python-ldap-dev — discussion among developers

authentication - no errors

[Michael E. <men...@ka...>]

I'm still losing my mind with why my python-ldap won't throw 
authentication errors when invalid passwords are passed

I removed all my openldap data from the /var/db/openldap directories 
and subdirectories and created a basic
slapd.conf file as shown here:

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/misc.schema
pidfile         /var/run/slapd.pid
argsfile        /var/run/slapd.args
allows          bind_v2
schemacheck	off

database ldbm
suffix "o=number1customer.com"
rootdn "cn=Directory Manager,o=number1customer.com"

rootpw secret
directory /var/db/openldap/openldap-data/number1customer.com/
cachesize       1000000
dbcachesize     10000000
index uid,cn,sn,givenName pres,eq,sub
sizelimit       20000

access to *
	by self write
	by dn="cn=Directory Manager,o=number1customer.com" write
	by * none

Then did this code
import ldap
try:
         l = ldap.open("127.0.0.1")
         # you should  set this to ldap.VERSION2 if you're using a v2 
directory
         l.protocol_version = ldap.VERSION2
         username = "cn=bogus-cn, o=wrongcompany.com"
         password  = "sjadfkjasfjkl"
         l.simple_bind(username, password)
         print "got here"
except ldap.LDAPError, e:
         print e

This output "got here" with no exceptions.  I still can't figure out 
how to force python-ldap to throw an exception upon entering an invalid 
dn or password or combination thereof.

Any help would be greatly appreciated.   This is definitely a 
python-ldap issue because when I try and do an ldapsearch on the 
command line it gives an error message saying that the dn or password 
is invalid.

Any help or ideas of where to look would be greatly appreciated.   I'm 
running this on Mac OS X (Darwin).   Everything else works perfectly.

Mike

ANN: python-ldap-2.0.0pre11

[<mi...@st...>]

Find a new pre-release of python-ldap:

   http://python-ldap.sourceforge.net/

python-ldap provides an object-oriented API to access LDAP directory
servers from Python programs. It mainly wraps the OpenLDAP 2.x libs for
that purpose. Additionally it contains modules for other LDAP-related
stuff (e.g. processing LDIF, LDAPURLs and LDAPv3 schema).

Download link:
http://prdownloads.sourceforge.net/python-ldap/python-ldap-2.0.0pre11.tar.gz?download

----------------------------------------------------------------
Released 2.0.0pre11 2003-05-02

Changes since 2.0.0pre10:

ldap.ldapobject:
* Cosmetic change: Named argument list for LDAPObject.compare()
   instead of *args,**kwargs.
* Fixed bug in ReconnectLDAPObject._apply_method_s() affecting
   compability with Python 2.0. The bug was introduced with
   2.0.0pre09 by dropping use of apply().

ldap.modlist:
* modifyModlist(): Only None is filtered from attribute value lists,
   '' is preserved as valid attribute value. But filtering applies
   to old_value and new_value now.

ldap.schema:
* Zero-length attribute values for schema elements are ignored
   (needed on e.g. Active Directory)

dsml:
Added support for parsing and generating DSMLv1.
Still experimental though.

Re: determining if bind successful

[Michael E. <men...@ka...>]

OK - did some testing.
When I use this simple piece of test code (note that the password is=20
invalid)

import ldap
dn =3D "cn=3DDirectory Manager, o=3Dtestcompany.com"
password =3D '1234567890'
server =3D ldap.open("127.0.0.1")
server.simple_bind(dn, password)
print "got here"

This binds to the server and no exception is thrown (even though the=20
password is invalid).

When I do this from the command line:
[StoneGroove:~/Desktop] mengelhart% ldapsearch -D "cn=3DDirectory=20
Manager,o=3Dtestcompany.com" -W -x "(ou=3DPeople)"
Enter LDAP Password: 1234567890
ldap_bind: Invalid credentials (49)

I am unable to bind because of the bogus password.

Any other thoughts on what may be causing this problem under=20
python-ldap and not ldapsearch?

Thanks
Mike
On Thursday, May 1, 2003, at 12:34  PM, Michael Str=F6der wrote:

> Michael Engelhart wrote:
>> Hmm. OK - well below are the relevant snippets from LDAPWrapper=20
>> class.  When I pass in a valid dn for "user" and an incorrect=20
>> password, it still binds.   It appears to bind as a user that has no=20=

>> privileges but it doesn't throw an exception.
>
> Strange. Maybe some problems with ACLs (check=20
> http://www.openldap.org/faq/data/cache/189.html)?
>
> Below's a test I did with my local server.
> 1. ldap.INVALID_CREDENTIALS is raised if the password provided does=20
> not match value of attribute 'userPassword'.
> 2. ldap.INAPPROPRIATE_AUTH is raised if entry does not have attribute=20=

> 'userPassword' at all.
> 3. It only binds in the case the password matches.
>
> Best bet is trying to reproduce the same behaviour with OpenLDAP's=20
> ldapsearch and ask on the openldap-software mailing list.
>
> Ciao, Michael.
>
> ------------------------------- snip -------------------------------
> >>> import ldap
> >>> l=3Dldap.initialize('ldap://localhost:1390')
> >>> l.simple_bind_s('uid=3Danna,ou=3DTesting,dc=3Dstroeder,dc=3Dcom','wr=
ong=20
> password')
> Traceback (most recent call last):
>   File "<stdin>", line 1, in ?
>   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line=20
> 435, in simple_bind_s
>     self.bind_s(who,passwd,_ldap.AUTH_SIMPLE)
>   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line=20
> 154, in bind_s
>     self.result(msgid,all=3D1,timeout=3Dself.timeout)
>   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line=20
> 334, in result
>     return self._ldap_call(self._l.result,msgid,all,timeout)
>   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line 90,=20=

> in _ldap_call
>     result =3D func(*args,**kwargs)
> ldap.INVALID_CREDENTIALS: {'info': '', 'desc': 'Invalid credentials'}
> >>> l.simple_bind_s('cn=3DMichael=20
> Stroeder,ou=3DTesting,dc=3Dstroeder,dc=3Dcom','wrong password')
> Traceback (most recent call last):
>   File "<stdin>", line 1, in ?
>   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line=20
> 435, in simple_bind_s
>     self.bind_s(who,passwd,_ldap.AUTH_SIMPLE)
>   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line=20
> 154, in bind_s
>     self.result(msgid,all=3D1,timeout=3Dself.timeout)
>   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line=20
> 334, in result
>     return self._ldap_call(self._l.result,msgid,all,timeout)
>   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line 90,=20=

> in _ldap_call
>     result =3D func(*args,**kwargs)
> ldap.INAPPROPRIATE_AUTH: {'info': '', 'desc': 'Inappropriate=20
> authentication'}
> >>> l.simple_bind_s('uid=3Danna,ou=3DTesting,dc=3Dstroeder,dc=3Dcom','an=
na')
> >>>
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Python-LDAP-dev mailing list
> Pyt...@li...
> https://lists.sourceforge.net/lists/listinfo/python-ldap-dev
>

Module dsml

[<mi...@st...>]

HI!

I've checked in a new stand-alone module called dsml (file Lib/dsml.py) 
which generates and parses DSMLv1 based on SAX parser in Python's standard 
lib. Since this is my first attempt implementing something XML-ish feedback 
of XML gurus is highly appreciated.

I'm not sure whether DSMLv1 still makes sense though.
http://www.dsml.org seems to be non-existent.
:-/

Ciao, Michael.

Re: determining if bind successful

[<mi...@st...>]

Michael Engelhart wrote:
> class LDAPWrapper:
> 
>     def __init__(self, user="", password=""):
>         try:
>             self.server = ldap.open("127.0.0.1")
>             self.server.simple_bind(user, password)

Note also that 'user' has to be a complete DN of an existing entry!

Ciao, Michael.

Re: determining if bind successful

[<mi...@st...>]

Michael Engelhart wrote:
> Hmm. OK - well below are the relevant snippets from LDAPWrapper class.  
> When I pass in a valid dn for "user" and an incorrect password, it still 
> binds.   It appears to bind as a user that has no privileges but it 
> doesn't throw an exception.

Strange. Maybe some problems with ACLs (check 
http://www.openldap.org/faq/data/cache/189.html)?

Below's a test I did with my local server.
1. ldap.INVALID_CREDENTIALS is raised if the password provided does not 
match value of attribute 'userPassword'.
2. ldap.INAPPROPRIATE_AUTH is raised if entry does not have attribute 
'userPassword' at all.
3. It only binds in the case the password matches.

Best bet is trying to reproduce the same behaviour with OpenLDAP's 
ldapsearch and ask on the openldap-software mailing list.

Ciao, Michael.

------------------------------- snip -------------------------------
 >>> import ldap
 >>> l=ldap.initialize('ldap://localhost:1390')
 >>> l.simple_bind_s('uid=anna,ou=Testing,dc=stroeder,dc=com','wrong password')
Traceback (most recent call last):
   File "<stdin>", line 1, in ?
   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line 435, in 
simple_bind_s
     self.bind_s(who,passwd,_ldap.AUTH_SIMPLE)
   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line 154, in 
bind_s
     self.result(msgid,all=1,timeout=self.timeout)
   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line 334, in 
result
     return self._ldap_call(self._l.result,msgid,all,timeout)
   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line 90, in 
_ldap_call
     result = func(*args,**kwargs)
ldap.INVALID_CREDENTIALS: {'info': '', 'desc': 'Invalid credentials'}
 >>> l.simple_bind_s('cn=Michael 
Stroeder,ou=Testing,dc=stroeder,dc=com','wrong password')
Traceback (most recent call last):
   File "<stdin>", line 1, in ?
   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line 435, in 
simple_bind_s
     self.bind_s(who,passwd,_ldap.AUTH_SIMPLE)
   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line 154, in 
bind_s
     self.result(msgid,all=1,timeout=self.timeout)
   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line 334, in 
result
     return self._ldap_call(self._l.result,msgid,all,timeout)
   File "/usr/lib/python2.2/site-packages/ldap/ldapobject.py", line 90, in 
_ldap_call
     result = func(*args,**kwargs)
ldap.INAPPROPRIATE_AUTH: {'info': '', 'desc': 'Inappropriate authentication'}
 >>> l.simple_bind_s('uid=anna,ou=Testing,dc=stroeder,dc=com','anna')
 >>>

Re: determining if bind successful

[Michael E. <men...@ka...>]

Hmm. OK - well below are the relevant snippets from LDAPWrapper class. =20=

When I pass in a valid dn for "user" and an incorrect password, it=20
still binds.   It appears to bind as a user that has no privileges but=20=

it doesn't throw an exception.   I'm running openldap 2.1 on Mac OS X=20
10.2.5 if that makes a difference.   Are the OpenLDAP settings that=20
override this behavior that I can adjust.     It's very odd to me that=20=

it wouldn't "always" throw an exception or what's the point of the=20
authentication step! :-)


Thanks
Mike


class LDAPWrapper:

	def __init__(self, user=3D"", password=3D""):
		try:
			self.server =3D ldap.open("127.0.0.1")
			self.server.simple_bind(user, password)
		except ldap.LDAPError, e:
			print "general LDAP error ", e
		except ldap.INVALID_CREDENTIALS, e:
			print "Invalid Credentials", e
		except ldap.INAPPROPRIATE_AUTH, e:
			print "Inappropriate Auth", e
		=09
On Thursday, May 1, 2003, at 12:03  PM, Michael Str=F6der wrote:

> Michael Engelhart wrote:
>> Is there anything in the API that will let you determine whether a=20
>> particular users login was successful or not?  I'm using simple_bind=20=

>> to bind a user but it appears that if you type in anything, it will=20=

>> accept but just not give access rights.  I want to be able to display=20=

>> a web page after a user tries to login that says "Username/Password=20=

>> were incorrect. please try again."
>
> Mainly if simple_bind_s(who,cred) was successful with a non-empty=20
> password in cred the "login" was successful. Otherwise one of the=20
> following exceptions is usually raised:
>
> ldap.INVALID_CREDENTIALS
>
> ldap.INAPPROPRIATE_AUTH
>
> Note the "usual" in the sentence above. Details depend very much on=20
> your LDAP server (which one?). Many weird things out there...
>
> Ciao, Michael.
>
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Python-LDAP-dev mailing list
> Pyt...@li...
> https://lists.sourceforge.net/lists/listinfo/python-ldap-dev
>

Re: determining if bind successful

[<mi...@st...>]

Michael Engelhart wrote:
> 
> Is there anything in the API that will let you determine whether a 
> particular users login was successful or not?  I'm using simple_bind to 
> bind a user but it appears that if you type in anything, it will accept 
> but just not give access rights.  I want to be able to display a web 
> page after a user tries to login that says "Username/Password were 
> incorrect. please try again."

Mainly if simple_bind_s(who,cred) was successful with a non-empty password 
in cred the "login" was successful. Otherwise one of the following 
exceptions is usually raised:

ldap.INVALID_CREDENTIALS

ldap.INAPPROPRIATE_AUTH

Note the "usual" in the sentence above. Details depend very much on your 
LDAP server (which one?). Many weird things out there...

Ciao, Michael.

determining if bind successful

[Michael E. <men...@ka...>]

Hi -

Is there anything in the API that will let you determine whether a 
particular users login was successful or not?  I'm using simple_bind to 
bind a user but it appears that if you type in anything, it will accept 
but just not give access rights.  I want to be able to display a web 
page after a user tries to login that says "Username/Password were 
incorrect. please try again."

Thanks
Mike

Re: Win32 anyone?

[<mi...@st...>]

Mauro Cicognini wrote:
> Michael Str=F6der wrote:
>=20
>> Once again I'd like to ask whether anybody has built a native Win32=20
>> version of recent python-ldap. Would be nice to have a maintainer for =

>> Win32 binaries.
>=20
> Hmm, given the low to very-low level of win32 traffic on the list, I=20
> might even ask if there's any interest for it.

There is! Otherwise I wouldn't ask.

> Anyway, for all it's worth, I volounteer to be the win32 maintainer,=20

Great.

> Anyway, if anyone's interested, I can provide a native windows installe=
r=20
> for python-ldap, packaged with the python dist tools.

Yes, please build one for Python 2.2.x. You can send the files to me and =

I'll add it to the file release system on SourceForge. Not sure if it's=20
necessary to have a complete Windows installer though.

How much effort is this for you? Can it be automated to some extent? If i=
t's=20
much work I'd like to make a next release with some small enhancements/fi=
xes=20
before you start the build.

Ciao, Michael.

Re: Win32 anyone?

[Mauro C. <mci...@si...>]

Michael Ströder wrote:

> HI!
>
> Once again I'd like to ask whether anybody has built a native Win32 
> version of recent python-ldap. Would be nice to have a maintainer for 
> Win32 binaries.
>
> Ciao, Michael.

Hmm, given the low to very-low level of win32 traffic on the list, I 
might even ask if there's any interest for it.

Anyway, for all it's worth, I volounteer to be the win32 maintainer, 
since it appears I'm almost the only one using python-ldap under windows :-)
Still, I'm sorry I can't participate in the devel discussions; given the 
very low amount of time I have for this job I prefer to wait for stable 
(or almost-stable) versions before I attempt a native compile under windows.

Anyway, if anyone's interested, I can provide a native windows installer 
for python-ldap, packaged with the python dist tools.

Mauro

Win32 anyone?

[<mi...@st...>]

HI!

Once again I'd like to ask whether anybody has built a native Win32 version 
of recent python-ldap. Would be nice to have a maintainer for Win32 binaries.

Ciao, Michael.

Re: Bug#175710: python-ldap modlist patch

[<mi...@st...>]

Domenico Andreoli wrote:
> On Sun, Apr 20, 2003 at 08:05:32PM +0200, Michael Str?der wrote:
> 
>>I've checked in a new version with the following change:
>>
> 
> where did you checked the stuff in? i'm looking at the sourceforge CVS
> repository but i still do not see any change :(

Aaargh! Sorry. Done now.

Ciao, Michael.

Re: Bug#175710: python-ldap modlist patch

[<ca...@fi...>]

On Sun, Apr 20, 2003 at 08:05:32PM +0200, Michael Str?der wrote:
> 
> I've checked in a new version with the following change:
> 
where did you checked the stuff in? i'm looking at the sourceforge CVS
repository but i still do not see any change :(

-----[ Domenico Andreoli, aka cavok
 --[ http://filibusta.crema.unimi.it/~cavok/gpgkey.asc
   ---[ 3A0F 2F80 F79C 678A 8936  4FEE 0677 9033 A20E BC50

Re: Bug#175710: python-ldap modlist patch

[<mi...@st...>]

Michael Str=F6der wrote:
> I will check whether it's feasible to filter() old_value. I had some=20
> problems with broken iPlanet DS 5.1 (prior SP1) which returned [] as=20
> attribute value in search results.
>=20
> Additionally I've learned in the mean-time that some attributes might=20
> hold empty strings (e.g. attributes of DirectoryString syntax).=20
> Therefore using filter(None,valuelist) might be problematic anyway and =

> might be dropped completely from modifyModList().
> =3D> you're safe if your code leaves out non-existent attributes comple=
tely.

I've checked in a new version with the following change:

-------------------------- snip --------------------------
ldap.modlist:
* modifyModlist(): Only None is filtered from attribute value lists,
   '' is preserved as valid attribute value. But filtering applies
   to old_value and new_value now.
-------------------------- snip --------------------------

Please test!

Ciao, Michael.

Re: Bug#175710: python-ldap modlist patch

[<mi...@st...>]

Domenico Andreoli wrote:
 >
 > On Sun, Apr 20, 2003 at 11:54:52AM +0200, Michael Str?der wrote:
 >
 >>1. Note that your code does not work with OpenLDAP 2.1.x since this
 >>version
 >>does stricter error checking on entry data:
 >>
 >>ldap.NAMING_VIOLATION: {'info': "naming attribute 'uid' is not present in
 >>entry", 'desc': 'Naming violation'}
 >
 > please change the dn to whatever works for you,

I did.

 > the problem is not here.

Just for the records: The entry MUST contain uid attribute with recent 
OpenLDAP 2.1.x which does stricter checking than e.g. OpenLDAP 2.0.x.

 >>2. Strictly spoken you are creating an invalid entry with
 >>
 >>entry = make_entry(None)
 >>
 >>The attribute value list of attribute 'description' is simply [ None ]
 >>which is filtered in modifyModlist() to []. But it means that the
 >>attribute
 >>is assumed to be existent in the old_entry. Non-existent attributes should
 >>not appear in the entry data at all.
 >
 > if you state that non-existent attributes should be left out, my standing
 > point is, of course, wrong and all this discussion is a non-sense.

Yes, non-existent attributes should be left out.

 > then, please note that your code is inconsistent with your affirmation
 > because of the last check ("elif old_value and not new_value"). here
 > you are explicitly checking whether new_value does not exist and then
 > whether the corresponding attribute is non-existent.

I will check that.

 >>Note: The diffing in modifyModlist() loops over new_entry.keys(). Whether
 >>an attribute is present in old_entry is determined by existence of the
 >>attribute type name in the dictionary's keys.
 >
 > this is the point. None is threated as "null-string" (and then filtered)
 > if found in new_value and as "present" if found in old_value. this is
 > not a problem unless it is the only item of the list (like in my case).
 >
 > indeed "if [None]" evaluates to true, while "if []" evaluates to false.
 >
 > if you filtered also old_value, you would handle perfectly the case of
 > non-existent attributes. the choice is yours.

I will check whether it's feasible to filter() old_value. I had some 
problems with broken iPlanet DS 5.1 (prior SP1) which returned [] as 
attribute value in search results.

Additionally I've learned in the mean-time that some attributes might hold 
empty strings (e.g. attributes of DirectoryString syntax). Therefore using 
filter(None,valuelist) might be problematic anyway and might be dropped 
completely from modifyModList().
=> you're safe if your code leaves out non-existent attributes completely.

For a complete solution modifyModList() would have to look at the schema to 
use the appropriate matching rules...

Ciao, Michael.

Re: Bug#175710: python-ldap modlist patch

[<ca...@fi...>]

hi Michael,

On Sun, Apr 20, 2003 at 11:54:52AM +0200, Michael Str?der wrote:
> 1. Note that your code does not work with OpenLDAP 2.1.x since this version 
> does stricter error checking on entry data:
> 
> ldap.NAMING_VIOLATION: {'info': "naming attribute 'uid' is not present in 
> entry", 'desc': 'Naming violation'}
> 
please change the dn to whatever works for you, the problem is not here.

> 2. Strictly spoken you are creating an invalid entry with
> 
> entry = make_entry(None)
> 
> The attribute value list of attribute 'description' is simply [ None ] 
> which is filtered in modifyModlist() to []. But it means that the attribute 
> is assumed to be existent in the old_entry. Non-existent attributes should 
> not appear in the entry data at all.
> 
if you state that non-existent attributes should be left out, my standing
point is, of course, wrong and all this discussion is a non-sense.

then, please note that your code is inconsistent with your affirmation
because of the last check ("elif old_value and not new_value"). here
you are explicitly checking whether new_value does not exist and then
whether the corresponding attribute is non-existent.

> Note: The diffing in modifyModlist() loops over new_entry.keys(). Whether 
> an attribute is present in old_entry is determined by existence of the 
> attribute type name in the dictionary's keys.
> 
this is the point. None is threated as "null-string" (and then filtered)
if found in new_value and as "present" if found in old_value. this is
not a problem unless it is the only item of the list (like in my case).

indeed "if [None]" evaluates to true, while "if []" evaluates to false.

if you filtered also old_value, you would handle perfectly the case of
non-existent attributes. the choice is yours.

> Ciao, Michael.
> 
ciao :)
domenico

-----[ Domenico Andreoli, aka cavok
 --[ http://filibusta.crema.unimi.it/~cavok/gpgkey.asc
   ---[ 3A0F 2F80 F79C 678A 8936  4FEE 0677 9033 A20E BC50

Re: Bug#175710: python-ldap modlist patch

[<mi...@st...>]

Domenico Andreoli wrote:
> hi Michael,
> 
> the patch you are referring to is already in the python-ldap version i'm
> using and the problem is right in the "modlist.append((ldap.MOD_DELETE,attrtype,None))".
> the error i get is from deletion of an inexistent entry.
> 
> i attached an example to reproduce the bug.

1. Note that your code does not work with OpenLDAP 2.1.x since this version 
does stricter error checking on entry data:

ldap.NAMING_VIOLATION: {'info': "naming attribute 'uid' is not present in 
entry", 'desc': 'Naming violation'}

2. Strictly spoken you are creating an invalid entry with

entry = make_entry(None)

The attribute value list of attribute 'description' is simply [ None ] which 
is filtered in modifyModlist() to []. But it means that the attribute is 
assumed to be existent in the old_entry. Non-existent attributes should not 
appear in the entry data at all.

Note: The diffing in modifyModlist() loops over new_entry.keys(). Whether an 
attribute is present in old_entry is determined by existence of the 
attribute type name in the dictionary's keys.

Ciao, Michael.

Re: Bug#175710: python-ldap modlist patch

[<ca...@fi...>]

of course i forgot the attachment..

On Sat, Apr 19, 2003 at 10:39:03PM +0200, Domenico Andreoli wrote:
> hi Michael,
> 
> the patch you are referring to is already in the python-ldap version i'm
> using and the problem is right in the "modlist.append((ldap.MOD_DELETE,attrtype,None))".
> the error i get is from deletion of an inexistent entry.
> 
> i attached an example to reproduce the bug.
> 
> cheers
> cavok
> 
> On Fri, Apr 04, 2003 at 08:53:06PM +1000, Peter Hawkins wrote:
> > Well, I'm not sure but I think I already fixed this in a different way:
> > 
> > http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/python-ldap/python-ldap/Lib/ldap/modlist.py.diff?r1=1.11&r2=1.12
> > 
> > Comment:
> > "Replace an attribute value by deleting it completely and re-add the whole
> > attribute value list. This is necessary to make it work with attributes for
> > which no matching rules are implemented. The caveat is that it might trigger
> > mor attribute indexing depending on LDAP server implementation."
> > 

-----[ Domenico Andreoli, aka cavok
 --[ http://filibusta.crema.unimi.it/~cavok/gpgkey.asc
   ---[ 3A0F 2F80 F79C 678A 8936  4FEE 0677 9033 A20E BC50

Re: Bug#175710: python-ldap modlist patch

[<ca...@fi...>]

hi Michael,

the patch you are referring to is already in the python-ldap version i'm
using and the problem is right in the "modlist.append((ldap.MOD_DELETE,attrtype,None))".
the error i get is from deletion of an inexistent entry.

i attached an example to reproduce the bug.

cheers
cavok

On Fri, Apr 04, 2003 at 08:53:06PM +1000, Peter Hawkins wrote:
> Well, I'm not sure but I think I already fixed this in a different way:
> 
> http://cvs.sourceforge.net/cgi-bin/viewcvs.cgi/python-ldap/python-ldap/Lib/ldap/modlist.py.diff?r1=1.11&r2=1.12
> 
> Comment:
> "Replace an attribute value by deleting it completely and re-add the whole
> attribute value list. This is necessary to make it work with attributes for
> which no matching rules are implemented. The caveat is that it might trigger
> mor attribute indexing depending on LDAP server implementation."
> 


-----[ Domenico Andreoli, aka cavok
 --[ http://filibusta.crema.unimi.it/~cavok/gpgkey.asc
   ---[ 3A0F 2F80 F79C 678A 8936  4FEE 0677 9033 A20E BC50

ANN: python-ldap-2.0.0pre10

[<mi...@st...>]

Find a new pre-release of python-ldap:

   http://python-ldap.sourceforge.net/

python-ldap provides an object-oriented API to access LDAP directory
servers from Python programs. It mainly wraps the OpenLDAP 2.x libs for
that purpose. Additionally it contains modules for other LDAP-related
stuff (e.g. processing LDIF, LDAPURLs and LDAPv3 schema).

Download link:
http://prdownloads.sourceforge.net/python-ldap/python-ldap-2.0.0pre10.tar.gz?download

----------------------------------------------------------------
Released 2.0.0pre10 2003-04-19

Changes since 2.0.0pre09:

ldap.schema:
* Emulate BooleanType for compability with Python2.3 in assert
   statements

----------------------------------------------------------------
Released 2.0.0pre09 2003-04-19

Changes since 2.0.0pre08:

Modified setup.py to support Cyrus-SASL 2.x.

ldap.ldapobject:
* apply() is not used anymore since it seems deprecated
* Fixed __setstate__() and __getstate__() of ReconnectLDAPObject

ldap.schema:
* Completed classes for nameForms, dITStructureRules and
   dITContentRules

ANN: python-ldap-2.0.0pre09

[<mi...@st...>]

HI!

Find a new pre-release of python-ldap:

   http://python-ldap.sourceforge.net/

python-ldap provides an object-oriented API to access LDAP directory
servers from Python programs. It mainly wraps the OpenLDAP 2.x libs for
that purpose. Additionally it contains modules for other LDAP-related
stuff (e.g. processing LDIF, LDAPURLs and LDAPv3 schema).

Download link:
http://prdownloads.sourceforge.net/python-ldap/python-ldap-2.0.0pre09.tar.gz?download

Changes since 2.0.0pre08:

Modified setup.py to support Cyrus-SASL 2.x.

ldap.ldapobject:
* apply() is not used anymore since it seems deprecated
* Fixed __setstate__() and __getstate__() of ReconnectLDAPObject

ldap.schema:
* Completed classes for nameForms, dITStructureRules and
   dITContentRules

Re: SASL response is not a SASL BindRequest

[Stuart B. <stu...@co...>]

On Friday, April 18, 2003, at 02:34  AM, Michael Str=F6der wrote:

> Stuart Bishop wrote:
>> Out of the OSX box I'm getting:
> > [..]
>> ldap.AUTH_UNKNOWN: {'info': 'SASL(-4): no mechanism available: No=20
>> worthy mechs found', 'desc': 'Unknown authentication method'}
>
> A wild guess: The SASL plugin libs on this box are not found...

Yup. Turns out that runtime libraries support via distutils is
broken in Python 2.2 under OS X. Python 2.3a2 is working fine,
and I've got a bug report open to fix the distutils problem in
any future 2.2.x release.

Looking good. Thanks for your help on this Michael :-)

--=20
Stuart Bishop <ze...@sh...>
http://shangri-la.dropbear.id.au/

Re: mandrake9.1 install problem

[<mi...@st...>]

Alain Soyeur wrote:
 > I used python-ldap without problems

Which version?

> warning: build_py: file Lib/ldap.py (for module ldap) not found
> warning: build_py: file Lib/ldap/schema.py (for module ldap.schema) not found

These two messages are no problem. It's just an issue with the DistUtils not 
properly recognizing the module packages.

> I tried an install with python setup.py install, but when I use my old 
> scripts, they don't work anymore, with errors like :
> NameError: global name 'SCOPE_SUBTREE' is not defined

Please try the following:

$ python -c "import ldap; print ldap.SCOPE_SUBTREE"
2

Ciao, Michael.

mandrake9.1 install problem

[Alain S. <as...@ac...>]

I used python-ldap without problems on a mandrake 9.0 distribution with r=
edhat=20
rpms (option --nodeps), but this does not work anymore with mandrake 9.1.
 I tried to compile python-ldap-2.0.0pre08.tar.gz, modified setup.cfg :

library_dirs =3D /usr/lib
libs =3D ldap lber resolv

but I get this message with python setup.py build:

running install
running build
running build_py
warning: build_py: file Lib/ldap.py (for module ldap) not found
warning: build_py: file Lib/ldap/schema.py (for module ldap.schema) not f=
ound

I tried an install with python setup.py install, but when I use my old=20
scripts, they don't work anymore, with errors like :
NameError: global name 'SCOPE_SUBTREE' is not defined
...
Anyone has an experience with mandrake 9.1 ?

--=20
Alain Soyeur
Lyc=E9e Fermat Toulouse
http://asoyeur.free.fr