Is there a way to print the exact command being sent to LDAP server by ruby-net-ldap?

Question

The following code to move an account to another OU is failing:

@net_ldap.rename(
  olddn:"CN=TestAMS\\,Henry,OU=Flemington,OU=NJ Region 4,OU=Agents,DC=nj,DC=tri,DC=nrt",
  newrdn:"CN=#TestAMS,Henry",
  delete_attributes:true,
  new_superior:"OU=Terminated Accounts,OU=No Sync,DC=nj,DC=tri,DC=nrt"
)

I am getting the following error:

#<OpenStruct code=64, error_message="00000057: LdapErr: DSID-0C090B07, comment: Error in attribute conversion operation, data 0, v1db1\x00", matched_dn="", message="Naming Violation">

Is there a way to print out the actual command that is being sent to the LDAP server so I can debug the issue?

Answer 1

My guess is that your attribute string is not being escaped properly. Perhaps try using single quotes and pass the exact string of the names. But do you need // ?

If you just do:

puts "CN=TestAMS\\,Henry,OU=Flemington,OU=NJ Region 4,OU=Agents,DC=nj,DC=tri,DC=nrt"

it will output:

CN=TestAMS\,Henry,OU=Flemington,OU=NJ Region 4,OU=Agents,DC=nj,DC=tri,DC=nrt

So you may wanna get rid of the \ or if that's valid, to the target object you're string to rename, then leave it. In ruby you should only use double quotes when you need string interpolation.

@net_ldap.rename(
  olddn:'CN=TestAMS,Henry,OU=Flemington,OU=NJ Region 4,OU=Agents,DC=nj,DC=tri,DC=nrt',
  newrdn:'CN=TestAMS,Henry',
  delete_attributes:true,
  new_superior:'OU=Terminated Accounts,OU=No Sync,DC=nj,DC=tri,DC=nrt'
)

But I'm not sure if LDAP allows hashes or slashes as attributes.

UPDATE: ruby net/ldap is just a ruby implementation but from your terminal see:

man ldap
#/name to search for name and we find:

# Distinguished  names  (DN)  (and relative distinguished names (RDN) to be passed to the LDAP routines should conform to
   RFC 4514 UTF-8 string representation.

So for more info see https://datatracker.ietf.org/doc/rfc4514/

From the looks of this get rid of backslashes and hashtags which I did in my example. But also for more details of which strings need to be escaped, see https://ldap.com/ldap-dns-and-rdns/