venugopal chinnakotla wrote:

Hi Team,

We are working on migration of nsldap C sdk to OpenLDAP C sdk for our application client code.

We are using OpenLDAP 2.6.7.

As part of this migration, we are facing one issue related to LDAP Referrals when LDAP_OPT_REFERRALS=ON (which means SDK will handle Referrals internally)

While testing our application which makes use of OpenLDAP sdk , we see a difference in the referral handling when LDAP_OPT_REFERRALS=ON when compared with NSLDAP C SDK with user bind We are testing with Oracle Unified Directory, referrals is enabled at server.

*With OpenLDAP C SDK:* When our application follows the bind(synchronous) request for the users which is present in another server (where chase should happen)     ldap_bind_s →        - Which internally calls ldap_sasl_bind_s → ldap_sasl_bind + ldap_result        able to succeed the bind (LDAP_SUCCESS).   And When our application follows the bind(asynchronous) request for the users which is present in another server (where chase should happen)     ldap_simple_bind ->         - which internally calls ldap_sasl_bind

failed to bind and returned (LDAP_REFERRAL) instead.

On further analysis of OpenLDAP code *result.c* (line# 728)  we observed, there is exclusion for bind request *tag != LDAP_RES_BIND*, which is preventing to chase the referral internally.

Use `git blame` to see the commit that changed a line of code, and then read about why it was changed. In this case, that line was changed in e5302c2431f due to ITS#6510.

/    /* Do we need to check for referrals? */             if ( tag != LDAP_RES_BIND &&                 ( LDAP_BOOL_GET(&ld->ld_options, LDAP_BOOL_REFERRALS) ||                     lr->lr_parent != NULL ))             {                 char        **refs = NULL;                 ber_len_t   len;                 /* Check if V3 referral */                 if ( ber_peek_tag( &tmpber, &len ) == LDAP_TAG_REFERRAL ) {                     ...                     /* Chase the referral */                     refer_cnt = ldap_chase_v3referrals( ld, lr, refs, ... );/

However, we don't see such exclusion with NSLDAP C SDK specifically for bind requests. We would like to understand the limitation for asynchronous bind when handling referral internally. Are there any known issues/limitations with this use case when OpenLDAP C SDK handles referrals? Is there any way (like any flag/option) to make automatic referrals work with asynchronous bind calls  ldap_simple_bind?

Please note that, the ldap_search succeeds with when LDAP_OPT_REFERRALS=ON, no issue observed.