Parameter suffix failed, because of too restrictive patterns in openldap/lib/puppet/type/openldap_database.rb

[wkernler]

Affected Puppet, Ruby, OS and module versions/distributions

• Puppet: 7.26.0
• Ruby: 2.7.6
• Distribution: RHEL 7/8/9
• Module version: 7.0.0

How to reproduce (e.g Puppet code you use)

openldap::server::database { 'xxOuId=AT:YY:999,dc=at': ... }

What are you seeing

Error: Failed to apply catalog: Parameter suffix failed on Openldap_database[xxOuId=AT:YY:999,dc=at]: 
Invalid value (file: /etc/puppetlabs/code/environments/xxxx/modules/openldap/manifests/server/database.pp, line: 70)

What behaviour did you expect instead

Successful creation of database

Output log

Any additional information you'd like to impart

There are two problems:

• xxOuId is not allowed as key in the pattern
• a collon (:) in then value is not allowed in the pattern

I could work around this error in adding an extra rule to openldap/lib/puppet/type/openldap_database.rb:

  newparam(:suffix, namevar: true) do
    desc 'The default namevar.'
      validate do |value|
        raise ArgumentError, 'Invalid value' unless [
        /\Acn=config\z/,
        /\Acn=monitor\z/,
        %r{\AxxOuId=[[:alnum:].:-]+(,(dc|o)=[[:alnum:].-]+)*\z}, # WORKAROUND: xxOuId and ':' in value
        %r{\A(dc|o)=[[:alnum:].-]+(,(dc|o)=[[:alnum:].-]+)*\z},
      ].any? do |pattern|
        pattern.match?(value)
      end
    end
  end

[virus2500]

Hi seems like a similiar problem i am facing in #391

[smortex]

Hum, I guess I was influenced by RFC2247 and also added o= support to cope with the test suite. A parser that match the grammar from RFC2253 seems needed if we want something reliable…