Re: (ITS#5024) Disabling pagedResults advertisements

[ando@sys-net.it]

v_orgos@yahoo.com.au wrote:

> I am upgrading from 2.0.xx (RHEL3) to 2.2.13 on RHEL4. Outlook 2003 clients have
> been using the old ldap server with no issues at all but during testing on the
> new RHEL4 test server I've come across the problem discussed at

First of all, upgrade to 2.3.

> http://www.openldap.org/lists/openldap-software/200408/msg00298.html
> 
> As suggested I've tried to stop it advertising pagedResults but it does not
> work.
> 
> I've tried 
> 
> access to dn.exact="" filter="(supportedControl=1.2.840.113556.1.4.319)"
>         by * none

This would filter out the whole rootDSE, but supportedControl has no 
matching rule.

> 
> but this does not work and I've tried 
> 
> ccess to dn.exact="" attrs=supportedControl val=1.2.840.113556.1.4.319
>         by * none

This doesn't work because supportedControl has no matching tule

> which seg faults.

It's a pity that you discovered this so late; if you found it when 2.2. 
was the latest, we could have fixed it.

> I would appreciate if you would provide me with the correct syntax or some means
> to allow Outlook to work correctly.

The real fix would be to dismiss Outlook.  A workaround for OpenLDAP 2.2 is

access to dn.exact="" attrs=supportedControl
                 val.regex="^1\.2\.840\.113556\.1\.4\.319$"
         by * none

The "right" syntax for 2.3 is

access to dn.exact="" attrs=supportedControl
                 val/objectIdentifierMatch="1.2.840.113556.1.4.319"
         by * none

> I really do not want to have to maintain a custom RPM or have to patch RedHat's
> everytime there is an update/security patch.


You won't get too many updates from RedHat anyway...

p.



Ing. Pierangelo Masarati
OpenLDAP Core Team

SysNet s.r.l.
via Dossi, 8 - 27100 Pavia - ITALIA
http://www.sys-net.it
---------------------------------------
Office:  +39 02 23998309
Mobile:  +39 333 4963172
Email:   pierangelo.masarati@sys-net.it
---------------------------------------