Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am doing passthrough authentication against a Novell eDirectory server. Currently I perform the following request:

results = server.search_s(
    self.basedn,
    ldap.SCOPE_SUBTREE,
    '(objectClass=user)',
    attrlist=['uid', 'networkAddress'])

(This is in python, let me know if you want me to explain it.)

The problem with this method is that each query returns every single user on the server, which I then have to loop through to find the user I'm interested in. I cache it, but what I'd really like to do is something like this:

results = server.search_s(
    self.basedn,
    ldap.SCOPE_SUBTREE,
    '(&(objectClass=user)(networkAddress=#9#\x00\x00\xc0\xa8\n\x1e))')

(That wacky #9# stuff is how the IP is stored - it's actually 192.168.10.30)

When I do a query for networkAddress I get an 'Invalid Syntax' error (even if I do something like networkAddress=blah, without all the \'s).

Is there a way to do an LDAP query for a specific IP?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

The problem is that Network Address is using a syntax of Net Address which is a structured attribute. I wrote about the various syntax types in these pair of articles:

http://www.novell.com/communities/node/6450/interesting-schema-syntaxes-edirectory-identity-manager-perspective-part-1 http://www.novell.com/communities/node/6457/interesting-schema-syntaxes-edirectory-identity-manager-perspective-part-2

The # signs separate fields in the LDAP view of the attribute.

I was looking at the schema reference for those articles in LogicSource for NDS, which was a for fee document.

The question is what is the comparison allowed on that attribute.

On a side point, if your queried for loginTime=* that would show those who are currently logged in, and would reduce the set of users to loop through.

Also, networkAddress is multivalued.

share|improve this answer
    
Great answer, but it seems changing the query to '(&(loginTime=*)(objectClass=user))' returns every user who has ever logged in. Numbers: all = 1101 after adding loginTime=* = 1046 users with uid and networkAddress = 55 –  Harley Jun 25 '09 at 2:08
    
Ah hah! If I make the query '(&(networkAddress=*)(objectClass=user))' it gives me a much smaller subset of users. Looks like that's what I want. –  Harley Jun 25 '09 at 2:10
    
Right, sorry forgot, Login Time remains... I guess if you could filter loginTime in the search with a less than filter, that would be good, but alas you cannot do that either. –  geoffc Jun 25 '09 at 21:03
add comment

I assume the code you're actually running doesn't have an unescaped apostrophe inside the string?

share|improve this answer
    
Woops, sorted that now. –  Harley Jun 25 '09 at 1:48
add comment

Looks like you've got a single quote in the wrong place in your search filter. Should it rather be:

results = server.search_s(
    self.basedn,
    ldap.SCOPE_SUBTREE,
    '(&(objectClass=user)(networkAddress=#9#\x00\x00\xc0\xa8\n\x1e))'
)
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.