Documentum and LDAP referrals

Sitinan

Hello,

I'm investigating a LDAP issue on our Documentum environment and I have the suspicion that Documentum is following the referral returned by the LDAP query and therefore returning wrong results.

Is it possible to configure/change the way Documentum handles LDAP referrals?

I'm using Documentum 6.6 and OpenLDAP.

Thanks and kind regards,

Sitinan

PanfilovAB

All, written below, is about 6.7SP1 version, so code differs from 6.6, but main idea is the same.

dmldap.jar#com.documentum.ldap.internal.ldap.jndi.JndiDirectoryService has the following code:

/*     */   public void initialize()
/*     */     throws DmLdapException
/*     */   {
/*  55 */     this.m_jndiEnv.put("java.naming.factory.initial", "com.sun.jndi.ldap.LdapCtxFactory");
/*  56 */     String ldapUrl = "ldap://" + this.m_synchronizationContext.getLdapHost() + ":" + this.m_synchronizationContext.getLdapPort();
/*  57 */     this.m_jndiEnv.put("java.naming.provider.url", ldapUrl);
/*     */ 
/*  59 */     if (this.m_synchronizationContext.isSslEnabled()) {
/*  60 */       setupSSL();
/*     */     }
/*     */     else {
/*  63 */       Tracer.logInfo("Ldap Connection: non-SSL connection");
/*  64 */       this.m_jndiEnv.put("java.naming.security.authentication", "simple");
/*     */     }
/*     */ 
/*  67 */     this.m_jndiEnv.put("java.naming.security.principal", this.m_synchronizationContext.getBindDN());
/*  68 */     this.m_jndiEnv.put("java.naming.security.credentials", this.m_synchronizationContext.getBindPswd());
/*  69 */     this.m_jndiEnv.put("java.naming.ldap.version", "3");
/*  70 */     this.m_jndiEnv.put("java.naming.referral", "follow");/*  71 */     if (!AttrTypeInfo.getKeys().isEmpty()) {
/*  72 */       for (String key : AttrTypeInfo.getKeys())
/*  73 */         this.m_jndiEnv.put(AttrTypeInfo.getAttrType(key).getValue(), key);
/*     */     }
/*  75 */     this.m_userGroupNameLdapAttrsArray = this.m_synchronizationContext.getUserGroupNameLdapAttrList();
/*     */ 
/*  77 */     if (Tracer.getTraceLevel() >= 4)
/*  78 */       dumpJndiEnvironmentValues();
/*     */   }

as you can see java.naming.referral parameter has hardcoded value. You can decompile that class and change java.naming.referral to ignore. But when I did that changes I got errors, related to pagination, the root cause was PagedJndiEntryIterator is implemented incorrectly, e.g.:

correct version of code:

    public boolean hasNext() {
        if (this.m_searchResults == null) {
            return false;
        }
        boolean retVal = false;
        try {
            retVal = this.m_searchResults.hasMore();
            if (!retVal) {
                retVal = ((PagedJndiDirectoryService) DataExchanger
                        .getDirectoryService()).hasNextPage();
                if (retVal)
                    this.m_searchResults = ((PagedJndiDirectoryService) DataExchanger
                            .getDirectoryService()).nextPage();
            }
        } catch (DmLdapException dlEx) {
            Tracer.logError(dlEx);
        } catch (NamingException ne) {
            Tracer.logError(ne.getMessage());
            try {
                this.m_searchResults = ((PagedJndiDirectoryService) DataExchanger
                        .getDirectoryService()).reconnectLDAPServer();

                if (DataExchanger.getEntryCount() != 0) {
                    int ignoreUserCnt = 0;
                    try {
                        while (ignoreUserCnt++ < DataExchanger.getEntryCount()) {
                            if (this.m_searchResults.hasMore()) {
                                this.m_searchResults.next();
                            }
                        }
                        retVal = this.m_searchResults.hasMore();
                    } catch (NamingException namEx) {
                        Tracer.logError(namEx);
                    }
                }
            } catch (DmLdapException dlEx) {
                Tracer.logError(dlEx);
            }

        }

is:

    public boolean hasNext() {
        if (this.m_searchResults == null) {
            return false;
        }
        boolean retVal = false;
        try {
            retVal = this.m_searchResults.hasMoreElements();
            if (!retVal) {
                retVal = ((PagedJndiDirectoryService) DataExchanger
                        .getDirectoryService()).hasNextPage();
                if (retVal)
                    this.m_searchResults = ((PagedJndiDirectoryService) DataExchanger
                            .getDirectoryService()).nextPage();
            }
        } catch (DmLdapException dlEx) {
            Tracer.logError(dlEx);
        }
        return retVal;
    }

correct version of code:

    public IEntry next() {
        if (this.m_searchResults == null) {
            return null;
        }

        IEntry entry = null;
        try {
            entry = new PagedJndiEntry(
                    (SearchResult) this.m_searchResults.next());
        } catch (NamingException ne) {
            Tracer.logError(Utilities.toDmLdapExceptionMessage(ne, true));
        } catch (DmLdapException dmEx) {
            Tracer.logError(dmEx);
        }
        return entry;
    }

is:

    public IEntry next() {
        if (this.m_searchResults == null) {
            return null;
        }

        IEntry entry = null;
        try {
            entry = new PagedJndiEntry(
                    (SearchResult) this.m_searchResults.nextElement());
        } catch (DmLdapException dmEx) {
            Tracer.logError(dmEx);
        }
        return entry;
    }

We filed our issue to support, and it is tracked as "CS-41576 - LDAP synchronization fails with java.net.ConnectException: Connection timed out"