base-64 encoded, not garbage.  I suggest you base-64 decode it
> to see the actual value.

Okay, base-64 decoded it is "mail count".

But as I wrote:
>> The attribute is garbled after conversion. slapd will not run until this
>> is fixed.

So the problem is that the number after count is not included in conversion.
After adding " <number>" slapd will start.

Is there a specific mechanism for the decision of what attributes get
base64-encoded in conversion?
In case of the count type constraint I can't see why it's needed.

FloD.

Comment 3 ando@openldap.org 2011-07-07 06:18:21 UTC
changed notes
changed state Open to Test
moved from Incoming to Software Bugs
Comment 4 ando@openldap.org 2011-07-07 06:21:22 UTC
There are clearly two bugs: "count" misses the number (same for "size")
and the prefix "restrict=" is repeated.  Fixed in master, please test and
report.

p.

> --On Tuesday, July 05, 2011 9:22 PM +0000 florian.dufner@uni-ulm.de wrote:
>
>> Full_Name: Florian Dufner
>> Version: 2.4.26
>> OS: SunOS sun 5.10 i86pc
>> URL:
>> Submission from: (NULL) (91.16.117.246)
>>
>>
>> Conversion to run-time configuration (RTC) does not work with every
>> configuration option of slapo-constraint.
>>
>> Problem #1: (count constraints)
>> constraint_attribute mail count 1
>> is converted to
>> olcConstraintAttribute:: bWFpbCBjb3VudCA=
>
> This is base-64 encoded, not garbage.  I suggest you base-64 decode it to
> see the actual value.
>
>> The attribute is garbled after conversion. slapd will not run until this
>> is fixed.
>>
>> Problem #2: (restrict parameter)
>> constraint_attribute mail regex ^[[:alnum:].-]+@host$
>> restrict="ldap:///ou=people,dc=host??sub?(objectClass=posixAccount)"
>> is converted to
>> olcConstraintAttribute: mail regex ^[[:alnum:].-]+@host$ restr
>>  ict="restrict=ldap:///ou=people,dc=host??sub?(obj
>>  ectClass=posixAccount)"
>>
>> The complete restrict parameter from the old configuration format
>> (including "restrict=") is appended after a "restrict=".
>> slapd will not run until this is fixed.
>>
>
> This sounds valid.
>
> --Quanah
>
> --
>
> Quanah Gibson-Mount
> Sr. Member of Technical Staff
> Zimbra, Inc
> A Division of VMware, Inc.
> --------------------
> Zimbra ::  the leader in open source messaging and collaboration
>
>
>


Comment 5 florian.dufner@uni-ulm.de 2011-07-07 08:25:09 UTC
Am 07.07.2011 08:21, schrieb masarati@aero.polimi.it:
> There are clearly two bugs: "count" misses the number (same for "size")
> and the prefix "restrict=" is repeated.  Fixed in master, please test and
> report.

Tested. Problem is gone with the provided patch. Thank you.

FloD.

Comment 6 Quanah Gibson-Mount 2011-09-07 00:22:51 UTC
changed notes
changed state Test to Release
Comment 7 Quanah Gibson-Mount 2011-11-28 18:37:12 UTC
changed notes
changed state Release to Closed
Comment 8 OpenLDAP project 2014-08-01 21:04:37 UTC
fixed in master
fixed in RE24