From 1493e3c1b18d6340f185461ee9ac360ddbefabb2 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Thu, 10 Sep 2026 17:08:50 +0300
Subject: [PATCH] [#1023] Delete every objectClass value a modification asks
 for

Entry.removeObjectClassAttribute() returned out of the whole method on the first value
it removed, so a "delete: objectClass" carrying several values dropped only the first
one and never looked at the rest: the remaining classes stayed on the entry, none of
the values which the entry does not have was reported as missing, and the client got
SUCCESS. Break out of the search through the object classes of the entry instead and
carry on with the next value of the modification.

The client-visible change is confined to "delete: objectClass" in a modify: the other
callers of Entry.removeAttribute(Attribute, Collection) - the old RDN handling of
modifyDN - ignore the return value and only read the missing values.

Fixes #1023
---
 .../java/org/opends/server/types/Entry.java   | 11 +++--
 .../org/opends/server/types/TestEntry.java    | 49 +++++++++++++++++++
 2 files changed, 57 insertions(+), 3 deletions(-)

diff --git a/opendj-server-legacy/src/main/java/org/opends/server/types/Entry.java b/opendj-server-legacy/src/main/java/org/opends/server/types/Entry.java
index f826fcaeba..549e129833 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/types/Entry.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/types/Entry.java
@@ -1330,17 +1330,22 @@ private boolean removeObjectClassAttribute(Attribute attribute, Collection<? sup
     {
       String ocName = toLowerName(rule, v);
 
+      boolean matchFound = false;
       for (ObjectClass oc : objectClasses.keySet())
       {
         if (oc.hasNameOrOID(ocName))
         {
           objectClasses.remove(oc);
-          return true;
+          matchFound = true;
+          break;
         }
       }
 
-      allSuccessful = false;
-      missingValues.add(v);
+      if (!matchFound)
+      {
+        allSuccessful = false;
+        missingValues.add(v);
+      }
     }
 
     return allSuccessful;
diff --git a/opendj-server-legacy/src/test/java/org/opends/server/types/TestEntry.java b/opendj-server-legacy/src/test/java/org/opends/server/types/TestEntry.java
index d3a99a59c4..6a18853ca0 100644
--- a/opendj-server-legacy/src/test/java/org/opends/server/types/TestEntry.java
+++ b/opendj-server-legacy/src/test/java/org/opends/server/types/TestEntry.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2006-2008 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.server.types;
 
@@ -26,6 +27,7 @@
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.LinkedHashSet;
+import java.util.LinkedList;
 import java.util.List;
 import java.util.Set;
 
@@ -108,6 +110,53 @@ public void setUp() throws Exception {
     TestCaseUtils.startServer();
   }
 
+  /** Returns an entry to delete object class values from. */
+  private Entry newTestUserEntry() throws Exception
+  {
+    return TestCaseUtils.makeEntry(
+        "dn: cn=Test User,ou=People,dc=example,dc=com",
+        "objectClass: top",
+        "objectClass: person",
+        "objectClass: organizationalPerson",
+        "objectClass: inetOrgPerson",
+        "cn: Test User",
+        "sn: User");
+  }
+
+  /**
+   * A delete of several object class values must remove every one of them, the way a delete of
+   * several values of any other attribute does.
+   */
+  @Test
+  public void testRemoveSeveralObjectClassValues() throws Exception
+  {
+    Entry e = newTestUserEntry();
+
+    List<ByteString> missingValues = new LinkedList<>();
+    assertTrue(e.removeAttribute(
+        Attributes.create("objectClass", "organizationalPerson", "inetOrgPerson"), missingValues));
+
+    assertThat(missingValues).isEmpty();
+    assertThat(e.getObjectClasses().values()).containsOnly("top", "person");
+  }
+
+  /**
+   * A delete of an object class value which the entry does not have must be reported as a missing
+   * value, whatever the other values of the same modification are.
+   */
+  @Test
+  public void testRemoveObjectClassValuesOneOfWhichIsMissing() throws Exception
+  {
+    Entry e = newTestUserEntry();
+
+    List<ByteString> missingValues = new LinkedList<>();
+    assertFalse(e.removeAttribute(
+        Attributes.create("objectClass", "inetOrgPerson", "domain"), missingValues));
+
+    assertThat(missingValues).containsOnly(ByteString.valueOfUtf8("domain"));
+    assertThat(e.getObjectClasses().values()).containsOnly("top", "person", "organizationalPerson");
+  }
+
   /**
    * Test the {@link Entry#parseAttribute(String)} method.
    */