samba - Mar 2018 - Accentuated characters issue when receiving attributes from "samba user syncpasswords"

I receive stdin input from "samba user syncpasswords" in my python
script.
The user is created with ' Active Directory Users and Computers', and
have
some accentuated characters in their givenName and/or familyName (sn)
When parsing the diff, the CN reads of, but weird characters appears in the
attributes instead of the right name :

INFO:root:DN found: CN=Arsène Lupin,CN=Users,DC=educonsult,DC=intra
INFO:root:Attribute found: cn: = QXJzw6huZSBMdXBpbg=INFO:root:Attribute found:
sn = Lupin
INFO:root:Attribute found: givenName: = QXJzw6huZQ=INFO:root:Attribute found:
displayName: = QXJzw6huZSBMdXBpbg=INFO:root:Attribute found: name: =
QXJzw6huZSBMdXBpbg=INFO:root:Attribute found: objectGUID =
c20847ee-963b-4d70-9c5c-a4e5458745f4
INFO:root:Attribute found: objectSid
S-1-5-21-1504766521-268068577-265870750-1120
INFO:root:Attribute found: sAMAccountName = arsene.lupin

When using regular characters, everything is fine.

Any help would be welcome...

Fabien Toune

Am 28.03.2018 um 15:52 schrieb Lapin Blanc via samba:
> I receive stdin input from "samba user syncpasswords" in my
python script.
> The user is created with ' Active Directory Users and Computers',
and have
> some accentuated characters in their givenName and/or familyName (sn)
> When parsing the diff, the CN reads of, but weird characters appears in the
> attributes instead of the right name :
> 
> INFO:root:DN found: CN=Arsène Lupin,CN=Users,DC=educonsult,DC=intra
> INFO:root:Attribute found: cn: = QXJzw6huZSBMdXBpbg=>
INFO:root:Attribute found: sn = Lupin
> INFO:root:Attribute found: givenName: = QXJzw6huZQ=> INFO:root:Attribute
found: displayName: = QXJzw6huZSBMdXBpbg=> INFO:root:Attribute found: name: =
QXJzw6huZSBMdXBpbg=> INFO:root:Attribute found: objectGUID =
c20847ee-963b-4d70-9c5c-a4e5458745f4
> INFO:root:Attribute found: objectSid >
S-1-5-21-1504766521-268068577-265870750-1120
> INFO:root:Attribute found: sAMAccountName = arsene.lupin
> 
> When using regular characters, everything is fine
there is nothing weird

php > echo base64_decode('QXJzw6huZSBMdXBpbg==');
Arsène Lupin

Am 28.03.2018 um 16:50 schrieb Lapin Blanc:
> Thank you for the tip, i'll use it, but how come it's correctly
encoded
> in the DN and not in the attribute ?
> Is it related to the ldif format or something ?
no idea and hence *do not* reply privately on mailing-lists
i just recognize base64 when i see it

proper mail clients respect
List-Post: <mailto:samba at lists.samba.org>

whoever configured that mailing list to add a wrong reply-to header
should be punsihed because my mails for sure contain one and it's
pervert to break a list like that
Reply-To: Reindl Harald <h.reindl at thelounge.net>
> 2018-03-28 16:06 GMT+02:00 Reindl Harald via samba
> <samba at lists.samba.org <mailto:samba at lists.samba.org>>:
> 
>     Am 28.03.2018 um 15:52 schrieb Lapin Blanc via samba:
>     > I receive stdin input from "samba user syncpasswords" in
my python script.
>     > The user is created with ' Active Directory Users and
Computers', and have
>     > some accentuated characters in their givenName and/or familyName
(sn)
>     > When parsing the diff, the CN reads of, but weird characters
appears in the
>     > attributes instead of the right name :
>     >
>     > INFO:root:DN found: CN=Arsène
Lupin,CN=Users,DC=educonsult,DC=intra
>     > INFO:root:Attribute found: cn: = QXJzw6huZSBMdXBpbg=>     >
INFO:root:Attribute found: sn = Lupin
>     > INFO:root:Attribute found: givenName: = QXJzw6huZQ=>     >
INFO:root:Attribute found: displayName: = QXJzw6huZSBMdXBpbg=>     >
INFO:root:Attribute found: name: = QXJzw6huZSBMdXBpbg=>     >
INFO:root:Attribute found: objectGUID = c20847ee-963b-4d70-9c5c-a4e5458745f4
>     > INFO:root:Attribute found: objectSid >     >
S-1-5-21-1504766521-268068577-265870750-1120
>     > INFO:root:Attribute found: sAMAccountName = arsene.lupin
>     >
>     > When using regular characters, everything is fine
> 
>     there is nothing weird
> 
>     php > echo base64_decode('QXJzw6huZSBMdXBpbg==');
>     Arsène Lupin

What I would like to know is how it comes that the DN looks like it's not
encode
and the attribute is.
I would be happy to have any kind of information about that.

Btw, Reindl Harald, I apologize for my "private" answer. Just hit the
reply
button, never
had this kind of problem before. I'll **never** make this mistake again !

2018-03-28 16:06 GMT+02:00 Reindl Harald via samba <samba at
lists.samba.org>:
>
>
> Am 28.03.2018 um 15:52 schrieb Lapin Blanc via samba:
> > I receive stdin input from "samba user syncpasswords" in my
python
> script.
> > The user is created with ' Active Directory Users and
Computers', and
> have
> > some accentuated characters in their givenName and/or familyName (sn)
> > When parsing the diff, the CN reads of, but weird characters appears
in
> the
> > attributes instead of the right name :
> >
> > INFO:root:DN found: CN=Arsène Lupin,CN=Users,DC=educonsult,DC=intra
> > INFO:root:Attribute found: cn: = QXJzw6huZSBMdXBpbg=> >
INFO:root:Attribute found: sn = Lupin
> > INFO:root:Attribute found: givenName: = QXJzw6huZQ=> >
INFO:root:Attribute found: displayName: = QXJzw6huZSBMdXBpbg=> >
INFO:root:Attribute found: name: = QXJzw6huZSBMdXBpbg=> >
INFO:root:Attribute found: objectGUID = c20847ee-963b-4d70-9c5c-
> a4e5458745f4
> > INFO:root:Attribute found: objectSid > >
S-1-5-21-1504766521-268068577-265870750-1120
> > INFO:root:Attribute found: sAMAccountName = arsene.lupin
> >
> > When using regular characters, everything is fine
>
> there is nothing weird
>
> php > echo base64_decode('QXJzw6huZSBMdXBpbg==');
> Arsène Lupin
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

On Wed, 28 Mar 2018 16:59:19 +0200
Reindl Harald via samba <samba at lists.samba.org> wrote:
> 
> 
> Am 28.03.2018 um 16:50 schrieb Lapin Blanc:
> > Thank you for the tip, i'll use it, but how come it's
correctly
> > encoded in the DN and not in the attribute ?
> > Is it related to the ldif format or something ?
> 
> no idea and hence *do not* reply privately on mailing-lists
> i just recognize base64 when i see it
> 
> proper mail clients respect
> List-Post: <mailto:samba at lists.samba.org>
> 
> whoever configured that mailing list to add a wrong reply-to header
> should be punsihed because my mails for sure contain one and it's
> pervert to break a list like that
> Reply-To: Reindl Harald <h.reindl at thelounge.net>
> 
It isn't the mailing list, it is probably the OP's mail client.

Rowland

On Wed, 2018-03-28 at 16:06 +0200, Reindl Harald via samba
wrote:
> 
> Am 28.03.2018 um 15:52 schrieb Lapin Blanc via samba:
> > I receive stdin input from "samba user syncpasswords" in my
python script.
> > The user is created with ' Active Directory Users and
Computers', and have
> > some accentuated characters in their givenName and/or familyName (sn)
> > When parsing the diff, the CN reads of, but weird characters appears
in the
> > attributes instead of the right name :
> > 
> > INFO:root:DN found: CN=Arsène Lupin,CN=Users,DC=educonsult,DC=intra
> > INFO:root:Attribute found: cn: = QXJzw6huZSBMdXBpbg=> >
INFO:root:Attribute found: sn = Lupin
> > INFO:root:Attribute found: givenName: = QXJzw6huZQ=> >
INFO:root:Attribute found: displayName: = QXJzw6huZSBMdXBpbg=> >
INFO:root:Attribute found: name: = QXJzw6huZSBMdXBpbg=> >
INFO:root:Attribute found: objectGUID = c20847ee-963b-4d70-9c5c-a4e5458745f4
> > INFO:root:Attribute found: objectSid > >
S-1-5-21-1504766521-268068577-265870750-1120
> > INFO:root:Attribute found: sAMAccountName = arsene.lupin
> > 
> > When using regular characters, everything is fine
> 
> there is nothing weird
> 
> php > echo base64_decode('QXJzw6huZSBMdXBpbg==');
> Arsène Lupin
This is correct.  The :: in the LDIF indicates that the value is base-
64 encoded, possibly over multiple lines (just as normal strings can be
over multiple lines).  We try and honour that RFC.

Ideally parse it with an LDIF parser.

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba