[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
ldapsearch - unexpected behavior with "-h URI -p PORT"
- To: openldap-technical@openldap.org
- Subject: ldapsearch - unexpected behavior with "-h URI -p PORT"
- From: Alexandre Rosenberg <alex@r42.ch>
- Date: Thu, 16 Mar 2017 07:29:25 +0900
- Dkim-signature: v=1; a=rsa-sha256; c=simple/simple; d=r42.ch; s=mail; t=1489616966; bh=uqOXgObFk1cuLxF/mziicLtFlaHWgStSPGjSw2CL3s0=; h=From:Subject:To:Reply-To:Date:From; b=ATbgz37x/VaHNcaIpsWTUVyYivcXjm6mqPiUUz0TmVtyWX0lhG0eIG+ry93pvMPgG kS9RNk/CmkSreb+dJZCU03b9TyOdjw9g4mU36rxhdREGCXcqfLLE8nr8SjRy0OAhPw SQVVx+JNJ5Xk/18yYXhfyWbfKquVUtH97UFWHX1w=
- User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Icedove/45.6.0
Hello,
I run into some unexpected behavior using ldapsearch today and believe
it is a bug. It all started with following command:
ldapsearch -x -LLL -h ldap://localhost -p 10636 -b ${BASEDN} \
uid=${USER} -D ${BINDINGUSER} -W
After checking the man page, it became clear that:
1. '-h' should take a *hostname* as argument (not "ldap://...")
2. Using '-H' (+ URI) is recommended instead of '-h'/'-p'
And sure enough following command works as expected:
ldapsearch -x -LLL -H ldap://localhost:10636 (...)
The actual issue is what happens when running the fist command.
- The "-h" option takes a hostname. As "ldap://localhost" is *not* a
valid hostname, I would expect the command the fail
- What happens instead is that ldapsearch connect to localhost on port
389 (!)
$ ldapsearch -x -d 255 -h ldap://localhost -p 10389
ldap_create
ldap_sasl_bind
ldap_send_initial_request
ldap_new_connection 1 1 0
ldap_int_open_connection
ldap_connect_to_host: TCP localhost:389
Note this *only* happens when both '-h' and '-p' are used.
When only '-h' is used, following happens which seem fine:
$ ldapsearch -x -d 255 -h ldap://localhost
ldap_create
ldap_url_parse_ext(ldap://ldap:%2F%2Flocalhost)
ldap_err2string
Could not create LDAP session handle for URI=ldap://ldap:
%2F%2Flocalhost (-9): Bad parameter to an ldap routine
Bellow are some more example:
1. $ ldapsearch -x -d 255 -h example.org -p 10636
-> Connects to example.org on port 10636 (as expected)
2. $ ldapsearch -x -d 255 -h /example.org -p 10636
-> Connects to localhost on port 389 (!) - note the added "/"
3. $ ldapsearch -x -d 255 -h /example.org
-> Fails as "/example.org" is not resolvable (as expected)
Running the command will give you the debug output (which I omitted
here). Note I am using openldap 2.4.44.
I hope the explanation is clear. The behavior must definitely looks like
a bug to me and got me very confused.
Best,
Alex