comparison man/lispref/ldap.texi @ 412:697ef44129c6 r21-2-14

Import from CVS: tag r21-2-14
author cvs
date Mon, 13 Aug 2007 11:20:41 +0200
parents b8cc9ab3f761
children
comparison
equal deleted inserted replaced
411:12e008d41344 412:697ef44129c6
1 @c -*-texinfo-*- 1 @c -*-texinfo-*-
2 @c This is part of the XEmacs Lisp Reference Manual. 2 @c This is part of the XEmacs Lisp Reference Manual.
3 @c Copyright (C) 1998 Free Software Foundation, Inc. 3 @c Copyright (C) 1998 Free Software Foundation, Inc.
4 @c See the file lispref.texi for copying conditions. 4 @c See the file lispref.texi for copying conditions.
5 @setfilename ../../info/ldap.info 5 @setfilename ../../info/ldap.info
6 @node LDAP Support, PostgreSQL Support, ToolTalk Support, top 6 @node LDAP Support, Internationalization, ToolTalk Support, top
7 @chapter LDAP Support 7 @chapter LDAP Support
8 @cindex LDAP 8 @cindex LDAP
9 9
10 XEmacs can be linked with a LDAP client library to provide Elisp primitives 10 XEmacs can be linked with a LDAP client library to provide Elisp primitives
11 to access directory servers using the Lightweight Directory Access Protocol. 11 to access directory servers using the Lightweight Directory Access Protocol.
23 LDAP support must be added to XEmacs at build time since it requires 23 LDAP support must be added to XEmacs at build time since it requires
24 linking to an external LDAP client library. As of 21.2, XEmacs has been 24 linking to an external LDAP client library. As of 21.2, XEmacs has been
25 successfully built and tested with 25 successfully built and tested with
26 26
27 @itemize @bullet 27 @itemize @bullet
28 @item OpenLDAP 1.2 (@url{http://www.openldap.org/}) 28 @item OpenLDAP 1.0.3 (@url{http://www.openldap.org/})
29 @item University of Michigan's LDAP 3.3 (@url{http://www.umich.edu/~dirsvcs/ldap/}) 29 @item University of Michigan's LDAP 3.3 (@url{http://www.umich.edu/~dirsvcs/ldap/})
30 @item LDAP SDK 1.0 from Netscape Corp. (@url{http://developer.netscape.com/}) 30 @item LDAP SDK 1.0 from Netscape Corp. (@url{http://developer.netscape.com/})
31 @end itemize 31 @end itemize
32 32
33 Other libraries conforming to RFC 1823 will probably work also but may 33 Other libraries conforming to RFC 1823 will probably work also but may
34 require some minor tweaking at C level. 34 require some minor tweaking at C level.
35 35
36 The standard XEmacs configure script auto-detects an installed LDAP 36 The standard XEmacs configure script autodetects an installed LDAP
37 library provided the library itself and the corresponding header files 37 library provided the library itself and the corresponding header files
38 can be found in the library and include paths. A successful detection 38 can be found in the library and include paths. A successful detection
39 will be signalled in the final output of the configure script. 39 will be signalled in the final output of the configure script.
40 40
41 41
47 XEmacs LDAP API consists of two layers: a low-level layer which tries 47 XEmacs LDAP API consists of two layers: a low-level layer which tries
48 to stay as close as possible to the C API (where practical) and a 48 to stay as close as possible to the C API (where practical) and a
49 higher-level layer which provides more convenient primitives to 49 higher-level layer which provides more convenient primitives to
50 effectively use LDAP. 50 effectively use LDAP.
51 51
52 The low-level API should be used directly for very specific purposes 52 As of XEmacs 21.0, only interfaces to basic LDAP search functions are
53 (such as multiple operations on a connection) only. The higher-level 53 provided, broader support is planned in future versions.
54 functions provide a more convenient way to access LDAP directories
55 hiding the subtleties of handling the connection, translating arguments
56 and ensuring compliance with LDAP internationalization rules and formats
57 (currently partly implemented only).
58 54
59 @menu 55 @menu
60 * LDAP Variables:: Lisp variables related to LDAP 56 * LDAP Variables:: Lisp variables related to LDAP
61 * The High-Level LDAP API:: High-level LDAP lisp functions 57 * The High-Level LDAP API:: High-level LDAP lisp functions
62 * The Low-Level LDAP API:: Low-level LDAP lisp primitives 58 * The Low-Level LDAP API:: Low-level LDAP lisp primitives
63 * LDAP Internationalization:: I18n variables and functions
64 @end menu 59 @end menu
65 60
66 61
67 @node LDAP Variables, The High-Level LDAP API, XEmacs LDAP API, XEmacs LDAP API 62 @node LDAP Variables, The High-Level LDAP API, XEmacs LDAP API, XEmacs LDAP API
68 @comment node-name, next, previous, up 63 @comment node-name, next, previous, up
80 @end defvar 75 @end defvar
81 76
82 @defvar ldap-default-base 77 @defvar ldap-default-base
83 Default base for LDAP searches. 78 Default base for LDAP searches.
84 This is a string using the syntax of RFC 1779. 79 This is a string using the syntax of RFC 1779.
85 For instance, "o=ACME, c=US" limits the search to the 80 For instance, "o¬ME, cÿ" limits the search to the
86 Acme organization in the United States. 81 Acme organization in the United States.
87 @end defvar 82 @end defvar
88 83
89 @defvar ldap-host-parameters-alist 84 @defvar ldap-host-parameters-alist
90 An alist of per host options for LDAP transactions. 85 An alist of per host options for LDAP transactions.
95 property/value pairs describing parameters for the server. Valid 90 property/value pairs describing parameters for the server. Valid
96 properties: 91 properties:
97 @table @code 92 @table @code
98 @item binddn 93 @item binddn
99 The distinguished name of the user to bind as. This may look like 94 The distinguished name of the user to bind as. This may look like
100 @samp{cn=Babs Jensen,o=ACME,c=US}, see RFC 1779 for details. 95 @samp{cÿ, o¬me, cnÿnny Bugs}, see RFC 1779 for details.
101 @item passwd 96 @item passwd
102 The password to use for authentication. 97 The password to use for authentication.
103 @item auth 98 @item auth
104 The authentication method to use, possible values depend on the LDAP 99 The authentication method to use, possible values depend on the LDAP
105 library XEmacs was compiled with, they may include @code{simple}, 100 library XEmacs was compiled with, they may include @code{simple},
130 @item sizelimit 125 @item sizelimit
131 The maximum number of matches to return for searches performed on this connection. 126 The maximum number of matches to return for searches performed on this connection.
132 @end table 127 @end table
133 @end defvar 128 @end defvar
134 129
135 @defvar ldap-verbose
136 If non-@code{nil}, LDAP operations will echo progress messages. Defaults to @code{nil}.
137 @end defvar
138 130
139 131
140 @node The High-Level LDAP API, The Low-Level LDAP API, LDAP Variables, XEmacs LDAP API 132 @node The High-Level LDAP API, The Low-Level LDAP API, LDAP Variables, XEmacs LDAP API
141 @comment node-name, next, previous, up 133 @comment node-name, next, previous, up
142 @subsection The High-Level LDAP API 134 @subsection The High-Level LDAP API
143 135
144 The following functions provide the most convenient interface to perform 136 As of this writing the high-level Lisp LDAP API only provides for LDAP
145 LDAP operations. All of them open a connection to a host, perform an 137 searches. Further support is planned in the future.
146 operation (add/search/modify/delete) on one or several entries and 138
147 cleanly close the connection thus insulating the user from all the 139 The @code{ldap-search} function provides the most convenient interface
148 details of the low-level interface such as LDAP Lisp objects @pxref{The 140 to perform LDAP searches. It opens a connection to a host, performs the
149 Low-Level LDAP API}. 141 query and cleanly closes the connection thus insulating the user from
150 142 all the details of the low-level interface such as LDAP Lisp objects
151 Note that @code{ldap-search} which used to be the name of the high-level 143 @pxref{The Low-Level LDAP API}
152 search function in XEmacs 21.1 is now obsolete. For consistency in the 144
153 naming as well as backward compatibility, that function now acts as a 145 @defun ldap-search filter &optional host attributes attrsonly
154 wrapper that calls either @code{ldap-search-basic} (low-level search
155 function) or @code{ldap-search-entries} (high-level search function)
156 according to the actual parameters. A direct call to one of these two
157 functions is preferred since it is faster and unambiguous.
158
159 @defun ldap-search-entries filter &optional host attributes attrsonly withdn
160 Perform an LDAP search. 146 Perform an LDAP search.
161 @var{filter} is the search filter @pxref{Syntax of Search Filters} 147 @var{filter} is the search filter @pxref{Syntax of Search Filters}
162 @var{host} is the LDAP host on which to perform the search. 148 @var{host} is the LDAP host on which to perform the search
163 @var{attributes} is the specific attributes to retrieve, @code{nil} means 149 @var{attributes} is the specific attributes to retrieve, @code{nil} means
164 retrieve all. 150 retrieve all
165 @var{attrsonly} if non-@code{nil} retrieves the attributes only without 151 @var{attrsonly} if non-@code{nil} retrieves the attributes only without
166 their associated values. 152 their associated values.
167 If @var{withdn} is non-@code{nil} each entry in the result will be prepended with
168 its distinguished name DN.
169 Additional search parameters can be specified through 153 Additional search parameters can be specified through
170 @code{ldap-host-parameters-alist}. 154 @code{ldap-host-parameters-alist}.
171 The function returns a list of matching entries. Each entry is itself 155 @end defun
172 an alist of attribute/value pairs optionally preceded by the DN of the 156
173 entry according to the value of @var{withdn}. 157 @node The Low-Level LDAP API, , The High-Level LDAP API, XEmacs LDAP API
174 @end defun
175
176 @defun ldap-add-entries entries &optional host binddn passwd
177 Add entries to an LDAP directory. @var{entries} is a list of entry
178 specifications of the form @code{(DN (ATTR . VALUE) (ATTR . VALUE) ...)}
179 where @var{dn} the distinguished name of an entry to add, the following
180 are cons cells containing attribute/value string pairs. @var{host} is
181 the LDAP host, defaulting to `ldap-default-host' @var{binddn} is the DN
182 to bind as to the server @var{passwd} is the corresponding password.
183 @end defun
184
185 @defun ldap-modify-entries entry-mods &optional host binddn passwd
186 Modify entries of an LDAP directory.
187 @var{entry_mods} is a list of entry modifications of the form
188 @code{(DN MOD-SPEC1 MOD-SPEC2 ...)} where @var{dn} is the distinguished name of
189 the entry to modify, the following are modification specifications.
190 A modification specification is itself a list of the form
191 @code{(MOD-OP ATTR VALUE1 VALUE2 ...)} @var{mod-op} and @var{attr} are mandatory,
192 @var{values} are optional depending on @var{mod-op}.
193 @var{mod-op} is the type of modification, one of the symbols @code{add}, @code{delete}
194 or @code{replace}. @var{attr} is the LDAP attribute type to modify.
195 @var{host} is the LDAP host, defaulting to @code{ldap-default-host}
196 @var{binddn} is the DN to bind as to the server
197 @var{passwd} is the corresponding password"
198 @end defun
199
200 @defun ldap-delete-entries dn &optional host binddn passwd
201 Delete an entry from an LDAP directory.
202 @var{dn} is the distinguished name of an entry to delete or
203 a list of those.
204 @var{host} is the LDAP host, defaulting to @code{ldap-default-host}
205 @var{binddn} is the DN to bind as to the server
206 @var{passwd} is the corresponding password.
207 @end defun
208
209
210 @node The Low-Level LDAP API, LDAP Internationalization, The High-Level LDAP API, XEmacs LDAP API
211 @comment node-name, next, previous, up 158 @comment node-name, next, previous, up
212 @subsection The Low-Level LDAP API 159 @subsection The Low-Level LDAP API
213
214 The low-level API should be used directly for very specific purposes
215 (such as multiple operations on a connection) only. The higher-level
216 functions provide a more convenient way to access LDAP directories
217 hiding the subtleties of handling the connection, translating arguments
218 and ensuring compliance with LDAP internationalization rules and formats
219 (currently partly implemented only). See @pxref{The High-Level LDAP API}
220
221 Note that the former functions @code{ldap-*-internal} functions have been
222 renamed in XEmacs 21.2
223 160
224 @menu 161 @menu
225 * The LDAP Lisp Object:: 162 * The LDAP Lisp Object::
226 * Opening and Closing a LDAP Connection:: 163 * Opening and Closing a LDAP Connection::
227 * Low-level Operations on a LDAP Server:: 164 * Searching on a LDAP Server (Low-level)::
228 @end menu 165 @end menu
229 166
230 @node The LDAP Lisp Object, Opening and Closing a LDAP Connection, The Low-Level LDAP API, The Low-Level LDAP API 167 @node The LDAP Lisp Object, Opening and Closing a LDAP Connection, The Low-Level LDAP API, The Low-Level LDAP API
231 @comment node-name, next, previous, up 168 @comment node-name, next, previous, up
232 @subsubsection The LDAP Lisp Object 169 @subsubsection The LDAP Lisp Object
245 @defun ldap-live-p ldap 182 @defun ldap-live-p ldap
246 Return non-@code{nil} if @var{ldap} is an active LDAP connection 183 Return non-@code{nil} if @var{ldap} is an active LDAP connection
247 @end defun 184 @end defun
248 185
249 186
250 @node Opening and Closing a LDAP Connection, Low-level Operations on a LDAP Server, The LDAP Lisp Object, The Low-Level LDAP API 187 @node Opening and Closing a LDAP Connection, Searching on a LDAP Server (Low-level), The LDAP Lisp Object, The Low-Level LDAP API
251 @comment node-name, next, previous, up 188 @comment node-name, next, previous, up
252 @subsubsection Opening and Closing a LDAP Connection 189 @subsubsection Opening and Closing a LDAP Connection
253 190
254 @defun ldap-open host &optional plist 191 @defun ldap-open host &optional plist
255 Open a LDAP connection to @var{host}. 192 Open a LDAP connection to @var{host}.
263 The authentication method to use, possible values depend on the LDAP 200 The authentication method to use, possible values depend on the LDAP
264 library XEmacs was compiled with, they may include @code{simple}, 201 library XEmacs was compiled with, they may include @code{simple},
265 @code{krbv41} and @code{krbv42}. 202 @code{krbv41} and @code{krbv42}.
266 @item binddn 203 @item binddn
267 The distinguished name of the user to bind as. This may look like 204 The distinguished name of the user to bind as. This may look like
268 @samp{c=com, o=Acme, cn=Babs Jensen}, see RFC 1779 for details. 205 @samp{cÿ, o¬me, cnÿnny Bugs}, see RFC 1779 for details.
269 @item passwd 206 @item passwd
270 The password to use for authentication. 207 The password to use for authentication.
271 @item deref 208 @item deref
272 The dereference policy is one of the symbols @code{never}, 209 The dereference policy is one of the symbols @code{never},
273 @code{always}, @code{search} or @code{find} and defines how aliases are 210 @code{always}, @code{search} or @code{find} and defines how aliases are
293 @defun ldap-close ldap 230 @defun ldap-close ldap
294 Close the connection represented by @var{ldap} 231 Close the connection represented by @var{ldap}
295 @end defun 232 @end defun
296 233
297 234
298 @node Low-level Operations on a LDAP Server, , Opening and Closing a LDAP Connection, The Low-Level LDAP API 235 @node Searching on a LDAP Server (Low-level), , Opening and Closing a LDAP Connection, The Low-Level LDAP API
299 @comment node-name, next, previous, up 236 @comment node-name, next, previous, up
300 @subsubsection Low-level Operations on a LDAP Server 237 @subsubsection Searching on a LDAP Server (Low-level)
301 238
302 @code{ldap-search-basic} is the low-level primitive to perform a 239 @code{ldap-search-internal} is the low-level primitive to perform a
303 search on a LDAP server. It works directly on an open LDAP connection 240 search on a LDAP server. It works directly on an open LDAP connection
304 thus requiring a preliminary call to @code{ldap-open}. Multiple 241 thus requiring a preliminary call to @code{ldap-open}. Multiple
305 searches can be made on the same connection, then the session must be 242 searches can be made on the same connection, then the session must be
306 closed with @code{ldap-close}. 243 closed with @code{ldap-close}.
307 244
308 @defun ldap-search-basic ldap filter base scope attrs attrsonly 245
246 @defun ldap-search-internal ldap filter base scope attrs attrsonly
309 Perform a search on an open connection @var{ldap} created with @code{ldap-open}. 247 Perform a search on an open connection @var{ldap} created with @code{ldap-open}.
310 @var{filter} is a filter string for the search @pxref{Syntax of Search Filters} 248 @var{filter} is a filter string for the search @pxref{Syntax of Search Filters}
311 @var{base} is the distinguished name at which to start the search. 249 @var{base} is the distinguished name at which to start the search.
312 @var{scope} is one of the symbols @code{base}, @code{onelevel} or 250 @var{scope} is one of the symbols @code{base}, @code{onelevel} or
313 @code{subtree} indicating the scope of the search limited to a base 251 @code{subtree} indicating the scope of the search limited to a base
315 @code{subtree}. 253 @code{subtree}.
316 @code{attrs} is a list of strings indicating which attributes to retrieve 254 @code{attrs} is a list of strings indicating which attributes to retrieve
317 for each matching entry. If @code{nil} all available attributes are returned. 255 for each matching entry. If @code{nil} all available attributes are returned.
318 If @code{attrsonly} is non-@code{nil} then only the attributes are retrieved, not 256 If @code{attrsonly} is non-@code{nil} then only the attributes are retrieved, not
319 their associated values 257 their associated values
320 If @code{withdn} is non-@code{nil} then each entry in the result is prepended with 258 The function returns a list of matching entries. Each entry being itself
321 its distinguished name DN 259 an alist of attribute/values.
322 If @code{verbose} is non-@code{nil} then progress messages are echoed 260 @end defun
323 The function returns a list of matching entries. Each entry is itself 261
324 an alist of attribute/value pairs optionally preceded by the DN of the 262
325 entry according to the value of @code{withdn}.
326 @end defun
327
328 @defun ldap-add ldap dn entry
329 Add @var{entry} to a LDAP directory which a connection @var{ldap} has
330 been opened to with @code{ldap-open}.
331 @var{dn} is the distinguished name of the entry to add.
332 @var{entry} is an entry specification, i.e., a list of cons cells
333 containing attribute/value string pairs.
334 @end defun
335
336 @defun ldap-modify ldap dn mods
337 Modify an entry in an LDAP directory.
338 @var{ldap} is an LDAP connection object created with @code{ldap-open}.
339 @var{dn} is the distinguished name of the entry to modify.
340 @var{mods} is a list of modifications to apply.
341 A modification is a list of the form @code{(MOD-OP ATTR VALUE1 VALUE2 ...)}
342 @var{mod-op} and @var{attr} are mandatory, @var{values} are optional depending on @var{mod-op}.
343 @var{mod-op} is the type of modification, one of the symbols @code{add}, @code{delete}
344 or @code{replace}. @var{attr} is the LDAP attribute type to modify
345 @end defun
346
347 @defun ldap-delete ldap dn
348 Delete an entry to an LDAP directory.
349 @var{ldap} is an LDAP connection object created with @code{ldap-open}.
350 @var{dn} is the distinguished name of the entry to delete
351 @end defun
352
353
354
355 @node LDAP Internationalization, , The Low-Level LDAP API, XEmacs LDAP API
356 @comment node-name, next, previous, up
357 @subsection LDAP Internationalization
358
359 The XEmacs LDAP API provides basic internationalization features based
360 on the LDAP v3 specification (essentially RFC2252 on "LDAP v3 Attribute
361 Syntax Definitions"). Unfortunately since there is currently no free
362 LDAP v3 server software, this part has not received much testing and
363 should be considered experimental. The framework is in place though.
364
365 @defun ldap-decode-attribute attr
366 Decode the attribute/value pair @var{attr} according to LDAP rules.
367 The attribute name is looked up in @code{ldap-attribute-syntaxes-alist}
368 and the corresponding decoder is then retrieved from
369 @code{ldap-attribute-syntax-decoders}' and applied on the value(s).
370 @end defun
371
372 @menu
373 * LDAP Internationalization Variables::
374 * Encoder/Decoder Functions::
375 @end menu
376
377 @node LDAP Internationalization Variables, Encoder/Decoder Functions, LDAP Internationalization, LDAP Internationalization
378 @comment node-name, next, previous, up
379 @subsubsection LDAP Internationalization Variables
380
381 @defvar ldap-ignore-attribute-codings
382 If non-@code{nil}, no encoding/decoding will be performed LDAP attribute values
383 @end defvar
384
385 @defvar ldap-coding-system
386 Coding system of LDAP string values.
387 LDAP v3 specifies the coding system of strings to be UTF-8.
388 You need an XEmacs with Mule support for this.
389 @end defvar
390
391 @defvar ldap-default-attribute-decoder
392 Decoder function to use for attributes whose syntax is unknown. Such a
393 function receives an encoded attribute value as a string and should
394 return the decoded value as a string
395 @end defvar
396
397 @defvar ldap-attribute-syntax-encoders
398 A vector of functions used to encode LDAP attribute values.
399 The sequence of functions corresponds to the sequence of LDAP attribute syntax
400 object identifiers of the form 1.3.6.1.4.1.1466.1115.121.1.* as defined in
401 RFC2252 section 4.3.2. As of this writing, only a few encoder functions
402 are available.
403 @end defvar
404
405 @defvar ldap-attribute-syntax-decoders
406 A vector of functions used to decode LDAP attribute values.
407 The sequence of functions corresponds to the sequence of LDAP attribute syntax
408 object identifiers of the form 1.3.6.1.4.1.1466.1115.121.1.* as defined in
409 RFC2252 section 4.3.2. As of this writing, only a few decoder functions
410 are available.
411 @end defvar
412
413 @defvar ldap-attribute-syntaxes-alist
414 A map of LDAP attribute names to their type object id minor number.
415 This table is built from RFC2252 Section 5 and RFC2256 Section 5
416 @end defvar
417
418 @node Encoder/Decoder Functions, , LDAP Internationalization Variables, LDAP Internationalization
419 @comment node-name, next, previous, up
420 @subsubsection Encoder/Decoder Functions
421
422 @defun ldap-encode-boolean bool
423 A function that encodes an elisp boolean @var{bool} into a LDAP
424 boolean string representation
425 @end defun
426
427 @defun ldap-decode-boolean str
428 A function that decodes a LDAP boolean string representation
429 @var{str} into an elisp boolean
430 @end defun
431
432 @defun ldap-decode-string str
433 Decode a string @var{str} according to `ldap-coding-system'
434 @end defun
435
436 @defun ldap-encode-string str
437 Encode a string @var{str} according to `ldap-coding-system'
438 @end defun
439
440 @defun ldap-decode-address str
441 Decode an address @var{str} according to `ldap-coding-system' and
442 replacing $ signs with newlines as specified by LDAP encoding rules for
443 addresses
444 @end defun
445
446 @defun ldap-encode-address str
447 Encode an address @var{str} according to `ldap-coding-system' and
448 replacing newlines with $ signs as specified by LDAP encoding rules for
449 addresses
450 @end defun
451 263
452 264
453 265
454 @node Syntax of Search Filters, , XEmacs LDAP API, LDAP Support 266 @node Syntax of Search Filters, , XEmacs LDAP API, LDAP Support
455 @comment node-name, next, previous, up 267 @comment node-name, next, previous, up
485 297
486 @code{(&(objectClass=Person)(mail=*)(|(sn=Smith)(givenname=John)))} 298 @code{(&(objectClass=Person)(mail=*)(|(sn=Smith)(givenname=John)))}
487 matches records of class @code{Person} containing a @code{mail} 299 matches records of class @code{Person} containing a @code{mail}
488 attribute and corresponding to people whose last name is @code{Smith} or 300 attribute and corresponding to people whose last name is @code{Smith} or
489 whose first name is @code{John}. 301 whose first name is @code{John}.
302
303
304