Winsync may fail on DN values if space in replica subtree

[389-ds-bot]

Cloned from Pagure issue: https://pagure.io/389-ds-base/issue/79

• Created at 2012-01-04 19:30:30 by mkosek
• Closed as Invalid
• Assigned to nhosoi (@nhosoi)
• Associated bugzillas
  • https://bugzilla.redhat.com/show_bug.cgi?id=641245

---

https://bugzilla.redhat.com/show_bug.cgi?id=641245

Description of problem:
When you have a rather big scope on AD objects with lots of OU and nested
groups, then full resync may not add some groups to DS. DS replication plugin
will not create local copy of group if it has members which are not yet being
syncronized and you need to some several full resync tasks.

The problem will appears only when you creates sync agreement like this:

dn: cn=1,cn=replica,cn=dc\3Dcompute\2Cdc\3Dmd\2Cdc\3Dmeteorf\2Cdc\3Dru,cn=mapp
 ing tree,cn=config
objectClass: top
objectClass: nsDSWindowsReplicationAgreement
description: 1
cn: 1
nsds7WindowsReplicaSubtree: ou=compute,dc=example,dc=com
nsds7DirectoryReplicaSubtree: cn=compute, dc=compute,dc=example,dc=com
nsds7NewWinUserSyncEnabled: on
nsds7NewWinGroupSyncEnabled: on
nsds7WindowsDomain: md.meteorf.ru
nsDS5ReplicaRoot: dc=compute,dc=md,dc=meteorf,dc=ru
nsDS5ReplicaHost: 10.1.11.12
nsDS5ReplicaPort: 389
nsDS5ReplicaBindDN: cn=dssync,cn=Users,dc=example,dc=com
nsDS5ReplicaBindMethod: SIMPLE
nsDS5ReplicaCredentials:
creatorsName: cn=admin
modifiersName: cn=Multimaster Replication Plugin,cn=plugins,cn=config
createTimestamp: 20101007233232Z
modifyTimestamp: 20101008064232Z

Brief view says that it's ok, but there is an issue:
nsds7DirectoryReplicaSubtree: cn=compute, dc=compute,dc=example,dc=com
contains space between "cn=compute," and "dc=compute,dc=example,dc=com"

and when full resync starts, then next part of code will generate wrong entries
for "uniqueMember" and will not create local copy:

#ldap/servers/plugins/replication/windows_protocol_util.c
============================================================================
static int
map_entry_dn_inbound(Slapi_Entry *e, Slapi_DN **dn, const Repl_Agmt *ra)
{
.......
if (NULL == new_dn)
        {
                char *new_dn_string = NULL;
                slapi_log_error(SLAPI_LOG_REPL, repl_plugin_name, "%s:
map_entry_dn_inbound: creating user:%s\n",agmt_get_long_name(ra),username);
                if (username)
                {
                        const char *suffix =
slapi_sdn_get_dn(windows_private_get_directory_subtree(ra));
                        char *container_str = NULL;

                        container_str =
extract_container(slapi_entry_get_sdn_const(e),
windows_private_get_windows_subtree(ra));
                        /* Local DNs for users and groups are different */
                        if (is_user)
                        {
                                new_dn_string =
PR_smprintf("uid=%s,%s%s",username,container_str,suffix);
.....
 } else
                        {
                                new_dn_string =
PR_smprintf("cn=%s,%s%s",username,container_str,suffix);
=============================================================================
this is because:
const char *suffix =
slapi_sdn_get_dn(windows_private_get_directory_subtree(ra));
will return
" ,dc=compute,dc=example,dc=com"
with lead space, instead of
",dc=compute,dc=example,dc=com"
spaceless entry.

As a result you may see via error logfile:
==========================================================================
Windows sync entry: Adding new local entry dn:
cn=grp1,cn=compute,dc=compute,dc=example,dc=com
objectClass: top
objectClass: groupofuniquenames
objectClass: ntGroup
objectClass: posixGroup
ntGroupDeleteGroup: true
cn: grp1
description:: MTAzMSDQk9Cc0KYgINCQ0KHQntCe0Jgg0YHRg9GJ0LXRgdGC0LLRg9GO0YnQsNG
 PINGB0LjRgdGC0LXQvNCw
uniqueMember: uid=user1,OU=HMC,cn=compute, dc=compute,dc=example,dc=com
uniqueMember: uid=user2,OU=HMC,cn=compute, dc=compute,dc=example,dc=com
uniqueMember: uid=user3,OU=HMC,cn=compute,dc=compute,dc=example,dc=com
uniqueMember: uid=user4,OU=HMC,cn=compute, dc=compute,dc=example,dc=com
uniqueMember: uid=user5,OU=HMC,cn=compute, dc=compute,dc=example,dc=com
ntUserDomainId: grp1
ntGroupType: -2147483646
gidNumber: 1031
ntUniqueId: 42be53fedc54554bb4252d19f017549d


=> send_ldap_result 21::uniqueMember: value 0 invalid per syntax
uniqueMember: value 1 invalid per syntax
uniqueMember: value 3 invalid per syntax
uniqueMember: value 4 invalid per syntax
============================================================================
Entries:
uniqueMember: uid=user1,OU=HMC,cn=compute, dc=compute,dc=example,dc=com
uniqueMember: uid=user2,OU=HMC,cn=compute, dc=compute,dc=example,dc=com
uniqueMember: uid=user4,OU=HMC,cn=compute, dc=compute,dc=example,dc=com
uniqueMember: uid=user5,OU=HMC,cn=compute, dc=compute,dc=example,dc=com
contains space between "cn=compute" and "dc=compute......"
This is because such entries are not yes created in directory server and plugin
trying to fake them via "map_entry_dn_inbound".

Entry:
uniqueMember: uid=user3,OU=HMC,cn=compute,dc=compute,dc=example,dc=com
is correct, because object has already been created in DS tree and
"map_entry_dn_inbound" gets it via  DS.

Sorry that i do not provide you a patch to solve this, as I'm not architecturer
of DS and I don't know where this should be fixed either in
"map_entry_dn_inbound" or in "slapi_sdn_get_dn" or maybe somewhere else.

[389-ds-bot]

Comment from rmeggins (@richm) at 2012-01-10 06:05:47

batch update to FUTURE milestone

[389-ds-bot]

Comment from rmeggins (@richm) at 2012-08-14 19:56:22

set default ticket origin to Community

[389-ds-bot]

Comment from nkinder (@nkinder) at 2012-08-28 04:14:27

Added initial screened field value.

[389-ds-bot]

Comment from arubin at 2012-08-29 21:34:02

needs a RHEL BZ

[389-ds-bot]

Comment from nhosoi (@nhosoi) at 2012-11-10 07:20:36

This is no longer an issue in the target version of 389-ds-base since slapi_sdn_get_dn always returns the normalized dn which does not have the leading/trailing spaces.

PR_smprintf("cn=%s,%s%s",username,container_str,suffix);

this is because:
const char *suffix =
slapi_sdn_get_dn(windows_private_get_directory_subtree(ra));
will return
" ,dc=compute,dc=example,dc=com"
with lead space, instead of
",dc=compute,dc=example,dc=com"
spaceless entry.

I tested WinSync with these replica subtrees and verified the sync worked in the both ways.
nsds7WindowsReplicaSubtree: ou=adpasssync,dc=win2k8sync64,dc=com
nsds7DirectoryReplicaSubtree: ou=dswinsync, dc=passsync, dc=com

[389-ds-bot]

Comment from nhosoi (@nhosoi) at 2012-11-13 00:35:22

I'm closing this bug as worksforme for now. If you run see this bug, please feel free to reopen this ticket.

[389-ds-bot]

Comment from nhosoi (@nhosoi) at 2017-02-11 23:00:21

Metadata Update from @nhosoi:

• Issue assigned to nhosoi
• Issue set to the milestone: 1.3.0.rc1