Operations against Active Directory fail due to default referral processing about google-apps-for-your-domain-ldap-sync

[GoogleCodeExporter]

Oops, additional bind was for testing.  This is the correct patch..

diff -u orig/ldap_ctxt.py new/ldap_ctxt.py
--- orig/ldap_ctxt.py   2008-06-24 20:53:52.000000000 -0400
+++ new/ldap_ctxt.py    2008-08-19 18:50:44.000000000 -0400
@@ -62,6 +62,7 @@
                   'ldap_base_dn': messages.MSG_LDAP_BASE_DN,
                   'ldap_timeout': messages.MSG_LDAP_TIMEOUT,
                   'ldap_page_size': messages.MSG_LDAP_PAGE_SIZE,
+                  'ldap_follow_referrals': messages.MSG_LDAP_FOLLOW_REFERRALS,
                   'tls_option': messages.MSG_TLS_OPTION,
                   'tls_cacertdir': messages.MSG_TLS_CACERTDIR,
                   'tls_cacertfile': messages.MSG_TLS_CACERTFILE}
@@ -80,6 +81,7 @@
     self.ldap_timeout = TIMEOUT_SECS
     self.ldap_url = None
     self.ldap_page_size = 0
+    self.ldap_follow_referrals = 'false'
     self.tls_option = 'never'
     self.tls_cacertdir = '/etc/ssl/certs'
     self.tls_cacertfile = ''
@@ -91,6 +93,10 @@
     self._required_config = ['ldap_url', 'ldap_user_filter', 'ldap_base_dn']
     self.config_changed = False
     self.conn = None
+    if self.ldap_follow_referrals == 'true':
+      ldap.set_option(ldap.OPT_REFERRALS, 1)
+    else:
+      ldap.set_option(ldap.OPT_REFERRALS, 0)
     if self.tls_option == 'demand':
       ldap.set_option(ldap.OPT_X_TLS, ldap.OPT_X_TLS_DEMAND)
     elif self.tls_option == 'allow':
diff -u orig/messages.py new/messages.py
--- orig/messages.py    2007-12-14 18:38:38.000000000 -0500
+++ new/messages.py     2008-08-19 18:44:38.000000000 -0400
@@ -157,6 +157,8 @@

 MSG_LDAP_URL = "URL for your LDAP server."

+MSG_LDAP_FOLLOW_REFERRALS = "Set to 'true' if LDAP referrals should be 
followed. 
Defaults to false"
+
 MSG_LDAP_PAGE_SIZE = """Some ldap servers (like Active Directory) will return 
 only a limited number of responses to a query and require the ldap client 
 to request more on subsequent requests.  If you have such a server, set this to

Original comment by [email protected] on 19 Aug 2008 at 10:51