On Thu, Mar 25, 2010 at 02:04:57PM -0600, Rich Megginson wrote: > Christopher Wood wrote: > > On Thu, Mar 25, 2010 at 11:59:31AM -0600, Rich Megginson wrote: > > > >> Christopher Wood wrote: > >> > >>> I'm having another issue that I'm not making headway on. This time, I can't import a single value into one attribute in my directory. The attribute in question is a DirectoryString . (Previously it was an IA5String and I had issues with many values, but I changed it to DirectoryString and now only this entry is giving me trouble.) > >>> > >>> > >>> Question: > >>> > >>> What troubleshooting steps can I use to identify the portion of the user-supplied string that is causing the "value #0 invalid per syntax" error? > >>> > >>> > >>> Here's the error I get from ldapmodify: > >>> > >>> modifying entry "ldapAuthControlCode=1234567, ou=UsersByControlCode, o=mycompany" > >>> ldap_modify: Invalid syntax (21) > >>> additional info: ldapAuthSieve: value #0 invalid per syntax > >>> > >>> > >>> Here's the schema for ldapAuthSieve from /opt/dirsrv/etc/dirsrv/slapd-cwlab-02/schema/99user.ldif: > >>> > >>> attributeTypes: ( 1.3.6.1.4.1.2805.1.1.1.1.36 NAME 'ldapAuthSieve' DESC 'The v > >>> acation message subject line' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VA > >>> LUE X-ORIGIN 'user defined' ) > >>> > >>> > >>> Points: > >>> > >>> The value I'm having trouble with is base64 encoded. > >>> > >>> The text inside the base64 encoding is bilingual English/French. It at least displays fine in my xterm. > >>> > >>> > >> value #0 invalid per syntax with DirectoryString syntax values usually > >> means the value is not a valid utf-8 encoded string. > >> > >>> I can ldapmodify this attribute in this entry with other base64-encoded strings. > >>> > >>> > >> Can you give an example of an LDIF that works with ldapmodify and one > >> that fails with ldapmodify? > >> > > > > I've narrowed it down to three characters (???), where if I include those in my base64 encoded string I get "#0 invalid per syntax". If I use each individually as the only value in my base64-encoded string, I get the same error. > > > Right. They are not utf-8 encoded, probably latin-1. > python > >>> foo = '???' > >>> foo > '\xc3\xa0\xc3\xb4\xc3\xa7' > >>> bar = u'???' > >>> bar > u'\xe0\xf4\xe7' Yes, they're Latin-1. Thank you, that's my lightbulb-goes-off moment. Turns out that in another way this is another NDS6.2-doesn't-check-syntax moment too. > > By contrast, if I use [A-Za-z0-9] characters only (base64-encoded) in my value then the ldap value is modified without any difficulties. I haven't tested with every single other character, so there may be more that cause this error. > > > The 7-bit ascii character set is essentially utf-8, so 7-bit ascii > characters always validate as valid utf-8 characters. > > I'm a bit confused as to why this happens. I thought the point of base64-encoding was that we could stuff arbitrary strings in? > No, you can't get around syntax validation by base64 encoding. > > However, many LDAP clients are capable of converting latin-1 characters > to utf-8. It could be that because it is base64 encoded, your LDAP > client cannot automatically convert the values to utf-8. > > Or does the fact that they're not UTF8 affect the encoding? > > > Yes. > > Is there a way to ensure that these values will be translated to an appropriate encoding in the initialization and replication process? > > > You have to convert them to utf-8 before storing in LDAP. Once in LDAP, > LDAP will just pass around the values as utf-8. It is up to the clients > to convert the utf-8 to something "human readable". > > > >>> I can ldapmodify this attribute in this entry with a much longer base64-encoded string, so I'm fairly sure I haven't hit a limit on the number of characters. > >>> > >>> > >> I don't think it is a limit on the number of characters that is causing > >> the problem. > >> > >>> Error log output with debug level of 1 when I was running ldapmodify: > >>> > >>> > >>> [25/Mar/2010:13:23:04 -0400] - reslimit_update_from_entry(): setting limit for handle 1 (based on nsSizeLimit) > >>> [25/Mar/2010:13:23:04 -0400] - reslimit_update_from_entry(): setting limit for handle 2 (based on nsTimeLimit) > >>> [25/Mar/2010:13:23:04 -0400] - reslimit_update_from_entry(): setting limit for handle 3 (based on nsIdleTimeout) > >>> [25/Mar/2010:13:23:04 -0400] - <= reslimit_update_from_entry() returning status 0 > >>> [25/Mar/2010:13:23:08 -0400] - ldbm backend flushing > >>> [25/Mar/2010:13:23:08 -0400] - ldbm backend done flushing > >>> [25/Mar/2010:13:23:08 -0400] - ldbm backend flushing > >>> [25/Mar/2010:13:23:08 -0400] - ldbm backend done flushing > >>> [25/Mar/2010:13:23:08 -0400] - ldbm backend flushing > >>> [25/Mar/2010:13:23:08 -0400] - ldbm backend done flushing > >>> [25/Mar/2010:13:23:35 -0400] - => ids_sasl_server_new (cwlab-02.pvt.primus.ca) > >>> [25/Mar/2010:13:23:35 -0400] - ids_sasl_getopt: plugin= option=log_level > >>> [25/Mar/2010:13:23:35 -0400] - ids_sasl_getopt: plugin= option=auto_transition > >>> [25/Mar/2010:13:23:35 -0400] - <= ids_sasl_server_new > >>> [25/Mar/2010:13:23:35 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e7248, handle=3 > >>> [25/Mar/2010:13:23:35 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:35 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e7188, handle=3 > >>> [25/Mar/2010:13:23:35 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:35 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e7008, handle=3 > >>> [25/Mar/2010:13:23:35 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:35 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e70c8, handle=3 > >>> [25/Mar/2010:13:23:35 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:35 -0400] - add_pb > >>> [25/Mar/2010:13:23:35 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e7188, handle=3 > >>> [25/Mar/2010:13:23:35 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:35 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e7008, handle=3 > >>> [25/Mar/2010:13:23:35 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:35 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e70c8, handle=3 > >>> [25/Mar/2010:13:23:35 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:35 -0400] - get_pb > >>> [25/Mar/2010:13:23:35 -0400] - do_bind > >>> [25/Mar/2010:13:23:35 -0400] - BIND dn="cn=Directory Manager" method=128 version=3 > >>> [25/Mar/2010:13:23:35 -0400] - => get_ldapmessage_controls > >>> [25/Mar/2010:13:23:35 -0400] - <= get_ldapmessage_controls no controls > >>> [25/Mar/2010:13:23:35 -0400] - => slapi_control_present (looking for 2.16.840.1.113730.3.4.16) > >>> [25/Mar/2010:13:23:35 -0400] - <= slapi_control_present 0 (NO CONTROLS) > >>> [25/Mar/2010:13:23:35 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e7248, handle=3 > >>> [25/Mar/2010:13:23:35 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:35 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e7188, handle=3 > >>> [25/Mar/2010:13:23:35 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:35 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e7008, handle=3 > >>> [25/Mar/2010:13:23:35 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:35 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e70c8, handle=3 > >>> [25/Mar/2010:13:23:35 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:35 -0400] - do_bind: version 3 method 0x80 dn cn=Directory Manager > >>> [25/Mar/2010:13:23:35 -0400] - => slapi_pw_find value: "password" > >>> [25/Mar/2010:13:23:35 -0400] - <= slapi_pw_find matched "cGFzc3dvcmQK" using scheme "SSHA" > >>> [25/Mar/2010:13:23:35 -0400] - => send_ldap_result 0:: > >>> [25/Mar/2010:13:23:35 -0400] - <= send_ldap_result > >>> [25/Mar/2010:13:23:38 -0400] - ldbm backend flushing > >>> [25/Mar/2010:13:23:38 -0400] - ldbm backend done flushing > >>> [25/Mar/2010:13:23:38 -0400] - ldbm backend flushing > >>> [25/Mar/2010:13:23:38 -0400] - ldbm backend done flushing > >>> [25/Mar/2010:13:23:38 -0400] - ldbm backend flushing > >>> [25/Mar/2010:13:23:38 -0400] - ldbm backend done flushing > >>> [25/Mar/2010:13:23:48 -0400] - add_pb > >>> [25/Mar/2010:13:23:48 -0400] - get_pb > >>> [25/Mar/2010:13:23:48 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e7188, handle=3 > >>> [25/Mar/2010:13:23:48 -0400] - do_modify > >>> [25/Mar/2010:13:23:48 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:48 -0400] - => get_ldapmessage_controls > >>> [25/Mar/2010:13:23:48 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e7008, handle=3 > >>> [25/Mar/2010:13:23:48 -0400] - <= get_ldapmessage_controls no controls > >>> [25/Mar/2010:13:23:48 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:48 -0400] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=2 > >>> [25/Mar/2010:13:23:48 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e70c8, handle=3 > >>> [25/Mar/2010:13:23:48 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:48 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:48 -0400] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=1 > >>> [25/Mar/2010:13:23:48 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:48 -0400] - => compute_limits: sizelimit=-1, timelimit=-1 > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'ACL preoperation' #1 type 403 > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'deref' #2 type 403 > >>> [25/Mar/2010:13:23:48 -0400] deref-plugin - --> deref_pre_search > >>> [25/Mar/2010:13:23:48 -0400] deref-plugin - <-- deref_pre_op > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'Legacy replication preoperation plugin' #4 type 403 > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'Multimaster replication preoperation plugin' #6 type 403 > >>> [25/Mar/2010:13:23:48 -0400] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=0 > >>> [25/Mar/2010:13:23:48 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:48 -0400] - => find_entry_internal (dn=ldapauthcontrolcode=1234567,ou=usersbycontrolcode,o=mycompany) lock 0 > >>> [25/Mar/2010:13:23:48 -0400] - => dn2entry "ldapauthcontrolcode=1234567,ou=usersbycontrolcode,o=mycompany" > >>> [25/Mar/2010:13:23:48 -0400] - <= dn2entry 9b6fd490 > >>> [25/Mar/2010:13:23:48 -0400] - <= find_entry_internal_dn found (ldapauthcontrolcode=1234567,ou=usersbycontrolcode,o=mycompany) > >>> [25/Mar/2010:13:23:48 -0400] - candidate list has 1 ids > >>> [25/Mar/2010:13:23:48 -0400] id2entry - => id2entry(633364) > >>> [25/Mar/2010:13:23:48 -0400] id2entry - <= id2entry 9b6fd490, dn "ldapauthcontrolcode=1234567,ou=usersbycontrolcode,o=mycompany" (cache) > >>> [25/Mar/2010:13:23:48 -0400] - => send_ldap_search_entry (ldapAuthControlCode=1234567, ou=UsersByControlCode, o=mycompany) > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'deref' #2 type 410 > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'Legacy replication preoperation plugin' #4 type 410 > >>> [25/Mar/2010:13:23:48 -0400] - <= send_ldap_search_entry > >>> [25/Mar/2010:13:23:48 -0400] - => send_ldap_result 0:: > >>> [25/Mar/2010:13:23:48 -0400] - <= send_ldap_result > >>> [25/Mar/2010:13:23:48 -0400] - modify_update_last_modified_attr > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin '7-bit check' #0 type 405 > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'ACL preoperation' #1 type 405 > >>> [25/Mar/2010:13:23:48 -0400] - => slapi_control_present (looking for 2.16.840.1.113730.3.4.12) > >>> [25/Mar/2010:13:23:48 -0400] - <= slapi_control_present 0 (NO CONTROLS) > >>> [25/Mar/2010:13:23:48 -0400] - => slapi_control_present (looking for 2.16.840.1.113730.3.4.18) > >>> [25/Mar/2010:13:23:48 -0400] - <= slapi_control_present 0 (NO CONTROLS) > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'Legacy replication preoperation plugin' #4 type 405 > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'Linked Attributes' #5 type 405 > >>> [25/Mar/2010:13:23:48 -0400] linkedattrs-plugin - --> linked_attrs_pre_op > >>> [25/Mar/2010:13:23:48 -0400] linkedattrs-plugin - --> linked_attrs_get_dn > >>> [25/Mar/2010:13:23:48 -0400] linkedattrs-plugin - <-- linked_attrs_get_dn > >>> [25/Mar/2010:13:23:48 -0400] linkedattrs-plugin - --> linked_attrs_dn_is_config > >>> [25/Mar/2010:13:23:48 -0400] linkedattrs-plugin - <-- linked_attrs_dn_is_config > >>> [25/Mar/2010:13:23:48 -0400] linkedattrs-plugin - <-- linked_attrs_pre_op > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'Multimaster replication preoperation plugin' #6 type 405 > >>> [25/Mar/2010:13:23:48 -0400] - => find_entry_internal (dn=ldapauthcontrolcode=1234567,ou=usersbycontrolcode,o=mycompany) lock 1 > >>> [25/Mar/2010:13:23:48 -0400] - => dn2entry "ldapauthcontrolcode=1234567,ou=usersbycontrolcode,o=mycompany" > >>> [25/Mar/2010:13:23:48 -0400] - <= dn2entry 9b6fd490 > >>> [25/Mar/2010:13:23:48 -0400] - <= find_entry_internal_dn found (ldapauthcontrolcode=1234567,ou=usersbycontrolcode,o=mycompany) > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'Multimaster replication bepreoperation plugin' #0 type 451 > >>> [25/Mar/2010:13:23:48 -0400] - => entry_apply_mods_wsi > >>> [25/Mar/2010:13:23:48 -0400] - <= entry_apply_mods_wsi 0 > >>> [25/Mar/2010:13:23:48 -0400] - => send_ldap_result 21::ldapAuthSieve: value #0 invalid per syntax > >>> > >>> [25/Mar/2010:13:23:48 -0400] - <= send_ldap_result > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'Retrocl postoperation plugin' #0 type 505 > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'Class of Service postoperation plugin' #1 type 505 > >>> [25/Mar/2010:13:23:48 -0400] - --> cos_post_op > >>> [25/Mar/2010:13:23:48 -0400] - --> cos_cache_change_notify > >>> [25/Mar/2010:13:23:48 -0400] - <-- cos_cache_change_notify > >>> [25/Mar/2010:13:23:48 -0400] - <-- cos_post_op > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'Distributed Numeric Assignment postop plugin' #2 type 505 > >>> [25/Mar/2010:13:23:48 -0400] dna-plugin - --> dna_config_check_post_op > >>> [25/Mar/2010:13:23:48 -0400] dna-plugin - --> dna_get_dn > >>> [25/Mar/2010:13:23:48 -0400] dna-plugin - <-- dna_get_dn > >>> [25/Mar/2010:13:23:48 -0400] dna-plugin - --> dna_is_config > >>> [25/Mar/2010:13:23:48 -0400] dna-plugin - <-- dna_is_config > >>> [25/Mar/2010:13:23:48 -0400] dna-plugin - <-- dna_config_check_post_op > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'Legacy replication postoperation plugin' #3 type 505 > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'Linked Attributes postop plugin' #4 type 505 > >>> [25/Mar/2010:13:23:48 -0400] linkedattrs-plugin - --> linked_attrs_mod_post_op > >>> [25/Mar/2010:13:23:48 -0400] linkedattrs-plugin - --> linked_attrs_oktodo > >>> [25/Mar/2010:13:23:48 -0400] linkedattrs-plugin - <-- linked_attrs_oktodo > >>> [25/Mar/2010:13:23:48 -0400] linkedattrs-plugin - <-- linked_attrs_mod_post_op > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'Multimaster replication postoperation plugin' #5 type 505 > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'Roles postoperation plugin' #6 type 505 > >>> [25/Mar/2010:13:23:48 -0400] - Calling plugin 'State Change Plugin' #7 type 505 > >>> [25/Mar/2010:13:23:48 -0400] statechange-plugin - --> statechange_post_op > >>> [25/Mar/2010:13:23:48 -0400] statechange-plugin - <-- statechange_post_op > >>> [25/Mar/2010:13:23:48 -0400] - do_unbind > >>> [25/Mar/2010:13:23:48 -0400] - => get_ldapmessage_controls > >>> [25/Mar/2010:13:23:48 -0400] - <= get_ldapmessage_controls no controls > >>> [25/Mar/2010:13:23:48 -0400] - defbackend_noop > >>> [25/Mar/2010:13:23:48 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e7188, handle=3 > >>> [25/Mar/2010:13:23:48 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:48 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e7008, handle=3 > >>> [25/Mar/2010:13:23:48 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:48 -0400] - => slapi_reslimit_get_integer_limit() conn=0xb01e70c8, handle=3 > >>> [25/Mar/2010:13:23:48 -0400] - <= slapi_reslimit_get_integer_limit() returning NO VALUE > >>> [25/Mar/2010:13:23:48 -0400] - => reslimit_update_from_entry() conn=0xb01e7248, entry=0x0 > >>> [25/Mar/2010:13:23:48 -0400] - reslimit_update_from_entry(): setting limit for handle 0 (based on nsLookThroughLimit) > >>> [25/Mar/2010:13:23:48 -0400] - reslimit_update_from_entry(): setting limit for handle 1 (based on nsSizeLimit) > >>> [25/Mar/2010:13:23:48 -0400] - reslimit_update_from_entry(): setting limit for handle 2 (based on nsTimeLimit) > >>> [25/Mar/2010:13:23:48 -0400] - reslimit_update_from_entry(): setting limit for handle 3 (based on nsIdleTimeout) > >>> [25/Mar/2010:13:23:48 -0400] - <= reslimit_update_from_entry() returning status 0 > >>> -- > >>> 389 users mailing list > >>> 389-users at lists.fedoraproject.org > >>> https://admin.fedoraproject.org/mailman/listinfo/389-users > >>> > >>> > >> -- > >> 389 users mailing list > >> 389-users at lists.fedoraproject.org > >> https://admin.fedoraproject.org/mailman/listinfo/389-users > >> > > -- > > 389 users mailing list > > 389-users at lists.fedoraproject.org > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > -- > 389 users mailing list > 389-users at lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users
