[PR #1254] [MERGED] Add memberOf attribute definition to LDAP schema #1212

New issue

Closed

opened 2026-02-27 09:11:20 +03:00 by kerem · 0 comments

kerem commented

2026-02-27 09:11:20 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/lldap/lldap/pull/1254
Author: @nitnelave
Created: 8/20/2025
Status: ✅ Merged
Merged: 8/21/2025
Merged by: @nitnelave

Base: main ← Head: copilot-ldap

📝 Commits (1)

5e2a850 Add memberOf attribute definition to LDAP schema

📊 Changes

1 file changed (+7 additions, -6 deletions)

View changed files

📝 crates/ldap/src/search.rs (+7 -6)

📄 Description

From https://github.com/lldap/lldap/pull/1250 :

The memberOf attribute was missing from the LDAP schema definition returned by LLDAP, causing some LDAP clients (like Python's ldap3 library) to reject searches using the memberOf attribute with an LDAPAttributeError.

While the memberOf functionality worked correctly for searches and filters, the attribute was not declared in the schema's attributeTypes section, leading to client-side validation failures.

This change adds the memberOf attribute definition to the hardcoded attributes list in the LDAP schema response with:

OID: 1.2.840.113556.1.2.102 (Microsoft's standard OID for memberOf)

Distinguished Name syntax for group DN values

Multi-valued attribute (no SINGLE-VALUE restriction)

NO-USER-MODIFICATION flag (computed attribute)

The fix ensures LDAP clients can properly validate and use the memberOf attribute in search filters and attribute requests without schema validation errors.

Example that now works:

from ldap3 import Server, Connection, SUBTREE, AUTO_BIND_NO_TLS
from ldap3.utils.conv import escape_filter_chars

server = Server("localhost", port=3890)
connection = Connection(server, user="uid=admin,ou=people,dc=example,dc=com", password="password", auto_bind=AUTO_BIND_NO_TLS)
connection.search(
    search_base="ou=people,dc=example,dc=com",
    search_filter="(&(memberof=cn=test_user,ou=groups,dc=example,dc=com)(|(uid=test@test.com)(mail=test@test.com)))",
    search_scope=SUBTREE,
    attributes=["uid"]
)
# No longer throws: ldap3.core.exceptions.LDAPAttributeError: invalid attribute memberOf

Fixes https://github.com/lldap/lldap/issues/1249.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/lldap/lldap/pull/1254 **Author:** [@nitnelave](https://github.com/nitnelave) **Created:** 8/20/2025 **Status:** ✅ Merged **Merged:** 8/21/2025 **Merged by:** [@nitnelave](https://github.com/nitnelave) **Base:** `main` ← **Head:** `copilot-ldap` --- ### 📝 Commits (1) - [`5e2a850`](https://github.com/lldap/lldap/commit/5e2a85031cb61eb8d71543d626815ae9412a4c96) Add memberOf attribute definition to LDAP schema ### 📊 Changes **1 file changed** (+7 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `crates/ldap/src/search.rs` (+7 -6) </details> ### 📄 Description From https://github.com/lldap/lldap/pull/1250 : The memberOf attribute was missing from the LDAP schema definition returned by LLDAP, causing some LDAP clients (like Python's ldap3 library) to reject searches using the memberOf attribute with an LDAPAttributeError. While the memberOf functionality worked correctly for searches and filters, the attribute was not declared in the schema's attributeTypes section, leading to client-side validation failures. This change adds the memberOf attribute definition to the hardcoded attributes list in the LDAP schema response with: - OID: 1.2.840.113556.1.2.102 (Microsoft's standard OID for memberOf) - Distinguished Name syntax for group DN values - Multi-valued attribute (no SINGLE-VALUE restriction) - NO-USER-MODIFICATION flag (computed attribute) The fix ensures LDAP clients can properly validate and use the memberOf attribute in search filters and attribute requests without schema validation errors. Example that now works: ```python from ldap3 import Server, Connection, SUBTREE, AUTO_BIND_NO_TLS from ldap3.utils.conv import escape_filter_chars server = Server("localhost", port=3890) connection = Connection(server, user="uid=admin,ou=people,dc=example,dc=com", password="password", auto_bind=AUTO_BIND_NO_TLS) connection.search( search_base="ou=people,dc=example,dc=com", search_filter="(&(memberof=cn=test_user,ou=groups,dc=example,dc=com)(|(uid=test@test.com)(mail=test@test.com)))", search_scope=SUBTREE, attributes=["uid"] ) # No longer throws: ldap3.core.exceptions.LDAPAttributeError: invalid attribute memberOf ``` Fixes https://github.com/lldap/lldap/issues/1249. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>