lib389 password policy DN handling is incorrect

[droideck]

Issue Description
After a migration between major DS versions, it can happen that already existing password policies will have 'cn' that contains a valid DN in double quote "". We need to strip the quotes before processing the DN with python-ldap.

[droideck]

https://bugzilla.redhat.com/show_bug.cgi?id=2150813

[droideck]

08d57a3..ddc566d 389-ds-base-1.4.3 -> 389-ds-base-1.4.3
a294c1d..dcda92f 389-ds-base-1.4.4 -> 389-ds-base-1.4.4
fae2bf3..d9df6a9 389-ds-base-2.0 -> 389-ds-base-2.0
e278e74..17ac5d2 389-ds-base-2.1 -> 389-ds-base-2.1
3358fd5..51b0e50 389-ds-base-2.2 -> 389-ds-base-2.2

[tbordaz]

@droideck , rereading the patch I have doubt.
The following dn 'cn=nsPwPolicyEntry,ou="my policies",dc=com' could be the value of 'cn'. The patch strips all quotes and double quotes, not only the heading/ending ones. The result is

• cn=nsPwPolicyEntry
• ou=my policies
• dc=com

Where it was

• cn=nsPwPolicyEntry
• ou="my policies"
• dc=com

Do you think it could be a problem for password policy handling. (I think it is not as 'cn' is just informational attribute)

[droideck]

The following dn 'cn=nsPwPolicyEntry,ou="my policies",dc=com' could be the value of 'cn'. The patch strips all quotes and double quotes, not only the heading/ending ones.

Odd... Was you able to reproduce the issue?
I've tried this in python3 (3.10.9) and all works as expected:

>>> dn = '\'cn=nsPwPolicyEntry,ou="my policies",dc=com\''
>>> print(dn)
'cn=nsPwPolicyEntry,ou="my policies",dc=com'
>>> print(dn.strip("\'").strip("\""))
cn=nsPwPolicyEntry,ou="my policies",dc=com

>>> dn = '\"cn=nsPwPolicyEntry,ou="my policies",dc=com\"'
>>> print(dn)
"cn=nsPwPolicyEntry,ou="my policies",dc=com"
>>> print(dn.strip("\'").strip("\""))
cn=nsPwPolicyEntry,ou="my policies",dc=com

>>> dn = 'cn=nsPwPolicyEntry,ou="my policies",dc=com'
>>> print(dn)
cn=nsPwPolicyEntry,ou="my policies",dc=com
>>> print(dn.strip("\'").strip("\""))
cn=nsPwPolicyEntry,ou="my policies",dc=com

But maybe I miss something...

[tbordaz]

@droideck , no you did not miss anything. I was guess something about python strip("'")... and I was wrong. Thanks for your answer and sorry for the noise.

[droideck]

@droideck , no you did not miss anything. I was guess something about python strip("'")... and I was wrong. Thanks for your answer and sorry for the noise.

No worries! Thanks for checking anyway!