Infra
/
lemur
5
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add support for nested group membership in ldap authenticator

This commit is contained in:
Ronald Moesbergen 2018-11-19 13:42:42 +01:00
parent 661bc9cc13
commit 61839f4aca
1 changed files with 15 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
lemur/auth/ldap.py
View File

@ -41,7 +41,6 @@ class LdapPrincipal():
self.ldap_default_role = current_app.config.get("LEMUR_DEFAULT_ROLE", None) self.ldap_default_role = current_app.config.get("LEMUR_DEFAULT_ROLE", None)
self.ldap_required_group = current_app.config.get("LDAP_REQUIRED_GROUP", None) self.ldap_required_group = current_app.config.get("LDAP_REQUIRED_GROUP", None)
self.ldap_groups_to_roles = current_app.config.get("LDAP_GROUPS_TO_ROLES", None) self.ldap_groups_to_roles = current_app.config.get("LDAP_GROUPS_TO_ROLES", None)
self.ldap_attrs = ['memberOf']
self.ldap_client = None self.ldap_client = None
self.ldap_groups = None self.ldap_groups = None
@ -168,11 +167,21 @@ class LdapPrincipal():
except ldap.LDAPError as e: except ldap.LDAPError as e:
raise Exception("ldap error: {0}".format(e)) raise Exception("ldap error: {0}".format(e))
lgroups = self.ldap_client.search_s(self.ldap_base_dn, # Lookup user DN, needed to search for group membership
ldap.SCOPE_SUBTREE, ldap_filter, self.ldap_attrs)[0][1]['memberOf'] userdn = self.ldap_client.search_s(self.ldap_base_dn,
# lgroups is a list of utf-8 encoded strings ldap.SCOPE_SUBTREE, ldap_filter,
# convert to a single string of groups to allow matching ['distinguishedName'])[0][1]['distinguishedName'][0]
self.ldap_groups = b''.join(lgroups).decode('ascii') userdn = userdn.decode('utf-8')
# Search all groups that have the userDN as a member
groupfilter = '(&(objectclass=group)(member:1.2.840.113556.1.4.1941:={0}))'.format(userdn)
lgroups = self.ldap_client.search_s(self.ldap_base_dn, ldap.SCOPE_SUBTREE, groupfilter, ['cn'])
# Create a list of group CN's from the result
self.ldap_groups = []
for group in lgroups:
(dn, values) = group
self.ldap_groups.append(values['cn'][0].decode('ascii'))
self.ldap_client.unbind() self.ldap_client.unbind()
def _ldap_validate_conf(self): def _ldap_validate_conf(self):