How to get LDAP unboundid AttributeSyntax?

Question

I'm trying to find out the unboundid AttributeSyntax type for a specific attribute name and it's simply not working.

Here's the example test code that I'm using to achieve this:

    @Test
    public void testLDAPSchema() {
    try {
        LDAPConnection connection = new LDAPConnection();
        connection.connect("hessmain", 389);
        connection.bind("CN=Administrator,CN=Users,DC=FISHBOWL,DC=NET", "password");

        Schema s = connection.getSchema();

        System.out.println(s.toString());

        AttributeTypeDefinition atd = s.getAttributeType("directReports");

        Set<AttributeTypeDefinition> oat = s.getOperationalAttributeTypes();
        Set<AttributeSyntaxDefinition> l = s.getAttributeSyntaxes();

        AttributeSyntaxDefinition asd1 = s.getAttributeSyntax(atd.getOID());
        AttributeSyntaxDefinition asd2 = s.getAttributeSyntax(atd.getSyntaxOID());
        AttributeSyntaxDefinition asd3 = s.getAttributeSyntax(atd.getBaseSyntaxOID());

        connection.close();
    } catch (Exception e) {
        Assert.fail(e.getMessage());
    }
    }

From the above code, all the sets are empty. This also means that no matter which OID I pass to the schema getAttributeSyntax method that I will simply get a null return.

Is there any reason why I can't get the attribute syntaxes from an Active Directory server schema?

Thanks

Posting in comment cause I'm not sure if this the answer or not, but have you checked the ACLs for CN=Administrator,CN=Users,DC=FISHBOWL,DC=NET? It may be possible that this user can't read attribute types or syntax definitions by default. — Ben Burns, May 18 '11 at 21:22
If you can turn on the logging feature of your LDAP server and see what queries are coming across the wire, that should help you debug this as well. — Ben Burns, May 18 '11 at 21:23

score 3 · Answer 1 · answered May 18 '11 at 22:42

3

I don't think that this is specific to the UnboundID LDAP SDK for Java. I'm not sure that Active Directory exposes this information over LDAP. When I perform a general LDAP search to retrieve schema information, I can see the attributeTypes and objectClasses attributes, but ldapSyntaxes isn't returned (and in fact ldapSyntaxes doesn't appear in the list of attribute types).

Similarly, none of the attribute type definitions includes a USAGE element, which is what is used to indicate that the attribute type is operational (e.g., "USAGE directoryOperation").

It may well be that Active Directory simply doesn't report this information at all. It could be that it provides some other non-standard way to get this information (e.g., a control or extended operation, or some other entry that can be retrieved), but if there is then I don't know about it.

answered May 18 '11 at 22:42

Neil Wilson

1,706
8
4

Neil, I can get the usage but that alone is not enough for what I need. In fact, I do not need it at all. In the code above if you add the following line: 'AttributeUsage u = atd.getUsage();'. For the example above I get 'userApplications' which is not what I need. I need to know if the field type is a Distinguished Name type since these fields can not be used together with wildcard searching. – Bruno Santos May 19 '11 at 13:35
1

My comment on the attribute usage was in reference to your call to Schema.getOperationalAttributeTypes(). The way that LDAP indicates that an attribute is operational is by including "USAGE directoryOperation" (or "USAGE distributedOperation" or "USAGE dSAOperation") in the attribute type definition. If an attribute type definition doesn't contain one of these elements, then it is considered a user attribute (which is the same as if it had explicitly included "USAGE userApplications"). – Neil Wilson May 19 '11 at 16:31
1

Also, the Schema.getAttributeSyntaxes() method requires that the schema include ldapSyntaxes attribute. Because Active Directory doesn't seem to return that attribute, the call to Schema.getAttributeSyntaxes() returns an empty set. – Neil Wilson May 19 '11 at 16:34
1

However, if you want to determine the syntax for a specific attribute type, then you should be able to just use AttributeTypeDefinition.getSyntaxOID(schema). You could also use the MatchingRule.selectEqualityMatchingRule(attrName, schema) get the MatchingRule subclass that should be used for matching operations, and for DN-syntax attributes that will be DistinguisheNameMatchingRule, which indicates that substring and ordering matching are not supported. – Neil Wilson May 19 '11 at 16:38
Strange, ldapsearch returns empty results in Windows AD, so it seems to confirm your comments. But connecting to the same server via Apache Directory Studio shows Attribute Syntax entries in the Schema explorer. Any idea how Apache Directory Studio fetches this ? – Edu Jan 02 '23 at 13:32

How to get LDAP unboundid AttributeSyntax?

1 Answers1