Accessing the compat subtree requires a specific search base

[Gianluca Amato]

Hi, 
I have a FreeIPA 4.10 installation with a Squid proxy server using the
ext_kerberos_ldap_group_acl helper for authorizations. At some point the helper stopped
working correctly. The problem is that ext_kerberos_ldap_group_acl uses the memberuid
attribute, which is only available in the
"cn=groups,cn=compat,dc=labeconomia,dc=unich,dc=it" subtree. Unfortunately, it
seems that traversing the compat subtree is only possible when specifying a search base.

For example, the command  

ldapsearch -H <host> "(uid=studente)"  

returns the user
"uid=studente,cn=users,cn=accounts,dc=labeconomia,dc=unich,dc=it"

If I want to get the corresponding user in the compat subtree, I need to  specify a search
base as in 

ldapsearch -H <host> -b "cn=compat,dc=labeconomia,dc=unich,dc=it"
"(uid=studente)" 

which correctly returns
"uid=studente,cn=users,cn=compat,dc=labeconomia,dc=unich,dc=it"

Now I wonder: is this the correct behavior ? And if this is correct, why did
ext_kerberos_ldap_group_acl use to work in the past ?

Thanks for any help.

[Alexander Bokovoy]

On su, 26 helmi 2023, Gianluca Amato via FreeIPA-users wrote:
> Hi,
> I have a FreeIPA 4.10 installation with a Squid proxy server using the
> ext_kerberos_ldap_group_acl helper for authorizations. At some point
> the helper stopped working correctly. The problem is that
> ext_kerberos_ldap_group_acl uses the memberuid attribute, which is only
> available in the "cn=groups,cn=compat,dc=labeconomia,dc=unich,dc=it"
> subtree. Unfortunately, it seems that traversing the compat subtree is
> only possible when specifying a search base.
>
> For example, the command
>
> ldapsearch -H <host> "(uid=studente)"
>
> returns the user
> "uid=studente,cn=users,cn=accounts,dc=labeconomia,dc=unich,dc=it"
>
> If I want to get the corresponding user in the compat subtree, I need to  specify a search
> base as in
>
> ldapsearch -H <host> -b "cn=compat,dc=labeconomia,dc=unich,dc=it"
> "(uid=studente)"
>
> which correctly returns
> "uid=studente,cn=users,cn=compat,dc=labeconomia,dc=unich,dc=it"
>
> Now I wonder: is this the correct behavior ? And if this is correct, why did
> ext_kerberos_ldap_group_acl use to work in the past ? 
There are two parts here:

  - slapi-nis was enhanced to tighten up its processing to prevent some
    of performance issues, with a side-effect of not responding to too
    wide queries anymore, and

  - there is a bug in Squid's helper that ignores a base DN setting.

I fixed the latter one with
https://github.com/squid-cache/squid/pull/1207 (there are few backports
to maintenance branches as well) but the former one is still being
investigated.

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland

[Gianluca Amato]

On Mon, Feb 27, 2023 at 8:40 AM Alexander Bokovoy <abokovoy(a)redhat.com&gt;
wrote:

I fixed the latter one with
>  https://github.com/squid-cache/squid/pull/1207 (there are few
> backports
>  to maintenance branches as well) but the former one is still being
>  investigated.
>
>  
Alexander,
thanks a lot for your answer. I actually saw this patch in the release
notes of Squid 6, but I did not realize that it was solving the problem I
have now.

--gianluca amato