LDAP-9: Add support to manually follow referrals about spring-ldap-migrate-issues

[rwinch]

Eric Rauer said:

Can this be handled by setting the context referral property to follow when creating the context? That should allow the jndi code to handle the referrals instead of passing the referral exception. See the jndi tutorial for more info, http://java.sun.com/products/jndi/tutorial/ldap/referral/jndi.html .

[rwinch]

Mattias Hellborg Arthursson said:

Yes, that should work with most LDAP servers (and btw you can specify this property using the baseEnvironmentPropertes property of ContextSource if your server does support it). Doesn’t work for Active Directory however, as AD is unable to automatically follow referrals. On AD you’ll need to do the work yourself.

[rwinch]

Claus Ibsen said:

Is this new information something that should be added to the reference doc (if not already there)?

[rwinch]

Mattias Hellborg Arthursson said:

I’m not sure if this is even a problem that can be addressed from inside the framework. We keep on moving it forward; maybe we should just close it with Won’t Fix…

[rwinch]

Nate Moser said:

See LDAP-136. After correcting for the DN parsing issue common to all entries returned from referrals with the JNDI context set to Context.REFERRAL==“follow”, I was able to successfully follow referrals between Active Directory 2003 servers. It sounds like original intent of this issue was to be able to use the Context.REFERRAL == “throw” setting, where ReferralExceptions are thrown, caught, and manually traversed. This allows for conditional processing of results (e.g., discard any results from ldap://someserver.example.com:389) and changing the bind credentials before connecting to the referral context. Admittedly, this would be a bit difficult to achieve within LdapTemplate.

Also worth noting that when the context is set follow referrals, AD does not return the PartialResultsException that org.springframework.ldap.core.LdapTemplate#setIgnorePartialResultException is used to skip. However, you will either need to set your client host to use a DNS server holding entries for the spurious zones and configuration referrals returned by AD, e.g.

search reference

ref: ldap://ForestDnsZones.TEST.COM/DC=ForestDnsZones,DC=TEST,DC=COM

search reference

ref: ldap://DomainDnsZones.TEST.COM/DC=DomainDnsZones,DC=TEST,DC=COM

search reference

ref: ldap://TEST.COM/CN=Configuration,DC=TEST,DC=COM

or use the Global Catalog server (port 3268).

[rwinch]

Mattias Hellborg Arthursson said:

Thanks Nate for the elaborate explanation on this. With the resolution of LDAP-136, this issue is actually to be considered solved as well. Setting the referral method to “follow” really should be the way to go about this, and the library should now support that fully.