From: Todd H. <Tod...@ma...> - 2009-06-23 19:18:21
|
I have a query that was written in python (2.5) utilizing the python-ldap package (newest stable version for both Windows and Linux) to query an Active Directory server for a user's group membership. The code works fine on my test machine (2-3 seconds for result) which is Windows based but when I move the code over and run it on our production Linux (Ubuntu 8.10) server the query hangs for exactly 5 minutes and then displays the results. Does anyone have any ideas where this delay might be coming from and how I can resolve the issue? The code is (please note I replaced some real data i.e. login, password, etc with "????" but in my code real names are there): #!/usr/bin/envpython import ldap import ldap.sasl import sys server = 'ldap://10.200.1.10' user_id = ???? pw = ???? def main(): try: con = ldap.initialize(server) con.simple_bind_s(user_id, pw) print 'Connection Made' except ldap.INVALID_CREDENTIALS: print "Your username or password is incorrect." sys.exit() except ldap.LDAPError, e: if type(e.message) == dict and e.message.has_key('desc'): print 'Error - ' + e.message['desc'] else: print 'Error - ' + str(e) sys.exit() finally: print 'Connected' try: #con.timeout = 10 #con.network_timeout = 10 base_dn = 'dc=mariner,dc=local' filter = "(memberOf=CN=????,CN=Users,DC=????,DC=local)" attrs = ['sn','mail','cn','sAMAccountName','displayName','memberOf'] timeout = 3 results = con.search_s(base_dn, ldap.SCOPE_SUBTREE, filter, attrs) for dn,entry in results: if dn != None: print 'Processing',repr(dn) print entry['sAMAccountName'] print entry['displayName'] print entry['memberOf'] con.unbind() print "" print "Connection Closed" except ldap.LDAPError, e: print 'Error - ' + str(e) sys.exit() # End Of Code ## ### #### if __name__=="__main__": main() Thank You Todd J. Hanson tod...@ma... |
From: Michael S. <mi...@st...> - 2009-06-24 10:18:01
|
Todd Hanson wrote: > > I have a query that was written in python (2.5) utilizing the > python-ldap package (newest stable version for both Windows and Linux) > to query an Active Directory server for a user’s group membership. The > code works fine on my test machine (2-3 seconds for result) which is > Windows based but when I move the code over and run it on our production > Linux (Ubuntu 8.10) server the query hangs for exactly 5 minutes and > then displays the results. Does anyone have any ideas where this delay > might be coming from and how I can resolve the issue? I've also observed strange things like this with MS AD before. I don't know a clear solution. It kind of sounds like a timeout. One very important thing is to double-check the DNS A and PTR RRs for all systems involved and avoid using DNS aliases (CNAME). This is especially true e.g. for SASL bind requests where I experienced strange problems when using IP address instead of FQDN when binding to AD. Ciao, Michael. |
From: Michael S. <mi...@st...> - 2009-06-25 12:03:42
|
Tood, please stay on the python-ldap-dev list (Cc:-ed) so others can learn and answer as well. Todd Hanson wrote: > Michael Ströder [mailto:mi...@st...] wrote: >> Todd Hanson wrote: >>> I have a query that was written in python (2.5) utilizing the >>> python-ldap package (newest stable version for both Windows and >>> Linux) to query an Active Directory server for a user's group >>> membership. The code works fine on my test machine (2-3 seconds for >>> result) which is Windows based but when I move the code over and >>> run it on our production Linux (Ubuntu 8.10) server the query hangs >>> for exactly 5 minutes and then displays the results. >> >> I've also observed strange things like this with MS AD before. I >> don't know a clear solution. It kind of sounds like a timeout. >> >> One very important thing is to double-check the DNS A and PTR RRs for >> all systems involved and avoid using DNS aliases (CNAME). This is >> especially true e.g. for SASL bind requests where I experienced >> strange problems when using IP address instead of FQDN when binding >> to AD. > > The strange thing is I would expect the delay to come when I'm doing > the "con.simple_bind_s(user_id, pw)" but that appears to connect > right away. The delay comes when I issue the "search_s" command. If > it was a DNS or reverse DNS issue I would expect the delay to come on > the connection or is that a wrong assumption? Bear in mind that a Windows domain could be part of a forest with trust relationships etc. So you never know what is resolved internally when processing a search request. I do not claim to be an AD expert though. Maybe you could try asking about this particular issue in a MS-AD-related newsgroup: news:microsoft.public.windows.server.active_directory Ciao, Michael. |
From: Michael S. <mi...@st...> - 2009-06-25 14:39:52
|
Todd Hanson wrote: > I found the resolution!!! If I add the line of code > "con.set_option(ldap.OPT_REFERRALS, 0)" after making the connection > everything runs fine. Why? Search the python-ldap-dev archive. This is a known issue with automatic referral chasing within libldap. Switching it off does not do any harm. Ciao, Michael. |