It turned out it is an issue of the DN normalization.

For instance, if secretary has a value "uid=U0+givenname=G0+sn=S0,dc=example,dc=com", then it's converted to "givenname=g0+sn=s0+uid=u0,dc=example,dc=com".

The value matches any of these filters [1]:
(secretary=uid=U0+givenname=G0+sn=S0,dc=example,dc=com)
(secretary=givenname=G0+uid=U0+sn=S0,dc=example,dc=com)
(secretary=givenname=g0+uid=u0+sn=s0,dc=example,dc=com)

[1] Internally, 3 multi-valued RDNs are sorted and all the characters are lowered.

But when the filter contains '', e.g., (secretary=givenname=G+uid=U0+sn=S0,dc=Example,dc=Com), the filter value is divided into the pieces at the location of '': (givenname=g) and (+uid=U0+sn=S0,dc=Example,dc=Com) in this example, then passed to the normalization code. The second piece (+uid=U0+sn=S0,dc=Example,dc=Com) is not a valid DN, so it is left as is. Since the value in the entry is "givenname=g0+sn=s0+uid=u0,dc=example,dc=com", it does not match with (secretary=givenname=g+uid=U0+sn=S0,dc=Example,dc=Com).

We have to fix this logic to normalize the filter value as a full string, instead of 2 or more pieces. E.g., "givenname=G+uid=U0+sn=S0,dc=Example,dc=Com". But even this is not a perfect solution since '' could be put at any place covering any strings. For instnace, (secretary=givenname=g0*uid=U0+sn=S0,dc=Example,dc=Com) would fail in the DN normalization...

This is violating the LDAP standard.

Closing this ticket with invalid.

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/1619

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.