Ruby net:LDAP returns "code = 53 message = Unwilling to perform" error

Question

I am getting this error "code = 53, message = Unwilling to perform" while I am traversing the eDirectory treebase = "ou=Users,o=MTC". My ruby script can read about 126 entries from eDirectory and then it stops and prints out this error. I do not have any clue of why this is happening.

I am using the ruby net:LDAP library version 0.0.4. The following is an excerpt of the code.

require 'rubygems'
require 'net/ldap'

ldap = Net::LDAP.new :host => "10.121.121.112",
 :port => 389,
 :auth => {:method => :simple, :username => "cn=abc,ou=Users,o=MTC", :password => "123"
 }

filter = Net::LDAP::Filter.eq( "mail", "*mtc.ca.gov" )

treebase = "ou=Users,o=MTC"

attrs = ["mail", "uid", "cn", "ou", "fullname"]

i = 0
ldap.search( :base => treebase, :attributes => attrs, :filter => filter ) do |entry|
  puts "DN: #{entry.dn}"
  i += 1
  entry.each do |attribute, values|
    puts "   #{attribute}:"
    values.each do |value|
      puts "      --->#{value}"
    end
  end
end

puts "Total #{i} entries found."
p ldap.get_operation_result

Here is the output and the error at the end. Thank you very much for your help.

DN: cn=uvogle,ou=Users,o=MTC

mail:

  --->[email protected]

fullname:

  --->Ursula Vogler

ou:

  --->Legislation and Public Affairs

dn:

  --->cn=uvogle,ou=Users,o=MTC

cn:

  --->uvogle

Total 126 entries found.

OpenStruct code=53, message="Unwilling to perform"

Answer 1

So, the problem is retrieving UID for user 126 (Based on what I am seeing here)? Or do you get UIDs for everyone and then it stops after the full output for user 126?

Regarding uid: In a default Novell eDirectory install, "uid" (lowercase) maps to the Novell uniqueID, which is the same as the CN. If you are looking to get a Unix-style numeric uid then you will want the uidNumber attribute. It may be that the admin of your installation has done some different LDAP mappings and that the uid is not present for that user (uidNumber is not a required or default attribute in eDirectory, it is acquired via the posixUser auxiliary class).

On the other hand, if it gives all 126 and then fails, then it is possible that the administrator has put a Search Entry Limit on the LDAP server object for this server in eDirectory. By default no such limit exists. Are you the admin? Do you have other tools (such as the now-hard-to-found Java LDAP Browser) to troubleshoot LDAP by looking at entries raw?

Answer 2

This is what I found using Google Code Search:

unwillingToPerform       (53), -- unable to sort

unwillingToPerform       (53)  -- server cannot process control

Answer 3

Do you have access to the eDirectory server? I.e. Is this a Dev or production eDirectory instance?

If not, ask the admin to watch on https://serverIP:8030/nds/trace with the LDAP switch enabled in trace config. Look at the query and the results, and see if eDirectory is showing a better error in the Dstrace logs.

As an example of what you might see, I worked through SAP GRC's use of LDAP in this article: Troubleshooting SAP GRC's LDAP interface and that shows what a Query and response should look like with some examples of it working and others of it failing.