Bug 26647 – Samba LDB Indizierung von SIDs in Deleted Objects

Bug 26647 - Samba LDB Indizierung von SIDs in Deleted Objects


Summary:	Samba LDB Indizierung von SIDs in Deleted Objects

Status:	RESOLVED DUPLICATE of bug 26535

Product:	UCS@school
Classification:	Unclassified
Component:	Samba
Version:	UCS@school 3.0
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	Samba maintainers
QA Contact:

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2012-03-28 10:24 CEST by Arvid Requate
Modified:	2012-03-28 10:36 CEST (History)
CC List:	0 users

See Also:
What kind of report is it?:	---
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2012-03-28 10:24:48 CEST

Im UCS@School Kontext gibt es Rejects im S4 Connector wenn ein Rechnerkonto im SD gelöscht wird und dann mit der ursprünglichen SID wieder von OpenLDAP in das Samba Directory synchronisiert wird. Die Rejects gehen darauf zurück, dass das im SD gelöschte Objekt mit objectSid im Container "CN=Deleted Objects" liegt und die LDB-Indizierung daher mit der Fehlermeldung

 ../lib/ldb/ldb_tdb/ldb_index.c:1107: unique index violation on objectSid

das Anlegen eines Objects mit gleicher objectSid verweigert.


root@qamaster:~# univention-s4search \
  --show-deleted  objectsid=S-1-5-21-3249565516-167943855-79951987-5016 
# record 1
dn: CN=qaslave\0ADEL:23c0ffc5-f1c7-4e13-8b02-b602c05ee6e1,CN=Deleted 
Objects,DC=arschool3i1,DC=qa
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
instanceType: 4
whenCreated: 20120315135106.0Z
uSNCreated: 3814
objectGUID: 23c0ffc5-f1c7-4e13-8b02-b602c05ee6e1
userAccountControl: 532480
sAMAccountName: qaslave$
objectSid: S-1-5-21-3249565516-167943855-79951987-5016
isDeleted: TRUE
lastKnownParent: CN=dc,CN=server,CN=computers,OU=SITE1,DC=arschool3i1,DC=qa
cn:: cWFzbGF2ZQpERUw6MjNjMGZmYzUtZjFjNy00ZTEzLThiMDItYjYwMmMwNWVlNmUx
name:: cWFzbGF2ZQpERUw6MjNjMGZmYzUtZjFjNy00ZTEzLThiMDItYjYwMmMwNWVlNmUx
whenChanged: 20120315135444.0Z
uSNChanged: 3836
distinguishedName: CN=qaslave\0ADEL:23c0ffc5-f1c7-4e13-8b02-b602c05ee6e1,CN=De
 leted Objects,DC=arschool3i1,DC=qa

Comment 1 Arvid Requate

2012-03-28 10:25:01 CEST

Auch AD entfernt die objectSid nicht von den "Tombstone Objects":

"[AD] Strips all attributes that are not needed by Active Directory. A few key attributes, including objectGuid , objectSid , distinguishedName , nTSecurityDescriptor , and usnChanged , are preserved on the tombstone."
  -- http://technet.microsoft.com/en-us/library/cc961798.aspx

Comment 2 Arvid Requate

2012-03-28 10:36:53 CEST


*** This bug has been marked as a duplicate of bug 26535 ***