Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-153624

Pagure #9854: Erroneous case-sensitivity in offline DSE lookup

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Normal Normal
    • rhel-10.1.z
    • rhel-10.1.z
    • ipa
    • None
    • Moderate
    • rhel-idm-ipa
    • ssg_idm
    • None
    • Dev ack
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • None
    • None
    • None
    • Unspecified Release Note Type - Unknown
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      Cloned from: https://pagure.io/freeipa/issue/9854
      
      ### Issue
      After migrating 389-dirsrv database (BDB->LMDB) and upgrading from Fedora 41->42 I noticed a new error message  in various `ipa` commands (`ipa-healthcheck`, `ipa server-cert-fix`, ...). 
      
      #### Steps to Reproduce
      1. (unconfirmed, most likely cause: run BDB -> LMDB migration)
      2. run various `ipa` commands that use dsinstance.py:get_server_cert_nickname
      
      #### Actual behavior
      Error message `Unable to find server cert nickname in /etc/dirsrv/slapd-my-instance/dse.ldif` in output
      
      #### Expected behavior
      Since the entry is present, no error should occur.
      
      #### Version/Release/Distribution
      ```
      $ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
      freeipa-server-4.12.2-14.fc42.x86_64
      freeipa-client-4.12.2-14.fc42.x86_64
      package ipa-server is not installed
      package ipa-client is not installed
      389-ds-base-3.1.3-2.fc42.x86_64
      package pki-ca is not installed
      krb5-server-1.21.3-6.fc42.x86_64
      ```
      
      #### Additional info:
      In `dse.ldif` I can see 
      ```
      dn: cn=rsa,cn=encryption,cn=config
      cn: RSA
      createTimestamp: 20170812014705Z
      creatorsName: cn=directory manager
      modifiersName: cn=directory manager
      modifyTimestamp: 20170812014705Z
      nsSSLActivation: on
      nsSSLPersonalitySSL: Server-Cert
      nsSSLToken: internal (software)
      objectClass: top
      objectClass: nsEncryptionModule
      ```
      
      However, `parser.parse_results().keys()` appears to be empty. This is because the case changed and the entries_dn filter in "GetEntryFromLDIF" is wrong. However LDAP is not case sensitive, so any case should be supported, and therefore this is a bug. Probably all keys should be converted to lower case as should all lookups to preserve case insensitivity.
      

              frenaud@redhat.com Florence Renaud
              frenaud@redhat.com Florence Renaud
              Florence Renaud Florence Renaud
              Sudhir Menon Sudhir Menon
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: