Forgotten username filter behavior

[Peter Heinemann]

Hello,

I have a search filter enabled for forgotten username that causes a 5016 return.  However, when I use the same filter and credentials in a command-line ldapsearch I get the intended records.  What's interesting is the difference in the ldap server logs.

With filter, from the PWM UI, returns the 5016 to the browser (and in PWM logs).

Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=0 BIND dn="cn=pwm-proxy,dc=penncommunity,dc=upenn,dc=edu" method=128
Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=0 BIND dn="cn=pwm-proxy,dc=penncommunity,dc=upenn,dc=edu" mech=SIMPLE bind_ssf=0 ssf=256
Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=0 RESULT tag=97 err=0 qtime=0.000016 etime=0.000165 text=
Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=1 SRCH base="" scope=0 deref=0 filter="(objectClass=*)"
Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=1 SRCH attr=vendorVersion objectClass vendorName rootDomainNamingContext
Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000020 etime=0.000212 nentries=1 text=
Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=2 SRCH base="cn=pwm-proxy,dc=penncommunity,dc=upenn,dc=edu" scope=0 deref=0 filter="(objectClass=*)"
Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=2 SRCH attr=pwdChangedTime
Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=2 SEARCH RESULT tag=101 err=0 qtime=0.000028 etime=0.000205 nentries=0 text=
Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=3 SRCH base="cn=pwm-proxy,dc=penncommunity,dc=upenn,dc=edu" scope=0 deref=0 filter="(objectClass=*)"
Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=3 SRCH attr=pwdReset
Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=3 SEARCH RESULT tag=101 err=0 qtime=0.000022 etime=0.000178 nentries=0 text=
Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=4 SRCH base="ou=people,dc=penncommunity,dc=upenn,dc=edu" scope=2 deref=0 filter="(pennSSPREnrolled=TRUE)"
Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=4 SRCH attr=1.1
Aug 07 09:15:07 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671272 op=4 SEARCH RESULT tag=101 err=4 qtime=0.000020 etime=0.000458 nentries=2 text=

The last log entry shows size limit exceeded (err=4) after returning 2 entries.  olcSizeLimit=unilimited is in effect.  The target of the filter (pennSSPREnrolled) is indexed.

Here are the logs from the successful command line search:
Aug 07 09:17:14 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671299 op=0 BIND dn="cn=pwm-proxy,dc=penncommunity,dc=upenn,dc=edu" method=128
Aug 07 09:17:14 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671299 op=0 BIND dn="cn=pwm-proxy,dc=penncommunity,dc=upenn,dc=edu" mech=SIMPLE bind_ssf=0 ssf=256
Aug 07 09:17:14 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671299 op=0 RESULT tag=97 err=0 qtime=0.000014 etime=0.000150 text=
Aug 07 09:17:14 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671299 op=1 SRCH base="ou=people,dc=penncommunity,dc=upenn,dc=edu" scope=2 deref=0 filter="(pennSSPREnrolled=TRUE)"
Aug 07 09:17:14 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671299 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000021 etime=0.003293 nentries=3 text
Aug 07 09:17:14 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671299 op=0 BIND dn="cn=pwm-proxy,dc=penncommunity,dc=upenn,dc=edu" method=128
Aug 07 09:17:14 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671299 op=0 BIND dn="cn=pwm-proxy,dc=penncommunity,dc=upenn,dc=edu" mech=SIMPLE bind_ssf=0 ssf=256
Aug 07 09:17:14 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671299 op=0 RESULT tag=97 err=0 qtime=0.000014 etime=0.000150 text=
Aug 07 09:17:14 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671299 op=1 SRCH base="ou=people,dc=penncommunity,dc=upenn,dc=edu" scope=2 deref=0 filter="(pennSSPREnrolled=TRUE)"
Aug 07 09:17:14 tsldaputdv01.isc.upenn.edu slapd[758]: conn=671299 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000021 etime=0.003293 nentries=3 text=

returned the expected number of records.  Main difference appears to be the pre-searches (?)  executed by PWM from the UI.

Any idea why this is failing with the filter enabled in PWM?