From 61839f4acadd3dfac12b21bb0572d1ddc795a236 Mon Sep 17 00:00:00 2001 From: Ronald Moesbergen Date: Mon, 19 Nov 2018 13:42:42 +0100 Subject: [PATCH] Add support for nested group membership in ldap authenticator --- lemur/auth/ldap.py | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/lemur/auth/ldap.py b/lemur/auth/ldap.py index 398a5830..dc8f8941 100644 --- a/lemur/auth/ldap.py +++ b/lemur/auth/ldap.py @@ -41,7 +41,6 @@ class LdapPrincipal(): self.ldap_default_role = current_app.config.get("LEMUR_DEFAULT_ROLE", None) self.ldap_required_group = current_app.config.get("LDAP_REQUIRED_GROUP", None) self.ldap_groups_to_roles = current_app.config.get("LDAP_GROUPS_TO_ROLES", None) - self.ldap_attrs = ['memberOf'] self.ldap_client = None self.ldap_groups = None @@ -168,11 +167,21 @@ class LdapPrincipal(): except ldap.LDAPError as e: raise Exception("ldap error: {0}".format(e)) - lgroups = self.ldap_client.search_s(self.ldap_base_dn, - ldap.SCOPE_SUBTREE, ldap_filter, self.ldap_attrs)[0][1]['memberOf'] - # lgroups is a list of utf-8 encoded strings - # convert to a single string of groups to allow matching - self.ldap_groups = b''.join(lgroups).decode('ascii') + # Lookup user DN, needed to search for group membership + userdn = self.ldap_client.search_s(self.ldap_base_dn, + ldap.SCOPE_SUBTREE, ldap_filter, + ['distinguishedName'])[0][1]['distinguishedName'][0] + userdn = userdn.decode('utf-8') + # Search all groups that have the userDN as a member + groupfilter = '(&(objectclass=group)(member:1.2.840.113556.1.4.1941:={0}))'.format(userdn) + lgroups = self.ldap_client.search_s(self.ldap_base_dn, ldap.SCOPE_SUBTREE, groupfilter, ['cn']) + + # Create a list of group CN's from the result + self.ldap_groups = [] + for group in lgroups: + (dn, values) = group + self.ldap_groups.append(values['cn'][0].decode('ascii')) + self.ldap_client.unbind() def _ldap_validate_conf(self):