Question

我认为这是一个通用的ldap问题，但是我已经用python编写了示例代码。

如果我在'root'下方指定dn，我可以搜索对象，但是如果我尝试在树的顶部搜索，则会收到错误消息：

import ldap

server = '<server address>'
realm = '<realm>'
realm_dn = ','.join(['DC=%s' % part for part in realm.lower().split('.')])

l = ldap.initialize('ldap://%s' % server)
auth_tokens = ldap.sasl.gssapi('')
l.sasl_interactive_bind_s('', auth_tokens)

system = 'CN=System,%s' % realm_dn

print('Containers at system:')
result = l.search_s(system, ldap.SCOPE_ONELEVEL, '(objectCategory=Container)', ['cn'])
for i in result:
    print(i[-1]['cn'])

print('Containers at top:')
result = l.search_s(realm_dn, ldap.SCOPE_ONELEVEL, '(objectCategory=Container)', ['cn'])
for i in result:
    print(i[-1]['cn'])

第一次搜索成功，并打印系统中的所有容器。我希望第二次搜索可以找到“系统”容器（以及其他），但没有找到。相反，我收到此错误：

  File "test_ldap_search.py", line 19, in <module>
    result = l.search_s(realm_dn, ldap.SCOPE_ONELEVEL, '(objectCategory=Container)', ['cn'])
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 831, in search_s
    return self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout=self.timeout)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 825, in search_ext_s
    return self.result(msgid,all=1,timeout=timeout)[1]
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 717, in result
    resp_type, resp_data, resp_msgid = self.result2(msgid,all,timeout)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 721, in result2
    resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all,timeout)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 728, in result3
    resp_ctrl_classes=resp_ctrl_classes
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 735, in result4
    ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 308, in _ldap_call
    reraise(exc_type, exc_value, exc_traceback)
  File "/usr/lib64/python2.7/site-packages/ldap/ldapobject.py", line 292, in _ldap_call
    result = func(*args,**kwargs)
ldap.OPERATIONS_ERROR: {'info': u'000004DC: LdapErr: DSID-0C0906DD, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1771', 'desc': u'Operations error'}

我知道我已通过身份验证。我已经初始化为管理员。因此，“为了执行此操作，必须在连接上完成成功的绑定”消息具有误导性。

我尝试搜索任何类型的对象，并且它总是在树根下方成功，而在顶部失败。这里有我不了解的ldap-ism吗？

ldap服务器是Windows 2008 R2服务器。

Answer 1

使用python ldap3代码进行相同的搜索即可。

l = ldap3.Connection(server, user=user, password=password, authentication=ldap3.NTLM, auto_bind=True)

print('Containers at top:')
l.search(realm_dn, '(objectCategory=Container)', search_scope='LEVEL', attributes= ['cn'])
for i in l.entries:
    print(i['cn'])

也许这是python-ldap代码中的错误？

LDAP无法在根目录下直接搜索对象

1 个答案: