(ITS#6915) memberof+accesslog duplicate reqStart

[ebackes@symas.com]

Full_Name: Emily Backes
Version: 2.4.25
OS: any
URL: 
Submission from: (NULL) (76.88.107.46)


In recent OpenLDAPs (2.4.25 at least, but I haven't found exactly where
it started), memberof interacts badly with accesslog.

In a simple test case with a groupOfNames and two people, if you add a
person to the group, memberOf should set their memberOf opeational
attribute to point to the group.  That works!  But currently the
accesslog db will only show the change for the memberof update and not
the original group change.

Digging deeper, I found:

==> hdb_add: reqStart=20110422103943.000001Z,cn=log
oc_check_required entry (reqStart=20110422103943.000001Z,cn=log), objectClass 
"auditModify"
oc_check_allowed type "objectClass"
oc_check_allowed type "structuralObjectClass"
oc_check_allowed type "reqStart"
oc_check_allowed type "reqEnd"
oc_check_allowed type "reqType"
oc_check_allowed type "reqSession"
oc_check_allowed type "reqAuthzID"
oc_check_allowed type "reqDN"
oc_check_allowed type "reqResult"
oc_check_allowed type "reqMod"
bdb_dn2entry("reqStart=20110422103943.000001Z,cn=log")
send_ldap_result: conn=1000 op=1 p=3
send_ldap_result: err=68 matched="" text=""

The changes are reaching accesslog, but don't make it into the logdb
because their generated DNs based on reqStart match.

reqStart is generated with a generalizedTime stamp where the
microseconds are an incrementing count based on o_tincr, but this does
not seem to be incremented, or incremented enough.

It's not entirely clear why this is a problem now and not earlier.

This may be related to ITS#6766.