198168 - LDAP v3 isn't supported...

Status: RESOLVED FIXED

(MailNews Core :: LDAP Integration, defect)

Description

[Henrik Gemal]

I'm unable to search using a the directory:
ldap://dir.certifikat.dk

All I'm getting is:
Protocol error requested protocol version not allowed

This is because Mozilla doesn't support LDAP v3

ldap://dir.certifikat.dk
is a LDAP v3 only. You cant use LDAP v2

you can use the following command lines to verify:
ldapsearch -P 3 -h dir.certifikat.dk -b 'c=DK' -x'(cn=Peter Lind*)' cn
 this works
ldapsearch -P 2 -h dir.certifikat.dk -b 'c=DK' -x'(cn=Peter Lind*)' cn
 this doesn't

What is needed for LDAP v3 to be supported?

20030318

Comment 1

[Mark Smith [:mcs]]

Ideally the LDAPv2 vs. LDAPv3 issue would be handled inside the directory/xpcom
layer. I am not sure if the Mozilla code always issue an LDAP bind operation or
not, but if you try to bind using version 3 to an LDAPv2 server, a protocol
error will be returned. So the usual approach is to try LDAPv3 and fall back to
v2 if the server returns that protocol error. But LDAPv2 is pretty old these
days. It would probably be OK to always use v3 by default and have a config.
option that says "use v2."

Setting the protocol version is simple to do globally before any LDAP * handles
have been created:

  int ldversion = LDAP_VERSION3;
  ldap_set_option( NULL, LDAP_OPT_PROTOCOL_VERSION, &ldversion );

Or it may be set on a LDAP * basis using a similar call to ldap_set_option().

Comment 2

[Carsten Menke]

Would be a good idea to just switch to LDAP v3, but do we really need yet
another pref for a really depreciated protocoll ? I mean Mozilla has more then
enough hidden und normal prefs quite know. Would be more interesting to find out
which LDAP servers do actually not provide LDAP v3 if any.

Another question is, what about write support for the Adressbook, currently I
cannot add new contacts to an LDAP Server -> enter new bug ? (No one existing
quite now)

These two things would make Mozilla perfect for my needs

Comment 3

[Henrik Gemal]

can anybody verify that connecting and/or searching is not working at:
ldap://dir.certifikat.dk

it's a ldapv3 only directory

Comment 4

[Carsten Menke]

I can confirm that Mozilla does not work with LDAP v3 only based servers due to
my own experience. I only got it to work when I explicitly enabled v2 on my LDAP
Server.

//Carsten

Comment 5

[Henrik Gemal]

is adding LDAPv3 support to Mozilla a large job or....?

All danes are given a digital signature and the directory that holds the
certificates is running LDAPv3 only...:( So no access for mozilla users. Outlook
Express supports LDAPv3

Comment 6

[Matthias Versen [:Matti]]

*** Bug 218988 has been marked as a duplicate of this bug. ***

Comment 7

[odi]

Please include v3 support. Openldap 2 defaults to using version 3. Can not use
Mozilla :-(

Comment 8

[Dan Mosedale (:dmosedale, :dmose)]

*** Bug 209304 has been marked as a duplicate of this bug. ***

Comment 9

[Dan Mosedale (:dmosedale, :dmose)]

As pointed out in http://bugzilla.mozilla.org/show_bug.cgi?id=209304#c1 OpenLDAP
can be set to still allow v2 connects.  In any case, I hope to get Moz
defaulting to v3 in 1.7a.

Comment 10

[rolf.offermanns]

I followed the suggestion in comment #1 and inserted the lines mentioned there
in the file:
directory/xpcom/base/src/nsLDAPConnection.cpp

at line 933.

Works for me now. OK, it fails on the first lookup, but I guess this is, because
I choosed the wrong place to insert the lines.

So it shouldn't be too hard for someone with a little more knowledge of the
mozilla codebase to fix this bug, shouldn't it?

If anyone would like to try it, the "fixed" version is here:
http://www.holy-penguin.de/libmozldap.so
(gcc (GCC) 3.2.3 20030316 (Debian prerelease))

Tested with thunderbird >=0.4, simply replaced components/libmozldap.so.

Comment 11

[Dan Mosedale (:dmosedale, :dmose)]

I want to make v2 available via hidden pref, so the actual changes I'm working
on are somewhat more complicated, as they have to tweak a few interface methods
to take a version param, as well as all the callers.  I still hope to get this
in to 1.7a.

Comment 12

[Dan Mosedale (:dmosedale, :dmose)]

*** Bug 12332 has been marked as a duplicate of this bug. ***

Comment 13

[Dan Mosedale (:dmosedale, :dmose)]

Attachment: patch to add and use a .protocolVersion preference, v1

Comment 14

[Scott MacGregor]

Comment on attachment 141127 [details] [diff] [review]
patch  to add and use a .protocolVersion preference, v1

r/sr=sspitzer on just the ldap changes, with some nits suggested to dmose over
aim.

the x-image-url stuff is not part of this fix.

Comment 15

[Dan Mosedale (:dmosedale, :dmose)]

Attachment: .protocolVersion patch, v2

Got rid of extraneous files, extraneous tab chars, and replaced a few
hardcorded numbers with symbolic constants.

Comment 16

[Dan Mosedale (:dmosedale, :dmose)]

Comment on attachment 141131 [details] [diff] [review]
.protocolVersion patch, v2

Carrying forward r+sr (which, despite what the bug says, actually came from
sspitzer, not mscott).

Comment 17

[Dan Mosedale (:dmosedale, :dmose)]

Attachment: .protocolVersion patch, v3

Forget a break statement in nsLDAPConnection.  Added some code so that LDAP
autoconfig won't break with this patch.  LDAP autoconfig will now use LDAPv3
unless the user adds a "setLDAPVersion" call to their autoconfig script before
calling getLDAPAttributes().

Comment 18

[(not reading, please use [e-mail] instead)]

Comment on attachment 141220 [details] [diff] [review]
.protocolVersion patch, v3

r/sr=sspitzer

Comment 19

[David :Bienvenu]

Need to patch the tbird version of MsgComposeCommands.js as well.

Comment 20

[David :Bienvenu]

Comment on attachment 141220 [details] [diff] [review]
.protocolVersion patch, v3

+	     try { 
+		 `protocolVersion = sPrefs.getCharPref(autocompleteDirectory + 
+						       ".protocolVersion");


a quote char ' snuck its way before protocol version, so please don't check
this in without removing it!

Comment 21

[chris hofmann]

a=chofmann for 1.7a.  if we are going to land this we need to do it pretty quick.

Comment 22

[David :Bienvenu]

Dan, if you want me to land this, I can - just let me know.

Comment 23

[David :Bienvenu]

fixed on trunk, a=chofmann.

Comment 24

[Andrew Schultz]

this busted mongo (IRIX 6.5 ports tinderbox):
cc-1162 CC: ERROR File =
/build2/tinderbox/mozilla/build/IRIX_6.5_Depend/mozilla/directory/xpcom/base/src/nsLDAPChannel.cpp,
Line = 643
  Too few arguments in function call.
                             : PR_FALSE, EmptyCString(), this, nsnull);
                                                                     ^

It looks like changes to nsLDAPChannel got left out of the patch.

Comment 25

[David :Bienvenu]

nsLDAPChannel isn't used on most platforms - not sure why it's used on IRIX, but
I bet that's why Dan left it out of the patch. I can look at it in the morning.

Comment 26

[David :Bienvenu]

Attachment: fix build bustage

this should fix the build bustage - this file is only compiled if
MOZ_LDAP_XPCOM_EXPERIMENTAL is turned on. I don't know how to check if the user
wants v2 vs v3 ldap here, but v3 will do for now.

Comment 27

[chris hofmann]

marking fixed

Comment 28

[Wolfgang Rosenauer [:wolfiR]]

using trunk-build from 20040309 and added an LDAP-addressbook it sets
user_pref("ldap_2.servers.slstdtestsystem.protocolVersion", "2");
There is no UI to set the version and the default for new addressbooks seems to
be 2? My old addressbook uses LDAPv3 because the default of nothing is in prefs.js
is V3?

Comment 29

[MORI Tomoya]

I am using 1.7RC1 build ID:2004042109. I changed protocolVersion property from 3
to 2 by about:config page. Because LDAP server of my organization is only
support LDAPv2.

I found this property have worked partialy yet. When I queried by "Address Book"
tool, I could monitored the version field of the LDAP Bind Request packet was 2
by Ethereal network packet capture tool. But when I queried by "To:" pane of the
compose mail window, the version field of the packet was 3 and displayed "<LDAP
initialization problem>" message and "Error code 2:Protocol error Please contact
your System Administrator" message was popped up.

Comment 30

[Scott MacGregor]

I think we missed a case here as pointed out in:

http://bugzilla.mozilla.org/show_bug.cgi?id=198168#c29

Comment 31

[Scott MacGregor]

Attachment: fix typo to let you turn of v3 for ldap auto complete

This still needs testing but should fix the problem.

Oddly, I don't see any of these change's in Seamonkey's MsgComposeCommands.js.
Hmmm.

Comment 32

[Dan Mosedale (:dmosedale, :dmose)]

Comment on attachment 147097 [details] [diff] [review]
fix typo to let you turn of v3 for ldap auto complete

r=dmose

Comment 33

[Dan Mosedale (:dmosedale, :dmose)]

mscott: in the attachment here that was slated to land originally
(".protocolVersion patch, v3"), there was patch for the seamonkey
MsgComposeCommands.js, complete with my typo of using ".login" instead of
".version".  I bet this didn't get landed with the rest of the patch.  If you
could land your corrected version in the SeaMonkey MsgComposeCommands.js on the
1.7branch & trunk, that would totally rule.

Comment 34

[Scott MacGregor]

Attachment: supplemental fix for seamonkey and fixes the typo

Yeah David and noticed that last night. Here's a new patch that has the missing
part for seamonkey plus fixes the typo.

Comment 35

[Scott MacGregor]

Comment on attachment 147109 [details] [diff] [review]
supplemental fix for seamonkey and fixes the typo

carrying over the r and sr. This needs to go into the 1.7 branch for sure

Comment 36

[Scott MacGregor]

fixed on the tbird 0.6 branch

fixed on the trunk

Leaving open for 1.7 approval 

Comment 37

[Henrik Skupin [:whimboo][⌚️UTC+2]]

(In reply to comment #35)
> (From update of attachment 147109 [details] [diff] [review])
> carrying over the r and sr. This needs to go into the 1.7 branch for sure

Get you this code compiled without any error? I don't think.

+                `protocolVersion = sPrefs.getCharPref(autocompleteDirectory + 
                 ^
It seems there is another typo.

Comment 38

[Scott MacGregor]

I fixed that ' charcter when I checked in already.

Comment 39

[chris hofmann]

Comment on attachment 147109 [details] [diff] [review]
supplemental fix for seamonkey and fixes the typo

a=chofmann for 1.7

Comment 40

[Scott MacGregor]

now fixed on the 1.7 branch too

Comment 41

[MORI Tomoya]

I guess bug 238485 and bug 240588 is duplication of this bug.

I could use ldap query on mail composer of latest trunk.

Comment 42

[Mike]

Once again, I hate to admit it, but MS got it right... Outlook Express tries v3
and if it fails uses v2.  Believe it or not, there are a number of places still
using v2.  Having a preference is a nice thing, but walking 2000+ users through
changing them is not nice.

Comment 43

[Mark Smith [:mcs]]

It surprises me that there are a lot of LDAP servers that still do not
recognized LDAPv3.  In Comment #1 I said:

  ... So the usual approach is to try LDAPv3 and fall back to v2 if
  the server returns that protocol error. But LDAPv2 is pretty old these
  days. It would probably be OK to always use v3 by default and have a
  config. option that says "use v2."

Sounds like I was wrong :(

Comment 44

[Markus Merz]

(In reply to comment #43)
> Sounds like I was wrong :(
Maybe simply too strict for enterprise use.

I would recommend:

- open a new bug
- link to this bug comment 42
- subject: LDAP v3 - fallback to v2 if v3 connect doesn't work with >=1.7
- Flag: block 1.7+ - reason: change in behaviour too heavy too handle for
enterprises with LDAP v2 Servers. support for manual switchback too hard to handle.
- add a comment here to link this bug to the new bug

Comment 45

[Mike]

(In reply to comment #44)
> I would recommend:
> 
> - open a new bug
> - link to this bug comment 42
> - subject: LDAP v3 - fallback to v2 if v3 connect doesn't work with >=1.7
> - Flag: block 1.7+ - reason: change in behaviour too heavy too handle for
> enterprises with LDAP v2 Servers. support for manual switchback too hard to
handle.
> - add a comment here to link this bug to the new bug

http://bugzilla.mozilla.org/show_bug.cgi?id=242789

Comment 46

[Dan Mosedale (:dmosedale, :dmose)]

Mike: you're right, the fallback is a better approach.  As far as deploying to a
large group of users, you might want to take a look at mozptch
<http://mozptch.mozdev.org/>, as it seems designed to solve exactly this problem.

Comment 47

[Karen Huang]

Verified as fix on latest 1.7 branch 06-24 builds.
Changing keywords from fixed1.7 to verified1.7.
Leave this bug status "as is" until this bug be verified on trunk again...

Comment 48

[R.K.Aa.]

*** Bug 249210 has been marked as a duplicate of this bug. ***

Comment 49

[Ian Broughton]

Has this been done?
Has the edit LDAP function been added?
This will enable me to remove the need to move to Exchange server.

See bug 86405

Comment 50

[David :Bienvenu]

ldap v3 is supported, but editing hasn't been implemented yet.