LDAP System Administration

Advanced Net::LDAP Scripting

At this point, we’ve covered all the basics: binding to a server, reading, writing, and modifying entries. The remainder of the chapter covers more advanced programming techniques. We’ll start by discussing how to handle referrals and references returned from a search operation.

References and Referrals

It’s important for both software developers and administrators to understand the difference between a reference and a referral. These terms are often confused, probably because the term “referral” is overused or misused. As defined in RFC 2251, an LDAP server returns a reference when a search request cannot be completed without the help of another directory server. I have called this reference a “subordinate knowledge reference” earlier in this book. In contrast, a referral is issued when the server cannot service the request at all and instead points the client to another directory that may have more knowledge about the base search suffix. I have called this link a “superior knowledge reference” because it points the client to a directory server that has superior knowledge, compared to the present LDAP server. These knowledge references will be returned only if the client has connected to the server using LDAPv3; they aren’t defined by LDAPv2.

A Net::LDAP search returns a Net::LDAP::Reference object if the search can’t be completed, but must be continued on another server. In this case, the reference is returned along with Net::LDAP::Entry objects. If ...