Re: LDAP - Binary values

[mcs@netscape.com (Mark C Smith)]

Rudolf Janz wrote:
> 
> Hello,
> I have a couple of questions, these are not OpenLDAP specific.
> 
> If an attribute for example has the syntax INTEGER, then it is encoded as
> an ASN.1 integer in LDAP, if I understood it correctly. But how does the
> C-API handle integers, do you have to use the binary value and then decode
> it with ber_scanf?

Integers used within LDAP protocol messages (but not within attribute
values) are encoded using BER.  Integers that appear in attribute values
are encoded as text strings.  From RFC 2252:

6.16. INTEGER

   ( 1.3.6.1.4.1.1466.115.121.1.27 DESC 'INTEGER' )

   Values in this syntax are encoded as the decimal representation of
   their values, with each decimal digit represented by the its
   character equivalent. So the number 1321 is represented by the
   character string "1321".


> A more general question, I'd like to write a gateway using the C-API, which
> translates the LDAP requests and responses.
> The problem is: this gateway, does not know the schema, is there enough
> information to decide which types the values have? For example how do I
> distinguish between binary data and strings, it seems they are both written
> with the same tag.

This is a difficult problem to solve.  One approach is to read the
schema from an LDAPv3 server and look at the syntax of each attribute to
determine whether it is likely to be human readable (section 4.3.2 of
RFC 2252 includes a list of syntaxes along with an indication of whether
values stored using each syntax are likely to be human readable).  I am
not sure if OpenLDAP provides the LDAPv3 style schema publication yet or
not, but servers like Netscape's and Innosoft's do.  Another approach is
to look at the data itself and guess at whether it looks like text. 
This works better than one might think, but might be troublesome in the
face of UTF-8 data (e.g., if multilingual data is stored in your DS).  A
third approach is to create templates of some kind and use them to
display entries.  The templates would include syntax information for
each attribute that is to be displayed.  Usually the choice of which
template to use is keyed off of an entry's objectclass values.  The
ldap_disptmpl(3) facility that is part of the OpenLDAP and other LDAP
client libraries is an example of this last approach.

-- 
Mark Smith
Directory Architect / Netscape Communications Corp.
My words are my own, not my employer's.  Got LDAP?