python-ldap-dev — discussion among developers

Re: ldaplib and LDAPv3

[Michael <mic...@in...>]

Federico Di Gregorio wrote:
> 
> Scavenging the mail folder uncovered Michael Ströder's letter:
> > Federico Di Gregorio wrote:
> >
> > I will have a closer look at it as soon as it appears in the CVS.
> >
> > > > I asked about LDAPv3 two days ago.
> > >
> > > i am sorry but i don't know about v3. any urls?
> >
> > RFC2251..2256. (I would not claim having read through all of this.)
> >
> > What IS really of interest that you can retrieve all object classes,
> > attributes and syntaxes with their OIDs existing on a particular
> > LDAP host by reading a schema entry from the root DSE => you don't
> > have to configure the LDAP client to know all the schema
> > definitions. Unfortunately LDAPv3 servers does not provide this
> > functionality to LDAPv2 clients.
> 
> i don't understand very well. can you elaborate or give an example?

E.g. a LDAPv3 server has a special entry under his RootDSE that
might look like this (shortened schema from a Domino server, lines
are wrapped):

Found under cn=schema:

objectclass=top
objectclass=subschema
objectclasses=( 2.5.6.0 NAME 'Top' ABSTRACT  MUST ( objectClass )
NOTES '' )
objectclasses=( 2.5.6.6 NAME 'person' ABSTRACT SUP 'Top'  MUST (
objectClass $ sn $ cn ) MAY ( userPa
objectclasses=( 2.5.6.7 NAME 'organizationalPerson' ABSTRACT SUP
'person'  MUST ( objectClass $ sn $ 
objectclasses=( 2.16.840.1.113730.3.2.2 NAME 'inetOrgPerson'
ABSTRACT SUP 'organizationalPerson'  MUS
objectclasses=( 2.5.6.9 NAME 'groupOfNames' ABSTRACT SUP 'Top'  MUST
( objectClass $ member $ cn ) MA
objectclasses=( 2.16.840.1.113678.2.2.2.1.2 NAME 'dominoGroup'
STRUCTURAL SUP 'groupOfNames'  MUST ( 
objectclasses=( id-oc-DominoPDPerson NAME 'PDPerson' STRUCTURAL SUP
'Top'  MUST ( objectClass ) MAY (
objectclasses=( 2.16.840.1.113678.2.2.2.1.3 NAME 'dominoPerson'
STRUCTURAL SUP 'inetOrgPerson'  MUST 
objectclasses=( 2.5.6.4 NAME 'organization' STRUCTURAL SUP 'Top' 
MUST ( objectClass ) MAY ( DisplayN
objectclasses=( 2.5.6.5 NAME 'organizationalUnit' STRUCTURAL SUP
'Top'  MUST ( objectClass ) MAY ( Di
objectclasses=( 2.16.840.1.113678.2.2.2.1.6 NAME 'Server' STRUCTURAL
SUP 'Top'  MUST ( objectClass ) 
objectclasses=( id-oc-Domino$DomainExtensibleSchema NAME
'$DomainExtensibleSchema' AUXILIARY SUP 'Top
objectclasses=( 2.16.840.1.113678.2.2.2.1.7 NAME
'$PersonGeneralInfo' AUXILIARY SUP 'Top'  MUST ( obj
objectclasses=( id-oc-Domino$$SearchTemplate for PDPeopleSearch NAME
'$$SearchTemplate for PDPeopleSe
ditcontentrules=( 2.16.840.1.113678.2.2.2.1.3 NAME 'dominoPerson'
AUX ( $PersonGeneralInfo ))
attributetypes=( 2.5.4.0 NAME 'objectClass' SYNTAX
1.3.6.1.4.1.1466.115.121.1.38 NOTES 'Type' )
attributetypes=( 2.5.4.4 NAME 'sn' SYNTAX
1.3.6.1.4.1.1466.115.121.1.15 ALIAS ( surName $ s ) NOTES '
attributetypes=( 2.5.4.3 NAME 'cn' SYNTAX
1.3.6.1.4.1.1466.115.121.1.15 ALIAS ( commonName ) NOTES 'C
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.7 DESC 'Boolean' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.22 DESC 'Facsimile
Telephone Number' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.23 DESC 'Fax' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.24 DESC 'Generalized Time'
)
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.25 DESC 'Guide' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.26 DESC 'IA5 String' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.27 DESC 'INTEGER' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.28 DESC 'JPEG' )

This should give you an idea of how powerful this mechanism is for
generic LDAP clients. I already started writing a parser for this
but got stuck because up to now I do not have a good class library.

Ciao, Michael.

_ldap on top Netscape SDK

[Michael <mic...@in...>]

David Leonard wrote:
> 
> On Fri, 11 Feb 2000, Michael Ströder wrote:
> 
> > I think this could be achieved by setting ldapmodule.c on top of the
> > Netscape SDK. Right?
> 
> well, i've had success stories from people using ldapmodule with 
> netscape's ldap library. but i haven't really delved into its api.

Well, it might be promising using the Netscape LDAP SDK. Maybe at
least for adding Python-LDAP to mozilla.org next to PerlLDAP. ;-)

Serious: LDAPv3 is highly needed by modern LDAP client software.

> feel free to hack away at it.

Unfortunately I'm not a C hacker at all...

Ciao, Michael.

A first look at ldaplib.connection.LDAPConnection

[Michael <mic...@in...>]

Federico Di Gregorio wrote:
> 
>         anyway, i begun to study/use ldap only 1 month ago, so comments
> and criticism is not only wellcome, but needed!

My comments about class ldap.connection.LDAPConnection:

1. Do you really think you need a high-level wrapper class around
_ldap?
Why are you doing this?

2. You make several assumptions which are not valid on most LDAP
hosts:

What's the meaning of filter = '(!(dn=*))' ?
On most systems entries do not have a dn attribute. The dn does not
appear in the entry's data itself.

self.filter = 'cn=*' does not make sense for general browsing of the
next sub-level. E.g. entries with object class organizationalUnit
does not have a cn attribute. Use the filter objectClass=* instead
because having an attribute objectClass is mandantory for entries.

You're setting self.base = binding_dn in ldap.connection.__init__().
I'm not sure what you're trying to do. The bind DN and the DN of the
current node you're browsing are most times not related at all. E.g.
you should set self.base = '' for start browsing from the RootDSE or
to a base DN pre-configured on the client side.


General note:
I highly recommend testing your library and client against
well-designed public LDAP hosts. E.g. nldap.com, ldap.novell.com,
elvira.innosoft.com (I'm not sure if they're happy about it). E.g.
db.debian.org is not a well-designed LDAP host because most entries
do not even have (correct) objectClass attributes. And
ldap.bigfoot.com, netcenter and other LDAP hosts pre-configured in
Netscape Communicator really suck!


Personal note:
I also highly recommend that you play around with web2ldap since
it's tested against various servers (OpenLDAP, Lotus Domino, several
public servers) and trys to be as tolerant as possible and behave
nicely for handling all the different situations/errors. Despite its
bad design web2ldap is also one of the most complete generic LDAP
clients around.
The handling of schemes and attributes is rather rude. There's no
class library yet. (I will write a proposal for a class lib in a
different posting). To be honest: E.g. displaying attributes is done
brute-force by figuring out which data is displayed (e.g. by pattern
checking for LDAP-URLs, URLs, DNs like e-mail clients usually do).
And the object class handling just knows about required and allowed
attributes. But I think the UI is quite useful now and browsing is
correctly done. Look at your server's log to learn about the search
filters used.

It does not have a tree view since this impossible on non-graphic
browsers like lynx. Use the "Go down" buttons to browse next level
below of the current entry.

Feel free to send comments about web2ldap!

Ciao, Michael.

Re: ok

[<fo...@mi...>]

Scavenging the mail folder uncovered Michael Ströder's letter:
> David Leonard wrote:
> > 
> > well.. i'm only going to touch stuff inside the cmodule for now...
> > simply to rename ldap to _ldap...
> 
> I would like several things to appear in the cmodule:
> 
> - LDAPv3 access
>   (the client should at least be recognized as LDAPv3
>   client by a LDAPv3 server)
> - SSL access

ssl access would be very nice.

-- 
Federico Di Gregorio
MIXAD LIVE System Programmer                           fo...@mi...
Debian GNU/Linux Developer & Italian Press Contact        fo...@de...
  Debian. The best software from the best people [see above]
                                      -- brought to you by One Line Spam

Re: ldaplib and LDAPv3

[<fo...@mi...>]

hi,

	i've just populated the ldaplib subtree of the cvs with my code.
it is still alpha, beware! but, togheter with the new _ldap module, it
works. i didn't commit lappo, the ldap browser. as i told you before,
david, we plan to host its page on our website (they pay me to code what i
want, but they want a little publicity back...)

	anyway, i begun to study/use ldap only 1 month ago, so comments
and criticism is not only wellcome, but needed!

Scavenging the mail folder uncovered Michael Ströder's letter:
> Federico Di Gregorio wrote:
>
> I will have a closer look at it as soon as it appears in the CVS.
> 
> > > I asked about LDAPv3 two days ago.
> > 
> > i am sorry but i don't know about v3. any urls?
> 
> RFC2251..2256. (I would not claim having read through all of this.)
> 
> What IS really of interest that you can retrieve all object classes,
> attributes and syntaxes with their OIDs existing on a particular
> LDAP host by reading a schema entry from the root DSE => you don't
> have to configure the LDAP client to know all the schema
> definitions. Unfortunately LDAPv3 servers does not provide this
> functionality to LDAPv2 clients.

i don't understand very well. can you elaborate or give an example? 

> Actually what I'd like to have is a class library which has base
> classes for syntaxes, attributes, object classes (inherited object
> classes in inherited Python classes?) and entries.

ok. give a look at my code and then let's start hacking. as i said
i'll be very happy is someone with more experience with ldap than me
can help.

> A LDAP client should be able to handle the schema no matter if it's
> retrieved via LDAPv3 from the LDAP host or from local configuration
> (in the case of LDAPv2 access). I plan to rewrite many parts of
> http://web2ldap.de and that's what I need it for...

looking at it now...

ciao,
federico

-- 
Federico Di Gregorio
MIXAD LIVE System Programmer                           fo...@mi...
Debian GNU/Linux Developer & Italian Press Contact        fo...@de...
           Nobody will ever need more than 640k RAM! -- Bill Gates, 1981
           Windows 95 needs at least 8 MB RAM.       -- Bill Gates, 1996
           Nobody will ever need Windows 95.       -- logical conclusion

Re: ok

[David L. <le...@cs...>]

On Fri, 11 Feb 2000, Michael Ströder wrote:

> I would like several things to appear in the cmodule:
> 
> - LDAPv3 access
>   (the client should at least be recognized as LDAPv3
>   client by a LDAPv3 server)
> - SSL access
> 
> I think this could be achieved by setting ldapmodule.c on top of the
> Netscape SDK. Right?

well, i've had success stories from people using ldapmodule with netscape's
ldap library. but i haven't really delved into its api.

feel free to hack away at it.

d
--
David Leonard                           Dav...@cs...
Dept of Comp. Sci. and Elec. Engg   _   Room:78-624  Ph:+61 7 336 52447
The University of Queensland       |+|  http://www.csee.uq.edu.au/~leonard/
QLD 4072  AUSTRALIA               ~` '~ E2A24DC6446E5779D7AFC41AA04E6401

Hey you! Don't disrespect our legal system. Ours is the best legal system 
that money can buy. - Anonymous Coward

ldaplib and LDAPv3

[Michael <mic...@in...>]

Federico Di Gregorio wrote:
> 
> Scavenging the mail folder uncovered Michael Ströder's letter:
> 
> > I'm also planning to write a class library for handling objectClasses,
> > attributes and syntaxes. Before I reinvent the wheel it would be nice to
> > join a project.
> 
> already done, at least in part. i am planning to write a full validating
> system (i.e., you can validate objects *before* trying to write to the
> LDAP directory.)

I will have a closer look at it as soon as it appears in the CVS.

> > I asked about LDAPv3 two days ago.
> 
> i am sorry but i don't know about v3. any urls?

RFC2251..2256. (I would not claim having read through all of this.)

What IS really of interest that you can retrieve all object classes,
attributes and syntaxes with their OIDs existing on a particular
LDAP host by reading a schema entry from the root DSE => you don't
have to configure the LDAP client to know all the schema
definitions. Unfortunately LDAPv3 servers does not provide this
functionality to LDAPv2 clients.

I don't know how long it takes until the OpenLDAP 2.x series
(LDAPv3) gets into a stable state for setting _ldap (ldapmodule.c)
on top of this. Can ldapmodule.c can be modified to use Netscape's
LDAP SDK instead of the OpenLDAP libs?

Actually what I'd like to have is a class library which has base
classes for syntaxes, attributes, object classes (inherited object
classes in inherited Python classes?) and entries.
A LDAP client should be able to handle the schema no matter if it's
retrieved via LDAPv3 from the LDAP host or from local configuration
(in the case of LDAPv2 access). I plan to rewrite many parts of
http://web2ldap.de and that's what I need it for...

Ciao, Michael.

Re: ok

[Michael <mic...@in...>]

David Leonard wrote:
> 
> well.. i'm only going to touch stuff inside the cmodule for now...
> simply to rename ldap to _ldap...

I would like several things to appear in the cmodule:

- LDAPv3 access
  (the client should at least be recognized as LDAPv3
  client by a LDAPv3 server)
- SSL access

I think this could be achieved by setting ldapmodule.c on top of the
Netscape SDK. Right?

Ciao, Michael.

ldap -> _ldap

[David L. <dav...@cs...>]

On Thu, 10 Feb 2000, David Leonard raved thusly:

> > to commit my changes and then i'll commit all the new code... stay tuned!
> well.. i'm only going to touch stuff inside the cmodule for now...
> simply to rename ldap to _ldap... 

this has been done.

i have also created a subdirectory called ldaplib. please cvs update,
then copy your lib stuff into there and add/commit.

> i have a modicum of work ahead of me moving the configure stuff up a dir.
> that won't happen any time soon.

and i'll work on this within the week

d
-- 
David Leonard                           Dav...@cs...
Dept of Comp. Sci. and Elec. Engg   _   Room:78-624  Ph:+61 7 336 52447
The University of Queensland       |+|  http://www.csee.uq.edu.au/~leonard/
QLD 4072  AUSTRALIA               ~` '~ E2A24DC6446E5779D7AFC41AA04E6401

setenv COPTS -Dnotyet

Re: ok

[David L. <dav...@cs...>]

On Wed, 9 Feb 2000, Michael Ströder raved thusly:

> I'm also planning to write a class library for handling objectClasses,
> attributes and syntaxes. Before I reinvent the wheel it would be nice to
> join a project.

excellent.. hang back a bit .. 

what i'd like to see from both you and fog is a short example or
outline of how you'd like to see a higher level library being used. I've
got a rough idea of how fog's works -actually i recall now that i've seen
sample pseudocode for his classes..

so what's your api look like, michael? can we pick out the good bits? :)

-- 
David Leonard                           Dav...@cs...
Dept of Comp. Sci. and Elec. Engg   _   Room:78-624  Ph:+61 7 336 52447
The University of Queensland       |+|  http://www.csee.uq.edu.au/~leonard/
QLD 4072  AUSTRALIA               ~` '~ E2A24DC6446E5779D7AFC41AA04E6401

setenv COPTS -Dnotyet

Re: ok

[David L. <dav...@cs...>]

On Thu, 10 Feb 2000, Federico Di Gregorio raved thusly:

> i wrote the initial code for the python part. i am waiting for david
> to commit my changes and then i'll commit all the new code... stay tuned!

well.. i'm only going to touch stuff inside the cmodule for now...
simply to rename ldap to _ldap... 

i have a modicum of work ahead of me moving the configure stuff up a dir.
that won't happen any time soon.

d
-- 
David Leonard                           Dav...@cs...
Dept of Comp. Sci. and Elec. Engg   _   Room:78-624  Ph:+61 7 336 52447
The University of Queensland       |+|  http://www.csee.uq.edu.au/~leonard/
QLD 4072  AUSTRALIA               ~` '~ E2A24DC6446E5779D7AFC41AA04E6401

setenv COPTS -Dnotyet

Re: ok

[Federico Di G. <fo...@de...>]

Scavenging the mail folder uncovered Michael Ströder's letter:
> David Leonard wrote:
> > 
> > On Wed, 9 Feb 2000, Federico Di Gregorio wrote:
> > 
> > > Date: Wed, 9 Feb 2000 09:56:32 +0100
> > > From: Federico Di Gregorio <fo...@mi...>
> > > To: David Leonard <dav...@cs...>
> > > Subject: Re: ok
> > > >     a c module directory
> > > >     a python lib directory
> 
> I would like to contribute to the python lib part if possible.
> Where can I have a look at it? Is it already available through CVS?

i wrote the initial code for the python part. i am waiting for david
to commit my changes and then i'll commit all the new code... stay tuned!

> I'm also planning to write a class library for handling objectClasses,
> attributes and syntaxes. Before I reinvent the wheel it would be nice to
> join a project.

already done, at least in part. i am planning to write a full validating
system (i.e., you can validate objects *before* trying to write to the
LDAP directory.)

> > ps: i've cc'd this to the developers list.
> 
> And do you read the list? I asked about LDAPv3 two days ago.
> But I'm not sure if the new web page / mailing list is already alive.

they are. i am sorry but i don't know about v3. any urls?

ciao,
federico

-- 
Federico Di Gregorio [http://www.bolinando.com/fog] {Friend of Penguins}
Debian GNU/Linux Developer & Italian Press Contact        fo...@de...
                             Best friends are often failed lovers. -- Me

Re: ok

[Michael <mic...@in...>]

David Leonard wrote:
> 
> On Wed, 9 Feb 2000, Federico Di Gregorio wrote:
> 
> > Date: Wed, 9 Feb 2000 09:56:32 +0100
> > From: Federico Di Gregorio <fo...@mi...>
> > To: David Leonard <dav...@cs...>
> > Subject: Re: ok
> > >     a c module directory
> > >     a python lib directory

I would like to contribute to the python lib part if possible.
Where can I have a look at it? Is it already available through CVS?

I'm also planning to write a class library for handling objectClasses,
attributes and syntaxes. Before I reinvent the wheel it would be nice to
join a project.

> ps: i've cc'd this to the developers list.

And do you read the list? I asked about LDAPv3 two days ago.
But I'm not sure if the new web page / mailing list is already alive.

Ciao, Michael.

Re: ok

[David L. <le...@cs...>]

On Wed, 9 Feb 2000, Federico Di Gregorio wrote:

> Date: Wed, 9 Feb 2000 09:56:32 +0100
> From: Federico Di Gregorio <fo...@mi...>
> To: David Leonard <dav...@cs...>
> Subject: Re: ok
> 
> hi,
> 
> Scavenging the mail folder uncovered David Leonard's letter:
> > On Tue, 8 Feb 2000, Federico Di Gregorio wrote:
> > > any news? just to know what do you think about...
> > 
> > okay, well i didn't have gtk handy so i couldn't really appreciate your 
> > gui client code... :)
> 
> well... at now the gui is a little bit flaky. 90% of my time goes into
> the classes and a framework to use ldap to administer all our (MIXAD LIVE)
> internal data: accounts, customers, jobs, etc...
> 
> > what do you think about writing an X500 class, instead of a purely LDAP class?
> > I mean, there's no way you'd write the functionality, but conceptually,
> > an X.500 directory is identical to the structure manipulated via LDAP.
> > Plus, it would give the library a more legitimate feel? And make it look
> > more standard. LDAP is actually a protocol, not a database you see.
> 
> i thought X.500 was heavy-weight and ldap the way to lighten it. 
> if implementing X.500 is no more difficult that implementing ldap
> i will do it. at now ldap is all what we need and i don't have the
> time do do *much* more work.
> 
> > you you have access to the x.500 standards? its published by x/open 
> > now, i think..
> 
> nope.
> 
> > more documentation needed really
> 
> i agree.
> 
> > otherwise, looks okay - but i still havent thoroughly looked at it all.
> > are you using it now for serious stuff?
> 
> yes. the framework outlined above. i have some python classes inheriting
> on the LDAPEntry: they represent the basic objects for the managment of
> our cutomers.
>  
> > what i meant by discuss the heirarchy was to split the cvs and distribution
> > up into two trees:
> > 
> > 	a c module directory
> > 	a python lib directory
> 
> as i did? (apart from the top-level configure.) it is the best way to do
> it. now the problem is the namespace. have you decided if you want to go
> the "compatibility" way (move ldap -> _ldap and "from _ldap import *" in
> ldap/__init__.py) or you prefer to separate the namespaces (i.e., the C
> module is still ldap and i use something different. note that i can't
> use LDAP, because some broken platform does not differentiate between
> ldap and LDAP.)
> 
> let me know,

I thought it would be best to call the C module 'cLDAP' (cf cPickle) or
'_ldap' (cf _tkinter). since you've already suggested the latter, we'll
go with that.

d

ps: i've cc'd this to the developers list.

--
David Leonard                           Dav...@cs...
Dept of Comp. Sci. and Elec. Engg   _   Room:78-624  Ph:+61 7 336 52447
The University of Queensland       |+|  http://www.csee.uq.edu.au/~leonard/
QLD 4072  AUSTRALIA               ~` '~ E2A24DC6446E5779D7AFC41AA04E6401

Hey you! Don't disrespect our legal system. Ours is the best legal system 
that money can buy. - Anonymous Coward

LDAPv3

[Michael <mic...@in...>]

HI!

I would like to know if there are plans to integrate LDAPv3 support
in python-ldap? This is quite important for my on-going project
http://web2ldap.de/.

Ciao, Michael.