GNU bug report logs - #58605
29.0.50; Commit 2a2f5530fa2 breaks ldap-search-internal

Previous Next

Full log

View this message in rfc822 format

From: Filipp Gunbin <fgunbin <at> fastmail.fm>
To: Jens Lechtenboerger <lechten <at> wi.uni-muenster.de>
Cc: 58605 <at> debbugs.gnu.org, Juri Linkov <juri <at> linkov.net>
Subject: bug#58605: 29.0.50; Commit 2a2f5530fa2 breaks ldap-search-internal
Date: Mon, 24 Oct 2022 19:06:37 +0300

Hi Jens,

On 22/10/2022 11:43 +0200, Jens Lechtenboerger wrote:

> Hi there!
>
> On 2022-10-21, Filipp Gunbin wrote:
>
>> Oh, so this is not just a test case, but the code you actually use.  Add
>> "-LLL" to ldap-ldapsearch-args?
>
> This was a test case.  In my code [1], I use ldap-search, not the
> internal function.  Essentially, like this:
>
> (let ((ldap-default-base "O=DFN-Verein,C=DE")
>       (ldap-ldapsearch-args '("-x" "-tt" "-H ldaps://ldap.pca.dfn.de"))
>       (mail "nix <at> example.org")
>       (host ""))
>   (ldap-search (concat "mail=" mail) host '("userCertificate") nil))
>
> Previously, this just returned the userCertificate, with and without
> -LLL.  If no certificate existed, it returned nil.
>
> Now, -LLL seems to be required, which I perceive to be a breaking
> change.  Can this be avoided?  Alternatively, document it?
>
> I confirm that with -LLL, my code works.
>
> Without it, I get ((("search" " ") ("result" " "))) instead of nil.

But ldap-search expects ldap-ldapsearch-args to be at least what default
value is, to be able to parse the output (btw, "-LL" was there since
"forever", which is 20 years in this case; it's just the third L which
was added recently, to exclude ldif version from the output).  Also,
default value can change along with ldap-search internal changes.  So if
you want to let-bind it, you should merge in your additional args, not
replace them.

However, I don't see why you would want to let-bind it:

- -H: Why don't you use host parameter?
- -x: just pass 'auth = simple
- -tt: already in ldap-ldapsearch-args

Even more, I'd say that the user should set ldap-host-parameters-alist
according to his/her setup, and you should not mess with ldapsearch
arguments at all.  Like:

(setq ldap-host-parameters-alist
      '(("ldap://example.org"
         auth simple
         auth-source t)))

Then just invoke:

(ldap-search "mail=.." "ldap://example.org"  '("userCertificate"))

> Also, without -LLL and with an existing certificate, ("dn" " ") and
> (("search" " ") ("result" " ")) are included in the result.  Note
> that I find ("dn" " ") misleading, as ldapsearch really does return
> a dn value...

Without -LL(L), the parsing code works incorrectly, and this case
"worked" before only by coincidence.

HTH,
Filipp

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.