If one tries to add an attribute without any value, an (illegal) attribute with empty value is created

• Key: DIRSERVER-630
• Type: Bug
• Status: Closed
• Resolution: Fixed
• Priority: Major
• Assignee: Alex Karasulu
• Reporter: Stefan Zoerner
• Fix Version/s: 1.5.0, 1.0-RC4

Environment

Sun ONE Directory SDK for Java 4.1
ApacheDS 1.0 RC 3
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_04-b05)
Microsoft Windows XP version 5.1 Service Pack 1

Description

If one tries to add an attribute to an entry, and does not provide a value, it is assumed that the server does not modify the entry. We have a situation here using Sun ONE Directory SDK for Java (or Netscape, now Mozilla SDK, http://www.mozilla.org/directory/), where adding a description attribute without value to a person entry like this

dn: cn=Kate Bush,dc=example,dc=com
objectclass: person
objectclass: top
sn: Bush
cn: Kate Bush

does not fail (modify call does not result in an exception). Instead, a description attribute is created within the entry. At least the new attribute is readable with Netscape SDK (it is not visible to most UIs, because it is invalid ...).

Attached you find a test case which demonstrates the problem. It passes with Sun Java System Directory Server 5.2, for instance. Unfortunately, I was not able to create this situation with JNDI, because its LDAP Provider does not allow this (illegal) operation -- it throws an exception on the client side and does not seem to call the server at all.

Comments

[Stefan Zoerner]

Added info about LDAP client library used (Sun ONE Directory SDK for Java 4.1)

[Stefan Zoerner]

Test case using Netscape SDK

[Norval Hope]

I've also noted, that if a custom partition passes back an attribute in this state with an Attributes result (from lookup()) or a SearchResult in the NamingEnumeration returned from a search() then the LDAP codec silently completes, but leaves the client application hung waiting for a reply.

Hence the handling of valueless attributes seem to effect both a) the client and b) the response part of the LDAP codec. I'm not sure if the other codecs have problems with valueless attributes in lookup/search results too.

Committed revision 428222 to 1.0 branch. Patch applied to 1.1 on revision 428223.

[Stefan Zoerner]

The issue is still present in the current Apache DS 1.0 branch. Although the test case has been integrated in the integration tests. First I thought. it is because the test has been renamed to IllegalModification (without "Test" suffix), and hence does not take place during a build or an integration test. But when I rename it, it is performed during the integration test, and passes during the build (!).

Anyway, the test case still fails in my environment, if performed standalone.

[Alex Karasulu]

I wonder what error code is best to return for this situation. I think an invalidAttributeSyntax(21) is best for this. I can't find anything else which matches that well.

The rationale behind n invalidAttributeSyntax is that the non-existent value is invalid. WDYT?

[Alex Karasulu]

Committed fix for 1.0 branch in revision 433483 and for 1.1 trunks in revision 433484.

[Stefan Zoerner]

Here are the return codes for other server, just in order to complete the information here:

Sun Java System Directory Server 5.2: error result (2); no values given
IBM Tivoli Directory Server 6.0: error result (2)
OpenLDAP 2.3: error result (2); modify/add operation requires values

So all server I have installed here decided to use a protocol error (error code 2) here. So I would suggest to do the same, but it is not that important from my point of view. The original problem of this issue has been perfectly fixed already. Thanks Alex!