Don't send the paged result control on Base scope searches - #104
Merged
jborean93 merged 1 commit intoAug 27, 2026
Merged
Conversation
`Get-OpenADRootDSE -AuthType Anonymous` fails against a default Active
Directory DC with "Cannot find AD RootDSE object", while the equivalent
anonymous `ldapsearch -x` succeeds.
`LdapSearchRequest` adds `PagedResultControl` to every search. On a `Base`
scope search the control can never do anything - the search returns at most
one entry - and AD rejects it on an anonymous connection with:
000004DC: LdapErr: DSID-0C090C06, comment: In order to perform this
operation a successful bind must be completed on the connection.
The anonymous simple bind itself succeeds; it is only the control-bearing
search that is refused. This can be reproduced without PSOpenAD, the only
difference between these two being the control:
ldapsearch -x -H ldap://dc -s base -b "" defaultNamingContext
ldapsearch -x -H ldap://dc -s base -b "" -E pr=1000/noprompt defaultNamingContext
`New-OpenADSession -AuthType Anonymous` is affected the same way and ends up
with an empty DefaultNamingContext, since session setup performs the same
RootDSE lookup.
Skip pagination when the scope cannot produce more than one entry.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #104 +/- ##
==========================================
+ Coverage 74.96% 80.49% +5.53%
==========================================
Files 63 63
Lines 7073 7553 +480
Branches 901 902 +1
==========================================
+ Hits 5302 6080 +778
+ Misses 1587 1276 -311
- Partials 184 197 +13
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
jborean93
approved these changes
Aug 27, 2026
jborean93
left a comment
jborean93
left a comment
Owner
There was a problem hiding this comment.
Thanks for sending this through. Looks like I need to push a new release soon.
Contributor
Author
|
No problems at all. |
Owner
|
Sure thing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For #103
Get-OpenADRootDSE -AuthType Anonymousfails against a default Active Directory DC with "Cannot find AD RootDSE object", while the equivalent anonymousldapsearch -xsucceeds.LdapSearchRequestaddsPagedResultControlto every search. On aBasescope search the control can never do anything - the search returns at most one entry - and AD rejects it on an anonymous connection with:The anonymous simple bind itself succeeds; it is only the control-bearing search that is refused. This can be reproduced without PSOpenAD, the only difference between these two being the control:
New-OpenADSession -AuthType Anonymousis affected the same way and ends up with an empty DefaultNamingContext, since session setup performs the same RootDSE lookup.Skip pagination when the scope cannot produce more than one entry.