[Python] Why does python-ldap code raise the Exception ldap.REFERRAL?

I'm trying to use the python-ldap library to connect to an Active Directory Server. I'm using the code found in this link.

Authentication by simple bind


The following code works correctly:

con = ldap.initialize(uri, bytes_mode=False)
con.protocol_version = ldap.VERSION3
con.set_option(ldap.OPT_REFERRALS, 0) # required for AD authentication
con.simple_bind_s(bindDN, bindPW)
print("Bind success!")


With correct credentials (in the variables bindDN and bindPW) the execution of the code allow a simple bind to the AD Server present in my company and prints the successfully message Bind success! that is the last instruction of the previous snippet of code.

REFERRAL Exception in the query execution


When I try to execute the code below, the last instruction con.result3, raise the ldap.REFERRAL Exception.

# optional, but reduce the number of supported control, since only this one will be parsed
known_ldap_resp_ctrls = {
SimplePagedResultsControl.controlType: SimplePagedResultsControl,
}

# instantiate the control that will make the paged results
# it carries the page cookie (initially empty, to request the first page)
req_ctrl = SimplePagedResultsControl(
criticality=True,
size=pagesize,
cookie=''
)

# query next page, asynchronous
msgid = con.search_ext(
baseDN,
ldap.SCOPE_SUBTREE,
filterstr,
attrlist=attrlist,
serverctrls=[req_ctrl]
)

try:
con.result3(msgid, timeout=timeout, resp_ctrl_classes=known_ldap_resp_ctrls)
except ldap.REFERRAL as ex:
print("REFERRAL Exception --> " + str(ex))


When the Exception is raised the catch block of ldap.REFERRAL Exception, prints the following message:

REFERRAL Exception --> {'msgtype': 101, 'msgid': 2, 'result': 10, 'desc': 'Referral', 'ctrls': [('1.2.840.113556.1.4.319', 0, b'0\x84\x00\x00\x00\x05\x02\x01\x00\x04\x00')], 'info': 'Referral:\nldap://domain.local/DC=domain,DC=local'}


I'm completely stuck on this Exception.

Someone could help me to find where is the problem?

Thanks


If I execute the same query by the utility ldapsearch, it works correctly and the AD Server sends the requested data.

Continue reading...