From 38249ac5d06da15424ee45865570039bd6de0fea Mon Sep 17 00:00:00 2001
From: "Endi S. Dewata" <edewata@redhat.com>
Date: Wed, 30 Apr 2014 11:50:21 -0400
Subject: [PATCH] Replaced filter in UGSubsystem.findUsers().

The findUsers() method in UGSubsystem has been modified to search
additional attributes in the user database. This method is only
used by the UserService, so the impact is limited to user-find
CLI command in all subsystems.

Ticket #920
---
 .../src/org/dogtagpki/server/rest/UserService.java |  2 --
 .../com/netscape/cmscore/usrgrp/UGSubsystem.java   | 27 ++++++++++++++++++----
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/base/server/cms/src/org/dogtagpki/server/rest/UserService.java b/base/server/cms/src/org/dogtagpki/server/rest/UserService.java
index 839b29291373c0ff34b8d8263ced7d77e322d0b6..e8dfaf199d6ded0b80f9847a839d101dcb815537 100644
--- a/base/server/cms/src/org/dogtagpki/server/rest/UserService.java
+++ b/base/server/cms/src/org/dogtagpki/server/rest/UserService.java
@@ -76,7 +76,6 @@ import com.netscape.certsrv.usrgrp.IUGSubsystem;
 import com.netscape.certsrv.usrgrp.IUser;
 import com.netscape.cms.servlet.admin.GroupMemberProcessor;
 import com.netscape.cms.servlet.base.PKIService;
-import com.netscape.cmsutil.ldap.LDAPUtil;
 import com.netscape.cmsutil.util.Cert;
 import com.netscape.cmsutil.util.Utils;
 
@@ -135,7 +134,6 @@ public class UserService extends PKIService implements UserResource {
     public Response findUsers(String filter, Integer start, Integer size) {
         UserCollection response = new UserCollection();
         try {
-            filter = StringUtils.isEmpty(filter) ? "*" : "*"+LDAPUtil.escapeFilter(filter)+"*";
             start = start == null ? 0 : start;
             size = size == null ? DEFAULT_SIZE : size;
 
diff --git a/base/server/cmscore/src/com/netscape/cmscore/usrgrp/UGSubsystem.java b/base/server/cmscore/src/com/netscape/cmscore/usrgrp/UGSubsystem.java
index 7883dec4fa2fd844cc472c3f3c6d97f35db7b6d9..d431f8e9647d1a2b070be0cc3aa9574532f93dbc 100644
--- a/base/server/cmscore/src/com/netscape/cmscore/usrgrp/UGSubsystem.java
+++ b/base/server/cmscore/src/com/netscape/cmscore/usrgrp/UGSubsystem.java
@@ -38,6 +38,8 @@ import netscape.ldap.LDAPSearchResults;
 import netscape.ldap.LDAPv2;
 import netscape.security.x509.X509CertImpl;
 
+import org.apache.commons.lang.StringUtils;
+
 import com.netscape.certsrv.apps.CMS;
 import com.netscape.certsrv.base.EBaseException;
 import com.netscape.certsrv.base.IConfigStore;
@@ -354,25 +356,40 @@ public final class UGSubsystem implements IUGSubsystem {
      * Searchs for identities that matches the filter.
      */
     public Enumeration<IUser> findUsers(String filter) throws EUsrGrpException {
-        if (filter == null) {
-            return null;
+
+        String ldapFilter;
+        if (StringUtils.isEmpty(filter)) {
+            ldapFilter = "(uid=*)";
+
+        } else {
+            filter = LDAPUtil.escapeFilter(filter);
+            ldapFilter = "(|(uid=*" + filter + "*)(cn=*" + filter + "*)(mail=*" + filter + "*))";
         }
 
         LDAPConnection ldapconn = null;
 
         try {
             ldapconn = getConn();
-            LDAPSearchResults res = ldapconn.search(getUserBaseDN(),
-                    LDAPv2.SCOPE_SUB, "(uid=" + filter + ")",
-                    null, false);
 
+            // use one-level search to search users in flat tree
+            LDAPSearchResults res = ldapconn.search(
+                    getUserBaseDN(),
+                    LDAPv2.SCOPE_ONE,
+                    ldapFilter,
+                    null,
+                    false);
+
+            // throw EUsrGrpException if result is empty
             Enumeration<IUser> e = buildUsers(res);
 
             return e;
+
         } catch (LDAPException e) {
             log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_USRGRP_FIND_USERS", e.toString()));
+
         } catch (ELdapException e) {
             log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_USRGRP_FIND_USERS", e.toString()));
+
         } finally {
             if (ldapconn != null)
                 returnConn(ldapconn);
-- 
1.8.4.2

