LuaLDAP: A Lua interface to the OpenLDAP library

Introduction

LuaLDAP is a simple interface from Lua to an LDAP client (in fact it is a bind to OpenLDAP client).

LuaLDAP defines one single global variable: a table called lualdap. This table holds the functions used to create an LDAP connection object.

A connection object offers methods to perform any operation on the directory such as comparing values, adding new entries, modifying attributes on existing entries, removing entries, and the most common of all: searching. Entries are represented as Lua tables; attributes are its fields. The attribute values can be strings or tables of strings (used to represent multiple values).

LuaLDAP is a bind to the OpenLDAP library, therefore it depends on a previous installation of this library. You can download OpenLDAP from the OpenLDAP download page.

LuaLDAP source consists in a single C source file. The distribution provides a Makefile prepared to compile the library and install it. The file config should be edited to suit the needs of the aimed platform.

Installation

LuaLDAP follows the package model for Lua 5.1, therefore it should be "installed". Refer to Compat-5.1 configuration section about how to install the compiled binary properly.

Windows users can use the pre-compiled version of LuaLDAP (libsasl.dll) available at LuaForge.

Representing attributes

Many LDAP operations manage sets of attributes and values. LuaLDAP provides a uniform way of representing them: using Lua tables. A table of attributes is indexed by the name of the attribute and its value can be a string (be careful: it can also be a "binary string") or a list/table of values indexed by numbers from 1 to n. Some operations have different approaches that will be explained when necessary.

Follows a small example:

entry = {
    an_attribute = "a value",
    other_attribute = {
        "first value of other attribute",
        "another value of other attribute",
    },
}

Attribute names cannot contain zeroes ('\0')

Distinguished names

The distinguished name (DN) is the term used to identify an entry on the directory information tree. It is formed by the relative distinguished name (RDN) of the entry and the distinguished name of its parent. LuaLDAP will always use a string to represent the DN of any entry.

A more precise definition can be found on the LDAP documentation. A list of some of these files can be found in section Related documentation.

Initialization functions

LuaLDAP provides a single way to connect to an LDAP server:

lualdap.open_simple (hostname, who, password, usetls): Initializes a session with an LDAP server. This function requires a hostname, accordingly to the C LDAP API definition ("hostname contains a space-separated list of hostnames or dotted strings representing the IP address of hosts running an LDAP server to connect to. Each hostname in the list MAY include a port number which is separated from the host itself with a colon (:) character."). The argument who should be the distinguished name of the entry that has the password to be checked against the third argument, password. The optional argument usetls is a Boolean flag indicating if Transport Layer Security (TLS) should be used.
Returns a connection object or nil followed by an error string.

Connection objects

A connection object offers methods which implement LDAP operations. Almost all of them need a distinguished name to identify the entry on which the operation will be executed.

These methods execute asynchronous operations and return a function that should be called to obtain the result(s). These functions will return true indicating success of the operation; the only exception is the function compare which can return either true or false (which is the result of the comparison) on a successful operation.

There are two types of errors: API errors, such as wrong parameters, absent connection etc.; and LDAP errors, such as mal-formed DN, unknown attribute etc. API errors will raise a Lua error, while LDAP errors will be reported by the function/method returning nil followed by the error message provided by the OpenLDAP client.

A connection object can be created by calling the Initialization function.

Methods

conn:add (distinguished_name, table_of_attributes)

Adds a new entry to the directory with the given attributes and values.

conn:close()

Closes the connection conn.

conn:compare (distinguished_name, attribute, value)

Compares a value against an entry.

conn:delete (distinguished_name)

Deletes an entry from the directory.

conn:modify (distinguished_name, table_of_operations*)

Changes values of attributes in the given entry. The tables of operations are table of attributes but with the value on index 1 indicating the operation to be performed. The valid operations are:

'+' to add the values to the attributes
'-' to delete the values of the attributes
'=' to replace the values of the attributes

All tables of operations given as arguments will be joined together to perform a single LDAP modify operation.

conn:rename (distinguished_name, new_relative_dn, new_parent)

Changes entry names (i.e. change its distinguished name).

conn:search (table_of_search_parameters)

Performs a search operation on the directory. The parameters are described below:

attrs: a string or a list of attribute names to be retrieved (default is to retrieve all attributes).
attrsonly: a Boolean value that must be either false (default) if both attribute names and values are to be retrieved, or true if only names are wanted.
base: The distinguished name of the entry at which to start the search.
filter: A string representing the search filter as described in The String Representation of LDAP Search Filters (RFC 2254).
scope: A string indicating the scope of the search. The valid strings are: "base", "onelevel" and "subtree". The empty string ("") and nil will be treated as the default scope.
sizelimit: The maximum number of entries to return (default is no limit).
timeout: The timeout in seconds (default is no timeout). The precision is microseconds.

The search method will return a search iterator which is a function that requires no arguments. The search iterator is used to get the search result and will return a string representing the distinguished name and a table of attributes as returned by the search request.

Example

Below is a small sample code displaying the basic use of the library.

require "lualdap"

ld = assert (lualdap.open_simple ("ldap.server",
                "mydn=manoeljoaquim,ou=people,dc=ldap,dc=world",
                "mysecurepassword"))

for dn, attribs in ld:search { base = "ou=people,dc=ldap,dc=world" } do
    io.write (string.format ("\t[%s]\n", dn))
    for name, values in pairs (attribs) do
        io.write ("["..name.."] : ")
        if type (values) == "string" then
            io.write (values)
        elseif type (values) == "table" then
            local n = table.getn(values)
            for i = 1, (n-1) do
                io.write (values[i]..",")
            end
            io.write (values[n])
        end
        io.write ("\n")
    end
end

ld:add ("mydn=newuser,ou=people,dc=ldap,dc=world", {
    objectClass = { "", "", },
    mydn = "newuser",
    abc = "qwerty",
    tel = { "123456758", "98765432", },
    givenName = "New User",
})()

ld:modify {"mydn=newuser,ou=people,dc=ldp,dc=world",
    { '=', givenName = "New", cn = "New", sn = "User", },
    { '+', o = { "University", "College", },
           mail = "newuser@university.edu", },
    { '-', abc = true, tel = "123456758", },
    { '+', tel = "13579113", },
}()

ld:delete ("mydn=newuser,ou=people,dc=ldp,dc=world")()