auth_ldap.py
154 lines
| 5.6 KiB
| text/x-python
|
PythonLexer
r1292 | # -*- coding: utf-8 -*- | |||
""" | ||||
rhodecode.controllers.changelog | ||||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | ||||
RhodeCode authentication library for LDAP | ||||
:created_on: Created on Nov 17, 2010 | ||||
:author: marcink | ||||
:copyright: (C) 2009-2011 Marcin Kuzminski <marcin@python-works.com> | ||||
:license: GPLv3, see COPYING for more details. | ||||
""" | ||||
r1206 | # This program is free software: you can redistribute it and/or modify | |||
# it under the terms of the GNU General Public License as published by | ||||
# the Free Software Foundation, either version 3 of the License, or | ||||
# (at your option) any later version. | ||||
r1203 | # | |||
r713 | # This program is distributed in the hope that it will be useful, | |||
# but WITHOUT ANY WARRANTY; without even the implied warranty of | ||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||||
# GNU General Public License for more details. | ||||
r1203 | # | |||
r713 | # You should have received a copy of the GNU General Public License | |||
r1206 | # along with this program. If not, see <http://www.gnu.org/licenses/>. | |||
r700 | ||||
r705 | import logging | |||
r1292 | from rhodecode.lib.exceptions import LdapConnectionError, LdapUsernameError, \ | |||
LdapPasswordError | ||||
r705 | log = logging.getLogger(__name__) | |||
r700 | ||||
r1292 | ||||
r705 | try: | |||
import ldap | ||||
except ImportError: | ||||
r1292 | # means that python-ldap is not installed | |||
r705 | pass | |||
r700 | ||||
r1292 | ||||
r705 | class AuthLdap(object): | |||
r700 | ||||
r705 | def __init__(self, server, base_dn, port=389, bind_dn='', bind_pass='', | |||
r1292 | tls_kind='PLAIN', tls_reqcert='DEMAND', ldap_version=3, | |||
|
r991 | ldap_filter='(&(objectClass=user)(!(objectClass=computer)))', | ||
search_scope='SUBTREE', | ||||
attr_login='uid'): | ||||
r705 | self.ldap_version = ldap_version | |||
|
r1290 | ldap_server_type = 'ldap' | ||
self.TLS_KIND = tls_kind | ||||
if self.TLS_KIND == 'LDAPS': | ||||
r705 | port = port or 689 | |||
|
r1290 | ldap_server_type = ldap_server_type + 's' | ||
r1579 | ||||
OPT_X_TLS_DEMAND = 2 | ||||
self.TLS_REQCERT = getattr(ldap, 'OPT_X_TLS_%s' % tls_reqcert, | ||||
OPT_X_TLS_DEMAND) | ||||
r705 | self.LDAP_SERVER_ADDRESS = server | |||
self.LDAP_SERVER_PORT = port | ||||
r700 | ||||
r705 | #USE FOR READ ONLY BIND TO LDAP SERVER | |||
self.LDAP_BIND_DN = bind_dn | ||||
self.LDAP_BIND_PASS = bind_pass | ||||
r700 | ||||
r705 | self.LDAP_SERVER = "%s://%s:%s" % (ldap_server_type, | |||
r1579 | self.LDAP_SERVER_ADDRESS, | |||
self.LDAP_SERVER_PORT) | ||||
r705 | ||||
self.BASE_DN = base_dn | ||||
|
r991 | self.LDAP_FILTER = ldap_filter | ||
r1579 | self.SEARCH_SCOPE = getattr(ldap, 'SCOPE_%s' % search_scope) | |||
|
r991 | self.attr_login = attr_login | ||
r705 | def authenticate_ldap(self, username, password): | |||
"""Authenticate a user via LDAP and return his/her LDAP properties. | ||||
r1203 | ||||
r705 | Raises AuthenticationError if the credentials are rejected, or | |||
EnvironmentError if the LDAP server can't be reached. | ||||
r1203 | ||||
r705 | :param username: username | |||
:param password: password | ||||
""" | ||||
from rhodecode.lib.helpers import chop_at | ||||
uid = chop_at(username, "@%s" % self.LDAP_SERVER_ADDRESS) | ||||
r775 | ||||
|
r1659 | if not password: | ||
log.debug("Attempt to authenticate LDAP user with blank password rejected.") | ||||
raise LdapPasswordError() | ||||
r705 | if "," in username: | |||
r713 | raise LdapUsernameError("invalid character in username: ,") | |||
r705 | try: | |||
r1579 | if hasattr(ldap,'OPT_X_TLS_CACERTDIR'): | |||
ldap.set_option(ldap.OPT_X_TLS_CACERTDIR, | ||||
'/etc/openldap/cacerts') | ||||
|
r991 | ldap.set_option(ldap.OPT_REFERRALS, ldap.OPT_OFF) | ||
ldap.set_option(ldap.OPT_RESTART, ldap.OPT_ON) | ||||
ldap.set_option(ldap.OPT_TIMEOUT, 20) | ||||
r705 | ldap.set_option(ldap.OPT_NETWORK_TIMEOUT, 10) | |||
|
r991 | ldap.set_option(ldap.OPT_TIMELIMIT, 15) | ||
|
r1290 | if self.TLS_KIND != 'PLAIN': | ||
|
r991 | ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, self.TLS_REQCERT) | ||
r705 | server = ldap.initialize(self.LDAP_SERVER) | |||
if self.ldap_version == 2: | ||||
server.protocol = ldap.VERSION2 | ||||
else: | ||||
server.protocol = ldap.VERSION3 | ||||
r700 | ||||
|
r1290 | if self.TLS_KIND == 'START_TLS': | ||
server.start_tls_s() | ||||
r705 | if self.LDAP_BIND_DN and self.LDAP_BIND_PASS: | |||
r794 | server.simple_bind_s(self.LDAP_BIND_DN, self.LDAP_BIND_PASS) | |||
r700 | ||||
r1292 | filt = '(&%s(%s=%s))' % (self.LDAP_FILTER, self.attr_login, | |||
username) | ||||
r1170 | log.debug("Authenticating %r filt %s at %s", self.BASE_DN, | |||
filt, self.LDAP_SERVER) | ||||
lobjects = server.search_ext_s(self.BASE_DN, self.SEARCH_SCOPE, | ||||
filt) | ||||
|
r991 | |||
if not lobjects: | ||||
raise ldap.NO_SUCH_OBJECT() | ||||
r775 | ||||
|
r1287 | for (dn, _attrs) in lobjects: | ||
r1444 | if dn is None: | |||
continue | ||||
|
r991 | try: | ||
server.simple_bind_s(dn, password) | ||||
r1292 | attrs = server.search_ext_s(dn, ldap.SCOPE_BASE, | |||
'(objectClass=*)')[0][1] | ||||
|
r991 | break | ||
except ldap.INVALID_CREDENTIALS, e: | ||||
r1170 | log.debug("LDAP rejected password for user '%s' (%s): %s", | |||
uid, username, dn) | ||||
|
r991 | |||
r1185 | else: | |||
log.debug("No matching LDAP objects for authentication " | ||||
"of '%s' (%s)", uid, username) | ||||
raise LdapPasswordError() | ||||
|
r991 | |||
r705 | except ldap.NO_SUCH_OBJECT, e: | |||
log.debug("LDAP says no such user '%s' (%s)", uid, username) | ||||
r713 | raise LdapUsernameError() | |||
r705 | except ldap.SERVER_DOWN, e: | |||
r1292 | raise LdapConnectionError("LDAP can't access " | |||
"authentication server") | ||||
r705 | ||||
|
r991 | return (dn, attrs) | ||