freeipa

#7933 FreeIPA must index certmap attributes.
Closed: fixed by abbra. Opened by firstyear.

Closed: fixed
Reopen Issue

Issue

During an investigation into filter optimisation in 389DS it was discovered that two attributes of the certmap query are unindexed. Due to the nature of LDAP filters, if any member of an OR query is unindexed, the entire OR becomes unindexed.

As a result this query is effectively:

(&
    (|
        (usercertificate;binary=)
        (ipaCertMapData=X509:<I>O=DEV.BLACKHATS.NET.AU,CN=Certificate Authority<S>O=DEV.BLACKHATS.NET.AU,CN=ipauser1)
        (altsecurityidentities=X509:<I>O=DEV.BLACKHATS.NET.AU,CN=Certificate Authority<S>O=DEV.BLACKHATS.NET.AU,CN=ipauser1)
    )
    (objectClass=posixAccount)
    (uid=*)
    (&
        (uidNumber=*)
        (!
            (uidNumber=0)
        )
    )
)
EFFECTIVE:
(&
    (objectClass=*)
    (objectClass=posixAccount)
    (uid=*)
    (&
        (uidNumber=*)
        (!
            (uidNumber=0)
        )
    )
)

This is then basically a full-table scan, which applies the filter test to the contained members.

The two attributes in question are ipaCertMapData and altsecurityidentities.

For reference, see:

https://pagure.io/freeipa/issue/7932
https://pagure.io/389-ds-base/pull-request/50252#comment-85208

Metadata Update from @pcech:
- Issue tagged with: Falcon

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/3110

master:

  • 5a83eea20bdd0c1c6302eada774ef3d8cfa04e36 Add altSecurityIdentities attribute from MS-WSPP schema definition
  • 725899595f42b607989db96d849e1b4f01de7faa Create indexes for altSecurityIdentities and ipaCertmapData attributes
  • 41ca4d484e7492bf469d73c6e627cc6df46eebf8 certmap rules: altSecurityIdentities should only be used for trusted domains
  • 95c2b34c4b468a9b766b24172e34ff2d8b6c9530 certmaprule: add negative test for altSecurityIdentities

ipa-4-8:

  • f9551453de251a46cf2e867334f5f4b435a60747 Add altSecurityIdentities attribute from MS-WSPP schema definition
  • 0841d8b4329feec312b22c0440dae9749061eae7 Create indexes for altSecurityIdentities and ipaCertmapData attributes
  • 14ddf7b8ed541e8d3343509acfde181b70c04295 certmap rules: altSecurityIdentities should only be used for trusted domains
  • 2e37205393e106d7ddd9de0c151d6c3a2c695243 certmaprule: add negative test for altSecurityIdentities

ipa-4-7:

  • 9de1287af88380a296850ee557fd784fc955265f Add altSecurityIdentities attribute from MS-WSPP schema definition
  • 0c57ce7eab559aac232c19edb4c295f8592b3a5a Create indexes for altSecurityIdentities and ipaCertmapData attributes
  • bbed1adc0bb61a51cfd7c017bac6dbb855460eae certmap rules: altSecurityIdentities should only be used for trusted domains
  • 9f59b3cfd8c97374edd365e1aa39bc4edbac5a74 certmaprule: add negative test for altSecurityIdentities

ipa-4-6:

  • f8fccd5a3381f44ad8058d611a37a72ea9327040 Add altSecurityIdentities attribute from MS-WSPP schema definition
  • dc816890398a681b2a5de4a75b932140ffd98627 Create indexes for altSecurityIdentities and ipaCertmapData attributes
  • 219fb1f5f98f72ff34010935000cc4072630ecc6 certmap rules: altSecurityIdentities should only be used for trusted domains
  • 0cc8ce2d23c46108088a0e2de6bb95bb7add8e92 certmaprule: add negative test for altSecurityIdentities

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

Falcon

None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.