zorn96
commented
3 years ago hi @nzig ! this should be handled automatically. Connection objects possess an auto_referral property that defaults to True, and referrals are handled
if responses[-2]['result'] == RESULT_REFERRAL:
if self.connection.usage:
self.connection._usage.referrals_received += 1
if self.connection.auto_referrals:
ref_response, ref_result = self.do_operation_on_referral(self._outstanding[message_id], responses[-2]['referrals'])
if ref_response is not None:
responses = ref_response + [ref_result]
responses.append(RESPONSE_COMPLETE)
elif ref_result is not None:
responses = [ref_result, RESPONSE_COMPLETE]
self._referrals = []could you try to set collect_usage=True when creating your connection? that should let you check connection._usage.referrals_received to see if the referrals were received. you can also look at connection._usage.referrals_connections to see if referral connections got created properly
one possibility is that the referral is being handled, but it doesn't resolve to anything or the library is failing to automatically cross-bind. Active Directory will attempt to construct referrals irregardless of the client and even when it isn't sure if the referral it provides works.
the ldap3 library has some extensive logic for picking out valid referrals and then creating connections to chase them. but it's possible something in that process is failing
def create_referral_connection(self, referrals):
referral_connection = None
selected_referral = None
cachekey = None
valid_referral_list = self.valid_referral_list(referrals)
if valid_referral_list:
preferred_referral_list = [referral for referral in valid_referral_list if
referral['ssl'] == self.connection.server.ssl]
selected_referral = choice(preferred_referral_list) if preferred_referral_list else choice(
valid_referral_list)
cachekey = (selected_referral['host'], selected_referral['port'] or self.connection.server.port, selected_referral['ssl'])
if self.connection.use_referral_cache and cachekey in self.referral_cache:
referral_connection = self.referral_cache[cachekey]
else:
referral_server = Server(host=selected_referral['host'],
port=selected_referral['port'] or self.connection.server.port,
use_ssl=selected_referral['ssl'],
get_info=self.connection.server.get_info,
formatter=self.connection.server.custom_formatter,
connect_timeout=self.connection.server.connect_timeout,
mode=self.connection.server.mode,
allowed_referral_hosts=self.connection.server.allowed_referral_hosts,
tls=Tls(local_private_key_file=self.connection.server.tls.private_key_file,
local_certificate_file=self.connection.server.tls.certificate_file,
validate=self.connection.server.tls.validate,
version=self.connection.server.tls.version,
ca_certs_file=self.connection.server.tls.ca_certs_file) if
selected_referral['ssl'] else None)
from ..core.connection import Connection
referral_connection = Connection(server=referral_server,
user=self.connection.user if not selected_referral['anonymousBindOnly'] else None,
password=self.connection.password if not selected_referral['anonymousBindOnly'] else None,
version=self.connection.version,
authentication=self.connection.authentication if not selected_referral['anonymousBindOnly'] else ANONYMOUS,
client_strategy=SYNC,
auto_referrals=True,
read_only=self.connection.read_only,
check_names=self.connection.check_names,
raise_exceptions=self.connection.raise_exceptions,
fast_decoder=self.connection.fast_decoder,
receive_timeout=self.connection.receive_timeout,
sasl_mechanism=self.connection.sasl_mechanism,
sasl_credentials=self.connection.sasl_credentials)
if self.connection.usage:
self.connection._usage.referrals_connections += 1
referral_connection.open()
...so it may be that the library didn't chase the referral properly due to a failure to resolve the addresses, or something like authentication/ssl issues with the referral servers (as you can see it tries to reuse the same settings for those on referral unless the referral specifies otherwise).
multi-domain trust via referrals is one of the more convoluted pieces of the LDAP protocol, because it relies on the servers to figure out how to accept incoming requests via referral, and that leaves a lot of room for hard to debug things.
hopefully the connection usage information above can help us chase down the problem (e.g. maybe we see that we received the referrals but failed to set up connections, and go from there). you can also try turning on extended logging for the library.
nzig
I'm searching in Active Directory with ldap3, and it appears that the AD server is returning
searchResRefreferrals that are not being followed. I'm using this (anonymized)which returns (also anonymized)
If I do the same thing but connect to
sub1.example.com, I will getRFC5411 says that
and the ldap3 docs say
However this does not appear to be the case. My current solution is to connect to all the servers in the
searchResRefs and run the search there as well. Is there a way for ldap3 to do this automatically?