Handling additional unresolved-reference search results

I know this is really asking for the package to deal with a problem that arguably lies elsewhere, but I’m asking for it anyway. If it is agreed that this is a feature and not a misfeature, then I am definitely interested in writing an implementation.

Our application is failing to authenticate users in their AD even though other applications are having no such problem. After quite a lot of debugging, we finally figured out that our search was returning multiple results. It is returning 1 normal result and several unresolved reference results (AD part is None and data part is an array containing an LDAP URL string).

Neither we nor the customer knows why that is happening, but since ours is the only app having a problem with it, the perception is that it’s our fault.

I have worked around the problem by copying the django-auth-ldap code into our project and patching backend._LDAPUser._search_for_user_dn to optionally (depending on a new setting value) iterate over the results and keep only those that have DN values.

Is this something that we can add to the official package?

[francoisfreitag]

Thanks for the ping. I’m closing it until we have an actual use case. It will be easier to find a satisfactory interface and add tests when we know what we are trying to accomplish.

[francoisfreitag]

The reasoning is clear. This issue requires more thinking than #285 and I am only getting to it now.

I wonder if the search terms could be more precise, in order to exclude the unwanted results and keep a single result? I’m wary of implementing a behavior that skips some search results, although I’m failing to see how an empty DN could be useful to authenticate a user.

As an aside, my preference would be to raise an exception when there are multiple results (probably an AuthenticationFailed), interrupting the authentication and explaining why the authentication failed. The current behavior of returning None makes debugging needlessly harder. However, there’s backward compatibility to think about… It probably needs a deprecation period and major version bump. I may give that a shot in the next weeks.