Beefy Boxes and Bandwidth Generously Provided by pair Networks
XP is just a number
 
PerlMonks  

Re^3: Net::LDAP q

by salva (Monsignor)
on Sep 06, 2011 at 09:57 UTC ( #924345=note: print w/ replies, xml ) Need Help??


in reply to Re^2: Net::LDAP q
in thread Net::LDAP q

The LDAP protocol does not support setting the type of the arguments in comparison filters. It is up to the server to decide which one to use.

Anyway, I would enable debugging on the Net::LDAP object and see what is being send and received by the script:

$ldap->debug(12);


Comment on Re^3: Net::LDAP q
Download Code
Re^4: Net::LDAP q
by fisher (Priest) on Sep 06, 2011 at 10:32 UTC
    Thank you for a tip.
    Searching for uids less than 1000 and gt 500... Net::LDAP=HASH(0x22d4e +e0) sending: 0000 82: SEQUENCE { 0002 1: INTEGER = 2 0005 77: [APPLICATION 3] { 0007 39: STRING = 'ou=slurm,dc=lomonosov,dc=parallel,dc=ru' 0030 1: ENUM = 2 0033 1: ENUM = 2 0036 1: INTEGER = 0 0039 1: INTEGER = 0 003C 1: BOOLEAN = FALSE 003F 17: [CONTEXT 6] { 0041 9: STRING = 'uidNumber' 004C 4: STRING = '1000' 0052 : } 0052 0: SEQUENCE { 0054 : } 0054 : } 0054 : } Net::LDAP=HASH(0x22d4ee0) received: 0000 12: SEQUENCE { 0002 1: INTEGER = 2 0005 7: [APPLICATION 5] { 0007 1: ENUM = 0 000A 0: STRING = '' 000C 0: STRING = '' 000E : } 000E : } Ok Found:
    I suppose that 'context 6' in this context means 'less or equal'; according to rfc,
    LDAPMessage ::= SEQUENCE { messageID MessageID, protocolOp CHOICE { bindRequest BindRequest, bindResponse BindResponse, unbindRequest UnbindRequest, searchRequest SearchRequest, searchResEntry SearchResultEntry, searchResDone SearchResultDone, [...] SearchRequest ::= [APPLICATION 3] SEQUENCE { baseObject LDAPDN, scope ENUMERATED { baseObject (0), singleLevel (1), wholeSubtree (2), ... }, derefAliases ENUMERATED { neverDerefAliases (0), derefInSearching (1), derefFindingBaseObj (2), derefAlways (3) }, sizeLimit INTEGER (0 .. maxInt), timeLimit INTEGER (0 .. maxInt), typesOnly BOOLEAN, filter Filter, attributes AttributeSelection } [...] Filter ::= CHOICE { [...] greaterOrEqual [5] AttributeValueAssertion, lessOrEqual [6] AttributeValueAssertion, [...] AttributeValueAssertion ::= SEQUENCE { attributeDesc AttributeDescription, assertionValue AssertionValue } AttributeDescription ::= LDAPString -- Constrained to <attributedescriptio +n> -- [RFC4512] AssertionValue ::= OCTET STRING
    Everything seems to be OK, but *why* console utility 'ldapsearch' returns ~200 entries, and Net::LDAP doesn't?
Re^4: Net::LDAP q
by fisher (Priest) on Sep 06, 2011 at 10:48 UTC
    answer has been found, thank you.
      Net::LDAP::Gateway contains a sample LDAP server that can dump the packets it receives as almost-human-friendly Perl data structures. It has served me in the past to compare and validate requests made through Net::LDAP and ldapsearch and solve problems as the one you were facing.

      What was the issue? Inquiring minds want to know. Adding information as to the source of the problem, solutions tried, and one that actually worked will help those who come after you.

      --MidLifeXis

        1. My assumption that 'ldapsearch' utility gives me the right result was wrong. According to rfc4515 there is no '>' or '<' comparators - at all. Thus, ldapsearch utility forms request with filter 'objectclass=*', which gives me all the entries in the given basedn. As I have almost all the entries with uidNumber in between 500 and 1000, I misunderstood the result.

        I got this fact only with wireshark's help - yes, I did tcpdump on request to find it. If 'ldapsearch' can't recognize given filter, it silently forms the filter 'present, objectClass' and treating original user's filter as attribute name to search.

        2. The server actually can't answer that kind of requests; to do this, you need to modify ldap schema and define attribute with proper ordering rules. The most helpful piece of text can be found here.

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://924345]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others rifling through the Monastery: (6)
As of 2014-07-30 06:26 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    My favorite superfluous repetitious redundant duplicative phrase is:









    Results (229 votes), past polls