[389-users] Groupe modifications and internalModifiersName

[Ivanov Andrey (M.)]

Hi,, 

i continue with my tests of 389ds v1.3.2.24. I've encountered another bug or strange
behavior (by design?). 
I've activated bind dn tracking ( nsslapd-plugin-binddn-tracking: on ). There is an
account that has the write to add the entries and to change some attributes (e.g.
description). The corresponding ACI: 

dn: ou=Cours,ou=Enseignement,ou=Groupes,dc=id,dc=polytechnique,dc=edu 
aci: (targetattr = " objectClass || uniqueMember || owner || cn || description ||
businessCategory " ) (version 3.0;acl "Droits de rejouter/supprimer/modifier les
groupes et leurs att 
ributs";allow ( add, delete, read,compare,search,write
)(userdn="ldap:///uid=sync-cours,ou=Comptes
generiques,ou=Utilisateurs,dc=id,dc=polytechnique,dc=edu");) 


Any attempt to modify an authorized attribute from the list above (for ex., description )
results in 
ldap_modify: Insufficient access (50) 
additional info: Insufficient 'write' privilege to the
'internalModifiersName' attribute of entry
'cn=mec431-2014,ou=2014,ou=cours,ou=enseignement,ou=groupes,dc=id,dc=polytechnique,dc=edu'.



[11/Nov/2014:10:38:49 +0100] conn=4 fd=256 slot=256 connection from 129.104.31.54 to
129.104.69.49 
[11/Nov/2014:10:38:49 +0100] conn=4 op=0 BIND dn="" method=sasl version=3
mech=GSSAPI 
[11/Nov/2014:10:38:49 +0100] conn=4 op=0 RESULT err=14 tag=97 nentries=0 etime=0.008000,
SASL bind in progress 
[11/Nov/2014:10:38:49 +0100] conn=4 op=1 BIND dn="" method=sasl version=3
mech=GSSAPI 
[11/Nov/2014:10:38:49 +0100] conn=4 op=1 RESULT err=14 tag=97 nentries=0 etime=0.002000,
SASL bind in progress 
[11/Nov/2014:10:38:49 +0100] conn=4 op=2 BIND dn="" method=sasl version=3
mech=GSSAPI 
[11/Nov/2014:10:38:49 +0100] conn=4 op=2 RESULT err=0 tag=97 nentries=0 etime=0.001000
dn="uid=sync-cours,ou=comptes
generiques,ou=utilisateurs,dc=id,dc=polytechnique,dc=edu" 
[11/Nov/2014:10:38:49 +0100] conn=4 op=3 SRCH
base="dc=id,dc=polytechnique,dc=edu" scope=2 filter="(cn=MEC431-2014)"
attrs=ALL 
[11/Nov/2014:10:38:49 +0100] conn=4 op=3 RESULT err=0 tag=101 nentries=1 etime=0.003000 
[11/Nov/2014:10:39:00 +0100] conn=4 op=4 MOD
dn="cn=MEC431-2014,ou=2014,ou=Cours,ou=Enseignement,ou=Groupes,dc=id,dc=polytechnique,dc=edu"

[11/Nov/2014:10:39:00 +0100] conn=4 op=4 RESULT err=50 tag=103 nentries=0 etime=0.002000 


is it an expected behavior and i need to add to all the ACIs that allow modifications the
right to modify internalModifiersName attribute (if i add it, everything is fine and the
attribute internalModifiersName becomes " cn=ldbm database,cn=plugins,cn=config
"). 
Or is it a bug? 

Thank you! 

Regards,