From 52bba704e74966d527ac5258432b6caf32d6a59f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= <ondra@mistotebe.net>
Date: Wed, 8 Dec 2021 17:15:40 +0000
Subject: [PATCH] ITS#9763 Make sure we keep cn=config values separate

---
 servers/slapd/overlays/refint.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/servers/slapd/overlays/refint.c b/servers/slapd/overlays/refint.c
index 2e49a94be5..a60422aca1 100644
--- a/servers/slapd/overlays/refint.c
+++ b/servers/slapd/overlays/refint.c
@@ -242,6 +242,17 @@ refint_cf_gen(ConfigArgs *c)
 		switch ( c->type ) {
 		case REFINT_ATTRS:
 			rc = 0;
+			if ( c->op != SLAP_CONFIG_ADD && c->argc > 2 ) {
+				/* We wouldn't know how to delete these values later */
+				snprintf( c->cr_msg, sizeof( c->cr_msg ),
+					"Please insert multiple names as separate %s values",
+					c->argv[0] );
+				Debug( LDAP_DEBUG_CONFIG|LDAP_DEBUG_NONE,
+					"%s: %s\n", c->log, c->cr_msg );
+				rc = LDAP_INVALID_SYNTAX;
+				break;
+			}
+
 			for ( i=1; i < c->argc; ++i ) {
 				ad = NULL;
 				if ( slap_str2ad ( c->argv[i], &ad, &text )