Home/ Questions/Q 6155971
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T20:31:42+00:00

I’m trying to use ldaptor to connect via startTLS to a LDAP server. Searching

  • 0

I’m trying to use ldaptor to connect via startTLS to a LDAP server. Searching on internet and trying myself I arrived to this snippet of code:

from ldaptor.protocols.ldap import ldapclient, ldapsyntax, ldapconnector, distinguishedname
[...]
def main(base, serviceLocationOverrides):
    c=ldapconnector.LDAPClientCreator(reactor, ldapclient.LDAPClient)
    d = c.connect(base, serviceLocationOverrides)
    d.addCallbacks(lambda proto: proto.startTLS(), error)
    [...]
    d.addErrback(error)
    d.addBoth(lambda dummy: reactor.stop())
    reactor.run()

but the code exits with an AssertionError:

[Failure instance: Traceback: <type 'exceptions.AssertionError'>: 
/usr/lib/python2.7/dist-packages/twisted/internet/base.py:1167:mainLoop
/usr/lib/python2.7/dist-packages/twisted/internet/base.py:789:runUntilCurrent
/usr/lib/python2.7/dist-packages/twisted/internet/defer.py:361:callback
/usr/lib/python2.7/dist-packages/twisted/internet/defer.py:455:_startRunCallbacks
--- <exception caught here> ---
/usr/lib/python2.7/dist-packages/twisted/internet/defer.py:542:_runCallbacks
/usr/lib/pymodules/python2.7/ldaptor/protocols/ldap/ldapclient.py:239:_startTLS
/usr/lib/pymodules/python2.7/ldaptor/protocols/pureldap.py:1278:__init__
/usr/lib/pymodules/python2.7/ldaptor/protocols/pureldap.py:1144:__init__
]

I have tried to look in ldaptor code for the incriminated assertion but seems all ok.
Is there someone who succeded in using ldaptorClient startTLS?
A code snippet?

Thank you very much

Bye

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I’m pretty certain that your problem is one I ran into a while back. In ldaptor/protocols/pureldap.py, line 1144 asserts that the LDAPExtendedRequest requestValue must be a string. But according to RFC 2251, that value is optional, and specifically should NOT be present in startTLS requests.

    So your approach is correct; this is just a major bug in ldaptor. As far as I can tell, the author only tested using simple bind without TLS. You need to comment out that line in pureldap.py. If you’re deploying this with the expectation that users will download or easy-install ldaptor, then you’ll need to create a fixed copy of the LDAPExtendedRequest class in your own code, and sub it in at run-time.

    Having had to maintain a project using ldaptor for several years, I would strongly urge you to switch to python-ldap if at all possible. Since it wraps the OpenLDAP libs, it can be much more difficult to build, especially with full support for SSL/SASL. But it’s well worth it, because ldaptor has a lot more problems than just the one you ran across.

    • 0