Add support for connecting with LDAP in Thin Mode

[mkmoisen]

In cx_Oracle, in order to connect to an oracle database over LDAP, we need to create a sqlnet.ora file and ldap.ora file.

In oracledb's thin mode, sqlnet.ora is not supported, and presumably ldap.ora file is not either.

Is it possible to connect over LDAP in oracledb's thin mode?

If so, how do we do it?

[anthony-tuininga]

Not currently. I can convert this to an enhancement request if you would like. If you can provide any details on your requirements that would be helpful.

[mkmoisen]

I would appreciate being able to use thin mode if that would be a possibility. We are hoping to get away from needing the instant client as it slows down our ability to upgrade docker images.

---

In cx_Oracle, I do LDAP connections this way.

sqlnet.ora:

SQLNET.AUTHENTICATION_SERVICES= (NTS)

NAMES.DIRECTORY_PATH= (LDAP, TNSNAMES, EZCONNECT)

For me, I need to put LDAP first, which minimizes the time Oracle spends.

ldap.ora:

DIRECTORY_SERVERS = (myldapserver.host.com:1234)
DEFAULT_ADMIN_CONTEXT = "dc=host,dc=com"
DIRECTORY_SERVER_TYPE = OID

So I suppose I would need some way to tell the thin client to 1) use ldap, 2) provide my ldap servers/ports, I guess this can be a list, as well as the admin context and server type.

[mkmoisen]

In addition, I noticed that in thick mode, I'm unable to connect over LDAP via:

oracledb.connect(user='myuser', password='mypassword', service_name='mydatabase')

This takes ~5 seconds before failing with:

oracledb.exceptions.DatabaseError: ORA-12545: Connect failed because target host or object does not exist

I can connect without issue over LDAP using dns:

oracledb.connect('myuser/mypassword@mydatabase')

[anthony-tuininga]

Thanks. I'll change this to an enhancement request. I don't know when this will be implemented though. You have to convince @cjbj that this enhancement is more important than others!

[cjbj]

'myuser/mypassword@mydatabase'

uses a network service alias, not a service name, so service_name='mydatabase' is not a valid equivalent.
The tnsnames.ora file maps that alias to a descriptor which will contain the actual service name.

[danidorbek]

i have tried to describe something similar in this discussion with a potential solution. Maybe that helps to speed up.

[ilmarkerm]

I'd like to add my strong upvote for this enhancement request.

[urosdigital]

+1

[mkmoisen]

@anthony-tuininga @cjbj Any chance we can get this feature to add support for connecting with LDAP in thin monde scheduled?

Connecting over LDAP is the preferred way at many companies that use Oracle.

[anthony-tuininga]

It is on the list of enhancements but there are many other enhancements on the list, too! If you have any compelling arguments why this particular enhancement should have its priority increased I'm sure that @cjbj would love to hear them!

[cjbj]

We do have a lot of enhancements to both Thin and Thick that our users want, including features we must add for supporting 23c database features. At least with LDAP there is already a general solution, for better or worse: Thick mode. Send me your "business case" so we can prioritize.