Can't set empty group about ldap3

[cannatag]

hello, I can't test it now. In LDAP there is no idea of "empty" attributes. An empty attribute should not be shown at all. Probably the member attribute as a NULL value. Can you try with 'member':: [chr(0)] in the add operation?

Anyway are you sure that member can be empty? It it is defined as MUST in the schema it should have a value.

ANyway tomorrow I will test it in my lab.

Bye,
Giovanni

[jtgasper3]

Hi,

I tested the [chr(0)] and no luck:

{'message': 'member: value #0 invalid per syntax', 'description': 'invalidAttributeSyntax', 'referrals': None, 'result': 21, 'type': 'addResponse', 'dn': ''}

I quickly spun up a second ldap server (I have Docker images for openLdap and 389-ds) and tried the same ldif and it also accepted it.

Apache Directory Studio exports the entry as well.

[jtgasper3]

I found a reference in http://www.ldapexplorer.com/en/manual/103021500-edit-set-empty-value.htm to setting an Empty value for member in a group. This looks to be user-agent specific, but the principal is the same.

Thanks for looking into this.

[cannatag]

Hi, please check code in dev. I've releaxed the attribute checking. Now you can send an empty attribute value (with '') even if this is forbidden by the rfc.

attributes={'cn': "test2", 'member': ''},

Let me know if it works for you.

Bye,
Giovanni

[jtgasper3]

Thanks for working on this. I'll probably not be able to test until Monday, but wanted to let you know that I am not ignoring you.

[jtgasper3]

Hello,

Using attributes={'cn': "test2", 'member': ''}, worked perfectly for my case. Thanks!

Thanks for the attribution in the release notes... One side note... 389-ds also supports this empty case.

[cannatag]

thanks. released in 0.9.9.1