samba - Nov 2023 - LDAP_MATCHING_RULE_IN_CHAIN no longer working after upgrade?

Thank you Kees.

On Mon, 6 Nov 2023 at 09:37, Kees van Vloten via samba
<samba at lists.samba.org> wrote:
> I am currently running at 4.19.2 but I have run 4.18.6 and 4.18.5. I did
> not experience any issues with nested group lookups, which many of the
> filters rely on.
Interestingly, I've now found that (on my current DCs, running
4.18.5), ldbsearch *does* seem to return the expected result, but the
same query via ldapsearch does not.

dc2$ sudo ldbsearch -H /usr/local/samba/private/sam.ldb
"(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=CN=somegroup,OUsomeou,DC=mydomain,DC=org))"
samAccountName
# Record 1
[...]
# record 39
dn: CN=A User,OU=Users,OU=someou,DC=mydomain,DC=org
sAMAccountName: auser

# Referral
[...]
# returned 42 records
# 39 entries
# 3 referrals


whereas no results are returned for the same query run via ldapsearch,
even running the search as the domain administrator.

dc2$ ldapsearch -H ldaps://dc2.mydomain.org -x -W -D
Administrator at mydomain -b "dc=mydomain,dc=org"
"(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=CN=somegroup,OU=someou,DC=mydomain,DC=org))"
samAccountName
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <dc=mydomain,dc=org> with scope subtree
# filter:
(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=CN=somegroup,OU=someou,DC=mydomain,DC=org)
# requesting: samAccountName
#

# search reference
[...]

# search result
search: 2
result: 0 Success

# numResponses: 4
# numReferences: 3
> And although the script uses ldbsearch locally on the DC, many
> applications use similar queries over the wire.
>
> If it does not show the desired output for you, it may be worth looking
> at configuration differences, because I had and have no issues
> whatsoever with this functionality.
Thanks, it's good to know that it does work for others, at least.
There is undoubtedly something about my configuration that is
different from others; I don't know if it's having members of groups
from different OUs across the domain, or perhaps permissions that have
been set over the years delegating ownership of different OUs, etc..
but it's interesting that I am seeing different behaviour between
ldbsearch and ldapsearch now.

(Andrew - I'm wondering if I can script startup of samba in docker
containers after restoring from a domain backup, that I could call
from git bisect. Do you know if anyone has scripts to do that sort of
thing already? It's not impossible for me to create, of course, but
it's always better to use an existing working script if there is one.
So far, my git bisect calls a script that compiles each samba version
and runs ldbsearch, checking for number of results returned; but based
on the above findings that's always going to succeed, so I think I
will need to switch to ldapsearch instead)

Cheers

Jonathan

Op 06-11-2023 om 14:58 schreef Jonathan Hunter:
> Thank you Kees.
>
> On Mon, 6 Nov 2023 at 09:37, Kees van Vloten via samba
> <samba at lists.samba.org> wrote:
>> I am currently running at 4.19.2 but I have run 4.18.6 and 4.18.5. I
did
>> not experience any issues with nested group lookups, which many of the
>> filters rely on.
> Interestingly, I've now found that (on my current DCs, running
> 4.18.5), ldbsearch *does* seem to return the expected result, but the
> same query via ldapsearch does not.
>
> dc2$ sudo ldbsearch -H /usr/local/samba/private/sam.ldb
>
"(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=CN=somegroup,OU>
someou,DC=mydomain,DC=org))" samAccountName
> # Record 1
> [...]
> # record 39
> dn: CN=A User,OU=Users,OU=someou,DC=mydomain,DC=org
> sAMAccountName: auser
>
> # Referral
> [...]
> # returned 42 records
> # 39 entries
> # 3 referrals
>
>
> whereas no results are returned for the same query run via ldapsearch,
> even running the search as the domain administrator.
>
> dc2$ ldapsearch -H ldaps://dc2.mydomain.org -x -W -D
> Administrator at mydomain -b "dc=mydomain,dc=org"
>
"(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=CN=somegroup,OU=someou,DC=mydomain,DC=org))"
> samAccountName
> Enter LDAP Password:
> # extended LDIF
> #
> # LDAPv3
> # base <dc=mydomain,dc=org> with scope subtree
> # filter:
(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=CN=somegroup,OU=someou,DC=mydomain,DC=org)
> # requesting: samAccountName
> #
>
> # search reference
> [...]
>
> # search result
> search: 2
> result: 0 Success
>
> # numResponses: 4
> # numReferences: 3
What if you try to use starttls instead of ldaps?

ldapseach -H ldap://dc2.mydomain.org-ZZ -x -W -D Administrator at mydomain 
-b "dc=mydomain,dc=org" 
"(&(objectCategory=Person)(sAMAccountName=*)(memberOf:1.2.840.113556.1.4.1941:=CN=somegroup,OU=someou,DC=mydomain,DC=org))"
>> And although the script uses ldbsearch locally on the DC, many
>> applications use similar queries over the wire.
>>
>> If it does not show the desired output for you, it may be worth looking
>> at configuration differences, because I had and have no issues
>> whatsoever with this functionality.
> Thanks, it's good to know that it does work for others, at least.
> There is undoubtedly something about my configuration that is
> different from others; I don't know if it's having members of
groups
> from different OUs across the domain, or perhaps permissions that have
> been set over the years delegating ownership of different OUs, etc..
> but it's interesting that I am seeing different behaviour between
> ldbsearch and ldapsearch now.
>
> (Andrew - I'm wondering if I can script startup of samba in docker
> containers after restoring from a domain backup, that I could call
> from git bisect. Do you know if anyone has scripts to do that sort of
> thing already? It's not impossible for me to create, of course, but
> it's always better to use an existing working script if there is one.
> So far, my git bisect calls a script that compiles each samba version
> and runs ldbsearch, checking for number of results returned; but based
> on the above findings that's always going to succeed, so I think I
> will need to switch to ldapsearch instead)
>
> Cheers
>
> Jonathan