bug#58605: 29.0.50; Commit 2a2f5530fa2 breaks ldap-search-internal

[Filipp Gunbin]

Hi Jens,

On 22/10/2022 11:43 +0200, Jens Lechtenboerger wrote:

> Hi there!
>
> On 2022-10-21, Filipp Gunbin wrote:
>
>> Oh, so this is not just a test case, but the code you actually use.  Add
>> "-LLL" to ldap-ldapsearch-args?
>
> This was a test case.  In my code [1], I use ldap-search, not the
> internal function.  Essentially, like this:
>
> (let ((ldap-default-base "O=DFN-Verein,C=DE")
>       (ldap-ldapsearch-args '("-x" "-tt" "-H ldaps://ldap.pca.dfn.de"))
>       (mail "nix@example.org")
>       (host ""))
>   (ldap-search (concat "mail=" mail) host '("userCertificate") nil))
>
> Previously, this just returned the userCertificate, with and without
> -LLL.  If no certificate existed, it returned nil.
>
> Now, -LLL seems to be required, which I perceive to be a breaking
> change.  Can this be avoided?  Alternatively, document it?
>
> I confirm that with -LLL, my code works.
>
> Without it, I get ((("search" " ") ("result" " "))) instead of nil.

But ldap-search expects ldap-ldapsearch-args to be at least what default
value is, to be able to parse the output (btw, "-LL" was there since
"forever", which is 20 years in this case; it's just the third L which
was added recently, to exclude ldif version from the output).  Also,
default value can change along with ldap-search internal changes.  So if
you want to let-bind it, you should merge in your additional args, not
replace them.

However, I don't see why you would want to let-bind it:

- -H: Why don't you use host parameter?
- -x: just pass 'auth = simple
- -tt: already in ldap-ldapsearch-args

Even more, I'd say that the user should set ldap-host-parameters-alist
according to his/her setup, and you should not mess with ldapsearch
arguments at all.  Like:

(setq ldap-host-parameters-alist
      '(("ldap://example.org";
         auth simple
         auth-source t)))

Then just invoke:

(ldap-search "mail=.." "ldap://example.org";  '("userCertificate"))

> Also, without -LLL and with an existing certificate, ("dn" " ") and
> (("search" " ") ("result" " ")) are included in the result.  Note
> that I find ("dn" " ") misleading, as ldapsearch really does return
> a dn value...

Without -LL(L), the parsing code works incorrectly, and this case
"worked" before only by coincidence.

HTH,
Filipp