[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: (ITS#8501) OpenLdap not RFC 2891 complaint



--_000_AM4PR0101MB19549BBC7F2AB2947F4C5505BBF10AM4PR0101MB1954_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Hello Howard,


Thanks again. This strangely enough works with 2.4.40 version , previously =
I was using 2.4.31.

________________________________
From: Howard Chu <hyc@symas.com>
Sent: Tuesday, September 13, 2016 9:23:07 PM
To: Maria Blagoeva; openldap-its@OpenLDAP.org
Subject: Re: (ITS#8501) OpenLdap not RFC 2891 complaint

Maria Blagoeva wrote:
> Hello Howard,
>
>
> And just one more follow-up question, if you do not mind, just to have th=
e
> full picture. The way the RFC is construct, it seems that if the ordering=
 rule
> is omitted in the request one that is defined must be used, but if nothin=
g is
> defined in the schema nothing will be used, but I do not understand why t=
he
> openlap will fail than. Exactly the same request works fine with
> ActiveDirectory server.

ActiveDirectory is not RFC-compliant.

> The quotes from the RFC directly:

> The MatchingRuleId, as defined in section 4.1.9 of [LDAPv3], SHOULD
>    be one that is valid for the attribute type it applies to.  If it is
>    not, the server will return inappropriateMatching.

>  If the orderingRule is omitted, the ordering MatchingRule defined for
>    use with this attribute MUST be used.

And when no MatchingRule exists for an attribute, matching cannot be
performed. That is part of RFC4511 so there's no need to state it here.

> Thanks again for your insights.
>
>
> -------------------------------------------------------------------------=
-----
> *From:* Maria Blagoeva
> *Sent:* Tuesday, September 13, 2016 8:50:45 AM
> *To:* Howard Chu; openldap-its@OpenLDAP.org
> *Subject:* Re: (ITS#8501) OpenLdap not RFC 2891 complaint
>
>
> Hello Howard,
>
>
> This means I need to patch the openldap instance or a default ordering ru=
le
> can be set for that attribute on the fly? Thanks again for your help and
> assistance.
>
>
> BR,
>
> Maria
>
> -------------------------------------------------------------------------=
-----
> *From:* Howard Chu <hyc@symas.com>
> *Sent:* Monday, September 12, 2016 6:31:25 PM
> *To:* Maria Blagoeva; openldap-its@OpenLDAP.org
> *Subject:* Re: (ITS#8501) OpenLdap not RFC 2891 complaint
>
> mblagoeva@axway.com wrote:
>> Full_Name: Maria Blagoeva
>> Version: openldap-2.4.31/debian/build/servers/slapd
>> OS: docker image with  3.10.0-327.28.2.el7.x86_64
>> URL: ftp://ftp.openldap.org/incoming/
>> Submission from: (NULL) (194.88.228.86)
>>
>>
>> It seems that openldap as of 2.4.31 is not RFC complaint
>> (https://www.ietf.org/rfc/rfc2891.txt) due to failure in response when o=
rdering
>> match rule is empty while doing server side sorting. Example below:
>
> False. OpenLDAP is completely correct and RFC-compliant in its behavior.
>
>> empty ordering rule:
>>
>> ldapsearch -E sss=3Dcn '(cn=3Dccc*)' cn' (&(objectClass=3DinetOrgPerson)=
(cn=3Dccc*))' -H
>> ldap://IP:389 -b "ou=3DUsers,dc=3Dopenstack,dc=3Dorg" -D "cn=3Daaa1,
>> ou=3DUsers,dc=3Dopenstack,dc=3Dorg" -x -W
>> # extended LDIF
>> #
>> # LDAPv3
>> # base <ou=3DUsers,dc=3Dopenstack,dc=3Dorg> with scope subtree
>> # filter: (cn=3Dccc*)
>> # requesting: cn (&(objectClass=3DinetOrgPerson)(cn=3Dccc*))
>> # with server side sorting control
>> #
>>
>> # search result
>> search: 2
>> result: 18 Inappropriate matching
>> text: serverSort control: No ordering rule
>
> This result is correct since the cn attribute has no ordering rule define=
d in
> the schema.
>>
>> # numResponses: 1
>>
>> caseIgnoreOrderingMatch ordering rule:
>>
>> ldapsearch -E sss=3Dcn:caseIgnoreOrderingMatch '(cn=3Dccc*)' cn'
>> (&(objectClass=3DinetOrgPerson)(cn=3Dccc*))' -H ldap://IP:389 -b
>> "ou=3DUsers,dc=3Dopenstack,dc=3Dorg" -D "c3D3Daaa1, ou=3DUsers,dc=3Dopen=
stack,dc=3Dorg" -x
>> -W
>> # extended LDIF
>> #
>> # LDAPv3
>> # base <ou=3DUsers,dc=3Dopenstack,dc=3Dorg> with scope subtree
>> # filter: (cn=3Dccc*)
>> # requesting: cn (&(objectClass=3DinetOrgPerson)(cn=3Dccc*))
>> # with server side sorting control
>> #
>>
>> # ccc0, Users, openstack.org
>> dn: cn=3Dccc0,ou=3DUsers,dc=3Dopenstack,dc=3Dorg
>> # search result
>> search: 2
>> result: 0 Success
>> control: 1.2.840.113556.1.4.474 false MAMKAQA=3D
>> sortResult: (0) Success
>>
>>
>> however the RFC states that the orderingRule is OPTIONAL as below:
>>
>>       SortKeyList ::=3D SEQUENCE OF SEQUENCE {
>>                  attributeType   AttributeDescription,
>>                  orderingRule    [0] MatchingRuleId OPTIONAL,
>>                  reverseOrder    [1] BOOLEAN DEFAULT FALSE }
>>
>> however openldap fails to return entries.
>
> The rule is optional in the control itself, but a valid ordering rule mus=
t
> exist somewhere. Since the attribute schema doesn't define one then you m=
ust
> provide one yourself.
>
> Closing this ITS.
>
> --
>    -- Howard Chu
>    CTO, Symas Corp.           http://www.symas.com
>    Director, Highland Sun     http://highlandsun.com/hyc/
>    Chief Architect, OpenLDAP  http://www.openldap.org/project/


--
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/

--_000_AM4PR0101MB19549BBC7F2AB2947F4C5505BBF10AM4PR0101MB1954_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-=
1">
<meta name=3D"Generator" content=3D"Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; pad=
ding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content=3D"text/html; charset=3DUTF-8">
<style type=3D"text/css" style=3D"">
<!--
p
	{margin-top:0;
	margin-bottom:0}
-->
</style>
<div dir=3D"ltr">
<div id=3D"x_divtagdefaultwrapper" style=3D"font-size:12pt; color:#000000; =
background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Hello Howard,</p>
<p><br>
</p>
<p>Thanks again. This strangely enough works with 2.4.40 version , previous=
ly I was using 2.4.31.<br>
</p>
</div>
<hr tabindex=3D"-1" style=3D"display:inline-block; width:98%">
<div id=3D"x_divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" =
color=3D"#000000" style=3D"font-size:11pt"><b>From:</b> Howard Chu &lt;hyc@=
symas.com&gt;<br>
<b>Sent:</b> Tuesday, September 13, 2016 9:23:07 PM<br>
<b>To:</b> Maria Blagoeva; openldap-its@OpenLDAP.org<br>
<b>Subject:</b> Re: (ITS#8501) OpenLdap not RFC 2891 complaint</font>
<div>&nbsp;</div>
</div>
</div>
<font size=3D"2"><span style=3D"font-size:10pt;">
<div class=3D"PlainText">Maria Blagoeva wrote:<br>
&gt; Hello Howard,<br>
&gt;<br>
&gt;<br>
&gt; And just one more follow-up question, if you do not mind, just to have=
 the<br>
&gt; full picture. The way the RFC is construct, it seems that if the order=
ing rule<br>
&gt; is omitted in the request one that is defined must be used, but if not=
hing is<br>
&gt; defined in the schema nothing will be used, but I do not understand wh=
y the<br>
&gt; openlap will fail than. Exactly the same request works fine with<br>
&gt; ActiveDirectory server.<br>
<br>
ActiveDirectory is not RFC-compliant.<br>
<br>
&gt; The quotes from the RFC directly:<br>
<br>
&gt; The MatchingRuleId, as defined in section 4.1.9 of [LDAPv3], SHOULD<br=
>
&gt;&nbsp;&nbsp;&nbsp; be one that is valid for the attribute type it appli=
es to.&nbsp; If it is<br>
&gt;&nbsp;&nbsp;&nbsp; not, the server will return inappropriateMatching.<b=
r>
<br>
&gt;&nbsp; If the orderingRule is omitted, the ordering MatchingRule define=
d for<br>
&gt;&nbsp;&nbsp;&nbsp; use with this attribute MUST be used.<br>
<br>
And when no MatchingRule exists for an attribute, matching cannot be <br>
performed. That is part of RFC4511 so there's no need to state it here.<br>
<br>
&gt; Thanks again for your insights.<br>
&gt;<br>
&gt;<br>
&gt; ----------------------------------------------------------------------=
--------<br>
&gt; *From:* Maria Blagoeva<br>
&gt; *Sent:* Tuesday, September 13, 2016 8:50:45 AM<br>
&gt; *To:* Howard Chu; openldap-its@OpenLDAP.org<br>
&gt; *Subject:* Re: (ITS#8501) OpenLdap not RFC 2891 complaint<br>
&gt;<br>
&gt;<br>
&gt; Hello Howard,<br>
&gt;<br>
&gt;<br>
&gt; This means I need to patch the openldap instance or a default ordering=
 rule<br>
&gt; can be set for that attribute on the fly? Thanks again for your help a=
nd<br>
&gt; assistance.<br>
&gt;<br>
&gt;<br>
&gt; BR,<br>
&gt;<br>
&gt; Maria<br>
&gt;<br>
&gt; ----------------------------------------------------------------------=
--------<br>
&gt; *From:* Howard Chu &lt;hyc@symas.com&gt;<br>
&gt; *Sent:* Monday, September 12, 2016 6:31:25 PM<br>
&gt; *To:* Maria Blagoeva; openldap-its@OpenLDAP.org<br>
&gt; *Subject:* Re: (ITS#8501) OpenLdap not RFC 2891 complaint<br>
&gt;<br>
&gt; mblagoeva@axway.com wrote:<br>
&gt;&gt; Full_Name: Maria Blagoeva<br>
&gt;&gt; Version: openldap-2.4.31/debian/build/servers/slapd<br>
&gt;&gt; OS: docker image with&nbsp; 3.10.0-327.28.2.el7.x86_64<br>
&gt;&gt; URL: <a href=3D"ftp://ftp.openldap.org/incoming/";>ftp://ftp.openld=
ap.org/incoming/</a><br>
&gt;&gt; Submission from: (NULL) (194.88.228.86)<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt; It seems that openldap as of 2.4.31 is not RFC complaint<br>
&gt;&gt; (<a href=3D"https://www.ietf.org/rfc/rfc2891.txt";>https://www.ietf=
.org/rfc/rfc2891.txt</a>) due to failure in response when ordering<br>
&gt;&gt; match rule is empty while doing server side sorting. Example below=
:<br>
&gt;<br>
&gt; False. OpenLDAP is completely correct and RFC-compliant in its behavio=
r.<br>
&gt;<br>
&gt;&gt; empty ordering rule:<br>
&gt;&gt;<br>
&gt;&gt; ldapsearch -E sss=3Dcn '(cn=3Dccc*)' cn' (&amp;(objectClass=3Dinet=
OrgPerson)(cn=3Dccc*))' -H<br>
&gt;&gt; ldap://IP:389 -b &quot;ou=3DUsers,dc=3Dopenstack,dc=3Dorg&quot; -D=
 &quot;cn=3Daaa1,<br>
&gt;&gt; ou=3DUsers,dc=3Dopenstack,dc=3Dorg&quot; -x -W<br>
&gt;&gt; # extended LDIF<br>
&gt;&gt; #<br>
&gt;&gt; # LDAPv3<br>
&gt;&gt; # base &lt;ou=3DUsers,dc=3Dopenstack,dc=3Dorg&gt; with scope subtr=
ee<br>
&gt;&gt; # filter: (cn=3Dccc*)<br>
&gt;&gt; # requesting: cn (&amp;(objectClass=3DinetOrgPerson)(cn=3Dccc*))<b=
r>
&gt;&gt; # with server side sorting control<br>
&gt;&gt; #<br>
&gt;&gt;<br>
&gt;&gt; # search result<br>
&gt;&gt; search: 2<br>
&gt;&gt; result: 18 Inappropriate matching<br>
&gt;&gt; text: serverSort control: No ordering rule<br>
&gt;<br>
&gt; This result is correct since the cn attribute has no ordering rule def=
ined in<br>
&gt; the schema.<br>
&gt;&gt;<br>
&gt;&gt; # numResponses: 1<br>
&gt;&gt;<br>
&gt;&gt; caseIgnoreOrderingMatch ordering rule:<br>
&gt;&gt;<br>
&gt;&gt; ldapsearch -E sss=3Dcn:caseIgnoreOrderingMatch '(cn=3Dccc*)' cn'<b=
r>
&gt;&gt; (&amp;(objectClass=3DinetOrgPerson)(cn=3Dccc*))' -H ldap://IP:389 =
-b<br>
&gt;&gt; &quot;ou=3DUsers,dc=3Dopenstack,dc=3Dorg&quot; -D &quot;c3D3Daaa1,=
 ou=3DUsers,dc=3Dopenstack,dc=3Dorg&quot; -x<br>
&gt;&gt; -W<br>
&gt;&gt; # extended LDIF<br>
&gt;&gt; #<br>
&gt;&gt; # LDAPv3<br>
&gt;&gt; # base &lt;ou=3DUsers,dc=3Dopenstack,dc=3Dorg&gt; with scope subtr=
ee<br>
&gt;&gt; # filter: (cn=3Dccc*)<br>
&gt;&gt; # requesting: cn (&amp;(objectClass=3DinetOrgPerson)(cn=3Dccc*))<b=
r>
&gt;&gt; # with server side sorting control<br>
&gt;&gt; #<br>
&gt;&gt;<br>
&gt;&gt; # ccc0, Users, openstack.org<br>
&gt;&gt; dn: cn=3Dccc0,ou=3DUsers,dc=3Dopenstack,dc=3Dorg<br>
&gt;&gt; # search result<br>
&gt;&gt; search: 2<br>
&gt;&gt; result: 0 Success<br>
&gt;&gt; control: 1.2.840.113556.1.4.474 false MAMKAQA=3D<br>
&gt;&gt; sortResult: (0) Success<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt; however the RFC states that the orderingRule is OPTIONAL as below:=
<br>
&gt;&gt;<br>
&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SortKeyList ::=3D SEQUENCE OF =
SEQUENCE {<br>
&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; attributeType&nbsp;&nbsp; AttributeDesc=
ription,<br>
&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; orderingRule&nbsp;&nbsp;&nbsp; [0] Matc=
hingRuleId OPTIONAL,<br>
&gt;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&=
nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; reverseOrder&nbsp;&nbsp;&nbsp; [1] BOOL=
EAN DEFAULT FALSE }<br>
&gt;&gt;<br>
&gt;&gt; however openldap fails to return entries.<br>
&gt;<br>
&gt; The rule is optional in the control itself, but a valid ordering rule =
must<br>
&gt; exist somewhere. Since the attribute schema doesn't define one then yo=
u must<br>
&gt; provide one yourself.<br>
&gt;<br>
&gt; Closing this ITS.<br>
&gt;<br>
&gt; --<br>
&gt;&nbsp;&nbsp;&nbsp; -- Howard Chu<br>
&gt;&nbsp;&nbsp;&nbsp; CTO, Symas Corp.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp; <a href=3D"http://www.symas.com";>http://www.symas.=
com</a><br>
&gt;&nbsp;&nbsp;&nbsp; Director, Highland Sun&nbsp;&nbsp;&nbsp;&nbsp; <a hr=
ef=3D"http://highlandsun.com/hyc/";>http://highlandsun.com/hyc/</a><br>
&gt;&nbsp;&nbsp;&nbsp; Chief Architect, OpenLDAP&nbsp; <a href=3D"http://ww=
w.openldap.org/project/">http://www.openldap.org/project/</a><br>
<br>
<br>
-- <br>
&nbsp;&nbsp; -- Howard Chu<br>
&nbsp;&nbsp; CTO, Symas Corp.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs=
p;&nbsp;&nbsp; <a href=3D"http://www.symas.com";>http://www.symas.com</a><br=
>
&nbsp;&nbsp; Director, Highland Sun&nbsp;&nbsp;&nbsp;&nbsp; <a href=3D"http=
://highlandsun.com/hyc/">http://highlandsun.com/hyc/</a><br>
&nbsp;&nbsp; Chief Architect, OpenLDAP&nbsp; <a href=3D"http://www.openldap=
.org/project/">http://www.openldap.org/project/</a><br>
</div>
</span></font>
</body>
</html>

--_000_AM4PR0101MB19549BBC7F2AB2947F4C5505BBF10AM4PR0101MB1954_--