venugopal chinnakotla wrote:
> Hi Team,
>
> We are working on migration of nsldap C sdk to OpenLDAP C sdk for our
> application client code.
>
> We are using OpenLDAP 2.6.7.
>
> As part of this migration, we are facing one issue related to LDAP Referrals
> when LDAP_OPT_REFERRALS=ON (which means SDK will handle Referrals internally)
>
>
> While testing our application which makes use of OpenLDAP sdk , we see a
> difference in the referral handling when LDAP_OPT_REFERRALS=ON when compared
> with
> NSLDAP C SDK with user bind
> We are testing with Oracle Unified Directory, referrals is enabled at server.
> *
> *
> *With OpenLDAP C SDK:*
> When our application follows the bind(synchronous) request for the users
> which is present in another server (where chase should happen)
> ldap_bind_s →
> - Which internally calls ldap_sasl_bind_s → ldap_sasl_bind +
> ldap_result
>
> able to succeed the bind (LDAP_SUCCESS).
>
> And When our application follows the bind(asynchronous) request for the users
> which is present in another server (where chase should happen)
> ldap_simple_bind ->
> - which internally calls ldap_sasl_bind
>
> failed to bind and returned (LDAP_REFERRAL) instead.
>
>
> On further analysis of OpenLDAP code *result.c* (line# 728) we observed,
> there is exclusion for bind request *tag != LDAP_RES_BIND*, which is
> preventing to
> chase the referral internally.
Use `git blame` to see the commit that changed a line of code, and then read
about why it was changed.
In this case, that line was changed in e5302c2431f due to ITS#6510.
>
> / /* Do we need to check for referrals? */
> if ( tag != LDAP_RES_BIND &&
> ( LDAP_BOOL_GET(&ld->ld_options, LDAP_BOOL_REFERRALS) ||
> lr->lr_parent != NULL ))
> {
> char **refs = NULL;
> ber_len_t len;
> /* Check if V3 referral */
> if ( ber_peek_tag( &tmpber, &len ) == LDAP_TAG_REFERRAL ) {
> ...
> /* Chase the referral */
> refer_cnt = ldap_chase_v3referrals( ld, lr, refs, ... );/
>
>
>
> However, we don't see such exclusion with NSLDAP C SDK specifically for bind
> requests. We would like to understand the limitation for asynchronous bind
> when
> handling referral internally.
> Are there any known issues/limitations with this use case when OpenLDAP C SDK
> handles referrals?
> Is there any way (like any flag/option) to make automatic referrals work with
> asynchronous bind calls ldap_simple_bind?
>
> Please note that, the ldap_search succeeds with when LDAP_OPT_REFERRALS=ON,
> no issue observed.
>
>
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
