Re: python-ldap - Operations Error

[theiviaxx]

Thanks for the help guys, it works! I used the
ldap.set_option(ldap.OPT_REFERRALS, 0) from http://peeved.org/blog/2007/11/20/
immedialtey after import, then did the initialize trace_level=2 and
did the simple_bind_s. I was able to search and get the results.
That trace_level thing is nice, i'm sure i will be debugging this more
as i move forward :)

Not sure if this is an AD thing or just something i needed to do with
our particular server/config.

Thanks again!

[t.a.adjuster]

On Apr 24, 2:02 pm, [e-mail] wrote:

Not sure if this is an AD thing or just something i needed to do with
our particular server/config.

Glad to hear my posting helped somebody.

In our case, our domain controller was passing us referrals to the
Configuration, ForestDNSZones, and DomainDNSZones partitions of the
directory when we were doing SCOPE_SUBTREE scoped searches from the
root DN of an AD domain. When python-ldap tried to chase those
referrals it did so with an anonymous bind, hence the error.

Once we turned off the OPT_REFERRALS option, our only other
consideration was to be sure that, when iterating over our search
results, we just scrubbed out the referrals that were returned (based
on the referrals being lists and the real search results being
dictionaries). This is a bit quick and dirty, perhaps, but it's what
did the trick for us.

Evan

[=?ISO-8859-1?Q?Michael_Str=F6der?=]

th*******@gmail.com wrote:

Thanks for the help guys, it works! I used the
ldap.set_option(ldap.OPT_REFERRALS, 0) from http://peeved.org/blog/2007/11/20/

Hmm, maybe I should generally switch off referral chasing in python-ldap
forcing applications to enable it if needed overriding libldap's
default. I did this already for LDAPObject.protocol_version where
libldap's default is LDAPv2 and python-ldap sets it to LDAPv3 in
LDAPObject.__init__(). Although this was an incompatible change no-one
complained.

immedialtey after import, then did the initialize trace_level=2 and
did the simple_bind_s. I was able to search and get the results.
That trace_level thing is nice, i'm sure i will be debugging this more
as i move forward :)

Not sure if this is an AD thing or just something i needed to do with
our particular server/config.

Basically the concept of LDAPv3 referrals is broken since there's no
concept for specifying how to bind to the referral's target without
a-priori local configuration. See also an old posting to
news:microsoft.public.windows.server.active_direct ory related to this:

http://groups.google.com/group/micro...61e0398cc366a5

Ciao, Michael.