1

I'd like to modify some entries in our LDAP. In the field gecos currently some users only have their user name which I would like to replace by their full name. In general this isn't a problem, but I guess doing this in plain text with names containing special characters like accents isn't a good idea, which is why I'd like to encode those as base64. Now I know how it should work in theory, but it only gives me an error. What I do:

ldapmodifyuser user
changetype: modify
replace: gecos
gecos:: YmFzZTY0LVRleHQK

Ctrl-d

This only gives me a very cryptic Error modifying user entry uid=username,ou=people,dc=domain,dc=de in LDAP. What am I doing wrong? It's successfull when modifying a user with plain text gecos, it only fails when trying to insert base64 with the double colon upfront neccessary to indicate non-printable text.

Improve this question
3
  • For reference, running into the same thing in my case, when trying to set the gecos value to a non-ASCII string. Both a literal non-ASCII and a base64-encoded fails for me. Did you manage to resolve your original problem, Richard?
    – Per Lundberg
    Commented Jan 25 at 9:14
  • 1
    Nope. I never did.
    – Richard Rosner
    Commented Jan 25 at 15:43
  • OK, thanks. I have managed to add the user with a base64/non-ASCII gecos though, so... it's kind of odd. Perhaps its a bug in ldapmodifyuser or some other element here.
    – Per Lundberg
    Commented Jan 27 at 20:58

1 Answer 1

Reset to default
0

The gecos attribute normally holds a one-line value, but your Base64-encoded data contains a 0x0A "Line feed" character (i.e. \n). Some LDAP servers may be configured to reject this, on the grounds that multi-line values cannot be represented in the traditional /etc/passwd format.

$ echo YmFzZTY0LVRleHQK | base64 -d | hexdump -C
00000000  62 61 73 65 36 34 2d 54  65 78 74 0a              |base64-Text.|
                                            ^^                          ^

py3.10 >>> import base64
py3.10 >>> base64.b64decode("YmFzZTY0LVRleHQK")
b'base64-Text\n'
             ^^
Improve this answer
5
  • It's not supposed to have multiple lines, just a space between name and surname. And that's also no problem in plain text gecos
    – Richard Rosner
    Commented Sep 13, 2022 at 9:42
  • That's exactly my point – it's not supposed to have multiple lines, but your provided value has multiple lines anyway. Look at the actual data that you've Base64-encoded.
    – grawity_u1686
    Commented Sep 13, 2022 at 9:52
  • I don't know how it was added there, I created this example with 'echo 'base64-Text' | base64'. Anyways, the actual base64 text actually ends with 0x6c, which should correspond correctly with an l, so that shouldn't be the Problem.
    – Richard Rosner
    Commented Sep 13, 2022 at 10:30
  • @RichardRosner echo adds one trailing newline character by design.
    – Kamil Maciorowski
    Commented Sep 13, 2022 at 10:42
  • Good to know for the future. Now the question is only why it still fails with a text that doesn't contain a newline character at all. The only non-letter character I have is 0x20 for the space. Other non-standard characters are 0xc3 and 0ca9. Not sure where they come from. They should be 0xe9 and 0x65, but when I convert the name with base64 the result is still the same, minus the encoded newline character. But I don't mind that as long as it works in the first place, corrections can be made later.
    – Richard Rosner
    Commented Sep 13, 2022 at 11:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .