ldap_attrs: #5450 breaks OpenLDAP config

[martin-kuba]

Summary

The merged PR #5450 has broken adding new databases in OpenLDAP's cn=config database using Ansible.

The PR was meant to allow to omit the {X} indexes, which it does, unfortunatelly when multliple databases are configured, they all have the same DN just with different {X}, and the ldap_entry module incorrectly says that the entry already exists when it does not.

This happens for example when replication is configured. Then there should be two databases:

olcDatabase={1}mdb,cn=config
olcDatabase={2}mdb,cn=config

The second database olcDatabase={2}mdb,cn=config cannot be now created using Ansible ldap_entry module, because it wrongly finds the olcDatabase={1}mdb,cn=config that exists and does not create the second entry.

The problem is caused by the change from

    self.dn = self.module.params['dn']

to

    # Try to find the X_ORDERed version of the DN
    self.dn = self._find_dn()

in LdapGeneric init method in the commit ee39fd5 .

I suggest to add a new config option for enabling or disabling this smart behavior.

Issue Type

Bug Report

Component Name

plugins/module_utils/ldap.py

Ansible Version

$ ansible --version
ansible [core 2.14.2]
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/home/makub/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python3/dist-packages/ansible
  ansible collection location = /home/makub/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/bin/ansible
  python version = 3.10.6 (main, Nov 14 2022, 16:10:14) [GCC 11.3.0] (/usr/bin/python3)
  jinja version = 3.0.3
  libyaml = True

Community.general Version

$ ansible-galaxy collection list community.general
# /usr/lib/python3/dist-packages/ansible_collections
Collection        Version
----------------- -------
community.general 6.3.0  

Configuration

$ ansible-config dump --only-changed

OS / Environment

$ lsb_release -a
No LSB modules are available.
Distributor ID:	Linuxmint
Description:	Linux Mint 21.1
Release:	21.1
Codename:	vera

Steps to Reproduce

Install a vanilla OpenLDAP server, e.g. on Debian Linux:

# apt install slapd

then try to execute the following playbook. It will say that the entry exists even if it does not exist.

- name: "show Ansible wrongly detecting LDAP entry existence"
  hosts: all
  remote_user: root
  vars:
    ldap_basedn: "dc=example,dc=org"
  tasks:
    - name: "accesslog database"
      ldap_entry:
        dn: "olcDatabase={2}mdb,cn=config"
        objectClass:
          - olcDatabaseConfig
          - olcMdbConfig
        attributes:
          olcDatabase: '{2}mdb'
          olcDbDirectory: /var/lib/ldap/accesslog
          olcSuffix: cn=accesslog
          olcAccess: '{0}to dn.subtree="cn=accesslog" by dn.exact="cn=replication,{{ ldap_basedn }}" read'
          olcLastMod: 'TRUE'
          olcMaxDerefDepth: 15
          olcReadOnly: 'FALSE'
          olcLimits: 'dn.exact="cn=replication,{{ ldap_basedn }}" time=unlimited size=unlimited'
          olcSizeLimit: unlimited
          olcTimeLimit: unlimited
          olcMonitoring: 'TRUE'
          olcDbCheckpoint: '0 0'
          olcDbIndex:
            - entryCSN eq
            - objectClass eq
            - reqEnd eq
            - reqResult eq
            - reqStart eq
            - reqDN eq
          olcDbMode: '0600'
          olcDbSearchStack: 16
          olcDbMaxsize: 85899345920
        state: present

Expected Results

The LDAP entry should be detected as non-existing and thus created.

Actual Results

TASK [accesslog database] **********************************************************************************************************************************************************************************************************************************************
ok: [ip-147-251-21-135.flt.cloud.muni.cz]

Code of Conduct

• I agree to follow the Ansible Code of Conduct

[ansibullbot]

Files identified in the description:

• plugins/doc_fragments/ldap.py

If these files are incorrect, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibullbot]

Files identified in the description:

• plugins/module_utils/ldap.py

If these files are incorrect, please update the component name section of the description or use the !component bot command.

click here for bot help

[felixfontein]

CC @mrvanes @rekup since you were involved in #5450.

[rekup]

I was able to reproduce the error, and this indeed is a problem. Adding a new config option would be one possible way to solve/mitigate this. Another approach could be to check if the user has supplied a dn which contains ordering information (such as olcDatabase={2}mdb,cn=config) and if that's the case, skip the logic to find a matching dn.

[felixfontein]

@rekup both approaches sound good to me. A combination would also work, i.e. a new option with three values, where auto tries to determine from the dn whether there's ordering information, and the other two values explicitly say whether to add or not find a matching dn.

[rekup]

I'm not sure about the 3rd value (adding the index to the dn) because there is no way of knowing what index we should add. If we take a look at the ldap_attrs module there is a ordered option which adds indices to ldap attributes, but this is only possible because there is an order of attributes within the same dn. In theory, we could just search the number of existing matching DNs and then just increment the index, but this would break idempotency and add the ldap entry on every subsequent run. I personally would opt for a bool option to enable/disable auto detection of the DN, but if there are other ideas on how to implement a three valued option I'm open for that as well.

[rekup]

Never mind, I think I misread your comment. It totally makes sense with three options. I will prepare a PR

[rekup]

Hi @martin-kuba
I created a PR which should fix this issue: #6109 maybe you could give it a try?

[martin-kuba]

Hi @martin-kuba I created a PR which should fix this issue: #6109 maybe you could give it a try?

@rekup The RP looks good to me. However the new option is added to all ldap modules, but the ldap_search module overrides the value of self.dn:

self.dn = self.module.params['dn']

so either this line should be removed or it should be mentioned in the documentation.

[rekup]

Good point, I guess it would make sense to remove the line to unify the behavior of all ldap modules. This would then also allow finding a dn with ordering information without specifying the index.