Re: ACL's using group access do not work (ITS#2118)

[quanah@stanford.edu]

--On Monday, September 30, 2002 1:30 PM -0700 "Kurt D. Zeilenga" 
<Kurt@OpenLDAP.org> wrote:

> To eliminate the SASL authzid stuff from this, you try authenticating
> directly as:
> suRegID=85e49978f61311d2ae662436000baa77,cn=people,dc=stanford,dc=edu
>
> using simple authentication to see if problem is with
> the group code or the authzid code.  Also, modifying
> bdb_group() to print both the DN and the normalized
> DN of the operation may be useful.
>
> I've tried unsuccessfully to duplicate this problem by
> hacking on test007-acls.

Kurt,

Finally, I have some useful information.  I changed value.c in 
servers/slapd to this:

	Debug(LDAP_DEBUG_ARGS, "====> Next set of normalize.\n",0,0,0);
        if( mr->smr_syntax->ssyn_normalize ) {
                struct berval nval_tmp = { 0, NULL };

                rc = mr->smr_syntax->ssyn_normalize(
                        mr->smr_syntax,
                        nval.bv_val == NULL ? val : &nval, &nval_tmp );

                free(nval.bv_val);
                nval = nval_tmp;
                if( rc != LDAP_SUCCESS ) {
                        free(nval.bv_val);
                        Debug(LDAP_DEBUG_ARGS,"===> Did NOT GET 
LDAP_SUCCESS.\n",0,0,0);
                        return LDAP_INAPPROPRIATE_MATCHING;
                }
        }

        Debug(LDAP_DEBUG_ARGS, "===> At the for loop.\n",0,0,0);


Now, when I bind, this is what I see in the syslog:

Oct  2 09:25:48 ldap2.Stanford.EDU slapd[8378]: [ID 487505 local4.debug] 
====> Doing the normalize.
Oct  2 09:25:48 ldap2.Stanford.EDU slapd[8378]: [ID 222091 local4.debug] 
====> Next set of normalize.
Oct  2 09:25:48 ldap2.Stanford.EDU slapd[8378]: [ID 114958 local4.debug] 
>>> dnNormalize: 
<suRegID=85e49978f61311d2ae662436000baa77,cn=people,dc=stanford,dc=edu>
Oct  2 09:25:48 ldap2.Stanford.EDU slapd[8378]: [ID 541742 local4.debug] 
===> Did NOT GET LDAP_SUCCESS.
Oct  2 09:25:48 ldap2.Stanford.EDU slapd[8378]: [ID 631365 local4.debug] <= 
bdb_group: 
"suRegID=85e49978f61311d2ae662436000baa77,cn=people,dc=stanford,dc=edu" not 
in "cn=supervisor,cn=applications,dc=stanford,dc=edu": member

So there is something wrong in this statement:

rc = mr->smr_syntax->ssyn_normalize(
                        mr->smr_syntax,
                        nval.bv_val == NULL ? val : &nval, &nval_tmp );


--Quanah

--
Quanah Gibson-Mount
Senior Systems Administrator
ITSS/TSS/Computing Systems
Stanford University
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html