users_ldap: Unable to connect to Active Directory containing non-ASCII characters

[Li Wee, Ong]

When connecting to Active Directory containing non-ASCII characters, the following errors occurs ...

Server Traceback (most recent call last):
  File "/opt/openerp/server/openerp/addons/web/common/http.py", line 592, in send
    result = openerp.netsvc.dispatch_rpc(service_name, method, args)
  File "/opt/openerp/server/openerp/netsvc.py", line 360, in dispatch_rpc
    result = ExportService.getService(service_name).dispatch(method, params)
  File "/opt/openerp/server/openerp/service/web_services.py", line 384, in dispatch
    return fn(*params)
  File "/opt/openerp/server/openerp/service/web_services.py", line 396, in exp_authenticate
    return res_users.authenticate(db, login, password, user_agent_env)
  File "/opt/openerp/server/openerp/addons/base/res/res_users.py", line 456, in authenticate
    uid = self.login(db, login, password)
  File "/opt/openerp/server/openerp/addons/users_ldap/users_ldap.py", line 254, in login
    entry = ldap_obj.authenticate(conf, login, password)
  File "/opt/openerp/server/openerp/addons/users_ldap/users_ldap.py", line 100, in authenticate
    results = self.query(conf, filter)
  File "/opt/openerp/server/openerp/addons/users_ldap/users_ldap.py", line 144, in query
    filter, retrieve_attributes, timeout=60)
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 505, in search_st
    return self.search_ext_s(base,scope,filterstr,attrlist,attrsonly,None,None,timeout)
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 495, in search_ext_s
    msgid = self.search_ext(base,scope,filterstr,attrlist,attrsonly,serverctrls,clientctrls,timeout,sizelimit)
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 491, in search_ext
    timeout,sizelimit,
  File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 96, in _ldap_call
    result = func(*args,**kwargs)
UnicodeEncodeError: 'ascii' codec can't encode characters in position 3-4: ordinal not in range(128)

This behaviour happens in both 6.1 and 7.0.
In my case, the ldap_base string contains non-ascii characters and I used "encode('utf-8')" as a quick fix.

Original code in users_ldap.py

results = conn.search_st(conf['ldap_base'], ldap.SCOPE_SUBTREE, filter, retrieve_attributes, timeout=60)

Modified code in users_ldap.py

results = conn.search_st(conf['ldap_base'].encode('utf-8'), ldap.SCOPE_SUBTREE, filter, retrieve_attributes, timeout=60)

This fix only works for 6.1.
Using this fix for 7.0, a different error relating to database insertion (creating new user) occurs.

[Li Wee, Ong (liwee-ong)]

The same fix is also working for 7.0 now ... not sure why it didn't work initially.

[Daniel Reis (dreis-pt)]

Just reproduced this problem in 6.1.
The fix above didn't work for me.

The patch I used was, in users_ldap,pt, class CompanyLDAP, method authenticate():

replace
                conn = self.connect(conf)
                conn.simple_bind_s(dn, password)
                conn.unbind()

with
                conn = self.connect(conf)
                conn.simple_bind_s(dn, password.encode("utf-8") )
                conn.unbind()

[Daniel Reis (dreis-pt)]

This issue is also present at trunk.

[martin (riess82)]

For me, the following worked:

Changes in users_ldap.py:

                conn = self.connect(conf)
                conn.simple_bind_s(dn, password.encode("utf-8"))
                conn.unbind()

and:

            conn.simple_bind_s(conf['ldap_binddn'] or '',
                               conf['ldap_password'].encode('utf-8') or '')
            results = conn.search_st(conf['ldap_base'].encode('utf-8'), ldap.SCOPE_SUBTREE,
                                     filter, retrieve_attributes, timeout=60)

[Olivier Dony (Odoo) (odo-openerp)]

The python-ldap library has some legacy code that predates the unicode introduction in Python, and all its methods expect bytestrings parameters only (utf-8 encoded for LDAPv3).
All the parameters that are taken from the OpenERP database need to be utf-8 encoded before being passed to the LDAP functions (by default the database returns unicode values)

Thanks for reporting!

[Alexandre Allouche (alexandre-allouche)]

Hello everyone,

I don't see any active branch on this fix. As it has been confirmed, shall we expect a core team to work on this?
Olivier, your comment is perfectly relevant so, if needed, I can ask my team to propose a patch.

Regards

[Daniel Reis (dreis-pt)]

Just stumbled upon this bug again, on v7 :-P

[Stefan Rijnhart (Opener) (stefan-opener)]

Hi Daniel,

I'm removing OCB-addons as an affected project for this bug as per project policy. Of course the bug affects ocb-addons by definition as well as openobject-addons but we only want to track bugs that we fix in OCB-specific changes. Therefore, you should only add bugs to the project that you are going to propose a solution for.

Thanks,
Stefan.

[Stefan Rijnhart (Opener) (stefan-opener)]

Oh wait, I see that you only proposed to ocb-addons, but not to openobject-addons. You'd need to backport the fix to openobject-addons then, once you are satisfied with the ocb one.