Support for referral chasing enable and disable

[tilakbishtAVI]

Hi, I am unsure whether the current implementation has any flag to enable or disable referral chasing while searching records in the LDAP server.

Please help me with this.

[tilakbishtAVI]

Hi Team,

Any update on this? Working on a critical part of our project and want to understand this feature in go-ldap @zerok @samuel @jefferai @johnweldon

[cpuschma]

Referrals are defined in the search result:

ldap/v3/search.go

Lines 317 to 325 in 0e43630

	// SearchResult holds the server's response to a search request
	type SearchResult struct {
	// Entries are the returned entries
	Entries []*Entry
	// Referrals are the returned referrals
	Referrals []string
	// Controls are the returned controls
	Controls []Control
	}

Example:

conn, err := ldap.DialURL("ldap//XXX")
if err != nil {
	//
}
defer conn.Close()

searchResult, err := conn.Search(&ldap.SearchRequest{
	BaseDN:       baseDN,
	Scope:        ldap.ScopeWholeSubtree,
	DerefAliases: ldap.NeverDerefAliases,
	Filter:       fmt.Sprintf("(%s=%s)", attribute, ldap.EscapeFilter(value)),
	Attributes:   []string{"objectClass"},
})
if err != nil {
	//
}

fmt.Println(searchResult.Referrals)

[tilakbishtAVI]

Hi @cpuschma This code will give me the referral list but it won't be searching for the given user in the referrals. Our requirement is that if the user is not found in the given DN then the LDAP server should automatically search in the referrals if there are any on the basis of a flag.

Below are the equivalent in ldapsearch commands:

1. This won't search in referrals
   ldapsearch -vvv -h <LDAP_SERVER> -p <PORT> -D <ADMIN_DN> -W -b <BASE_DN>

2. This will search in referrals too, -C flag is used to tell the LDAP server that we want it to search in referrals too
   ldapsearch -vvv -C -h <LDAP_SERVER> -p <PORT> -D <ADMIN_DN> -W -b <BASE_DN>

[tilakbishtAVI]

Hi @cpuschma did you get a change to look into the above query?

[ram-parameswaran]

@tilakbishtAVI would approving PR 376 fix the functionality you are looking for?

[akshay-ware-druva]

I believe go-ldap doesnt support searching in the referral URLs. It just returns Referrals in the SearchResult and its client responsibility to connect to those referrals (binding, searching, etc). @cpuschma is that right?

There is this method python ldap supports - connect.set_option(ldap.OPT_REFERRALS, 0), @cpuschma I am looking for somehting equivalent of python ldap set_option method is there such option in go-ldap ?

[cpuschma]

I have a lot to do at the moment, but I will see if I can implement transactions as well as this feature as an optional function this weekend.

[appu333]

I'd like to disable referral chasing in order to authenticate users using LDAP. @cpuschma, is it safe to assume that referral chasing is disabled by default in this client library & there's no need for explicit disabling, even though this option is currently unavailable in this library

[akshay-ware-druva]

I'd like to disable referral chasing in order to authenticate users using LDAP. @cpuschma, is it safe to assume that referral chasing is disabled by default in this client library & there's no need for explicit disabling, even though this option is currently unavailable in this library

I also want to know if referral chasing is enabled or disabled by default ?

[cpuschma]

It doesn't exist yet, but to preserve backwards compatibility it will be disabled by default.

[JesseCoretta]

Below are the equivalent in ldapsearch commands:

1. This won't search in referrals
   ldapsearch -vvv -h <LDAP_SERVER> -p <PORT> -D <ADMIN_DN> -W -b <BASE_DN>
2. This will search in referrals too, -C flag is used to tell the LDAP server that we want it to search in referrals too
   ldapsearch -vvv -C -h <LDAP_SERVER> -p <PORT> -D <ADMIN_DN> -W -b <BASE_DN>

Just want to chime in on a compatibility note.

OpenLDAP's client referral flag is OBSOLETE, per a few comments here. This is probably why -C is not listed in ldapsearch --help output.

In this case, it might be advisable for the author to rewrite number 2 to avoid use of -C and provide for a non-obsolete use-case for the go-ldap devs to reference instead.

One way is simply editing ldap.conf (whether the system copy or the user copy, whichever applies):

  REFERRALS <on/true/yes/off/false/no>
    Specifies if the client should automatically follow referrals returned by LDAP servers.
    The default is on.  Note that the command line tools ldapsearch(1) &co always override
    this option.

... FWIW, not sure if that comment in the ldap.conf manpage needs to be updated by the maintainers of OpenLDAP (if the "override" is referring to the now-obsoleted -C option), with another option like -e ... to control chaining/referral preferences.

😃