Description Sönke Schwardt-Krummrich 2014-03-28 15:43:15 CET

verify_ldap_object currently does a lo.search() with base=$DN and scope='sub' which may return more than the desired single object (e.g. if a container or the ldap base is checked). For performance reasons scope='base' should be passed to search() or instead lo.get() should be used.

@@ -99,11 +99,11 @@ def get_ldap_connection(pwdfile = False, start_tls = 2, decode_ignorelist = []):
 	raise ldap.SERVER_DOWN()
 
 
 def verify_ldap_object(baseDn, expected_attr = {}, strict = True, should_exist = True):
 	try:
-		dn, attr = get_ldap_connection().search(filter = '(objectClass=*)', base = baseDn, attr = expected_attr.keys())[0]
+		dn, attr = get_ldap_connection().search(filter = '(objectClass=*)', base = baseDn, scope='base', attr = expected_attr.keys())[0]
 	except (ldap.NO_SUCH_OBJECT, IndexError):
 		if should_exist:
 			raise LDAPObjectNotFound('DN: %s' % baseDn)
 		return