suffix massaging in back-ldap (ITS#1002)

[masarati@aero.polimi.it]

Full_Name: Pierangelo Masarati
Version: devel
OS: 
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (151.99.223.33)


There is a limitation in the suffix massaging feature recently introduced
in the devel branch of back-ldap (ITS#924).
The massaging is based on case-insensitive comparison of the terminal part of
both
incoming (all operations with a dn/base) and outgoing (search results) dns
against
the virtual and the real naming context strings as entered in slapd.conf with
the suffixmassage directive. A problem occurs in case the incoming/outgoing dn
has different "beautification" in terms of spaces after commas. As an example,
if the server is configured as

# "virtual naming context" for backend selection
suffix "dc=my,dc=org"
# "virtual naming context" vs. "real naming context"
suffixmassage "dc=my,dc=org" "o=My Org, c=IT"

a request with, for instance, a search base of "dc=my, dc=org" would correctly
make the database be selected, because the suffix comparison is made against
the
NORMALIZED dn. However, as the suffix massage comparison needs be performed
against the non-normalized dns, no massaging would occur, resulting in a failed
search and in any case in a behavior that is different from the desired one.

This limitation would be overcome by splitting the suffix comparison into the 
comparison of each relative dn component; otherwise, the comparison could be
made
against the normalized strings, whereas the correct splitting point needs be 
recovered in an alternative manner, that does not rely on the length of the 
matching part ...

All these problems would be overcome by the rewriting capability proposed in 
ITS#989, by using the following syntax:

# all client->server rewrite operations
rewriteContext default
rewriteRule "(.*)dc=my,([ ]?)dc=org" "%1o=My Org,%2c=IT"

# only server->client rewrite operation
rewriteContext searchResult
rewriteRule "(.*)o=My Org,([ ]?)c=IT" "%1dc=my,%2dc=org"

# no rewriting of search filters (no rewriteRule directive should follow...)
rewriteContext searchFilter

Pierangelo Masarati      mailto:ando@sys-net.it
Developer, SysNet s.n.c. http://www.sys-net.it