title: Python LDAP and Active Directory issue
body: <p>I'll try to include as much detail as possible but consider this situation:</p>
  
  <p>For privacy concerns lets say I have an Active Directory infrastructure like the following:</p>
  
  <p>microsoft.com<br>
  and some child domains:<br>
  csharp.microsoft.com<br>
  vb.microsoft.com</p>
  
  <p>All user accounts are stored at microsoft.com.</p>
  
  <p>I start out my code with the following:</p>
  
  <pre><code>import ldap
  ldap.set_option(ldap.OPT_REFERRALS,0)
  ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT,ldap.OPT_X_TLS_NEVER)
  </code></pre>
  
  <p>(I know I should probably have a certificate for the domain, but what can you do)</p>
  
  <p>I then make a connection like the following:</p>
  
  <pre><code>conn = ldap.initialize("ldaps://microsoft.com:636")
  conn.simple_bind_s("user","pass")
  </code></pre>
  
  <p>In my script I am searching for a user account, and I use the following search:</p>
  
  <pre><code>result_id = conn.search("DC=microsoft,DC=com",
                                  ldap.SCOPE_SUBTREE,
                                  "(&amp;(CN=gates)(!(objectClass=contact)))",
                                  None)
  result_type,result_data = conn.result(result_id,0)
  </code></pre>
  
  <p>Ok great, so this works....most of the time.<br>
  When it does work I get something to the effect of:</p>
  
  <pre><code>[("CN=gates,OU=Users,DC=microsoft,DC=com", {'sAMAccountName':['gates']}])
  </code></pre>
  
  <p>However, it seems at random, that I will get results like the following:</p>
  
  <pre><code>[(None, ['ldaps://csharp.microsoft.com/DC=csharp,DC=microsoft,DC=com'])]
  </code></pre>
  
  <p>While the result makes sense - gates does not exist at csharp.microsoft.com he exists at microsoft.com DC - it is still very puzzling because I am under the impression that using OPT_REFERRALS setting to 0 will tell the Python LDAP module to NOT use referrals.
  To make things more interesting I also sometimes get results like the following:</p>
  
  <pre><code>[(None, ['ldaps://ForestDnsZones.microsoft.com/DC=ForestDnsZones,DC=microsoft,DC=com'])]
  </code></pre>
  
  <p>So my question - is there anything I'm doing wrong?</p>
  
  <p>Also, it has been suggested that if I use a search path like "OU=Users,DC=microsoft,DC=com" instead of just searching from the root ( "DC=microsoft,DC=com" ) that the LDAP client module will not attempt to use referrals - is this accurate?</p>
  
  <p><strong>Edit</strong></p>
  
  <p>The issue turned out to not be LDAP related but rather a WSGI mis-configuration.
  Using the WSGIDaemonProcess solved the cross contamination issue we were experiencing.</p>