From: Will Drewry <drewry@...>
Date: 2004-11-05T02:21:01+09:00
Subject: Re: using LDAP Controls in ruby-ldap

On Thu, 4 Nov 2004 14:26:33 +0900, Jason Wold <jason.wold@gmail.com> wrote:
> This is a bit of a stretch since it is as much about LDAP as it is
> ruby but I'll ask it here anyway.  I'd like to use the "paged results"
> control/extension to LDAP for getting results sets larger than the
> server allows.  Has anyone used this or have any further pointers?
> 
> The gory details:
> ------------------------
> ruby-ldap seems to have part of what is needed but I can't seem to tie
> it together and get it to work.  There is a LDAP::Control.new method
> which appears to let me create a control (although a peek at the
> source reveals a bug in the initialize script that prevents "oid" from
> being initialized so I hack around it by assigning it after).  The
> search_ext function appears to happily accept this control object, but
> the behavior is not as expected.  Part of the problem might be that I
> have no freakin clue what the second argument ( :value ) to
> LDAP::Control.new should look like.  What I have there is just based
> on looking at RFC2696 which defines the paged results control for
> LDAP.  The RFC says this is BER encoded value but it looks like the
> ldap-ruby code is doing that.
> 
> $ cat test.rb
> #!/usr/bin/ruby
> 
> require 'ldap'
> require 'pp'
> 
> control = LDAP::Control.new(nil, 'size=10', true)
> control.oid="1.2.840.113556.1.4.319"
> 
> conn = LDAP::SSLConn.new('test-dc-02.xxxxx.com', 636, false)
> 
> conn.bind("test@xxxxxx.com", Password::get() )
> 
> conn.search_ext("ou=users,ou=test,dc=xxxxx,dc=com",
> LDAP::LDAP_SCOPE_SUBTREE, "sn=*", ["sn"], false, serverctrls =
> [control] ) { |r| pp r.attributes }
> 
> $ ./test.rb
> Password:
> ./test.rb:16:in `search_ext': Critical extension is unavailable
> (LDAP::ResultError)
>         from ./test.rb:16
> 
> 

This looks like the extension - not the value - isn't supported.

According to the OpenLDAP list, AD used to be the only server that
supported this - maybe not anymore?

http://www.openldap.org/lists/openldap-devel/200207/msg00016.html

Anyway - I'd give it a go on an OpenLDAP 2.2 server if you have one
available and see what happens.

As to the value, it's unclear if the ruby lib will BER encode this for
you, Once I've move my install up to 2.2, I'll be able to test a
little more.

Poking around misc.c didn't make things clearer for me either.


You could try something like this
a = OpenSSL::ASN1::Sequence.new([OpenSSL::ASN1::Integer.new('10'),
OpenSSL::ASN1::OctetString.new('')])

control.value = a.to_der

I get conversion errors, but my openssl could be newer.


good luck,
will 

ref: http://www.faqs.org/rfcs/rfc2696.html