[python-ldap] Validated URL can't be used for bind - handling SRV lookups

[Michael Ströder]

Elias Probst wrote:
> I planned to make it possible to use URLs like this:
> ldap:///dc=company,dc=tld

You should seriously consider the security implications regarding DNS spoofing
by relying on yet another DNS lookup which is *not* protected by e.g. TLS
hostname check.

> When using such an URL on the commandline (e.g. ldapsearch) this will
> cause a DNS lookup to retrieve SRV records from DNS contining pointers
> to LDAP hosts and their ports which will then be used to bind to.

Yes, as Howard pointed out that's a feature of the command-line tools.

> python-ldap validates such an URL just fine using ldapurl.isLDAPUrl(),
> but actually using in in ldap.initialize() will fail.
> [..]
> initialize() failed: ldap:///dc=institution,dc=de - (2, 'No such file or
> directory')

Yes.

> This seems to happen, because python-ldap doesn't use dn2domain() and
> domain2hostlist() from libldap. See also the following IRC log where
> OpenLDAP dev 'hyc' pointed me towards this:

So what do you expect python-ldap to do?

Mainly you have to implement that yourself by using one of the DNS modules for
Python (like I did in web2ldap). It's not a big deal anyway.

But again: Think twice considering security aspects.

Ciao, Michael.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2398 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://mail.python.org/pipermail/python-ldap/attachments/20131016/be50837b/attachment.bin>