python-ldap-dev — discussion among developers

fetching the structure / obejctClass defs

[Tjabo K. <t.k...@bi...>]

hi,

is it possible to fetch a list of all supported objectClasses and their attribs
from an openLDAP server using python-ldap?

how?

thanks in advance,
 
Tjabo Kloppenburg - billiton internet services GmbH
Entwicklung+Technik
--------------------------------------------------------------
direct phone: 0271/30386-19 direct mail: t.k...@bi...
Weitere Informationen finden Sie unter http://www.billiton.de/

start TLS

[David M. <da...@es...>]

Hello,

I'm interested in working on TLS support in python-ldap.  I have been
meaning look at this for some time, but only recently I finally downloaded
and worked a bit with openldap 2.0.23.  My understanding of client TLS
support (i.e.  command line tools like ldapsearch, or apps that use
libldap) is the following: 

1) it enforces the requirement that the subject DN in the certificate
contain the FQDN of the hostname you supplied,
2) if the FQDN does not match the cn in the subject DN, it will look in
the subjectAltName extension for a match.  This is helpful for load
balancers scenarios where the FQDN would not match the subject DN, 
3) no CA certificate checking is done.

Supposedly steps 1 and 2 are to guard against man-in-the-middle attacks,
but I can't find any reference anywhere for how to configure a client with
a local store of 'trusted root CA certificates'.  This means that a
man-in-the-middle attack is still possible.

Can anyone provide a bit of insight?  Maybe the python-ldap module could
be made a bit more flexible than client apps like ldapsearch in this
regard, say by giving the developer the option of providing certificate
verification callbacks, etc. 

Thanks,

Dave

python-ldap-2.0.0pre04

[<Jel...@Bi...>]

Hi,
my son - who is reading this list too - told me that is ok.
Perhaps my _ldap.so is not correct. I will check that tomorrow.

regards j.k.

Fwd: Re: python-ldap-2.0.0pre04 and _ldap

[Tjabo K. <t.k...@bi...>]

hi jelske :),

> But when I want to use the installed python-ldap,
> /usr/local/lib/python2.2/site-packages/ldap/__init__.py
> wants to import from _ldap
> and that isn't anywhere.
> in site-packages is a _ldap.so.

that's allright. On my suse linux box it is the same - and it runs.
the "from _ldap import *" loads _ldap.so -- I think it is the lib form of a
 package. or a extension library for python, written in C.

this is the output of "rpm -ql python-ldap-2.0.0pre04-45" on my suse box:

/usr/lib/python2.2/site-packages/_ldap.so
/usr/lib/python2.2/site-packages/ldap
/usr/lib/python2.2/site-packages/ldap/__init__.py
/usr/lib/python2.2/site-packages/ldap/__init__.pyc
/usr/lib/python2.2/site-packages/ldap/async.py
/usr/lib/python2.2/site-packages/ldap/async.pyc
/usr/lib/python2.2/site-packages/ldap/functions.py
/usr/lib/python2.2/site-packages/ldap/functions.pyc
/usr/lib/python2.2/site-packages/ldap/ldapobject.py
/usr/lib/python2.2/site-packages/ldap/ldapobject.pyc
/usr/lib/python2.2/site-packages/ldap/modlist.py
/usr/lib/python2.2/site-packages/ldap/modlist.pyc
/usr/lib/python2.2/site-packages/ldapurl.py
/usr/lib/python2.2/site-packages/ldapurl.pyc
/usr/lib/python2.2/site-packages/ldif.py
/usr/lib/python2.2/site-packages/ldif.pyc
/usr/share/doc/packages/python-ldap
/usr/share/doc/packages/python-ldap/README


tk.
--
Mit freundlichem Gruß

Tjabo Kloppenburg - billiton internet services GmbH
Entwicklung+Technik
--------------------------------------------------------------
direct phone: 0271/30386-19 direct mail: t.k...@bi...
Weitere Informationen finden Sie unter http://www.billiton.de/

python-ldap-2.0.0pre04 and _ldap

[<Jel...@Bi...>]

Hi,
I tried to install python-ldap-2.0.0pre04 on Mac OS X.
I have Python 2.2.1 and OpenLDAP 2.

First I get the error message
warning: build_py: file Lib/ldap.py (for module ldap) not found
I think I may ignore that.

But when I want to use the installed python-ldap,
/usr/local/lib/python2.2/site-packages/ldap/__init__.py
wants to import from _ldap
and that isn't anywhere.
in site-packages is a _ldap.so.

regards j.k.

Re: modify method

[Tjabo K. <t.k...@bi...>]

hi,

> If you only want to modify a single attribute it's probably
> overkill to look into (undocumented) sub module ldap.modlist.

undocumented. yes.
I finally managed to alter a single attribute of an object, and it is fairly easy.
Compared to perl it is great fun!

tk.

Re: modify method

[<mi...@st...>]

Tjabo Kloppenburg wrote:
> 
> I'm doing some tests with python ldap.
> bind and search work well, but now I'ld like to take a search result, modify a single field,
> and modify the "data row" in the ldap database.
> 
> ldap.modify() takes a dn and a modifyList, but that seems to be complicated. 
> Is there a way to use the search result to generate the modify list?

If you only want to modify a single attribute it's probably 
overkill to look into (undocumented) sub module ldap.modlist.

Ciao, Michael.

modify method

[Tjabo K. <t.k...@bi...>]

hi,

I'm doing some tests with python ldap.
bind and search work well, but now I'ld like to take a search result, modify a single field,
and modify the "data row" in the ldap database.

ldap.modify() takes a dn and a modifyList, but that seems to be complicated. 
Is there a way to use the search result to generate the modify list?

tk.
+ Tired of coding perl+ldap. +

Re: Type Problem with Exception Handler Error Messages

[Michael <mi...@st...>]

Richard Holbert schrieb:
> 
> I've ran into a problem with the way the exception handler error messages are
> returned by python-ldap.
> [..]
> BINDFAILED {'desc': "Can't contact LDAP server"}
> 
> This is because your exception handler returns e is an instance of a
> dictionary, so I have to do the following:
> [..]
> The exception handler in IO is a bit more straight forward.

Feel free to contribute an implementation of a __str__() method for the
LDAPError class. Should be in Modules/error.c.

Ciao, Michael.

Type Problem with Exception Handler Error Messages

[Richard H. <hol...@os...>]

Dear Michael,

I've ran into a problem with the way the exception handler error messages are 
returned by python-ldap.

I'm trying to print exception handler error messages using the following:

try:
        l.simple_bind_s(login_dn, login_pw)
except ldap.LDAPError, e:
        print "BINDFAILED", e
        sys.exit(1)

But it doesn't work as expected.  Here's what I get:

BINDFAILED {'desc': "Can't contact LDAP server"}

This is because your exception handler returns e is an instance of a 
dictionary, so I have to do the following:

try:
        l.simple_bind_s(login_dn, login_pw)
except ldap.LDAPError, e:
        print "BINDFAILED", e.args[0]['desc']
        sys.exit(1)

To get:

BINDFAILED Can't contact LDAP server

The exception handler in IO is a bit more straight forward.

This example:

try:
        input = open("config.txt","r")
except IOError, e:
        print "CONFIGFILEERROR", e
        sys.exit(1)

yields the following:

CONFIGFILEERROR [Errno 2] No such file or directory: 'config.txt'

Thanks!

Rick

Re: probleme with escape-encoding

[Jens V. <je...@zo...>]

jan,

this list is for the python-ldap module, not for products built on top =
of=20
it. if you have a problem with the LDAPUserFolder please file a tracker=20=

issue:

http://www.dataflake.org/software/tracker

jens


On Monday, May 6, 2002, at 09:36 , Jan Idzikowski wrote:

> hallo,
>
> i have a problem with special german characters like "=F6", "=E4", =
"=FC", "=DF".
> in ldap it is '\xc3\xbc' for '=FC', but when i to get the user from=20
> ldapuserfolder,
> i always get:
>  Error Type: UnicodeError
>  Error Value: ASCII decoding error: ordinal not in range(128)
>
>  in utils.py line 70 'return unicode( st )'
>
>  the problem is, that my entries in utf-8 and when i try unicode(st,=20=

> 'utf-8') it works
>
> have anybody a same problem?
>
> _______________________________________________________________
>
> Have big pipes? SourceForge.net is looking for download mirrors. We =
supply
> the hardware. You get the recognition. Email Us: =
ban...@so...
> _______________________________________________
> Python-LDAP-dev mailing list
> Pyt...@li...
> https://lists.sourceforge.net/lists/listinfo/python-ldap-dev

probleme with escape-encoding

[Jan I. <idz...@at...>]

hallo,

i have a problem with special german characters like "ö", "ä", "ü", "ß".
in ldap it is '\xc3\xbc' for 'ü', but when i to get the user from ldapuserfolder,
i always get:
 Error Type: UnicodeError
 Error Value: ASCII decoding error: ordinal not in range(128)
 
 in utils.py line 70 'return unicode( st )'

 the problem is, that my entries in utf-8 and when i try unicode(st, 'utf-8') it works

have anybody a same problem?

Re: Zope Ldap

[Jens V. <je...@zo...>]

godwin,

these errors have nothing to do with python-ldap and are off-topic on this 
list. however, knowing some of the zope products listed i can give you some 
more or less useful information:

all the product that give you these error messages (UserLDAP, LDAPAdapter,
  ZLAPConnection) have not been updated in over a year (LDAPAdapter) and 
over 2 years (UserLDAP, ZLDAPConnection), respectively. i'm not sure where 
you got them or who told you to download them, i would not even be able to 
find them anymore.

if your goal is to authenticate users in zope using records from a LDAP 
database i suggest you look at the LDAPUserFolder:

http://www.dataflake.org/software/ldapuserfolder

jens


On Monday, May 6, 2002, at 12:03 , Godwin Vaz wrote:

> Hi All
>
> I am new to Zope and am trying to install Ldap under Win2000. I have
> downloaded the .dll anf python files as instructed on Barrys page. I get
> the following errors
>
> 2002-05-06T03:36:26 PROBLEM(100) Init Ambiguous name for method of
> Products.LDAP
> Adapter.LDAPAdapter.LDAPAdapter: "manage_main" != "manage"
> ------
> 2002-05-06T03:36:28 PROBLEM(100) Init Ambiguous name for method of
> Products.Pyth
> onMethod.PythonMethod.PythonMethod: "manage" != "manage_main"
> D:\zope\lib\python\Products\UserLDAP\UserLDAP.py:11: DeprecationWarning:
> the reg
> ex module is deprecated; please use the re module
>   import Globals, App.Undo, socket, regex
> ------
> 2002-05-06T03:36:29 PROBLEM(100) Init Ambiguous name for method of
> Products.User
> LDAP.UserLDAP.UserLDAP: "_mainUser" != "manage"
> ------
> 2002-05-06T03:36:29 PROBLEM(100) Init Ambiguous name for method of
> Products.User
> LDAP.UserLDAP.UserLDAP: "_mainUser" != "manage_main"
> ------
> 2002-05-06T03:36:31 PROBLEM(100) Init Ambiguous name for method of
> Products.ZLDA
> PConnection.Entry.ZopeEntry: "manage_attributes" != "manage_main"
>
> Your help is appreciated.
>
> Thanks once again
>
> Regards
> Godwin
>

Zope Ldap

[Godwin V. <God...@en...>]

Hi All

I am new to Zope and am trying to install Ldap under Win2000. I have
downloaded the .dll anf python files as instructed on Barrys page. I get
the following errors 

2002-05-06T03:36:26 PROBLEM(100) Init Ambiguous name for method of
Products.LDAP
Adapter.LDAPAdapter.LDAPAdapter: "manage_main" != "manage"
------
2002-05-06T03:36:28 PROBLEM(100) Init Ambiguous name for method of
Products.Pyth
onMethod.PythonMethod.PythonMethod: "manage" != "manage_main"
D:\zope\lib\python\Products\UserLDAP\UserLDAP.py:11: DeprecationWarning:
the reg
ex module is deprecated; please use the re module
  import Globals, App.Undo, socket, regex
------
2002-05-06T03:36:29 PROBLEM(100) Init Ambiguous name for method of
Products.User
LDAP.UserLDAP.UserLDAP: "_mainUser" != "manage"
------
2002-05-06T03:36:29 PROBLEM(100) Init Ambiguous name for method of
Products.User
LDAP.UserLDAP.UserLDAP: "_mainUser" != "manage_main"
------
2002-05-06T03:36:31 PROBLEM(100) Init Ambiguous name for method of
Products.ZLDA
PConnection.Entry.ZopeEntry: "manage_attributes" != "manage_main"

Your help is appreciated.

Thanks once again

Regards
Godwin

Finally added Hans' SASL and schema patches

[<mi...@st...>]

HI!

Finally I've added the schema and SASL patches contributed by Hans 
a couple of weeks ago. I did not make noteable changes so far.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Note that some parts of the API needs additional work. Nobody 
should rely on any parts of this implementation for now.

Any complaints about "incompatible" changes made are redirected to 
/dev/null.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Interested developers are encouraged to sync their local CVS tree, 
look at the API and comment.

Ciao, Michael.

Re: opening a connection with more than a single server

[<mi...@st...>]

Jens Vagelpohl wrote:
 > ldap.open doesn't have anything to do with this as
 > far as i know.

It has. Please think again.

 > actually, it now even seems to be supporting two ways to
 > get a connection:
 >
 > ldap.open( 'server:port' )
 > ldap.open( 'server', port )

Note: The exact declaration is currently:

def open(host,port=389,trace_level=0,trace_file=sys.stdout):

 > the only item (for this discussion) that i am looking it is the
 > string 'host'. i know that under 1.10 i could do..
 >
 > ldap.open( 'host1 host2 host3' )

Which is not possible with separate key-word parameter _port_ in
function parameter list of ldap.open().

 > assuming they all run on the default port. i'm not interested
 > in non-default ports here.

Are you kidding?

  > don't get me wrong, i am not trying to warm over some ldap.open
  > declaration semantics.

If it's just an interesting thing go and use ldap.initialize() and
we'll close this thread.

Ciao, Michael.

Re: opening a connection with more than a single server

[Jens V. <je...@zo...>]

we can close the thread, that's fine. for me it was just an interesting=20=

tidbit that someone else revealed to me.

i still maintain that the discussion about ldap.open back in january was=20=

for totally different reasons and doesn't really have any bearing on =
this.

jens

On Thursday, May 2, 2002, at 12:41 , Michael Str=F6der wrote:

> Jens Vagelpohl wrote:
> > ldap.open doesn't have anything to do with this as
> > far as i know.
>
> It has. Please think again.
>
> > actually, it now even seems to be supporting two ways to
> > get a connection:
> >
> > ldap.open( 'server:port' )
> > ldap.open( 'server', port )
>
> Note: The exact declaration is currently:
>
> def open(host,port=3D389,trace_level=3D0,trace_file=3Dsys.stdout):
>
> > the only item (for this discussion) that i am looking it is the
> > string 'host'. i know that under 1.10 i could do..
> >
> > ldap.open( 'host1 host2 host3' )
>
> Which is not possible with separate key-word parameter _port_ in
> function parameter list of ldap.open().
>
> > assuming they all run on the default port. i'm not interested
> > in non-default ports here.
>
> Are you kidding?
>
>  > don't get me wrong, i am not trying to warm over some ldap.open
>  > declaration semantics.
>
> If it's just an interesting thing go and use ldap.initialize() and
> we'll close this thread.
>
> Ciao, Michael.
>

Re: opening a connection with more than a single server

[Jens V. <je...@zo...>]

> Jens, can you please tell us exactly how the declaration of ldap.open() 
> should look like and how the behaviour should be?
>
> I've changed the declaration and behaviour according to your inquiry 
> because you complained about an incompatible change (review thread 
> "signature of ldap.open changed?" started by you).

the declaration of ldap.open doesn't have anything to do with this as far 
as i know. actually, it now even seems to be supporting two ways to get a 
connection:

ldap.open( 'server:port' )
ldap.open( 'server', port )

the only item (for this discussion) that i am looking it is the string 
'host'. i know that under 1.10 i could do..

ldap.open( 'host1 host2 host3' )

assuming they all run on the default port. i'm not interested in 
non-default ports here. if i execute the same on python2.1 and python-ldap 
2.0pre4 i am getting a strange error: ldap.LDAPError: ( 2, 'No such file 
or directory' ).

don't get me wrong, i am not trying to warm over some ldap.open 
declaration semantics. i'm not even trying to badger anyone into bringing 
back this type of behavior, i'm just curious if that's something that 
would be interesting for others and the package as a whole.


>> It's very likely that David did not know about the space-separated 
>> multiple host feature. I'm not even sure if it was available in OpenLDAP 
>> 1.x or Netscape 3 libs. But he defined the ldap.open() function's 
>> interface and old code might be using it.
>
> As I understood your former inquiry you relied on this old behaviour of 
> ldap.open(). Now you're requesting a change.

this whole deal with the space-separated hosts is nothing i ever relied on 
(because i did not know it even worked at all). it was brought to my 
attention by someone else who had been doing it previously and it failed 
after he upgraded python-ldap.

i appreciate your comments regarding long-lived connections. i'll start 
using it when i have time to do more tinkering.

jens

Re: opening a connection with more than a single server

[<mi...@st...>]

Jens Vagelpohl wrote:
>> 1. change the docs and pass string-parameter _host_ to OpenLDAP's 
>> ldap_open() function and drop parameter _port_ or
> 
> the space-separated host list was only used in place of the first argument,
>  "host". i am not sure if you were still able to pass a "port" parameter 
> or what would happen if you did.

Jens, can you please tell us exactly how the declaration of 
ldap.open() should look like and how the behaviour should be?

I've changed the declaration and behaviour according to your 
inquiry because you complained about an incompatible change 
(review thread "signature of ldap.open changed?" started by you).

> comply to which docs? the docs that came with python-ldap 1.10?

The docs weren't changed since 1.x for ldap.open().

 > i have a
> feeling that the author might not have realized that you can send 
> space-separated host names in the "host" portion of the argument list.

It's very likely that David did not know about the space-separated 
multiple host feature. I'm not even sure if it was available in 
OpenLDAP 1.x or Netscape 3 libs. But he defined the ldap.open() 
function's interface and old code might be using it.

As I understood your former inquiry you relied on this old 
behaviour of ldap.open(). Now you're requesting a change.

>> I did that in former versions of web2ldap but dropped support for 
>> python-ldap 1.x because it's getting too complex if you want to do 
>> that completely (referrals, etc.). Also python-ldap does not support 
>> LDAPv3 which has some serious implications if you take RFC2251 ff. 
>> seriously (e.
>> g. character set T.61 for LDAPv2 instead of UTF-8).
> 
> well, my products lack the complexity to really be worried about that. 

Not caring about the complexity does not mean the complexity isn't 
there...

>> Yes, you have to try a LDAPRequest and catch ldap.SERVER_DOWN.
> 
> is there a suitable and simple LDAP request that would work on most 
> servers without knowing what the tree looks like?

Read RootDSE on LDAPv3 servers. Well, that means you have to know 
the protocol version. Also the node of the search root has to be 
existent.

But IMHO you're thinking the wrong way: Just try the LDAPRequest, 
catch ldap.SERVER_DOWN, re-connect/-bind and re-try same 
LDAPRequest if necessary.

>>> never experimented with long-lived connections. i am all for 
>>> improving performance,
>>
>> Well, if you're after performance you should work with persistent 
>> connections. Especially for web2ldap it was a great performance boost 
>> since web2ldap does a lot of special stuff after establishing the 
>> connection. Doing this for each request is a performance nightmare. 
>> Think of negotiating LDAP protocol version, evaluating RootDSE 
>> attributes, more complex bind operations, etc.
> 
> well, again, my products lack that kind of complexity...

Are you sure? ;-)

>  i connect, i bind,
>  i might rebind as someone else, i read and i write. then i disconnect. 
> nothing exotic really.

Not exotical but too many LDAPRequests for being a light-weight 
authenticating process. Also think of the costs when doing a 
connect, especially SSL/TLS connection establishment.

Ciao, Michael.

Re: problems ldap-module on AIX

[<mi...@st...>]

Jan Idzikowski wrote:
 > i have install python with:
 > ./configure --prefix=/home/ji/python --without-gcc 
--with-thread --without-pymalloc --with-cycle-gc

1. Check output of ./configure --help. Option --with-thread is 
deprecated. Use --with-threads.

2. Continue trying --without-cycle-gc as stated in my first reply.

Make sure to re-compile *all* additional extension modules each 
time you change build options.

Ciao, Michael.

Re: problems ldap-module on AIX

[Jan I. <idz...@at...>]

On Thu, 02 May 2002 12:37:01 +0200
Michael Ströder <mi...@st...> wrote:

> Jan Idzikowski wrote:
>  > i have python install with --without-gcc --with-pymalloc 
> --with-cycle-gc
>  > and make CC="cc_r" OPT="-O -qmaxmem=4000"
> 
> Try --without-pymalloc.

i have install python with:
./configure --prefix=/home/ji/python --without-gcc --with-thread --without-pymalloc --with-cycle-gc

with the same problem: 
  import ldap
  l = ldap.initialize("ldap://myldapserver:389")

  Segmentation fault (core dumped)

and in the core dump:
  reading symbolic information ...
  [using memory image in core]

  Segmentation fault in ldap_search_ext at 0xd228a0a8 ($t1)
  0xd228a0a8 (ldap_search_ext+0x218) 800c0000        lwz   r0,0x0(r12)

do you have any idee?

greeting jan

Re: opening a connection with more than a single server

[Jens V. <je...@zo...>]

> 1. change the docs and pass string-parameter _host_ to OpenLDAP's 
> ldap_open() function and drop parameter _port_ or

the space-separated host list was only used in place of the first argument,
  "host". i am not sure if you were still able to pass a "port" parameter or 
what would happen if you did.


> 2. comply to the docs which means not supporting the 
> multiple-hosts-in-space-separated-list parameter.

comply to which docs? the docs that came with python-ldap 1.10? i have a 
feeling that the author might not have realized that you can send 
space-separated host names in the "host" portion of the argument list.


> If you don't get the difference I'm pretty sure that you've never used to 
> connect to a LDAP server running on "non-standard" port...

well of course i have ;)  all my products allow selecting nonstandard ports,
  too.


> I did that in former versions of web2ldap but dropped support for 
> python-ldap 1.x because it's getting too complex if you want to do that 
> completely (referrals, etc.). Also python-ldap does not support LDAPv3 
> which has some serious implications if you take RFC2251 ff. seriously (e.
> g. character set T.61 for LDAPv2 instead of UTF-8).

well, my products lack the complexity to really be worried about that. no 
one has ever come to me and said they couldn't get things to work using 
referrals :)  and i don't think i'll try to provide that ability.


>> if i remember correctly i had at one time tried to come up with a way to 
>> test whether a given LDAP connection object was still good for use, but 
>> could not find anything that would not already involve making LDAP 
>> queries.
>
> Yes, you have to try a LDAPRequest and catch ldap.SERVER_DOWN.

is there a suitable and simple LDAP request that would work on most servers 
without knowing what the tree looks like?


> > i have
>> never experimented with long-lived connections. i am all for improving 
>> performance, if you can show me a good way to test existing connection 
>> objects and tell me that it is indeed faster to do it, i'm all ears.
>
> Well, if you're after performance you should work with persistent 
> connections. Especially for web2ldap it was a great performance boost 
> since web2ldap does a lot of special stuff after establishing the 
> connection. Doing this for each request is a performance nightmare. Think 
> of negotiating LDAP protocol version, evaluating RootDSE attributes, more 
> complex bind operations, etc.

well, again, my products lack that kind of complexity...  i connect, i bind,
  i might rebind as someone else, i read and i write. then i disconnect. 
nothing exotic really.

jens

Re: problems ldap-module on AIX

[<mi...@st...>]

Jan Idzikowski wrote:
 > i have python install with --without-gcc --with-pymalloc 
--with-cycle-gc
 > and make CC="cc_r" OPT="-O -qmaxmem=4000"

Try --without-pymalloc.

Ciao, Michael.

Re: problems ldap-module on AIX

[Jan I. <idz...@at...>]

On Tue, 30 Apr 2002 20:12:37 +0200
Michael Ströder <mi...@st...> wrote:

> Jan Idzikowski wrote:
>  >
>  > i have a problem with the ldap-module on AIX.
> 
> Disclaimer: I have no personal experience on AIX and
> IBM's C compiler.
> 
>  > I use Python-2.1.3 installed thread-safe with the IBM
>  > C-Compiler cc_r and the option -qmaxmem=4000.
> 
> I also have no clue what "Python-2.1.3 installed thread-safe" means.
> 
> But please check the options you chose when compiling Python by 
> issuing the following command in Python's source tree.
> 
> $ ./configure --help
> 
> Some candidates for further examination might be:
> 
>    --without-gcc                   never use gcc
>    --with-signal-module            disable/enable signal module
>    --with(out)-threads[=DIRECTORY] disable/enable thread support
>    --with(out)-thread[=DIRECTORY]  deprecated; use
>                                    --with(out)-threads
>    --with-pth                      use GNU pth threading libraries
>    --with(out)-cycle-gc            disable/enable garbage collection
>    --with(out)-pymalloc            disable/enable specialized mallocs
>    --with-wctype-functions         use wctype.h functions
>    --with-dl-dld=DL_DIR,DLD_DIR    GNU dynamic linking
>    --with-fpectl                   enable SIGFPE catching
>

i have python install with --without-gcc --with-pymalloc --with-cycle-gc
and make CC="cc_r" OPT="-O -qmaxmem=4000"

and all looks fine, but the python-ldap-modul get a Segmentation fault,
i have use the dbx (aix debugger) and get the output:

Segmentation fault in ldap_search_ext at 0xd10860a8 ($t1)
0xd10860a8 (ldap_search_ext+0x218) 800c0000        lwz   r0,0x0(r12)

greetings jan

Re: opening a connection with more than a single server

[<mi...@st...>]

Jens Vagelpohl wrote:
>>> i had no idea that this ever worked, but apparently (i verified it 
>>> with python-ldap 1.10alpha3) ldap.open used to accept a hostname 
>>> string as argument with more than one LDAP host, separated by 
>>> whitespace. this worked in a failover fashion where if one became 
>>> unavailable the next one would be used to execute queries.
>>
>>
>> 1. You have to decide what you want. You requested the old "parameter 
>> signature" for ldap.open(). You remember? Think of defining the port 
>> number...
> 
> this actually doesn't have anything to do with my earlier complaints 
> about ldap.open.

It has.

> i'm just saying that apparently back in the 1.10 days 
> ldap.open never checked the parameter and passed it straight to the ldap 
> libraries, which would interpret it as "if the first server is dead just 
> use the second".

Well, we can implement it like this. But it contradicts your 
inquiry for a parameter signature like described in the documentation.

--------------------- snip -----------------------
open(host [, port=PORT])

Opens a new connection with an LDAP server, and return an LDAP 
object (see 1.1.4) used to perform operations on that server. host 
is a string containing solely the host name. port is an integer 
specifying the port where the LDAP server is listening (default is 
389). Note: Using this function is deprecated.
--------------------- snip -----------------------

We can either
1. change the docs and pass string-parameter _host_ to OpenLDAP's 
ldap_open() function and drop parameter _port_ or
2. comply to the docs which means not supporting the 
multiple-hosts-in-space-separated-list parameter.

If you don't get the difference I'm pretty sure that you've never 
used to connect to a LDAP server running on "non-standard" port...

>> 2. I'd recommend you drop support for old python-ldap and use 
>> ldap.initialize() directly.
> 
> my software is written so that it attempts to determine what version of 
> python-ldap is in use and behave accordingly.

I did that in former versions of web2ldap but dropped support for 
python-ldap 1.x because it's getting too complex if you want to do 
that completely (referrals, etc.). Also python-ldap does not 
support LDAPv3 which has some serious implications if you take 
RFC2251 ff. seriously (e.g. character set T.61 for LDAPv2 instead 
of UTF-8).

> i'm just 
> wondering if this "server fallback" behavior could find its way back 
> into python-ldap2, regardless of connection building method used, 
> because it seems it is supported by the OpenLDAP libraries and i am 
> thinking it is a useful behavior. that's all.

Someone has to decide on that. See above.

> if i remember correctly i had at one time tried to come up with a way to 
> test whether a given LDAP connection object was still good for use, but 
> could not find anything that would not already involve making LDAP queries.

Yes, you have to try a LDAPRequest and catch ldap.SERVER_DOWN.

 > i have
> never experimented with long-lived connections. i am all for improving 
> performance, if you can show me a good way to test existing connection 
> objects and tell me that it is indeed faster to do it, i'm all ears.

Well, if you're after performance you should work with persistent 
connections. Especially for web2ldap it was a great performance 
boost since web2ldap does a lot of special stuff after 
establishing the connection. Doing this for each request is a 
performance nightmare. Think of negotiating LDAP protocol version, 
evaluating RootDSE attributes, more complex bind operations, etc.

Ciao, Michael.