jumpserver/apps/authentication/backends/ldap.py

# coding:utf-8
#
import abc
import ldap
from django.conf import settings
from django.core.cache import cache
from django.core.exceptions import ImproperlyConfigured, ObjectDoesNotExist
from django_auth_ldap.backend import _LDAPUser, LDAPBackend, valid_cache_key
from django_auth_ldap.config import _LDAPConfig, LDAPSearch, LDAPSearchUnion

from users.utils import construct_user_email
from common.const import LDAP_AD_ACCOUNT_DISABLE
from common.utils.http import is_true
from .base import JMSBaseAuthBackend

logger = _LDAPConfig.get_logger()


class LDAPBaseBackend(LDAPBackend):

    @abc.abstractmethod
    def is_enabled(self):
        raise NotImplementedError('is_enabled')

    @property
    @abc.abstractmethod
    def is_user_login_only_in_users(self):
        raise NotImplementedError('is_authenticated')

    def get_or_build_user(self, username, ldap_user):
        """
        This must return a (User, built) 2-tuple for the given LDAP user.

        username is the Django-friendly username of the user. ldap_user.dn is
        the user's DN and ldap_user.attrs contains all of their LDAP
        attributes.

        The returned User object may be an unsaved model instance.

        """
        model = self.get_user_model()

        if self.settings.USER_QUERY_FIELD:
            query_field = self.settings.USER_QUERY_FIELD
            query_value = ldap_user.attrs[self.settings.USER_ATTR_MAP[query_field]][0]
            query_value = query_value.strip()
            lookup = query_field
        else:
            query_field = model.USERNAME_FIELD
            query_value = username.lower()
            lookup = "{}__iexact".format(query_field)

        try:
            user = model.objects.get(**{lookup: query_value})
        except model.DoesNotExist:
            user = model(**{query_field: query_value})
            built = True
        else:
            built = False

        return user, built

    def get_user(self, user_id):
        user = None
        try:
            user = self.get_user_model().objects.get(pk=user_id)
            LDAPUser(self, user=user)  # This sets user.ldap_user
        except ObjectDoesNotExist:
            pass
        return user

    def get_group_permissions(self, user, obj=None):
        if not hasattr(user, 'ldap_user') and self.settings.AUTHORIZE_ALL_USERS:
            LDAPUser(self, user=user)  # This sets user.ldap_user
        if hasattr(user, 'ldap_user'):
            permissions = user.ldap_user.get_group_permissions()
        else:
            permissions = set()
        return permissions

    def populate_user(self, username):
        ldap_user = LDAPUser(self, username=username)
        user = ldap_user.populate_user()
        return user

    def authenticate(self, request=None, username=None, password=None, **kwargs):
        logger.info('Authentication LDAP backend')
        if username is None or password is None:
            logger.info('No username or password')
            return None
        match, msg = self.pre_check(username, password)
        if not match:
            logger.info('Authenticate failed: {}'.format(msg))
            return None
        ldap_user = LDAPUser(self, username=username.strip(), request=request)
        user = self.authenticate_ldap_user(ldap_user, password)
        logger.info('Authenticate user: {}'.format(user))
        return user if self.user_can_authenticate(user) else None

    def pre_check(self, username, password):
        if not self.is_enabled():
            error = 'Not enabled auth ldap'
            return False, error
        if not username:
            error = 'Username is None'
            return False, error
        if not password:
            error = 'Password is None'
            return False, error
        if self.is_user_login_only_in_users:
            user_model = self.get_user_model()
            exist = user_model.objects.filter(username=username).exists()
            if not exist:
                error = 'user ({}) is not in the user list'.format(username)
                return False, error
        return True, ''


class LDAPAuthorizationBackend(JMSBaseAuthBackend, LDAPBaseBackend):
    """
    Override this class to override _LDAPUser to LDAPUser
    """

    @staticmethod
    def is_enabled():
        return settings.AUTH_LDAP

    @property
    def is_user_login_only_in_users(self):
        return settings.AUTH_LDAP_USER_LOGIN_ONLY_IN_USERS


class LDAPHAAuthorizationBackend(JMSBaseAuthBackend, LDAPBaseBackend):
    """
    Override this class to override _LDAPUser to LDAPUser
    """
    settings_prefix = "AUTH_LDAP_HA_"

    @staticmethod
    def is_enabled():
        return settings.AUTH_LDAP_HA

    @property
    def is_user_login_only_in_users(self):
        return settings.AUTH_LDAP_HA_USER_LOGIN_ONLY_IN_USERS


class LDAPUser(_LDAPUser):

    def __init__(self, backend, username=None, user=None, request=None):
        super().__init__(backend=backend, username=username, user=user, request=request)
        config_prefix = "" if isinstance(self.backend, LDAPAuthorizationBackend) else "_ha"
        self.user_dn_cache_key = valid_cache_key(
            f"django_auth_ldap{config_prefix}.user_dn.{self._username}"
        )
        self.category = f"ldap{config_prefix}"
        self.search_filter = getattr(settings, f"AUTH_LDAP{config_prefix.upper()}_SEARCH_FILTER", None)
        self.search_ou = getattr(settings, f"AUTH_LDAP{config_prefix.upper()}_SEARCH_OU", None)

    def _search_for_user_dn_from_ldap_util(self):
        from settings.utils import LDAPServerUtil
        util = LDAPServerUtil(category=self.category)
        user_dn = util.search_for_user_dn(self._username)
        return user_dn

    def _load_user_dn(self):
        """
        Populates self._user_dn with the distinguished name of our user.

        This will either construct the DN from a template in
        AUTH_LDAP_USER_DN_TEMPLATE or connect to the server and search for it.
        If we have to search, we'll cache the DN.

        """
        if self._using_simple_bind_mode():
            self._user_dn = self._construct_simple_user_dn()
        else:
            if self.settings.CACHE_TIMEOUT > 0:
                self._user_dn = cache.get_or_set(
                    self.user_dn_cache_key, self._search_for_user_dn, self.settings.CACHE_TIMEOUT
                )
            else:
                self._user_dn = self._search_for_user_dn()

    def _search_for_user_dn(self):
        """
        This method was overridden because the AUTH_LDAP_USER_SEARCH
        configuration in the settings.py file
        is configured with a `lambda` problem value
        """
        user_search_union = [
            LDAPSearch(
                USER_SEARCH, ldap.SCOPE_SUBTREE,
                self.search_filter
            )
            for USER_SEARCH in str(self.search_ou).split("|")
        ]

        search = LDAPSearchUnion(*user_search_union)
        if search is None:
            raise ImproperlyConfigured(
                'AUTH_LDAP_USER_SEARCH must be an LDAPSearch instance.'
            )

        results = search.execute(self.connection, {'user': self._username})
        if results is not None and len(results) == 1:
            (user_dn, self._user_attrs) = next(iter(results))
        else:
            # 解决直接配置DC域，用户认证失败的问题(库不能从整棵树中搜索)
            user_dn = self._search_for_user_dn_from_ldap_util()
            if user_dn is None:
                self._user_dn = None
                self._user_attrs = None
            else:
                self._user_dn = user_dn
                self._user_attrs = self._load_user_attrs()

        return user_dn

    def _populate_user_from_attributes(self):
        for field, attr in self.settings.USER_ATTR_MAP.items():
            if field in ['groups']:
                continue
            try:
                value = self.attrs[attr][0]
                value = value.strip()
                if field == 'is_active':
                    if attr.lower() == 'useraccountcontrol' and value:
                        value = int(value) & LDAP_AD_ACCOUNT_DISABLE != LDAP_AD_ACCOUNT_DISABLE
                    else:
                        value = is_true(value)
            except LookupError:
                logger.warning(
                    "{} does not have a value for the attribute {}".format(self.dn, attr))
            else:
                if not hasattr(self._user, field):
                    continue
                if isinstance(getattr(self._user, field), bool):
                    if isinstance(value, str):
                        value = value.lower()
                    value = value in ['true', '1', True]
                setattr(self._user, field, value)

        email = getattr(self._user, 'email', '')
        email = construct_user_email(self._user.username, email)
        setattr(self._user, 'email', email)