python-ldap-dev — discussion among developers

undefined symbol: ber_pvt_opt_on

[David L. <d...@ad...>]

It looks like _ldap.so module was not linked with -lber.
ber_pvt_opt_on was introduced early in the openldap-2.2 branch, so
OpenLDAP-2.2.17 will certainly that symbol.

References:
http://www.openldap.org/devel/cvsweb.cgi/libraries/liblber/options.c (1.35)

d

On Thu, 17 Nov 2004, Gwenaelle Demol typed thusly:

> Hello David Leonard,
>
> I've an error when i import the product Ldap in my python2.3. Do you
> recognise this error ?:
>
>>>> import ldap
> Traceback (most recent call last):
>  File "<stdin>", line 1, in ?
>  File
> "/home/user/Zopes/m8/Python/lib/python2.3/site-packages/ldap/__init__.py", line 21, in ?
>    from _ldap import *
> ImportError:
> /home/user/Zopes/m8/Python/lib/python2.3/site-packages/_ldap.so:
> undefined symbol: ber_pvt_opt_on
> (i use /home/user/Zopes/m8/Python/lib/python2.3  and not the python
> system)
>
> I work on RedHat 9.0, I've installed OpenLDAP-2.2.17
> Before install your products (python-ldap-2.0.5), i've edited the file
> setup.cfg with my librairies directories.
>
> I have no idea about this error. Can you help me ? I searched on the web
> but i don't find any solution to fix it.
>
> Thanks very much
> Gwenaelle Demol
>
>

-- 
David Leonard                           d...@ad...
                                         Ph:+61 404 844 850

Re: SASL/TLS question

[Marc B. <ma...@ms...>]

Michael Str=F6der wrote:

> Feel free to contribute a platform-specific setup.cfg for addition to=20
> the source distribution under directory Build/. The text in file INSTAL=
L=20
> refers to that directory under "Quick build instructions".

On OpenBSD databases/py-ldap comes in two flavors:  with sasl and=20
without.  We can not just provide the one and only OpenBSD setup.cfg=20
because of that.  And it would make no sense as python-ldap is included=20
in the OpenBSD ports collection.  As the maintainer of said port,=20
questions arrise from time to time ;-)

- Marc

Re: SASL/TLS question

[<mi...@st...>]

Marc Balmer wrote:
> 
> Why is SASL/TLS support in python-ldap not enabled by default in configure?

python-ldap is built with the help of Python DistUtils. autoconf's 
configure is not used at all.

See http://docs.python.org/dist/dist.html

> Does it make sense to enable it  by default on platforms that always 
> have tls libs, e.g. on OpenBSD?

Feel free to contribute a platform-specific setup.cfg for addition to 
the source distribution under directory Build/. The text in file INSTALL 
refers to that directory under "Quick build instructions".

Ciao, Michael.

SASL/TLS question

[Marc B. <ma...@ms...>]

HI

Why is SASL/TLS support in python-ldap not enabled by default in configure?

Does it make sense to enable it  by default on platforms that always 
have tls libs, e.g. on OpenBSD?

- Marc

ANN: python-ldap-2.0.5

[<mi...@st...>]

Find a new release of python-ldap:

   http://python-ldap.sourceforge.net/

python-ldap provides an object-oriented API to access LDAP directory
servers from Python programs. It mainly wraps the OpenLDAP 2.x libs for
that purpose. Additionally it contains modules for other LDAP-related
stuff (e.g. processing LDIF, LDAPURLs and LDAPv3 schema).

----------------------------------------------------------------
Released 2.0.5 2004-11-11

Changes since 2.0.4:

Some small improvements for SASL:
The noisy output during SASL bind is avoided now. Interaction
with output on stderr can be enabled by the calling application
by explicitly defining SASL flags.

Removed obsolete directory Win32/.

Lib/:
* Make sure that ldap.sasl.sasl.cb_value_dict is a dictionary
   even when the caller passes in None to argument cb_value_dict
* Added new key-word arg sasl_flags to method
   LDAPObject.sasl_interactive_bind_s()

Modules/:
* l_ldap_sasl_interactive_bind_s():
   New key-word arg sasl_flags passed to
   ldap_sasl_interactive_bind_s()

Re: Python-LDAP-dev digest, Vol 1 #876 - 1 msg

[<mi...@st...>]

Brian Beck wrote:
> Bertrand Croq <ber...@fr...> wrote:
>> 
>>  I wasn't able to find a function to escape chars in DN strings, so I
>>wrote this one (based on escape_filter_chars):
>>
>>def escape_dn_chars(s):
>>[..]
> 
> Alternatively, wouldn't using urllib.quote do nearly the same thing? 
> The only difference I notice is that quote uses a % as an escape
> character instead of \.  That's easily changed...

I strongly dislike abusing urllib.quote since RFC2253 clearly defines a 
certain set of special chars in DNs which surely differs from special 
chars in URLs.

 > Or is there something about LDAP URIs that I'm missing?

We're talking about LDAP DN string representation here (see RFC2253). 
Not about LDAP URLs (as described in RFC2255). LDAP URLs are handled 
through python-ldap's module 'ldapurl'.

Ciao, Michael.

Re: Python-LDAP-dev digest, Vol 1 #876 - 1 msg

[Brian B. <ex...@gm...>]

> 
> s = urllib.quote(s).replace('%', r'\')
> 

Whoops, that should be '\\' instead of r'\' at the end there.

-- 
Brian Beck
Adventurer of the First Order

Re: Python-LDAP-dev digest, Vol 1 #876 - 1 msg

[Brian B. <ex...@gm...>]

> From: Bertrand Croq <ber...@fr...>
> To: pyt...@li...
> Subject: escape_dn_chars
>  
> Hi,
>   I wasn't able to find a function to escape chars in DN strings, so I
> wrote this one (based on escape_filter_chars):
> 
> def escape_dn_chars(s):
>         s =3D s.replace('\\', r'\5C')
>         s =3D s.replace(',', r'\2C')
>         s =3D s.replace('=3D', r'\3D')
>         s =3D s.replace('+', r'\2B')
>         return s
>

Alternatively, wouldn't using urllib.quote do nearly the same thing? 
The only difference I notice is that quote uses a % as an escape
character instead of \.  That's easily changed...

s = urllib.quote(s).replace('%', r'\')

Or is there something about LDAP URIs that I'm missing?


-- 
Brian Beck
Adventurer of the First Order

escape_dn_chars

[Bertrand C. <ber...@fr...>]

Hi,
  I wasn't able to find a function to escape chars in DN strings, so I
wrote this one (based on escape_filter_chars):

def escape_dn_chars(s):
	s =3D s.replace('\\', r'\5C')
	s =3D s.replace(',', r'\2C')
	s =3D s.replace('=3D', r'\3D')
	s =3D s.replace('+', r'\2B')
	return s

Feel free to use/modify it in python-ldap (license: PSFL, as
python-ldap)

--=20
Bertrand Croq - FreesKop - Avenue Robert Schuman - 35170 BRUZ (France)
http://www.freeskop.com/ - Tel: 02 99 05 04 56 - Fax: 02 99 05 96 40

Re: ANN: 2.0.4 win32 build using mingw32

[Mauro C. <mci...@li...>]

Jens Vagelpohl scrive:

>> Anyway, I have uploaded the new binary to my homepage (the one 
>> referred to from http://python-ldap.sourceforge.net/download.shtml) 
>> where it should appear sometime tomorrow.
>>
>> I also have a mingw setup.cfg for our build script, which I propose 
>> to label the "official" win32 compiler, and therefore to remove all 
>> MSVC-related stuff from the HEAD branch of the source tree. I can 
>> provide the script on demand, I won't obvisouly attach it here to 
>> avoid spam.
>
>
> I don't use Windows myself, but as someone whose software relies on 
> the windows library in those cases where people deploy it on Windows 
> I'd like to say thanks!

I'd say You're welcome ;-)

but I think you should rather wait and see some actual successful use 
cases first :-)

Mauro

Re: ANN: 2.0.4 win32 build using mingw32

[Jens V. <je...@da...>]

> Anyway, I have uploaded the new binary to my homepage (the one 
> referred to from http://python-ldap.sourceforge.net/download.shtml) 
> where it should appear sometime tomorrow.
>
> I also have a mingw setup.cfg for our build script, which I propose to 
> label the "official" win32 compiler, and therefore to remove all 
> MSVC-related stuff from the HEAD branch of the source tree. I can 
> provide the script on demand, I won't obvisouly attach it here to 
> avoid spam.

I don't use Windows myself, but as someone whose software relies on the 
windows library in those cases where people deploy it on Windows I'd 
like to say thanks!

jens

Re: SASL/GSSAPI problems

[Wido D. <wid...@gm...>]

On Tue, 09 Nov 2004 00:46:51 +0100, Michael Str=F6der
<mi...@st...> wrote:
> > The solution for my problem was simpler than expected.
> Thanks for letting us know.

> > In my code I
> > had "sasl_cb_value_dict =3D None" instead of "sasl_cb_value_dict =3D {}=
".
> > After correcting this, everything worked. However it would be good if
> > the developer gets a more meaningful error message than 'local error'.
>=20
> Hmm, would the patch below solve this particular problem?

The patch looks ok to me. Thanks for the fast response :)

bye
  Wido
--=20
Wido Depping
ICQ: 51303067    AIM: wido3379
Jabber: wi...@ja...
Blog: http://widoww.blogspot.com

Re: ANN: 2.0.4 win32 build using mingw32

[<mi...@st...>]

Mauro Cicognini wrote:
> I finally got around to updating my win32 binary of Python-LDAP.

Thanks so much for contributing this. I will test it soon.

> Anyway, I have uploaded the new binary to my homepage (the one referred 
> to from http://python-ldap.sourceforge.net/download.shtml) where it 
> should appear sometime tomorrow.

Would you like to see some details explained on this web page about your 
Win32 build?

> I also have a mingw setup.cfg for our build script, which I propose to 
> label the "official" win32 compiler, and therefore to remove all 
> MSVC-related stuff from the HEAD branch of the source tree. I can 
> provide the script on demand, I won't obvisouly attach it here to avoid 
> spam.

Please send this stuff to me personally.

Ciao, Michael.

Re: SASL/GSSAPI problems

[<mi...@st...>]

Wido Depping wrote:
> On Wed, 3 Nov 2004 10:05:34 +0100, Hans Aschauer <han...@ep...> wrote:
>  
>>>SASL/GSSAPI authentication started
>>>Error during LDAP bind request
>>>Reason: {'info': 'SASL(0): successful result: ', 'desc': 'Local error'}
>>
>>This error is most likely due to a wrong setup of kerberos <-> LDAP, and has
>>probably nothing to do with python-ldap.
> 
> The solution for my problem was simpler than expected.

Thanks for letting us know.

> In my code I
> had "sasl_cb_value_dict = None" instead of "sasl_cb_value_dict = {}".
> After correcting this, everything worked. However it would be good if
> the developer gets a more meaningful error message than 'local error'.

Hmm, would the patch below solve this particular problem?

> Beside that, I just want to say that python-ldap is a really nice
> library and it has helped me a lot with my Luma development, altough I
> don't use its full potential :)

I look forward to luma using the full potential of python-ldap... :-)

Ciao, Michael.

Index: Lib/ldap/sasl.py
===================================================================
RCS file: /cvsroot/python-ldap/python-ldap/Lib/ldap/sasl.py,v
retrieving revision 1.11
diff -u -r1.11 sasl.py
--- Lib/ldap/sasl.py    25 Mar 2004 14:57:02 -0000      1.11
+++ Lib/ldap/sasl.py    8 Nov 2004 23:44:36 -0000
@@ -46,7 +46,7 @@
          question-answer pairs. Questions are specified by the respective
          SASL callback id's. The mech argument is a string that specifies
          the SASL mechaninsm to be uesd."""
-        self.cb_value_dict = cb_value_dict
+        self.cb_value_dict = cb_value_dict or {}
          self.mech = mech

      def callback(self,cb_id,challenge,prompt,defresult):

Re: SASL/GSSAPI problems

[Wido D. <wid...@gm...>]

On Wed, 3 Nov 2004 10:05:34 +0100, Hans Aschauer <han...@ep...> wrote:
 
> On Saturday 30 October 2004 02:07, Wido Depping wrote:
> > Hi All,
> > some users of Luma ( http://luma.sf.net ) have problems with binding
> > to a directory using the SASL/GSSAPI method. All these people have a
> > working Kerberos environment and using SASL/MD5 work flawlessly.
> > Here's the output they get from the console:
> >
> > SASL/GSSAPI authentication started
> > Error during LDAP bind request
> > Reason: {'info': 'SASL(0): successful result: ', 'desc': 'Local error'}
> 
> This error is most likely due to a wrong setup of kerberos <-> LDAP, and has
> probably nothing to do with python-ldap. The luma users might look at
> 
> http://www.bayour.com/LDAPv3-HOWTO.html
> 
> which is a great HOWTO for setting up a working ldap server with GSSAPI
> authentication. It also explains the reasons for a 'local error'. BTW, it was
> some time ago that I last looked at python-ldap, but I think that it still is
> built on top of the openldap-libraries. So SASL/GSSAPI will work only if it
> also works using ldapsearch (and vice versa(?)).

Hi All,
The solution for my problem was simpler than expected. In my code I
had "sasl_cb_value_dict = None" instead of "sasl_cb_value_dict = {}".
After correcting this, everything worked. However it would be good if
the developer gets a more meaningful error message than 'local error'.
Beside that, I just want to say that python-ldap is a really nice
library and it has helped me a lot with my Luma development, altough I
don't use its full potential :)

mfg.
  Wido Depping
-- 
Wido Depping
ICQ: 51303067    AIM: wido3379
Jabber: wi...@ja...
Blog: http://widoww.blogspot.com

ANN: 2.0.4 win32 build using mingw32

[Mauro C. <mci...@li...>]

Hi all,
I finally got around to updating my win32 binary of Python-LDAP.

The reason it took so long was that in between my last attempt and today 
the core OpenLDAP developers have dropped MSVC support and now Win32 
platforms are officially supported through mingw32, so all my previous 
work of making Python-LDAP compile using the Microsoft toolchain were 
useless and obsolete :-(

The good news is that the original developer of the OpenLDAP win32 port  
(his name is Lucas Bergman) resumed work on it, as a purely volounteer 
effort, so now we can count on OpenLDAP living on Windows for a while. 
So far his most important achievement has been the re-introduction of 
SSL capabilities (which should be promptly available through Python-LDAP 
too).
On the other hand, the SASL developers seem to be sticking to the MS 
toolchain, therefore since mingw cannot build it, SASL support is not 
available instead... oh well. I sure hope we'll have it back sometime, 
but that isn't currently one of my priorities.

After asking the win32 Python developers for reassurance (it turns out 
mingw-built extensions will work nicely with the ordinary MSVC-built 
interpreter), I had to learn to use mingw32, which was fun (I got around 
building OpenLDAP too) and actually easier than I thought. I used the 
very latest versions of both OpenLDAP (2.2.18) and OpenSSL (0.9.7e) so 
we should really be cutting edge.

Anyway, I have uploaded the new binary to my homepage (the one referred 
to from http://python-ldap.sourceforge.net/download.shtml) where it 
should appear sometime tomorrow.

I also have a mingw setup.cfg for our build script, which I propose to 
label the "official" win32 compiler, and therefore to remove all 
MSVC-related stuff from the HEAD branch of the source tree. I can 
provide the script on demand, I won't obvisouly attach it here to avoid 
spam.

I'd be glad to hear feedback, although, as always, YMMV.

All the best,
Mauro

Re: python-ldap on OS X 10.3

[Jens V. <je...@da...>]

On Nov 3, 2004, at 23:15, Michael Str=F6der wrote:

> Jens Vagelpohl wrote:
>> All I do is remove "sasl2" from the "libs" directive in setup.cfg.=20
>> Then it compiles. Is that enough modification to qualify inclusion as=20=

>> a separate sample setup.cfg?
>
> Well, some people might wanna get spoon-fed. ;-)
>
> Any other platform-specific DistUtils options for e.g.
> binary packages under Mac OS X?

Doing python setup.py --help-commands doesn't reveal anything special=20
for OS X. I don't think there are any OS X-related special options.

jens

Re: python-ldap on OS X 10.3

[<mi...@st...>]

Jens Vagelpohl wrote:
> 
> All I do is remove "sasl2" from the "libs" directive in setup.cfg. Then 
> it compiles. Is that enough modification to qualify inclusion as a 
> separate sample setup.cfg?

Well, some people might wanna get spoon-fed. ;-)

Any other platform-specific DistUtils options for e.g.
binary packages under Mac OS X?

Ciao, Michael.

Re: python-ldap on OS X 10.3

[Jens V. <je...@da...>]

On Nov 3, 2004, at 22:50, Michael Str=F6der wrote:

> Jens Vagelpohl wrote:
> >
> > By default OS X does not have SASL header files. At least I cannot=20=

> find
> > them on my 10.3.5, even though it has sasl-libraries in /usr/lib and
> > /usr/lib/sasl2
>
> I'd add an example setup.cfg for Mac OS X to the source distribution=20=

> under Build/ if you provide one.

Hallo Michael,

All I do is remove "sasl2" from the "libs" directive in setup.cfg. Then=20=

it compiles. Is that enough modification to qualify inclusion as a=20
separate sample setup.cfg?

jens

---------------

Jens Vagelpohl			je...@ze...
Software Engineer			+49-(0)441-36 18 14 38
Zetwork GmbH				http://www.zetwork.com/

Re: python-ldap on OS X 10.3

[<mi...@st...>]

Jens Vagelpohl wrote:
 >
 > By default OS X does not have SASL header files. At least I cannot find
 > them on my 10.3.5, even though it has sasl-libraries in /usr/lib and
 > /usr/lib/sasl2

I'd add an example setup.cfg for Mac OS X to the source distribution under 
Build/ if you provide one.

Ciao, Michael.

Re: python-ldap on OS X 10.3

[Jens V. <je...@da...>]

On Nov 3, 2004, at 17:58, Michael Str=F6der wrote:

> Kyle Mott wrote:
> >
> > include_dirs: /usr/local/openldap-REL_ENG_2_1/include=20
> /usr/include/sasl
> > /usr/local/sasl/include/sasl
> > [..]
> > Modules/LDAPObject.c:20:18: sasl.h: No such file or directory
>
> First I don't know Mac OS X.
>
> But where's your sasl.h located? You have to set the appropriate=20
> include directories in setup.cfg. Or turn off SASL in setup.cfg if you=20=

> don't need it at all.

By default OS X does not have SASL header files. At least I cannot find=20=

them on my 10.3.5, even though it has sasl-libraries in /usr/lib and=20
/usr/lib/sasl2

jens

---------------

Jens Vagelpohl			je...@ze...
Software Engineer			+49-(0)441-36 18 14 38
Zetwork GmbH				http://www.zetwork.com/

Re: python-ldap on OS X 10.3

[<mi...@st...>]

Kyle Mott wrote:
 >
 > include_dirs: /usr/local/openldap-REL_ENG_2_1/include /usr/include/sasl
 > /usr/local/sasl/include/sasl
 > [..]
 > Modules/LDAPObject.c:20:18: sasl.h: No such file or directory

First I don't know Mac OS X.

But where's your sasl.h located? You have to set the appropriate include 
directories in setup.cfg. Or turn off SASL in setup.cfg if you don't need it 
at all.

Ciao, Michael.

Re: SASL/GSSAPI problems

[<mi...@st...>]

Hans Aschauer wrote:
> [to list and OP]
> 
> On Saturday 30 October 2004 02:07, Wido Depping wrote:
> 
>>SASL/GSSAPI authentication started
>>Error during LDAP bind request
>>Reason: {'info': 'SASL(0): successful result: ', 'desc': 'Local error'}
> 
> This error is most likely due to a wrong setup of kerberos <-> LDAP, and has 
> probably nothing to do with python-ldap.

I agree. One would also need to know which version of heimdal or MIT 
Kerberos and which kind of KDC this happens with.

E.g. I did get such errors when using a earlier version of heimdal with a 
KDC of W2K3 Active Directory. In my case this was solved by upgrading 
heimdal. Your mileage may vary.

> So SASL/GSSAPI will work only if it 
> also works using ldapsearch (and vice versa(?)).

Yes. Best advice is to test with OpenLDAP's command-line tool ldapsearch.

Ciao, Michael.

Re: start_tls?

[<mi...@st...>]

Marc Balmer wrote:
> 
> OpenLDAP support start_tls to switch to TLS while talking to a LDAP 
> server.  I found no reference to it in the python-ldap docs.  Is it 
> supported after all?

Yes, it is supported. Check out Demo/initialize.py in the source 
distribution. Hmm, it's missing in the docs...

> BTW:  I am not (yet) subsribed to this list, maybe you answer directly.

Please subscribe. It's very low-traffic. Normally I refuse to answer direct 
e-mails.

Ciao, Michael.

start_tls?

[Marc B. <ma...@ms...>]

Hi

OpenLDAP support start_tls to switch to TLS while talking to a LDAP 
server.  I found no reference to it in the python-ldap docs.  Is it 
supported after all?

- Marc

BTW:  I am not (yet) subsribed to this list, maybe you answer directly.