habsi/authentik
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sources/ldap: implement working membership lookups

Browse Source
This commit is contained in:
Amélie Lilith Krejčí
2025-01-13 14:47:14 +01:00
parent 269a557c58
commit 9dfa792757
1 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
authentik/sources/ldap/sync/membership.py
View File

@ -28,15 +28,16 @@ class MembershipLDAPSynchronizer(BaseLDAPSynchronizer):
if not self._source.sync_groups: if not self._source.sync_groups:
self.message("Group syncing is disabled for this Source") self.message("Group syncing is disabled for this Source")
return iter(()) return iter(())
attributes = [self._source.object_uniqueness_field, LDAP_DISTINGUISHED_NAME]
if not self._source.lookup_groups_from_user: # If we are looking up groups from users, we don't need to fetch the group membership field
attributes.append(self._source.group_membership_field)
return self.search_paginator( return self.search_paginator(
search_base=self.base_dn_groups, search_base=self.base_dn_groups,
search_filter=self._source.group_object_filter, search_filter=self._source.group_object_filter,
search_scope=SUBTREE, search_scope=SUBTREE,
attributes=[ attributes=attributes,
self._source.group_membership_field,
self._source.object_uniqueness_field,
LDAP_DISTINGUISHED_NAME,
],
**kwargs, **kwargs,
) )
@ -50,10 +51,10 @@ class MembershipLDAPSynchronizer(BaseLDAPSynchronizer):
if self._source.lookup_groups_from_user: if self._source.lookup_groups_from_user:
group_dn = group.get("dn", {}) group_dn = group.get("dn", {})
group_filter = f"({self._source.group_membership_field}={group_dn})" group_filter = f"({self._source.group_membership_field}={group_dn})"
group_members = self._source.connection.extend.standard.paged_search( group_members = self._source.connection().extend.standard.paged_search(
search_base=self.base_dn_users, search_base=self.base_dn_users,
search_filter=group_filter, search_filter=group_filter,
search_scope=ldap3.SUBTREE, search_scope=SUBTREE,
attributes=[ attributes=[
self._source.object_uniqueness_field self._source.object_uniqueness_field
] ]