Release v0.1.1: Fix undefined attribute handling for OpenLDAP compatibility

Author: rvben

CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.1] - 2025-06-16
+
+### Fixed
+- **OpenLDAP Compatibility**: Search filters with undefined attributes now return `UndefinedAttributeType` error (code 17) instead of silently returning 0 results
+  - Matches OpenLDAP's behavior for better compatibility with existing LDAP client code
+  - Enables exception-based fallback patterns used for Active Directory/OpenLDAP compatibility
+  - Added comprehensive tests for undefined attribute handling
+
+### Changed
+- Search operations now validate all attributes referenced in filters before executing the search
+- Added methods to collect and validate attributes from both schema and existing entries
+
 ## [0.1.0] - 2025-06-14
 
 ### Added

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "yamldap"
-version = "0.1.0"
+version = "0.1.1"
 edition = "2021"
 authors = ["Ruben J. Jongejan <ruben.jongejan@gmail.com>"]
 description = "A lightweight LDAP server that serves directory data from YAML files"

Cargo.toml

@@ -99,6 +99,24 @@ impl Directory {
     pub fn entry_exists(&self, dn: &str) -> bool {
         self.entries.contains_key(&dn.to_lowercase())
     }
+
+    /// Get all attributes that exist in any entry in the directory
+    pub fn get_all_existing_attributes(&self) -> std::collections::HashSet<String> {
+        let mut attributes = std::collections::HashSet::new();
+
+        // Always include standard attributes
+        attributes.insert("objectclass".to_string());
+        attributes.insert("dn".to_string());
+
+        // Collect attributes from all entries
+        for entry in self.entries.iter() {
+            for attr_name in entry.attributes.keys() {
+                attributes.insert(attr_name.to_lowercase());
+            }
+        }
+
+        attributes
+    }
 }
 
 #[derive(Debug, Clone, Copy, PartialEq)]

src/directory/storage.rs

@@ -93,6 +93,39 @@ impl LdapFilter {
             LdapFilter::Not(filter) => !filter.matches(entry),
         }
     }
+
+    /// Extract all attribute names referenced in this filter
+    pub fn get_referenced_attributes(&self) -> std::collections::HashSet<String> {
+        let mut attributes = std::collections::HashSet::new();
+        self.collect_attributes(&mut attributes);
+        attributes
+    }
+
+    fn collect_attributes(&self, attributes: &mut std::collections::HashSet<String>) {
+        match self {
+            LdapFilter::Present(attr)
+            | LdapFilter::Equality(attr, _)
+            | LdapFilter::Substring(attr, _)
+            | LdapFilter::GreaterOrEqual(attr, _)
+            | LdapFilter::LessOrEqual(attr, _)
+            | LdapFilter::Approximate(attr, _) => {
+                attributes.insert(attr.to_lowercase());
+            }
+            LdapFilter::Extensible(ext) => {
+                if let Some(attr) = &ext.attribute {
+                    attributes.insert(attr.to_lowercase());
+                }
+            }
+            LdapFilter::And(filters) | LdapFilter::Or(filters) => {
+                for filter in filters {
+                    filter.collect_attributes(attributes);
+                }
+            }
+            LdapFilter::Not(filter) => {
+                filter.collect_attributes(attributes);
+            }
+        }
+    }
 }
 
 impl SubstringFilter {

src/ldap/filters.rs

@@ -84,6 +84,25 @@ pub fn handle_operation(
                 }
             };
 
+            // Check if filter references undefined attributes
+            let filter_attributes = ldap_filter.get_referenced_attributes();
+            let existing_attributes = directory.get_all_existing_attributes();
+
+            for attr in &filter_attributes {
+                if !existing_attributes.contains(attr) {
+                    responses.push(LdapMessage {
+                        message_id,
+                        protocol_op: LdapProtocolOp::SearchResultDone {
+                            result: LdapResult::error(
+                                LdapResultCode::UndefinedAttributeType,
+                                format!("{}: attribute type undefined", attr),
+                            ),
+                        },
+                    });
+                    return responses;
+                }
+            }
+
             // Convert scope
             let dir_scope = match scope {
                 SearchScope::BaseObject => DirSearchScope::BaseObject,
@@ -919,4 +938,89 @@ mod tests {
             _ => panic!("Expected ExtendedResponse"),
         }
     }
+
+    #[test]
+    fn test_search_with_undefined_attribute() {
+        let directory = create_test_directory();
+        let auth_handler = AuthHandler::new(false);
+
+        // Search with undefined attribute should return UndefinedAttributeType error
+        let operation = LdapOperation::Search {
+            base_dn: "dc=example,dc=com".to_string(),
+            scope: SearchScope::WholeSubtree,
+            filter: "(userPrincipalName=test)".to_string(),
+            attributes: vec![],
+        };
+
+        let responses = handle_operation(1, operation, &directory, &auth_handler, true);
+
+        // Should have 1 response: SearchResultDone with error
+        assert_eq!(responses.len(), 1);
+
+        match &responses[0].protocol_op {
+            LdapProtocolOp::SearchResultDone { result } => {
+                assert_eq!(result.result_code, LdapResultCode::UndefinedAttributeType);
+                assert!(result
+                    .diagnostic_message
+                    .contains("attribute type undefined"));
+            }
+            _ => panic!("Expected SearchResultDone"),
+        }
+    }
+
+    #[test]
+    fn test_search_with_undefined_attribute_in_complex_filter() {
+        let directory = create_test_directory();
+        let auth_handler = AuthHandler::new(false);
+
+        // AND filter with undefined attribute
+        let operation = LdapOperation::Search {
+            base_dn: "dc=example,dc=com".to_string(),
+            scope: SearchScope::WholeSubtree,
+            filter: "(&(uid=user1)(nonExistentAttr=value))".to_string(),
+            attributes: vec![],
+        };
+
+        let responses = handle_operation(1, operation, &directory, &auth_handler, true);
+
+        // Should have 1 response: SearchResultDone with error
+        assert_eq!(responses.len(), 1);
+
+        match &responses[0].protocol_op {
+            LdapProtocolOp::SearchResultDone { result } => {
+                assert_eq!(result.result_code, LdapResultCode::UndefinedAttributeType);
+                assert!(result.diagnostic_message.contains("nonexistentattr"));
+                assert!(result
+                    .diagnostic_message
+                    .contains("attribute type undefined"));
+            }
+            _ => panic!("Expected SearchResultDone"),
+        }
+    }
+
+    #[test]
+    fn test_search_with_valid_attributes_still_works() {
+        let directory = create_test_directory();
+        let auth_handler = AuthHandler::new(false);
+
+        // Search with valid attribute should work
+        let operation = LdapOperation::Search {
+            base_dn: "dc=example,dc=com".to_string(),
+            scope: SearchScope::WholeSubtree,
+            filter: "(uid=user1)".to_string(),
+            attributes: vec![],
+        };
+
+        let responses = handle_operation(1, operation, &directory, &auth_handler, true);
+
+        // Should have 2 responses: 1 entry + done
+        assert_eq!(responses.len(), 2);
+
+        match &responses[1].protocol_op {
+            LdapProtocolOp::SearchResultDone { result } => {
+                assert_eq!(result.result_code, LdapResultCode::Success);
+            }
+            _ => panic!("Expected SearchResultDone"),
+        }
+    }
 }

src/ldap/operations.rs

@@ -64,6 +64,31 @@ impl From<SchemaConfig> for YamlSchema {
     }
 }
 
+impl YamlSchema {
+    /// Get all known attributes from the schema
+    pub fn get_all_known_attributes(&self) -> std::collections::HashSet<String> {
+        let mut attributes = std::collections::HashSet::new();
+
+        // Add standard LDAP attributes that are always available
+        attributes.insert("objectclass".to_string());
+        attributes.insert("dn".to_string());
+
+        // Add attributes from all object classes
+        for attrs in self.object_classes.values() {
+            for attr in attrs {
+                attributes.insert(attr.to_lowercase());
+            }
+        }
+
+        // Add custom attributes
+        for attr_name in self.custom_attributes.keys() {
+            attributes.insert(attr_name.to_lowercase());
+        }
+
+        attributes
+    }
+}
+
 impl Default for YamlSchema {
     fn default() -> Self {
         let mut object_classes = HashMap::new();

src/yaml/schema.rs

@@ -1,4 +1,5 @@
 mod basic_test;
 mod complex_filters_test;
 mod concurrent_test;
-mod enhanced_filters_test;
+mod enhanced_filters_test;
+mod undefined_attributes_test;