habsi/authentik
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ldap(major): start rewrite

Browse Source
This commit is contained in:
Jens Langhammer
2019-10-10 17:36:09 +02:00
parent 088b9592cd
commit 4e6653e299
10 changed files with 79 additions and 271 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
passbook/core/templates/overview/base.html
View File

@ -141,18 +141,6 @@
<span class="list-group-item-value">{% trans 'Audit Log' %}</span> <span class="list-group-item-value">{% trans 'Audit Log' %}</span>
</a> </a>
</li> </li>
<li class="list-group-item {% is_active_app 'admin' %}">
<a href="{% url 'admin:index' %}">
<span class="fa fa-database" data-toggle="tooltip" title="{% trans 'Django' %}"></span>
<span class="list-group-item-value">{% trans 'Django' %}</span>
</a>
</li>
<li class="list-group-item {% is_active 'passbook_admin:debug-request' %}">
<a href="{% url 'passbook_admin:debug-request' %}">
<span class="fa fa-bug" data-toggle="tooltip" title="{% trans 'Debug' %}"></span>
<span class="list-group-item-value">{% trans 'Debug' %}</span>
</a>
</li>
{% endif %} {% endif %}
</ul> </ul>
</div> </div>

4
passbook/sources/ldap/auth.py
View File

@ -2,7 +2,7 @@
from django.contrib.auth.backends import ModelBackend from django.contrib.auth.backends import ModelBackend
from structlog import get_logger from structlog import get_logger
from passbook.sources.ldap.ldap_connector import LDAPConnector from passbook.sources.ldap.connector import Connector
from passbook.sources.ldap.models import LDAPSource from passbook.sources.ldap.models import LDAPSource
LOGGER = get_logger() LOGGER = get_logger()
@ -16,7 +16,7 @@ class LDAPBackend(ModelBackend):
if 'password' not in kwargs: if 'password' not in kwargs:
return None return None
for source in LDAPSource.objects.filter(enabled=True): for source in LDAPSource.objects.filter(enabled=True):
_ldap = LDAPConnector(source) _ldap = Connector(source)
user = _ldap.auth_user(**kwargs) user = _ldap.auth_user(**kwargs)
if user: if user:
return user return user

120
passbook/sources/ldap/ldap_connector.py → passbook/sources/ldap/connector.py
View File

@ -11,16 +11,16 @@ from passbook.sources.ldap.models import LDAPSource
LOGGER = get_logger() LOGGER = get_logger()
USERNAME_FIELD = CONFIG.y('ldap.username_field', 'sAMAccountName') # USERNAME_FIELD = CONFIG.y('ldap.username_field', 'sAMAccountName')
LOGIN_FIELD = CONFIG.y('ldap.login_field', 'userPrincipalName') # LOGIN_FIELD = CONFIG.y('ldap.login_field', 'userPrincipalName')
class LDAPConnector: class Connector:
"""Wrapper for ldap3 to easily manage user authentication and creation""" """Wrapper for ldap3 to easily manage user authentication and creation"""
_server = None _server: ldap3.Server
_connection = None _connection = ldap3.Connection
_source = None _source: LDAPSource
def __init__(self, source: LDAPSource): def __init__(self, source: LDAPSource):
self._source = source self._source = source
@ -28,68 +28,17 @@ class LDAPConnector:
if not self._source.enabled: if not self._source.enabled:
LOGGER.debug("LDAP not Enabled") LOGGER.debug("LDAP not Enabled")
# if not con_args:
# con_args = {}
# if not server_args:
# server_args = {}
# Either use mock argument or test is in argv
# if mock or any('test' in arg for arg in sys.argv):
# self.mock = True
# self.create_users_enabled = True
# con_args['client_strategy'] = ldap3.MOCK_SYNC
# server_args['get_info'] = ldap3.OFFLINE_AD_2012_R2
# if self.mock:
# json_path = os.path.join(os.path.dirname(__file__), 'tests', 'ldap_mock.json')
# self._connection.strategy.entries_from_json(json_path)
self._server = ldap3.Server(source.server_uri) # Implement URI parsing self._server = ldap3.Server(source.server_uri) # Implement URI parsing
self._connection = ldap3.Connection(self._server, raise_exceptions=True, self._connection = ldap3.Connection(self._server, raise_exceptions=True,
user=source.bind_cn, user=source.bind_cn,
password=source.bind_password) password=source.bind_password)
self._connection.bind() self._connection.bind()
# if CONFIG.y('ldap.server.use_tls'): if source.start_tls:
# self._connection.start_tls() self._connection.start_tls()
# @staticmethod
# def cleanup_mock():
# """Cleanup mock files which are not this PID's"""
# pid = os.getpid()
# json_path = os.path.join(os.path.dirname(__file__), 'test', 'ldap_mock_%d.json' % pid)
# os.unlink(json_path)
# LOGGER.debug("Cleaned up LDAP Mock from PID %d", pid)
# def apply_db(self):
# """Check if any unapplied LDAPModification's are left"""
# to_apply = LDAPModification.objects.filter(_purgeable=False)
# for obj in to_apply:
# try:
# if obj.action == LDAPModification.ACTION_ADD:
# self._connection.add(obj.dn, obj.data)
# elif obj.action == LDAPModification.ACTION_MODIFY:
# self._connection.modify(obj.dn, obj.data)
# # Object has been successfully applied to LDAP
# obj.delete()
# except ldap3.core.exceptions.LDAPException as exc:
# LOGGER.error(exc)
# LOGGER.debug("Recovered %d Modifications from DB.", len(to_apply))
# @staticmethod
# def handle_ldap_error(object_dn, action, data):
# """Custom Handler for LDAP methods to write LDIF to DB"""
# LDAPModification.objects.create(
# dn=object_dn,
# action=action,
# data=data)
# @property
# def enabled(self):
# """Returns whether LDAP is enabled or not"""
# return CONFIG.y('ldap.enabled')
@staticmethod @staticmethod
def encode_pass(password): def encode_pass(password: str) -> str:
"""Encodes a plain-text password so it can be used by AD""" """Encodes a plain-text password so it can be used by AD"""
return '"{}"'.format(password).encode('utf-16-le') return '"{}"'.format(password).encode('utf-16-le')
@ -128,7 +77,7 @@ class LDAPConnector:
return None return None
# Create the user data. # Create the user data.
field_map = { field_map = {
'username': '%(' + USERNAME_FIELD + ')s', 'username': '%(' + ')s',
'name': '%(givenName)s %(sn)s', 'name': '%(givenName)s %(sn)s',
'email': '%(mail)s', 'email': '%(mail)s',
} }
@ -168,7 +117,7 @@ class LDAPConnector:
# FIXME: Adapt user_uid # FIXME: Adapt user_uid
# email = filters.pop(CONFIG.y('passport').get('ldap').get, '') # email = filters.pop(CONFIG.y('passport').get('ldap').get, '')
email = filters.pop('email') email = filters.pop('email')
user_dn = self.lookup(self.generate_filter(**{LOGIN_FIELD: email})) user_dn = self.lookup(self.generate_filter(**{'email': email}))
if not user_dn: if not user_dn:
return None return None
# Try to bind as new user # Try to bind as new user
@ -179,7 +128,7 @@ class LDAPConnector:
temp_connection.bind() temp_connection.bind()
if self._connection.search( if self._connection.search(
search_base=self._source.search_base, search_base=self._source.search_base,
search_filter=self.generate_filter(**{LOGIN_FIELD: email}), search_filter=self.generate_filter(**{'email': email}),
search_scope=ldap3.SUBTREE, search_scope=ldap3.SUBTREE,
attributes=[ldap3.ALL_ATTRIBUTES, ldap3.ALL_OPERATIONAL_ATTRIBUTES], attributes=[ldap3.ALL_ATTRIBUTES, ldap3.ALL_OPERATIONAL_ATTRIBUTES],
get_operational_attributes=True, get_operational_attributes=True,
@ -198,47 +147,6 @@ class LDAPConnector:
LOGGER.warning(exception) LOGGER.warning(exception)
return None return None
def is_email_used(self, mail):
"""Checks whether an email address is already registered in LDAP"""
if self._source.create_user:
return self.lookup(self.generate_filter(mail=mail))
return False
def create_ldap_user(self, user, raw_password):
"""Creates a new LDAP User from a django user and raw_password.
Returns True on success, otherwise False"""
if self._source.create_user:
LOGGER.debug("User creation not enabled")
return False
# The dn of our new entry/object
username = user.pk.hex # UUID without dashes
# sAMAccountName is limited to 20 chars
# https://msdn.microsoft.com/en-us/library/ms679635.aspx
username_trunk = username[:20] if len(username) > 20 else username
# AD doesn't like sAMAccountName's with . at the end
username_trunk = username_trunk[:-1] if username_trunk[-1] == '.' else username_trunk
user_dn = 'cn=' + username + ',' + self._source.search_base
LOGGER.debug('New DN: %s', user_dn)
attrs = {
'distinguishedName': str(user_dn),
'cn': str(username),
'description': 't=' + str(time()),
'sAMAccountName': str(username_trunk),
'givenName': str(user.name),
'displayName': str(user.username),
'name': str(user.name),
'mail': str(user.email),
'userPrincipalName': str(username + '@' + self._source.domain),
'objectClass': ['top', 'person', 'organizationalPerson', 'user'],
}
try:
self._connection.add(user_dn, attributes=attrs)
except ldap3.core.exceptions.LDAPException as exception:
LOGGER.warning("Failed to create user ('%s'), saved to DB", exception)
# LDAPConnector.handle_ldap_error(user_dn, LDAPModification.ACTION_ADD, attrs)
LOGGER.debug("Signed up user %s", user.email)
return self.change_password(raw_password, mail=user.email)
def _do_modify(self, diff, **fields): def _do_modify(self, diff, **fields):
"""Do the LDAP modification itself""" """Do the LDAP modification itself"""
user_dn = self.lookup(self.generate_filter(**fields)) user_dn = self.lookup(self.generate_filter(**fields))
@ -246,7 +154,7 @@ class LDAPConnector:
self._connection.modify(user_dn, diff) self._connection.modify(user_dn, diff)
except ldap3.core.exceptions.LDAPException as exception: except ldap3.core.exceptions.LDAPException as exception:
LOGGER.warning("Failed to modify %s ('%s'), saved to DB", user_dn, exception) LOGGER.warning("Failed to modify %s ('%s'), saved to DB", user_dn, exception)
# LDAPConnector.handle_ldap_error(user_dn, LDAPModification.ACTION_MODIFY, diff) # Connector.handle_ldap_error(user_dn, LDAPModification.ACTION_MODIFY, diff)
LOGGER.debug("modified account '%s' [%s]", user_dn, ','.join(diff.keys())) LOGGER.debug("modified account '%s' [%s]", user_dn, ','.join(diff.keys()))
return 'result' in self._connection.result and self._connection.result['result'] == 0 return 'result' in self._connection.result and self._connection.result['result'] == 0
@ -270,7 +178,7 @@ class LDAPConnector:
"""Changes LDAP user's password based on mail or user_dn. """Changes LDAP user's password based on mail or user_dn.
Returns True on success, otherwise False""" Returns True on success, otherwise False"""
diff = { diff = {
'unicodePwd': [(ldap3.MODIFY_REPLACE, [LDAPConnector.encode_pass(new_password)])], 'unicodePwd': [(ldap3.MODIFY_REPLACE, [Connector.encode_pass(new_password)])],
} }
return self._do_modify(diff, **fields) return self._do_modify(diff, **fields)

45
passbook/sources/ldap/forms.py
View File

@ -5,8 +5,7 @@ from django.contrib.admin.widgets import FilteredSelectMultiple
from django.utils.translation import gettext_lazy as _ from django.utils.translation import gettext_lazy as _
from passbook.admin.forms.source import SOURCE_FORM_FIELDS from passbook.admin.forms.source import SOURCE_FORM_FIELDS
from passbook.core.forms.policies import GENERAL_FIELDS from passbook.sources.ldap.models import LDAPSource
from passbook.sources.ldap.models import LDAPGroupMembershipPolicy, LDAPSource
class LDAPSourceForm(forms.ModelForm): class LDAPSourceForm(forms.ModelForm):
@ -15,36 +14,36 @@ class LDAPSourceForm(forms.ModelForm):
class Meta: class Meta:
model = LDAPSource model = LDAPSource
fields = SOURCE_FORM_FIELDS + ['server_uri', 'bind_cn', 'bind_password', fields = SOURCE_FORM_FIELDS + [
'type', 'domain', 'base_dn', 'create_user', 'server_uri',
'reset_password'] 'bind_cn',
'bind_password',
'start_tls',
'base_dn',
'additional_user_dn',
'additional_group_dn',
'user_object_filter',
'group_object_filter',
'sync_groups',
'sync_parent_group',
]
widgets = { widgets = {
'name': forms.TextInput(), 'name': forms.TextInput(),
'server_uri': forms.TextInput(), 'server_uri': forms.TextInput(),
'bind_cn': forms.TextInput(), 'bind_cn': forms.TextInput(),
'bind_password': forms.TextInput(), 'bind_password': forms.PasswordInput(),
'domain': forms.TextInput(),
'base_dn': forms.TextInput(), 'base_dn': forms.TextInput(),
'additional_user_dn': forms.TextInput(),
'additional_group_dn': forms.TextInput(),
'user_object_filter': forms.TextInput(),
'group_object_filter': forms.TextInput(),
'policies': FilteredSelectMultiple(_('policies'), False) 'policies': FilteredSelectMultiple(_('policies'), False)
} }
labels = { labels = {
'server_uri': _('Server URI'), 'server_uri': _('Server URI'),
'bind_cn': _('Bind CN'), 'bind_cn': _('Bind CN'),
'start_tls': _('Enable Start TLS'),
'base_dn': _('Base DN'), 'base_dn': _('Base DN'),
} 'additional_user_dn': _('Addition User DN'),
'additional_group_dn': _('Addition Group DN'),
class LDAPGroupMembershipPolicyForm(forms.ModelForm):
"""LDAPGroupMembershipPolicy Form"""
class Meta:
model = LDAPGroupMembershipPolicy
fields = GENERAL_FIELDS + ['dn', ]
widgets = {
'name': forms.TextInput(),
'dn': forms.TextInput(),
}
labels = {
'dn': _('DN')
} }

41
passbook/sources/ldap/migrations/0001_initial.py
View File

@ -1,5 +1,6 @@
# Generated by Django 2.2.6 on 2019-10-07 14:07 # Generated by Django 2.2.6 on 2019-10-08 20:43
import django.core.validators
import django.db.models.deletion import django.db.models.deletion
from django.db import migrations, models from django.db import migrations, models
@ -13,18 +14,33 @@ class Migration(migrations.Migration):
] ]
operations = [ operations = [
migrations.CreateModel(
name='LDAPPropertyMapping',
fields=[
('propertymapping_ptr', models.OneToOneField(auto_created=True, on_delete=django.db.models.deletion.CASCADE, parent_link=True, primary_key=True, serialize=False, to='passbook_core.PropertyMapping')),
('ldap_property', models.TextField()),
('object_field', models.TextField()),
],
options={
'abstract': False,
},
bases=('passbook_core.propertymapping',),
),
migrations.CreateModel( migrations.CreateModel(
name='LDAPSource', name='LDAPSource',
fields=[ fields=[
('source_ptr', models.OneToOneField(auto_created=True, on_delete=django.db.models.deletion.CASCADE, parent_link=True, primary_key=True, serialize=False, to='passbook_core.Source')), ('source_ptr', models.OneToOneField(auto_created=True, on_delete=django.db.models.deletion.CASCADE, parent_link=True, primary_key=True, serialize=False, to='passbook_core.Source')),
('server_uri', models.TextField()), ('server_uri', models.URLField(validators=[django.core.validators.URLValidator(schemes=['ldap', 'ldaps'])])),
('bind_cn', models.TextField()), ('bind_cn', models.TextField()),
('bind_password', models.TextField()), ('bind_password', models.TextField()),
('type', models.CharField(choices=[('ad', 'Active Directory'), ('generic', 'Generic')], max_length=20)), ('start_tls', models.BooleanField(default=False)),
('domain', models.TextField()),
('base_dn', models.TextField()), ('base_dn', models.TextField()),
('create_user', models.BooleanField(default=False)), ('additional_user_dn', models.TextField(help_text='Prepended to Base DN for User-queries.')),
('reset_password', models.BooleanField(default=True)), ('additional_group_dn', models.TextField(help_text='Prepended to Base DN for Group-queries.')),
('user_object_filter', models.TextField()),
('group_object_filter', models.TextField()),
('sync_groups', models.BooleanField(default=True)),
('sync_parent_group', models.ForeignKey(blank=True, default=None, on_delete=django.db.models.deletion.SET_DEFAULT, to='passbook_core.Group')),
], ],
options={ options={
'verbose_name': 'LDAP Source', 'verbose_name': 'LDAP Source',
@ -32,17 +48,4 @@ class Migration(migrations.Migration):
}, },
bases=('passbook_core.source',), bases=('passbook_core.source',),
), ),
migrations.CreateModel(
name='LDAPGroupMembershipPolicy',
fields=[
('policy_ptr', models.OneToOneField(auto_created=True, on_delete=django.db.models.deletion.CASCADE, parent_link=True, primary_key=True, serialize=False, to='passbook_core.Policy')),
('dn', models.TextField()),
('source', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='passbook_sources_ldap.LDAPSource')),
],
options={
'verbose_name': 'LDAP Group Membership Policy',
'verbose_name_plural': 'LDAP Group Membership Policys',
},
bases=('passbook_core.policy',),
),
] ]

43
passbook/sources/ldap/models.py
View File

@ -1,30 +1,30 @@
"""passbook LDAP Models""" """passbook LDAP Models"""
from django.core.validators import URLValidator
from django.db import models from django.db import models
from django.utils.translation import gettext as _ from django.utils.translation import gettext as _
from passbook.core.models import Policy, Source, User from passbook.core.models import Group, PropertyMapping, Source
class LDAPSource(Source): class LDAPSource(Source):
"""LDAP Authentication source""" """LDAP Authentication source"""
TYPE_ACTIVE_DIRECTORY = 'ad' server_uri = models.URLField(validators=[URLValidator(schemes=['ldap', 'ldaps'])])
TYPE_GENERIC = 'generic'
TYPES = (
(TYPE_ACTIVE_DIRECTORY, _('Active Directory')),
(TYPE_GENERIC, _('Generic')),
)
server_uri = models.TextField()
bind_cn = models.TextField() bind_cn = models.TextField()
bind_password = models.TextField() bind_password = models.TextField()
type = models.CharField(max_length=20, choices=TYPES) start_tls = models.BooleanField(default=False)
domain = models.TextField()
base_dn = models.TextField() base_dn = models.TextField()
create_user = models.BooleanField(default=False) additional_user_dn = models.TextField(help_text=_('Prepended to Base DN for User-queries.'))
reset_password = models.BooleanField(default=True) additional_group_dn = models.TextField(help_text=_('Prepended to Base DN for Group-queries.'))
user_object_filter = models.TextField()
group_object_filter = models.TextField()
sync_groups = models.BooleanField(default=True)
sync_parent_group = models.ForeignKey(Group, blank=True,
default=None, on_delete=models.SET_DEFAULT)
form = 'passbook.sources.ldap.forms.LDAPSourceForm' form = 'passbook.sources.ldap.forms.LDAPSourceForm'
@ -37,19 +37,8 @@ class LDAPSource(Source):
verbose_name = _('LDAP Source') verbose_name = _('LDAP Source')
verbose_name_plural = _('LDAP Sources') verbose_name_plural = _('LDAP Sources')
class LDAPGroupMembershipPolicy(Policy):
"""Policy to check if a user is in a certain LDAP Group"""
dn = models.TextField() class LDAPPropertyMapping(PropertyMapping):
source = models.ForeignKey('LDAPSource', on_delete=models.CASCADE)
form = 'passbook.sources.ldap.forms.LDAPGroupMembershipPolicyForm' ldap_property = models.TextField()
object_field = models.TextField()
def passes(self, user: User):
"""Check if user instance passes this policy"""
raise NotImplementedError()
class Meta:
verbose_name = _('LDAP Group Membership Policy')
verbose_name_plural = _('LDAP Group Membership Policys')

33
passbook/sources/ldap/templates/ldap/settings.html
View File

@ -1,33 +0,0 @@
{% extends "_admin/module_default.html" %}
{% load i18n %}
{% load utils %}
{% block title %}
{% title "Settings" %}
{% endblock %}
{% block module_content %}
<h2><clr-icon shape="application" size="32"></clr-icon>{% trans 'LDAP connection' %}</h2>
<div class="row">
<div class="col-md-12">
<div class="card">
<form role="form" method="POST">
<div class="card-block">
<h3><clr-icon shape="cog" size="32"></clr-icon>{% trans 'General settings' %}</h3>
{% include 'partials/form.html' with form=general %}
<h3><clr-icon shape="connect" size="32"></clr-icon>{% trans 'Connection settings' %}</h3>
{% include 'partials/form.html' with form=connection %}
<h3><clr-icon shape="certificate" size="32"></clr-icon>{% trans 'Authentication backend ' %}</h3>
{% include 'partials/form.html' with form=authentication %}
<h3><clr-icon shape="users" size="32"></clr-icon>{% trans 'Create users settings' %}</h3>
{% include 'partials/form.html' with form=create_users %}
</div>
<div class="card-footer">
<button type="submit" value="general" class="btn btn-sm btn-primary">{% trans 'Update' %}</button>
</div>
</form>
</div>
</div>
</div>
{% endblock %}

9
passbook/sources/ldap/urls.py
View File

@ -1,9 +0,0 @@
# """passbook LDAP Urls"""
# from django.conf.urls import url
# from passbook.mod.auth.ldap import views
# urlpatterns = [
# url(r'^settings/$', views.admin_settings, name='admin_settings'),
# ]

38
passbook/sources/ldap/views.py
View File

@ -1,38 +0,0 @@
# """passbook LDAP Views"""
# from django.contrib import messages
# from django.contrib.auth.decorators import login_required, user_passes_test
# from django.http import HttpRequest, HttpResponse
# from django.shortcuts import redirect, render
# from django.urls import reverse
# from django.utils.translation import ugettext as _
# from passbook.sources.ldap.forms import (AuthenticationBackendSettings,
# ConnectionSettings,
# CreateUsersSettings,
# GeneralSettingsForm)
# @login_required
# @user_passes_test(lambda u: u.is_superuser)
# def admin_settings(request: HttpRequest) -> HttpResponse:
# """Default view for modules without admin view"""
# form_classes = {
# 'general': GeneralSettingsForm,
# 'connection': ConnectionSettings,
# 'authentication': AuthenticationBackendSettings,
# 'create_users': CreateUsersSettings,
# }
# render_data = {}
# for form_key, form_class in form_classes.items():
# render_data[form_key] = form_class(request.POST if request.method == 'POST' else None)
# if request.method == 'POST':
# update_count = 0
# for form_key, form_class in form_classes.items():
# form = form_class(request.POST)
# if form.is_valid():
# update_count += form.save()
# messages.success(request, _('Successfully updated %d settings.' % update_count))
# return redirect(reverse('passbook_ldap:admin_settings'))
# return render(request, 'ldap/settings.html', render_data)

5
passbook/sources/oauth/clients.py
View File

@ -3,7 +3,6 @@
import json import json
from urllib.parse import parse_qs, urlencode from urllib.parse import parse_qs, urlencode
from django.conf import settings
from django.utils.crypto import constant_time_compare, get_random_string from django.utils.crypto import constant_time_compare, get_random_string
from django.utils.encoding import force_text from django.utils.encoding import force_text
from requests import Session from requests import Session
@ -11,6 +10,8 @@ from requests.exceptions import RequestException
from requests_oauthlib import OAuth1 from requests_oauthlib import OAuth1
from structlog import get_logger from structlog import get_logger
from passbook import __version__
LOGGER = get_logger() LOGGER = get_logger()
@ -23,7 +24,7 @@ class BaseOAuthClient:
self.source = source self.source = source
self.token = token self.token = token
self._session = Session() self._session = Session()
self._session.headers.update({'User-Agent': 'web:passbook:%s' % settings.VERSION}) self._session.headers.update({'User-Agent': 'web:passbook:%s' % __version__})
def get_access_token(self, request, callback=None): def get_access_token(self, request, callback=None):
"Fetch access token from callback request." "Fetch access token from callback request."