Menu
▾
▴
python-ldap-dev — discussion among developers
You can subscribe to this list here.
| 2000 |
Jan
|
Feb
(34) |
Mar
(9) |
Apr
|
May
(2) |
Jun
(14) |
Jul
(67) |
Aug
(34) |
Sep
(5) |
Oct
(20) |
Nov
(22) |
Dec
(31) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2001 |
Jan
(15) |
Feb
(16) |
Mar
(20) |
Apr
(13) |
May
(72) |
Jun
(42) |
Jul
(41) |
Aug
(11) |
Sep
(19) |
Oct
(67) |
Nov
(59) |
Dec
(57) |
| 2002 |
Jan
(74) |
Feb
(69) |
Mar
(34) |
Apr
(55) |
May
(47) |
Jun
(74) |
Jul
(116) |
Aug
(68) |
Sep
(25) |
Oct
(42) |
Nov
(28) |
Dec
(52) |
| 2003 |
Jan
(19) |
Feb
(18) |
Mar
(35) |
Apr
(49) |
May
(73) |
Jun
(39) |
Jul
(26) |
Aug
(59) |
Sep
(33) |
Oct
(56) |
Nov
(69) |
Dec
(137) |
| 2004 |
Jan
(276) |
Feb
(15) |
Mar
(18) |
Apr
(27) |
May
(25) |
Jun
(7) |
Jul
(13) |
Aug
(2) |
Sep
(2) |
Oct
(10) |
Nov
(27) |
Dec
(28) |
| 2005 |
Jan
(22) |
Feb
(25) |
Mar
(41) |
Apr
(17) |
May
(36) |
Jun
(13) |
Jul
(22) |
Aug
(12) |
Sep
(23) |
Oct
(6) |
Nov
(4) |
Dec
|
| 2006 |
Jan
(11) |
Feb
(3) |
Mar
(5) |
Apr
(22) |
May
(1) |
Jun
(10) |
Jul
(19) |
Aug
(7) |
Sep
(25) |
Oct
(23) |
Nov
(5) |
Dec
(27) |
| 2007 |
Jan
(25) |
Feb
(17) |
Mar
(44) |
Apr
(8) |
May
(33) |
Jun
(31) |
Jul
(42) |
Aug
(16) |
Sep
(12) |
Oct
(16) |
Nov
(23) |
Dec
(73) |
| 2008 |
Jan
(26) |
Feb
(6) |
Mar
(46) |
Apr
(17) |
May
(1) |
Jun
(44) |
Jul
(9) |
Aug
(34) |
Sep
(20) |
Oct
(2) |
Nov
(4) |
Dec
(16) |
| 2009 |
Jan
(14) |
Feb
(3) |
Mar
(45) |
Apr
(52) |
May
(34) |
Jun
(32) |
Jul
(24) |
Aug
(52) |
Sep
(22) |
Oct
(23) |
Nov
(19) |
Dec
(10) |
| 2010 |
Jan
(10) |
Feb
(13) |
Mar
(22) |
Apr
(9) |
May
(1) |
Jun
(1) |
Jul
(8) |
Aug
(9) |
Sep
(10) |
Oct
(1) |
Nov
(2) |
Dec
(3) |
| 2011 |
Jan
|
Feb
(18) |
Mar
(39) |
Apr
(5) |
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: <mi...@st...> - 2006-11-15 17:42:35
|
Find a new release of python-ldap: http://python-ldap.sourceforge.net/ python-ldap provides an object-oriented API to access LDAP directory servers from Python programs. It mainly wraps the OpenLDAP 2.x libs for that purpose. Additionally it contains modules for other LDAP-related stuff (e.g. processing LDIF, LDAPURLs and LDAPv3 schema). ---------------------------------------------------------------- Released 2.2.1 2006-11-15 Changes since 2.2.0: Modules/ * Fix for Python 2.5 free(): invalid pointer (see SF#1575329) * passwd() accepts None for arguments user, oldpw, newpw (see SF#1440151) Lib/ * ldif.LDIFWriter.unparse() now accepts instances of derived dict and list classes (see SF#1489898) |
|
From: <mi...@st...> - 2006-10-28 21:49:18
|
Roland,
Roland Hedberg wrote:
>
> If you encounter a problem the raises the exception, for instance
> TYPE_OR_VALUE_EXISTS, and then prints the exception info, it will come
> out looking something like this:
>
> {'info': 'street: value #0 provided more than once', 'desc': 'Type or
> value exists'}
>
> Which looks like when you print a dictionary.
It is a dictionary.
> The obvious:
>
> try:
> ....
> except ldap.TYPE_OR_VALUE_EXISTS, e:
> print e.info
>
> doesn't work
Be warned: It's ugly!
e.args[0]['desc']
e.args[0]['info']
I really have no clue why David implemented it in this way. Guess it has
something to do with focusing on C programming. ;-)
Guess it's time for another wrapper class around exceptions raised by
_ldap...
Ciao, Michael.
|
|
From: Roland H. <rol...@ad...> - 2006-10-27 15:23:45
|
Hi!
If you encounter a problem the raises the exception, for instance
TYPE_OR_VALUE_EXISTS, and then prints the exception info, it will come
out looking something like this:
{'info': 'street: value #0 provided more than once', 'desc': 'Type or
value exists'}
Which looks like when you print a dictionary.
So, is that how it's done?
And if so, is there a way by which I can get at the individual pieces ?
The obvious:
try:
....
except ldap.TYPE_OR_VALUE_EXISTS, e:
print e.info
doesn't work
-- Roland
|
|
From: Jim B. <jbo...@bc...> - 2006-10-26 12:12:00
|
Micheal, my apologies, I wasn't paying attention to the reply behaviour etc I intended it to be on list! That has cracked it, thanks muchly! This Python + LDAP stuff is really quite a powerful tool, and it makes me look good into the bargain ;-) Cheers Jim Michael Ströder wrote: >Jim, > >please stay on the python-ldap-dev mailing list (again Cc:-ed) with your >responses so others can comment as well! > >Jim Boone wrote: > > >>l.simple_bind(dn,oldpass) >>valid=True >>except ldap.LDAPError, e: >>valid=False >>if valid: >>print "****************valid****************" >>else: >>print "--------------- nope ----------------" >> >> > >You probably want to use the synchronous method >l.simple_bind_s(dn,oldpass). simple_bind() returns just a message ID >which you have pass to result(). > >Ciao, Michael. > > > > -- Jim Boone -------------------------------------------- Buckinghamshire Chilterns University College R&D Manager - Information and Communication Technologies Tel: 01494 522141 ext 3569 The myth that Bill Gates has appeared like a knight in shining armor to lead all customers out of a mire of technological chaos neatly ignores the fact that it was he who, by peddling second-rate technology, led them into it in the first place, and continues to do so today. ~Douglas Adams~ |
|
From: <mi...@st...> - 2006-10-26 11:46:29
|
Jim, please stay on the python-ldap-dev mailing list (again Cc:-ed) with your responses so others can comment as well! Jim Boone wrote: > l.simple_bind(dn,oldpass) > valid=True > except ldap.LDAPError, e: > valid=False > if valid: > print "****************valid****************" > else: > print "--------------- nope ----------------" You probably want to use the synchronous method l.simple_bind_s(dn,oldpass). simple_bind() returns just a message ID which you have pass to result(). Ciao, Michael. |
|
From: <mi...@st...> - 2006-10-26 11:20:11
|
Jim Boone wrote:
>
> l = ldap.initialize("ldaps://server:636",trace_level=2)
It would probably help to see the debug log since you already set the
trace level. But overwrite your passwords in there!
Ciao, Michael.
|
|
From: Jim B. <jbo...@bc...> - 2006-10-26 10:45:18
|
Hi gang,
Ok, first time I've needed to test a bind, whats wrong with it?
l = ldap.initialize("ldaps://server:636",trace_level=2)
l.protocol_version = 3
do a bind a know user, then bounce out the dn for the proper bind. Thats
all good, can thet attributes out and play with happily, I then need to
test the users credentials against ldap in order to then run an LDAP
modify on some attributes, I'm using:
try:
l.simple_bind(dn,oldpass)
valid=True
except ldap.LDAPError, e:
valid=False
if valid:
print "****************valid****************"
else:
print "--------------- nope ----------------"
with the latter being my debug code obviously
It always returns valid, even though with the wrong credentials I can
see the rejection on the LDAP server. LDAP server is Netware, I have a
PERL script which runs against it which does return an 'unauthorized'
result..... Please Lord, don't make me write this in PERL!
Surely this must be straight forward and I'm missing something??
Cheers
Jim
--
Jim Boone
--------------------------------------------
Buckinghamshire Chilterns University College
R&D Manager - Information and Communication Technologies
Tel: 01494 522141 ext 3569
The myth that Bill Gates has appeared like a knight in shining armor to lead all customers out of a mire of technological chaos neatly ignores the fact that it was he who, by peddling second-rate technology, led them into it in the first place, and continues to do so today.
~Douglas Adams~
|
|
From: David L. <d...@ad...> - 2006-10-26 09:47:55
|
Jim Boon wrote:
> Dear Mod, ignore that email, i just spotted it it's in the modify
bit! Doh!
but ... it was too late! (sorry, jim)
David Leonard
(itinerant moderator)
Jim Boone wrote:
> Hi Guys, I know this is a dumb question, but I'm stuck!
>
> I have a python cgi script driven off a web form, works fine as long as
> the credentials are correct for l.simple_bind, however if the wrong
> password is entered it fatals with:
>
>
> Traceback (most recent call last): File "password.py", line 83, in
> ? l.modify_s(dn,password) File
> "/usr/lib/python2.3/site-packages/ldap/ldapobject.py", line 285,
> in modify_s self.result(msgid,all=1,timeout=self.timeout) File
> "/usr/lib/python2.3/site-packages/ldap/ldapobject.py", line 385,
> in result return self._ldap_call(self._l.result,msgid,all,timeout)
> File "/usr/lib/python2.3/site-packages/ldap/ldapobject.py", line
> 94, in _ldap_call result = func(*args,**kwargs) ldap.OTHER:
> {'info': 'NDS error: access denied (-168)', 'desc': 'Internal
> (implementation specific) error'}
>
>
> Surely it should return a failed code of some description? Obviously its
> a Netware service, but other LDAP applications don't die under these
> circumstances, so it must be crappy coding,
>
> l.simple_bind(dn,password)
>
> thats my bind line, I then carry on with some LDAP modify operations on
> that user, should this be written differently?
>
> Cheers for any input!
>
--
David Leonard d...@ad...
Ph:+61 404 844 850
|
|
From: Jim B. <jbo...@bc...> - 2006-10-25 15:20:25
|
Hi Guys, I know this is a dumb question, but I'm stuck!
I have a python cgi script driven off a web form, works fine as long as
the credentials are correct for l.simple_bind, however if the wrong
password is entered it fatals with:
Traceback (most recent call last): File "password.py", line 83, in
? l.modify_s(dn,password) File
"/usr/lib/python2.3/site-packages/ldap/ldapobject.py", line 285,
in modify_s self.result(msgid,all=1,timeout=self.timeout) File
"/usr/lib/python2.3/site-packages/ldap/ldapobject.py", line 385,
in result return self._ldap_call(self._l.result,msgid,all,timeout)
File "/usr/lib/python2.3/site-packages/ldap/ldapobject.py", line
94, in _ldap_call result = func(*args,**kwargs) ldap.OTHER:
{'info': 'NDS error: access denied (-168)', 'desc': 'Internal
(implementation specific) error'}
Surely it should return a failed code of some description? Obviously its
a Netware service, but other LDAP applications don't die under these
circumstances, so it must be crappy coding,
l.simple_bind(dn,password)
thats my bind line, I then carry on with some LDAP modify operations on
that user, should this be written differently?
Cheers for any input!
Jim
|
|
From: <mi...@st...> - 2006-10-18 09:41:20
|
gee...@ut... wrote: > > Is it possible to enforce the sslv2 protocol to be used in the ssl > connection ? > (In this case it also works with openssl....) These fairly new TLS options of the OpenLDAP API are not supported in python-ldap yet. But for security reasons you really should avoid using SSLv2! You definitely don't want it! It's deprecated for good reasons. Maybe ask your colleagues why. ;-) Ciao, Michael. |
|
From: <gee...@ut...> - 2006-10-18 08:45:31
|
Hello,
Is it possible to enforce the sslv2 protocol to be used in the ssl=20
connection ?
(In this case it also works with openssl....)
Regards,
Geert
Michael Str=F6der <mi...@st...>
Sent by: pyt...@li...
10/17/2006 07:35 PM
=20
To: gee...@ut...
cc: pyt...@li...
Subject: Re: SSL and AD
gee...@ut... wrote:
>
> Here is the result with openssl. It also "sometimes" work...
So this is not related to python-ldap at all...
Ciao, Michael.
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job=20
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D1=
21642
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F
Python-LDAP-dev mailing list
Pyt...@li...
https://lists.sourceforge.net/lists/listinfo/python-ldap-dev
|
|
From: <mi...@st...> - 2006-10-17 17:35:58
|
gee...@ut... wrote: > > Here is the result with openssl. It also "sometimes" work... So this is not related to python-ldap at all... Ciao, Michael. |
|
From: <gee...@ut...> - 2006-10-17 16:38:14
|
Hi Michael,
Here is the result with openssl. It also "sometimes" work...
gvm@endor:~/Temp/PYSSL> openssl s=5Fclient -connect 192.168.1.5:636 -CAfile=
=20
/home/gvm/Temp/PYSSL/rootca.pem -cert /home/gvm/Temp/PYSSL/endor-crt.pem=20
-key /home/gvm/Temp/PYSSL/endor-key.pem
CONNECTED(00000003)
depth=3D1 /C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3DCAS=5FSK
verify return:1
depth=3D0 /C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3Deowyn.doom.be
verify return:1
15313:error:140790E5:SSL routines:SSL23=5FWRITE:ssl handshake=20
failure:s23=5Flib.c:188:
gvm@endor:~/Temp/PYSSL> openssl s=5Fclient -connect 192.168.1.5:636 -CAfile=
=20
/home/gvm/Temp/PYSSL/rootca.pem -cert /home/gvm/Temp/PYSSL/endor-crt.pem=20
-key /home/gvm/Temp/PYSSL/endor-key.pem
CONNECTED(00000003)
depth=3D1 /C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3DCAS=5FSK
verify return:1
depth=3D0 /C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3Deowyn.doom.be
verify return:1
15318:error:140790E5:SSL routines:SSL23=5FWRITE:ssl handshake=20
failure:s23=5Flib.c:188:
gvm@endor:~/Temp/PYSSL> openssl s=5Fclient -connect 192.168.1.5:636 -CAfile=
=20
/home/gvm/Temp/PYSSL/rootca.pem -cert /home/gvm/Temp/PYSSL/endor-crt.pem=20
-key /home/gvm/Temp/PYSSL/endor-key.pem
CONNECTED(00000003)
depth=3D1 /C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3DCAS=5FSK
verify return:1
depth=3D0 /C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3Deowyn.doom.be
verify return:1
---
Certificate chain
0 s:/C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3Deowyn.doom.be
i:/C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3DCAS=5FSK
---
Server certificate
-----BEGIN CERTIFICATE-----
MIICjDCCAfWgAwIBAgIBHDANBgkqhkiG9w0BAQUFADBUMQswCQYDVQQGEwJCRTEU
MBIGA1UEBxMLSG9vZ3N0cmF0ZW4xEDAOBgNVBAoTB0NBVHJ1c3QxDDAKBgNVBAsT
A1BLSTEPMA0GA1UEAwwGQ0FTX1NLMB4XDTA2MTAxNzEwNDk1NVoXDTA3MTAxNzEw
NDk1NVowWzELMAkGA1UEBhMCQkUxFDASBgNVBAcTC0hvb2dzdHJhdGVuMRAwDgYD
VQQKEwdDQVRydXN0MQwwCgYDVQQLEwNQS0kxFjAUBgNVBAMTDWVvd3luLmRvb20u
YmUwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAL6pGS7FO76CcZuDBOtwso5+
H1Sr/9hfDy2Cymp0gLixW1Fga5xdsO+hiV255NDiI2jQHvjP/FloThEp5UzJVwTY
lvT50APyGl1f2g/Akv8eqvK12TyOAtGwuj8SXzayyEzsWtzlN2NFnlWEKJc0qh6Q
l2UmDo/ggGxJBxxlfBkNAgMBAAGjZzBlMB8GA1UdIwQYMBaAFDhp/FYUPtJVxyCc
64ksf3y38HKIMB0GA1UdDgQWBBQ/g+qO3W1SDxsEJu86QgEzTrZAVDAOBgNVHQ8B
Af8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEwDQYJKoZIhvcNAQEFBQADgYEA
ASmsG3ltOTkUJWv5zlTSZ69sr9hSjOeSC+wqiKFI0fqmbbcMkiDdxp+olwZwE3LM
RGwg9KXU4MZjQsMbDPoySPqDvHh4LlDOeMx8SVqvfQxQa/SnOYIGtONl3CosVe81
P19ynZeq4z+QzubR4F1Is3dqYqL9zYi0k4z2F0pXixA=3D
-----END CERTIFICATE-----
subject=3D/C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3Deowyn.doom.be
issuer=3D/C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3DCAS=5FSK
---
Acceptable client certificate CA names
/C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3DCAS=5FSK
/C=3DUS/O=3DVeriSign, Inc./OU=3DClass 1 Public Primary Certification Author=
ity -=20
G2/OU=3D(c) 1998 VeriSign, Inc. - For authorized use only/OU=3DVeriSign Tru=
st=20
Network
/C=3DUS/O=3DVeriSign, Inc./OU=3DClass 4 Public Primary Certification Author=
ity -=20
G2/OU=3D(c) 1998 VeriSign, Inc. - For authorized use only/OU=3DVeriSign Tru=
st=20
Network
/C=3DZA/ST=3DWestern Cape/L=3DCape Town/O=3DThawte Consulting/OU=3DCertific=
ation=20
Services Division/CN=3DThawte Personal Freemail=20
CA/emailAddress=3Dp...@th...
/C=3DZA/ST=3DWestern Cape/L=3DCape Town/O=3DThawte Consulting/OU=3DCertific=
ation=20
Services Division/CN=3DThawte Personal Premium=20
CA/emailAddress=3Dp...@th...
/C=3DUS/O=3DFirst Data Digital Certificates Inc./CN=3DFirst Data Digital=20
Certificates Inc. Certification Authority
/C=3DZA/ST=3DWestern Cape/L=3DCape Town/O=3DThawte Consulting/OU=3DCertific=
ation=20
Services Division/CN=3DThawte Personal Basic=20
CA/emailAddress=3Dp...@th...
/C=3DUS/O=3DVeriSign, Inc./OU=3DClass 3 Public Primary Certification Author=
ity
/C=3DUS/O=3DVeriSign, Inc./OU=3DClass 2 Public Primary Certification Author=
ity
/C=3DUS/O=3DVeriSign, Inc./OU=3DClass 1 Public Primary Certification Author=
ity
/C=3DUS/O=3DVeriSign, Inc./OU=3DClass 3 Public Primary Certification Author=
ity -=20
G2/OU=3D(c) 1998 VeriSign, Inc. - For authorized use only/OU=3DVeriSign Tru=
st=20
Network
/C=3DUS/O=3DGTE Corporation/CN=3DGTE CyberTrust Root
/C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3DEOWYN CA
/C=3DUS/O=3DGTE Corporation/OU=3DGTE CyberTrust Solutions, Inc./CN=3DGTE=20
CyberTrust Global Root
/OU=3DCopyright (c) 1997 Microsoft Corp./OU=3DMicrosoft=20
Corporation/CN=3DMicrosoft Root Authority
/C=3DUS/O=3DVeriSign, Inc./OU=3DClass 2 Public Primary Certification Author=
ity -=20
G2/OU=3D(c) 1998 VeriSign, Inc. - For authorized use only/OU=3DVeriSign Tru=
st=20
Network
/C=3DUS/O=3DGTE Corporation/OU=3DGTE CyberTrust Solutions, Inc./CN=3DGTE=20
CyberTrust Root
---
SSL handshake has read 3261 bytes and written 1781 bytes
---
New, TLSv1/SSLv3, Cipher is RC4-MD5
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : RC4-MD5
Session-ID:=20
830A000079AD969762D5CA1CC27D874EADB5777B7F9AF5A191900602703F0F9B
Session-ID-ctx:
Master-Key:=20
2D17CCBF98E9610A5043C5348A5551717846756EFAE04734239A1DBA6D044788D3A34E7074E=
108CD12D1364586B2405E
Key-Arg : None
Start Time: 1161103751
Timeout : 300 (sec)
Verify return code: 0 (ok)
---
read:errno=3D0
gvm@endor:~/Temp/PYSSL>=20
Thanks,
Geert
Michael Str=F6der <mi...@st...>
Sent by: pyt...@li...
10/17/2006 06:18 PM
=20
To: gee...@ut...
cc: pyt...@li...
Subject: Re: SSL and AD
gee...@ut... wrote:
>
> Strange things are happening: It sometimes works.
Hmm, this kind of error we all like most... ;-)
> I can sometime make an
> ssl connection with client authentication,
> search for some entries,,,
Could you please verify that your connection always works on
command-line without python-ldap?
openssl s=5Fclient ...
Ciao, Michael.
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job=20
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D1=
21642
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F
Python-LDAP-dev mailing list
Pyt...@li...
https://lists.sourceforge.net/lists/listinfo/python-ldap-dev
|
|
From: <mi...@st...> - 2006-10-17 16:18:55
|
gee...@ut... wrote: > > Strange things are happening: It sometimes works. Hmm, this kind of error we all like most... ;-) > I can sometime make an > ssl connection with client authentication, > search for some entries,,, Could you please verify that your connection always works on command-line without python-ldap? openssl s_client ... Ciao, Michael. |
|
From: <gee...@ut...> - 2006-10-17 16:02:24
|
Hi All,
Strange things are happening: It sometimes works. I can sometime make an=20
ssl connection with client authentication,
search for some entries,,,
What could be the reason? some network timeout issues?
Regards,
Geert
Michael Str=F6der <mi...@st...>
Sent by: pyt...@li...
10/17/2006 03:21 PM
=20
To: gee...@ut...
cc: pyt...@li...
Subject: Re: SSL and AD
gee...@ut... wrote:
>
>=20
ldap.set=5Foption(ldap.OPT=5FX=5FTLS=5FCACERTFILE,'/home/gvm/Temp/PYSSL/roo=
tca.pem')
Does rootca.pem contain the cert of
/C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3DCAS=5FSK?
Or is there also an intermediate CA?
> ldap.set=5Foption(ldap.OPT=5FX=5FTLS=5FCERTFILE,
> '/home/gvm/Temp/PYSSL/endor-crt.pem')
>
>=20
ldap.set=5Foption(ldap.OPT=5FX=5FTLS=5FKEYFILE,'/home/gvm/Temp/PYSSL/endor-=
key.pem')
Are you sure AD is configured to allow SSL client authentication?
> lconn=3Dldap.initialize("ldaps://eowyn.doom.be/")
> lconn.simple=5Fbind=5Fs ('Adm...@do...','system')
> lconn.unbind=5Fs()
Seems ok. But I hope you know that using the UPN instead of a bind DB
with simple=5Fbind=5Fs() is proprietary feature of MS AD.
Ciao, Michael.
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job=20
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D1=
21642
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=
=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F
Python-LDAP-dev mailing list
Pyt...@li...
https://lists.sourceforge.net/lists/listinfo/python-ldap-dev
|
|
From: <gee...@ut...> - 2006-10-17 13:38:40
|
Hi,
- rootca.pem contains the self-signed root certificate
(/C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3DCAS=5FSK)
- I'm not 100% sure if the AD allows client authentication (didn't find a=20
place where=20
to configure it....) but I made a small test app based on the platform sdk
and I had to import a client key first into windows...When I didn't do=20
that, I also=20
got the server down error. So I supposed that client authentication was=20
required...
thanks and regards,
Geert
PS My test environment:
SuSE 10.1
python: 2.4.2-18
python-ldap: 2.0.11-14
Michael Str=F6der <mi...@st...>
10/17/2006 03:21 PM
=20
To: gee...@ut...
cc: pyt...@li...
Subject: Re: SSL and AD
gee...@ut... wrote:
>
>=20
ldap.set=5Foption(ldap.OPT=5FX=5FTLS=5FCACERTFILE,'/home/gvm/Temp/PYSSL/roo=
tca.pem')
Does rootca.pem contain the cert of
/C=3DBE/L=3DHoogstraten/O=3DCATrust/OU=3DPKI/CN=3DCAS=5FSK?
Or is there also an intermediate CA?
> ldap.set=5Foption(ldap.OPT=5FX=5FTLS=5FCERTFILE,
> '/home/gvm/Temp/PYSSL/endor-crt.pem')
>
>=20
ldap.set=5Foption(ldap.OPT=5FX=5FTLS=5FKEYFILE,'/home/gvm/Temp/PYSSL/endor-=
key.pem')
Are you sure AD is configured to allow SSL client authentication?
> lconn=3Dldap.initialize("ldaps://eowyn.doom.be/")
> lconn.simple=5Fbind=5Fs ('Adm...@do...','system')
> lconn.unbind=5Fs()
Seems ok. But I hope you know that using the UPN instead of a bind DB
with simple=5Fbind=5Fs() is proprietary feature of MS AD.
Ciao, Michael.
|
|
From: <mi...@st...> - 2006-10-17 13:22:12
|
gee...@ut... wrote:
>
> ldap.set_option(ldap.OPT_X_TLS_CACERTFILE,'/home/gvm/Temp/PYSSL/rootca.pem')
Does rootca.pem contain the cert of
/C=BE/L=Hoogstraten/O=CATrust/OU=PKI/CN=CAS_SK?
Or is there also an intermediate CA?
> ldap.set_option(ldap.OPT_X_TLS_CERTFILE,
> '/home/gvm/Temp/PYSSL/endor-crt.pem')
>
> ldap.set_option(ldap.OPT_X_TLS_KEYFILE,'/home/gvm/Temp/PYSSL/endor-key.pem')
Are you sure AD is configured to allow SSL client authentication?
> lconn=ldap.initialize("ldaps://eowyn.doom.be/")
> lconn.simple_bind_s ('Adm...@do...','system')
> lconn.unbind_s()
Seems ok. But I hope you know that using the UPN instead of a bind DB
with simple_bind_s() is proprietary feature of MS AD.
Ciao, Michael.
|
|
From: Ted J. <wha...@ya...> - 2006-10-04 22:43:53
|
Fixed it. This to me is outrageous, that I should have to figure this out and that the ports don't do this automatically, but what I did was copy /usr/ports/lang/python23/work/Python-2.3.5/build.shared/python to /usr/local/bin Once I did that, I could fire up the python interpreter and import ldap. I think I'm done with that project now! Thanks Xin for your help!! Ted2 Ted Johnson <wha...@ya...> wrote: My server's down!!! I don't have a spare machine to try things out on yet. I went ahead and moved all the python stuff, tried your recipe to reinstall from ports, but now when I type in "python" at the prompt it tells me no such command exists! It's not to be found in /usr/bin or /usr/local/bin. I restored everything I moved (including the aforementioned) but python still doesn't come up. Help! Ted2 LI Xin <de...@de...> wrote: Ted Johnson wrote: > I realized too late that I should have moved the /usr/bin/python binary > before building out with the command you gave me. I used your command > but still couldn't import ldap...I assume because I didn't uninstall the > old python 2.3.5 (which I don't know how to do, since it's not built > from ports, so I'll just move the binary :) Anyway, can you give me a > command which undoes everything you just had me do, and I'll try again? If I understand correctly, that would be "make deinstall clean" and then "make install clean", if it insists to use python2.3, try specifying PYTHON_VERSION=python2.4. Note that it's not the end of world if you have a installation in /usr/bin/python :-) Just do a tarball over: /usr/bin/idle* /usr/bin/python* /usr/lib/python* /usr/include/python* /usr/share/python* /usr/share/examples/python*, then remove them would make sure that you have a clean system. Note that Zope 2.7 requires Python 2.3 series IIRC. If you have a spare system, installing everything from scratch with the ports collection there before actual operation on production system would save you a lot of time. Cheers, -- Xin LI http://www.delphij.net/ FreeBSD - The Power to Serve! --------------------------------- Talk is cheap. Use Yahoo! Messenger to make PC-to-Phone calls. Great rates starting at 1¢/min.103 --------------------------------- Stay in the know. Pulse on the new Yahoo.com. Check it out. |
|
From: Ted J. <wha...@ya...> - 2006-10-04 17:52:29
|
My server's down!!! I don't have a spare machine to try things out on yet. I went ahead and moved all the python stuff, tried your recipe to reinstall from ports, but now when I type in "python" at the prompt it tells me no such command exists! It's not to be found in /usr/bin or /usr/local/bin. I restored everything I moved (including the aforementioned) but python still doesn't come up. Help! Ted2 LI Xin <de...@de...> wrote: Ted Johnson wrote: > I realized too late that I should have moved the /usr/bin/python binary > before building out with the command you gave me. I used your command > but still couldn't import ldap...I assume because I didn't uninstall the > old python 2.3.5 (which I don't know how to do, since it's not built > from ports, so I'll just move the binary :) Anyway, can you give me a > command which undoes everything you just had me do, and I'll try again? If I understand correctly, that would be "make deinstall clean" and then "make install clean", if it insists to use python2.3, try specifying PYTHON_VERSION=python2.4. Note that it's not the end of world if you have a installation in /usr/bin/python :-) Just do a tarball over: /usr/bin/idle* /usr/bin/python* /usr/lib/python* /usr/include/python* /usr/share/python* /usr/share/examples/python*, then remove them would make sure that you have a clean system. Note that Zope 2.7 requires Python 2.3 series IIRC. If you have a spare system, installing everything from scratch with the ports collection there before actual operation on production system would save you a lot of time. Cheers, -- Xin LI http://www.delphij.net/ FreeBSD - The Power to Serve! --------------------------------- Talk is cheap. Use Yahoo! Messenger to make PC-to-Phone calls. Great rates starting at 1¢/min. |
|
From: LI X. <de...@de...> - 2006-10-04 00:52:19
|
Ted Johnson wrote: > I realized too late that I should have moved the /usr/bin/python binary= > before building out with the command you gave me. I used your command > but still couldn't import ldap...I assume because I didn't uninstall th= e > old python 2.3.5 (which I don't know how to do, since it's not built > from ports, so I'll just move the binary :) Anyway, can you give me a > command which undoes everything you just had me do, and I'll try again?= If I understand correctly, that would be "make deinstall clean" and then "make install clean", if it insists to use python2.3, try specifying PYTHON_VERSION=3Dpython2.4. Note that it's not the end of world if you have a installation in /usr/bin/python :-) Just do a tarball over: /usr/bin/idle* /usr/bin/python* /usr/lib/python* /usr/include/python* /usr/share/python* /usr/share/examples/python*, then remove them would make sure that you have a clean system. Note that Zope 2.7 requires Python 2.3 series IIRC. If you have a spare system, installing everything from scratch with the ports collection there before actual operation on production system would save you a lot of time. Cheers, --=20 Xin LI <de...@de...> http://www.delphij.net/ FreeBSD - The Power to Serve! |
|
From: Ted J. <wha...@ya...> - 2006-10-03 20:01:18
|
I realized too late that I should have moved the /usr/bin/python binary before building out with the command you gave me. I used your command but still couldn't import ldap...I assume because I didn't uninstall the old python 2.3.5 (which I don't know how to do, since it's not built from ports, so I'll just move the binary :) Anyway, can you give me a command which undoes everything you just had me do, and I'll try again? TIA, Ted2 LI Xin <de...@de...> wrote: Ted Johnson wrote: > Hi; > I've successfully installed python 2.4.3 and OpenLDAPwith py-ldap2 > (thanks to help from this list). However, I realize that I should > probably stick with python 2.3.5, because my Zope instance, which serves > my Web sites and which I am not able to upgrade at this point, depends > on that vintage, and I will be using LDAP to authenticate users to my > portal. Furthermore, the py-ldap2 distro that I built from the ports in > my FreeBSD 6.1 pulled a version of that s/w that is apparently > incompatible with python 2.3.5. Therefore, I should probably d/l an old > distro (after Feb 8, 2005) of py-ldap2. But where do I find it? I've > only been able to find the latest and greatest. > TIA, > Ted 3 I think you may want to do a "make clean all deinstall install PYTHON_VERSION=python2.3" in ports/net/py-ldap2? I think that would be enough to force a python2.3 dependency for python-ldap2. Cheers, -- Xin LI http://www.delphij.net/ FreeBSD - The Power to Serve! --------------------------------- Do you Yahoo!? Everyone is raving about the all-new Yahoo! Mail. |
|
From: LI X. <de...@de...> - 2006-10-03 18:12:12
|
Ted Johnson wrote: > Hi; > I've successfully installed python 2.4.3 and OpenLDAPwith py-ldap2 > (thanks to help from this list). However, I realize that I should > probably stick with python 2.3.5, because my Zope instance, which serve= s > my Web sites and which I am not able to upgrade at this point, depends > on that vintage, and I will be using LDAP to authenticate users to my > portal. Furthermore, the py-ldap2 distro that I built from the ports in= > my FreeBSD 6.1 pulled a version of that s/w that is apparently > incompatible with python 2.3.5. Therefore, I should probably d/l an old= > distro (after Feb 8, 2005) of py-ldap2. But where do I find it? I've > only been able to find the latest and greatest. > TIA, > Ted 3 I think you may want to do a "make clean all deinstall install PYTHON_VERSION=3Dpython2.3" in ports/net/py-ldap2? I think that would be= enough to force a python2.3 dependency for python-ldap2. Cheers, --=20 Xin LI <de...@de...> http://www.delphij.net/ FreeBSD - The Power to Serve! |
|
From: Ted J. <wha...@ya...> - 2006-10-03 18:05:27
|
I thought I had written you off-list because I'd accidentally erased your response while I was working on solving my problem, but I just checked and the email never got sent! It was more involved than I thought, and by the time I got it all figured out, I'd erased your email. I had to figure out how to install a new python over the old, but the old kept getting called. It was because the python binary lived in /usr/bin and the new one in /usr/local/bin, and guess which one got called first! Anyway, everything works now. However, I'm working on getting an older distro of py-ldap2 because I've realized I will probably need to work with the older python :( Thanks, Ted3 --------------------------------- Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ countries) for 2¢/min or less. |
|
From: Ted J. <wha...@ya...> - 2006-10-03 18:00:31
|
Hi; I've successfully installed python 2.4.3 and OpenLDAPwith py-ldap2 (thanks to help from this list). However, I realize that I should probably stick with python 2.3.5, because my Zope instance, which serves my Web sites and which I am not able to upgrade at this point, depends on that vintage, and I will be using LDAP to authenticate users to my portal. Furthermore, the py-ldap2 distro that I built from the ports in my FreeBSD 6.1 pulled a version of that s/w that is apparently incompatible with python 2.3.5. Therefore, I should probably d/l an old distro (after Feb 8, 2005) of py-ldap2. But where do I find it? I've only been able to find the latest and greatest. TIA, Ted 3 __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com |
|
From: LI X. <de...@de...> - 2006-09-30 07:55:05
|
Ted Johnson wrote: > 2 >=20 > */LI Xin <de...@de...>/* wrote: >=20 > Hi, Ted, >=20 > Ted Johnson wrote: > > Hi; > > I'm on FreeBSD 6.1. I've successfully installed OpenLDAP from the= port > > (I can issue commands to the s/w at the prompt) and it appears > I've done > > the same with py-ldap2 (don't know what commands to issue, but Fr= eeBSD > > says the s/w was loaded successfully). However, when I fire up my= > Python > > interpreter and enter "import ldap" I'm told no such module exist= s. > > What could I be doing wrong? >=20 > I do use py-ldap2 on FreeBSD a lot, and I think I have did a good j= ob on > the port ;-) so I would like to help out. >=20 > Which python release do you use? >=20 > 2.3.5 >=20 > Will you please check the output of > 'pkg_info -L py24-ldap2-2.2.0' to confirm that it has installed the= > stuff into your python installation's site-packages/ directory? >=20 > Here it is, thanks for your help, and TIA for any further direction= > you can provide. > Ted >=20 > server167# pkg_info -L py24-ldap2-2.2.0 > Information for py24-ldap2-2.2.0: >=20 > Files: > /usr/local/lib/python2.4/site-packages/dsml.py > /usr/local/lib/python2.4/site-packages/dsml.pyc It seems that you have side-by-side installation of Python 2.4 and 2.3. Will you please deinstall one and re-install python-ldap, to see if it is built with python-2.3? BTW. If you do not have specific reason to use Python 2.3.x (be sure to rebuild all py23-*), I would suggest that you install 2.4 series. Cheers, --=20 Xin LI <de...@de...> http://www.delphij.net/ FreeBSD - The Power to Serve! |
627 messages has been excluded from this view by a project administrator.
