[Date Prev][Date Next]
Re: (ITS#6504) Corrupted control value when using pagedresults with subordinate *ldap* database
- To: openldap-its@OpenLDAP.org
- Subject: Re: (ITS#6504) Corrupted control value when using pagedresults with subordinate *ldap* database
- From: email@example.com
- Date: Fri, 2 Apr 2010 02:08:55 GMT
- Auto-submitted: auto-generated (OpenLDAP-ITS)
>> Full_Name: Jonathan Clarke
>> Version: RE24
>> URL: ftp://ftp.openldap.org/incoming/
>> Submission from: (NULL) (188.8.131.52)
>> This is similar to ITS #5191 (http://www.openldap.org/its/?findid=5191),
>> it happens with a subordinate LDAP database.
>> Consider this configuration :
>> database ldap
>> suffix "o=test,o=sub"
>> uri "ldap://localhost:1234"
>> idassert-bind mode=none bindmethod=simple flags=prescriptive timeout=0
>> network-timeout=0 binddn="cn=svc,o=test" credentials="verysecret"
>> idassert-authzFrom dn.regex:.*
>> single-conn yes
>> overlay rwm
>> rwm-suffixmassage "o=test,o=sub" "o=test"
>> database null
>> suffix "o=sub"
>> rootdn "cn=Manager,o=sub"
>> rootpw secret
>> overlay glue
>> A search with pagedResults control returns results as expected, but with
>> response control containing some garbage:
>> result: 0 Success
>> Some gdb'ing shows that backglue copies over the pointers to
>> glue_state->ctrls. But then, back-ldap's ldap_back_search does a
>> ldap_controls_free() on rs->sr_ctrls. And so, the returned control
>> garbage (mostly).
>> I haven't been able to come up with a patch yet, just commenting line
>> back-ldap/search.c works. Running out of time for now...
> Probably, backglue should rather ldap_controls_dup() them. However, in
> this case we need to make sure that the glued databases delete their own
Also, I note that the glued paged response seems to work incorrectly. I
made a simple test system, where the root database contains exactly one
entry (the suffix) and a back-ldap is glued on top. If I request entries
with a page size of 2, searching the suffix return 3 entries; subsequent
searches return 2 entries from the proxy. I haven't figured out yet where
the issue is.