yahoo-eng-team team mailing list archive

[Brant Knudson <bknudson@xxxxxxxxxx>]

Public bug reported:


If the user_tree_dn is set to something like cn=foo)bar and enabled emulation is enabled, the filter that's used to find the user in the enabled emulation entry is invalid. The filter will be like "(member=cn=user_id,cn=foo)bar)", which is invalid since the ) in foo)bar terminates the () in the filter. The ) needs to be escaped when used in a filter.

I assume an exception would be raised so user operations (like getting a
token) would result in a 500.

While it's unlikely that anybody would actually configure their system
this way, might as well fix it.

** Affects: keystone
     Importance: Undecided
     Assignee: Brant Knudson (blk-u)
         Status: New

** Changed in: keystone
     Assignee: (unassigned) => Brant Knudson (blk-u)

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1532345

Title:
  enabled emulation query must filter tree dn

Status in OpenStack Identity (keystone):
  New

Bug description:
  
  If the user_tree_dn is set to something like cn=foo)bar and enabled emulation is enabled, the filter that's used to find the user in the enabled emulation entry is invalid. The filter will be like "(member=cn=user_id,cn=foo)bar)", which is invalid since the ) in foo)bar terminates the () in the filter. The ) needs to be escaped when used in a filter.

  I assume an exception would be raised so user operations (like getting
  a token) would result in a 500.

  While it's unlikely that anybody would actually configure their system
  this way, might as well fix it.

To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1532345/+subscriptions