search

jborean93 / sansldap

Python Sans I/O LDAP Library
MIT License
6 stars 0 forks source link

Support Non Numeric OIDs #4

Open woder opened 1 month ago

woder commented 1 month ago

Hi,

While trying to use a library that uses sansldap to manage LDAP connections I've run into a schema validation problem involving attribute OIDs. I have confirmed that the LDAP directory I'm connecting to contains OIDs that are invalid according to the spec. The code in schema.py then throws a "value is not a valid AttributeTypeDescription" when attempting to parse the schema.

I know that strictly speaking, this schema is in fact invalid, but from my research online it appears that several directory servers allow this violation and that it is, unfortunately, common enough to find. The following excerpt from the Oracle Unified Directory provides some insight:

Oracle Unified Directory allows the use of non-numeric OIDs if a corresponding numeric OID is defined within the schema. For example, you can use a non-numeric OID, mytestattribute-oid for the named attribute, myTestAttribute. The non-numeric OID must be all lowercase with the -oid appended to the named attribute. The use of non-numeric OIDs is an LDAP-specification violation but is permissible for ease of use.

https://docs.oracle.com/cd/E52734_01/oud/OUDAG/schema.htm

What would be the best way to add support for servers that are operating with this invalid schema? I would mostly like to be able to connect to such servers without special handling in application code for cases where the schema isn't strictly to spec, but follows this non-numeric convention.

Thanks for your consideration.

jborean93 commented 1 month ago

Do you know what part is actually using names instead of OIDs. Is it trying to parse one of the schema metadata structures defined in https://github.com/jborean93/sansldap/blob/main/src/sansldap/schema.py or dealing with a raw LDAP message?

woder commented 1 month ago

The specific part that is throwing the error is ATTRIBUTE_TYPE_DESCRIPTION.

Specifically, it finds no match due to the entry's OID. I'm not sure if other areas are affected, but in my case once the ATTRIBUTE_TYPE_DESCRIPTION error is ignored nothing else goes wrong.

jborean93 commented 1 month ago

Can you share the full stacktrace and potentially the raw value that is being parsed. I can certainly look into relaxing the regex rules for that type but would need the original value to test with.

MS made a few RFC violations with these types where the SYNTAX entry also works with strings so maybe Oracle is similar here.