RFE: Add an option to exclude sensitive attributes from the retro changelog DB

[jchapma]

Description.
A user has requested functionality that will allow an admin exclude certain attributes from the retro changelog suffix.

Solution
Add an option that allows an admin exclude attributes from the retro changelog db:

sudo dsconf -D "cn=dm" inst01 plugin retro-changelog set --exclude-attrs "hideme,hidemetoo"

These attributes will be added to the cn=Retro Changelog Plugin,cn=plugins,cn=config dn:

dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: extensibleObject
...
nsslapd-exclude-attrs: hideme,hidemetoo

When the post op plugin is called the retrocl plugin will query the server for excluded attributes and exclude them from the retro changelog db. Similar to the exclude suffix functionality.

Additional context
https://bugzilla.redhat.com/show_bug.cgi?id=1850664

[jchapma]

This RFE will allow a user exclude attributes from the retro changelog db.

After an add/delete/modify/modrdn operation an entry is added to the "cn=changelog" suffix, reflecting the operation.

The changes for this issue will exclude specified attributes from the changelog entry, also the operation changestring will be modified to "hide" the excluded atributes.

Here are two examples of a modify operation before and after this change:

Before

dn: changenumber=32,cn=changelog
objectClass: top
objectClass: changelogentry
objectClass: extensibleObject
targetuniqueid: 86811681-991211eb-81fecedb-88ed0954
car: 131D16647
phone: 11111111
changeNumber: 32
targetDn: uid=ISauder99,ou=product development,dc=test02,dc=com
changeTime: 20210409090433Z
changeType: add
changes:: dWlkOiBJU2F1ZGVyOTkKZ2l2ZW5OYW1lOiBnaXZlbl9uYW1lCm9iamVjdENsYXNzOiB0
 b3AKb2JqZWN0Q2xhc3M6IHBlcnNvbgpvYmplY3RDbGFzczogb3JnYW5pemF0aW9uYWxQZXJzb24Kb
 2JqZWN0Q2xhc3M6IGluZXRvcmdwZXJzb24Kc246IHN1cm5hbWUKY246IHVzZXIKY2FyTGljZW5zZT
 ogMDR3eDExMDM4CmhvbWVQaG9uZTogMDg3ODI3MTQwNApjcmVhdG9yc05hbWU6IGNuPWRtCm1vZGl
 maWVyc05hbWU6IGNuPWRtCmNyZWF0ZVRpbWVzdGFtcDogMjAyMTA0MDkwOTA0MzNaCm1vZGlmeVRp
 bWVzdGFtcDogMjAyMTA0MDkwOTA0MzNaCnBhcmVudGlkOiAzCmVudHJ5aWQ6IDIzCg==

Decoded changestring

replace: homePhone
homePhone: 11111111
-
replace: carLicense
carLicense: 131D16647
-
replace: modifiersname
modifiersname: cn=dm
-
replace: modifytimestamp
modifytimestamp: 20210409090234Z

After (With homePhone attribute excluded)

dn: changenumber=32,cn=changelog
objectClass: top
objectClass: changelogentry
objectClass: extensibleObject
targetuniqueid: 86811681-991211eb-81fecedb-88ed0954
car: 131D16647
changeNumber: 32
targetDn: uid=ISauder99,ou=product development,dc=test02,dc=com
changeTime: 20210409090433Z
changeType: add
changes:: cmVwbGFjZTogaG9tZVBob25lCmhvbWVQaG9uZTogWFhYWFgKLQpyZXBsYWNlOiBjYXJMaWNlbnNl
CmNhckxpY2Vuc2U6IFhYWFhYCi0KcmVwbGFjZTogbW9kaWZpZXJzbmFtZQptb2RpZmllcnNuYW1l
OiBjbj1kbQotCnJlcGxhY2U6IG1vZGlmeXRpbWVzdGFtcAptb2RpZnl0aW1lc3RhbXA6IDIwMjEw
NDA5MDkwMjM0Wgo=

Decoded changestring

replace: homePhone
homePhone: XXXXX
-
replace: carLicense
carLicense: 131D16647
-
replace: modifiersname
modifiersname: cn=dm
-
replace: modifytimestamp
modifytimestamp: 20210409090234Z

I'm currently looking into how these changes will impact syncrepl, I would appreciate any help with answering these questions:

1. Is it better to remove the excluded attribute from the changelog entry changestring or obfuscate the attribute value as shown above.
2. If this change break syncrepl, is there a better way to do it.

NOTE:
Using an ACI to restrict access to certain changelog attributes didn't suit the customer's usage model.

[tbordaz]

@jchapma , sync_repl uses the retrochangelog to detect any change on an entry and send it back to the sync_repl client if the entry matches the sync_repl filter.
I have a concern this RFE can possibly "hide" updates to sync_repl. For example, if 'givenName', 'modifiersname' and 'modifytimestamp' are skipped from retroCL and an update changes only 'givenName', there is a risk that the update will be a NOOP at retroCL level and will not be recorded. To be tested.
If it happens then it should simply be documented so that the administrator knows such tuning may impact sync_repl

The RFE mentioned the ability to exclude attributes and it looks enough for me. obfuscating values can be more complex because you will need to set a value matching the attribute syntax.

[jchapma]

@tbordaz
Thanks for your feedback, so the plan is to exclude the specified attribute from the retrocl entry and document that this feature will have an impact on syncrepl.

[tbordaz]

@jchapma is it okay to close it ?
Remember to copy/paste the git commit (master and branches)

[mreynolds389]

@jchapma This needs to be cherry picked down to 1.4.3 please

[jchapma]

e501b83 -> master
f0861d8 -> 389-ds-base-1.4.3
4ba0f07..e0cf8a9 389-ds-base-1.4.4 -> 389-ds-base-1.4.4

[mreynolds389]

e501b83 -> master
f0861d8 -> 389-ds-base-1.4.3

And 389-ds-base-1.4.4 please

[mreynolds389]

This introduced a complier warning:

../389-ds-base/ldap/servers/plugins/retrocl/retrocl.c: In function ‘retrocl_start’:
../389-ds-base/ldap/servers/plugins/retrocl/retrocl.c:402:20: warning: unused variable ‘length’ [-Wunused-variable]
  402 |             size_t length = strlen(value);
      | 

please fix...