We've had problems with SSSD being slow sometimes, but not others (probably only slow whenver it's caches expired?), and there never seemed to be any obvious cause why, but I think I've tracked it down to problems with dereferencing. We do see errors about dereferencing in the log, but I didn't realize until now what it was referring to - due to how our SSD configuration sections were named, I thought it was a Kerberos issue for a long time...
In theory, a search like this should give us the cn and objectclass of all members of the group, but I get only the attributes of the group itself. Whether I give the "-E 'deref=...'" or not I get the same output. Redacted output below:
ldapsearch [bind username and password stuff, etc] -E 'deref=uniqueMember:cn,objectclass' 'cn=Global System Administrators' # extended LDIF # # LDAPv3 # base <[our base DN]> (default) with scope subtree # filter: cn=Global System Administrators # requesting: ALL # with dereference control # # Global System Administrators, Groups, [our base DN] dn: cn=Global System Administrators,ou=Groups,[our base DN] control: 1.3.6.1.4.1.4203.666.5.16 false MIQAAAAA uniqueMember: uid=user1,ou=Users,ou=[Office1],[our base DN] uniqueMember: uid=user2,ou=Users,ou=[Office2],[our base DN] uniqueMember: uid=user3,ou=Users,ou=[Office2],[our base DN] uniqueMember: uid=user4,ou=Users,ou=[Office1],[our base DN] objectClass: top objectClass: groupofuniquenames objectClass: posixgroup cn: Global System Administrators gidNumber: 1001002 description: Global System Administrators # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1
I posted this to the 389-ds-user-list and Ludwig Krispenz responded and said I should open a ticket, and that if we had performed the query with the control specified as critical "-E '!deref=....' we would get an error the the deref attr needs to be of dn syntax. I did try that, and indeed, it said "A dereference attribute must have DN syntax". Per Ludwig Krispenz, "in 389 ds uniquemember is specified as 'Name and Optional UID' syntax, which is dn [#UID], but the deref plugin just checks for dn syntax."
no cloning, upstream tests can cover this.
git patch file (master) 0001-Ticket-47757-Unable-to-dereference-unqiemember-attri.patch
I have tested without and with the patch and can confirm that it corrects the behaviour for the query with "-E 'deref=uniqueMember:cn,objectclass'".
Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1256938
Reviewed by Mark (Thanks!!)
Pushed to master: 5fe2892..2dbbb9d master -> master commit 2dbbb9d
Pushed to 389-ds-base-1.3.4: 19b0d4a..626f2d7 389-ds-base-1.3.4 -> 389-ds-base-1.3.4 commit 626f2d7
Metadata Update from @nhosoi: - Issue assigned to lkrispen - Issue set to the milestone: 1.3.4 backlog
389-ds-base is moving from Pagure to Github. This means that new issues and pull requests will be accepted only in 389-ds-base's github repository.
This issue has been cloned to Github and is available here: - https://github.com/389ds/389-ds-base/issues/1089
If you want to receive further updates on the issue, please navigate to the github issue and click on subscribe button.
subscribe
Thank you for understanding. We apologize for all inconvenience.
Metadata Update from @spichugi: - Issue close_status updated to: wontfix (was: Fixed)
Login to comment on this ticket.