A strictly RFC 4510 conforming LDAP V3 pure Python client library
npx @tessl/cli install tessl/pypi-ldap3@1.4.0A strictly RFC 4510 conforming LDAP V3 pure Python client library that works across Python 2, Python 3, PyPy, PyPy3, and Nuikta. LDAP3 provides comprehensive LDAP directory services interaction capabilities with support for synchronous and asynchronous operations, various authentication methods, server pooling, and an abstraction layer for simplified programming.
pip install ldap3import ldap3Common import patterns:
from ldap3 import Server, Connection, ALL, SUBTREEImport authentication and strategy constants:
from ldap3 import SIMPLE, SASL, SYNC, ASYNC, AUTO_BIND_NO_TLSImport additional classes and utilities:
from ldap3 import Tls, ServerPool, DsaInfo, SchemaInfo
from ldap3 import ObjectDef, AttrDef, Entry, Reader, Attribute, OperationalAttributeImport exceptions for error handling:
from ldap3 import (LDAPException, LDAPBindError, LDAPInvalidCredentialsResult,
LDAPInsufficientAccessRightsResult, LDAPCommunicationError)import ldap3
# Create server and connection
server = ldap3.Server('ldap://ldap.example.com', get_info=ldap3.ALL)
conn = ldap3.Connection(server, 'cn=admin,dc=example,dc=com', 'password', auto_bind=True)
# Perform a search
conn.search('dc=example,dc=com', '(objectClass=person)', attributes=['cn', 'mail'])
# Access results
for entry in conn.entries:
print(f"Name: {entry.cn}, Email: {entry.mail}")
# Add an entry
conn.add('cn=newuser,dc=example,dc=com',
object_class=['inetOrgPerson'],
attributes={'cn': 'New User', 'sn': 'User', 'mail': 'newuser@example.com'})
# Modify an entry
conn.modify('cn=newuser,dc=example,dc=com', {'mail': [(ldap3.MODIFY_REPLACE, 'updated@example.com')]})
# Delete an entry
conn.delete('cn=newuser,dc=example,dc=com')
# Close connection
conn.unbind()LDAP3 provides a layered architecture:
This design enables both low-level protocol control and high-level abstraction, making it suitable for everything from simple directory queries to complex enterprise LDAP applications.
Server definition, connection establishment, authentication methods, TLS/SSL configuration, server pooling for high availability, and connection strategies for different use cases.
class Server:
def __init__(self, host, port=None, use_ssl=False, allowed_referral_hosts=None,
get_info=NONE, tls=None, formatter=None, connect_timeout=None,
mode=IP_V6_PREFERRED): ...
class Connection:
def __init__(self, server, user=None, password=None, auto_bind=AUTO_BIND_NONE,
version=3, authentication=None, client_strategy=SYNC,
auto_referrals=True, auto_range=False, sasl_mechanism=None,
sasl_credentials=None, check_names=True, collect_usage=False,
read_only=False, lazy=False, raise_exceptions=False,
pool_name=None, pool_size=None, pool_lifetime=None,
fast_decoder=True, receive_timeout=None,
return_empty_attributes=False): ...
def bind(self, user=None, password=None, sasl_mechanism=None, sasl_credentials=None): ...
def unbind(self, controls=None): ...
def rebind(self, user=None, password=None, authentication=None, sasl_mechanism=None, sasl_credentials=None): ...
def extended(self, request_name, request_value=None, controls=None, no_encode=None): ...
@property
def entries(self): ...
@property
def stream(self): ...
class ServerPool:
def __init__(self, servers=None, pool_strategy=ROUND_ROBIN, active=True, exhaust=False): ...Core Connection and Server Management
All standard LDAP operations including search, add, modify, delete, compare, and abandon operations with full control support and multiple response formats.
# Core LDAP operations on Connection class
def search(self, search_base, search_filter, search_scope=SUBTREE,
dereference_aliases=DEREF_ALWAYS, attributes=None, size_limit=0,
time_limit=0, types_only=False, get_operational_attributes=False,
controls=None, paged_size=None, paged_criticality=False,
paged_cookie=None): ...
def add(self, dn, object_class=None, attributes=None, controls=None): ...
def delete(self, dn, controls=None): ...
def modify(self, dn, changes, controls=None): ...
def modify_dn(self, dn, relative_dn, delete_old_dn=True, new_superior=None, controls=None): ...
def compare(self, dn, attribute, value, controls=None): ...High-level ORM-like interface with object definitions, attribute definitions, entry objects, and reader classes for simplified LDAP programming.
class ObjectDef:
def __init__(self, object_class=None): ...
class AttrDef:
def __init__(self, name, key=None, validate=None, pre_query=None, post_query=None,
default=NotImplemented, dereference_dn=None, description=None): ...
class Entry:
def __init__(self, dn, reader): ...
def entry_get_dn(self): ...
def entry_to_json(self): ...
def entry_to_ldif(self): ...
class Reader:
def __init__(self, connection, object_def, query, base, components_in_and=True,
sub_tree=True, get_operational_attributes=False, controls=None): ...
def search(self): ...Extended operations for specific LDAP server implementations including Microsoft Active Directory, Novell eDirectory, and standard RFC extensions.
# Standard extended operations (connection.extend.standard)
def who_am_i(self, controls=None): ...
def modify_password(self, user, old_password, new_password, hash_algorithm=None,
salt=None, controls=None): ...
# Microsoft AD extended operations (connection.extend.microsoft)
def dir_sync(self, sync_base, sync_filter, sync_attributes=None, cookie=None,
object_security=False, ancestors_first=False, public_data_only=False,
incremental_values=False, max_length=2147483647, hex_guid=False, controls=None): ...
# Novell eDirectory extended operations (connection.extend.novell)
def get_bind_dn(self, controls=None): ...
def start_transaction(self, controls=None): ...
def end_transaction(self, commit=True, controls=None): ...Configuration parameters, constants, exception handling, utility functions, and protocol information classes.
def get_config_parameter(parameter): ...
def set_config_parameter(parameter, value): ...
class DsaInfo:
def __init__(self, attributes, raw_attributes): ...
@staticmethod
def from_json(json_info): ...
class SchemaInfo:
def __init__(self, schema_dn, attributes, raw_attributes): ...
@staticmethod
def from_json(json_schema): ...ANONYMOUS - Anonymous authenticationSIMPLE - Simple bind authenticationSASL - SASL authenticationNTLM - NTLM authenticationSYNC - Synchronous strategyASYNC - Asynchronous strategyLDIF - LDIF producer strategyRESTARTABLE - Restartable strategyREUSABLE - Reusable threaded strategyBASE - Base object scopeLEVEL - Single level scopeSUBTREE - Whole subtree scopeMODIFY_ADD - Add attribute valuesMODIFY_DELETE - Delete attribute valuesMODIFY_REPLACE - Replace attribute valuesMODIFY_INCREMENT - Increment attribute valuesAUTO_BIND_NONE - No auto-bindingAUTO_BIND_NO_TLS - Auto-bind without TLSAUTO_BIND_TLS_BEFORE_BIND - Start TLS before bindingAUTO_BIND_TLS_AFTER_BIND - Start TLS after bindingclass LDAPException(Exception): ...
# Configuration exceptions
class LDAPConfigurationError(LDAPException): ...
class LDAPDefinitionError(LDAPException): ...
# Connection exceptions
class LDAPBindError(LDAPException): ...
class LDAPInvalidServerError(LDAPException): ...
class LDAPCommunicationError(LDAPException): ...
# Operation result exceptions
class LDAPOperationResult(LDAPException): ...
class LDAPInvalidCredentialsResult(LDAPOperationResult): ...
class LDAPInsufficientAccessRightsResult(LDAPOperationResult): ...