[389-users] ACI warnings in error log

[Chris Chatfield]

> On 01/13/2014 03:27 PM, Chris Chatfield wrote:
> > Hi,
> >
> > I'm seeing a similar situation as was described in the mailing list message "errors
> log - NSACLPlugin - acllas__client_match_URL:" from Feb 2013. The final result of
> this was a suggestion to file a ticket. As far as I can see this wasn't done. Should I
> do this (for my scenario)?
> yes. Create a ticket and add the full aci and the log messages. I agree that it
> should not be  a fatal message.
Thanks. I've added a simplified example as a new ticket at https://fedorahosted.org/389/ticket/47670

> >
> > On to my case. I'm getting messages like this in my errors log (Centos 6.5,
> 389DS 1.2.11.15):
> > NSACLPlugin - acllas__client_match_URL: url
> > [ldap:///gcUID=0001ab51,o=Teamphone.com??sub?(objectclass=gcsubscriber
> > )] scope is subtree but dn [gcUID=0001ab51,o=Teamphone.com] is not a
> > suffix of [cn=tp manager,ou=configuration,o=teamphone.com]
> >
> > There are acis at the o=teamphone.com subtree which allow administrators
> access to the whole tree.
> > There are acis at the gcUID=0001ab51,o=Teamphone.com subtree which allow
> gcsubscriber entries within that tree to have limited access to the subtree. Note
> that we have extended the schema such that gcsubscribers extend person,
> amongst other things. I do not believe this makes any difference to the problem.
> >
> > The message happens on a connection bound to cn=tp
> manager,ou=configuration,o=teamphone.com (an administrator) when it searches
> within the subtree gcUID=0001ab51,o=Teamphone.com. It seems the acis at
> gcUID=0001ab51,o=Teamphone.com are being evaluated in the context of this
> administrator. In this case the administrator does not match the aci's userdn url
> path. This is deliberate as this aci is concerned with gcsubscriber access, not
> admin access. Other acis higher up give the correct admin access.
> >
> > So in summary, I think this logging should be downgraded from
> SLAPI_LOG_FATAL to SLAPI_LOG_ACL for the "acllas__client_match_URL: url
> [%s] scope is subtree but dn [%s] is not a suffix of [%s]\n"  message (and I guess
> similarly for the onelevel/base scopes too). I notice that the git comment
> suggested that these lines were debugging.
> >
> > Would that be the right approach? We're moving away from the Sun/Oracle 5.2
> directory server, and this aci is behaving quietly there.
> >
> > Many thanks,
> >
> > Chris
> >