freeipa

#8301 The value of the first character in target* keywords is expected to be a double quote
Closed: fixed by cheimes. Opened by vashirov.

Closed: fixed
Reopen Issue

A fix for https://pagure.io/389-ds-base/issue/51054 now enforces syntax for target* keywords (targetattr, targetfilter, etc) to have quoted attributes. Otherwise the aci that contains unquoted parameters is ignored: 

[30/Apr/2020:04:29:09.218921780 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr = cACertificate)
[30/Apr/2020:04:29:09.225986375 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (target = "ldap:///cn=cacert,cn=ipa,cn=etc,dc=ipa,dc=test
[30/Apr/2020:04:29:09.229397407 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((target = "ldap:///cn=CAcert,cn=ipa,cn=etc,dc=ipa,dc=test")(targetattr = cACertificate)(version 3.0; acl "Modify CA Certificate"; allow (write) groupdn = "ldap:///cn=ipaservers,cn=hostgroups,cn=accounts,dc=ipa,dc=test";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.232683772 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=ipa,dc=test does not exist
[30/Apr/2020:04:29:09.235684494 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=ipa,dc=test does not exist
[30/Apr/2020:04:29:09.246015035 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr=*)
[30/Apr/2020:04:29:09.250400690 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr=*
[30/Apr/2020:04:29:09.253345429 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr=*)(version 3.0; acl "cert manager access v2"; allow (all) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.359314311 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr  = aci)
[30/Apr/2020:04:29:09.365384613 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr  = aci
[30/Apr/2020:04:29:09.368774106 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr != aci)(version 3.0; aci "cert manager read access"; allow (read, search, compare) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.372519869 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr=*)
[30/Apr/2020:04:29:09.375374124 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config
[30/Apr/2020:04:29:09.380259881 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((target = "ldap:///cn=automember rebuild membership,cn=tasks,cn=config")(targetattr=*)(version 3.0;acl "permission:Add Automember Rebuild Membership Task";allow (add) groupdn = "ldap:///cn=Add Automember Rebuild Membership Task,cn=permissions,cn=pbac,dc=ipa,dc=test";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.384798970 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr=*)
[30/Apr/2020:04:29:09.388333819 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr=*
[30/Apr/2020:04:29:09.399869985 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr=*)(version 3.0;acl "permission:Add Replication Agreements";allow (add) groupdn = "ldap:///cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=ipa,dc=test";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.405179605 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr=*)
[30/Apr/2020:04:29:09.408356753 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr=*
[30/Apr/2020:04:29:09.414310017 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "permission:Modify Replication Agreements"; allow (read, write, search) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=ipa,dc=test";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.417676495 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr=*)
[30/Apr/2020:04:29:09.421322798 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr=*
[30/Apr/2020:04:29:09.424238629 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "permission:Remove Replication Agreements";allow (delete) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=ipa,dc=test";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.427282650 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr=*)
[30/Apr/2020:04:29:09.430585254 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr=*
[30/Apr/2020:04:29:09.434033066 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr=*)(version 3.0; acl "Run tasks after replica re-initialization"; allow (add) groupdn = "ldap:///cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=ipa,dc=test";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.437237956 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr=*)
[30/Apr/2020:04:29:09.441939166 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr=*
[30/Apr/2020:04:29:09.445375826 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr=*)(version 3.0; acl "cert manager: Run tasks after replica re-initialization"; allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.448689557 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr  = aci)
[30/Apr/2020:04:29:09.452242617 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr  = aci
[30/Apr/2020:04:29:09.455431998 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr != aci)(version 3.0; aci "cert manager manage replication users"; allow (all) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.459333351 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr=*)
[30/Apr/2020:04:29:09.462509506 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr=*
[30/Apr/2020:04:29:09.465797457 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr=*)(version 3.0;acl "cert manager: Add Replication Agreements";allow (add) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.471680429 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr=*)
[30/Apr/2020:04:29:09.475159525 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr=*
[30/Apr/2020:04:29:09.480348188 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr=*)(targetfilter="(|(objectclass=nsds5Replica)(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement)(objectClass=nsMappingTree))")(version 3.0; acl "cert manager: Modify Replication Agreements"; allow (read, write, search) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.483587202 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr=*)
[30/Apr/2020:04:29:09.489072368 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr=*
[30/Apr/2020:04:29:09.492184555 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version 3.0;acl "cert manager: Remove Replication Agreements";allow (delete) userdn = "ldap:///uid=pkidbuser,ou=people,o=ipaca";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.495079648 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr=*)
[30/Apr/2020:04:29:09.498001640 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr=*
[30/Apr/2020:04:29:09.501029658 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr=*)(version 3.0; acl "Cert Manager access for VLV searches"; allow (read) userdn="ldap:///uid=pkidbuser,ou=people,o=ipaca";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.505136920 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr=dnaNextRange || dnaNextValue || dnaMaxValue)
[30/Apr/2020:04:29:09.508171533 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr=dnaNextRange || dnaNextValue || dnaMaxValue
[30/Apr/2020:04:29:09.511074050 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr=dnaNextRange || dnaNextValue || dnaMaxValue)(version 3.0;acl "permission:Modify DNA Range";allow (write) groupdn = "ldap:///cn=Modify DNA Range,cn=permissions,cn=pbac,dc=ipa,dc=test";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.514452826 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr=cn || dnaMaxValue || dnaNextRange || dnaNextValue  || dnaThreshold || dnaType || objectclass)
[30/Apr/2020:04:29:09.517350321 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr=cn || dnaMaxValue || dnaNextRange || dnaNextValue  || dnaThreshold || dnaType || objectclass
[30/Apr/2020:04:29:09.520832956 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr=cn || dnaMaxValue || dnaNextRange || dnaNextValue  || dnaThreshold || dnaType || objectclass)(version 3.0;acl "permission:Read DNA Range";allow (read, search, compare) groupdn = "ldap:///cn=Read DNA Range,cn=permissions,cn=pbac,dc=ipa,dc=test";)) ACL will not be considered for evaluation because of syntax errors.
[30/Apr/2020:04:29:09.525390042 -0400] - ERR - NSACLPlugin - __aclp__init_targetattr - targetattr has an invalid value (targetattr=nsslapd-readonly)
[30/Apr/2020:04:29:09.528461619 -0400] - ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE ERR(rv=-5): (targetattr=nsslapd-readonly
[30/Apr/2020:04:29:09.534681938 -0400] - ERR - NSACLPlugin - __aclinit_handler - This  ((targetattr=nsslapd-readonly)(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=ipa,dc=test";)) ACL will not be considered for evaluation because of syntax errors.

Metadata Update from @cheimes:
- Issue assigned to cheimes
- Issue priority set to: important
- Issue set to the milestone: FreeIPA 4.8.7

Viktor is working on a PR.

https://github.com/freeipa/freeipa/pull/4623
https://github.com/dogtagpki/pki/pull/397

master:

  • 273ed1535d54a4ab213cca6cee1e39497b9ad75b Update ACIs with the correct syntax

ipa-4-8:

  • 218e655617400097e5dcd2fa0aae82b21e8c2366 Update ACIs with the correct syntax

ipa-4-6:

  • f42dac1ee84427daeed97d5145213d862e80b59c Update ACIs with the correct syntax

Metadata Update from @cheimes:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to 389-ds 1.4 enforces syntax for target* keywords (targetattr, targetfilter, etc) to have quoted attributes. Otherwise the aci that contains unquoted parameters is ignored. Default FreeIPA access controls were fixed to follow 389-ds syntax. Any third-party ACIs need to be updated manually.
Metadata
None
None
None
Low
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.