python-ldap-dev — discussion among developers

Re: build error on RHEL3 (ES)

[Ames A. <And...@co...>]

Hi,

shishkin alexey wrote:

> gcc -DNDEBUG -O2 -g -pipe -march=3Di386 -mcpu=3Di686 -D_GNU_SOURCE =
-fPIC -fPIC
> -DLDAPMODULE_VERSION=3D2.0.8 -IModules -I/usr/local/include
> -I/usr/local/include/sasl -I/usr/include -I/usr/lib/include
> -I/usr/include/python2.2 -c Modules/ldapcontrol.c -o
> build/temp.linux-i686-2.2/ldapcontrol.o
> Modules/ldapcontrol.c:204: syntax error before string constant

[...]

> Packets installed:
>
> python-2.2.3-5

I guess, this is the problem.  I use the PyDoc_STRVAR macro which is
apparently only available from python 2.3 and up (although I haven't
checked, I know it is a relatively recent addition to python).

Are you able to switch to a more recent version of python?  Given that
you seem to use sort of an "enterprise" linux, this is probably not an
option.

In this case you might try to replace the offending line by:

static char encode_rfc2696__doc__[] =3D "encode_page_control(blabla)";

But please be aware that this is untested and that I'm not sure that =
this
is my only 2.3ism.  Please also note that PyDoc_STRVAR is used twice =
within=20
the module.


HTH,

aa

--=20
Andreas Ames | Programmer | Comergo GmbH |=20
Voice:  +49 69 7505 3213 | andreas . ames AT comergo . com

build error on RHEL3 (ES)

[shishkin.alexey <shi...@gm...>]

Hi there!

Please help me to solve following issue.
I'm get error when building python-ldap:

gcc -DNDEBUG -O2 -g -pipe -march=i386 -mcpu=i686 -D_GNU_SOURCE -fPIC -fPIC
-DLDAPMODULE_VERSION=2.0.8 -IModules -I/usr/local/include
-I/usr/local/include/sasl -I/usr/include -I/usr/lib/include
-I/usr/include/python2.2 -c Modules/ldapcontrol.c -o
build/temp.linux-i686-2.2/ldapcontrol.o
Modules/ldapcontrol.c:204: syntax error before string constant
Modules/ldapcontrol.c:208: warning: data definition has no type or storage
class
Modules/ldapcontrol.c:265: syntax error before string constant
Modules/ldapcontrol.c:268: warning: data definition has no type or storage
class
Modules/ldapcontrol.c:306: `encode_rfc2696__doc__' undeclared here (not in a
function)
Modules/ldapcontrol.c:306: initializer element is not constant
Modules/ldapcontrol.c:306: (near initialization for `methods[0].ml_doc')
Modules/ldapcontrol.c:306: initializer element is not constant
Modules/ldapcontrol.c:306: (near initialization for `methods[0]')
Modules/ldapcontrol.c:307: `decode_rfc2696__doc__' undeclared here (not in a
function)
Modules/ldapcontrol.c:307: initializer element is not constant
Modules/ldapcontrol.c:307: (near initialization for `methods[1].ml_doc')
Modules/ldapcontrol.c:307: initializer element is not constant
Modules/ldapcontrol.c:307: (near initialization for `methods[1]')
Modules/ldapcontrol.c:308: initializer element is not constant
Modules/ldapcontrol.c:308: (near initialization for `methods[2]')
error: command 'gcc' failed with exit status 1

Packets installed:

python-2.2.3-5
python-ldap-2.0.8
openldap-2.3.4 ( configured --with-cyrus-sasl --with-tls )
cyrus-sasl-2.1.21
openssl-devel-0.9.7a-22.1
openssl096b-0.9.6b-16
openssl-0.9.7a-22.1

Here is my setup.cfg:

# Example for setup.cfg
# You have to edit this file to reflect your system configuation
# $Id: setup.cfg.suse-linux,v 1.1 2003/08/20 10:04:34 stroeder Exp $

[_ldap]
# Section for compiling the C extension module
# for wrapping OpenLDAP 2 libs

library_dirs = /usr/local/lib /usr/local/lib/sasl2 /usr/lib
include_dirs = /usr/local/include /usr/local/include/sasl /usr/include
/usr/lib/include

extra_compile_args =
extra_objects =

# Example for full-featured SuSE build:
# Support for StartTLS/LDAPS, SASL bind and reentrant libldap_r.
# This needs recent OpenLDAP 2.0.26+ or 2.1.3+ built with
# ./configure --with-cyrus-sasl --with-tls
libs = ldap_r lber ssl crypto sasl2

[install]
# Installation options
compile = 1
optimize = 1

# For SuSE Linux 8.2
[bdist_rpm]
provides = python-ldap
requires = python openldap2-client openssl cyrus-sasl2
distribution_name = SuSE Linux 8.2
release = 1
packager = Michael Stroeder <mi...@st...>
doc_files = CHANGES README INSTALL TODO Demo/

 
-- 
shishkin

build error on RHEL3 (ES)

[<A.S...@ho...>]

Hi there!

Please help me to solve following issue.
I'm get error when building python-ldap:

gcc -DNDEBUG -O2 -g -pipe -march=3Di386 -mcpu=3Di686 -D_GNU_SOURCE -fPIC =
-fPIC
-DLDAPMODULE_VERSION=3D2.0.8 -IModules -I/usr/local/include
-I/usr/local/include/sasl -I/usr/include -I/usr/lib/include
-I/usr/include/python2.2 -c Modules/ldapcontrol.c -o
build/temp.linux-i686-2.2/ldapcontrol.o
Modules/ldapcontrol.c:204: syntax error before string constant
Modules/ldapcontrol.c:208: warning: data definition has no type or =
storage
class
Modules/ldapcontrol.c:265: syntax error before string constant
Modules/ldapcontrol.c:268: warning: data definition has no type or =
storage
class
Modules/ldapcontrol.c:306: `encode_rfc2696__doc__' undeclared here (not =
in a
function)
Modules/ldapcontrol.c:306: initializer element is not constant
Modules/ldapcontrol.c:306: (near initialization for `methods[0].ml_doc')
Modules/ldapcontrol.c:306: initializer element is not constant
Modules/ldapcontrol.c:306: (near initialization for `methods[0]')
Modules/ldapcontrol.c:307: `decode_rfc2696__doc__' undeclared here (not =
in a
function)
Modules/ldapcontrol.c:307: initializer element is not constant
Modules/ldapcontrol.c:307: (near initialization for `methods[1].ml_doc')
Modules/ldapcontrol.c:307: initializer element is not constant
Modules/ldapcontrol.c:307: (near initialization for `methods[1]')
Modules/ldapcontrol.c:308: initializer element is not constant
Modules/ldapcontrol.c:308: (near initialization for `methods[2]')
error: command 'gcc' failed with exit status 1

Packets installed:

python-2.2.3-5
python-ldap-2.0.8
openldap-2.3.4 ( configured --with-cyrus-sasl --with-tls )
cyrus-sasl-2.1.21
openssl-devel-0.9.7a-22.1
openssl096b-0.9.6b-16
openssl-0.9.7a-22.1

Here is my setup.cfg:

# Example for setup.cfg
# You have to edit this file to reflect your system configuation
# $Id: setup.cfg.suse-linux,v 1.1 2003/08/20 10:04:34 stroeder Exp $

[_ldap]
# Section for compiling the C extension module
# for wrapping OpenLDAP 2 libs

library_dirs =3D /usr/local/lib /usr/local/lib/sasl2 /usr/lib
include_dirs =3D /usr/local/include /usr/local/include/sasl /usr/include
/usr/lib/include

extra_compile_args =3D
extra_objects =3D

# Example for full-featured SuSE build:
# Support for StartTLS/LDAPS, SASL bind and reentrant libldap_r.
# This needs recent OpenLDAP 2.0.26+ or 2.1.3+ built with
# ./configure --with-cyrus-sasl --with-tls
libs =3D ldap_r lber ssl crypto sasl2

[install]
# Installation options
compile =3D 1
optimize =3D 1

# For SuSE Linux 8.2
[bdist_rpm]
provides =3D python-ldap
requires =3D python openldap2-client openssl cyrus-sasl2
distribution_name =3D SuSE Linux 8.2
release =3D 1
packager =3D Michael Stroeder <mi...@st...>
doc_files =3D CHANGES README INSTALL TODO Demo/

=20
--=20
shishkin

Re: get or set OpenLDAPaci

[<jer...@li...>]

Michael Str=F6der a =E9crit :

>J=E9r=F4me Wax wrote:
> =20
>
>>Then I create an openexchange account on an ldap account,
>>   =20
>>
>
>Just curious, what project are you working on?
> =20
>

> =20
>
>>mlist =3D ldap.modlist.modifyModlist(attrs, newattrs)
>>self.l.modify_s(cn, mlist)
>>   =20
>>
>
>Can you please post repr(mlist)?
> =20
>
[(0, 'mailDomain', 'linbox.com'), (1, 'objectClass', None), (0,=20
'objectClass', ['inetOrgPerson', 'posixAccount', 'shadowAccount', 'top',=20
'person', 'sambaSamAccount', 'OXUserObject']), (0, 'OXTimeZone',=20
'Europe/Paris'), (0, 'OXTaskDays', '5'), (0, 'OpenLDAPaci',=20
'1#entry#grant;r,w,s,c;cn,initials,mail,title,ou,l,birthday,description,s=
treet,postalcode,st,c,oxtimezone,homephone,mobile,pager,facsimiletelephon=
enumber,telephonenumber,labeleduri,jpegphoto,loginDestination,sn,givennam=
e,;r,s,c;[all]#self#"'),=20
(1, 'preferredLanguage', None), (0, 'preferredLanguage', 'EN'), (0,=20
'OXGroupID', '500'), (1, 'mail', None), (0, 'mail',=20
'vi...@li...'), (0, 'lnetMailAccess', '5'), (0,=20
'OXAppointmentDays', '5'), (0, 'userCountry', 'Tuxworld'), (1, 'o',=20
None), (0, 'o', 'linbox'), (1, 'givenName', None), (0, 'givenName',=20
'vincent'), (0, 'mailEnabled', 'TRUE')]

but attrs fetch on ldap entry of this user contain

{'shadowMin': ['-1'], 'cn': ['vincent'], 'objectClass':=20
['inetOrgPerson', 'posixAccount', 'shadowAccount', 'top', 'person',=20
'sambaSamAccount'], 'uidNumber': ['10021'], 'sambaAcctFlags':=20
['[U          ]'], 'shadowMax': ['99999'], 'shadowLastChange':=20
['11192'], 'shadowExpire': ['-1'], 'sambaPwdCanChange': ['1121872460'],=20
'uid': ['vincent'], 'shadowFlag': ['134538308'], 'preferredLanguage':=20
['EN'], 'userPassword': ['{crypt}351Hd48lGvZKo'], 'sambaPwdMustChange':=20
['2147483647'], 'sambaLMPassword': ['4E6319FFC67D969DAAD3B435B51404EE'],=20
'postalCode': ['57950'], 'mail': ['vi...@co...'], 'loginShell':=20
['/bin/false'], 'gidNumber': ['10018'], 'sambaPasswordHistory':=20
['0000000000000000000000000000000000000000000000000000000000000000'],=20
'sambaPwdLastSet': ['1121872460'], 'sambaPrimaryGroupSID':=20
['S-1-5-21-1297919630-73438211-3158585458-21037'], 'sambaNTPassword':=20
['90076DCEE4C9C5772477679A8CFE38AE'], 'displayName': ['franky vincent'],=20
'shadowWarning': ['7'], 'labeledURI': ['http://lo2k.net'],=20
'shadowInactive': ['-1'], 'l': ['Montigny les Metz'], 'o': ['linbox'],=20
'sambaSID': ['S-1-5-21-1297919630-73438211-3158585458-21042'], 'gecos':=20
['vincent franky'], 'sn': ['franky'], 'homeDirectory':=20
['/home/vincent'], 'givenName': ['vincent']}

so no OpenLDAPaci key


> =20
>
>> attrs is the entire attributes list.
>>newattrs is the modified list.
>>   =20
>>
>
>These are dictionaries, not lists!
> =20
>
You have reason :)

> =20
>
>>When I create and delete... it works.
>>
>>But if I recreate OX attributes... OpenLDAPaci already exist... but don=
't appear in attributes list and cause this:
>>
>>ldap.INAPPROPRIATE_MATCHING: {'info': 'modify/add: OpenLDAPaci: no equa=
lity matching rule', 'desc': 'Inappropriate matching'}
>>
>>How can I get OpenLDAPaci attribute to prevent this error ?
>>   =20
>>
>
>Probably you have to use ldap.MOD_REPLACE in mlist for attribute
>OpenLDAPaci instead of ldap.MOD_DELETE. Not sure if usage of
>ldap.modlist.modifyModlist() in every case.
> =20
>
I'm not following you... I don't want to delete... just add or replace.

>But first turn on python-ldap's debugging by setting trace_level=3D2 whe=
n
>calling ldap.initialize() and post the output.
>
>Example:
>l =3D ldap.initialize('ldap://localhost:1390',trace_level=3D2)
> =20
>
Just respond me that

*** ldap://127.0.0.1 - SimpleLDAPObject.set_option ((17, 3),{})

Re: get or set OpenLDAPaci

[<mi...@st...>]

J=E9r=F4me Wax wrote:
>=20
> Then I create an openexchange account on an ldap account,

Just curious, what project are you working on?

> mlist =3D ldap.modlist.modifyModlist(attrs, newattrs)
> self.l.modify_s(cn, mlist)

Can you please post repr(mlist)?

>  attrs is the entire attributes list.
> newattrs is the modified list.

These are dictionaries, not lists!

> When I create and delete... it works.
>=20
> But if I recreate OX attributes... OpenLDAPaci already exist... but don=
't appear in attributes list and cause this:
>=20
> ldap.INAPPROPRIATE_MATCHING: {'info': 'modify/add: OpenLDAPaci: no equa=
lity matching rule', 'desc': 'Inappropriate matching'}
>=20
> How can I get OpenLDAPaci attribute to prevent this error ?

Probably you have to use ldap.MOD_REPLACE in mlist for attribute
OpenLDAPaci instead of ldap.MOD_DELETE. Not sure if usage of
ldap.modlist.modifyModlist() in every case.

But first turn on python-ldap's debugging by setting trace_level=3D2 when
calling ldap.initialize() and post the output.

Example:
l =3D ldap.initialize('ldap://localhost:1390',trace_level=3D2)

Ciao, Michael.

get or set OpenLDAPaci

[<jer...@li...>]

I've got a problem (again).

Then I create an openexchange account on an ldap account, I must set OpenLDAPaci. like this

*if* *not* "OpenLDAPaci" *in* newattrs:
	newattrs["OpenLDAPaci"]='1#entry#grant;r,w,s,c;cn,initials,mail,title,ou,l,birthday,description,street,postalcode,st,c,oxtimezone,homephone,mobile,pager,facsimiletelephonenumber,telephonenumber,labeleduri,jpegphoto,loginDestination,sn,givenname,;r,s,c;[all]#self#"'

mlist = ldap.modlist.modifyModlist(attrs, newattrs)
self.l.modify_s(cn, mlist)

attrs is the entire attributes list.
newattrs is the modified list.

When I create and delete... it works.

But if I recreate OX attributes... OpenLDAPaci already exist... but don't appear in attributes list and cause this:

ldap.INAPPROPRIATE_MATCHING: {'info': 'modify/add: OpenLDAPaci: no equality matching rule', 'desc': 'Inappropriate matching'}

How can I get OpenLDAPaci attribute to prevent this error ?

thanks in advance

Re: bugs in ldap.OBJECT_CLASS_VIOLATION ?

[<mi...@st...>]

J=E9r=F4me Wax wrote:
>=20
> ldap.OBJECT_CLASS_VIOLATION: {'info': "object class 'inetOrgPerson'
> requires attribute 'sn'", 'desc': 'Object class violation'}

Yepp.

> But sn is not a required attribute for inetOrgPerson...

It is required since inetOrgPerson is SUP organizationalPerson which is
SUP person.

> and inetOrgPerson schema response doesn't contain sn attribute...

You have to resolve object class inheritance.

Fortunately you can use ready-to-use methods:

  ldap.schema.subentry.SubSchema.attribute_types()

Or the convenience wrapper method:

  ldap.schema.models.Entry.attribute_types().

BTW: Attribute types are derived via SUP too...

Additionally I'd recommend to use the schema browser in
http://www.web2ldap.de to dig your local LDAP server's schema. :-)

Ciao, Michael.

bugs in ldap.OBJECT_CLASS_VIOLATION ?

[<jer...@li...>]

I've got this error message for my function who delete objectClass on an 
entry

In this example i delete objectClass "person"

My function try to delete sn,telephoneNumber and seeAlso attributes... 
cause the over are used by other schema.

I've got this error message

ldap.OBJECT_CLASS_VIOLATION: {'info': "object class 'inetOrgPerson' 
requires attribute 'sn'", 'desc': 'Object class violation'}

But sn is not a required attribute for inetOrgPerson...

and inetOrgPerson schema response doesn't contain sn attribute...

Re: retrieves attributes from schema

[<mi...@st...>]

J=E9r=F4me Wax wrote:
>=20
> I'll try to create function to delete properly an objectClass, preserve
> same Attributes between schema.
> I can post the function... if you want to integrate it into Python-Ldap=
.

This could be a method of class ldap.schema.models.Entry.
Please take a closer look at this.

Ciao, Michael.

Re: retrieves attributes from schema

[<jer...@li...>]

Thanks, it works well.

I'll try to create function to delete properly an objectClass, preserve=20
same Attributes between schema.
I can post the function... if you want to integrate it into Python-Ldap.

It can be useful.

Michael Str=F6der a =E9crit :

>J=E9r=F4me Wax wrote:
> =20
>
>>Can I retrieve all required and sufficient attributes for a specific
>>schema with Python-Ldap ?
>>   =20
>>
>
>There's a undocumented module ldap.schema. See Demo/schema.py for a
>couple of examples. But first you should understand all the nits and
>bits about correct usage of LDAPv3 subschema subentries.
>
>Note: The API of ldap.schema might change in the future. I.e. I'm still
>thinking about changing the ill-designed error handling for non-existent
>schema elements.
>
>Ciao, Michael.
>
> =20
>

Re: retrieves attributes from schema

[<mi...@st...>]

J=E9r=F4me Wax wrote:
> Can I retrieve all required and sufficient attributes for a specific
> schema with Python-Ldap ?

There's a undocumented module ldap.schema. See Demo/schema.py for a
couple of examples. But first you should understand all the nits and
bits about correct usage of LDAPv3 subschema subentries.

Note: The API of ldap.schema might change in the future. I.e. I'm still
thinking about changing the ill-designed error handling for non-existent
schema elements.

Ciao, Michael.

retrieves attributes from schema

[<jer...@li...>]

Can I retrieve all required and sufficient attributes for a specific 
schema with Python-Ldap ?

For example I need all attributes of OXUserObject schema to correctly 
delete OXUserObject in objectClass attribute of this user.

thanks in advance.

Re: auth with python-ldap

[<mi...@st...>]

jea...@ac... wrote:
> I'de like to autorize a user to go into a web application.
> anonymous bind is allowing, also a bind is always sucessfull.
> How can I test if a user is valid with simplebind ?

You simply bind with the user's DN and his password.

> ldapserver = sun  directory server 5.2
> passwd use shadow

Your local system's password checking is not relevant. Basically one
sets the userPassword value in the user's entry.

Ciao, Michael.

auth with python-ldap

[<jea...@ac...>]

Helo,
I'de like to autorize a user to go into a web application.
anonymous bind is allowing, also a bind is always sucessfull.
How can I test if a user is valid with simplebind ?

ldapserver = sun  directory server 5.2
passwd use shadow

any examples or best pratices are welcome

thanks

Re: how can i delete objectclass with it's attributes

[<fra...@fr...>]

No, I don't think so, you have to remove the objectClass value and all=20
the attributes values in the same modify operation.

Fran=E7ois

P.S.: don't forget to reply to all, so as the list can see your reply.


J=E9r=F4me Wax wrote:

> Fran=E7ois Beretti a =E9crit :
>
> Sorry, can Python-Ldap can remove a schema of the server ?
>
> No,no, it's just to remove an objectClass on an entry of the directory=20
> with all attributes.=20

Re: how can i delete objectclass with it's attributes

[<fra...@fr...>]

Hi Jer=F4me,

You are not very clear on what you are trying to do... Do you mean you=20
want to remove an objectClass from the schema of the server, or you want=20
to remove an objectclass from an entry of the directory ?

Fran=E7ois

J=E9r=F4me Wax wrote:

> Hi,
>
> I just try to delete an objectClass.
> Can Python-Ldap delete attributes which corresponds to that=20
> objectClass automatically ?
>
>
>
>
> -------------------------------------------------------
> SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
> from IBM. Find simple to follow Roadmaps, straightforward articles,
> informative Webcasts and more! Get everything you need to get up to
> speed, fast. http://ads.osdn.com/?ad_id=3D7477&alloc_id=3D16492&op=3Dcl=
ick
> _______________________________________________
> Python-LDAP-dev mailing list
> Pyt...@li...
> https://lists.sourceforge.net/lists/listinfo/python-ldap-dev
>
>

how can i delete objectclass with it's attributes

[<jer...@li...>]

Hi,

I just try to delete an objectClass.
Can Python-Ldap delete attributes which corresponds to that objectClass 
automatically ?

Re: python-ldap under OS X 10.4

[Jens V. <je...@da...>]

On 28 Jun 2005, at 14:51, Jens Vagelpohl wrote:

> Hi guys,
>
> I find myself unable to use python-ldap compiled under OS X 10.4.  
> It compiles, but loading it leads to unresolved symbols.

Just to close out this thread, if you compile python-ldap against you  
own hand-rolled OpenLDAP instead of the system-provided libraries/ 
headers it works fine. So basically the fault lies with the crummy OL  
libraries shipped with OS X 10.4. This is a recent breakage, it did  
not occur on any 10.3 version.

So now I'm happily running python-ldap 2.0.8 on both Python 2.4.1 and  
2.3.5 built against OL 2.2.26/BDB 4.52.4 on OS X.

For those who have tried to build Python 2.3.5 on OS X 10.4 and  
failed (such as me until yesterday) here's a howto:

http://blogs.nuxeo.com/sections/blogs/florent_guillaume/ 
2005_05_21_compiling_python_2_3_5

jens

python-ldap under OS X 10.4

[Jens V. <je...@da...>]

Hi guys,

I find myself unable to use python-ldap compiled under OS X 10.4. It  
compiles, but loading it leads to unresolved symbols.

Environment:
- OS X 10.4.1
- Python 2.4.1, compiled separately from the system's own python, no  
special options
- in setup.cfg, I set "libs = ldap_r lber"


_ldap.so ends up being linked against the following:

_ldap.so:
         /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP  
(compatibility version 1.0.0, current version 2.2.0)
         /usr/lib/libSystem.B.dylib (compatibility version 1.0.0,  
current version 88.0.0)


  When I load it in the interpreter I see this:

Python 2.4.1 (#1, Jun  9 2005, 13:53:37)
[GCC 4.0.0 20041026 (Apple Computer, Inc. build 4061)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
 >>> import _ldap
Traceback (most recent call last):
   File "<stdin>", line 1, in ?
ImportError: Failure linking new module: _ldap.so: Symbol not found:  
_ldap_matchingrule_free
   Referenced from: _ldap.so
   Expected in: dynamic lookup


Has anyone found a way around this?

jens

ANN: python-ldap-2.0.8

[<mi...@st...>]

Find a new release of python-ldap:

  http://python-ldap.sourceforge.net/

python-ldap provides an object-oriented API to access LDAP directory
servers from Python programs. It mainly wraps the OpenLDAP 2.x libs for
that purpose. Additionally it contains modules for other LDAP-related
stuff (e.g. processing LDIF, LDAPURLs and LDAPv3 schema).

----------------------------------------------------------------
Released 2.0.8 2005-06-22 at Linuxtag 2005, Karlsruhe, Germany

Changes since 2.0.7:

* Preliminary support for receiving LDAP controls added.
  Contributor:
  - Andreas Ames

Lib:/
- Added classes in module ldif to ldif.__all__ to fix
  from ldif import *
- Removed BitString syntax from
  ldap.schema.models.NOT_HUMAN_READABLE_LDAP_SYNTAXES
  since the LDAP encoding is in fact human-readable
- ldapurl.LDAPUrlExtension.unparse() outputs empty string
  if LDAPUrlExtension.exvalue is None
- Added ldap.controls.SimplePagedResultsControl

----------------------------------------------------------------
Released 2.0.7 2005-04-29

Changes since 2.0.6:

* Added preliminary support for sending LDAP controls
  with a request.
  Contributors:
  - Deepak Giridharagopal
  - Ingo Steuwer
  (Receiving controls in LDAP results still not supported.)

Modules:
* LDAPObject.c: removed l_ldap_manage_dsa_it()
* LDAPObject.c: Added missing #ifdef around l_ldap_passwd()
  for compability with older OpenLDAP libs.

Lib:/
* New algorithm in ldap.schema.tokenizer.split_tokens()
  contributed by Wido Depping which is more robust
  when parsing very broken schema elements
  (e.g. Oracle's OID).
* Fixed argument list (position of timeout) when calling
  LDAPObject.search_ext_s() from search_st() and search_s().
* LDAPObject.search_ext_s() correctly calls search_ext_s() now.
* Re-implemented LDAPObject.manage_dsa_it() without calling _ldap.

Re: [Patch] RFC 2696 and reception of server controls

[Ames A. <And...@co...>]

SGVsbG8gTWljaGFlbCwNCg0KTWljaGFlbCBTdHLDtmRlciB3cm90ZToNCg0KPiBUaGFua3MgZm9y
IHlvdXIgY29udHJpYnV0aW9uLiBJdCBhbHNvIHNlZW1zIHRvIHdvcmsgd2l0aCBPcGVuTERBUA0K
PiAyLjMuDQoNClRoYW5rIHlvdSBtdWNoIG1vcmUgZm9yIGFsbCB0aGUgd29yayBhbmQgZW5lcmd5
IHRoYXQgeW91IGludmVzdCBpbnRvDQpweXRob24tbGRhcCB0byBtYWtlIGl0IGFzIHVzZWZ1bCBh
cyBpdCBpcy4NCg0KPiBJJ3ZlIGNvbW1pdHRlZCB0aGUgY2hhbmdlcyB1bmRlciBNb2R1bGVzLyBh
bmQgY2xlYW5lZCB1cCB0aGluZ3MgZm9yDQo+IExpYi8gYSBsaXR0bGUgYml0LiBUaGUgbmV3IGZp
bGUgRGVtby9wYWdlX2NvbnRyb2wucHkgZGVtb25zdHJhdGVzDQo+IHRoZSB1c2Ugb2YgbGRhcC5j
b250cm9scy5TaW1wbGVQYWdlZFJlc3VsdHNDb250cm9sLg0KDQpUaGFua3MgYWdhaW4uDQoNCj4g
UGxlYXNlIHN5bmMgd2l0aCBDVlMgYW5kIHRlc3QuIElmIHlvdSBkb24ndCBoYXZlIGFjY2VzcyB0
byBDVlMNCj4gZS1tYWlsIG1lIHBlcnNvbmFsbHkgYW5kIEknbGwgc2VuZCBhIHRhci5neiBzbmFw
c2hvdC4NCg0KSSBqdXN0IGhhZCBhIGN1cnNvcnkgZ2xhbmNlIGF0IGl0IGFuZCBpdCBsb29rcyBn
b29kIHRvIG1lLiAgT25lIHZlcnkNCm1pbm9yIGlzc3VlIGlzIHRoYXQgdGhlIGNvbW1lbnQgYWJv
dXQgcmV0dXJuaW5nIHBsYWluIHR1cGxlcyBpbiB0aGUNCnBhZ2UgY29udHJvbCBkZW1vIGlzIG5v
IGxvbmdlciBwcmV2YWlsaW5nIGJlY2F1c2Ugb2YgeW91ciBlbmhhbmNlbWVudHMNCm9mIHRoZSBy
ZXN1bHQzIG1ldGhvZC4NCg0KV2hlbiBJIGdldCBhcm91bmQgaXQgKGFuZCB0aGF0IG1heSB2ZXJ5
IHdlbGwgdGFrZSBzb21lIHRpbWUpIEkgd2lsbA0KanVzdCB1c2UNCmh0dHA6Ly9jdnMuc291cmNl
Zm9yZ2UubmV0L2N2c3RhcmJhbGxzL3B5dGhvbi1sZGFwLWN2c3Jvb3QudGFyLmJ6MiB0bw0KZ2V0
IGEgY3ZzIHNuYXBzaG90Lg0KDQoNCmNoZWVycywNCg0KYWENCg0KLS0gDQpBbmRyZWFzIEFtZXMg
fCBQcm9ncmFtbWVyIHwgQ29tZXJnbyBHbWJIIHwgDQpWb2ljZTogICs0OSA2OSA3NTA1IDMyMTMg
fCBhbmRyZWFzIC4gYW1lcyBBVCBjb21lcmdvIC4gY29tDQo=

Re: [Patch] RFC 2696 and reception of server controls

[<mi...@st...>]

Andreas,

Ames Andreas wrote:
> 
> the attached patch tries to implement what subject says.  It is barely
> tested (only against Active Directory) and it is diffed against stock
> 2.0.7 release (because I need it this way and because I have no CVS
> access by courtesy of a corp. firewall).  It is actually a small
> add-on to Deepak Giridharagopal's control patch.

Thanks for your contribution. It also seems to work with OpenLDAP 2.3.

I've committed the changes under Modules/ and cleaned up things for Lib/
a little bit. The new file Demo/page_control.py demonstrates the use of
ldap.controls.SimplePagedResultsControl.

Please sync with CVS and test. If you don't have access to CVS e-mail me
personally and I'll send a tar.gz snapshot.

Ciao, Michael.

Re: password bind

[<fra...@fr...>]

Fabio Marcone wrote:

>Hi!
>I would know if there is a way to pass to bind() method an encrypted password. 
>I read this password from a configuration file and would not write password 
>in it in clear text.
>  
>
Hi Fabio

If it was possible to bind with an encrypted password, and someone read 
your encrypted password, then it can authenticate. So it is useless to 
encrypt it, because it does not prevent someone to use it :-)

Anyway, it is not possible. The LDAP API needs the clear text password. 
This is not a problem, considering the explanation above.

François

>Thanks in advance,
>Fabio
>
>  
>

Re: password bind

[<mi...@st...>]

Fabio Marcone wrote:
> I would know if there is a way to pass to bind() method an encrypted password. 

Which entity do you want to decrypt this password and with which key?

LDAPv3 requires a clear-text password to be passed with simple bind
request. If you want to protect the password from being sniffed you have
to protect your LDAP connection with SSL or TLS. Another option is to
use SASL bind with reasonable strong challenge-response mechanism (e.g.
DIGEST-MD5).

> I read this password from a configuration file and would not write password 
> in it in clear text.

This has nothing to do with python-ldap or LDAPv3. The only thing which
helps is to avoid having to store a password in your configuration.

It's impossible to give better advice without any background information
about what your LDAP client looks like.

Ciao, Michael.

password bind

[Fabio M. <fab...@du...>]

Hi!
I would know if there is a way to pass to bind() method an encrypted password. 
I read this password from a configuration file and would not write password 
in it in clear text.

Thanks in advance,
Fabio

-- 
Dott. Fabio Marcone

2T srl
Telefono   +39 - 0871- 540154    
Fax           +39 - 0871- 571594   
Indirizzo  Viale B. Croce 573, 66013 Chieti Scalo (CH)