{"action":"created","issue":{"url":"https://api.github.com/repos/cannatag/ldap3/issues/114","labels_url":"https://api.github.com/repos/cannatag/ldap3/issues/114/labels{/name}","comments_url":"https://api.github.com/repos/cannatag/ldap3/issues/114/comments","events_url":"https://api.github.com/repos/cannatag/ldap3/issues/114/events","html_url":"https://github.com/cannatag/ldap3/issues/114","id":110873475,"number":114,"title":"I can not get SASL/EXTERNAL working","user":{"login":"croessner","id":2562594,"avatar_url":"https://avatars.githubusercontent.com/u/2562594?v=3","gravatar_id":"","url":"https://api.github.com/users/croessner","html_url":"https://github.com/croessner","followers_url":"https://api.github.com/users/croessner/followers","following_url":"https://api.github.com/users/croessner/following{/other_user}","gists_url":"https://api.github.com/users/croessner/gists{/gist_id}","starred_url":"https://api.github.com/users/croessner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/croessner/subscriptions","organizations_url":"https://api.github.com/users/croessner/orgs","repos_url":"https://api.github.com/users/croessner/repos","events_url":"https://api.github.com/users/croessner/events{/privacy}","received_events_url":"https://api.github.com/users/croessner/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-10-11T18:14:56Z","updated_at":"2015-10-11T19:56:53Z","closed_at":null,"body":"These are my first steps to ldap3. I have an OpenLDAP server that accepts StartTLS on port 389.\r\n\r\n want to use SSL-certs to authz-to to a special user. This all works perfectly with python-ldap in python2.7. Now that I try to port some software to python3.4, I wanted to use ldap3.\r\n\r\nHere is what I tried so far:\r\n\r\n-------------------------------------------------------------------------------------------------------------------\r\n#!/usr/bin/python3\r\n\r\nimport ssl\r\n\r\nfrom ldap3 import Server, Connection, Tls, AUTH_SASL, SUBTREE\r\n\r\ntls_configuration = Tls(local_private_key_file='/etc/ssl/private/mx.roessner-net.de.key',\r\n                        local_certificate_file='/etc/ssl/certs/mx.roessner-net.de.crt',\r\n                        ca_certs_file='/etc/ssl/certs/ca-certificates.crt',\r\n                        validate=ssl.CERT_REQUIRED,\r\n                        version=ssl.PROTOCOL_TLSv1)\r\n\r\nserver = Server('db.roessner-net.de',\r\n                tls=tls_configuration)\r\n\r\nconn = Connection(server,\r\n                  authentication=AUTH_SASL,\r\n                  sasl_mechanism='EXTERNAL',\r\n                  sasl_credentials=())\r\n\r\nconn.open()\r\nconn.start_tls()\r\n\r\nbind = conn.do_sasl_bind(controls=None)\r\nprint(\"bind: %s\" % str(bind))\r\n\r\ni_am = conn.extend.standard.who_am_i()\r\nprint(i_am)\r\n\r\nconn.search(search_base='ou=people,ou=it,dc=roessner-net,dc=de',\r\n            search_filter='(objectclass=*)',\r\n            attributes=['cn'],\r\n            search_scope=SUBTREE)\r\n\r\nprint(conn)\r\nprint(conn.entries)\r\n-------------------------------------------------------------------------------------------------------------------\r\n\r\nTrying to use this, I receive an error:\r\n\r\nbind: {'type': 'bindResponse', 'dn': '', 'saslCreds': b'', 'referrals': None, 'message': 'SASL(0): successful result: ', 'description': 'saslBindInProgress', 'result': 14}\r\nTraceback (most recent call last):\r\n  File \"./ldap-test.py\", line 27, in <module>\r\n    i_am = conn.extend.standard.who_am_i()\r\n  File \"/usr/lib64/python3.4/site-packages/ldap3/extend/__init__.py\", line 53, in who_am_i\r\n    return WhoAmI(self._connection).send()\r\n  File \"/usr/lib64/python3.4/site-packages/ldap3/extend/operation.py\", line 57, in send\r\n    self.decode_response()\r\n  File \"/usr/lib64/python3.4/site-packages/ldap3/extend/operation.py\", line 69, in decode_response\r\n    raise LDAPExtensionError('extended operation error: ' + self.result['description'] + ' - ' + self.result['message'])\r\nldap3.core.exceptions.LDAPExtensionError: extended operation error: operationsError - SASL bind in progress\r\n\r\nI spent hours now, but I do not get it to work. I have no idea, if I did something wrong or if I just encountered a bug. So I ask you, if you can give me a hint.\r\n\r\nI want ldap3 for automx, which you also find as an OSS here on Github ;-)"},"comment":{"url":"https://api.github.com/repos/cannatag/ldap3/issues/comments/147239526","html_url":"https://github.com/cannatag/ldap3/issues/114#issuecomment-147239526","issue_url":"https://api.github.com/repos/cannatag/ldap3/issues/114","id":147239526,"user":{"login":"croessner","id":2562594,"avatar_url":"https://avatars.githubusercontent.com/u/2562594?v=3","gravatar_id":"","url":"https://api.github.com/users/croessner","html_url":"https://github.com/croessner","followers_url":"https://api.github.com/users/croessner/followers","following_url":"https://api.github.com/users/croessner/following{/other_user}","gists_url":"https://api.github.com/users/croessner/gists{/gist_id}","starred_url":"https://api.github.com/users/croessner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/croessner/subscriptions","organizations_url":"https://api.github.com/users/croessner/orgs","repos_url":"https://api.github.com/users/croessner/repos","events_url":"https://api.github.com/users/croessner/events{/privacy}","received_events_url":"https://api.github.com/users/croessner/received_events","type":"User","site_admin":false},"created_at":"2015-10-11T19:56:53Z","updated_at":"2015-10-11T19:56:53Z","body":"I tried this before :-) Here is the result:\r\n\r\nbind: False\r\nTraceback (most recent call last):\r\n  File \"./ldap-test.py\", line 28, in <module>\r\n    i_am = conn.extend.standard.who_am_i()\r\n  File \"/usr/lib64/python3.4/site-packages/ldap3/extend/__init__.py\", line 53, in who_am_i\r\n    return WhoAmI(self._connection).send()\r\n  File \"/usr/lib64/python3.4/site-packages/ldap3/extend/operation.py\", line 57, in send\r\n    self.decode_response()\r\n  File \"/usr/lib64/python3.4/site-packages/ldap3/extend/operation.py\", line 69, in decode_response\r\n    raise LDAPExtensionError('extended operation error: ' + self.result['description'] + ' - ' + self.result['message'])\r\nldap3.core.exceptions.LDAPExtensionError: extended operation error: operationsError - SASL bind in progress\r\n\r\nbind() seems not to bind.\r\n\r\nAnd yes, I want SASL/EXTERNAL. Here is the authz-to from openldap that works perfectly over 8 servers:\r\n\r\nauthz-policy    to\r\n\r\nauthz-regexp\r\n        cn=mx\\.roessner-net\\.de,ou=Mail,o=R.N.S.,l=Alsfeld,st=Hessen,dc=roessner-net,dc=de,c=DE$\r\n        cn=mail,ou=people,ou=it,dc=roessner-net,dc=de\r\n\r\nAnd the object cn=mail:\r\n\r\ndn: cn=mail,ou=people,ou=it,dc=roessner-net,dc=de\r\nobjectClass: simpleSecurityObject\r\nobjectClass: organizationalRole\r\nstructuralObjectClass: organizationalRole\r\ncn: mail\r\ndescription: LDAP administrator for the mail system (read-only)\r\nuserPassword:: *****\r\nauthzTo: {0}dn.regex:uid=.*,ou=([^,].+),ou=people,ou=it,dc=roessner-net,dc=de\r\n\r\nThis user can switch to different other users like this:\r\n\r\nauthz-regexp\r\n        uid=([^,]+),(cn=[^,]+,)?cn=[^,]+,cn=auth\r\n        ldap:///ou=people,ou=it,dc=roessner-net,dc=de??sub?(&(objectclass=rnsMSPostfixAccount)(|(rnsMSRecipientAddress=$1)(uniqueIdentifier=$1)))\r\n\r\nYou see, I want SASL/EXTERNAL :-)"}}