freeipa

#7750 ipaldap: invalid modlist when attribute encoding can vary
Closed: fixed Opened by ftweedal.

Closed: fixed
Reopen Issue

Issue

ipaldap does not take into account the possibility of the attribute encoding
as returned by 389DS differing from the attribute encoding produced by FreeIPA.
This can occur especially in DNs that require escpaing of special characters.
For example, 389DS escapes special characters using hex encoding:

CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\2C Inc.,L=Brisbane,C=AU

Whereas FreeIPA escapes the character directly.

CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\, Inc.,L=Brisbane,C=AU

Therefore it is possible to generate an invalid modlist. For example, during
external CA certificate renewal, if the issuer DN includes a comma in one of the
attribute values (as above), an invalid modlist will be generated:

[ (ldap.MOD_ADD, 'ipacaissuerdn', [b'CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\, Inc.,L=Brisbane,C=AU'])
, (ldap.MOD_DELETE, 'ipacaissuerdn', [b'CN=Test Sub-CA 201604041620,OU=ftweedal,O=Red Hat\2C Inc.,L=Brisbane,C=AU'])
]

In the above case, the attribute already exists, and LDAP error 20 (attributeOrValueExists)
occurs.

Metadata Update from @ftweedal:
- Issue assigned to ftweedal

PR: https://github.com/freeipa/freeipa/pull/2511

Metadata Update from @ftweedal:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/2511

master:

  • 4cd26fcba5b444020536935c979e44af4fdc654b ipaldap: avoid invalid modlist when attribute encoding differs

ipa-4-6:

  • 3cf2490ac45bd4b9028836a3daa60ccec7443682 ipaldap: avoid invalid modlist when attribute encoding differs

ipa-4-5:

  • cb8bcfb2ac2787b07106b05fcc667fcaeb4cb62c ipaldap: avoid invalid modlist when attribute encoding differs

ipa-4-7:

  • 9e7e9c1014c10f838b341a45436aba0840ad5b07 ipaldap: avoid invalid modlist when attribute encoding differs

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • 425dff1e0d2b360557075ea322309411b485d58f ipatests: add test for correct modlist when value encoding differs

ipa-4-6:

  • 04d4f8ba415a40cc033f06e5d01e712bd5698594 ipatests: add test for correct modlist when value encoding differs

ipa-4-7:

  • 7a8b875c2500e00dd7eca9e5425d4569906ee1ef ipatests: add test for correct modlist when value encoding differs

ipa-4-5:

  • 8b5f7c163995d7d4c4f5e2bcdf4f3379637cd513 ipatests: add test for correct modlist when value encoding differs
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/2511
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.