|
|
# coding:utf-8
|
|
|
#
|
|
|
import abc
|
|
|
import ldap
|
|
|
from django.conf import settings
|
|
|
from django.core.cache import cache
|
|
|
from django.core.exceptions import ImproperlyConfigured, ObjectDoesNotExist
|
|
|
from django_auth_ldap.backend import _LDAPUser, LDAPBackend, valid_cache_key
|
|
|
from django_auth_ldap.config import _LDAPConfig, LDAPSearch, LDAPSearchUnion
|
|
|
|
|
|
from users.utils import construct_user_email
|
|
|
from common.const import LDAP_AD_ACCOUNT_DISABLE
|
|
|
from common.utils.http import is_true
|
|
|
from .base import JMSBaseAuthBackend
|
|
|
|
|
|
logger = _LDAPConfig.get_logger()
|
|
|
|
|
|
|
|
|
class LDAPBaseBackend(LDAPBackend):
|
|
|
|
|
|
@abc.abstractmethod
|
|
|
def is_enabled(self):
|
|
|
raise NotImplementedError('is_enabled')
|
|
|
|
|
|
@property
|
|
|
@abc.abstractmethod
|
|
|
def is_user_login_only_in_users(self):
|
|
|
raise NotImplementedError('is_authenticated')
|
|
|
|
|
|
def get_or_build_user(self, username, ldap_user):
|
|
|
"""
|
|
|
This must return a (User, built) 2-tuple for the given LDAP user.
|
|
|
|
|
|
username is the Django-friendly username of the user. ldap_user.dn is
|
|
|
the user's DN and ldap_user.attrs contains all of their LDAP
|
|
|
attributes.
|
|
|
|
|
|
The returned User object may be an unsaved model instance.
|
|
|
|
|
|
"""
|
|
|
model = self.get_user_model()
|
|
|
|
|
|
if self.settings.USER_QUERY_FIELD:
|
|
|
query_field = self.settings.USER_QUERY_FIELD
|
|
|
query_value = ldap_user.attrs[self.settings.USER_ATTR_MAP[query_field]][0]
|
|
|
query_value = query_value.strip()
|
|
|
lookup = query_field
|
|
|
else:
|
|
|
query_field = model.USERNAME_FIELD
|
|
|
query_value = username.lower()
|
|
|
lookup = "{}__iexact".format(query_field)
|
|
|
|
|
|
try:
|
|
|
user = model.objects.get(**{lookup: query_value})
|
|
|
except model.DoesNotExist:
|
|
|
user = model(**{query_field: query_value})
|
|
|
built = True
|
|
|
else:
|
|
|
built = False
|
|
|
|
|
|
return user, built
|
|
|
|
|
|
def get_user(self, user_id):
|
|
|
user = None
|
|
|
try:
|
|
|
user = self.get_user_model().objects.get(pk=user_id)
|
|
|
LDAPUser(self, user=user) # This sets user.ldap_user
|
|
|
except ObjectDoesNotExist:
|
|
|
pass
|
|
|
return user
|
|
|
|
|
|
def get_group_permissions(self, user, obj=None):
|
|
|
if not hasattr(user, 'ldap_user') and self.settings.AUTHORIZE_ALL_USERS:
|
|
|
LDAPUser(self, user=user) # This sets user.ldap_user
|
|
|
if hasattr(user, 'ldap_user'):
|
|
|
permissions = user.ldap_user.get_group_permissions()
|
|
|
else:
|
|
|
permissions = set()
|
|
|
return permissions
|
|
|
|
|
|
def populate_user(self, username):
|
|
|
ldap_user = LDAPUser(self, username=username)
|
|
|
user = ldap_user.populate_user()
|
|
|
return user
|
|
|
|
|
|
def authenticate(self, request=None, username=None, password=None, **kwargs):
|
|
|
logger.info('Authentication LDAP backend')
|
|
|
if username is None or password is None:
|
|
|
logger.info('No username or password')
|
|
|
return None
|
|
|
match, msg = self.pre_check(username, password)
|
|
|
if not match:
|
|
|
logger.info('Authenticate failed: {}'.format(msg))
|
|
|
return None
|
|
|
ldap_user = LDAPUser(self, username=username.strip(), request=request)
|
|
|
user = self.authenticate_ldap_user(ldap_user, password)
|
|
|
logger.info('Authenticate user: {}'.format(user))
|
|
|
return user if self.user_can_authenticate(user) else None
|
|
|
|
|
|
def pre_check(self, username, password):
|
|
|
if not self.is_enabled():
|
|
|
error = 'Not enabled auth ldap'
|
|
|
return False, error
|
|
|
if not username:
|
|
|
error = 'Username is None'
|
|
|
return False, error
|
|
|
if not password:
|
|
|
error = 'Password is None'
|
|
|
return False, error
|
|
|
if self.is_user_login_only_in_users:
|
|
|
user_model = self.get_user_model()
|
|
|
exist = user_model.objects.filter(username=username).exists()
|
|
|
if not exist:
|
|
|
error = 'user ({}) is not in the user list'.format(username)
|
|
|
return False, error
|
|
|
return True, ''
|
|
|
|
|
|
|
|
|
class LDAPAuthorizationBackend(JMSBaseAuthBackend, LDAPBaseBackend):
|
|
|
"""
|
|
|
Override this class to override _LDAPUser to LDAPUser
|
|
|
"""
|
|
|
|
|
|
@staticmethod
|
|
|
def is_enabled():
|
|
|
return settings.AUTH_LDAP
|
|
|
|
|
|
@property
|
|
|
def is_user_login_only_in_users(self):
|
|
|
return settings.AUTH_LDAP_USER_LOGIN_ONLY_IN_USERS
|
|
|
|
|
|
|
|
|
class LDAPHAAuthorizationBackend(JMSBaseAuthBackend, LDAPBaseBackend):
|
|
|
"""
|
|
|
Override this class to override _LDAPUser to LDAPUser
|
|
|
"""
|
|
|
settings_prefix = "AUTH_LDAP_HA_"
|
|
|
|
|
|
@staticmethod
|
|
|
def is_enabled():
|
|
|
return settings.AUTH_LDAP_HA
|
|
|
|
|
|
@property
|
|
|
def is_user_login_only_in_users(self):
|
|
|
return settings.AUTH_LDAP_HA_USER_LOGIN_ONLY_IN_USERS
|
|
|
|
|
|
|
|
|
class LDAPUser(_LDAPUser):
|
|
|
|
|
|
def __init__(self, backend, username=None, user=None, request=None):
|
|
|
super().__init__(backend=backend, username=username, user=user, request=request)
|
|
|
config_prefix = "" if isinstance(self.backend, LDAPAuthorizationBackend) else "_ha"
|
|
|
self.user_dn_cache_key = valid_cache_key(
|
|
|
f"django_auth_ldap{config_prefix}.user_dn.{self._username}"
|
|
|
)
|
|
|
self.category = f"ldap{config_prefix}"
|
|
|
self.search_filter = getattr(settings, f"AUTH_LDAP{config_prefix.upper()}_SEARCH_FILTER", None)
|
|
|
self.search_ou = getattr(settings, f"AUTH_LDAP{config_prefix.upper()}_SEARCH_OU", None)
|
|
|
|
|
|
def _search_for_user_dn_from_ldap_util(self):
|
|
|
from settings.utils import LDAPServerUtil
|
|
|
util = LDAPServerUtil(category=self.category)
|
|
|
user_dn = util.search_for_user_dn(self._username)
|
|
|
return user_dn
|
|
|
|
|
|
def _load_user_dn(self):
|
|
|
"""
|
|
|
Populates self._user_dn with the distinguished name of our user.
|
|
|
|
|
|
This will either construct the DN from a template in
|
|
|
AUTH_LDAP_USER_DN_TEMPLATE or connect to the server and search for it.
|
|
|
If we have to search, we'll cache the DN.
|
|
|
|
|
|
"""
|
|
|
if self._using_simple_bind_mode():
|
|
|
self._user_dn = self._construct_simple_user_dn()
|
|
|
else:
|
|
|
if self.settings.CACHE_TIMEOUT > 0:
|
|
|
self._user_dn = cache.get_or_set(
|
|
|
self.user_dn_cache_key, self._search_for_user_dn, self.settings.CACHE_TIMEOUT
|
|
|
)
|
|
|
else:
|
|
|
self._user_dn = self._search_for_user_dn()
|
|
|
|
|
|
def _search_for_user_dn(self):
|
|
|
"""
|
|
|
This method was overridden because the AUTH_LDAP_USER_SEARCH
|
|
|
configuration in the settings.py file
|
|
|
is configured with a `lambda` problem value
|
|
|
"""
|
|
|
user_search_union = [
|
|
|
LDAPSearch(
|
|
|
USER_SEARCH, ldap.SCOPE_SUBTREE,
|
|
|
self.search_filter
|
|
|
)
|
|
|
for USER_SEARCH in str(self.search_ou).split("|")
|
|
|
]
|
|
|
|
|
|
search = LDAPSearchUnion(*user_search_union)
|
|
|
if search is None:
|
|
|
raise ImproperlyConfigured(
|
|
|
'AUTH_LDAP_USER_SEARCH must be an LDAPSearch instance.'
|
|
|
)
|
|
|
|
|
|
results = search.execute(self.connection, {'user': self._username})
|
|
|
if results is not None and len(results) == 1:
|
|
|
(user_dn, self._user_attrs) = next(iter(results))
|
|
|
else:
|
|
|
# 解决直接配置DC域，用户认证失败的问题(库不能从整棵树中搜索)
|
|
|
user_dn = self._search_for_user_dn_from_ldap_util()
|
|
|
if user_dn is None:
|
|
|
self._user_dn = None
|
|
|
self._user_attrs = None
|
|
|
else:
|
|
|
self._user_dn = user_dn
|
|
|
self._user_attrs = self._load_user_attrs()
|
|
|
|
|
|
return user_dn
|
|
|
|
|
|
def _populate_user_from_attributes(self):
|
|
|
for field, attr in self.settings.USER_ATTR_MAP.items():
|
|
|
if field in ['groups']:
|
|
|
continue
|
|
|
try:
|
|
|
value = self.attrs[attr][0]
|
|
|
value = value.strip()
|
|
|
if field == 'is_active':
|
|
|
if attr.lower() == 'useraccountcontrol' and value:
|
|
|
value = int(value) & LDAP_AD_ACCOUNT_DISABLE != LDAP_AD_ACCOUNT_DISABLE
|
|
|
else:
|
|
|
value = is_true(value)
|
|
|
except LookupError:
|
|
|
logger.warning(
|
|
|
"{} does not have a value for the attribute {}".format(self.dn, attr))
|
|
|
else:
|
|
|
if not hasattr(self._user, field):
|
|
|
continue
|
|
|
if isinstance(getattr(self._user, field), bool):
|
|
|
if isinstance(value, str):
|
|
|
value = value.lower()
|
|
|
value = value in ['true', '1', True]
|
|
|
setattr(self._user, field, value)
|
|
|
|
|
|
email = getattr(self._user, 'email', '')
|
|
|
email = construct_user_email(self._user.username, email)
|
|
|
setattr(self._user, 'email', email)
|
