Referral is not being added to Referrals array after search

[trdyer]

I may be entirely doing this wrong...

I am trying to search for users in a subdomain from the domain that I am connected to.

For instance I am connected to the Active Directory Forest root of foo.bar and trying to search for users in baz.foo.bar

doing a ldapsearch yields

ldapsearch -h foo.bar -D user@foo.bar  -W -x -b "DC=baz,DC=foo,DC=bar" "(objectClass=user)"
Enter LDAP Password: *******
# extended LDIF
#
# LDAPv3
# base <DC=baz,DC=foo,DC=bar> with scope subtree
# filter: (objectClass=user)
# requesting: ALL
#

# search result
search: 2
result: 10 Referral
text: 0000202B: RefErr: DSID-03100781, data 0, 1 access points
	ref 1: 'baz.foo.bar'

ref: ldap://baz.foo.bar/DC=baz,DC=foo,DC=bar

# numResponses: 1

but doing a search in go-ldap that looks like ...

search := ldap.NewSearchRequest("DC=baz,DC=foo,DC=bar", ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false, "(objectClass=user)", nil, nil)

will retrieve nothing, and give me an error of

LDAP Result Code 10 "Referral": 0000202B: RefErr: DSID-03100781, data 0, 1 access points
	ref 1: 'baz.foo.bar'

any ideas what I may be doing wrong?

[rws-github]

I ran into the same issue. I'm not sure why there is referral handling only for PasswordModify.

I added the following on top of search and it works:

func handleReferralError(res *ldap.SearchResult, err error) error {
	if ldap.IsErrorWithCode(err, ldap.LDAPResultReferral) {
		var ldapError *ldap.Error
		if errors.As(err, &ldapError) {
			if ldapError.Packet != nil && len(ldapError.Packet.Children) > 1 {
				referrals := []string{}
				for _, child := range ldapError.Packet.Children[1].Children {
					if child.Tag == 3 && len(child.Children) > 0 && reflect.ValueOf(child.Children[0].Value).Kind() == reflect.String {
						referrals = append(referrals, child.Children[0].Value.(string))
					}
				}
				res.Referrals = referrals
			}
		}
		// if its a referral error, return no error
		return nil
	}
	// return the original error if its not a referral error
	return err
}

It can be used to rewrite the error on the results of a Search:

result, err := client.Search(searchRequest)
err = handleReferralError(result, err)
return result, err