perl-ldap-dev

DN comparision not using compare function

[Steve N. <ne...@na...>]

I have written a script that makes sure that the indexes on the slave
servers are consistent with the master server.  I am having problems
finding a good way to compare DNs correctly. I do a search on each
server for to get all the indexes, then I need to compare the DN's to
see if the indexes exist on all the servers. 

It appears that Net::LDAP does not normalize the DN before hashing it
into a structure.  Therefore if I do a comparison of the DN's and one
happens to be capitalized (or spaces differently, or ??) then comparing
DNs will fail.

I want to do a single search on each server rather than do a ->compare
on each attribute.  Is there a better method for comparing DNs between
two servers to find out if they match?


----code snippet below showing an ugly incomplete hack----


 my $server1 = $ldap1->search (        # perform a search
                   base   => "cn=index,cn=config,cn=ldbm",
                   filter => "objectclass=*",
                   attrs => [qw(cn, nsindextype)]

  my $server2 = $ldap2->search (        # perform a search
                   base   => "cn=index,cn=config,cn=ldbm",
                   filter => "objectclass=*",
                   attrs => [qw(cn, nsindextype)]
                  );

  my $href1 = $server1->as_struct;
  my $href2 = $server2->as_struct;

  my @arrayOfDNs1  = keys %$href1 ; # use DN hashes
  my @arrayOfDNs2  = keys %$href2 ; # use DN hashes

  #bug in Net::LDAP where DNs are stored in case sensitive manner
  # cannocialize everything to lower case entries
  my $dn;
  foreach $dn  (@arrayOfDNs1){
    $$href1{lc "$dn"} =$$href1{"$dn"};
  }
  foreach $dn  (@arrayOfDNs2){
    $$href2{lc "$dn"} =$$href2{"$dn"};
  }

Re: DN comparision not using compare function

[Chris R. <chr...@me...>]

Steve Neruda <ne...@na...> wrote:
> I have written a script that makes sure that the indexes on the slave
> servers are consistent with the master server.  I am having problems
> finding a good way to compare DNs correctly. I do a search on each
> server for to get all the indexes, then I need to compare the DN's to
> see if the indexes exist on all the servers. 
> 
> It appears that Net::LDAP does not normalize the DN before hashing it
> into a structure.  Therefore if I do a comparison of the DN's and one
> happens to be capitalized (or spaces differently, or ??) then comparing
> DNs will fail.

That looks about right. Net::LDAP simply uses the bytes that were sent by
the server as the DN without trying to interpret them too much.

I'm not sure it is a Net::LDAP bug, rather just the "way it works".

> I want to do a single search on each server rather than do a ->compare
> on each attribute.  Is there a better method for comparing DNs between
> two servers to find out if they match?

I can't think of one. Your canonicalization (lower-casing the entire DN)
will of course not work for many cases, but I guess you're aware of that.
It might be good enough to solve your immediate problem.

To be complete I think Unicode says that you should convert to upper-case,
and you need to deal with the different ways to encode accented characters,
the different ordering of multi-AVA RDNs (cn=Foo Bar+uid=baz,...), the
different ways of encoding the attribute types and values, etc etc etc.
Pretty hard to do it all correctly!

And that's assuming you're using LDAPv3 to access the directory. For LDAPv2
there are more problems. :-)

How painful would it be to use compare operations against one of the
servers? It strikes me that would be a *lot* easier, assuming the server
did these things correctly.

Cheers,

Chris