LDAP AD - range attribute, how to use it?

Question

I am trying to use the range attribute.

For testing, I use a search that returns 3 records without a range, and I set the range 0-1, which should return only the first 2. However, I get all 3 results.

Here is how I do it:

String rangeStr = attribute + ";range=0-1";
String returnedAttrs[] = {rangeStr, attribute};
_searchControls.setReturningAttributes(returnedAttrs);
_searchControls.setSearchScope(scope);
NamingEnumeration<SearchResult> answer = _context.search(name, filter, _searchControls);
List<String> result = new LinkedList<String>();
while (answer != null && answer.hasMoreElements())
{
    Attribute currentAttr = answer.next().getAttributes().get(attribute);
    if (currentAttr == null)
        continue;
    for (int i=0; i<currentAttr.size(); i++)
    {
        String val = currentAttr.get(i).toString();
        result.add(val);
    }
}

What am I doing wrong?

I use a page size of 1000, but if I understand correctly, this should not affect long-range searches (given that the page size is larger than the specified range). It is right?

Answer 1

#!/usr/bin/env python

import ldap

def msad_flatten_ranges(conn, dn, ldap_dict):
  for attrname in ldap_dict:
    if ';range=' in attrname:
      #
      # parse range attr
      #
      actual_attrname, range_stmt = attrname.split(';')
      bound_lower, bound_upper = [
        int(x) for x in range_stmt.split('=')[1].split('-')
      ]

      step = bound_upper - bound_lower + 1
      while True:
        attr_next = '%s;range=%d-%d' % (
          actual_attrname, bound_lower, bound_upper
        )

        dn, attrs = conn.search_s(
          dn, ldap.SCOPE_BASE, attrlist = [attr_next])[0]

        assert len(attrs) == 1

        ret_attrname = attrs.keys()[0]

        ldap_dict[actual_attrname].extend(attrs[ret_attrname])
        if ret_attrname.endswith('-*'):
          break

        bound_lower = bound_upper + 1
        bound_upper += step