All data by metadata provider is in list form.

[dragonpaw]

As it stands now, all metadata returned is in list form, even when it is single element. This makes for some unappealing code when accessing these attributes. (Maybe this is a 'feature' of my specific LDAP server?)

email = request.identity['mail'][0]
name = request.identity['display_name'][0]
...

(I'm complaining about the trailing [0].)

[Gustavo Narea (gnarea)]

Hello, dragonpaw.

I understand the problem with the keys, but unfortunately I'm afraid there's nothing we could do here, since it's perfectly valid to have more than one value for a field.

Cheers.

[dragonpaw (ash-dragonpaw)]

The patch I submitted handles both cases, by only flattening data when
there is only one value (len == 1). It makes for much simpler code in
the case where there are just one value (which is like 95% of them)
while still fully supporting the case where there will be more than
one value. Admittedly, I've made it now a developer issue if there is
returned a list when the dev only expects a single value, but I think
that's actually an improvement over the prior case where the idiom
would be email[0] all the time, overlooking the real fact that if
indeed two email addresses came back, you'd never notice it and
possibly overlook corrupt or malfored data in the LDAP repository that
way.

Please reconsider your decision not to accept this patch.

[Damien Baty (damien-baty)]

I have the same concerns as the original poster. I ended up with the attached patch, defining the attributes that may be flattened (i.e. converted from a one-value list to a string) in a "who.ini". I think this may be a safer way, rather than doing it for any attribute (especially considering that already deployed applications may expect the current behaviour). With the attached patch, the current behaviour is not changed, unless the application is configured otherwise.

For example, in a who.ini, I have this::

  [plugin:ldap_attributes]
  use = repoze.who.plugins.ldap:LDAPAttributesPlugin
  ldap_connection = ldap://localhost
  attributes = cn,uid
  flatten_attributes = cn,uid

... because I happen to know that all users have only one common name and UID.

If this idea is accepted, I'll write tests for it, too.