diff --git a/ldapcherry/backend/backendLdap.py b/ldapcherry/backend/backendLdap.py new file mode 100644 index 0000000..54bf5be --- /dev/null +++ b/ldapcherry/backend/backendLdap.py @@ -0,0 +1,104 @@ +# -*- coding: utf-8 -*- +# vim:set expandtab tabstop=4 shiftwidth=4: +# +# The MIT License (MIT) +# LdapCherry +# Copyright (c) 2014 Carpentier Pierre-Francois + +import cherrypy +import ldap +import logging +import ldapcherry.backend + +class Backend(ldapcherry.backend.Backend): + + def __init__(self, config, logger): + self.config = config + self._logger = logger + + def auth(self, username, password): + + binddn = get_user(username) + if binddn: + ldap_client = self._connect() + try: + ldap_client.simple_bind_s(binddn, password) + except ldap.INVALID_CREDENTIALS: + ldap_client.unbind_s() + return False + ldap_client.unbind_s() + return True + else: + return False + + def add_to_group(self): + pass + + def set_attrs(self, attrs): + pass + + def rm_from_group(self): + pass + + def add_user(self, username): + pass + + def del_user(self, username): + pass + + def get_user(self, username): + ldap_client = self._connect() + try: + ldap_client.simple_bind_s(self.binddn, self.bindpassword) + except ldap.INVALID_CREDENTIALS: + self._logger( + logging.ERROR, + "Configuration error, wrong credentials, unable to connect to ldap with '" + self.config['binddn'] + "'" + ) + raise cherrypy.HTTPError("500", "Configuration Error, contact administrator") + except ldap.SERVER_DOWN: + self._logger( + logging.ERROR, + "Unable to contact ldap server '" + self.config['uri'] + "', check 'auth.ldap.uri' and ssl/tls configuration" + ) + return False + + user_filter = self.config['user_filter_tmpl'] % { + 'login': username + } + + r = ldap_client.search_s(self.userdn, + ldap.SCOPE_SUBTREE, + user_filter + ) + if len(r) == 0: + ldap_client.unbind_s() + return False + + dn_entry = r[0][0] + return dn_entry + + def _connect(self): + ldap_client = ldap.initialize(self.config['uri']) + ldap_client.set_option(ldap.OPT_REFERRALS, 0) + if self.config['starttls'] == 'on': + ldap.set_option(ldap.OPT_X_TLS_DEMAND, True) + if self.config['starttls'] == 'on': + ldap.set_option(ldap.OPT_X_TLS_DEMAND, True) + if self.config['ca']: + ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, self.config['ca']) + if self.config['checkcert'] == 'off': + ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_ALLOW) + else: + ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT,ldap.OPT_X_TLS_DEMAND) + + if self.config['starttls'] == 'on': + try: + ldap_client.start_tls_s() + except ldap.OPERATIONS_ERROR: + self._logger( + logging.ERROR, + "cannot use starttls with ldaps:// uri (uri: " + self.config['uri'] + ")" + ) + raise cherrypy.HTTPError("500", "Configuration Error, contact administrator") + return ldap_client diff --git a/ldapcherry/backend/backendSamba4.py b/ldapcherry/backend/backendSamba4.py new file mode 100644 index 0000000..8f490e1 --- /dev/null +++ b/ldapcherry/backend/backendSamba4.py @@ -0,0 +1,13 @@ +# -*- coding: utf-8 -*- +# vim:set expandtab tabstop=4 shiftwidth=4: +# +# License GPLv3 +# LdapCherry +# Copyright (c) 2014 Carpentier Pierre-Francois + +import ldapcherry.backend + +class Backend(ldapcherry.backend.Backend): + + def __init__(self, config, logger): + pass diff --git a/ldapcherry/backend/ldap.py b/ldapcherry/backend/ldap.py deleted file mode 100644 index b1d930f..0000000 --- a/ldapcherry/backend/ldap.py +++ /dev/null @@ -1,103 +0,0 @@ -# -*- coding: utf-8 -*- -# vim:set expandtab tabstop=4 shiftwidth=4: -# -# The MIT License (MIT) -# LdapCherry -# Copyright (c) 2014 Carpentier Pierre-Francois - -import cherrypy -import ldap -import logging -import ldapcherry.backend - -class Backend(ldapcherry.backend.Backend): - - def __init__(self, config, logger): - self.config = config - - def auth(self, username, password): - - binddn = get_user(username) - if binddn: - ldap_client = self._connect() - try: - ldap_client.simple_bind_s(binddn, password) - except ldap.INVALID_CREDENTIALS: - ldap_client.unbind_s() - return False - ldap_client.unbind_s() - return True - else: - return False - - def add_to_group(self): - pass - - def set_attrs(self, attrs): - pass - - def rm_from_group(self): - pass - - def add_user(self, username): - pass - - def del_user(self, username): - pass - - def get_user(self, username): - ldap_client = self._connect() - try: - ldap_client.simple_bind_s(self.binddn, self.bindpassword) - except ldap.INVALID_CREDENTIALS: - self._logger( - logging.ERROR, - "Configuration error, wrong credentials, unable to connect to ldap with '" + self.binddn + "'" - ) - raise cherrypy.HTTPError("500", "Configuration Error, contact administrator") - except ldap.SERVER_DOWN: - self._logger( - logging.ERROR, - "Unable to contact ldap server '" + self.uri + "', check 'auth.ldap.uri' and ssl/tls configuration" - ) - return False - - user_filter = self.config['user_filter_tmpl'] % { - 'login': username - } - - r = ldap_client.search_s(self.userdn, - ldap.SCOPE_SUBTREE, - user_filter - ) - if len(r) == 0: - ldap_client.unbind_s() - return False - - dn_entry = r[0][0] - return dn_entry - - def _connect(self): - ldap_client = ldap.initialize(self.config['uri']) - ldap_client.set_option(ldap.OPT_REFERRALS, 0) - if self.config['starttls'] == 'on': - ldap.set_option(ldap.OPT_X_TLS_DEMAND, True) - if self.config['starttls'] == 'on': - ldap.set_option(ldap.OPT_X_TLS_DEMAND, True) - if self.ca: - ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, self.config['ca']) - if self.checkcert == 'off': - ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_ALLOW) - else: - ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT,ldap.OPT_X_TLS_DEMAND) - - if self.config['starttls'] == 'on': - try: - ldap_client.start_tls_s() - except ldap.OPERATIONS_ERROR: - self._logger( - logging.ERROR, - "cannot use starttls with ldaps:// uri (uri: " + self.uri + ")" - ) - raise cherrypy.HTTPError("500", "Configuration Error, contact administrator") - return ldap_client diff --git a/ldapcherry/backend/samba4.py b/ldapcherry/backend/samba4.py deleted file mode 100644 index 8f490e1..0000000 --- a/ldapcherry/backend/samba4.py +++ /dev/null @@ -1,13 +0,0 @@ -# -*- coding: utf-8 -*- -# vim:set expandtab tabstop=4 shiftwidth=4: -# -# License GPLv3 -# LdapCherry -# Copyright (c) 2014 Carpentier Pierre-Francois - -import ldapcherry.backend - -class Backend(ldapcherry.backend.Backend): - - def __init__(self, config, logger): - pass