search

389ds / 389-ds-base

The enterprise-class Open Source LDAP server for Linux
https://www.port389.org/
Other
210 stars 90 forks source link

search having substring filter on attribute with dn syntax may fail to return matching entries #6203

Open progier389 opened 3 months ago

progier389 commented 3 months ago

Issue Description search having substring filter on attribute with dn syntax may fail to return matching entries

Package Version and Platform:

Steps to Reproduce Steps to reproduce the behavior:

  1. Create an instance with the sample data
  2. Run: ldapsearch ... -b dc=example,dc=com "(entrydn=uid=DEMO_USER,ou=people,dc=example,dc=com)" dn (... are the connection and authentication info of your instance)
  3. Run: ldapsearch ... -b dc=example,dc=com "(entrydn=uid=DEMO*USER,ou=people,dc=example,dc=com)" dn
  4. See error: 2. returns 1 entry while 3. returns no entries

Expected results

  1. and 3. should both returns the uid=demo_user,ou=people,dc=example,dc=com entry

Additional context Turning on trace and filter log level helps to understand the problem: we see that the regex that check the substring value is not properly normalized. Likely because USER,ou=people,dc=example,dc=com is not a proper dn and the normalization fails