Re: Fw: OpenLDAP Search bug?

[Banzaitron <banzaitron@adelphia.net>]

----- Original Message -----
From: "Kurt D. Zeilenga" <Kurt@OpenLDAP.org>
To: "Banzaitron" <banzaitron@adelphia.net>
Cc: <openldap-software@OpenLDAP.org>
Sent: Monday, September 09, 2002 4:26 PM
Subject: Re: Fw: OpenLDAP Search bug?


> At 02:35 PM 2002-09-09, Banzaitron wrote:
> >I have set logging to show everything and the problem is that the
candidate
> >set as you call it is the ENTIRE TREE!!!  It is ignoring my start DN and
it
> >is searching below AND above the DN I pass, regardless of the search
scope.
>
> In one of your previous post, you described one case where
> you ONLY changed the filter from a (objectClass=*) to
> (objectClass=myorgservice) caused the candidate to be
> quite large (presumable all entries in the database).
>
> This is odd because, assuming everything else is equal
> (including DN and scope), the latter search candidate
> set should be subset of the former search candidate
> set.

OK yes, sorry I misunderstood your statement.  You are correct in the
following:

Query #1: DN="uid=someone,ou=People,o=someorg,myorgroot=top,o=myorg.com",
search scope=1, filter = (objectclass=myorgservice)

Query #2: DN="uid=someone,ou=People,o=someorg,myorgroot=top,o=myorg.com",
search scope=1, filter = (objectclass=*)

Query #1 takes 5 seconds and looks through the entire tree for matches,
correctly returns 10 matches.  Query #2 runs instantly and does not traverse
the entire tree and correctly returns 10 matches.  It makes no sense.

> Looking at the logs, one can determine which indexing
> component(s) caused this oddity.

Any idea what a good logging level would be, as well as what I should be
looking for?  There was so much information with -1 debugging level, I got
lost.

> But a candidate set which happens to include an entry
> which doesn't match all of the search criteria (including
> DN, scope, filter, etc.) isn't odd.  It's called a
> candidate set because it includes, in addition to
> all entries which do match the criteria, some number
> of entries that do not.  The number of these entries
> depends on how effective the indexing system was on
> reducing the candidate set from all entries to the
> subset of entries matching all of the search criteria.

Are you saying it is normal for a candidate set to include arbitrary DNs
that are not within the search scope of the start DN I pass?  For example,
if I pass the following query:

DN: uid=someone,ou=People,o=org
search scope=1

is it normal for slapd to search starting at o=org, thus increasing the
candidate set by the entire contents of the ldap?

Andy