From 7eb53fdcf3d42491deb86c6d87e91cd87ca53fd1 Mon Sep 17 00:00:00 2001
From: "Endi S. Dewata" <edewata@redhat.com>
Date: Wed, 30 Apr 2014 10:55:30 -0400
Subject: [PATCH] Fixed UGSubsystem.getUser().

Previously the getUser() method in UGSubsystem was using findUsers()
which uses a subtree search to find users. It has been replaced with
a base search which is more accurate since the user DN is known.

Ticket #920
---
 .../com/netscape/cmscore/usrgrp/UGSubsystem.java   | 65 +++++++++++++++++-----
 1 file changed, 51 insertions(+), 14 deletions(-)

diff --git a/base/server/cmscore/src/com/netscape/cmscore/usrgrp/UGSubsystem.java b/base/server/cmscore/src/com/netscape/cmscore/usrgrp/UGSubsystem.java
index 4eaaa4758c2e297e952726ab4a8202b12efdb1fd..2f0d1e6f909527ea2c9ac06ba34bb0b86c248cd2 100644
--- a/base/server/cmscore/src/com/netscape/cmscore/usrgrp/UGSubsystem.java
+++ b/base/server/cmscore/src/com/netscape/cmscore/usrgrp/UGSubsystem.java
@@ -191,44 +191,81 @@ public final class UGSubsystem implements IUGSubsystem {
      * Retrieves a user from LDAP
      */
     public IUser getUser(String userid) throws EUsrGrpException {
+
         if (userid == null) {
             return null;
         }
 
         try {
-            if (userid.indexOf('=') == -1) {
-                Enumeration<IUser> e = findUsers(userid);
+            if (userid.indexOf('=') == -1) { // userid is not a DN
+                LDAPConnection ldapconn = null;
 
-                if (e != null && e.hasMoreElements()) {
-                    IUser u = e.nextElement();
+                try {
+                    ldapconn = getConn();
 
-                    return u;
-                } else {
-                    throw new EUsrGrpException(CMS.getUserMessage("CMS_USRGRP_USER_NOT_FOUND"));
+                    // use base search to find the exact user
+                    String baseDN = "uid=" + userid + "," + getUserBaseDN();
+                    LDAPSearchResults res = ldapconn.search(
+                            baseDN,
+                            LDAPv2.SCOPE_BASE,
+                            "(objectclass=*)",
+                            null,
+                            false);
+
+                    // throw EUsrGrpException if result is empty
+                    Enumeration<IUser> e = buildUsers(res);
+
+                    if (e == null || !e.hasMoreElements()) {
+                        // never happens because buildUsers() already throws exception
+                        throw new EUsrGrpException(CMS.getUserMessage("CMS_USRGRP_USER_NOT_FOUND"));
+                    }
+
+                    // user found
+                    return e.nextElement();
+
+                } finally {
+                    if (ldapconn != null)
+                        returnConn(ldapconn);
                 }
-            } else {
+
+            } else { // userid is a DN
                 LDAPConnection ldapconn = null;
 
                 try {
                     ldapconn = getConn();
-                    // read DN
-                    LDAPSearchResults res =
-                            ldapconn.search(userid,
-                                    LDAPv2.SCOPE_SUB, "(objectclass=*)", null, false);
+
+                    // use base search to find the exact user
+                    String baseDN = userid;
+                    LDAPSearchResults res = ldapconn.search(
+                            baseDN,
+                            LDAPv2.SCOPE_BASE,
+                            "(objectclass=*)",
+                            null,
+                            false);
+
+                    // throw EUsrGrpException if result is empty
                     Enumeration<IUser> e = buildUsers(res);
 
-                    if (e.hasMoreElements()) {
-                        return e.nextElement();
+                    if (e == null || !e.hasMoreElements()) {
+                        // never happens because buildUsers() already throws exception
+                        throw new EUsrGrpException(CMS.getUserMessage("CMS_USRGRP_USER_NOT_FOUND"));
                     }
+
+                    // user found
+                    return e.nextElement();
+
                 } finally {
                     if (ldapconn != null)
                         returnConn(ldapconn);
                 }
             }
+
         } catch (Exception e) {
             log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_USRGRP_GET_USER", e.toString()));
             // throws...
         }
+
+        // user not found or other error occurs
         return null;
     }
 
-- 
1.8.4.2

