ldap3

• new feature: added support for using Kerberos authentication on windows clients using the native winkerberos library
  • new feature: added support for using Channel Bind tokens with Kerberos authentication on windows clients
  • fixed a bug related to using start_tls with a RESTARTABLE strategy that caused errors to be raised erroneously.
  • fixed a bug around the type checking of Reverse DNS Settings with Kerberos authentication
  • fixed an issue related to decoding unicode strings in LDAP referrals and attributes in python 2
  • minor documentation updates and corrections

Added configuration for testing against Windows AD 2019 running on an…

• fixed regression in 2.8 for members returned in AD auto-range search (thanks Felix)
  • fixed regression in 2.8 for attribute error in restartable class (thanks Christian)
  • try to use Crypto library if present for hashing NTLM password on python interpreter missing the MD4 OpenSSL algorithm (thanks Doron)

test_server_type defaults to NONE

• tested against Python 3.8.1 and pyasn1 0.4.8
  • re-enabled ssl exception raising on bad certificate when only 1 server is present in the server pool
  • removed Python 2.6 from Travis configuration (thanks gliptak)
  • added support for source specifications in LDAP connections (thanks Azaria)
  • added support for allowing special AD security identifier (SID) in DN (thanks John)
  • fixed pickling of entry and attribute (thanks cfelder)
  • close connection when auto_bind fails (thank Hrishikesh)
  • operational attributes can be used in Abstraction Layer (thanks Sohalt)
  • additional SSL options can be used in Tls object (thanks Nazarii)
  • threading.Event replaces loop checking in async strategy. ASYNC strategy should be much faster now (thanks Yang)
  • adding a key that is already an alias that contains other aliases in CaseInsensitiveWithAliasDict() now works properly (thanks Mark)
  • when searching for GUID, UUID and SID the backslash character (0x5C) is properly managed (thanks Nocturem)
  • LDIF output properly formatted when controls are missing (thanks Tom)
  • operational attributes are not returned in MOCK strategies when not requested (thanks kpinc)
  • undecodable values are returned as raw bytes when using the pyasn1 decoder

message for prohibit modify opeations in new entry

Merge remote-tracking branch 'origin/dev' into dev

empty schema doesn't raise exception in objectDef

bind() is no more executed twice when auto_bind() == True

• abstract layer now handles auxiliary classes
  • pwdLastSet in AD is valid for 0 and -1 (thanks Taylor)
  • fixed extend.novell.get_universal_password (thanks Fernando)
  • entryUUID is properly validated in search filters (thanks FriedrichI)
  • custom attribute formatters are properly applied when parsing the search filter
  • REUSABLE strategy now honours credentials when changed in the original connection (thanks Prof Hase)
  • add operation doesn't change passed attribute dict anymore (thanks Daniele)
  • missing entry's attribute return False when searching instead of raising an exception (thanks Maxsond)
  • fixed ad_timestamp evaluation for integers (thanks Flynn)
  • wrong exception raised when user name is empty in simple binding (thanks Ivan)
  • exception is raised if size limit is exceed when searching in mocking strategies with raise_exceptions=True (thanks David)
  • fixed validator for novell guid
  • fixed validator for openldap EntryUUID
  • fixed validator for AD objectGUID, now follows MS-DTYP
  • fixed formatter for AD objectGUID
  • fixed exception when adding binary values (thanks guidow)
  • added escape_rdn_chars() to ldap3.utils.dn for safe checking untrusted input while building DNs (thanks Alex)
  • fixed search for binary values in mock strategies
  • fixed exception with unicode chars in subfilters for python 2 (thanks Friedrich)
  • connection.extend.paged_search() doesn't miss the last entries anymore when size limit is exceeded on the server (thanks Friedrich)
  • validators are not applied when loading data from json dump in Mock strategies (thanks Derek)
  • additional validator to check for erroneous bytes to string conversion in Python 3 (thanks Brian)
  • additional formatter and validator to check for generalizedTime with 0 year (thanks Brian)
  • added ADDITIONAL_CLIENT_ENCODINGS parameter
  • fixed AD dir_sync extended operation (thanks Lucas)
  • ad_unlock_account works properly (thanks Francowxu)
  • added Microsoft security descriptor control (thanks Dirk-jan)
  • fixed search in mock strategies when raise_exceptions=True (thanks Derek)
  • formatters never raise exceptions but return the raw_value when unable to format
  • fixed controls duplication in paged search (thanks Dirk-jan)

• tested against pyasn1 from version 0.1.8 up to version 0.4.2, Python 2.6.6, Python 2.7.14, Python 3.6.4
  • auto_encode parameter is honored when binding (thanks jkolo)
  • fixed organizationalName definition in oid (thanks mingulov)
  • automatic byte to int conversion working again (thanks Brian)
  • mock connection searchs correctly escape filters (thanks kiddick)
  • fixed bind with not unicode characters in Python 2 (thanks jkolo)
  • extended filter attributes should work again with pyasn1 0.4.1 (thanks Dirk-jan)
  • fixed error when reading incomplete server info
  • NOT keyword properly handled in dit_content_rules (thanks Michael)
  • operational attributes are prorerly returned in Cursor whit get_operational_attributes = True (thanks a23s4a)
  • start_tls() is properly executed with AD when raise_exceptions=True (thanks Andrew)
  • reopening a Connection honours auto_bind setting (thanks calken)
  • an attribute returned with no value from a flaky server doesn't raise exception anymore (thanks Terrence)
  • pwdLastSet in AD is valid only for -1 (thanks Thane)
  • fixed docs for ldifProducer (thanks lhoekenga)
  • fixed monkeypatching of pyasn1 for Boolean Value in BER encoding (thanks tmarlok88)
  • check_names was not honoured while validating attribute values (thanks ymcymc)
  • locks refactored in Connection and in Async strategy
  • socket properly closed when checking availability of an invalid server

• security fix in the rebind() method of the Connection object (thanks Daniel)
  • fix for Sasl credentials in Python 3 (thanks Busuwe)
  • fixed bug when checking for equality in MockBase
  • added validator parameter to Server object for custom validators
  • attribute values are now validated in add/compare/modify operations in the Connection object
  • Python types can now be used in add/compare/modify operations
  • compatible with the pyasn1 library from version 0.1.8 up to latest (0.3.3 for now) version
  • fixed compatibility with Twisted on Windows on Python 2.7 (thanks Pmisik)
  • fixed paged_search behaviour in Reader object
  • fixed regression in MockBase (thanks Markus)
  • fixed invalid filter sequence in MockBase (thanks SignedBit)
  • added compatibility with Cython (thanks Pedro)
  • fixed auto_encode check in validate_attribute_value for unknown attrs (thanks CFelder)
  • don't encode response_value as extended_response_to_dict expects a decoded value (thanks Matthias)
  • compatible with the pyasn1 library from version 0.1.8 up to latest (0.3.7 for now) version
  • added LDAPObjectDereferenceError exception
  • LDAPObjectDereferenceError is raised when an object tries to dereference itself in the Abstraction Layer (thanks Daniele)
  • async module renamed to asynchronous for compatibility with Python 3.7 (thank Barry)
  • long integer are properly checked in mocking strategies (thanks gregn610)
  • NUMERIC_TYPES includes long for Python 2

• compatible with the pyasn1 library from version 0.1.8 up to latest (0.3.1 for now) version
  • MockAsync strategy is available
  • added ne method to Attribute in abstraction layer (thank Rodrigo)
  • added LDAPUserNameIsMandatoryError exception in simple bind when user name is empty
  • search referrals are properly decoded with fast decoder
  • paged search works in mock strategies
  • paged_search in extend.standard namespace raises an exception of class LDAPOperationResult if the search returns an error
  • search_paged() method of Cursor object now return the whole list of entries if generator=False
  • updated docs for defaults parameters (thanks Guarnacciaa)
  • fixed mockBase for integer matching (thanks Jijo)
  • boolean values are now uppercase in LDIF (thanks Linus)
  • fixed timeout in ssl connection on Linux and Mac (thanks Allan)
  • changed some internal functions to private in ldap3.utils.dn
  • operational attribute entryDN is properly managed in Mock strategies (thanks Mark)
  • new rdn in renamed entry is properly set in Mock strategies (thanks Mark)
  • metrics are now updated for Mock strategies, except that for received bytes (thanks joehy)
  • better managing of missing schema from the server (thanks Deborah)
  • fixed error while schema is not in string format (thanks Alexandre)
  • SNI support added when the underlying python library allows it (thanks Edmund)
  • added pool_keepalive parameter to Connection object for REUSABLE strategy
  • connection.extend.microsoft.modify_password returns False when change is not successful (thanks Ashley)
  • added validators for uuid and uuid_le
  • fixed error while searching for bytes
  • fixed pickling and unpickling of datetime values (thanks David)
  • fixed error that resulted in valid generalizedTime strings not being parsed (thanks Busuwe)
  • fixed error with modify operation on referrals (thanks Busuwe)
  • fixed error in mockBase add_entry() with raw rdn (thanks Chad)
  • fixed error when stdin has not encoding in config.py (thanks cronicryo)
  • fixed error when optional field are not present in pyasn1 requests (thanks Ilya)
  • added DEFAULT_SERVER_ENCODING config parameter, should always be utf-8
  • DEFAULT_ENCODING config parameter renamed to DEFAULT_CLIENT_ENCODING
  • ADDITIONAL_ENCODINGS config parameter renamed to ADDITIONAL_SERVER_ENCONDINGS
  • additional encodings are applied to all data received from the server
  • additional encodings are not applied to client data
  • added from_server=False parameter to to_unicode() to not try client encoding while decoding data from server

• leading and trailing spaces in server name don't raise exception anymore
  • DitContentRule is properly read from the schema
  • added validator for Active Directory timestamp
  • Mock strategies raise an exception if a non-bytes value is added to the schema when no offline schema is provided (str and int are automatically converted)
  • added custom_validators property to Mock strategies
  • modifying objectClass with bytes values doesn't raise an exception anymore (but it may fail anyway because of server constraints)
  • ensure that config sequence parameters are properly set
  • allow case insensitive attribute and class names in config parameters
  • added server.schema.is_valid() to check if the schema is available
  • empty schema properties are set to empty dict() instead of None
  • schema definitions with trailing and leading spaces are now properly parsed and don't raise an LDAPSchemaError exception anymore
  • fixed error when flaky servers (OpenLDAP) don't return the correct response with StartTls

• abstraction layer query converts int values to string (thanks dgadmin)
  • CaseInsensitiveDictWithAlias doesn't raise an exception anymore if alias is set multiple times to the same key
  • friendly names in AttrDef are properly managed when performing commits in Writer cursors
  • no more errors when server returns an empty schema (thanks Glen)
  • range attributes in entries are properly recognized when auto_range is False
  • fixed random errors in auto_range searches (thanks James)
  • fixed checking of malformed schema
  • added configuration parameter IGNORE_MALFORMED_SCHEMA to not raise exception for servers that don't follow the LDAP RFCs (defaults to False)
  • test config moved to test/config.py
  • testcase_id generated randomly for each test
  • added ATTRIBUTES_EXCLUDED_FROM_OBJECT_DEF parmeter to exclude some attribute from automatic populate of ObjectDef in Abstract Layer (helpful for AD)
  • added IGNORED_MANDATORY_ATTRIBUTES_IN_OBJECT_DEF parmeter to exclude some attribute from mandatory attribute list in ObjectDef in Abstract Layer (helpful for AD)
  • fixed error when using implicit assigning in WritableEntry
  • added LDAPInvalidValueError Exception
  • in Python 3 byte filter are converted to unicode before parsing
  • RESPONSE_DN_ENCODING parameter renamed to ADDITIONAL_ENCODINGS
  • to_unicode(value, encoding=None, additional_encodings=False) now checks for additional encoodings in ADDITIONAL_ENCODINGS list if additional_encoding is set to True
  • Reusable strategy uses not lazy Restartable connections
  • Reusable strategy doesn't keep requesting the schema
  • connection pool size in Reusable strategy defaults to 5
  • optimized usage of configuration parameters

• PLAIN mechanism added to SASL authentication (thanks Janusz)
  • added RESULT_RESERVED return code (thanks Rak)
  • added RESPONSE_DN_ENCODING in config for flaky servers that return non utf-8 encoded DN. Set it to a list of encoding to sequentially try for decodign DNs.
  • removed StopIteration in generators (deprecated by PEP 479)
  • fixed a bug when converting AD datetimes on Windows systems
  • added compatibility with pyasn1 0.2.3
  • fixed NTLM authentication with pyasn1 0.2.3
  • fixed an error when installing via executable on Windows (thanks TrumSteven)
  • added 'raw_dn' key in search response dictionary. It contains the DN byte value returned for DN by the server
  • attributes with ";binary" tag can now be retrieved in abstraction layer with the usual entry.atttribute syntax
  • updated tests for OpenLDAP
  • fixed error when in add/remove extend operation for case mismatch in user or group dn
  • integer validator now automatically convert valid string numbers to int
  • invalid timezone are checked when validating Generalized Time Format
  • added test cases for validators
  • updated tests for OpenLDAP

• tested against pyasn1 0.2.2 (thanks Ilya)
  • get_response() has an optional new parameter "get_request" to return the request too, helpful in asynchronous strategies
  • connection.request, connection.response and connection result are now properly blanked in async strategies
  • ldap3.utils.dn.safe_dn() now checks for AD names only if no equal sign is present in the dn
  • abstraction layer properly works with asynchronous strategies
  • added a named tuple "Operation" used to store the request, result and response of an LDAP operation in Cursor history
  • cursors in the Abstraction Layer keep history of executed LDAP operations for the last Cursor operation in the cursor.operation property
  • Cursors in the Abstraction Layer keep history of errors for the last Cursor operation in the cursor.errors property
  • if any error has occurred in the last operation of a Cursor the cursor.failed property is set to True
  • added a named tuple "Operation" for storing request, result and response of an LDAP operation in Cursor history
  • Cursor honours raise_exception parameter of the Connection.
  • Cursor commit() return True if operations are successful and False if not. All pending commits are executed even if some fail
  • new entries that have no additional mandatory attributes other those defined in dn are properly managed in Writers (thanks Matt)
  • CaseInsensitiveDict now properly strips blanks from keys
  • updated hashing alghoritm SHA to SHA1 (thanks Satoh)
  • added match_dn(dn) to Cursor for matching entries with specified text in DN
  • added match(attributes, value) for matching entries with specified value in one or more attribute values. It checks values and raw_values
  • Cursors have simple match capability. When key is a string Cursor tries to match it against the DN of entries found.

• tested againsts Python 3.6.0, Python 2.7.13 and Python 2.6.6
  • updated docs regarding search response attributes (thanks James)
  • fixed LDIF representation for operation_to_ldif (thanks m7four)
  • fixed rebind for pooled connections
  • fixed custom sort order in LDIF representation of entry
  • added Active Directory GUID syntax for safe_dn() (thanks dinhngtu)
  • added pre-post read control (thanks Elizabeth)
  • added add_members_to_groups in microsoft.extend namespace for Active Directory
  • added remove_members_to_groups in microsoft.extend namespace for Active Directory
  • refactored internal extend.microsoft and extend.novell structures
  • fixed auto_escape for extended characters (thanks asand3r)
  • validators now transform the Python value to a valid LDAP value when appropriate (thanks Sjd-Risca)
  • added validator for boolean types
  • added validator for date types
  • fixed representation of binary data in Abstraction Layer for Python 2
  • added auto_encode parameter to Connection object (defaults to True)
  • limited auto_escape feature only to filter values
  • escape_filter_chars doens't try anymore to guess if the value is already escaped.
  • added ldap3.conv.is_filter_safe() (thanks Robert)
  • added auto_escape parameter to connection.search() to override connection auto_escape behaviour (defaults to None)
  • auto_escape is not applied to filter value if already escaped
  • automatically encode output to stdout encoding for repr() and str() (for printing and logging attributes values).
  • binary data are converted to a hex values string in repr() and str() (for printing and logging attributes values).
  • auto_encoding is performed only for well known attribute types that use Unicode format in LDAP
  • CLASSES_EXCLUDED_FROM_CHECK and ATTRIBUTES_EXCLUDED_FROM_CHECK moved to ldap3.utils.config and made available via get_config_parameter()
  • added UTF8_ENCODED_SYNTAXES in ldap3.config.utils and made available via get_config_parameter()
  • added UTF8_ENCODED_TYPES in ldap3.config.utils and made available via get_config_parameter()
  • config parameters made available only via get_config_parameters()
  • removed to_bytes() and check_escape() from ldap3.utils.conv (ambiguous functions)
  • added connection.request to MockSync (thanks Fabian)
  • tags are properly managed in add, compare and modify requests (thanks guidow)
  • in Mock strategies single-valued attributes are properly managed
  • in Mock strategies attributes type names are properly managed
  • implemented extended operation machinery in MockBase
  • implemented WhoAmI [RFC4532] in Mock strategies
  • implemented GetBindDn [NOVELL] in Mock strategies
  • implemented operational attributes machinery in MockBase
  • implemented entryDN [RFC5020] operational attribute in MockBase
  • Sphinx updated to 1.5.1

• Mock strategy uses case insensitive matching when appropriate
  • fixed error when adding a virtual attribute in the abstract Entry object
  • fixed error messages in Entry moving and renaming
  • Reverted default connection strategy to SYNC (thanks Mauro)
  • Fixed tutorials (thanks Mauro)
  • Fixed checking of schema in ObjectDef (thanks Pierre)
  • Fixed checking of stdin in config (thanks Oleg)
  • fixed commit of entry with async strategies
  • fixed reading of entries in async strategies
  • added cipher argument to Tls (thanks Nicolas)
  • fixed bug when using the abstraction layer with lazy connections
  • fixed case matching while adding new entry in Writer cursor (thanks t0neg)
  • disabled auto_escape for byte values
  • fixed auto_escape for python 2
  • fixed tutorials (thanks Ivano)

• changed default Connection strategy from SYNC to RESTARTABLE
  • enable automatic escaping of assertion values
  • fixed decoding error with check_name=False
  • added auto_escape parameter in connection, for trying automatic filter and attribute values escape
  • fixed checking of schema in MockBase
  • SASLBindInProgress doesn't raise an exception anymore with raise_exceptions=True
  • standard formatters are applied in mocking strategies when serching for exact match

• removed sanitization of DN in bind operation because some servers accept non standard DN for Simple Bind

• Multiple Mock strategies now share entries when using the same Server object
  • Added AsyncStreamStrategy
  • Added Connection.extend.standard.persistent_search() (Thanks martinrm77)
  • Added escaping of character > 0x7F in filter validation (thanks cfelder)
  • Added better descriptions of Exception in abstraction layer (thanks cfelder)
  • Added queue in Persistent Search
  • Added callback in Persistent Search
  • MockStrategy now honors raise_exception parameter (thanks Simon)

• Change paameter name from 'check' to 'fix' in connection.extend.novell.add_members_to_groups() and connection.extend.novell.remove_members_from_groups
  • Added connection.extend.novell.check_groups_memberships() that check if members are in groups and fixes the user-group relation if incorrect
  • Updated docs link to ldap3.readthedocs.io
  • Fixed error in utils.conv.check_escape (thanks Anjuta)
  • Fixed typo in server.py when IP_V4_PREFERRED is used (thanks eva8668)
  • Host name certificate matching exception and logging is much more informative (thanks eddie-dunn)
  • Fixed typo in docs for use_ssl (thanks Brooks Kindle)
  • Tested against Python 2.6., Python 2.7.12, Python 3.5.2 and PyPy 5.3.1

• Added support for mocking the ldap3 library
  • Added support for MockSync strategy (thanks Roxana)
  • Added checked_attributes=True parameter to connection.response_to_json()
  • Added checked_attributes=True parameter to entry.entry_to_json()
  • MockSyncBase strategy supports bind(), unbind(), delete(), compare(), modify(), modify_dn(), abandon(), add()
  • MockSyncBase strategy accepts directory entries in json file
  • Fixed schema representation (thanks Conrado)
  • Allow connection.abandon(0), useful to "ping" the server
  • Added connection.abandon() test suite
  • Reusable strategy checks bind credential at bind() time, only on one worker connection
  • Reusable strategy ignores abandon() operation because of multiple connection workers
  • Reusable strategy honours return_empty_attributes connection parameter
  • Added lazy information to connection representation
  • Added support for hash (LM:NTLM) Windows NTLM authentication (thanks Dirk)
  • Fixed representation of empty attributes in connection.entries
  • Comparison of entry attributes value is easier
  • Added new extended operation connection.extend.novell.start_transaction()
  • Added new extended operation connection.extend.novell.end_transaction()
  • Added new extended operation connection.extend.novell.add_members_to_groups(members, groups, check, transaction)
  • Added new extended operation connection.extend.novell.remove_members_from_groups(members, groups, check, transaction)
  • Added new exception LDAPTransactionError
  • Added logic to handle Novell Transaction Error Unsolicited Notice
  • Ignore cheching of ssl context when cadata, cafile and capath are not provided (thanks DelboyJan)

• repr encoding set to 'ascii' when sys.stdout.encoding is None (thanks Jeff)

• try to use the requested ssl protocol in SSLContext for Python>=3.4 (thanks Patrick)
  • added return_empty_attributes to Connection object to return an empty list when the attribute requested is missing in the retrieved object

• Added rebind() method to Connection object to rebind with a different user (thanks Lorenzo)
  • Added Tests for rebind operation
  • Start_tls honored in referrals
  • Default ldaps port honored in referrals
  • Additional connection parameters honored in referrals and in the restartable strategy
  • Server connection timeout is honored while connecting, connection receive timeout while receiving
  • Extended operations followed on referrals (thanks Pavel)
  • Added receive_timeout parameter in Connection object to set socket in non-blocking mode with a specified timeout (thanks Antho)
  • Fixed abstract entry getattr() throwing KeyError instead of AttributeError (thanks Kilroy)
  • Fixed start_tls() Reusable strategy

• Controls can be added to extended operation in the extend package (thanks Hinel)

• Fixed set_config_parameter (thanks Sigmunau)
  • Disabled unauthenticated authentication, see RFC 4513 section 5.1.2 (thanks Petros)
  • Fixed falsey value in abstract Entry object contains() (thanks Vampouille)

• Allowed_referral_hosts in Server objects defaults to [('*', True)] to accept any referral server with authentication
  • Referral uri is now properly percent-undecoded (thanks TWAC)
  • Referral Server object now use the same configuration of the original Server object
  • Fixed contains() in Entry object (thanks Vampouille)