python-ldap-dev — discussion among developers

Re: Question: Mac OS 10.6 and Python 2.6

[Torsten K. <pyt...@tk...>]

Hi John,

> I was wondering if anyone has been successful building
> packages for python-ldap for Mac OS X 10.6 and Python 2.6.

a bit outdated, but you might have a look at

http://svn.iwm-kmrc.de/download/distribution/contrib/python_ldap-2.3.9-py2.6-macosx-10.3-fat.egg

This .egg was built on OS X 10.5 and should work on any version (and
platform) from 10.3 through 10.6.

Exactly What kind of problem are you encountering while trying to
build on 10.6?
Did you install the latest XCode? Did you change the include- and
library-paths in python-ldap's setup.cfg according to your setup?

Best regards,
Torsten
-- 
  The scene is dull. Tell him to put more life into his dying.
  -Samuel Goldwyn

Question: Mac OS 10.6 and Python 2.6

[John C. <jt...@gm...>]

I was wondering if anyone has been successful building packages for
python-ldap for Mac OS X 10.6 and Python 2.6.

Thanks,
John

Docs updated for 2.3.11

[Michael S. <mi...@st...>]

HI!

Slightly updated python-ldap docs are now available on:

http://www.python-ldap.org/docs.shtml

Ciao, Michael.

Re: python_ldap 2.3.11 broken on pypi

[Michael S. <mi...@st...>]

Tobias Schmidt wrote:
> could it be that the latest release of python_ldap (2.3.11) is broken on 
> pypi? It didn't work inside my buildout and I could not open the archive 
> after downloading it manually.
> 
> Error message:
> 
> gzip: stdin: unexpected end of file
> tar: Child returned status 1
> tar: Error exit delayed from previous errors

Should be fixed now. Thanks for your quick report.

Ciao, Michael.

python_ldap 2.3.11 broken on pypi

[Tobias S. <tob...@ub...>]

Hi,

could it be that the latest release of python_ldap (2.3.11) is broken on 
pypi? It didn't work inside my buildout and I could not open the archive 
after downloading it manually.

Error message:

gzip: stdin: unexpected end of file
tar: Child returned status 1
tar: Error exit delayed from previous errors

Best regards
Tobias

ANN: python-ldap-2.3.11

[Michael S. <mi...@st...>]

Find a new release of python-ldap:

  http://www.python-ldap.org/

python-ldap provides an object-oriented API to access LDAP directory
servers from Python programs. It mainly wraps the OpenLDAP 2.x libs for
that purpose. Additionally it contains modules for other LDAP-related
stuff (e.g. processing LDIF, LDAPURLs and LDAPv3 schema).

Ciao, Michael.

-- 
Michael Ströder
E-Mail: mi...@st...
http://www.stroeder.com

----------------------------------------------------------------
Released 2.3.11 2010-02-26

Changes since 2.3.10:

Lib/
* Fixed LDAP URL parsing with four ? but no real extensions
* ldap.ldapobject.LDAPObject.rename_s() now also accepts arguments
  serverctrls and clientctrls
* Removed untested and undocumented class ldap.ldapobject.SmartLDAPObject
* Removed broken method ldap.ldapobject.LDAPObject.manage_dsa_it()

Modules/
* Make use of LDAP_OPT_X_TLS_NEWCTX only if available in
  OpenLDAP libs used for the build
* Fixed #ifdef-statements for OPT_X_TLS_PROTOCOL_MIN

Doc/
* Some updates and corrections regarding description of use of
  LDAPv3 controls
* Some more descriptions for constants
* Removed comments related to old LaTeX-based documentation system

Re: Anyone using LDAPObject.manage_dsa_it()?

[Michael S. <mi...@st...>]

Michael Ströder wrote:
> For some time there has been a warning in the docs about
> LDAPObject.manage_dsa_it() soon vanishing from python-ldap once full support
> for LDAPv3 controls is implemented. Since we have that for quite some time now
> this inherently broken method should be removed.
> 
> Anyone still using it? If yes, then raise your voice now or I'll remove it
> from upcoming python-ldap 2.3.11.

No answer so far.
=> I removed it in CVS HEAD and will release it like this in 2.3.11.

Ciao, Michael.

Re: ldap.ldapobject.SmartLDAPObject removed

[Andreas B. <bue...@un...>]

Hi Michael,

Am Freitag 05 Februar 2010 13:34:32 schrieb Michael Ströder:
> Michael Ströder wrote:
> > Well, SmartLDAPObject is not well tested nor documented and should
> > probably be removed anyway...
> > [..]
> > Well, tls_cacertfile is simply not used in SmartLDAPObject.__init__().
> > The reason is that OpenLDAP libs 2.3 were not able to set
> > connection-specific SSL options. It should work with OpenLDAP 2.4 under
> > some circumstances but I never got it working.
> >
> > => please either don't use SmartLDAPObject or contribute fixes for it
> > Personally I'd vote for removing it.
>
> In CVS HEAD I've removed the untested and undocumented wrapper class
> ldap.ldapobject.SmartLDAPObject completely. Upcoming release 2.3.11 will
> not contain it anymore. It never worked robustly like intended and it's not
> worth the effort to fix it.

Thanx for the information. We will replace in SmartLDAPObject in one of our 
next releases of the software.

best regards
Andreas

-- 
Andreas Büsching
Open Source Software Engineer

Univention GmbH
Linux for your business
Mary-Somerville-Str.1
28359 Bremen
Tel. : +49 421 22232-0
Fax : +49 421 22232-99

<bue...@un...>
http://www.univention.de

Geschäftsführer: Peter H. Ganten
HRB 20755 Amtsgericht Bremen
Steuer-Nr.: 71-597-02876

**** Besuchen Sie uns auf der KOMCOM NORD in Hannover 
vom 9.-10.02.2010 in der Eilenriedehalle, Stand H 03 ****

Anyone using LDAPObject.manage_dsa_it()?

[Michael S. <mi...@st...>]

HI!

For some time there has been a warning in the docs about
LDAPObject.manage_dsa_it() soon vanishing from python-ldap once full support
for LDAPv3 controls is implemented. Since we have that for quite some time now
this inherently broken method should be removed.

Anyone still using it? If yes, then raise your voice now or I'll remove it
from upcoming python-ldap 2.3.11.

Ciao, Michael.

ldap.ldapobject.SmartLDAPObject removed

[Michael S. <mi...@st...>]

Michael Ströder wrote:
> Well, SmartLDAPObject is not well tested nor documented and should probably be
> removed anyway...
> [..]
> Well, tls_cacertfile is simply not used in SmartLDAPObject.__init__(). The
> reason is that OpenLDAP libs 2.3 were not able to set connection-specific SSL
> options. It should work with OpenLDAP 2.4 under some circumstances but I never
> got it working.
> 
> => please either don't use SmartLDAPObject or contribute fixes for it
> Personally I'd vote for removing it.

In CVS HEAD I've removed the untested and undocumented wrapper class
ldap.ldapobject.SmartLDAPObject completely. Upcoming release 2.3.11 will not
contain it anymore. It never worked robustly like intended and it's not worth
the effort to fix it.

Ciao, Michael.

Re: start_tls = 2 is ignored with LDAP URIs starting with LDAP://

[Michael S. <mi...@st...>]

Andreas,

sorry for my late reply. I'm quite busy at the moment.

Andreas Büsching wrote:
> I've found a strange behaviour of python-ldap when working with TLS encrypted 
> connections. I'm not sure if this is a problem of the python bindings or of 
> libldap or in my head ;-)
> 
> In my first scenario I was trying to set up a TLS encrypted connection with a 
> specific CA certificate that was set in the ldap.conf file (TLS_CACERT).
> 
>>>> import ldap
>>>> l = 
> ldap.ldapobject.SmartLDAPObject(uri='LDAP://qamaster.windom2008.univention.test:389', 
> who='uid=Administrator,cn=users,DC=windom2008,DC=univention,DC=test',cred='univention', 
> start_tls=2, tls_cacertfile='/etc/univention/ssl/ucsCA/CAcert.pem')
>>>> l.started_tls
> 0
> 
> In that case the connection is not encrypted. When I replace LDAP:// with 
> ldap:// in the URI the connection is encrypted.

Well, that's because of the stupid handling in SmartLDAPObject.__init__().
Line 900 should check the lower-cased uri:

    if start_tls>0 and uri[:5].lower()=='ldap:':

Well, SmartLDAPObject is not well tested nor documented and should probably be
removed anyway...

> In the second scenario I've tried to set up a TLS encrypted connection with a 
> CA certificate that was not set in the ldap.conf file.
> 
>>>> l = 
> ldap.ldapobject.SmartLDAPObject(uri='ldap://win-64q6lq48z7a.windom2008.univention.test:389', 
> who='cn=Administrator,cn=users,DC=windom2008,DC=univention,DC=test',cred='univention', 
> start_tls=2, 
> tls_cacertfile='/etc/univention/connector/ad/ad_cert_20091221_153053.pem')
> ...
> ldap.CONNECT_ERROR: {'info': 'error:14090086:SSL 
> routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify 
> failed', 'desc': 'Connect error'}

Well, tls_cacertfile is simply not used in SmartLDAPObject.__init__(). The
reason is that OpenLDAP libs 2.3 were not able to set connection-specific SSL
options. It should work with OpenLDAP 2.4 under some circumstances but I never
got it working.

=> please either don't use SmartLDAPObject or contribute fixes for it
Personally I'd vote for removing it.

Ciao, Michael.

Re: start_tls = 2 is ignored with LDAP URIs starting with LDAP://

[Andreas B. <bue...@un...>]

Hi,

Has anyone an idea?

thanx in advance
Andreas

Am Freitag 08 Januar 2010 09:39:40 schrieb Andreas Büsching:
> I've found a strange behaviour of python-ldap when working with TLS
> encrypted connections. I'm not sure if this is a problem of the python
> bindings or of libldap or in my head ;-)
>
> In my first scenario I was trying to set up a TLS encrypted connection with
> a specific CA certificate that was set in the ldap.conf file (TLS_CACERT).
>
> >>> import ldap
> >>> l =
>
> ldap.ldapobject.SmartLDAPObject(uri='LDAP://qamaster.windom2008.univention.
>test:389',
> who='uid=Administrator,cn=users,DC=windom2008,DC=univention,DC=test',cred='
>univention', start_tls=2,
> tls_cacertfile='/etc/univention/ssl/ucsCA/CAcert.pem')
>
> >>> l.started_tls
>
> 0
>
> In that case the connection is not encrypted. When I replace LDAP:// with
> ldap:// in the URI the connection is encrypted.
>
> >>> l =
>
> ldap.ldapobject.SmartLDAPObject(uri='ldap://qamaster.windom2008.univention.
>test:389',
> who='uid=Administrator,cn=users,DC=windom2008,DC=univention,DC=test',cred='
>univention', start_tls=2,
> tls_cacertfile='/etc/univention/ssl/ucsCA/CAcert.pem')
>
> >>> l.started_tls
>
> 1
>
> It look likes a TLS connection is not set up if the URI starts with LDAP://
>
> In the second scenario I've tried to set up a TLS encrypted connection with
> a CA certificate that was not set in the ldap.conf file.
>
> >>> l =
>
> ldap.ldapobject.SmartLDAPObject(uri='ldap://win-64q6lq48z7a.windom2008.univ
>ention.test:389',
> who='cn=Administrator,cn=users,DC=windom2008,DC=univention,DC=test',cred='u
>nivention', start_tls=2,
> tls_cacertfile='/etc/univention/connector/ad/ad_cert_20091221_153053.pem')
> ...
> ldap.CONNECT_ERROR: {'info': 'error:14090086:SSL
> routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify
> failed', 'desc': 'Connect error'}
>
> It seems that the argument tls_cacertfile is ignored, because if I set the
> CA certificate file with the set_option function the connection works and
> is encrypted.
>
> ldap.set_option(
> ldap.OPT_X_TLS_CACERTFILE,
> '/etc/univention/connector/ad/ad_cert_20091221_153053.pem' ) l =
> ldap.ldapobject.SmartLDAPObject(uri='ldap://win-64q6lq48z7a.windom2008.univ
>ention.test:389',
> who='cn=Administrator,cn=users,DC=windom2008,DC=univention,DC=test',cred='u
>nivention', start_tls=2 )
>
> >>> l.started_tls
>
> 1
>
> software versions:
>
> python 2.4.6
> libldap 2.4.15
> python-ldap 2.3.5
>
> Is there any mistake in my reasoning or is this a known behaviour?
>
> best regards
> Andreas


-- 
Andreas Büsching
Open Source Software Engineer

Univention GmbH
Linux for your business
Mary-Somerville-Str.1
28359 Bremen
Tel. : +49 421 22232-0
Fax : +49 421 22232-99

<bue...@un...>
http://www.univention.de

Geschäftsführer: Peter H. Ganten
HRB 20755 Amtsgericht Bremen
Steuer-Nr.: 71-597-02876

**** Besuchen Sie uns auf der KOMCOM NORD in Hannover 
vom 9.-10.02.2010 in der Eilenriedehalle, Stand H 03 ****

Re: ldaps and Active Directory

[Michael S. <mi...@st...>]

Patrick A. Treptau wrote:
> I am pulling my hair out trying to connect via ldaps to one of our AD 
> controllers.
> 
> host = "ldaps://ad_host:636"

You should always use the fully-qualified which is in the CN of the server
certificate's subject DN.

> #openssl s_client -CAfile path/to/cert.crt -connect ad_host:636 returns 
> a successful connection

With -verify?

Ciao, Michael.

ldaps and Active Directory

[Patrick A. T. <ptr...@sw...>]

I am pulling my hair out trying to connect via ldaps to one of our AD 
controllers.

Everything works just fine with ldap:389, but as soon as I try to use 
ldaps:636, I get this:

ldap.SERVER_DOWN: {'info': '(unknown error code)', 'desc': "Can't 
contact LDAP server"}

My code is exactly as in "Demo/initialize.py":

import sys
import ldap
ldap.set_option(ldap.OPT_REFERRALS, 0)
ldap.set_option(ldap.OPT_DEBUG_LEVEL,0)
ldapmodule_trace_level = 1
ldapmodule_trace_file = sys.stderr
host = "ldaps://ad_host:636"
con = 
ldap.initialize(host,trace_level=ldapmodule_trace_level,trace_file=ldapmodule_trace_file)
con.set_option(ldap.OPT_PROTOCOL_VERSION, 3)
con.set_option(ldap.OPT_X_TLS_REQUIRE_CERT,ldap.OPT_X_TLS_DEMAND)
con.set_option(ldap.OPT_X_TLS_CACERTFILE, 'path/to/cert.crt')
con.set_option(ldap.OPT_DEBUG_LEVEL, 255)
con.bind_s(full_dn, pass)

#openssl s_client -CAfile path/to/cert.crt -connect ad_host:636 returns 
a successful connection and I am also able to connect with other ldap 
clients (jxplorer) with SSL and the same CA cert.

What am I missing?

Thank you,
Patrick

Re: How can i add a booleanMatch type attribute

[Zhang H. <zhb...@gm...>]

On Jan 31, 2010, at 10:58 PM, Michael Ströder wrote:

> Zhang Huangbin wrote:
>> How can i add a booleanMatch type attribute with py-ldap?
> 
> Simply like any other attribute provided your attribute value is TRUE or FALSE.

Successed with modlist:

('amavisLocal', ['TRUE']),

Thanks :)

-- 
Best Regards.

Zhang Huangbin

- Open Source Mail Server Solution for Red Hat(R) Enterprise Linux,
  CentOS, Debian, Ubuntu, FreeBSD: http://www.iredmail.org/

Re: DSML writer

[Michael S. <mi...@st...>]

Adam Tauno Williams wrote:
> I noticed that python-ldap contains some DSML support;  only the XML
> produced is invalid [I believe this is caused by its attempt to create
> 'pretty' output].

Could you please point me to the details which parts of the XML produced are
invalid.

Ciao, Michael.

Re: How can i add a booleanMatch type attribute

[Michael S. <mi...@st...>]

Zhang Huangbin wrote:
> How can i add a booleanMatch type attribute with py-ldap?

Simply like any other attribute provided your attribute value is TRUE or FALSE.

> Refer to python-ldap-2.3.10/Demo/ldapcontrols.py, i use below code to add new attribute:
> 
> ----
> l = ldap.initialize('ldap://localhost:389',trace_level=2)
> l.add_ext_s(dn, modlist, serverctrls=[ BooleanControl('1.3.6.1.4.1.4203.1.10.1',1,1) ],)

???

Here you are using the Subentries control with an LDAP AddRequest. AFAIK this
control (which is not an attribute) is only applicable to SearchRequests (see
RFC 3672). What made you write this code?

> ----
> 
> But i got this error message:
> ----
> => result: 2
> *** ldap://127.0.0.1:389/ - SimpleLDAPObject.result3 ((2, 1, -1),{})
> => LDAPError - UNAVAILABLE_CRITICAL_EXTENSION: {'info': 'critical extension is not recognized', 'desc': 'Critical extension is unavailable'}
> ----

The server does not support this control for processing this request. Well,
that looks correct to me.

> I use amavisd-new attribute:
> ----
> attributetype ( 1.3.6.1.4.1.15312.2.2.1.19
>   NAME 'amavisLocal'
>   DESC 'Is user considered local'
>   EQUALITY booleanMatch
>   SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
>   SINGLE-VALUE )
> ----

I don't see any need to use a LDAPv3 extended control to simply populate this
attribute (once it's added to the schema).

Ciao, Michael.

How can i add a booleanMatch type attribute

[Zhang H. <zhb...@gm...>]

Hi, all.

How can i add a booleanMatch type attribute with py-ldap?

Refer to python-ldap-2.3.10/Demo/ldapcontrols.py, i use below code to add new attribute:

----
l = ldap.initialize('ldap://localhost:389',trace_level=2)
l.add_ext_s(dn, modlist, serverctrls=[ BooleanControl('1.3.6.1.4.1.4203.1.10.1',1,1) ],)
----

But i got this error message:
----
=> result: 2
*** ldap://127.0.0.1:389/ - SimpleLDAPObject.result3 ((2, 1, -1),{})
=> LDAPError - UNAVAILABLE_CRITICAL_EXTENSION: {'info': 'critical extension is not recognized', 'desc': 'Critical extension is unavailable'}
----

I use amavisd-new attribute:
----
attributetype ( 1.3.6.1.4.1.15312.2.2.1.19
  NAME 'amavisLocal'
  DESC 'Is user considered local'
  EQUALITY booleanMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
  SINGLE-VALUE )
----

-- 
Best Regards.

Zhang Huangbin

- Open Source Mail Server Solution for Red Hat(R) Enterprise Linux,
  CentOS, Debian, Ubuntu, FreeBSD: http://www.iredmail.org/

DSML writer

[Adam T. W. <awi...@op...>]

I noticed that python-ldap contains some DSML support;  only the XML
produced is invalid [I believe this is caused by its attempt to create
'pretty' output].  Unable to use the DSML support in python-ldap I wrote
my own DSML writer.  License is MIT/X11.

<http://coils.hg.sourceforge.net/hgweb/coils/coils/file/aad88f715c0f/src/coils/logic/workflow/actions/ldap/dsml1_writer.py>

This is only meant as an FYI in case someone wants to update the DSML
support in Python-LDAP.

-- 
OpenGroupware developer: awi...@wh...
<http://www.whitemiceconsulting.com
OpenGroupare & Cyrus IMAPd documenation @
<http://docs.opengroupware.org/Members/whitemice/wmogag/file_view>

Re: How get get more search results than the server’s sizelimit?

[Michael S. <mi...@st...>]

Dave Kirby wrote:
> 2010/1/18 Michael Ströder <mi...@st...>:
> Dave Kirby wrote:
> [snip]
>>> but according to the python-ldap
>>> docs controls are not supported for the search functions even though
>>> they are for other functions.
>>
>> Which version of python-ldap and docs are you referring to?
>>
> 
> I was referring to the docs online at
> http://www.python-ldap.org/doc/html/ldap.html#ldapobject-class and the
> latest version in CVS at
> http://python-ldap.cvs.sourceforge.net/viewvc/python-ldap/python-ldap/Doc/ldap.rst?revision=1.11&view=markup.
> 
> They both say under the LDAPPObject.search_xxx functions:
> 
> * serverctrls* not implemented yet.
> * clientctrls* not implemented yet.

Sorry, this is clearly outdated. Will correct it soon.

Ciao, Michael.

Re: How get get more search results than the server’s sizelimit?

[Dave K. <dav...@gm...>]

2010/1/18 Michael Ströder <mi...@st...>:
Dave Kirby wrote:
[snip]
>> but according to the python-ldap
>> docs controls are not supported for the search functions even though
>> they are for other functions.
>
> Which version of python-ldap and docs are you referring to?
>

I was referring to the docs online at
http://www.python-ldap.org/doc/html/ldap.html#ldapobject-class and the
latest version in CVS at
http://python-ldap.cvs.sourceforge.net/viewvc/python-ldap/python-ldap/Doc/ldap.rst?revision=1.11&view=markup.

They both say under the LDAPPObject.search_xxx functions:

* serverctrls* not implemented yet.
* clientctrls* not implemented yet.

So I assumed that controls were not implemented for the search
functions.  I guess the docs need updating.

Thanks for the response - I now have enough information to do what I want.

Regards,

Dave

Re: How get get more search results than the server’s sizelimit?

[Michael S. <mi...@st...>]

Dave Kirby wrote:
> Hi, I am trying to search for all groups on a server, but there are
> more than the server sizelimit results, so the search fails to get
> them all.
> 
> My understanding is that the only way to get round this is to use a
> paged search control with the search,

Which LDAP server product? With MS Active Directory using the simple paged
results control helps to circumvent the search result limit. But this won't
work with other LDAP servers like OpenLDAP which always enforces the
configured search result limit.

> but according to the python-ldap
> docs controls are not supported for the search functions even though
> they are for other functions.

Which version of python-ldap and docs are you referring to?

An example for simple paged results is shipped in the source distribution. See
this file:

Demo/page_control.py

> Is there a way in python-ldap to get all the results from a search
> query, or am I shafted?

In general the server determines what "all the results" means. ;-)

Ciao, Michael.

How get get more search results than the server’s sizelimit?

[Dave K. <dav...@gm...>]

Hi, I am trying to search for all groups on a server, but there are
more than the server sizelimit results, so the search fails to get
them all.

My understanding is that the only way to get round this is to use a
paged search control with the search, but according to the python-ldap
docs controls are not supported for the search functions even though
they are for other functions.

Is there a way in python-ldap to get all the results from a search
query, or am I shafted?

Re: Multiple Email Values

[Michael S. <mi...@st...>]

Chris Dukes wrote:
> On Wed, Dec 30, 2009 at 02:41:03PM +0100, Christoph Holtermann wrote:
>> I use LDAP for storing my contacts. I keep thinking about the
>> simple case of people having multiple email. One case
>> would be to have an attribute "mail" another one "mozillaSecond
>> Email". On the other hand I know that it
>> is possible to store multiple values in the corresponding LDAP-
>> attribute. but i wonder how it could be possible to also store
>> an additional information about these email.
> 
> If you're caring from an MTA perspective...
> Postfix's LDAP maps suggest a 'maildrop' attribute for calculating actual
> delivery.

'maildrop' has a different semantics.

> And now a suggestion so you can spend an afternoon seeing what it
> breaks...
> Well, atleast in my LDAP schemas the mail attribute has syntax
> 1.3.6.1.4.1.1466.115.121.1.15
> 
> And looking at 6.10 of RFC2252
> http://tools.ietf.org/html/rfc2252
> 
> You can put any unicode string there you want to such
> as 
> Christoph Holtermann Obsolete  <c.h...@fo...r>

This is IMO bad advice since MUAs expect only the raw e-mail address in
attribute 'mail' (see section 2.16 in RFC 4524) which also contains some other
interesting notes.

Ciao, Michael.

start_tls = 2 is ignored with LDAP URIs starting with LDAP://

[Andreas B. <bue...@un...>]

Hi,

I've found a strange behaviour of python-ldap when working with TLS encrypted 
connections. I'm not sure if this is a problem of the python bindings or of 
libldap or in my head ;-)

In my first scenario I was trying to set up a TLS encrypted connection with a 
specific CA certificate that was set in the ldap.conf file (TLS_CACERT).

>>> import ldap
>>> l = 
ldap.ldapobject.SmartLDAPObject(uri='LDAP://qamaster.windom2008.univention.test:389', 
who='uid=Administrator,cn=users,DC=windom2008,DC=univention,DC=test',cred='univention', 
start_tls=2, tls_cacertfile='/etc/univention/ssl/ucsCA/CAcert.pem')
>>> l.started_tls
0

In that case the connection is not encrypted. When I replace LDAP:// with 
ldap:// in the URI the connection is encrypted.

>>> l = 
ldap.ldapobject.SmartLDAPObject(uri='ldap://qamaster.windom2008.univention.test:389', 
who='uid=Administrator,cn=users,DC=windom2008,DC=univention,DC=test',cred='univention', 
start_tls=2, tls_cacertfile='/etc/univention/ssl/ucsCA/CAcert.pem')
>>> l.started_tls
1

It look likes a TLS connection is not set up if the URI starts with LDAP://

In the second scenario I've tried to set up a TLS encrypted connection with a 
CA certificate that was not set in the ldap.conf file.

>>> l = 
ldap.ldapobject.SmartLDAPObject(uri='ldap://win-64q6lq48z7a.windom2008.univention.test:389', 
who='cn=Administrator,cn=users,DC=windom2008,DC=univention,DC=test',cred='univention', 
start_tls=2, 
tls_cacertfile='/etc/univention/connector/ad/ad_cert_20091221_153053.pem')
...
ldap.CONNECT_ERROR: {'info': 'error:14090086:SSL 
routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify 
failed', 'desc': 'Connect error'}

It seems that the argument tls_cacertfile is ignored, because if I set the CA 
certificate file with the set_option function the connection works and is 
encrypted.

ldap.set_option( 
ldap.OPT_X_TLS_CACERTFILE, '/etc/univention/connector/ad/ad_cert_20091221_153053.pem' )
l = 
ldap.ldapobject.SmartLDAPObject(uri='ldap://win-64q6lq48z7a.windom2008.univention.test:389', 
who='cn=Administrator,cn=users,DC=windom2008,DC=univention,DC=test',cred='univention', 
start_tls=2 )
>>> l.started_tls
1

software versions:

python 2.4.6
libldap 2.4.15
python-ldap 2.3.5

Is there any mistake in my reasoning or is this a known behaviour?

best regards
Andreas

-- 
Andreas Büsching
Open Source Software Engineer

Univention GmbH
Linux for your business
Mary-Somerville-Str.1
28359 Bremen
Tel. : +49 421 22232-0
Fax : +49 421 22232-99

<bue...@un...>
http://www.univention.de

Geschäftsführer: Peter H. Ganten
HRB 20755 Amtsgericht Bremen
Steuer-Nr.: 71-597-02876