[python-ldap] Searching for nested membership in AD groups

[Stephen J. Butler]

\5C is blackslash itself, not comma. I think what he wants is really:

r'(member:1.2.840.113556.1.4.1941:=CN=Whalen\, Sean,OU=Users,OU=Users and
Groups,DC=redacted,DC=net)'

Notice the raw string. Otherwise, if you aren't using a raw string, then:

"(member:1.2.840.113556.1.4.1941:=CN=Whalen\\, Sean,OU=Users,OU=Users and
Groups,DC=redacted,DC=net)"


IDK how you're building your DN's in general, but what you should be doing
is this when you have arbitrary input:

from ldap.dn import escape_dn_chars

filter = '(member:1.2.840.113556.1.4.1941:=CN={0},OU=Users,OU=Users and
Groups,DC=redacted,DC=net)'.format(escape_dn_chars('Whalen, Sean'))

That will always do the right thing.

On Fri, Sep 30, 2016 at 7:37 PM, Michael Ströder <michael at stroeder.com>
wrote:

> Sean Whalen wrote:
> > Then I tried
> >
> > (member:1.2.840.113556.1.4.1941:=CN=Whalen\5c, Sean,OU=Users,OU=Users
> and
>                                             ^^^^
> Yes, you must escape the comma in the DN.
>
> But the escaped hex-encoded character \5C must fully *replace* the comma.
> Or
> simply escape the comma like \, (see RFC 4514).
>
> Bear in mind that you have to deal with extra escaping in Python string
> syntax
> when hard-coding a DN like this in your source code.
>
> Also note that there can be a bunch of specific performance differences
> depending on how and from where you connect and bind to Active Directory,
> especially if it's not well maintained (stale directory replicas / site
> topology).
>
> Ciao, Michael.
>
>
> _______________________________________________
> python-ldap mailing list
> python-ldap at python.org
> https://mail.python.org/mailman/listinfo/python-ldap
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/python-ldap/attachments/20160930/401347bd/attachment.html>