1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
|
<! See Copyright Notice in license.html>
<html>
<head>
<title>LuaLDAP: A Lua interface to the OpenLDAP library</title>
<style type="text/css">
ul { list-style-type: disc };
</style>
</head>
<body bgcolor="#FFFFFF">
<hr>
<center>
<table border=0 cellspacing=2 cellpadding=2>
<tr><td align=center><a href="http://www.keplerproject.org/lualdap">
<img border=0 alt="LuaLDAP logo" src="lualdap.png"></a>
<tr><td align=center><big><b>LuaLDAP Reference Manual</b></big>
<tr><td align=center valign=top>A
<a href="http://www.lua.org">Lua</a>
interface to the OpenLDAP library
</table>
</center>
<p>
<center><small>
<a href="index.html">home</a> ·
<a href="#attributes">attributes</a> ·
<a href="#dn">DN</a> ·
<a href="#initialization_functions">initialization</a> ·
<a href="#connection_object">connection</a> ·
<a href="#examples">example</a> ·
<a href="#related_docs">related docs</a>
</small></center>
<p>
<hr>
<a name="introduction"></a>
<h2>Introduction</h2>
<p>
LuaLDAP is a simple interface from Lua to an LDAP client
(in fact it's a bind to
<a href="http://www.openldap.org">OpenLDAP</a>
client).
</p>
<p>
LuaLDAP defines one single global variable, a table called
<tt>lualdap</tt>
which holds the function that creates a connection object.
To initiate an LDAP session is required a hostname and a user
identification.
If desired Transport Layer Security (TLS) can be used throughout
the connection.
</p>
<p>
With a connection object any operation can be performed on the
directory such as value comparation, addition of new entries,
modification of attributes on existing entries, remotion and
the most common of all: searches.
Entries are represented as Lua tables; attributes are it's
fields.
Attribute's values can be strings or tables of strings when
they have multiple values on the directory.
</p>
<p>
LuaLDAP is free software and uses the same
<a href="license.html">license</a>
as Lua 5.0.
</p>
<a name="attributes">
<h2>Representing attributes</h2>
<p>
Many LDAP operations manage sets of attributes and values.
So LuaLDAP provides a uniform way of representing them: using Lua tables.
A table of attributes is indexed by the name of the attribute and its
value can be a string (it can be a "binary string", so be careful),
when there is only one value for that attribute or a list/table of values
indexed by numbers from 1 to <em>n</em>.
Some operations have different approaches that will be explained
when necessary.
<p>
Follows a small example:
<pre>
entry = {
an_attribute = "a value",
other_attribute = {
"first value of other attribute",
"another value of other attribute",
},
}
</pre>
Attribute's names cannot cantain zeroes (<tt>'\0'</tt>)
<a name="dn"></a>
<h2>Distinguished names</h2>
<p>
The distinguished name (DN) is the term used to identify an entry on the
directory information tree.
It is formed by the concatenation of the relative distinguished name (RDN)
of the entry with the distinguished name of its parent.
LuaLDAP will always use a string to represent the DN of any entry.
<p>
A more precise definition can be found on the LDAP documentation.
You can find a list of some of these files in section
<a href="#related_docs">Related documentation</a>.
<a name="initialization_functions"></a>
<h2>Initialization functions</h2>
<p>
LDAP provides some way to connect to a server and so did LuaLDAP:
<ul>
<li> <b><tt>lualdap.open_simple (hostname, who, password, usetls)</tt></b> <br>
Initializes a session with an LDAP server.
Quoting the C LDAP API definition <em>"hostname contains a space-separated
list of hostnames or dotted strings representing the IP address of hosts
running an LDAP server to connect to. Each hostname in the list MAY include
a port number which is separated from the host itself with a colon (:)
character."</em>
The argument <tt>who</tt> should be the <a href="#dn">distinguished name</a>
of the entry that has the password to be checked against the third argument,
<tt>password</tt>.
The optional argument <tt>usetls</tt> is a boolean flag indicating if
Transport Layer Security (TLS) should be used.
</ul>
<a name="connection_object">
<h2>Connection objects</h2>
<p>
A connection object offers methods that implement the LDAP operations.
Almost all of them need a <a href="#dn">distinguished name</a> to
identify the entry on which the operation will be executed.
<p>
These methods execute asynchronous operations and return a function
that should be called to get the result(s).
These functions will return <tt>true</tt> indicating success of the operation;
the only exception is <a href="#conn_compare">compare</a> that can return
<tt>false</tt> (the result of the comparison) on a success operation.
<p>
There are two kinds of errors:
<em>API errors</em>, such as wrong parameters, absent connection etc.; and
<em>LDAP errors</em>, such as mal-formed DN, unknown attribute etc.
API errors will raise a Lua error,
while LDAP errors will be reported by the function/method
returning <tt>nil</tt> followed by the error message provided by
the OpenLDAP client.
<p>
A connection object can be created by calling one of the
<a href="#initialization_functions">Initialization functions</a>.
<h4>Methods</h4>
<ul>
<a name="conn_add"></a>
<li> <b><tt>conn:add (distinguished_name, table_of_attributes)</tt></b> <br>
Add a new entry to the directory with the given attributes and values.
<a name="conn_close"></a>
<li> <b><tt>conn:close()</tt></b> <br>
Closes the connection <tt>conn</tt>.
<a name="conn_compare"></a>
<li> <b><tt>conn:compare (distinguished_name, attribute, value)</tt></b> <br>
Compare a value against an entry.
<a name="conn_delete"></a>
<li> <b><tt>conn:delete (distinguished_name)</tt></b> <br>
Delete an entry from the directory.
<a name="conn_modify"></a>
<li> <b><tt>conn:modify (distinguished_name, table_of_operations*)</tt></b> <br>
Modify values of attributes on the given entry.
The tables of operations are <a href="#attributes">table of attributes</a>
but with the value on index <tt>1</tt> indicating the operation to be
performed.
The valid operations are:
<ul>
<li> <b><tt>'+'</tt></b> to add the values to the attributes
<li> <b><tt>'-'</tt></b> to delete the values of the attributes
<li> <b><tt>'='</tt></b> to replace the values of the attributes
</ul>
All tables of operations passed as arguments will be joined together to
perform just one LDAP modify operation.
<a name="conn_rename"></a>
<li> <b><tt>conn:rename (distinguished_name, new_relative_dn, new_parent)</tt></b> <br>
Modify the name of the entry
(<i>i.e. change its <a href="#dn">distinguished name</a></i>).
<a name="conn_search"></a>
<li> <b><tt>conn:search (table_of_search_parameters)</tt></b> <br>
Execute a search on directory using the given parameters.
The parameters are described below:
<ul>
<li> <b><tt>attrs</tt></b> a string or a list of attributes names to be retrieved (default is to retrieve all attributes).
<li> <b><tt>attrsonly</tt></b> a boolean value that must be <i>false</i> (default) if both attribute names and values are to be retrieved or <i>true</i> if only names are wanted.
<li> <b><tt>base</tt></b> The <a href="#dn">distinguished name</a> of the entry at which to start the search.
<li> <b><tt>filter</tt></b> A string representing the search filter as described in <a href="http://www.ietf.org/rfc/rfc2254.txt">The String Representation of LDAP Search Filters (RFC 2254)</a>.
<li> <b><tt>scope</tt></b> A string indicating the scope of the search. The valid strings are: "base", "onelevel" and "subtree". In fact, just the initial letter is tested, so any string beginning with the same lower case letters will be accepted. The empty string ("") and <tt>nil</tt> will be treated as the default scope.
<li> <b><tt>sizelimit</tt></b> The maximum number of entries to return (the default is no limit).
<li> <b><tt>timeout</tt></b> The timeout in seconds (default is no timeout). The precision is microseconds.
</ul>
The search method will return a <i>search iterator</i> which is a function
that should be called with no arguments.
The search iterator is used to get the search result and will return
a string representing the <a href="#dn">distinguished name</a> and
a <a href="#attributes">table of attributes</a> as returned by the
search request.
</ul>
<a name="examples"></a>
<h2>Example</h2>
Below is a small sample code displaying the basic use of the library.
<blockquote>
<pre>
require "lualdap"
ld = assert (lualdap.open_simple ("ldap.server", "mydn=manoeljoaquim,ou=people,dc=ldap,dc=world", "mysecurepassword"))
for dn, attribs in ld:search { base = "ou=people,dc=ldap,dc=world" } do
io.write (string.format ("\t[%s]\n", dn))
for name, values in pairs (attribs) do
io.write ("["..name.."] : ")
if type (values) == "string" then
io.write (values)
elseif type (values) == "table" then
local n = table.getn(values)
for i = 1, (n-1) do
io.write (values[i]..",")
end
io.write (values[n])
end
io.write ("\n")
end
end
ld:add ("mydn=newuser,ou=people,dc=ldap,dc=world", {
objectClass = { "", "", },
mydn = "newuser",
abc = "qwerty",
tel = { "123456758", "98765432", },
givenName = "New User",
}()
ld:modify {"mydn=newuser,ou=people,dc=ldp,dc=world",
{ '=', givenName = "New", cn = "New", sn = "User", },
{ '+', o = { "University", "College", }, mail = "newuser@university.edu", },
{ '-', abc = true, tel = "123456758", },
{ '+', tel = "13579113", },
}()
ld:delete ("mydn=newuser,ou=people,dc=ldp,dc=world")()
</pre>
</blockquote>
<a name="related_docs"></a>
<h2>Related documentation</h2>
Here is a list of related documentation:
<ul>
<li> <a href="http://www.ietf.org/rfc/rfc2251.txt">Lightweight Directory
Access Protocol (v3)</a>
<li> <a href="http://www.ietf.org/rfc/rfc3377.txt">LDAPv3 Technical
Specification</a>
<li> <a href="http://www.ietf.org/rfc/rfc2254.txt">The String Representation
of LDAP Search Filters (RFC 2254)</a>
</ul>
<a name="contents"></a>
<h2>Contents</h2>
<p>
<ul>
<li> <a href="#introduction">Introduction</a>
<li> <a href="#attributes">Representing attributes</a>
<li> <a href="#dn">Distinguished names</a>
<li> <a href="#initialization_functions">Initialization functions</a>
<li> <a href="#connection_object">Connection object</a>
<ul>
<li> <a href="#conn_add">add</a>
<li> <a href="#conn_close">close</a>
<li> <a href="#conn_compare">compare</a>
<li> <a href="#conn_delete">delete</a>
<li> <a href="#conn_modify">modify</a>
<li> <a href="#conn_rename">rename</a>
<li> <a href="#conn_search">search</a>
</ul>
<li> <a href="#examples">Example</a>
<li> <a href="#related_docs">Related documentation</a>
</ul>
</p>
<p>
<center><small>
<a href="index.html">home</a> ·
<a href="#attributes">attributes</a> ·
<a href="#dn">DN</a> ·
<a href="#initialization_functions">initialization</a> ·
<a href="#connection_object">connection</a> ·
<a href="#examples">example</a> ·
<a href="#related_docs">related docs</a>
</small></center>
<p>
<hr>
<small>
$Id: manual.html,v 1.13 2004-01-12 10:44:06 tomas Exp $
</small>
</body>
</html>
|
