You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@directory.apache.org by Markus Pohle <ap...@webunity.de> on 2007/07/23 18:28:34 UTC
[ApacheDS 1.5.0 + DirStudio] Search result differs between Uppercase
and Lowercase Searchstring
Hi List-users,
following problem I see during my tests with ApacheDS. Would like to
know if someone of you do know what the problem is... any hint or tip is
really appreciated.
If my webapp tries to get the roles which contain a given user
"p.groesche" as a uniqueMember, I do get a resultset of zero when the
search string is like this:
(uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
If I modify the search string so that it looks like this
(uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
I do get a result set of one.
I am able to reproduce this behaviour thru Directory Studio searches.
Can anybody explain this behaviour to me? I would really like to know
what the problem is, 'cause I thought ApacheDS is case-insensitive.
The following is the system I used for my tests.
TIA
Markus Pohle
System: CentOS 4.3
ADS: ApacheDS 1.5.0 installed by rpm under /usr/local/apache-1.5.0
Java Version: 1.5.0_10
Defined a partition called DouglasHolding with the following base
structur: http://www.webunity.de/apacheds-tools/basic-structure.ldif
Within this structure I created the following objects:
dn: uid=p.groesche,cn=users,dc=VERWALTUNG,dc=DOUGLASHOLDING
objectClass: organizationalPerson
objectClass: person
objectClass: inetOrgPerson
objectClass: top
cn: Groesche, Peter
givenname: Peter
sn: Groesche
uid: p.groesche
userpassword:: c3RhcnQ=
dn: uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING
objectClass: uidObject
objectClass: alias
objectClass: top
aliasedobjectname: uid=p.groesche,cn=users,dc=VERWALTUNG,dc=DOUGLASHOLDING
uid: p.groesche
dn: cn=Admin,cn=rollen,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING
objectClass: groupOfUniqueNames
objectClass: top
cn: Admin
uniquemember:
uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=douglasholding
Re: [ApacheDS 1.5.0 + DirStudio] Search result differs between Uppercase
and Lowercase Searchstring
Posted by Stefan Zoerner <st...@labeo.de>.
Emmanuel Lecharny wrote:
> Seems to be a clear bug !
>
> I _think_ there is already a JIRA about it, but not 100% sure.
>
Do you mean this one:
uniqueMember attribute compare does not seem to work properly
(uniqueMemberMatch is not implemented?)
http://issues.apache.org/jira/browse/DIRSERVER-766
Similar one is this one:
"Attribute 'uniqueMember' allows for any string, not just DN"
http://issues.apache.org/jira/browse/DIRSERVER-757
Both are not closed yet.
Re: [ApacheDS 1.5.0 + DirStudio] Search result differs between Uppercase and Lowercase Searchstring
Posted by Emmanuel Lecharny <el...@gmail.com>.
Seems to be a clear bug !
I _think_ there is already a JIRA about it, but not 100% sure.
On 7/23/07, Markus Pohle <ap...@webunity.de> wrote:
> Hi List-users,
> hi Emmanuel,
>
> I am so sorry, there is a mistake in my description of the problem:
>
> Search result zero is:
> (uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
>
> Search result one is:
> (uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=douglasholding)
>
> The difference is once dc=DOUGLASHOLDING and dc=douglasholding
>
> I appologize for that mispelling!
>
> And yes, Emmanuel, I have tried to search for
> (uniqueMember=*p.groesche*) just to see if there are any results. And
> this delivers one match, too.
>
> Best regards
> Markus
>
>
> Emmanuel Lecharny schrieb:
> > Hi Markus,
> >
> > have you tried with :
> > (uniqueMember=*p.groesche*) ?
> >
> > Just to check that you get any result.
> >
> > On 7/23/07, Markus Pohle <ap...@webunity.de> wrote:
> >> Hi List-users,
> >>
> >> following problem I see during my tests with ApacheDS. Would like to
> >> know if someone of you do know what the problem is... any hint or tip is
> >> really appreciated.
> >>
> >> If my webapp tries to get the roles which contain a given user
> >> "p.groesche" as a uniqueMember, I do get a resultset of zero when the
> >> search string is like this:
> >> (uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
> >>
> >>
> >> If I modify the search string so that it looks like this
> >> (uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
> >>
> >> I do get a result set of one.
> >>
> >> I am able to reproduce this behaviour thru Directory Studio searches.
> >>
> >> Can anybody explain this behaviour to me? I would really like to know
> >> what the problem is, 'cause I thought ApacheDS is case-insensitive.
> >>
> >> The following is the system I used for my tests.
> >>
> >> TIA
> >> Markus Pohle
> >>
> >>
> >> System: CentOS 4.3
> >> ADS: ApacheDS 1.5.0 installed by rpm under /usr/local/apache-1.5.0
> >> Java Version: 1.5.0_10
> >>
> >> Defined a partition called DouglasHolding with the following base
> >> structur: http://www.webunity.de/apacheds-tools/basic-structure.ldif
> >>
> >> Within this structure I created the following objects:
> >>
> >> dn: uid=p.groesche,cn=users,dc=VERWALTUNG,dc=DOUGLASHOLDING
> >> objectClass: organizationalPerson
> >> objectClass: person
> >> objectClass: inetOrgPerson
> >> objectClass: top
> >> cn: Groesche, Peter
> >> givenname: Peter
> >> sn: Groesche
> >> uid: p.groesche
> >> userpassword:: c3RhcnQ=
> >>
> >> dn: uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING
> >> objectClass: uidObject
> >> objectClass: alias
> >> objectClass: top
> >> aliasedobjectname:
> >> uid=p.groesche,cn=users,dc=VERWALTUNG,dc=DOUGLASHOLDING
> >> uid: p.groesche
> >>
> >> dn: cn=Admin,cn=rollen,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING
> >> objectClass: groupOfUniqueNames
> >> objectClass: top
> >> cn: Admin
> >> uniquemember:
> >> uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=douglasholding
> >>
> >>
> >>
> >
> >
>
--
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com
Re: [ApacheDS 1.5.0 + DirStudio] Search result differs between Uppercase
and Lowercase Searchstring
Posted by Markus Pohle <ap...@webunity.de>.
Hi List-users,
hi Emmanuel,
I am so sorry, there is a mistake in my description of the problem:
Search result zero is:
(uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
Search result one is:
(uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=douglasholding)
The difference is once dc=DOUGLASHOLDING and dc=douglasholding
I appologize for that mispelling!
And yes, Emmanuel, I have tried to search for
(uniqueMember=*p.groesche*) just to see if there are any results. And
this delivers one match, too.
Best regards
Markus
Emmanuel Lecharny schrieb:
> Hi Markus,
>
> have you tried with :
> (uniqueMember=*p.groesche*) ?
>
> Just to check that you get any result.
>
> On 7/23/07, Markus Pohle <ap...@webunity.de> wrote:
>> Hi List-users,
>>
>> following problem I see during my tests with ApacheDS. Would like to
>> know if someone of you do know what the problem is... any hint or tip is
>> really appreciated.
>>
>> If my webapp tries to get the roles which contain a given user
>> "p.groesche" as a uniqueMember, I do get a resultset of zero when the
>> search string is like this:
>> (uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
>>
>>
>> If I modify the search string so that it looks like this
>> (uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
>>
>> I do get a result set of one.
>>
>> I am able to reproduce this behaviour thru Directory Studio searches.
>>
>> Can anybody explain this behaviour to me? I would really like to know
>> what the problem is, 'cause I thought ApacheDS is case-insensitive.
>>
>> The following is the system I used for my tests.
>>
>> TIA
>> Markus Pohle
>>
>>
>> System: CentOS 4.3
>> ADS: ApacheDS 1.5.0 installed by rpm under /usr/local/apache-1.5.0
>> Java Version: 1.5.0_10
>>
>> Defined a partition called DouglasHolding with the following base
>> structur: http://www.webunity.de/apacheds-tools/basic-structure.ldif
>>
>> Within this structure I created the following objects:
>>
>> dn: uid=p.groesche,cn=users,dc=VERWALTUNG,dc=DOUGLASHOLDING
>> objectClass: organizationalPerson
>> objectClass: person
>> objectClass: inetOrgPerson
>> objectClass: top
>> cn: Groesche, Peter
>> givenname: Peter
>> sn: Groesche
>> uid: p.groesche
>> userpassword:: c3RhcnQ=
>>
>> dn: uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING
>> objectClass: uidObject
>> objectClass: alias
>> objectClass: top
>> aliasedobjectname:
>> uid=p.groesche,cn=users,dc=VERWALTUNG,dc=DOUGLASHOLDING
>> uid: p.groesche
>>
>> dn: cn=Admin,cn=rollen,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING
>> objectClass: groupOfUniqueNames
>> objectClass: top
>> cn: Admin
>> uniquemember:
>> uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=douglasholding
>>
>>
>>
>
>
Re: [ApacheDS 1.5.0 + DirStudio] Search result differs between Uppercase and Lowercase Searchstring
Posted by Emmanuel Lecharny <el...@gmail.com>.
Hi Markus,
have you tried with :
(uniqueMember=*p.groesche*) ?
Just to check that you get any result.
On 7/23/07, Markus Pohle <ap...@webunity.de> wrote:
> Hi List-users,
>
> following problem I see during my tests with ApacheDS. Would like to
> know if someone of you do know what the problem is... any hint or tip is
> really appreciated.
>
> If my webapp tries to get the roles which contain a given user
> "p.groesche" as a uniqueMember, I do get a resultset of zero when the
> search string is like this:
> (uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
>
> If I modify the search string so that it looks like this
> (uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
> I do get a result set of one.
>
> I am able to reproduce this behaviour thru Directory Studio searches.
>
> Can anybody explain this behaviour to me? I would really like to know
> what the problem is, 'cause I thought ApacheDS is case-insensitive.
>
> The following is the system I used for my tests.
>
> TIA
> Markus Pohle
>
>
> System: CentOS 4.3
> ADS: ApacheDS 1.5.0 installed by rpm under /usr/local/apache-1.5.0
> Java Version: 1.5.0_10
>
> Defined a partition called DouglasHolding with the following base
> structur: http://www.webunity.de/apacheds-tools/basic-structure.ldif
>
> Within this structure I created the following objects:
>
> dn: uid=p.groesche,cn=users,dc=VERWALTUNG,dc=DOUGLASHOLDING
> objectClass: organizationalPerson
> objectClass: person
> objectClass: inetOrgPerson
> objectClass: top
> cn: Groesche, Peter
> givenname: Peter
> sn: Groesche
> uid: p.groesche
> userpassword:: c3RhcnQ=
>
> dn: uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING
> objectClass: uidObject
> objectClass: alias
> objectClass: top
> aliasedobjectname: uid=p.groesche,cn=users,dc=VERWALTUNG,dc=DOUGLASHOLDING
> uid: p.groesche
>
> dn: cn=Admin,cn=rollen,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING
> objectClass: groupOfUniqueNames
> objectClass: top
> cn: Admin
> uniquemember:
> uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=douglasholding
>
>
>
--
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com
Re: [ApacheDS 1.5.0 + DirStudio] Search result differs between Uppercase and Lowercase Searchstring
Posted by Emmanuel Lecharny <el...@gmail.com>.
Yes, but I don't know when...
I will try to spend a few hours this week, but don't expect it to be
fixed before 2 weeks (vacations ...).
We really want to have it fixed for 1.5.2 version, supposed to be
released before end of august.
Emmanuel
On 7/24/07, Markus Pohle <ap...@webunity.de> wrote:
> Hi Emmanuel,
> hi Stefan.
>
> is there a chance getting this fixed?
>
> Greets
> Markus
>
> Emmanuel Lecharny schrieb:
> > Alex,
> >
> > the first mail from Markus caontained a mistake, and he fixed it in
> > his second post :
> >
> > Search result zero is:
> > (uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
> >
> >
> > Search result one is:
> > (uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=douglasholding)
> >
> >
> > Here there is a difference in the last RDN (dc=DOUGLASHOLDING vs
> > dc=douglasholding).
> >
> > This is a clear bug in the way uniqueMember MatchingRule is handled.
> >
>
--
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com
Re: [ApacheDS 1.5.0 + DirStudio] Search result differs between Uppercase
and Lowercase Searchstring
Posted by Markus Pohle <ap...@webunity.de>.
Hi Emmanuel,
hi Stefan.
is there a chance getting this fixed?
Greets
Markus
Emmanuel Lecharny schrieb:
> Alex,
>
> the first mail from Markus caontained a mistake, and he fixed it in
> his second post :
>
> Search result zero is:
> (uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
>
>
> Search result one is:
> (uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=douglasholding)
>
>
> Here there is a difference in the last RDN (dc=DOUGLASHOLDING vs
> dc=douglasholding).
>
> This is a clear bug in the way uniqueMember MatchingRule is handled.
>
Re: [ApacheDS 1.5.0 + DirStudio] Search result differs between Uppercase and Lowercase Searchstring
Posted by Alex Karasulu <ak...@apache.org>.
Yeah that's bad because dc is caseIgnoreMatch.
Alex
On 7/24/07, Emmanuel Lecharny <el...@gmail.com> wrote:
>
> Alex,
>
> the first mail from Markus caontained a mistake, and he fixed it in
> his second post :
>
> Search result zero is:
> (uniqueMember=uid=p.groesche
> ,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
>
> Search result one is:
> (uniqueMember=uid=p.groesche
> ,cn=users,cn=cas,dc=APPLICATIONS,dc=douglasholding)
>
> Here there is a difference in the last RDN (dc=DOUGLASHOLDING vs
> dc=douglasholding).
>
> This is a clear bug in the way uniqueMember MatchingRule is handled.
>
> --
> Regards,
> Cordialement,
> Emmanuel Lécharny
> www.iktek.com
>
Re: [ApacheDS 1.5.0 + DirStudio] Search result differs between Uppercase and Lowercase Searchstring
Posted by Emmanuel Lecharny <el...@gmail.com>.
Alex,
the first mail from Markus caontained a mistake, and he fixed it in
his second post :
Search result zero is:
(uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
Search result one is:
(uniqueMember=uid=p.groesche,cn=users,cn=cas,dc=APPLICATIONS,dc=douglasholding)
Here there is a difference in the last RDN (dc=DOUGLASHOLDING vs
dc=douglasholding).
This is a clear bug in the way uniqueMember MatchingRule is handled.
--
Regards,
Cordialement,
Emmanuel Lécharny
www.iktek.com
Re: [ApacheDS 1.5.0 + DirStudio] Search result differs between Uppercase and Lowercase Searchstring
Posted by Alex Karasulu <ak...@apache.org>.
On 7/23/07, Markus Pohle <ap...@webunity.de> wrote:
>
> Hi List-users,
>
> following problem I see during my tests with ApacheDS. Would like to
> know if someone of you do know what the problem is... any hint or tip is
> really appreciated.
>
> If my webapp tries to get the roles which contain a given user
> "p.groesche" as a uniqueMember, I do get a resultset of zero when the
> search string is like this:
> (uniqueMember=uid=p.groesche
> ,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
>
> If I modify the search string so that it looks like this
> (uniqueMember=uid=p.groesche
> ,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
> I do get a result set of one.
(uniqueMember=uid=p.groesche
,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
(uniqueMember=uid=p.groesche
,cn=users,cn=cas,dc=APPLICATIONS,dc=DOUGLASHOLDING)
This looks the same to me or am I going blind?
I am able to reproduce this behaviour thru Directory Studio searches.
>
> Can anybody explain this behaviour to me? I would really like to know
> what the problem is, 'cause I thought ApacheDS is case-insensitive.
Case sensitivity depends on the matching rules used by the attributeType.
For example uniqueMember's attributeType description is below from RFC 2256
[http://www.faqs.org/rfcs/rfc2256.html]:
5.51. uniqueMember
( 2.5.4.50 NAME 'uniqueMember' EQUALITY uniqueMemberMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.34 )
The matching characteristics of this attributeType are determined by this
matchingRule
which ApacheDS implements or should :). Let's see what the RFCs say about
that in
(4517) :
4.2.31. uniqueMemberMatch
The uniqueMemberMatch rule compares an assertion value of the Name
And Optional UID syntax to an attribute value of a syntax (e.g., the
Name And Optional UID syntax) whose corresponding ASN.1 type is
NameAndOptionalUID.
The rule evaluates to TRUE if and only if the <distinguishedName>
components of the assertion value and attribute value match according
to the distinguishedNameMatch rule and either, (1) the <BitString>
component is absent from both the attribute value and assertion
value, or (2) the <BitString> component is present in both the
attribute value and the assertion value and the <BitString> component
of the assertion value matches the <BitString> component of the
attribute value according to the bitStringMatch rule.
Note that this matching rule has been altered from its description in
X.520 [X.520] in order to make the matching rule commutative. Server
implementors should consider using the original X.520 semantics
(where the matching was less exact) for approximate matching of
attributes with uniqueMemberMatch as the equality matching rule.
The LDAP definition for the uniqueMemberMatch matching rule is:
( 2.5.13.23 NAME 'uniqueMemberMatch'
SYNTAX 1.3.6.1.4.1.1466.115.121.1.34 )
The uniqueMemberMatch rule is an equality matching rule.
==========
Ok what the heck does this mean. It means that each DN component within the
String
for the DN will be compared according to the matchingRules of the DN
attribute. So if
the you have the following two DN's:
ou=engineering
ou=ENGINeering
They will evaluate to being equal since ou uses caseIgnoreMatch I do
believe. However
these two DNs will not be equal:
uid=RockStar
uid=rockstar
This is because the uid attribute uses caseExactMatch for equality matching.
Making sense now? Basically the equality matchingRule of the attributeType
determines
how matching is conducted during the filter evaluation process.
Since your example strings above were the same I did not see the difference
but
now you can use this information to figure out what's going on.
Alex
Alex