Module session 

Structs

LdapSession 🔒

An LDAPS connection to a domain controller. Every request on it uses the operation timeout.

Timeouts 🔒

Constants

NO_ATTRS 🔒

The “no attributes” OID (RFC 4511 §4.5.1.8); the lookup only needs the DN.

UNICODE_PWD_ATTR 🔒

The account’s password. A search never returns it, and replacing it is an administrative reset, which needs the Reset Password right and an encrypted connection. See https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/6e803168-f140-4d23-b2d3-c3a8ab5917d2.

Functions

account_filter 🔒

The identity comes from the server, so it is escaped before it goes into the filter.

entry_dn 🔒

The DN of a search result entry, or None if the entry is malformed. SearchEntry::construct panics on a malformed entry instead, which would end the process.

escape_filter_value 🔒

RFC 4515 §3, plus control and non-ASCII bytes.

ldaps_url 🔒

Refuses anything beyond a host name, IPv6 literal and :port rather than normalising it, so a typo can’t downgrade the connection or send the bind elsewhere.

search_entries_only 🔒

AD answers every subtree search with continuation references to subordinate naming contexts, so a domain-root base would look ambiguous. References are dropped rather than chased, so the bind never goes to a server nobody named.