Re: Fw: OpenLDAP Search bug?

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

At 03:51 PM 2002-09-09, Banzaitron wrote:
>> At 02:35 PM 2002-09-09, Banzaitron wrote:
>> >I have set logging to show everything and the problem is that the
>candidate
>> >set as you call it is the ENTIRE TREE!!!  It is ignoring my start DN and
>it
>> >is searching below AND above the DN I pass, regardless of the search
>scope.
>>
>> In one of your previous post, you described one case where
>> you ONLY changed the filter from a (objectClass=*) to
>> (objectClass=myorgservice) caused the candidate to be
>> quite large (presumable all entries in the database).
>>
>> This is odd because, assuming everything else is equal
>> (including DN and scope), the latter search candidate
>> set should be subset of the former search candidate
>> set.
>
>OK yes, sorry I misunderstood your statement.  You are correct in the
>following:
>
>Query #1: DN="uid=someone,ou=People,o=someorg,myorgroot=top,o=myorg.com",
>search scope=1, filter = (objectclass=myorgservice)
>
>Query #2: DN="uid=someone,ou=People,o=someorg,myorgroot=top,o=myorg.com",
>search scope=1, filter = (objectclass=*)
>
>Query #1 takes 5 seconds and looks through the entire tree for matches,
>correctly returns 10 matches.  Query #2 runs instantly and does not traverse
>the entire tree and correctly returns 10 matches.  It makes no sense.

It's at least odd.

>> Looking at the logs, one can determine which indexing
>> component(s) caused this oddity.
>
>Any idea what a good logging level would be, as well as what I should be
>looking for?  There was so much information with -1 debugging level, I got
>lost.

        -d 1 -d 2 -d 4 -d 8 -d 32 -d 128


>> But a candidate set which happens to include an entry
>> which doesn't match all of the search criteria (including
>> DN, scope, filter, etc.) isn't odd.  It's called a
>> candidate set because it includes, in addition to
>> all entries which do match the criteria, some number
>> of entries that do not.  The number of these entries
>> depends on how effective the indexing system was on
>> reducing the candidate set from all entries to the
>> subset of entries matching all of the search criteria.
>
>Are you saying it is normal for a candidate set to include arbitrary DNs
>that are not within the search scope of the start DN I pass?

Under certain circumstances, it's quite normal.  In particular,
when the number of entries matching the baseObject and scope
criteria is large.

Under normal circumstances, it unusual but still possible.
(for example, due to key collisions in the indexing system.)

>For example, if I pass the following query:
>
>DN: uid=someone,ou=People,o=org
>search scope=1
>
>is it normal for slapd to search starting at o=org, thus increasing the
>candidate set by the entire contents of the ldap?

See above.