bug#58605: 29.0.50; Commit 2a2f5530fa2 breaks ldap-search-internal

[Filipp Gunbin <fgunbin@fastmail.fm>]

Hi Jens,

On 25/10/2022 07:55 +0200, Jens Lechtenboerger wrote:

> Hi there!
>
> On 2022-10-24, Filipp Gunbin wrote:
>
>> [...]
>> But ldap-search expects ldap-ldapsearch-args to be at least what default
>> value is, to be able to parse the output (btw, "-LL" was there since
>> "forever", which is 20 years in this case; it's just the third L which
>> was added recently, to exclude ldif version from the output).
>
> How should users know about that expectation?

As I wrote, there should be no need to use it at all.

>> Also, default value can change along with ldap-search internal
>> changes.  So if you want to let-bind it, you should merge in your
>> additional args, not replace them.
>
> If the code requires this, it might separate the necessary arguments
> from the customizable ones.

It does - via ldap-host-parameters-alist.

>> However, I don't see why you would want to let-bind it:
>>
>> - -H: Why don't you use host parameter?
>> - -x: just pass 'auth = simple
>> - -tt: already in ldap-ldapsearch-args
>
> When I started using LDAP, I could not make ldapsearch to use
> encrypted connections without -H.  That may have changed since
> then...

Yeah, commit 0b4e003766f15225dede9bdba4ead33e493856e2 (June 2019) adds
support for LDAP URIs.

On a side note, OpenLDAP recently removed `-h' from ldapsearch
altogether.

>> Even more, I'd say that the user should set ldap-host-parameters-alist
>> according to his/her setup, and you should not mess with ldapsearch
>> arguments at all.  Like:
>>
>> (setq ldap-host-parameters-alist
>>       '(("ldap://example.org"
>>          auth simple
>>          auth-source t)))
>>
>> Then just invoke:
>>
>> (ldap-search "mail=.." "ldap://example.org"  '("userCertificate"))
>
> Does this result in encrypted connections?

It should work with ldaps:// as well.

I'm now closing this issue, feel free to reopen or create new if needed.

Filipp