python-ldap-dev — discussion among developers

Re: self.__block.acquire(blocking) hanging Plone instance using LDAP

[Troy D. <tr...@me...>]

Hello,

Unfortunately the latest release of python-ldap did not fix the  
problem I reported last night. The server still goes unresponsive for  
10 minutes to an hour at a time randomly, it's happened eight times  
since my post last night.

Unfortunately I may not be able to troubleshoot this for much longer.  
My client is very upset with the unavailability of the Plone site  
when these problems occur, and they are considering firing my company  
and getting someone else to do the work. So if you have any  
suggestions, this is the time.

Thank You,
Troy

self.__block.acquire(blocking) hanging Plone instance using LDAP

[Troy D. <tr...@me...>]

Hello Everyone,

I've been trying to resolve a deadlock situation on a Plone instance  
that uses ldap for authentication, and thus python-ldap. The ldap  
server is on a Fedora Core 2 machine, openldap-servers-2.1.29-1 rpm.  
It has an SSL cert from GoDaddy, and LDAPUserFolder is configured to  
use SSL.

The system running Plone is Fedora Core 5, python-2.4.3-8.FC5 rpm,  
and up until tonight I had python-ldap rpm 2.0.6-5.2.1. But I'm  
hoping that upgrading to 2.2.0 will help, I downloaded and installed  
it a few minutes ago.  Plone is 2.5, zope is 2.9.4-final,  
LDAPUserFolder 2.7, LDAPMultiPlugins 1.3.

Does any of this send up red flags? Here's a traceback I got from  
zope's DeadlockDebugger:

http://rafb.net/paste/results/lHaHty24.html

I think the relevant section is here:

File "/opt/zope/instance1/Products/LDAPUserFolder/LDAPDelegate.py",  
line 189, in connect
     conn.simple_bind_s(user_dn, user_pwd)
   File "/opt/zope/instance1/Products/LDAPUserFolder/ 
SharedResource.py", line 110, in __call__
     self._lock.acquire()
   File "/usr/lib/python2.4/threading.py", line 100, in acquire
     rc = self.__block.acquire(blocking)


After doing a little research, I came across the same errors in this  
message:

http://www.dataflake.org/tracker/issue_00423

And that led me to a message from this list last year:

http://sourceforge.net/mailarchive/message.php?msg_id=11183313

So I think I've found the right place...

Hopefully I'll write in tomorrow saying that the problem is solved  
and the Plone instance is stable again. If so, I hope this message  
guides other folks that encounter this problem toward a solution.

Crossing fingers & toes,
Troy

Re: [patch] fix get_option() crash, make more OPT_X_SASL_* info available.

[Tom M. <tmc...@sd...>]

Hey, I'm retarded...  Here's the patch.

tom

> Hi, the attached patch is to fix a crash I found with py-ldap when using
> get_option() and to allow getting more OPT_X_SASL_* information with
> get_option().
>
> 1) The second to last hunk fixes a crash when using get_option() and the
> constant returns a NULL.  I can repeat this crash on FreeBSD with python
> 2.4.3 / py-ldap 2.2.0 / openldap 2.3.24 and on CentOS with python 2.3.4 /
> py-ldap 2.0.1 / openldap 2.2.13.
>
> To recreate: (without TLS_CERT defined in ldap.conf || ~/.ldaprc)
>>>> ldap.get_option(ldap.OPT_X_TLS_CERTFILE)
>
> Result:
> Segfault
>
> Backtrace:
<snip>
>
>
> 2) I wanted to be able to get a user's SASL_MECH, SASL_AUTHCID, and
> SASL_AUTHZID but that information wasn't available through py-ldap...  So
> I made it available. :)  Other than adding more SASL constants to
> Modules/options.c, I made LDAP_OPT_X_SASL_SECPROPS return Py_None with
> LDAP_get_option() because according to ldap.h it is read only.  Trying to
> get ldap.OPT_X_SASL_SECPROPS was returning ldap.SERVER_DOWN for me before
> even though I had SASL_SECPROPS defined.
>
> Please let me know if there are any questions or comments.  I don't
> actually know C...  I just kinda figured out the changes.  Thanks.
>
> tom
>
> --
> | tmclaugh at sdf.lonestar.org             tmclaugh at FreeBSD.org |
> | FreeBSD                                   http://www.FreeBSD.org |
> | BSD#                    http://www.mono-project.com/Mono:FreeBSD |


-- 
| tmclaugh at sdf.lonestar.org             tmclaugh at FreeBSD.org |
| FreeBSD                                   http://www.FreeBSD.org |
| BSD#                    http://www.mono-project.com/Mono:FreeBSD |

Re: [patch] fix get_option() crash, make more OPT_X_SASL_* info available.

[<mi...@st...>]

Tom,

thanks for contributing.

Tom McLaughlin wrote:
> Hi, the attached patch

Where's the patch?

Ciao, Michael.

[patch] fix get_option() crash, make more OPT_X_SASL_* info available.

[Tom M. <tmc...@sd...>]

Hi, the attached patch is to fix a crash I found with py-ldap when using
get_option() and to allow getting more OPT_X_SASL_* information with
get_option().

1) The second to last hunk fixes a crash when using get_option() and the
constant returns a NULL.  I can repeat this crash on FreeBSD with python
2.4.3 / py-ldap 2.2.0 / openldap 2.3.24 and on CentOS with python 2.3.4 /
py-ldap 2.0.1 / openldap 2.2.13.

To recreate: (without TLS_CERT defined in ldap.conf || ~/.ldaprc)
>>> ldap.get_option(ldap.OPT_X_TLS_CERTFILE)

Result:
Segfault

Backtrace:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x811f000 (LWP 100124)]
0x0807779a in PyString_FromString (str=0x0)
    at /usr/ports/lang/python/work/Python-2.4.3/Objects/stringobject.c:106
106             size = strlen(str);
(gdb) bt full
#0  0x0807779a in PyString_FromString (str=0x0)
    at /usr/ports/lang/python/work/Python-2.4.3/Objects/stringobject.c:106
        size = 0
        op = (PyStringObject *) 0x2838f448
#1  0x2838d68b in LDAP_get_option (self=0x0, option=0) at
Modules/options.c:237
        res = 0
        intval = 673302330
        tv = {tv_sec = 0, tv_usec = 135372032}
        apiinfo = {ldapai_info_version = 0, ldapai_api_version = 0,
  ldapai_protocol_version = 0, ldapai_extensions = 0x2838f448,
  ldapai_vendor_name = 0x81b0acc "\002", ldapai_vendor_version = 136047500}
        lcs = (LDAPControl **) 0x2821cdca
        lc = (LDAPControl *) 0x0
        strval = 0x0
        extensions = (PyObject *) 0xbfbfe3c8
        v = (PyObject *) 0x811f048
        tup = (PyObject *) 0x0
        i = 0
        num_extensions = 0
        num_controls = 0
        ld = (LDAP *) 0x0
#2  0x2838c298 in l_ldap_get_option (self=0x0, args=0x81b45ec)
    at Modules/functions.c:117
        option = 24580
#3  0x0805a7dc in PyObject_Call (func=0xffffffff, arg=0x81b45ec,
kw=0x825302c)
    at /usr/ports/lang/python/work/Python-2.4.3/Objects/abstract.c:1795
        result = (PyObject *) 0x81b45ec
        call = 0
#4  0x0809d8ee in PyEval_EvalFrame (f=0x8168e0c)
    at /usr/ports/lang/python/work/Python-2.4.3/Python/ceval.c:3843
        s = (Py_UNICODE *) 0x81beb8c
        len = 135989964
        stack_pointer = (PyObject **) 0x8168f78
        next_instr = (unsigned char *) 0x82290a2 "}\004"
        opcode = -1
        oparg = 135989964
        why = WHY_NOT
        err = 0
        x = (PyObject *) 0x825302c
        v = (PyObject *) 0x81b45ec
        w = (PyObject *) 0x81b4f80
        u = (PyObject *) 0x81beb8c
        t = (PyObject *) 0x81b0acc
        stream = (PyObject *) 0x0
        fastlocals = (PyObject **) 0x8168f58
        freevars = (PyObject **) 0x8168f6c
        retval = (PyObject *) 0x0
        tstate = (PyThreadState *) 0x8117800
        co = (PyCodeObject *) 0x81b9860
        instr_ub = -1
        instr_lb = 0
        instr_prev = -1
        first_instr = (unsigned char *) 0x8229014 "t"
        names = (PyObject *) 0x812dabc
        consts = (PyObject *) 0x816589c
#5  0x0809ff28 in PyEval_EvalCodeEx (co=0x81b9860, globals=0x0, locals=0x0,
    args=0x81b9860, argcount=2, kws=0x8186968, kwcount=0, defs=0x0,
    defcount=0, closure=0x0)
    at /usr/ports/lang/python/work/Python-2.4.3/Python/ceval.c:2739
        tmp = (PyObject *) 0xffffffff
        f = (PyFrameObject *) 0x8168e0c
        retval = (PyObject *) 0x0
        fastlocals = (PyObject **) 0x8168f58
        freevars = (PyObject **) 0x8168f6c
        tstate = (PyThreadState *) 0x8117800
        x = (PyObject *) 0x0
        u = (PyObject *) 0x81b0acc
#6  0x0809e535 in PyEval_EvalFrame (f=0x818680c)
    at /usr/ports/lang/python/work/Python-2.4.3/Python/ceval.c:3658
        a = 0
        b = 0
        res = 0
        stack_pointer = (PyObject **) 0x8186968
        next_instr = (unsigned char *) 0x81cbc23 "S"
        opcode = -1
        oparg = 136135372
        why = WHY_NOT
        err = 0
        x = (PyObject *) 0x821b2d4
        v = (PyObject *) 0x81cc9bc
        w = (PyObject *) 0x81b5c00
        u = (PyObject *) 0x2
        t = (PyObject *) 0x81d42cc
        stream = (PyObject *) 0x0
        fastlocals = (PyObject **) 0x8186958
        freevars = (PyObject **) 0x818695c
        retval = (PyObject *) 0x0
        tstate = (PyThreadState *) 0x8117800
        co = (PyCodeObject *) 0x81c4260
        instr_ub = -1
        instr_lb = 0
        instr_prev = -1
        first_instr = (unsigned char *) 0x81cbc14 "t"
        names = (PyObject *) 0x81c38ec
        consts = (PyObject *) 0x81cafcc
#7  0x0809f6fd in PyEval_EvalFrame (f=0x816ec0c)
    at /usr/ports/lang/python/work/Python-2.4.3/Python/ceval.c:3648
        retval = (PyObject *) 0xffffffec
        fastlocals = (PyObject **) 0x8186958
        i = 1
        f = (PyFrameObject *) 0x818680c
        tstate = (PyThreadState *) 0x8117800
        stack = (PyObject **) 0x0
        stack_pointer = (PyObject **) 0x816ed60
        next_instr = (unsigned char *) 0x81c7763 "Fd"
        opcode = -1
        oparg = 136651076
        why = WHY_NOT
        err = 0
        x = (PyObject *) 0x821b2d4
        v = (PyObject *) 0x818680c
        w = (PyObject *) 0x81acfb0
        u = (PyObject *) 0x8186958
        t = (PyObject *) 0x8252144
        stream = (PyObject *) 0x0
        fastlocals = (PyObject **) 0x816ed58
        freevars = (PyObject **) 0x816ed58
        retval = (PyObject *) 0x0
        tstate = (PyThreadState *) 0x8117800
        co = (PyCodeObject *) 0x81ae5e0
        instr_ub = -1
        instr_lb = 0
        instr_prev = -1
        first_instr = (unsigned char *) 0x81c7754 "e"
        names = (PyObject *) 0x81bc7fc
        consts = (PyObject *) 0x814c6ac
#8  0x0809ff28 in PyEval_EvalCodeEx (co=0x81ae5e0, globals=0x0, locals=0x0,
    args=0x81ae5e0, argcount=0, kws=0x0, kwcount=0, defs=0x0, defcount=0,
    closure=0x0)
    at /usr/ports/lang/python/work/Python-2.4.3/Python/ceval.c:2739
        tmp = (PyObject *) 0xffffffff
        f = (PyFrameObject *) 0x816ec0c
        retval = (PyObject *) 0x0
        fastlocals = (PyObject **) 0x816ed58
        freevars = (PyObject **) 0x816ed58
        tstate = (PyThreadState *) 0x8117800
        x = (PyObject *) 0x0
        u = (PyObject *) 0x0
#9  0x080a00c2 in PyEval_EvalCode (co=0x81ae5e0, globals=0x813e824,
    locals=0x813e824)
    at /usr/ports/lang/python/work/Python-2.4.3/Python/ceval.c:487
No locals.
#10 0x080b79de in run_node (n=0x81265a8, filename=0x0, globals=0x813e824,
    locals=0x813e824, flags=0xbfbfeb18)
    at /usr/ports/lang/python/work/Python-2.4.3/Python/pythonrun.c:1265
        co = (PyCodeObject *) 0x81ae5e0
        v = (PyObject *) 0x81265a8
#11 0x080b8be9 in PyRun_InteractiveOneFlags (fp=0x282faac0,
    filename=0x80d9b7c "<stdin>", flags=0xbfbfeb18)
    at /usr/ports/lang/python/work/Python-2.4.3/Python/pythonrun.c:762
        m = (PyObject *) 0x0
        d = (PyObject *) 0x0
        v = (PyObject *) 0x81b4a20
        w = (PyObject *) 0x81b4d60
        n = (node *) 0x81265a8
        err = {error = 16, filename = 0x80d9b7c "<stdin>", lineno = 0,
  offset = 0, text = 0x0, token = -1, expected = -1}
        ps1 = 0x81b4a34 ">>> "
        ps2 = 0x81265a8 "8f\022\bP\217\021\b"
#12 0x080b8d27 in PyRun_InteractiveLoopFlags (fp=0x282faac0,
    filename=0x80d9b7c "<stdin>", flags=0xbfbfeb18)
    at /usr/ports/lang/python/work/Python-2.4.3/Python/pythonrun.c:695
        v = (PyObject *) 0x81b4d60
        ret = 0
        local_flags = {cf_flags = 135422044}
#13 0x080b9235 in PyRun_AnyFileExFlags (fp=0x282faac0,
    filename=0x80d9b7c "<stdin>", closeit=0, flags=0xbfbfeb18)
    at /usr/ports/lang/python/work/Python-2.4.3/Python/pythonrun.c:658
        err = 135109500
#14 0x08055a41 in Py_Main (argc=0, argv=0xbfbfec48)
    at /usr/ports/lang/python/work/Python-2.4.3/Modules/main.c:493
        v = (PyObject *) 0x0
        c = 0
        sts = 0
        command = 0x0
        filename = 0x0
        module = 0x0
        fp = (FILE *) 0x282faac0
        p = 0x0
        inspect = 0
        unbuffered = 0
        skipfirstline = 0
        stdin_is_interactive = 1
        help = 0
        version = 0
        saw_inspect_flag = 0
        saw_unbuffered_flag = 0
        cf = {cf_flags = 0}
#15 0x0805504d in main (argc=1, argv=0xbfbfec48)
    at /usr/ports/lang/python/work/Python-2.4.3/Modules/python.c:23



2) I wanted to be able to get a user's SASL_MECH, SASL_AUTHCID, and
SASL_AUTHZID but that information wasn't available through py-ldap...  So
I made it available. :)  Other than adding more SASL constants to
Modules/options.c, I made LDAP_OPT_X_SASL_SECPROPS return Py_None with
LDAP_get_option() because according to ldap.h it is read only.  Trying to
get ldap.OPT_X_SASL_SECPROPS was returning ldap.SERVER_DOWN for me before
even though I had SASL_SECPROPS defined.

Please let me know if there are any questions or comments.  I don't
actually know C...  I just kinda figured out the changes.  Thanks.

tom

-- 
| tmclaugh at sdf.lonestar.org             tmclaugh at FreeBSD.org |
| FreeBSD                                   http://www.FreeBSD.org |
| BSD#                    http://www.mono-project.com/Mono:FreeBSD |

Installing on Windows

[Bradley S. H. <hi...@cs...>]

The installer for Windows wants to install python-ldap into the python
in the registry, but I want to install it for a version of python that
is in a zope installation. Unfortunately, the installer doesn't want to
let me enter a python directory or installation directory. Is there a work
around?

Brad

Re: Mac OS X Binary Download

[Bob I. <bo...@re...>]

On Jul 20, 2006, at 4:34 PM, bra...@om... wrote:

> Ben Gollmer wrote on 06/28/2006 05:23:04 PM:
>
>> FYI,
>>
>> I've built a universal binary (PPC & Intel) package for python-ldap.
>> This is a standard Mac OS X installer which does not require
>> DarwinPorts or Fink. It's hosted at Bob Ippolito's PythonMac packages
>> site: http://pythonmac.org/packages/py24-fat/python_ldap-2.2.0-py2.4-
>> macosx10.4.zip. It'd be nice to add that link to the Downloads page.
>
> The link for this appears to be currently broken...if you browse
> http://pythonmac.org/packages/py24-fat/ and click the link for
> python_ldap-2.2.0-py2.4-macosx10.4.zip you get a broken URL:

fixed now, it was missing the "mpkg/" part

> http://pythonmac.org/packages/py24-fat/dmg/wxPython2.6-osx- 
> unicode-2.6.3.3-universal10.4-py2.4.dmg

It definitely wasn't set to that, nor was that URL broken...

-bob

Re: Mac OS X Binary Download

[<bra...@om...>]

Ben Gollmer wrote on 06/28/2006 05:23:04 PM:

> FYI,
> 
> I've built a universal binary (PPC & Intel) package for python-ldap. 
> This is a standard Mac OS X installer which does not require 
> DarwinPorts or Fink. It's hosted at Bob Ippolito's PythonMac packages 
> site: http://pythonmac.org/packages/py24-fat/python_ldap-2.2.0-py2.4- 
> macosx10.4.zip. It'd be nice to add that link to the Downloads page.

The link for this appears to be currently broken...if you browse
http://pythonmac.org/packages/py24-fat/ and click the link for
python_ldap-2.2.0-py2.4-macosx10.4.zip you get a broken URL:

http://pythonmac.org/packages/py24-fat/dmg/wxPython2.6-osx-unicode-2.6.3.3-universal10.4-py2.4.dmg

Re: _ldap.so: undefined symbol: ber_flatten2

[<mi...@st...>]

Michele Marcionelli wrote:
> 
>     OpenLDAP 2.0.27
>     python-ldap-2.0.11
> [..]
> ImportError: /usr/local/lib/python2.3/site-packages/_ldap.so:  undefined
> symbol: ber_flatten2
> [..]
> What is wrong? It sould also be possible to use OpenLDAP 2.0 (not  only
> 2.1)?

Hmm, python-ldap 2.0.11 was supposed to work with OpenLDAP 2.0.x but
adding a user-contributed patch for LDAPv3 controls used function
ber_flatten2(). Obviously this change was not available in the 2.0.11
release yet:

http://python-ldap.cvs.sourceforge.net/python-ldap/python-ldap/Modules/ldapcontrol.c?r1=1.3&r2=1.4

Well, since OpenLDAP 2.0.27's libldap is really ancient and very buggy
compared to today's versions I'm not keen on supporting this OpenLDAP
version anymore. It's really time to upgrade now.

Ciao, Michael.

_ldap.so: undefined symbol: ber_flatten2

[Michele M. <mic...@ma...>]

** with attachments **

Hello,

	Python 2.3.5
	OpenLDAP 2.0.27
	python-ldap-2.0.11

I can build (with some warnings - see attachment) and install python- 
ldap but when I try to "import ldap" I get the following error message:

Traceback (most recent call last):
   File "<stdin>", line 1, in ?
   File "/usr/local/lib/python2.3/site-packages/ldap/__init__.py",  
line 23, in ?
     from _ldap import *
ImportError: /usr/local/lib/python2.3/site-packages/_ldap.so:  
undefined symbol: ber_flatten2

What is wrong? It sould also be possible to use OpenLDAP 2.0 (not  
only 2.1)?

Help needed ;-)
Regards,
Michele

_ldap.so: undefined symbol: ber_flatten2

[Michele M. <mic...@ma...>]

Hello,

	Python 2.3.5
	OpenLDAP 2.0.27
	python-ldap-2.0.11

I can build (with some warnings - see attachment) and install python-=20
ldap but when I try to "import ldap" I get the following error message:

Traceback (most recent call last):
   File "<stdin>", line 1, in ?
   File "/usr/local/lib/python2.3/site-packages/ldap/__init__.py", =20
line 23, in ?
     from _ldap import *
ImportError: /usr/local/lib/python2.3/site-packages/_ldap.so: =20
undefined symbol: ber_flatten2

What is wrong? It sould also be possible to use OpenLDAP 2.0 (not =20
only 2.1)?

Help needed ;-)
Regards,
Michele

--
ETH Z=FCrich
Michele Marcionelli
IT Support Gruppe D-MATH
HG G 18
R=E4mistrasse 101
CH=968092 Z=FCrich

mic...@ma...
http://www.math.ethz.ch/~michele

+41 44 632 6193 Telefon
+41 44 632 1404 Fax

compiling with kubuntu

[Raphael P. <rap...@rz...>]

Hi,

I'm desperatly trying to compile python-ldap-2.2.0 on kubuntu 6.06 with 
python-2.3.5.
OpenLDAP, OpenSSL and SASL are installed.
I get the error:

Modules/errors.c:24 error: size of array 'errobjects' is negative
error: command 'gcc' failed with exit status 1

excerpt of my setup.cfg:
library_dirs = /usr/lib /usr/lib/sasl2
include_dirs = /usr/include/sasl

libs = ldap lber resolv
I tried also:
libs = ldap_r lber sasl2 ssl crypto

any hints as how to get it working?

Thanks,
Raphael

Re: Mac OS X Binary Download

[Ben G. <be...@ja...>]

On Jul 15, 2006, at 4:54 PM, Michael Str=F6der wrote:
> The problem is that you are posting the URL with a space. But even =20
> if I
> omit the space I can't figure out what's the right URL.

Sorry, it must be my mailer wrapping the URL.

> Maybe the URL on http://pythonmac.org/packages/py24-fat/ is also =20
> wrong?

It is correct - at least it worked when I initially sent the package =20
there, although now the file seems to have been moved. I'll check =20
with the maintainer of that server and see what happened.


--=20
Ben

Re: Mac OS X Binary Download

[<mi...@st...>]

Ben Gollmer wrote:
> On Jul 2, 2006, at 4:11 AM, Michael Str=F6der wrote:
>=20
>> Ben Gollmer wrote:
>>
>>>
>>> I've built a universal binary (PPC & Intel) package for python-ldap.
>>> This is a standard Mac OS X installer which does not require
>>> DarwinPorts or Fink. It's hosted at Bob Ippolito's PythonMac packages
>>> site: http://pythonmac.org/packages/py24-fat/python_ldap-2.2.0-py2.4-
>>> macosx10.4.zip. It'd be nice to add that link to the Downloads page.
>>
>>
>> Ben, thanks for contributing. I've added a link on the download page.
>=20
>=20
> Thanks! Unfortunately the link on that page is broken. The correct  URL
> is as follows:
>=20
> http://pythonmac.org/packages/py24-fat/python_ldap-2.2.0-py2.4-
> macosx10.4.zip

The problem is that you are posting the URL with a space. But even if I
omit the space I can't figure out what's the right URL.

Maybe the URL on http://pythonmac.org/packages/py24-fat/ is also wrong?

$ wget "http://pythonmac.org/packages/py24-fat/python_ldap-2.2.0-py2.4-
macosx10.4.zip"
--23:50:55--
http://pythonmac.org/packages/py24-fat/python_ldap-2.2.0-py2.4-%20macosx1=
0.4.zip
           =3D> `python_ldap-2.2.0-py2.4- macosx10.4.zip'
Resolving pythonmac.org... 66.33.220.150
Connecting to pythonmac.org|66.33.220.150|:80... connected.
HTTP request sent, awaiting response... 404 Not Found
23:50:56 ERROR 404: Not Found.

$ wget
"http://pythonmac.org/packages/py24-fat/python_ldap-2.2.0-py2.4-macosx10.=
4.zip"
--23:51:00--
http://pythonmac.org/packages/py24-fat/python_ldap-2.2.0-py2.4-macosx10.4=
.zip
           =3D> `python_ldap-2.2.0-py2.4-macosx10.4.zip'
Resolving pythonmac.org... 66.33.220.150
Connecting to pythonmac.org|66.33.220.150|:80... connected.
HTTP request sent, awaiting response... 404 Not Found
23:51:00 ERROR 404: Not Found.

Ciao, Michael.

Re: Mac OS X Binary Download

[Ben G. <be...@ja...>]

On Jul 2, 2006, at 4:11 AM, Michael Str=F6der wrote:

> Ben Gollmer wrote:
>>
>> I've built a universal binary (PPC & Intel) package for python-ldap.
>> This is a standard Mac OS X installer which does not require
>> DarwinPorts or Fink. It's hosted at Bob Ippolito's PythonMac packages
>> site: http://pythonmac.org/packages/py24-fat/python_ldap-2.2.0-py2.4-
>> macosx10.4.zip. It'd be nice to add that link to the Downloads page.
>
> Ben, thanks for contributing. I've added a link on the download page.

Thanks! Unfortunately the link on that page is broken. The correct =20
URL is as follows:

http://pythonmac.org/packages/py24-fat/python_ldap-2.2.0-py2.4-=20
macosx10.4.zip


Cheers,
--=20
Ben

Re: huge among of time to bind

[<mi...@st...>]

Cedric Briner wrote:
> 
> I've done a strace -f of my applications
> and I've seen that the application was spending a lot of time
> reading/analysing the /etc/ssl/certs files.
> so I've remove all the files in /etc/ssl/certs/ except the one I use.

That's an OpenSSL issue. You have to create hash symlinks to the CA
certs. See OpenSSL docs.

Ciao, Michael.

Re: huge among of time to bind

[<mi...@st...>]

Cedric Briner wrote:
> debian/etch

This does not mean anything to me.
Please always provide version numbers of python-ldap and OpenLDAP libs.

> It takes about 45 seconds to bind to an ldap server using this code.

I suspect something related to DNS timeouts due to misconfiguration.

Ciao, Michael.

huge among of time to bind

[Cedric B. <bri...@gm...>]

debian/etch
model name      : Intel(R) Pentium(R) 4 CPU 2.40GHz


hello,

It takes about 45 seconds to bind to an ldap server using this code.
``top'' shows that in works a 100 % percent of its capacities during
this 45 sec. I also checked the network usage without seeing any big
transfer of data (using the gnome applet to watch the resources)

Am I doing something wrong in this code ???

code
------
import ldap
ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_ALLOW)
ldap.set_option(ldap.OPT_X_TLS_CACERTDIR,'/etc/ssl/certs/')
l = ldap.initialize('ldaps://newpeople.unige.ch:636')
username='cn=observatoire agent,ou=observatoire,ou=Applications,dc=unige,dc=ch'
password  = "not_copied"

# this is the line which takes 45 secs ?
l.bind_s(username,password,ldap.AUTH_SIMPLE)


thx in advance for any hints .

Ced.

Re: Mac OS X Binary Download

[<mi...@st...>]

bra...@om... wrote:
> 
> Hm...without SASL is there any other way to perform secure LDAP
> authentication using Python-ldap?

You could use simple bind (with clear-text password) over SSL/TLS.

> My goal is to find a way in Python to securely authenticate against
> an Active Directory.

SASL/GSSAPI

you need to compile python-ldap with SASL support off course.

> It would be even better if the
> script could obtain a Kerberos ticket, so the ticket could be passed
> to a server app for inspection.

kinit is called by the user before using your application (to achieve
SSO). On Windows that's another story. Maybe you're better off using
win32all with ADSI there.

Ciao, Michael.

Re: Mac OS X Binary Download

[<bra...@om...>]

Ben Gollmer <be...@ja...> wrote on 07/01/2006 02:31:03 PM:

> On Jul 1, 2006, at 9:56 AM, bra...@om... wrote:
> 
> > Thanks! Do you also have one for the Python 2.3.5 that comes 
> > bundled with
> > Mac OS X?
> 
> Not ATM, although I could whip one up if you like. Also note that 
> these packages are built on "stock" 10.4, so they don't have SASL 
> enabled (Apple doesn't ship SASL libs or headers with their developer 
> tools).

Hm...without SASL is there any other way to perform secure LDAP
authentication using Python-ldap?

My goal is to find a way in Python to securely authenticate against
an Active Directory. The user will enter their username/password into a
PythonCard GUI and then Python will try that username and password
against the Active Directory.  It would be even better if the
script could obtain a Kerberos ticket, so the ticket could be passed
to a server app for inspection. That way, the server app could trust
that the client is who it claims to be.  However, Kerberos programming
is a bit above my head right now, so for now secure LDAP authentication
would be nice. If anyone on this list is interested in a consulting
gig to help me figure this out, please contact me off-list.

Re: problem binding to AD with known-good credentials

[<mi...@st...>]

jacob martinson wrote:
> 
> I created a user in AD with search rights and am able to do a simple
> bind with the java-based "LDAP Browser" and search/browse the
> directory with those credentials.
> 
> When I try to do a simple bind to the directory with python-ldap I
> don't get an exception, but when I try to perform the search, I get an
> exception indicating I didn't bind successfully:

I guess something's wrong in your code.

> ldap.OPERATIONS_ERROR: {'info': '00000000: LdapErr: DSID-0C090627,
> comment: In order to perform this operation a successful bind must be
> completed on the connection., data 0, vece', 'desc': 'Operations
> error'}

I suspect you're really doing a search before an appropriate bind.

> I am attaching the script that generated this exception.  Am I missing
> something?

I'm not going to debug your code especially since it's an incomplete
excerpt. Just some hints:

> def search_ad(email,password=''):

Where is password used?

>         # Connect to ldap server, retrieve the CN tied to the given email addr
>         try:
>                 l = ldap.open(ldapconf.host)

You should use ldap.initialize(). Look into arguments trace_level and
trace_file. (Hmm, docs needs update in this regard.)

The output could help you finding the error in sequence and arguments of
the LDAP requests you send. Beware: It outputs passwords!

>                 l.simple_bind_s(ldapconf.ldap_user,ldapconf.ldap_pass)

Obviously ldapconf.ldap_pass is not argument password above.

Another hint: The universal principal name is not always the RFC 822
e-mail address of a user. This depends on your AD / Exchange installation.

>         ldap_result_id = l.search(ldapconf.base_dn,
ldap.SCOPE_SUBTREE, ldapconf.filter, ['cn'])
>         result_set = []
>         while 1:
>                 result_type, result_data = l.result(ldap_result_id, 0)
>                 if (result_data == []):
>                         break
>                 else:
>                         if result_type == ldap.RES_SEARCH_ENTRY:
>                                 result_set.append(result_data)
>         print result_set

Style: Any reason why you don't use the simple l.search_s() method call?
I wouldn't expect many results. I don't know your LDAP search filter though.

Ciao, Michael.

Re: Mac OS X Binary Download

[<mi...@st...>]

Ben Gollmer wrote:
> 
> I've built a universal binary (PPC & Intel) package for python-ldap. 
> This is a standard Mac OS X installer which does not require 
> DarwinPorts or Fink. It's hosted at Bob Ippolito's PythonMac packages 
> site: http://pythonmac.org/packages/py24-fat/python_ldap-2.2.0-py2.4-
> macosx10.4.zip. It'd be nice to add that link to the Downloads page.

Ben, thanks for contributing. I've added a link on the download page.

Ciao, Michael

Re: Mac OS X Binary Download

[Ben G. <be...@ja...>]

On Jul 1, 2006, at 9:56 AM, bra...@om... wrote:

> Thanks! Do you also have one for the Python 2.3.5 that comes  
> bundled with
> Mac OS X?

Not ATM, although I could whip one up if you like. Also note that  
these packages are built on "stock" 10.4, so they don't have SASL  
enabled (Apple doesn't ship SASL libs or headers with their developer  
tools).

-- 
Ben

Re: Mac OS X Binary Download

[<bra...@om...>]

Thanks! Do you also have one for the Python 2.3.5 that comes bundled with
Mac OS X?

Ben Gollmer wrote on 06/28/2006 05:23:04 PM:

> FYI,
> 
> I've built a universal binary (PPC & Intel) package for python-ldap. 
> This is a standard Mac OS X installer which does not require 
> DarwinPorts or Fink. It's hosted at Bob Ippolito's PythonMac packages 
> site: http://pythonmac.org/packages/py24-fat/python_ldap-2.2.0-py2.4- 
> macosx10.4.zip. It'd be nice to add that link to the Downloads page.
> 
> Cheers,
> -- 
> Ben
> 

Mac OS X Binary Download

[Ben G. <be...@ja...>]

FYI,

I've built a universal binary (PPC & Intel) package for python-ldap.  
This is a standard Mac OS X installer which does not require  
DarwinPorts or Fink. It's hosted at Bob Ippolito's PythonMac packages  
site: http://pythonmac.org/packages/py24-fat/python_ldap-2.2.0-py2.4- 
macosx10.4.zip. It'd be nice to add that link to the Downloads page.

Cheers,
-- 
Ben