Return-Path: 
 <dev-return-8663-apmail-directory-dev-archive=directory.apache.org@directory.apache.org>
Delivered-To: apmail-directory-dev-archive@www.apache.org
Received: (qmail 90872 invoked from network); 25 Oct 2005 02:17:19 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (209.237.227.199)
  by minotaur.apache.org with SMTP; 25 Oct 2005 02:17:19 -0000
Received: (qmail 44428 invoked by uid 500); 25 Oct 2005 02:17:18 -0000
Delivered-To: apmail-directory-dev-archive@directory.apache.org
Received: (qmail 44225 invoked by uid 500); 25 Oct 2005 02:17:17 -0000
Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:dev-help@directory.apache.org>
List-Unsubscribe: <mailto:dev-unsubscribe@directory.apache.org>
List-Post: <mailto:dev@directory.apache.org>
List-Id: <dev.directory.apache.org>
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Delivered-To: mailing list dev@directory.apache.org
Received: (qmail 44213 invoked by uid 99); 25 Oct 2005 02:17:17 -0000
X-ASF-Spam-Status: No, hits=1.3 required=10.0
	tests=SPF_FAIL
X-Spam-Check-By: apache.org
Received: from [192.87.106.226] (HELO ajax.apache.org) (192.87.106.226)
    by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 24 Oct 2005 19:17:17 -0700
Received: from ajax.apache.org (ajax.apache.org [127.0.0.1])
	by ajax.apache.org (Postfix) with ESMTP id F3BF5220
	for <dev@directory.apache.org>; Tue, 25 Oct 2005 04:16:55 +0200 (CEST)
Message-ID: <861108491.1130206615477.JavaMail.jira@ajax.apache.org>
Date: Tue, 25 Oct 2005 04:16:55 +0200 (CEST)
From: "Alex Karasulu (JIRA)" <directory-dev@incubator.apache.org>
To: dev@directory.apache.org
Subject: [jira] Resolved: (DIREVE-284) Simple bind fails for entries with
 certain partition suffix names
In-Reply-To: <1829541984.1130146736085.JavaMail.jira@ajax.apache.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Virus-Checked: Checked by ClamAV on apache.org
X-Spam-Rating: minotaur.apache.org 1.6.2 0/1000/N

     [ http://issues.apache.org/jira/browse/DIREVE-284?page=all ]
     
Alex Karasulu resolved DIREVE-284:
----------------------------------

    Resolution: Fixed

Committed fix changes on revision 328236 here:

http://svn.apache.org/viewcvs.cgi?rev=328236&view=rev

Looks like lookups were being made against a bare nexus without normalizing the principals name.  I started using the present operation's proxy object with bypasses where normalization was still allowed.  

Added test case in MiscTest for Stefan's Kate Bush user.


> Simple bind fails for entries with certain partition suffix names
> -----------------------------------------------------------------
>
>          Key: DIREVE-284
>          URL: http://issues.apache.org/jira/browse/DIREVE-284
>      Project: Directory Server
>         Type: Bug
>     Reporter: Stefan Zoerner
>     Assignee: Alex Karasulu
>      Fix For: 0.9.3

>
> Some users (i.e. person entries with userPassword attribute) can't authenticate to the server via simple bind. The problem does not exist with entries located in ou=system or dc=apache,dc=org. To give an example:
> I used the default server.xml from
> http://svn.apache.org/viewcvs.cgi/directory/apacheds/trunk/main/server.xml
> to start the server and added the following entry:
> dn: cn=Kate Bush,dc=apache,dc=org
> cn: Kate Bush
> objectclass: top
> objectclass: person
> sn: Bush
> userPassword: Aerial
> After that, the following works as expected:
> $ ldapsearch -h magritte -p 10389 -D "cn=Kate Bush,dc=apache,dc=org" -w Aerial -b "dc=apache,dc=org" "(sn=Bush)" cn
> cn=Kate Bush,dc=apache,dc=org
> cn=Kate Bush
> $
> and providing a wrong password leads to an "invalid credentials". 
> But if I use "dc=aPache,dc=org" as suffix within the partition configuration, i.e.
> <property name="suffix"><value>dc=aPache,dc=org</value></property>
> adjust other occurrences of dc=apache as well and import the person entry above with DN "cn=Kate Bush,dc=aPache,dc=org", the following happens:
> $ ldapsearch -h magritte -p 10389 -D "cn=Kate Bush,dc=aPache,dc=org" -w Aerial -b "dc=aPache,dc=org" "(sn=Bush)" cn
> ldap_simple_bind: Invalid credentials
> $
> But this still works:
> $ ldapsearch -h magritte -p 10389 -D "uid=admin,ou=system" -w secret -b "dc=aPache,dc=org" "(sn=Bush)"
> cn=Kate Bush,dc=aPache,dc=org
> sn=Bush
> cn=Kate Bush
> objectclass=person
> objectclass=top
> userPassword=Aerial
> $
> I have the same problem with suffix "o=sevenSeas" (actually it was the first occurrence I found), and the defect disappears with "o=sevenseas". 
> I therefore assume that the authenticator used for simple binds has problems with the mixed characters in the suffices.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
   http://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see:
   http://www.atlassian.com/software/jira