python-ldap-dev — discussion among developers

FYI: python-ldap and web2ldap at OpenLDAP booth, Linuxtag 2005

[<mi...@st...>]

HI!

once again OpenLDAP will be presented by a team of volunteers

  at Linuxtag 2005
  in Karlsruhe, Germany
  from Wednesday, 2005-06-22
  until Saturday, 2005-06-25

  http://www.linuxtag.de/2005/

Several deployment scenarios based on OpenLDAP will be demonstrated with
various LDAP clients.

I will also present web2ldap and answer questions about python-ldap too.
I'd be glad to meet members of the community personally there.

See you at booth F87!

Ciao, Michael.

-- 
Michael Ströder
E-Mail: mi...@st...
http://www.stroeder.com

Re: LDIFWriter

[<mi...@st...>]

Fabio Marcone wrote:
> Where I can find other docs about LDIFWriter (and ldif parser)?

Sorry, no decent documentation for module 'ldif' yet. Use the source and
the example in Demo/Lib/ldif/. Also there are some __doc__ strings which
you could view with pydoc.

Urrgs! I did not include the classes in ldif.__all__ which prevents
pydoc from including them in the output. Anyway I've attached a correct
pydoc-generated ldif.html (gzipped).

Ciao, Michael.

Re: LDIFWriter

[Fabio M. <fab...@du...>]

Thanks very much!
Where I can find other docs about LDIFWriter (and ldif parser)?

Thanks,
=46abio
Alle 11:36, venerd=EC 03 giugno 2005, Michael Str=F6der ha scritto:
> Fabio Marcone wrote:
> > I need to backup an ldap directory from python. I try to follow example
> > in docs about LDIFWriter but I have this problem: I want to have the ld=
if
> > output in a file, not in standard output, and so: how can I do? what
> > paramenter I have to pass to LDIFWriter in place of sys.stdout ?
>
> Simply pass a file object as argument:
>
> f =3D open('/tmp/dirbackup.ldif','wb')
> ldif_writer=3Dldif.LDIFWriter(f)
>
> Ciao, Michael.
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by Yahoo.
> Introducing Yahoo! Search Developer Network - Create apps using Yahoo!
> Search APIs Find out how you can build Yahoo! directly into your own
> Applications - visit http://developer.yahoo.net/?fr=3Doffad-ysdn-ostg-q22=
005
> _______________________________________________
> Python-LDAP-dev mailing list
> Pyt...@li...
> https://lists.sourceforge.net/lists/listinfo/python-ldap-dev

=2D-=20
Dott. Fabio Marcone

2T srl
Telefono   +39 - 0871- 540154   =20
=46ax           +39 - 0871- 571594  =20
Indirizzo  Viale B. Croce 573, 66013 Chieti Scalo (CH)

Re: LDIFWriter

[<mi...@st...>]

Fabio Marcone wrote:
> I need to backup an ldap directory from python. I try to follow example in 
> docs about LDIFWriter but I have this problem: I want to have the ldif output 
> in a file, not in standard output, and so: how can I do? what paramenter I 
> have to pass to LDIFWriter in place of sys.stdout ?

Simply pass a file object as argument:

f = open('/tmp/dirbackup.ldif','wb')
ldif_writer=ldif.LDIFWriter(f)

Ciao, Michael.

LDIFWriter

[Fabio M. <fab...@du...>]

Hi!
I need to backup an ldap directory from python. I try to follow example in 
docs about LDIFWriter but I have this problem: I want to have the ldif output 
in a file, not in standard output, and so: how can I do? what paramenter I 
have to pass to LDIFWriter in place of sys.stdout ?

Thanks in advance,
Fabio Marcone
-- 
Dott. Fabio Marcone

2T srl
Telefono   +39 - 0871- 540154    
Fax           +39 - 0871- 571594   
Indirizzo  Viale B. Croce 573, 66013 Chieti Scalo (CH)

Re: [Patch] RFC 2696 and reception of server controls

[<mi...@st...>]

Ames Andreas wrote:
> 
> the attached patch tries to implement what subject says.

Many thanks for your patch submission. I'll review and test it. This
will take a couple of days before I can follow-up.

I'd like to encourage other list members to test and comment too.

Ciao, Michael.

[Patch] RFC 2696 and reception of server controls

[Ames A. <And...@co...>]

Hi all,

the attached patch tries to implement what subject says.  It is barely
tested (only against Active Directory) and it is diffed against stock
2.0.7 release (because I need it this way and because I have no CVS
access by courtesy of a corp. firewall).  It is actually a small
add-on to Deepak Giridharagopal's control patch.

Here is a minimalistic usage example.  You might want to edit the four
constants at the very beginning of the sample code, to make it behave
meaningful in your environment:

------------ <demo> ----------------
url =3D "ldap://your.ldap.server/"
base =3D "ou=3Dyour,dc=3Dbase,dc=3Ddn"
search_flt =3D r'(sn=3Da*)'
page_size =3D 100

import ldap
from ldap.controls import LDAPControl

ldap.set_option(ldap.OPT_REFERRALS, 0)
l =3D ldap.initialize(url)
l.bind_s(r"tnbk1\ts62fr", "webti", ldap.AUTH_SIMPLE)

pctrl_val =3D ldap.encode_page_control(page_size, '')
msgid =3D l.search_ext(base, ldap.SCOPE_SUBTREE, search_flt,
                     =
serverctrls=3D[LDAPControl(ldap.LDAP_CONTROL_PAGE_OID, True, =
pctrl_val)])

pages =3D 0
while True:
    pages +=3D 1
    print "Getting page %d" % (pages,)
    rtype, rdata, rmsgid, serverctrls =3D l.result3(msgid)
    pctrls =3D [c for c in serverctrls if c[0] =3D=3D =
ldap.LDAP_CONTROL_PAGE_OID]
    if pctrls:
        # l.result3 returns raw tuples, no LDAPControl instances
        # this is just a matter of taste and can be easily changed
        est, cookie =3D ldap.decode_page_control(pctrls[0][2])
        if cookie:
            pctrl_val =3D ldap.encode_page_control(page_size, cookie)
            msgid =3D l.search_ext(base, ldap.SCOPE_SUBTREE, search_flt,
                                 =
serverctrls=3D[LDAPControl(ldap.LDAP_CONTROL_PAGE_OID, True, =
pctrl_val)])
        else:
            break
    else:
        print "Warning:  Server ignores RFC 2696 control."
        break
------------ </demo> ----------------


HTH,

aa

--=20
Andreas Ames | Programmer | Comergo GmbH |=20
Voice:  +49 69 7505 3213 | andreas . ames AT comergo . com

Re: Setting password

[Deepak G. <de...@ar...>]

On Tue, 2005-05-24 at 14:21 +0200, Daniel LB wrote:
> Yes, I am doing this with AD.
> I tried what you said and the error message I got back was
> WILL_NOT_PERFORM (Server unwilling to perform), so I'm guessing it's
> because I don't use any encryption on my connection.

Perhaps. AD has the habit of throwing the WILL_NOT_PERFORM error in all
kinds of weird situations. :)

> But, since I'm only connecting to localhost, is encryption really neces=
sary?

The short answer is "yes". :) The long answer is that this is a
restriction that AD imposes upon us:

"The password is stored in the Active Directory on a user object in the
unicodePwd attribute. This attribute can be written under restricted
conditions, but it cannot be read. The attribute can only be modified;
it cannot be added on object creation or queried by a search. In order
to modify this attribute, the client must have a 128-bit Secure Socket
Layer (SSL) connection to the server. For this connection to be
possible, the server must possess a server certificate for a 128-bit RSA
connection, the client must trust the certificate authority (CA) that
generated the server certificate, and both client and server must be
capable of 128-bit encryption."

This is from:
http://support.microsoft.com/default.aspx?scid=3Dkb;en-us;269190

> Anyway.. could you give me an example of how you establish your
> encrypted connection?

What Bj=F8rn says is largely correct, except that with AD you have to go
through some pain to get it to do LDAP/SSL. It's much more painful than
with OpenLDAP, unfortunately (my kingdom for a simple config file!).
Here's what you do:

1) Install an "Enterprise Certificate Authority" onto your AD server.
You can do this through the Control Panel -> "Add/Remove Windows
Components"

2) You'll need to create 2 new "Automatic Certificate Requests", one for
"Computer" and one for "Domain Controller". Do this via "Domain
Controller Security Policy" -> "Computer Configuration" -> "Windows
Settings" -> "Security Settings" -> "Public Key Policies" ->
(right-click on "Automatic Certificate Request Settings) -> (choose
"New") -> (choose "Automatic Certificate Request). Do this step twice,
once to make a "Computer" cert, and once for a "Domain Controller" cert.

3) At this point, you should be able to connect via SSL (I'm not sure if
the AD server requires a reboot or not...)

4) Here's how I establish an SSL connection in Python:

import ldap

# Disable strict certificate checking, since you've made up your
# own certificate for SSL
ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)

# Disable OpenLDAP referral chasing, which can cause trouble with
# AD
ldap.set_option(ldap.OPT_REFERRALS, 0)

# Create the connection
conn =3D ldap.initialize("ldaps://localhost")
conn.simple_bind_s("username", "password")

Ta da!

I know it's a lot of work, but that's the only way I know of to get AD
to do LDAP/SSL. Here is a (pretty worthless) article from MSDN about it:

http://support.microsoft.com/default.aspx?scid=3Dkb;en-us;247078

Hope this helps! :)

Cheers,
deepak

--
Deepak Giridharagopal

Re: Setting password

[Bjorn O. G. <bjo...@it...>]

Daniel LB:
> Yes, I am doing this with AD.
> I tried what you said and the error message I got back was
> WILL_NOT_PERFORM (Server unwilling to perform), so I'm guessing it's
> because I don't use any encryption on my connection.
>=20
> But, since I'm only connecting to localhost, is encryption really neces=
sary?
Depends on wether your server allows non-encrypted authentication or
not. In general, I wouldn't to non-anonumous non-encrypted
authenticaion.

> Anyway.. could you give me an example of how you establish your
> encrypted connection?

TLS:
l =3D ldap.open("localhost")
l.start_tls_s()
# Now we've got tls over port 389
l.simple_bind("someuser","secret")


SSL:
l =3D ldap.initialize("localhost") # use fqdn and/or cn in the certificat=
e here
# That's it.. we've got ldap using SSL -> Secure socket layer
l.simple_bind("someuser","secret")

--=20
Regards
=20
Bj=F8rn Ove Gr=F8tan

Re: Setting password

[Daniel LB <dan...@gm...>]

Yes, I am doing this with AD.
I tried what you said and the error message I got back was
WILL_NOT_PERFORM (Server unwilling to perform), so I'm guessing it's
because I don't use any encryption on my connection.

But, since I'm only connecting to localhost, is encryption really necessary=
?

Anyway.. could you give me an example of how you establish your
encrypted connection?

thanks

//daniel

On 5/23/05, Deepak Giridharagopal <de...@ar...> wrote:
> On Mon, 2005-05-23 at 13:06 +0200, Daniel LB wrote:
> > I have only come across the passwd(user,oldpw,newpw) function, which
> > requires the old password, but if you are logged in as Administrator
> > you should be able to *set* the users' password directly, no?
>=20
> Are you doing this with Active Directory (I ask because you mention
> "Administrator" in your email)? If not, then ignore the rest of this
> message. :)
>=20
> But if so, then here's some code that I use:
>=20
> userdn =3D "cn=3Dfoo,cn=3Dusers,dc=3Dblah,dc=3Dorg"
> pw =3D "1337secret"
>=20
> # AD requires that passwords be enclosed in quotes
> # and properly encoded
> adpw =3D unicode('"' + pw + '"', "iso-8859-1")
> adpw =3D adpw.encode("utf-16-le")
>=20
> # conn is an established LDAP connection
> conn.modify_s(userdn, [(ldap.MOD_REPLACE, "unicodePwd", adpw)])
>=20
> Also, this snippet requires that your LDAP connection to the AD server
> is encrypted. AD won't let you modify certain attributes over an
> unencrypted connection.
>=20
> Cheers!
> deepak
>=20
> --
> Deepak Giridharagopal
>=20
>

Re: Setting password

[Deepak G. <de...@ar...>]

On Mon, 2005-05-23 at 13:06 +0200, Daniel LB wrote:
> I have only come across the passwd(user,oldpw,newpw) function, which
> requires the old password, but if you are logged in as Administrator
> you should be able to *set* the users' password directly, no?

Are you doing this with Active Directory (I ask because you mention
"Administrator" in your email)? If not, then ignore the rest of this
message. :)

But if so, then here's some code that I use:

userdn = "cn=foo,cn=users,dc=blah,dc=org"
pw = "1337secret"

# AD requires that passwords be enclosed in quotes 
# and properly encoded
adpw = unicode('"' + pw + '"', "iso-8859-1")
adpw = adpw.encode("utf-16-le")

# conn is an established LDAP connection
conn.modify_s(userdn, [(ldap.MOD_REPLACE, "unicodePwd", adpw)])

Also, this snippet requires that your LDAP connection to the AD server
is encrypted. AD won't let you modify certain attributes over an
unencrypted connection. 

Cheers!
deepak

--
Deepak Giridharagopal

Re: python-ldap vs. Active directory

[Jens V. <je...@da...>]

On May 22, 2005, at 14:11, Michael Str=F6der wrote:

> Jens Vagelpohl wrote:
>
>> For what it's worth, a long time ago I had the same problems with the
>> LDAPUserFolder Zope product against AD. Among the resultset =20
>> returned  by
>> a query there would always be one record that made everything  =20
>> barf. The
>> (not very clean) workaround has been to special-case that  record and
>> discard it. It is a AD-specific referral.
>>
>
> How did you sort out this special case?
>
> IMO the appropriate way is to sort out the search references.
> Having to deal with referrals / search references is *not* AD-=20
> specific!

I know that references need to be dealt with, however, I have no AD =20
instance to test anything and thus the only goal was to make things =20
work somehow. I personally do not support AD, it's only on the basis =20
of "if it works for you, great. if not, sorry, can't help". Besides, =20
these "invalid" records come back as part of a normal set of search =20
results - leaving them out hasn't made anyone complain yet.

The specific case here is the return value from =20
ldap_connection.search_s, which I assume to be a sequence of two-item =20=

sequences consisting of a string (the DN) and a dictionary (the =20
attributes and their values). However, with AD you can get stuff like =20=

this as part f the results sequence:

(None, ['ldap://ForestDnsZones.PORTAL.LOCAL/=20
DC=3DForestDnsZones,DC=3DPORTAL,DC=3DLOCAL'])

I simply discard anything where the second element is not a dictionary.

jens

Re: Setting password

[Bjorn O. G. <bjo...@it...>]

Daniel LB:
> Hi
>=20
> Is it possible to set a user's password without knowing the old
> password with python-ldap?
>=20
> I have only come across the passwd(user,oldpw,newpw) function, which
> requires the old password, but if you are logged in as Administrator
> you should be able to *set* the users' password directly, no?

Just use the function modify_s to do such modifications.

import ldap
import ldap.modlist as modlist
newattrs =3D {'userPassword': '1337secret'}
old =3D l.search_s(base,ldap.SCOPE_SUBTREE,"uid=3Dsomeuser",[])[0][1]['us=
erPassword'][0]

# Given that you're binding with a user with read-priv to userPassword.
attrs =3D modlist.modifyModlist(old,newattrs)
l.modify_s(dn,attrs)


# Alternatively, make a list of change-commands. I think its documented
# in the module, so just play along with help(ldap.modify_s) or
# something.

--=20
Regards
=20
Bj=F8rn Ove Gr=F8tan

Setting password

[Daniel LB <dan...@gm...>]

Hi

Is it possible to set a user's password without knowing the old
password with python-ldap?

I have only come across the passwd(user,oldpw,newpw) function, which
requires the old password, but if you are logged in as Administrator
you should be able to *set* the users' password directly, no?

//daniel

Re: python-ldap vs. Active directory

[<mi...@st...>]

Jens Vagelpohl wrote:
> 
> 
> For what it's worth, a long time ago I had the same problems with the 
> LDAPUserFolder Zope product against AD. Among the resultset returned  by
> a query there would always be one record that made everything  barf. The
> (not very clean) workaround has been to special-case that  record and
> discard it. It is a AD-specific referral.

How did you sort out this special case?

IMO the appropriate way is to sort out the search references.
Having to deal with referrals / search references is *not* AD-specific!

Ciao, Michael.

Re: python-ldap vs. Active directory

[Jens V. <je...@da...>]

On May 21, 2005, at 23:26, Michael Str=F6der wrote:
>> I was getting the exact same error. I fixed the problem by explicitly
>> disabling referral chasing in the OpenLDAP client libraries (for my
>> purposes, I didn't care about referrals).
>>
>> Before you call ldap.initialize, try:
>>
>> ldap.set_option(ldap.OPT_REFERRALS, 0)
>>
>
> This is good advice since IIRC the OpenLDAP libs chase referrals doing
> an anonymous bind. Therefore it's definitely better to get the search
> references (check the result type). Sort them out or chase the =20
> referrals
> in your Python application.

For what it's worth, a long time ago I had the same problems with the =20=

LDAPUserFolder Zope product against AD. Among the resultset returned =20
by a query there would always be one record that made everything =20
barf. The (not very clean) workaround has been to special-case that =20
record and discard it. It is a AD-specific referral.

Another solution has been to connect to the "Global Catalog" port or =20
somesuch thing. This port apparently gives you a view on the data =20
contained in a forest of AD server instances as one single entity, as =20=

opposed to single AD instances handing back references to other AD =20
instances where a record may be found.

jens

Re: python-ldap vs. Active directory

[<mi...@st...>]

Deepak Giridharagopal wrote:
> On Thu, 2005-05-19 at 15:24 -0700, Sean O'Connell wrote:
> 
>>The results are invariably:
>>
>>initializing ..
>>binding ..
>>Sucessfully bound to AD
>>searching ..
>>{'info': '00000000: LdapErr: DSID-0C0905FF, comment: In order to perform
>>this operation a successful bind must be completed on the connection.,
>>data 0, vece', 'desc': 'Operations error'}
> 
> 
> I was getting the exact same error. I fixed the problem by explicitly
> disabling referral chasing in the OpenLDAP client libraries (for my
> purposes, I didn't care about referrals). 
> 
> Before you call ldap.initialize, try:
> 
> ldap.set_option(ldap.OPT_REFERRALS, 0)

This is good advice since IIRC the OpenLDAP libs chase referrals doing
an anonymous bind. Therefore it's definitely better to get the search
references (check the result type). Sort them out or chase the referrals
in your Python application.

Ciao, Michael.

Re: python-ldap vs. Active directory

[Sean O'C. <oco...@so...>]

On Fri, 2005-05-20 at 17:09 -0500, Deepak Giridharagopal wrote:
> On Thu, 2005-05-19 at 15:24 -0700, Sean O'Connell wrote:
> > The results are invariably:
> > 
> > initializing ..
> > binding ..
> > Sucessfully bound to AD
> > searching ..
> > {'info': '00000000: LdapErr: DSID-0C0905FF, comment: In order to perform
> > this operation a successful bind must be completed on the connection.,
> > data 0, vece', 'desc': 'Operations error'}
> 
> I was getting the exact same error. I fixed the problem by explicitly
> disabling referral chasing in the OpenLDAP client libraries (for my
> purposes, I didn't care about referrals). 
> 
> Before you call ldap.initialize, try:
> 
> ldap.set_option(ldap.OPT_REFERRALS, 0)
> 
> Cheers!
> deepak
> 
> --
> Deepak Giridharagopal

Deepak-

You rock! That definitely solved the problem (of course, it now means I
have more work to do :).


-- 
Sean

Re: python-ldap vs. Active directory

[Deepak G. <de...@ar...>]

On Thu, 2005-05-19 at 15:24 -0700, Sean O'Connell wrote:
> The results are invariably:
> 
> initializing ..
> binding ..
> Sucessfully bound to AD
> searching ..
> {'info': '00000000: LdapErr: DSID-0C0905FF, comment: In order to perform
> this operation a successful bind must be completed on the connection.,
> data 0, vece', 'desc': 'Operations error'}

I was getting the exact same error. I fixed the problem by explicitly
disabling referral chasing in the OpenLDAP client libraries (for my
purposes, I didn't care about referrals). 

Before you call ldap.initialize, try:

ldap.set_option(ldap.OPT_REFERRALS, 0)

Cheers!
deepak

--
Deepak Giridharagopal

Re: python-ldap vs. Active directory

[Jason T. <ja...@ti...>]

Sean,

On Thu, May 19, 2005 at 03:24:13PM -0700, Sean O'Connell wrote:
> I am trying to get a trivial python-ldap script to work talking to our
> campus active directory from a Linux machine (Fedora Core 3 or Centos
> 4), but I am being thwarted. I have successfully used python-ldap
> (same versions) to talk to an openldap server quite happily; however,
> the AD servers are proving to be quite stubborn.

I had trouble when my company switched to AD (i.e., MS Exchange 2000)
from MS Exchange 5.5 too.  Hopefully, the attached script will give you
some ideas to try.  FWIW, it works for me from mutt.

Jason

-- 
PGP/GPG Key: http://www.tishler.net/jason/pubkey.asc or key servers
Fingerprint: 7A73 1405 7F2B E669 C19D  8784 1AFD E4CC ECF4 8EF6

python-ldap vs. Active directory

[Sean O'C. <oco...@so...>]

Folks-

I am trying to get a trivial python-ldap script to work talking to our
campus active directory from a Linux machine (Fedora Core 3 or Centos
4), but I am being thwarted. I have successfully used python-ldap (same
versions) to talk to an openldap server quite happily; however, the AD
servers are proving to be quite stubborn.

The client side software versions are:

openldap (openldap-2.2.13-2 RPM)
python-ldap (python-ldap-2.0.1-2 RPM)
python (python-2.3.4-13.1)

The simple script is as follows, with some silly info tossed in for the
usual reasons.

---------------------------------- snip --------------------------------

import sys
import ldap

myLdapURI="ldap://ad.ucsd.edu"
myBaseDN="dc=ad,dc=ucsd,dc=edu"
myBindDN="cn=AdAccount,ou=foo,ou=bar,dc=ad,dc=ucsd,dc=edu"
myPassWD="LetMeIn" 

# Open the LDAP connection
print "initializing .."
try:
  l = ldap.initialize(myLdapURI)
except ldap.LDAPError,e:
  print e
  sys.exit(1)

# Set protocol version to LDAPv3
l.protocol_version = ldap.VERSION3

# Bind to AD
print "binding .."
try:
  l.bind_s(myBindDN,myPasswd)
except ldap.LDAPError, e:
  print e
  sys.exit(1)
else:
  print 'Sucessfully bound to AD'

#myFilter='(objectclass=*)'
myFilter='(sAMAccountName=AKnownUserInAD)'
myRetrieveAttrs = None
myScope=ldap.SCOPE_SUBTREE

# Do a search
print "searching .."
try:
  myResults = l.search_s(myBaseDN,myScope,myFilter,myRetrieveAttrs)
except ldap.LDAPError, e:
  print e
else:
  print myResults

# Close down the connection
l.unbind()

------------------------------- snip ----------------------------------
The results are invariably:

initializing ..
binding ..
Sucessfully bound to AD
searching ..
{'info': '00000000: LdapErr: DSID-0C0905FF, comment: In order to perform
this operation a successful bind must be completed on the connection.,
data 0, vece', 'desc': 'Operations error'}

It appears to do the bind properly, but seems to forget about it when it
goes to do the search. Whereas, the following returns the desired
results:

ldapsearch -x -w 'LetMeIn' -D
'cn=AdAccount,ou=foo,ou=bar,dc=ad,dc=ucsd,dc=edu' -b
'dc=ad,dc=ucsd,dc=edu' -H ldap://ad.ucsd.edu
'(sAMAccountName=AKnownUserInAD)'

Any ideas what's going on here? Am I missing something obvious? The
command line search also works using kinit (and dropping the -x flag).
The python-ldap doesn't appear to work with SASL at all.

Thanks
-- 
Sean

Re: python-ldap and mac os x tiger, missing symbols

[<mi...@st...>]

Jens Vagelpohl wrote:
>
> On May 17, 2005, at 21:58, Bethany Jane Hanson wrote:
>
>> Hi Jens!  I tried building python 2.4.1 and python-ldap 2.0.7 last
>> night.  Both of them built and installed without errors, but when I
>> ran Python and tried to use the ldap module it complained about
>> missing symbols again:
>> [..]
>> ImportError: Failure linking new module: /usr/local/lib/python2.4/
>> site-packages/_ldap.so: Symbol not found: _ldap_matchingrule_free
>>   Referenced from: /usr/local/lib/python2.4/site-packages/_ldap.so
>>   Expected in: dynamic lookup
>
> I did not see these problems after compiling Python 2.4.1 and python-
> ldap HEAD from CVS anymore, there's not much I can say - it worked
> for me.

Well, then it should also work with python-ldap 2.0.7 compiled from
source since at the moment there's no new code in CVS HEAD.

Ciao, Michael.

Re: python-ldap and mac os x tiger, missing symbols

[Jens V. <je...@da...>]

<putting this back on the list where it belongs>

On May 17, 2005, at 21:58, Bethany Jane Hanson wrote:

> Hi Jens!  I tried building python 2.4.1 and python-ldap 2.0.7 last  
> night.  Both of them built and installed without errors, but when I  
> ran Python and tried to use the ldap module it complained about  
> missing symbols again:
>
> ila:/tmp/python-ldap-2.0.7 root# /usr/local/bin/python
> Python 2.4.1 (#1, May 17 2005, 11:58:55)
> [GCC 3.3 20030304 (Apple Computer, Inc. build 1809)] on darwin
> Type "help", "copyright", "credits" or "license" for more information.
> >>> import ldap
> Traceback (most recent call last):
>   File "<stdin>", line 1, in ?
>   File "/usr/local/lib/python2.4/site-packages/ldap/__init__.py",  
> line 21, in ?
>     from _ldap import *
> ImportError: Failure linking new module: /usr/local/lib/python2.4/ 
> site-packages/_ldap.so: Symbol not found: _ldap_matchingrule_free
>   Referenced from: /usr/local/lib/python2.4/site-packages/_ldap.so
>   Expected in: dynamic lookup

I did not see these problems after compiling Python 2.4.1 and python- 
ldap HEAD from CVS anymore, there's not much I can say - it worked  
for me.

jens

Re: authentication problem

[<mi...@st...>]

Fabio Marcone wrote:
> 
> I've to authenticate users using python and ldap. I have this problem: 
> password in ldap and password calculate using slappasswd are different 
> (password in ldap was calculated using slappasswd too).

You shouldn't validate a password via LDAP by a CompareRequest. Use an
appropriate BindRequest instead.

See http://stroeder.com/proxy_auth_ldap.html for a short example using a
simple bind request.

Whether to protect against a clear text password being transmitted (by
LDAP or StartTLS ext.op. or SASL bind) depends on your security
requirements and the capabilities of your LDAP server.

See Demo/initialize.py for how to use StartTLS ext. op.

See Demo/sasl_bind.py for SASL bind requests.

Ciao, Michael.

authentication problem

[Fabio M. <fab...@du...>]

Hi!

I've to authenticate users using python and ldap. I have this problem: 
password in ldap and password calculate using slappasswd are different 
(password in ldap was calculated using slappasswd too).

How can I authenticate users in another way?

Thanks,
Fabio


-- 
Dott. Fabio Marcone

2T srl
Telefono   +39 - 0871- 540154    
Fax           +39 - 0871- 571594   
Indirizzo  Viale B. Croce 573, 66013 Chieti Scalo (CH)