Bug 34262 - Search for univentionInventoryNumber is case sensitive
Search for univentionInventoryNumber is case sensitive
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: LDAP
UCS 2.3
Other Linux
: P5 normal (vote)
: UCS 4.0
Assigned To: Arvid Requate
Felix Botner
http://www.openldap.org/its/index.cgi...
: interim-3
Depends on: 18183
Blocks:
  Show dependency treegraph
 
Reported: 2014-03-05 17:27 CET by Sönke Schwardt-Krummrich
Modified: 2014-11-26 06:55 CET (History)
3 users (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Ticket number:
Bug group (optional): Usability
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sönke Schwardt-Krummrich univentionstaff 2014-03-05 17:27:56 CET
Reported by a customer: still existing and very annoying.

+++ This bug was initially created as a clone of Bug #18183 +++

# ldapsearch -x -LL univentionInventoryNumber="IVTNR 400" univentionInventoryNumber
version: 1

dn: cn=fsc01,cn=FSC-Futro-A250,cn=ThinClients,cn=computers,dc=knut,dc=univention,dc=de
univentionInventoryNumber: IVTNR 400

# ldapsearch -x -LL univentionInventoryNumber="ivtnr 400" univentionInventoryNumber
version: 1
Comment 1 Arvid Requate univentionstaff 2014-09-08 12:00:52 CEST
There is some strange issue blocking a quick fix currently: When I change caseExactMatch to caseIgnoreMatch the existing attributes are not found any longer (even not with exact search). We had this once and could fix this by running slapindex once again, but somehow I couldn't get it to work yet.
Comment 2 Arvid Requate univentionstaff 2014-09-09 20:31:25 CEST
* If I don't change the default matching rule in the schema file, the following four searches return the object (which already had the attribute before the syntax change):

univention-ldapsearch  -x "(univentionInventoryNumber=INV 938)"
univention-ldapsearch  -x "(univentionInventoryNumber:caseExactMatch:=INV 938)"
univention-ldapsearch  -x "(univentionInventoryNumber:caseIgnoreMatch:=INV 938)"
univention-ldapsearch  -x "(univentionInventoryNumber:caseIgnoreMatch:=inv 938)"


When I change the default matching roule to caseIgnoreMatch only

univention-ldapsearch  -x "(univentionInventoryNumber:caseExactMatch:=INV 938)"

returns a result. This is not exactly expected behaviour.



* When I add the attribute to another object, the search to that value succeeds in any of the possible searches above.



* Another thing we should maybe fix here is that univentionInventoryNumber is not in ldap/index/eq, only in ldap/index/sub.
Comment 3 Arvid Requate univentionstaff 2014-09-10 20:38:47 CEST
I couldn't get this fixed properly in the source code (and changing the normalization of LDAP searches is much too dangerous without upstream consultation). So I created an example script demonstrating the issue and opened an ITS (see URL). Let's see what upstream thinks about this.
Comment 4 Arvid Requate univentionstaff 2014-09-11 11:15:13 CEST
This is the upstream position on how to deal with this:

 Making such changes requires the DB to be reloaded.
Comment 5 Arvid Requate univentionstaff 2014-09-11 13:14:50 CEST
There at least two ways to handle this:

a) change the schema during the update to UCS 4.0
b) keep the schema on update, but use the new schema for new installations,
   and offer a tool and description for migration.
   Caveat: use old schema on new installed slaves in an updated domain?


I guess in both cases it would be good to have a tool to dump, call a hook (i.e. change the schema) and restore the backend. Even in case a) it's probably to messy to patch slapd.pre/postinst to handle the schema change on the fly.

Retagging for UCS 4.0.
Comment 6 Arvid Requate univentionstaff 2014-09-11 14:24:38 CEST
A third way would be to only tackle this in the UDM layer. Again several options here:

a) Use special univention.admin.mapping function for the UDM property

b) Make use of the "extensible matching rule" to explicitly select
   caseIgnoreMatch equality matching in the UDM LDAP search, like: 
   "(univentionInventoryNumber:caseIgnoreMatch:=INV 938)"
   This looks like a more complex change in the lookup functions to
   e.g. adjust search filters containing "univentionInventoryNumber'.
   So this is probably to complex to implement.

Let's focus on option a): This only tackles UDM, but I guess this would be enough, as the customer can always use the "extensible matching rule" in case plain ldap searches are required in some context.

Probably the first option is something that could also be done in errata3.2-x.
Comment 7 Arvid Requate univentionstaff 2014-10-08 20:24:37 CEST
Fixed:
* default matching rule adjusted in schema
* univention-ldap-config has been added to the preup.sh
* the attribute has been added to the ldap/index/eq list
* changelog entry
Comment 8 Felix Botner univentionstaff 2014-10-13 14:59:21 CEST
OK

> * default matching rule adjusted in schema

-> univention-ldapsearch -LLL univentionInventoryNumber="INV*"
dn: cn=master,cn=dc,cn=computers,dc=new,dc=intranet
univentionInventoryNumber: InvNum 876

-> univention-ldapsearch -LLL univentionInventoryNumber="inv*" 
dn: cn=master,cn=dc,cn=computers,dc=new,dc=intranet
univentionInventoryNumber: InvNum 876

-> univention-ldapsearch -LLL univentionInventoryNumber="InvNum 876"
dn: cn=master,cn=dc,cn=computers,dc=new,dc=intranet
univentionInventoryNumber: InvNum 876

-> univention-ldapsearch -LLL univentionInventoryNumber="iNVnUM 876"
dn: cn=master,cn=dc,cn=computers,dc=new,dc=intranet
univentionInventoryNumber: InvNum 876

> * the attribute has been added to the ldap/index/eq list

-> grep univentionInventoryNumber /etc/ldap/slapd.conf 
index   pTRRecord,sambaSID,univentionInventoryNumber eq,sub

> * univention-ldap-config has been added to the preup.sh

OK

> * changelog entry

OK
Comment 9 Stefan Gohmann univentionstaff 2014-11-26 06:55:20 CET
UCS 4.0-0 has been released:
 http://docs.univention.de/release-notes-4.0-0-en.html
 http://docs.univention.de/release-notes-4.0-0-de.html

If this error occurs again, please use "Clone This Bug".