=head1 NAME

lualdap - interface to an LDAP client (LuaLDAP)

=head1 OVERVIEW

LuaLDAP is a simple interface from Lua to an LDAP client, in fact it
is a bind to OpenLDAP (L<http://www.openldap.org>). It enables a Lua
program to:

=over 4

=item

Connect to an LDAP server;

=item

Execute any operation (search, add, compare, delete, modify and
rename);

=item

Retrieve entries and references of the search result.

=back

=head1 INTRODUCTION

LuaLDAP is a simple interface from Lua to an LDAP client, in fact it
is a bind to OpenLDAP (L<http://www.openldap.org>) client.

LuaLDAP defines one single global variable: a table called
C<lualdap>. This table holds the functions used to create an LDAP
connection object.

A connection object offers methods to perform any operation on the
directory such as comparing values, adding new entries, modifying
attributes on existing entries, removing entries, and the most common
of all: searching. Entries are represented as Lua tables; attributes
are its fields. The attribute values can be strings or tables of
strings (used to represent multiple values).

LuaLDAP is a bind to the OpenLDAP (L<http://www.openldap.org>) library
and it depends on a previous installation of this library. You can
download OpenLDAP from the OpenLDAP download
(L<http://www.openldap.org/software/download>) page.

=head1 EXAMPLE

Here is a some sample code that demonstrate the basic use of the
library.

  require "lualdap"
  
  ld = assert (lualdap.open_simple ("ldap.server",
                  "mydn=manoeljoaquim,ou=people,dc=ldap,dc=world",
                  "mysecurepassword"))
  
  for dn, attribs in ld:search { base = "ou=people,dc=ldap,dc=world" } do
      io.write (string.format ("\t[%s]\n", dn))
      for name, values in pairs (attribs) do
          io.write ("["..name.."] : ")
          if type (values) == "string" then
              io.write (values)
          elseif type (values) == "table" then
              local n = table.getn(values)
              for i = 1, (n-1) do
                  io.write (values[i]..",")
              end
              io.write (values[n])
          end
          io.write ("\n")
      end
  end
  
  ld:add ("mydn=newuser,ou=people,dc=ldap,dc=world", {
      objectClass = { "", "", },
      mydn = "newuser",
      abc = "qwerty",
      tel = { "123456758", "98765432", },
      givenName = "New User",
  })()
  
  ld:modify {"mydn=newuser,ou=people,dc=ldp,dc=world",
      { '=', givenName = "New", cn = "New", sn = "User", },
      { '+', o = { "University", "College", },
             mail = "newuser@university.edu", },
      { '-', abc = true, tel = "123456758", },
      { '+', tel = "13579113", },
  }()
  
  ld:delete ("mydn=newuser,ou=people,dc=ldp,dc=world")()
  
=head1 DOWNLOAD

LuaLDAP can be downloaded in source code from the LuaForge
(L<http://luaforge.net/projects/lualdap/files>) page. If you are using
LuaBinaries (L<http://luabinaries.luaforge.net>) Release 2 a Windows
binary version of LuaLDAP can be found at the same LuaForge page.

=head1 DOWNLOAD

LuaLDAP can be downloaded in source code from the LuaForge
(L<http://luaforge.net/projects/lualdap/files>) page. If you are using
LuaBinaries (L<http://luabinaries.luaforge.net>) Release 2 a Windows
binary version of LuaLDAP can be found at the same LuaForge page.

=head1 INSTALLATION

LuaLDAP follows the package model
(L<http://www.keplerproject.org/compat/>) for Lua 5.1, therefore it
should be "installed". Refer to Compat-5.1 configuration
(L<http://www.keplerproject.org/compat/manual.html#configuration>)
section about how to install the compiled binary properly. The
compiled binary should be copied to a directory in your C<LUA_CPATH>.

Windows users can use the binary versions of LuaLDAP (C<lualdap.dll>)
and OpenLDAP (C<libsasl.dll>) available at LuaForge
(L<http://luaforge.net/projects/lualdap/files>).

=head1 Representing attributes

Many LDAP operations manage sets of attributes and values.  LuaLDAP
provides a uniform way of representing them by using Lua tables. The
table attributes can be Lua string, a binary string (a string of
bits), or table of I<n> values indexed from 1 to I<n>.
Some operations have different approaches that will be explained as
necessary.

Here is a simple example:

  entry = {
      an_attribute = "a value",
      other_attribute = {
          "first value of other attribute",
          "another value of other attribute",
      },
  }

Attribute names cannot contain the C<'\0'> character.

=head1 Distinguished names

The distinguished name (DN) is the term used to identify an entry on
the directory information tree. It is formed by the relative
distinguished name (RDN) of the entry and the distinguished name of
its parent. LuaLDAP will always use a string to represent the DN of
any entry.

A more precise definition can be found on the LDAP documentation. A
list of some of these files can be found in L</Related documentation>
section.

=head1 Initialization functions

LuaLDAP provides a single way to connect to an LDAP server:

=head2 C<lualdpan.open_simple>

  lualdap.open_simple (hostname, who, password, usetls)

Initializes a session with an LDAP server. This function requires a
hostname, accordingly to the C LDAP API (L</Related documentation>)
definition (I<"hostname contains a space-separated list of hostnames
or dotted strings representing the IP address of hosts running an LDAP
server to connect to. Each hostname in the list MAY include a port
number which is separated from the host itself with a colon (:)
character.">). The argument C<who> should be the distinguished
name (L</Distinguished names>) of the entry that has the password to
be checked against the third argument, C<password>. The optional
argument C<usetls> is a Boolean flag indicating if Transport Layer
Security (TLS) should be used.

Returns a connection object if the operation was successful. In case
of error it returns C<nil> followed by an error string.

=head1 Connection objects

A connection object offers methods which implement LDAP
operations. Almost all of them need a distinguished name
(L</Distinguished names>) to identify the entry on which the operation
will be executed.

These methods execute asynchronous operations and return a function
that should be called to obtain the results. The called functions will
return C<true> indicating the success of the operation. The only
exception is the C<compare> function which can return either
C<true> or C<false> (as the result of the comparison) on a
successful operation.

There are two types of errors: I<API errors>, such as wrong
parameters, absent connection etc.; and I<LDAP errors>, such as
malformed DN, unknown attribute etc. API errors will raise a Lua
error, while LDAP errors will be reported by the function/method
returning C<nil> plus the error message provided by the OpenLDAP
client.

A connection object can be created by calling the Initialization
function (L</Initialization functions>).

=head2 C<conn:add>

  conn:add (distinguished_name, table_of_attributes)

Adds a new entry to the directory with the given attributes and
values.

=head2 C<conn:close>

  conn:close()

Closes the connection C<conn>.

=head2 C<conn:compare>

  conn:compare (distinguished_name, attribute, value)

Compares a value to an entry.

=head2 C<conn:delete>

  conn:delete (distinguished_name)

Deletes an entry from the directory.

=head2 C<conn:modify>

  conn:modify (distinguished_name, table_of_operations*)

Changes the values of attributes in the given entry. The tables of
operations are L<table of attributes|/Representing attributes> with
the value on index C<1> indicating the operation to be performed. The
valid operations are:

=over 4

=item C<'+'>

to add the values to the attributes

=item C<'-'>

to delete the values of the attributes

=item C<'='>

to replace the values of the attributes

=back

Any number of tables of operations will be used in a single LDAP modify
operation.

=head2 C<conn:rename>

  conn:rename (distinguished_name, new_relative_dn, new_parent)

Changes an entry name (i.e. change its distinguished name
(L</Distinguished names>)).

=head2 C<conn:search>
	
  conn:search (table_of_search_parameters)

Performs a search operation on the directory. The parameters are
described below:

=over 4

=item C<attrs>

a string or a list of attribute names to
be retrieved (default is to retrieve all attributes).

=item C<attrsonly>

a Boolean value that must be either C<false> (default) if both
attribute names and values are to be retrieved, or C<true> if
only names are wanted.

=item C<base>

The distinguished name (L</Distinguished names>) of the entry at which
to start the search.

=item C<filter>

A string representing the search filter as described in The String
Representation of LDAP Search Filters (RFC 2254)
(L<http://www.ietf.org/rfc/rfc2254.txt>).

=item C<scope>

A string indicating the scope of the search. The valid strings are:
"base", "onelevel" and "subtree".  The empty string ("") and C<nil>
will be treated as the default scope.

=item C<sizelimit>

The maximum number of entries to return (default is no limit).

=item C<timeout>

The timeout in seconds (default is no timeout). The precision is
microseconds.

=back

The search method will return a I<search iterator> which is a
function that requires no arguments. The search iterator is used to
get the search result and will return a string representing the
distinguished name (L</Distinguished names>) and a L<table of
attributes|/Representing attributes> as returned by the search
request.

=head1 Related documentation

=over 4

=item

Lightweight Directory Access Protocol (v3)
(L<http://www.ietf.org/rfc/rfc2251.txt>)

=item

LDAPv3 Technical Specification (L<http://www.ietf.org/rfc/rfc3377.txt>)

=item

The String Representation of LDAP Search Filters (RFC 2254)
(L<http://www.ietf.org/rfc/rfc2254.txt>)

=item

The C LDAP Application Program Interface
(L<http://www.ietf.org/proceedings/01aug/I-D/draft-ietf-ldapext-ldap-c-api-05.txt>)

=back

=head1 VERSION

Current version is 1.0.1. It was developed for Lua 5.0 and
OpenLDAP (L<http://www.openldap.org>) 2.1.

Version 1.0.1 follows the package model
(L<http://www.keplerproject.org/compat>) for Lua 5.1 (see
L</INSTALLATION>) for more details).

=head1 HISTORY

=over 4

=item Version 1.0.1 [04/Apr/2006]

Compatible with Compat-5.1 R5.

=item Version 1.0 [10/Jun/2005]

=item Version 1.0 Alpha [10/Dec/2003]

=back

=head1 CREDITS

LuaLDAP was designed by Roberto Ierusalimschy, AndrE<eacute> Carregal
and TomE<aacute>s Guisasola as part of the Kepler Project
(L<http://www.keplerproject.org>) which holds its copyright. It was
implemented by TomE<aacute>s Guisasola.

LuaLDAP development was sponsored by FE<aacute>brica Digital
(L<http://www.fabricadigital.com.br>) and FINEP.

=head1 CONTACT

For further information please contact us
(info-NO-SPAM-THANKS@keplerproject.org).  Comments are welcome!

You can also reach other Kepler developers and users on the Kepler
Project mailing list (L<http://luaforge.net/mail/?group_id=104>).

=head1 LICENSE

LuaLDAP is free software and uses the same license as Lua 5.0.

LuaLDAP is free software: it can be used for both academic and
commercial purposes at absolutely no cost. There are no royalties or
GNU-like "copyleft" restrictions. LuaLDAP qualifies as Open Source
(L<http://www.opensource.org/docs/definition.html>) software. Its
licenses are compatible with GPL
(L<http://www.gnu.org/licenses/gpl.html>). LuaLDAP is not in the
public domain and the Kepler Project (L<http://www.keplerproject.org>)
keep its copyright. The legal details are below.

The spirit of the license is that you are free to use LuaLDAP for any
purpose at no cost without having to ask us. The only requirement is
that if you do use LuaLDAP, then you should give us credit by
including the appropriate copyright notice somewhere in your product
or its documentation.

The LuaLDAP library is designed and implemented by Roberto
Ierusalimschy, AndrE<eacute> Carregal and TomE<aacute>s Guisasola.
The implementation is not derived from licensed software.

~~~~~

Copyright E<copy> 2003-2006 The Kepler Project. 

Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:

The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

~~~~~