You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2009/02/11 22:08:03 UTC
DO NOT REPLY [Bug 46698] New: invalid default sizelimit in ldap
searches
https://issues.apache.org/bugzilla/show_bug.cgi?id=46698
Summary: invalid default sizelimit in ldap searches
Product: Apache httpd-2
Version: 2.3-HEAD
Platform: All
OS/Version: All
Status: NEW
Severity: normal
Priority: P3
Component: mod_auth_ldap
AssignedTo: bugs@httpd.apache.org
ReportedBy: matt.richard@fandm.edu
mod_auth_ldap on OpenVMS won't authenticate users against a modern OpenLDAP
installation.
I am using the Apple Open Directory implementation of OpenLDAP from Mac OSX
Server 10.5.6
The function for LDAP authentication is uldap_cache_getuserdn which in turn
uses the function ldap_search_ext_s to do the uid search portion.
In modules/ldap/util_ldap.c, ldap_search_ext_s is called as follows: (revision
737582 ( https://svn.apache.org/viewcvs.cgi?view=rev&rev=737582 ) from 2.3-HEAD)
result = ldap_search_ext_s(ldc->ldap, (char *)reqdn, LDAP_SCOPE_BASE,
"(objectclass=*)", NULL, 1,
NULL, NULL, NULL, APR_LDAP_SIZELIMIT, &res);
and from the top of util_ldap.c:
#ifndef APR_LDAP_SIZELIMIT
#define APR_LDAP_SIZELIMIT -1
#endif
Older revisions (httpd 2.2.5 and before) use a static -1 in place of
APR_LDAP_SIZELIMIT.
>From ldap.h (OpenLDAP), here is the parameters for ldap_search_ext_s:
ldap_search_ext_s LDAP_P((
LDAP *ld,
LDAP_CONST char *base,
int scope,
LDAP_CONST char *filter,
char **attrs,
int attrsonly,
LDAPControl **serverctrls,
LDAPControl **clientctrls,
struct timeval *timeout,
int sizelimit,
LDAPMessage **res ));
So the value '-1' is passsed as the sizeLimit parameter from the client
(mod_auth_ldap) to the server (OpenLDAP).
This seems to work for a lot of client / server combinations, however it is not
working here.
According to RFC 4511 (section 4.5.1 ), sizelimit is an unsigned integer
between 0 and maxInt. A value of zero indicates no size limit.
Would it make sense to change the default APR_LDAP_SIZELIMIT to 0? I welcome
any other feedback...
Thanks,
Matt
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 46698] invalid default sizelimit in ldap searches
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=46698
--- Comment #1 from Matt Richard <ma...@fandm.edu> 2009-03-06 06:30:24 PST ---
I have also tested Apache's mod_auth_ldap against slapd from openldap.org's
OpenLDAP releases, including 2.1.30, 2.2.19, 2.2.30, 2.3.43, and 2.4.15, all
without success.
-Matt
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 46698] invalid default sizelimit in ldap searches
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=46698
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Component|mod_auth_ldap |APR-util
Version|2.3-HEAD |HEAD
AssignedTo|bugs@httpd.apache.org |bugs@apr.apache.org
Product|Apache httpd-2 |APR
--- Comment #2 from Eric Covener <co...@gmail.com> 2009-03-06 06:44:05 PST ---
#if APR_HAS_ZOS_LDAPSDK || APR_HAS_MICROSOFT_LDAPSDK
#define APR_LDAP_SIZELIMIT LDAP_NO_LIMIT
#else
#ifdef LDAP_DEFAULT_LIMIT
#define APR_LDAP_SIZELIMIT LDAP_DEFAULT_LIMIT
#else
#define APR_LDAP_SIZELIMIT -1 /* equivalent to LDAP_DEFAULT_LIMIT */
#endif
#endif
Why isn't the first macro just #ifdef LDAP_NO_LIMIT?
On my recent linux system, ldap.h has LDAP_NO_LIMIT defined as 0.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org