United StatesChange Country, Oracle Worldwide Web Sites Communities I am a... I want to...
Bug ID: JDK-6997561 A request for better error handling in JNDI
JDK-6997561 : A request for better error handling in JNDI

Details
Type:
Bug
Submit Date:
2010-11-04
Status:
Closed
Updated Date:
2011-04-11
Project Name:
JDK
Resolved Date:
2011-03-07
Component:
core-libs
OS:
generic
Sub-Component:
javax.naming
CPU:
generic
Priority:
P2
Resolution:
Fixed
Affected Versions:
6u22
Fixed Versions:

Related Reports
Backport:
Backport:
Backport:
Backport:

Sub Tasks

Description
From the cu:

SES uses oracle ldap library (ldapjclnt11.jar) to connect to OID
(Oracle Internet Directory) for authentication, validation of users, getting
group information for users etc. for secure search.

Intermittently while invoking some LDAP APIs, it throws following exception -

<java.lang.IndexOutOfBoundsException: Posn: -1, Size: 0>
<at javax.naming.ldap.LdapName.getPrefix(LdapName.java:240)>
<at com.sun.jndi.toolkit.ctx.Continuation.fillInException(Continuation.java:133)>
<at com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1877)>
<at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1749)>
<at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentDirContext.java:368)>
<at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:338)>
<at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:257)>
<at oracle.ldap.util.Util.getEntryDetails(Util.java:501)>
<at oracle.ldap.util.User.resolve(User.java:1069)>
<at oracle.ldap.util.User.<init>(User.java:382)>
<at oracle.ldap.util.User.<init>(User.java:240)>
<at oracle.search.plugin.security.identity.oid.OIDPlugin.getUserForName(OIDPlugin.java:696)>
<at oracle.search.plugin.security.identity.oid.OIDPlugin.getUserForName(OIDPlugin.java:674)>
<at oracle.search.plugin.security.identity.oid.OIDPlugin.getAllGroups(OIDPlugin.java:630)>

This happens while validating the user SES creates LDAP User object.
Following is the SES code -

  private User getUserForName(String username, int authnAttrId, boolean
retry)
  throws PluginException
  {
    try {
      return new User(m_context, authnAttrId, username, m_subscriber, true);
    } catch (CommunicationErrorException cee) {
      if (retry) {
        m_logger.info(
          "getUserForName: caught CommunicationErrorException; reconnecting"
        );
        try {
          connect(); // re-connect to OID server
        } catch (NamingException ne) {
          m_logger.warn("getUserForName: NamingException on reconnect");
          throw new PluginException(ne.getMessage());
        }
        return getUserForName(username, authnAttrId, false);
      } else {
        m_logger.warn("getUserForName: failed after reconnection attempt");
        return null;
      }
    } catch (UtilException ue) {
      m_logger.warn("getUserForName: UtilException("+ue.getMessage()+")");
      // This appears to be the exception thrown when there is no such user
      return null;
    }

This error cannot be consistently reproduced and since the the exception
doesn't give any clue about the real cause of the issue (e.g. error because
of stale connection or some communication exception, in which case SES can
reconnect and re-try the operation)

This IndexOutOfBoundException is seen instead of CommunicationException only
if
 - searchbase is "" and
 - searcbase input to the DirContext.search is javax.naming.Name (not String)
and
 - server closed the connection before the search() method is invoked.

                                    

Comments
SUGGESTED FIX

Modify com.sun.jndi.ldap.toolkit.ctx.Continuation.fillInException to handle empty Name.
                                     
2011-02-03
EVALUATION

Root cause is due to the way an empty Name (returned by the LDAP server) is mishandled.
                                     
2011-02-03



Hardware and Software, Engineered to Work Together