python-ldap-dev — discussion among developers

Re: python-ldap search_s hanging problem on Linux box

[Michael S. <mi...@st...>]

Todd Hanson wrote:
> I found the resolution!!!  If I add the line of code
> "con.set_option(ldap.OPT_REFERRALS, 0)" after making the connection
> everything runs fine.  Why?

Search the python-ldap-dev archive. This is a known issue with automatic
referral chasing within libldap. Switching it off does not do any harm.

Ciao, Michael.

Re: python-ldap search_s hanging problem on Linux box

[Michael S. <mi...@st...>]

Tood,

please stay on the python-ldap-dev list (Cc:-ed) so others can learn and
answer as well.

Todd Hanson wrote:
> Michael Ströder [mailto:mi...@st...] wrote:
>> Todd Hanson wrote:
>>> I have a query that was written in python (2.5) utilizing the 
>>> python-ldap package (newest stable version for both Windows and
>>> Linux) to query an Active Directory server for a user's group
>>> membership. The code works fine on my test machine (2-3 seconds for
>>> result) which is Windows based but when I move the code over and
>>> run it on our production Linux (Ubuntu 8.10) server the query hangs
>>> for exactly 5 minutes and then displays the results.
>> 
>> I've also observed strange things like this with MS AD before. I
>> don't know a clear solution. It kind of sounds like a timeout.
>> 
>> One very important thing is to double-check the DNS A and PTR RRs for
>> all systems involved and avoid using DNS aliases (CNAME). This is
>> especially true e.g. for SASL bind requests where I experienced
>> strange problems when using IP address instead of FQDN when binding
>> to AD.
>
> The strange thing is I would expect the delay to come when I'm doing
> the "con.simple_bind_s(user_id, pw)" but that appears to connect
> right away.  The delay comes when I issue the "search_s" command.  If
> it was a DNS or reverse DNS issue I would expect the delay to come on
> the connection or is that a wrong assumption?

Bear in mind that a Windows domain could be part of a forest with trust
relationships etc. So you never know what is resolved internally when
processing a search request. I do not claim to be an AD expert though.

Maybe you could try asking about this particular issue in a
MS-AD-related newsgroup:

news:microsoft.public.windows.server.active_directory

Ciao, Michael.

Re: python-ldap search_s hanging problem on Linux box

[Michael S. <mi...@st...>]

Todd Hanson wrote:
> 
> I have a query that was written in python (2.5) utilizing the
> python-ldap package (newest stable version for both Windows and Linux)
> to query an Active Directory server for a user’s group membership.  The
> code works fine on my test machine (2-3 seconds for result) which is
> Windows based but when I move the code over and run it on our production
> Linux (Ubuntu 8.10) server the query hangs for exactly 5 minutes and
> then displays the results.  Does anyone have any ideas where this delay
> might be coming from and how I can resolve the issue?

I've also observed strange things like this with MS AD before. I don't
know a clear solution. It kind of sounds like a timeout.

One very important thing is to double-check the DNS A and PTR RRs for
all systems involved and avoid using DNS aliases (CNAME). This is
especially true e.g. for SASL bind requests where I experienced strange
problems when using IP address instead of FQDN when binding to AD.

Ciao, Michael.

python-ldap search_s hanging problem on Linux box

[Todd H. <Tod...@ma...>]

I have a query that was written in python (2.5) utilizing the
python-ldap package (newest stable version for both Windows and Linux)
to query an Active Directory server for a user's group membership.  The
code works fine on my test machine (2-3 seconds for result) which is
Windows based but when I move the code over and run it on our production
Linux (Ubuntu 8.10) server the query hangs for exactly 5 minutes and
then displays the results.  Does anyone have any ideas where this delay
might be coming from and how I can resolve the issue? 

 

The code is (please note I replaced some real data i.e. login, password,
etc with "????" but in my code real names are there):

 

#!/usr/bin/envpython

import ldap

import ldap.sasl

import sys

 

server = 'ldap://10.200.1.10'

user_id = ????

pw = ????

 

def main():

    try:

        con = ldap.initialize(server)

        con.simple_bind_s(user_id, pw)

        print 'Connection Made'

    except ldap.INVALID_CREDENTIALS:

        print "Your username or password is incorrect."

        sys.exit()

    except ldap.LDAPError, e:

        if type(e.message) == dict and e.message.has_key('desc'):

            print 'Error - ' + e.message['desc']

        else:

            print 'Error - ' + str(e)

            sys.exit()

    finally:

 

        print 'Connected'

 

        try:

            #con.timeout = 10

            #con.network_timeout = 10

 

            base_dn = 'dc=mariner,dc=local'

            filter = "(memberOf=CN=????,CN=Users,DC=????,DC=local)"

            attrs =
['sn','mail','cn','sAMAccountName','displayName','memberOf']

            timeout = 3

            results = con.search_s(base_dn, ldap.SCOPE_SUBTREE, filter,
attrs)

 

            for dn,entry in results:

                if dn != None:

                    print 'Processing',repr(dn)

                    print entry['sAMAccountName']

                    print entry['displayName']

                    print entry['memberOf']

 

            con.unbind()

            print ""

            print "Connection Closed"

        except ldap.LDAPError, e:

            print 'Error - ' + str(e)

            sys.exit()

 

# End Of Code

##

###

####

if __name__=="__main__":

    main()

 

Thank You

 

Todd J. Hanson

tod...@ma...

 

Re: Any example to display jpegPhoto?

[Zhang H. <zhb...@gm...>]

Ryan Lovett wrote:
> You would have a tag such as <img src="jpegphoto.cgi?user=someone"> where
> jpegphoto.cgi is a CGI script that outputs "Content-type: image/jpeg"
> followed by the JPEG data.
>
> But that is an HTTP topic so you should probably consult a Python/CGI
> resource.

Solved, thanks all :)

I use webpy framework, solved just like Ryan Lovett said.

Related thread:
http://groups.google.com/group/webpy/t/9f7fdff1c75f7e93

-- 
Best regards.

Zhang Huangbin

- Open Source Mail Server Solution for RHEL, CentOS,
  Debian, Ubuntu:
    + Homepage: http://code.google.com/p/iredmail/
    + Forum: http://www.iredmail.org/forum/

Re: Any example to display jpegPhoto?

[Michael S. <mi...@st...>]

Zhang Huangbin wrote:
> Zhang Huangbin wrote:
>>> Not sure what you really want to display and where.
>>>
>>> How about entry['jpegPhoto'][0].encode('base64') ?
> 
> Still confused what data type it stored in LDAP.
> Already base64 encoded?

Please read my e-mails more carefully.

As said in <4A2...@st...> it's the raw binary JPEG
image data.

> Display entry['jpegPhoto'][0] directly, got error msg:
> ----
> 'ascii' codec can't decode byte 0x89 in position 0: ordinal not in 
> range(128)
> ----
> 
> How can i display it if i use 'content-type: image/jpeg' header?

Send the binary data directly. Don't try to (implicitly) convert
entry['jpegPhoto'][0] to a Unicode object. You might want to learn a bit
more about normal strings vs. Unicode objects, string coercion and how
to interpret exceptions like the one above before going any further.

Ciao, Michael.

Re: Any example to display jpegPhoto?

[Ryan L. <ry...@st...>]

On Tue, Jun 09, 2009 at 05:14:33PM +0800, Zhang Huangbin wrote:
> > How can i display it if i use 'content-type: image/jpeg' header?
> 
> Forget to say, it works in non-IE browsers like this:
> ----
> <img src="data:image/jpeg;base64,**** output of 
> entry['jpegPhoto'][0].encode('base64') here ****" />
> ----

You would have a tag such as <img src="jpegphoto.cgi?user=someone"> where
jpegphoto.cgi is a CGI script that outputs "Content-type: image/jpeg"
followed by the JPEG data.

But that is an HTTP topic so you should probably consult a Python/CGI
resource.

Ryan

Re: Any example to display jpegPhoto?

[Zhang H. <zhb...@gm...>]

Zhang Huangbin wrote:
> Zhang Huangbin wrote:
>>> Not sure what you really want to display and where.
>>>
>>> How about entry['jpegPhoto'][0].encode('base64') ?
>
> Still confused what data type it stored in LDAP.
> Already base64 encoded?
>
> Display entry['jpegPhoto'][0] directly, got error msg:
> ----
> 'ascii' codec can't decode byte 0x89 in position 0: ordinal not in 
> range(128)
> ----
>
> How can i display it if i use 'content-type: image/jpeg' header?
>

Forget to say, it works in non-IE browsers like this:
----
<img src="data:image/jpeg;base64,**** output of 
entry['jpegPhoto'][0].encode('base64') here ****" />
----

-- 
Best regards.

Zhang Huangbin

- Open Source Mail Server Solution for RHEL, CentOS,
  Debian, Ubuntu:
    + Homepage: http://code.google.com/p/iredmail/
    + Forum: http://www.iredmail.org/forum/

Re: Any example to display jpegPhoto?

[Zhang H. <zhb...@gm...>]

Zhang Huangbin wrote:
>> Not sure what you really want to display and where.
>>
>> How about entry['jpegPhoto'][0].encode('base64') ?

Still confused what data type it stored in LDAP.
Already base64 encoded?

Display entry['jpegPhoto'][0] directly, got error msg:
----
'ascii' codec can't decode byte 0x89 in position 0: ordinal not in 
range(128)
----

How can i display it if i use 'content-type: image/jpeg' header?

-- 
Best regards.

Zhang Huangbin

- Open Source Mail Server Solution for RHEL, CentOS,
  Debian, Ubuntu:
    + Homepage: http://code.google.com/p/iredmail/
    + Forum: http://www.iredmail.org/forum/

Re: Any example to display jpegPhoto?

[Michael S. <mi...@st...>]

Zhang Huangbin wrote:
> Michael Ströder wrote:
>> Zhang Huangbin wrote:
>>   
>>> Is there ny example to display jpegPhoto stored in LDAP as base64 format?
>>>     
>> Not sure what you really want to display and where.
>>
>> How about entry['jpegPhoto'][0].encode('base64') ?
>>
>> Or are you talking about LDIF? Then use module ldif which automagically
>> base64-encodes NON-ASCII values.
> 
> Just display the jpegPhoto on web page, not LDIF. :)
> 
> I got encoded string after 'entry['jpegPhoto'][0].encode('base64') ',
> but how to convert it to a image file and use '<img> tag in HTML to
> display it?

entry['jpegPhoto'][0] is the raw binary JPEG data. You can send this
directly to the browser in the body of a HTTP response with MIME-type
image/jpeg. This is kind of off-topic here since it's rather related to
web app programming. So I'd recommend to ask in the forum related to the
web app framework you're using.

Ciao, Michael.

Re: Any example to display jpegPhoto?

[Zhang H. <zhb...@gm...>]

Michael Ströder wrote:
> Zhang Huangbin wrote:
>   
>> Is there ny example to display jpegPhoto stored in LDAP as base64 format?
>>     
>
> Not sure what you really want to display and where.
>
> How about entry['jpegPhoto'][0].encode('base64') ?
>
> Or are you talking about LDIF? Then use module ldif which automagically
> base64-encodes NON-ASCII values.
>
>   

Thanks Michael :)

Just display the jpegPhoto on web page, not LDIF. :)

I got encoded string after 'entry['jpegPhoto'][0].encode('base64') ',
but how to convert it to a image file and use '<img> tag in HTML to
display it?



-- 
Best regards.

Zhang Huangbin

- Open Source Mail Server Solution for RHEL, CentOS,
  Debian, Ubuntu:
    + Homepage: http://code.google.com/p/iredmail/
    + Forum: http://www.iredmail.org/forum/

Re: Any example to display jpegPhoto?

[Michael S. <mi...@st...>]

Zhang Huangbin wrote:
> 
> Is there ny example to display jpegPhoto stored in LDAP as base64 format?

Not sure what you really want to display and where.

How about entry['jpegPhoto'][0].encode('base64') ?

Or are you talking about LDIF? Then use module ldif which automagically
base64-encodes NON-ASCII values.

Ciao, Michael.

Any example to display jpegPhoto?

[Zhang H. <zhb...@gm...>]

Hi, list.

Is there ny example to display jpegPhoto stored in LDAP as base64 format?
I only found example to add jpegPhoto in python-ldap-2.3.8/Demo/simple.py.

Thanks very much. :)

-- 
Best regards.

Zhang Huangbin

- Open Source Mail Server Solution for RHEL, CentOS,
  Debian, Ubuntu:
    + Homepage: http://code.google.com/p/iredmail/
    + Forum: http://www.iredmail.org/forum/

Re: Python-ldap and client-only OpenLDAP

[Guillaume S. <gu...@gm...>]

Thanks a lot for the detailed response.
I finally fixed this issue. I thought that library_dirs and include_dirs
would search /usr/local/lib and /usr/local/include without having to
specify these directories.

Have a good day !

2009/6/2 Michael Ströder <mi...@st...>

> Guillaume Simard wrote:
> >
> > I want to build OpenLDAP and Python-LDAP from source.
> > However, I can't install Berkeley DB so I installed Open-LDAP with
> >
> > ./configure --disable-slapd --disable-slurpd
>
> Yes, that should be sufficient for python-ldap.
>
> > I then built and installed Python-LDAP.
> >
> > However, when I try to import, I get
> >
> >   File "/usr/local/lib/python2.6/site-packages/ldap/__init__.py", line
> > 22, in <module>
> >     from _ldap import *
> > ImportError: /usr/local/lib/python2.6/site-packages/_ldap.so: undefined
> > symbol: ber_pvt_opt_on
>
> Which platform is that on? Could you please check with
>
> ldd /usr/local/lib/python2.6/site-packages/_ldap.so
>
> or a similar tool whether libldap(_r) of your OpenLDAP build is
> dynamically linked?
>
> Did you adjust the parameters 'library_dirs' and 'include_dirs' in
> file setup.cfg to point to your OpenLDAP client lib installation before
> running python setup.py build?
>
> > Does Python-LDAP have any dependencies toward the "server" part of
> > OpenLDAP ?
>
> No.
>
> Ciao, Michael.
>

Re: Python-ldap and client-only OpenLDAP

[Michael S. <mi...@st...>]

Guillaume Simard wrote:
> 
> I want to build OpenLDAP and Python-LDAP from source.
> However, I can't install Berkeley DB so I installed Open-LDAP with 
> 
> ./configure --disable-slapd --disable-slurpd

Yes, that should be sufficient for python-ldap.

> I then built and installed Python-LDAP.
> 
> However, when I try to import, I get 
> 
>   File "/usr/local/lib/python2.6/site-packages/ldap/__init__.py", line
> 22, in <module>
>     from _ldap import *
> ImportError: /usr/local/lib/python2.6/site-packages/_ldap.so: undefined
> symbol: ber_pvt_opt_on

Which platform is that on? Could you please check with

ldd /usr/local/lib/python2.6/site-packages/_ldap.so

or a similar tool whether libldap(_r) of your OpenLDAP build is
dynamically linked?

Did you adjust the parameters 'library_dirs' and 'include_dirs' in
file setup.cfg to point to your OpenLDAP client lib installation before
running python setup.py build?

> Does Python-LDAP have any dependencies toward the "server" part of
> OpenLDAP ?

No.

Ciao, Michael.

Python-ldap and client-only OpenLDAP

[Guillaume S. <gu...@gm...>]

Hey everyone,
I want to build OpenLDAP and Python-LDAP from source.
However, I can't install Berkeley DB so I installed Open-LDAP with

./configure --disable-slapd --disable-slurpd

I then built and installed Python-LDAP.

However, when I try to import, I get

  File "/usr/local/lib/python2.6/site-packages/ldap/__init__.py", line 22,
in <module>
    from _ldap import *
ImportError: /usr/local/lib/python2.6/site-packages/_ldap.so: undefined
symbol: ber_pvt_opt_on

Does Python-LDAP have any dependencies toward the "server" part of OpenLDAP
?

Any help is most welcome, thanks.

Re: problem with set_option and tls

[Mike L. <mi...@mo...>]

Michael Ströder wrote:
> Mike Lovell wrote:
>   
>> Michael Ströder wrote:
>>     
>>> I guess you're using python-ldap built against OpenLDAP 2.3 client libs.
>>> With OpenLDAP 2.4 connection-specific TLS options should be supported.
>>>
>>>   
>>>       
>> I am using a machine with Ubuntu 9.04 which has the 2.4 OpenLDAP
>> libraries.
>>     
>
> Please post the exact OpenLDAP version.
>
> Ciao, Michael.
>   
So, I was testing this on an Ubuntu 9.04 system that was upgraded from 
8.10 and has various other quirks and it was showing this problem. I 
just tested on a Debian Lenny system which has libldap-2.4-2 with 
python-ldap 2.3.5-1 and it works fine. So I am guessing it is just 
another one of the quirks with the system I was using.

mike

Re: Problem with names that include ","

[Michael S. <mi...@st...>]

Christoph Holtermann wrote:
> I am working on a filter that makes Thunderbirds LDIF-Output
> importable to OpenLDAP. It works quite fine except for names
> that include ",". OpenLDAP dislikes the output that is produced
> like :

Can you please elaborate on which exact problems you have with OpenLDAP?

> dn: cn=Lehmann\, Veronika,dc=Adressbuch,dc=christoph

This looks like a perfectly valid DN string representation to me.

> cn: Lehmann\, Veronika

This is wrong since the attribute value for cn is supposed to be
'Lehmann, Veronika' not 'Lehmann\\, Veronika' (strings here in Python
string notation with single \ escaped to \\). OpenLDAP is pretty strict
when checking the characteristic attribute used in the RDN of entry.

> I found out that an encoding like "\2C" is accepted, like :
> 
> dn: cn=Lehmann\2C Veronika,dc=Adressbuch,dc=christoph

Yes, that's an alternate style also valid according to RFC 4514.

> The code that is about that problem looks like :
> 
> basedn='dc=Adressbuch,dc=christoph'
> 
> def fix_dn(self, dn):
>  try:
>   self.head=ldap.dn.explode_dn(dn)[0]
>   for i in range(len(dn_warning)):
>    if self.head.find(dn_warning[i])>-1:
>     print "dn :",self.head, "contains '",dn_warning[i],"' - change
> manually !"
>   return self.head + ',' + basedn
>  except:
>   if dn==None:
>    print "No dn specified"
>    return None

Glancing over this I don't understand your code. What is this function
supposed to do?

At least this looks correct to me:

Python 2.6 (r26:66714, Feb  3 2009, 20:52:03)
[GCC 4.3.2 [gcc-4_3-branch revision 141291]] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import ldap
>>> ldap.explode_dn('cn=Lehmann\, Veronika,dc=Adressbuch,dc=christoph')
['cn=Lehmann\\, Veronika', 'dc=Adressbuch', 'dc=christoph']
>>>

Ciao, Michael.

Re: Problem with names that include ","

[Marc B. <ma...@ms...>]

Am 02.06.2009 um 14:12 schrieb Michael Ströder:

> Marc Balmer wrote:
>> take a look at RFC 1779.  A semicolon could be used as an
>> alternate delimiter and it shuld be possible to enclose strings
>> in quotes, i.e. like this:
>
> RFC 1779 was part of LDAPv2 standard which has been obsoleted for  
> quite
> a while now. Today RFC 4514 is relevant for LDAPv3-based DSAs which  
> does
> not allow semicolon as delimiter.


grmbll, that is what you get when you work with 40 years old systems....

Sorry for the wrong information, though.

Marc Balmer (long time BSD developer ;)

Re: Problem with names that include ","

[Yves D. <yv...@zi...>]

Michael Ströder wrote:
>>
>>> I am working on a filter that makes Thunderbirds LDIF-Output
>>> importable to OpenLDAP. It works quite fine except for names
>>> that include ",". OpenLDAP dislikes the output that is produced
>>> like :
>>>
>>> dn: cn=Lehmann\, Veronika,dc=Adressbuch,dc=christoph
>> Escaping characters is used by some LDAP servers, not all of them, but is 
>> not conform to LDIF.
> 
> Yves, that sounds wrong to me.
> 
> According to RFC 4514 a comma within a RDN value has to either be
> escaped with \ or converted to hex-escaped value.  That's what function
> ldap.dn.escape_dn_chars() is for. And you can directly use the result in
> LDIF.

Michael is right here, even though there is no escaping in LDIF itself, you 
can use a backslash in an LDIF file, and RFC 4514 defines the backslash 
syntax to escape some characters.

Sorry to mislead you Christoph.

-- 
Yves.
http://www.sollers.ca/

Re: Problem with names that include ","

[Michael S. <mi...@st...>]

Christoph Holtermann wrote:
> 
> Still working on commas in dn. When I now look
> at the functions supplied in python ldap there is
> for example :
> 
>>>> a='cn="lehmann, Andreas",dc=Adressbuch'
>>>> b=ldap.dn.str2dn(a)
>>>> b
> [[('cn', 'lehmann, Andreas', 1)], [('dc', 'Adressbuch', 1)]]
>>>> ldap.dn.dn2str(b)
> 'cn=lehmann\\, Andreas,dc=Adressbuch'
>>>> ldap.dn.explode_dn(a)
> ['cn=lehmann\\, Andreas', 'dc=Adressbuch']
> 
> So Python-LDAP itself goes this nonconform way of
> using escape sequences if I get it right.

Why do you think that this is wrong? I'd recommend to read RFC 4514 to
learn in detail instead of relying on false information given by others.

> I guess it's quite easy using dn2str and then converting it to a new
> string using "" instead of using str2dn or explode_dn that lead to
> ESC-Codes.

There's nothing wrong with correct escaping. Quoted RDN attribute values
should be avoided.

> But wouldn't it make sense to change the functions ?

No.

Ciao, Michael.

Re: Problem with names that include ","

[Michael S. <mi...@st...>]

Yves Dorfsman wrote:
> Christoph Holtermann wrote:
> 
>> I am working on a filter that makes Thunderbirds LDIF-Output
>> importable to OpenLDAP. It works quite fine except for names
>> that include ",". OpenLDAP dislikes the output that is produced
>> like :
>>
>> dn: cn=Lehmann\, Veronika,dc=Adressbuch,dc=christoph
> 
> Escaping characters is used by some LDAP servers, not all of them, but is 
> not conform to LDIF.

Yves, that sounds wrong to me.

According to RFC 4514 a comma within a RDN value has to either be
escaped with \ or converted to hex-escaped value.  That's what function
ldap.dn.escape_dn_chars() is for. And you can directly use the result in
LDIF.

Ciao, Michael.

Re: Problem with names that include ","

[Christoph H. <c.h...@gm...>]

Hello !

Still working on commas in dn. When I now look
at the functions supplied in python ldap there is
for example :

>>> a='cn="lehmann, Andreas",dc=Adressbuch'
>>> b=ldap.dn.str2dn(a)
>>> b
[[('cn', 'lehmann, Andreas', 1)], [('dc', 'Adressbuch', 1)]]
>>> ldap.dn.dn2str(b)
'cn=lehmann\\, Andreas,dc=Adressbuch'
>>> ldap.dn.explode_dn(a)
['cn=lehmann\\, Andreas', 'dc=Adressbuch']

So Python-LDAP itself goes this nonconform way of
using escape sequences if I get it right.
I guess it's quite easy using dn2str and then
converting it to a new string using "" instead of using
str2dn or explode_dn that lead to ESC-Codes.
But wouldn't it make sense to change the
functions ?

regards,

C. Holtermann

Re: Problem with names that include ","

[Michael S. <mi...@st...>]

Michael Ströder wrote:
> Christoph Holtermann wrote:
>> I just fed it with
>>
>> dn: cn="Lehmann, Veronika",dc=Adressbuch,dc=christoph
>> objectclass: top
>> objectclass: person
>> objectclass: inetOrgPerson
>> objectclass: mozillaAbPersonAlpha
>> sn: Lehmann
>> cn: Lehmann, Veronika
> 
> And that's the correct LDIF for the entry you want to add.

And

dn: cn=Lehmann\, Veronika,dc=Adressbuch,dc=christoph

would have been correct either.

Ciao, Michael.

Re: Problem with names that include ","

[Michael S. <mi...@st...>]

Christoph Holtermann wrote:
> I just fed it with
> 
> dn: cn="Lehmann, Veronika",dc=Adressbuch,dc=christoph
> objectclass: top
> objectclass: person
> objectclass: inetOrgPerson
> objectclass: mozillaAbPersonAlpha
> sn: Lehmann
> cn: Lehmann, Veronika

And that's the correct LDIF for the entry you want to add.

> it works fine. But the Output of OpenLDAP, when I ldapsearch it is :
> 
>> ldapsearch -x "(cn=*lehmann*)"
> # extended LDIF                                                    
> #                                                                  
> # LDAPv3                                                           
> # base <dc=christoph> (default) with scope subtree                 
> # filter: (cn=*lehmann*)                                           
> # requesting: ALL                                                  
> #
> 
> # Lehmann\2C Veronika, Adressbuch.christoph
> dn: cn=Lehmann\2C Veronika,dc=Adressbuch,dc=christoph
> objectClass: top
> objectClass: person
> objectClass: inetOrgPerson
> objectClass: mozillaAbPersonAlpha
> sn: Lehmann
> cn: Lehmann, Veronika

And that's correct either.

> And what I saw was : escape-codes. And I just have been told, that
> it's not LDIF-conform ;-)

Yes, this was wrong information.

> So my goal now is to make my filter put entrys which contain commas
> in "". Does anyone know how to make Python-ldap do so ?

I'm not sure what you want to achieve. I'd use module 'ldif' to read the
Thunderbird export file and sanitize it. If Thunderbird put the \ in the
value for attribute 'cn' then you have to strip this wrong escaping, but
only for this particular attribute value. It seems you can use the DN as is.

Ciao, Michael.