Zend\Ldap\Dn::isChildOf - should it be case insensitive?

[weierophinney]

This is a "reopen" of zendframework/zendframework#6299

I just ran into the same problem. The comparison in isChildOf is case sensitive in regard to the attribute values (not the attribute names which have been changed to lower case before). This is incorrect if the attribute is, for instance, of type DirectoryString using matching rule caseIgnoreMatch for equality match.

For example, we use base DN "ou=people,o=ldap". A user DN might be "uid=test,ou=People,o=ldap" (note the capital "P").

isChildOf won't match in this case, even though the user DN is of a child of the base DN. This is incorrect as the ou attribute must be checked case insensitive.

As a quick workaround I modified the line

if ($cdn[$i + $startIndex] != $pdn[$i]) {

in Dn.php to this test:

$result = array_udiff_uassoc($cdn[$i + $startIndex], $cdn[$i + $startIndex], 'strcasecmp', 'strcasecmp');
if (! empty($result) ) {

This compares attribute names and values case insensitive. Of course, this is not complete as whitespace should be removed as well and some attributes in the DN might actually be case sensitive. Thus I guess ideally, the test should be done by an ldap query instead...

---

Originally posted by @gvde at zendframework/zend-ldap#54

[weierophinney]

Thanks for raising the issue! I'll have an in depth look at it later.

---

Originally posted by @heiglandreas at zendframework/zend-ldap#54 (comment)

[weierophinney]

The comparison should use the schema-information for the attribute to decide whether to check case sensitive or insensitive. As that might include a severe performance-issue I'll need to check how to implement that in a way that satisfies all needs…

---

Originally posted by @heiglandreas at zendframework/zend-ldap#54 (comment)