Fedora Info: [389-devel] Re: Groups are not accessible by filter

# --- BEGIN COPYRIGHT BLOCK ---
# Copyright (C) 2019 Red Hat, Inc.
# All rights reserved.
#
# License: GPL (version 3 or any later version).
# See LICENSE for details.
# --- END COPYRIGHT BLOCK ---

"""
Importing necessary Modules.
"""

import os
import pytest

from lib389._constants import DEFAULT_SUFFIX, PW_DM
from lib389.topologies import topology_st as topo
from lib389.idm.user import UserAccount, UserAccounts
from lib389.idm.organizationalunit import OrganizationalUnit, OrganizationalUnits
from lib389.index import Index
from lib389.idm.account import Accounts

import ldap

GIVEN_NAME = 'cn=givenname,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config'
CN_NAME = 'cn=sn,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config'
UNIQMEMBER = 'cn=uniquemember,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config'
OBJECTCLASS = 'cn=objectclass,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config'
MAIL = 'cn=mail,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config'
ACLG_OU = f'ou=ACLGroup,{DEFAULT_SUFFIX}'
NESG_OU = f'ou=nestedgroup, {DEFAULT_SUFFIX}'

LIST_OF_USER_ACCOUNTING = [
f"uid=Ted Morris, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=David Miller, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Gern Farmer, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Judy Wallace, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Marcus Ward, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Judy McFarland, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Anuj Hall, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Gern Triplett, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Emanuel Johnson, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Brad Walker, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Tobias Pierce, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Randy Mills, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=David Thorud, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Elba Kohler, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Laurel Campbell, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Torrey Schneider, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Paula Rose, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Frank Albers, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Martin Schneider, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Andrew Hel, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Pete Tyler, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Randy Ulrich, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Richard Francis, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Morgan White, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Anuj Maddox, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Jody Jensen, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Mike Carter, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Gern Tyler, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Bjorn Jensen, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Andy Hall, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Ted Jensen, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Wendy Lutz, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Kelly Mcinnis, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Trent Couzens, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Dan Lanoway, ou=Accounting,{DEFAULT_SUFFIX}",
f"uid=Richard Jensen, ou=Accounting,{DEFAULT_SUFFIX}"]

LIST_OF_USER_HUMAN = [
f"uid=Kirsten Vaughan, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Chris Schmith, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Torrey Clow, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Robert Daugherty, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Torrey Mason, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Brad Talbot, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Anuj Jablonski, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Harry Miller, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Jeffrey Campaigne, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Stephen Triplett, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=John Falena, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Peter Rigden, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Mike Lott, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Richard Bannister, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Brian Plante, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Daniel Smith, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Tim Labonte, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Scott Lee, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Bjorn Free, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Alexander Shelton, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=James Burrell, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Karen Carter, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Randy Fish, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Philip Hunt, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Rachel Schneider, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Gern Jensen, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=David Akers, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Tobias Ward, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Jody Rentz, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Peter Lorig, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Kelly Schmith, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Pete Worrell, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Matthew Reuter, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Tobias Schmith, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Jon Goldstein, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Janet Lutz, ou=Human Resources,{DEFAULT_SUFFIX}",
f"uid=Karl Cope, ou=Human Resources,{DEFAULT_SUFFIX}",
]

LIST_OF_USER_TESTING = [
f"uid=Andy Bergin, ou=Product Testing,{DEFAULT_SUFFIX}",
f"uid=John Walker, ou=Product Testing,{DEFAULT_SUFFIX}",
f"uid=Jayne Reuter, ou=Product Testing,{DEFAULT_SUFFIX}",
f"uid=Lee Ulrich, ou=Product Testing,{DEFAULT_SUFFIX}",
f"uid=Benjamin Schneider, ou=Product Testing,{DEFAULT_SUFFIX}",
f"uid=Bertram Rentz, ou=Product Testing,{DEFAULT_SUFFIX}",
f"uid=Patricia Cruse, ou=Product Testing,{DEFAULT_SUFFIX}",
f"uid=Jim Lange, ou=Product Testing,{DEFAULT_SUFFIX}",
f"uid=Alan White, ou=Product Testing,{DEFAULT_SUFFIX}",
f"uid=Daniel Ward, ou=Product Testing,{DEFAULT_SUFFIX}",
f"uid=Lee Stockton, ou=Product Testing,{DEFAULT_SUFFIX}",
f"uid=Matthew Vaughan, ou=Product Testing,{DEFAULT_SUFFIX}"
]

LIST_OF_USER_DEVELOPMENT = [
f"uid=Kelly Winters, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Torrey Rigden, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Benjamin Hall, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Lee Labonte, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Jody Campaigne, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Alexander Lutz, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Bjorn Talbot, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Marcus Langdon, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Sue Peterson, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Kurt Jensen, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Cecil Wallace, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Stephen Carter, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Janet Hunter, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Marcus Mcinnis, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Timothy Kelly, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Sue Mason, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Chris Alexander, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Anuj Jensen, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Martin Talbot, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Scott Farmer, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Allison Jensen, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Jeff Muffly, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Alan Worrell, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Dan Langdon, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Ashley Knutson, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Jon Bourke, ou=Product Development,{DEFAULT_SUFFIX}",
f"uid=Pete Hunt, ou=Product Development,{DEFAULT_SUFFIX}",

]

LIST_OF_USER_PAYROLL = [
f"uid=Ashley Chassin, ou=Payroll,{DEFAULT_SUFFIX}",
f"uid=Sue Kelleher, ou=Payroll,{DEFAULT_SUFFIX}",
f"uid=Jim Cruse, ou=Payroll,{DEFAULT_SUFFIX}",
f"uid=Judy Brown, ou=Payroll,{DEFAULT_SUFFIX}",
f"uid=Patricia Shelton, ou=Payroll,{DEFAULT_SUFFIX}",
f"uid=Dietrich Swain, ou=Payroll,{DEFAULT_SUFFIX}",
f"uid=Allison Hunter, ou=Payroll,{DEFAULT_SUFFIX}",
f"uid=Anne-Louise Barnes, ou=Payroll,{DEFAULT_SUFFIX}"

]

def test_various_combinations_of_filters_and_idlistscanlimit(topo):
"""
Test various combinations of filters and idlistscanlimit
Starting...test cases for bug1011539
:id:44f83e2c-9f06-11e8-bffe-8c16451d917b
:setup: Standalone instance
:steps:
1. Create Instance
2. Create entries
3. Try change nsslapd-errorlog-levelva
4. Search created entries
5. restart instance
6. Search created entries
:expectedresults:
1. This should pass
2. This should pass
3. This should pass
4. This should pass
5. This should pass
"""
ous = OrganizationalUnits(topo.standalone, DEFAULT_SUFFIX)
for demo in ['Product Development',
'Accounting',
'Human Resources',
'Payroll',
'Product Testing']:
ous.create(properties={'ou': demo})

users_accounts = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn='ou=Accounting')
users_human = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn='ou=Human Resources')
users_testing = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn='ou=Product Testing')
users_development = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn='ou=Product Development')
users_payroll = UserAccounts(topo.standalone, DEFAULT_SUFFIX, rdn='ou=Payroll')
users_people = UserAccounts(topo.standalone, DEFAULT_SUFFIX)

for demo1 in LIST_OF_USER_ACCOUNTING:
users_accounts.create(properties={
'uid': demo1.split(',')[0].split('=')[1],
'cn': demo1.split(',')[0].split('=')[1],
'sn': demo1.split(',')[0].split(' ')[1],
'uidNumber': str(1000),
'gidNumber': '2000',
'homeDirectory': '/home/' + demo1,
'givenname': demo1.split(',')[0].split('=')[1].split(' ')[0],
'userpassword': PW_DM
})

for demo1 in LIST_OF_USER_HUMAN:
users_human.create(properties={
'uid': demo1.split(',')[0].split('=')[1],
'cn': demo1.split(',')[0].split('=')[1],
'sn': demo1.split(',')[0].split(' ')[1],
'uidNumber': str(1000),
'gidNumber': '2000',
'homeDirectory': '/home/' + demo1,
'givenname': demo1.split(',')[0].split('=')[1].split(' ')[0],
'userpassword': PW_DM
})

for demo1 in LIST_OF_USER_TESTING:
users_testing.create(properties={
'uid': demo1.split(',')[0].split('=')[1],
'cn': demo1.split(',')[0].split('=')[1],
'sn': demo1.split(',')[0].split(' ')[1],
'uidNumber': str(1000),
'gidNumber': '2000',
'homeDirectory': '/home/' + demo1,
'givenname': demo1.split(',')[0].split('=')[1].split(' ')[0],
'userpassword': PW_DM
})

for demo1 in LIST_OF_USER_DEVELOPMENT:
users_development.create(properties={
'uid': demo1.split(',')[0].split('=')[1],
'cn': demo1.split(',')[0].split('=')[1],
'sn': demo1.split(',')[0].split(' ')[1],
'uidNumber': str(1000),
'gidNumber': '2000',
'homeDirectory': '/home/' + demo1,
'givenname': demo1.split(',')[0].split('=')[1].split(' ')[0],
'userpassword': PW_DM
})

for demo1 in LIST_OF_USER_PAYROLL:
users_payroll.create(properties={
'uid': demo1.split(',')[0].split('=')[1],
'cn': demo1.split(',')[0].split('=')[1],
'sn': demo1.split(',')[0].split(' ')[1],
'uidNumber': str(1000),
'gidNumber': '2000',
'homeDirectory': '/home/' + demo1,
'givenname': demo1.split(',')[0].split('=')[1].split(' ')[0],
'userpassword': PW_DM
})

users_people.create(properties={
'uid': 'scarter',
'cn': 'Sam Carter',
'sn': 'Carter',
'uidNumber': str(1000),
'gidNumber': '2000',
'homeDirectory': '/home/' + 'scarter',
'mail': 'scarter@anuj.com',
})

topo.standalone.config.set('nsslapd-errorlog-level', '524288')

for i in ['limit=1 type=eq values=Lutz,Hunter',
'limit=2 type=eq flags=AND values=Jensen,Rentz',
'limit=3 type=eq flags=AND',
'limit=4 type=eq', 'limit=5 flags=AND',
'limit=6',
'limit=1 type=sub values=*utz,*ter',
'limit=4 type=sub',
'limit=2 type=sub flags=AND values=*sen,*ntz',
'limit=3 type=sub flags=AND',
'limit=5 type=sub values=*sch*']:
Index(topo.standalone, CN_NAME).replace('nsIndexIDListScanLimit', i)

for i in ['limit=1 type=eq values=Andy,Andrew',
'limit=2 type=eq flags=AND values=Bjorn,David',
'limit=3 type=eq flags=AND',
'limit=4 type=eq',
'limit=5 flags=AND',
'limit=6']:
Index(topo.standalone, GIVEN_NAME).replace('nsIndexIDListScanLimit', i)

Index(topo.standalone, UNIQMEMBER).\
replace('nsIndexIDListScanLimit',
'limit=0 type=eq values=uid=kvaughan,ou=People,'
'dc=example,dc=com,uid=rdaugherty,ou=People,dc=example,dc=com')

Index(topo.standalone, OBJECTCLASS).\
replace('nsIndexIDListScanLimit', 'limit=0 type=eq flags=AND values=inetOrgPerson')

Index(topo.standalone, MAIL).\
replace('nsIndexIDListScanLimit',
'cn=mail,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config')

for i in ['(sn=Lutz)',
'(sn=*ter)',
'(&(sn=*sen)(objectclass=organizationalPerson))',
'(&(objectclass=organizationalPerson)(sn=*ntz))',
'(&(sn=Car*)(objectclass=organizationalPerson))',
'(sn=sc*)',
'(sn=*sch*)',
'(|(givenname=Andy)(givenname=Andrew))',
'(&(givenname=Bjorn)(objectclass=organizationalPerson))',
'(&(objectclass=organizationalPerson)(givenname=David))',
'(&(sn=*)(cn=*))',
'(sn=Hunter)',
'(&(givenname=Richard)(objectclass=organizationalPerson))',
'(givenname=Anuj)',
'(&(givenname=*)(cn=*))',
'(givenname=*)']:
assert Accounts(topo.standalone, DEFAULT_SUFFIX).filter(f'{i}')

UserAccount(topo.standalone, 'cn=Accounting Managers,ou=groups,dc=example,dc=com').\
add('uniquemember',
['uid=scarter, ou=People, dc=example,dc=com',
'uid=tmorris, ou=People, dc=example,dc=com',
'uid=kvaughan, ou=People, dc=example,dc=com',
'uid=rdaugherty, ou=People, dc=example,dc=com',
'uid=hmiller, ou=People, dc=example,dc=com'])

UserAccount(topo.standalone, 'cn=HR Managers,ou=groups,dc=example,dc=com').\
add('uniquemember',
['uid=kvaughan, ou=People, dc=example,dc=com',
'uid=cschmith, ou=People, dc=example,dc=com'])

for i in ['(uniquemember=uid=kvaughan,ou=People,dc=example,dc=com)',
'(uniquemember=uid=rdaugherty, ou=People, dc=example,dc=com)',
'(uniquemember=uid=hmiller, ou=People, dc=example,dc=com)',
'(&(objectclass=inetorgperson)(uid=scarter))',
'(&(objectclass=organizationalperson)(uid=scarter))',
'(objectclass=inetorgperson)',
'(&(objectclass=organizationalPerson)(sn=Jensen))',
'(&(mail=*)(objectclass=organizationalPerson))',
'(mail=*)',
'(&(sn=Rentz)(objectclass=organizationalPerson))',
'(&(sn=Ward)(sn=Ward))',
'(sn=Jensen)',
'(sn=*)',
'(sn=*utz)']:
assert topo.standalone.search_s(DEFAULT_SUFFIX, ldap.SCOPE_SUBTREE, i)

UserAccount(topo.standalone, 'cn=config').replace('nsslapd-errorlog-level', '0')

if __name__ == '__main__':
CURRENT_FILE = os.path.realpath(__file__)
pytest.main("-s -v %s" % CURRENT_FILE)
# --- BEGIN COPYRIGHT BLOCK ---
# Copyright (C) 2019 Red Hat, Inc.
# All rights reserved.
#
# License: GPL (version 3 or any later version).
# See LICENSE for details.
# --- END COPYRIGHT BLOCK ---

"""
Importing necessary Modules.
"""

import os
import pytest

import ldap

]

topo.standalone.config.set('nsslapd-errorlog-level', '524288')

Index(topo.standalone, UNIQMEMBER).\
replace('nsIndexIDListScanLimit',
'limit=0 type=eq values=uid=kvaughan,ou=People,'
'dc=example,dc=com,uid=rdaugherty,ou=People,dc=example,dc=com')

Index(topo.standalone, OBJECTCLASS).\
replace('nsIndexIDListScanLimit', 'limit=0 type=eq flags=AND values=inetOrgPerson')

Index(topo.standalone, MAIL).\
replace('nsIndexIDListScanLimit',
'cn=mail,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config')

UserAccount(topo.standalone, 'cn=HR Managers,ou=groups,dc=example,dc=com').\
add('uniquemember',
['uid=kvaughan, ou=People, dc=example,dc=com',
'uid=cschmith, ou=People, dc=example,dc=com'])

for i in ['(uniquemember=uid=kvaughan,ou=People,dc=example,dc=com)',
'(uniquemember=uid=rdaugherty, ou=People, dc=example,dc=com)',
'(uniquemember=uid=hmiller, ou=People, dc=example,dc=com)',
'(&(objectclass=inetorgperson)(uid=scarter))',
'(&(objectclass=organizationalperson)(uid=scarter))',
'(objectclass=inetorgperson)',
'(&(objectclass=organizationalPerson)(sn=Jensen))',
'(&(mail=*)(objectclass=organizationalPerson))',
'(mail=*)',
'(&(sn=Rentz)(objectclass=organizationalPerson))',
'(&(sn=Ward)(sn=Ward))',
'(sn=Jensen)',
'(sn=*)',
'(sn=*utz)']:
assert Accounts(topo.standalone, DEFAULT_SUFFIX).filter(i)

UserAccount(topo.standalone, 'cn=config').replace('nsslapd-errorlog-level', '0')

if __name__ == '__main__':
CURRENT_FILE = os.path.realpath(__file__)
pytest.main("-s -v %s" % CURRENT_FILE)

@Ludwig

Try running these Two scrips one is with filter and other is with search_s.

Problem is with search_s i am getting correct result , where with filter wrong result.

Regards

Anuj Borah

On Thu, Apr 25, 2019 at 8:30 PM Ludwig <lkrispen@redhat.com> wrote:

what is your problem ? the searches in both access logs produce the same results:

grep nentries /tmp/access_with* | grep tag=101
/tmp/access_with_filter:[25/Apr/2019:08:36:36.560467098 +0000] conn=1 op=148 RESULT err=0 tag=101 nentries=3 etime=0.0000399837
/tmp/access_with_filter:[25/Apr/2019:08:36:36.562926674 +0000] conn=1 op=149 RESULT err=0 tag=101 nentries=9 etime=0.0000452772
/tmp/access_with_filter:[25/Apr/2019:08:36:36.565416724 +0000] conn=1 op=150 RESULT err=0 tag=101 nentries=8 etime=0.0000416033
/tmp/access_with_filter:[25/Apr/2019:08:36:36.567629593 +0000] conn=1 op=151 RESULT err=0 tag=101 nentries=2 etime=0.0000350486
/tmp/access_with_filter:[25/Apr/2019:08:36:36.569782885 +0000] conn=1 op=152 RESULT err=0 tag=101 nentries=4 etime=0.0000350236
/tmp/access_with_filter:[25/Apr/2019:08:36:36.571945045 +0000] conn=1 op=153 RESULT err=0 tag=101 nentries=7 etime=0.0000367961
/tmp/access_with_filter:[25/Apr/2019:08:36:36.577773550 +0000] conn=1 op=154 RESULT err=0 tag=101 nentries=7 etime=0.0004031631
/tmp/access_with_filter:[25/Apr/2019:08:36:36.579866766 +0000] conn=1 op=155 RESULT err=0 tag=101 nentries=3 etime=0.0000274951
/tmp/access_with_filter:[25/Apr/2019:08:36:36.581771337 +0000] conn=1 op=156 RESULT err=0 tag=101 nentries=3 etime=0.0000312338
/tmp/access_with_filter:[25/Apr/2019:08:36:36.583848484 +0000] conn=1 op=157 RESULT err=0 tag=101 nentries=3 etime=0.1999656509
/tmp/access_with_filter:[25/Apr/2019:08:36:36.587570224 +0000] conn=1 op=158 RESULT err=0 tag=101 nentries=121 etime=0.0001897405
/tmp/access_with_filter:[25/Apr/2019:08:36:36.591514384 +0000] conn=1 op=159 RESULT err=0 tag=101 nentries=2 etime=0.0000319819
/tmp/access_with_filter:[25/Apr/2019:08:36:36.593657986 +0000] conn=1 op=160 RESULT err=0 tag=101 nentries=3 etime=0.0000285626
/tmp/access_with_filter:[25/Apr/2019:08:36:36.595880861 +0000] conn=1 op=161 RESULT err=0 tag=101 nentries=4 etime=0.0000356436
/tmp/access_with_filter:[25/Apr/2019:08:36:36.602518935 +0000] conn=1 op=162 RESULT err=0 tag=101 nentries=120 etime=0.0004828401
/tmp/access_with_filter:[25/Apr/2019:08:36:36.611163994 +0000] conn=1 op=163 RESULT err=0 tag=101 nentries=120 etime=0.0004651831
/tmp/access_with_filter:[25/Apr/2019:08:36:36.640014117 +0000] conn=1 op=166 RESULT err=0 tag=101 nentries=2 etime=0.0000711662
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.910324404 +0000] conn=1 op=148 RESULT err=0 tag=101 nentries=3 etime=0.0000351385
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.912317892 +0000] conn=1 op=149 RESULT err=0 tag=101 nentries=9 etime=0.0000358365
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.914679657 +0000] conn=1 op=150 RESULT err=0 tag=101 nentries=8 etime=0.0000430844
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.916847641 +0000] conn=1 op=151 RESULT err=0 tag=101 nentries=2 etime=0.0000332474
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.918878872 +0000] conn=1 op=152 RESULT err=0 tag=101 nentries=4 etime=0.0000341456
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.920965290 +0000] conn=1 op=153 RESULT err=0 tag=101 nentries=7 etime=0.0000374608
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.926723170 +0000] conn=1 op=154 RESULT err=0 tag=101 nentries=7 etime=0.0004056591
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.928637310 +0000] conn=1 op=155 RESULT err=0 tag=101 nentries=3 etime=0.0000299780
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.930719687 +0000] conn=1 op=156 RESULT err=0 tag=101 nentries=3 etime=0.0000296688
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.932751416 +0000] conn=1 op=157 RESULT err=0 tag=101 nentries=3 etime=0.0000318958
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.936312042 +0000] conn=1 op=158 RESULT err=0 tag=101 nentries=121 etime=0.0001861409
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.939996595 +0000] conn=1 op=159 RESULT err=0 tag=101 nentries=2 etime=0.0000340760
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.942122456 +0000] conn=1 op=160 RESULT err=0 tag=101 nentries=3 etime=0.0000309626
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.944215749 +0000] conn=1 op=161 RESULT err=0 tag=101 nentries=4 etime=0.0000340311
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.950446188 +0000] conn=1 op=162 RESULT err=0 tag=101 nentries=120 etime=0.0004499138
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.957921166 +0000] conn=1 op=163 RESULT err=0 tag=101 nentries=120 etime=0.0004453710
/tmp/access_with_search_s:[25/Apr/2019:08:56:30.968401791 +0000] conn=1 op=166 RESULT err=0 tag=101 nentries=2 etime=0.0000215050

On 04/25/2019 10:59 AM, Anuj Borah wrote:
@Ludwig

Attached the logs .

I have noticed , it happening due to _get_objectclass_filter() method in filter of DSLdapObjects .

Accounts(topo.standalone, DEFAULT_SUFFIX)._objectclasses
['nsAccount', 'nsPerson', 'simpleSecurityObject', 'organization', 'person', 'account', 'organizationalUnit', 'netscapeServer', 'domain', 'posixAccount', 'shadowAccount', 'posixGroup', 'mailRecipient']

but the cn=Accounting Managers,ou=Groups,dc=example,dc=com has objectClass: groupOfUniqueNames .

This may be the problem . You can not find any error in access logs as naturally it does not have any error , its just empty results .

Regards

Anuj Borah
On Thu, Apr 25, 2019 at 12:39 PM Ludwig <lkrispen@redhat.com> wrote:
can you provide the access logs to show what searches were really done

On 04/24/2019 12:23 PM, Anuj Borah wrote:
Hi all,

Please consider bellow condition .
UserAccount(topo.standalone, 'cn=Accounting Managers,ou=groups,dc=example,dc=com').add('uniquemember', [      'uid=scarter, ou=People, dc=example,dc=com', 'uid=tmorris, ou=People, dc=example,dc=com', 'uid=kvaughan, ou=People, dc=example,dc=com',      'uid=rdaugherty, ou=People, dc=example,dc=com', 'uid=hmiller, ou=People, dc=example,dc=com'])    UserAccount(topo.standalone, 'cn=HR Managers,ou=groups,dc=example,dc=com').add('uniquemember', [      'uid=kvaughan, ou=People, dc=example,dc=com', 'uid=cschmith, ou=People, dc=example,dc=com'])
And try to add filter:

With Filter: It fails gives 0 result for those involves Group 'cn=Accounting Managers,ou=groups,dc=example,dc=com' .
for i in ['(uniquemember=uid=kvaughan,ou=People,dc=example,dc=com)',             '(uniquemember=uid=rdaugherty, ou=People, dc=example,dc=com)',            '(uniquemember=uid=hmiller, ou=People, dc=example,dc=com)',             '(&(objectclass=inetorgperson)(uid=scarter))',            '(&(objectclass=organizationalperson)(uid=scarter))',             '(objectclass=inetorgperson)',             '(&(objectclass=organizationalPerson)(sn=Jensen))',            '(&(mail=*)(objectclass=organizationalPerson))',             '(mail=*)',             '(&(sn=Rentz)(objectclass=organizationalPerson))',            '(&(sn=Ward)(sn=Ward))',             '(sn=Jensen)',             '(sn=*)',             '(sn=*utz)']:      assert Accounts(topo.standalone, DEFAULT_SUFFIX).filter(i)
with search_s(Old Way): I gives correct results .
for i in ['(uniquemember=uid=kvaughan,ou=People,dc=example,dc=com)',            '(uniquemember=uid=rdaugherty, ou=People, dc=example,dc=com)',            '(uniquemember=uid=hmiller, ou=People, dc=example,dc=com)',            '(&(objectclass=inetorgperson)(uid=scarter))',            '(&(objectclass=organizationalperson)(uid=scarter))',            '(objectclass=inetorgperson)',            '(&(objectclass=organizationalPerson)(sn=Jensen))',            '(&(mail=*)(objectclass=organizationalPerson))',            '(mail=*)',            '(&(sn=Rentz)(objectclass=organizationalPerson))',            '(&(sn=Ward)(sn=Ward))',            '(sn=Jensen)',            '(sn=*)',            '(sn=*utz)']:      assert topo.standalone.search_s(DEFAULT_SUFFIX, ldap.SCOPE_SUBTREE, i)
I have attached the test script too . Test test_various_combinations_of_filters_and_idlistscanlimit

Regards

Anuj Borah
_______________________________________________  389-devel mailing list -- 389-devel@lists.fedoraproject.org  To unsubscribe send an email to 389-devel-leave@lists.fedoraproject.org  Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines  List Archives: https://lists.fedoraproject.org/archives/list/389-devel@lists.fedoraproject.org  
_______________________________________________
389-devel mailing list -- 389-devel@lists.fedoraproject.org
To unsubscribe send an email to 389-devel-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-devel@lists.fedoraproject.org

Fedora Info

Thursday, April 25, 2019

[389-devel] Re: Groups are not accessible by filter

No comments:

Post a Comment