| 74 | |
| 75 | |
| 76 | class LdapAuthenticator(auth_base.Authenticator): |
| 77 | def __init__(self, params_dict, temp_folder): |
| 78 | super().__init__() |
| 79 | |
| 80 | self.url = model_helper.read_obligatory(params_dict, 'url', ' for LDAP auth') |
| 81 | |
| 82 | username_pattern = strip(params_dict.get('username_pattern')) |
| 83 | if username_pattern: |
| 84 | self.username_template = Template(username_pattern) |
| 85 | else: |
| 86 | self.username_template = None |
| 87 | |
| 88 | base_dn = params_dict.get('base_dn') |
| 89 | if base_dn: |
| 90 | self._base_dn = base_dn.strip() |
| 91 | else: |
| 92 | resolved_base_dn = _resolve_base_dn(username_pattern) |
| 93 | |
| 94 | if resolved_base_dn: |
| 95 | LOGGER.info('Resolved base dn: ' + resolved_base_dn) |
| 96 | self._base_dn = resolved_base_dn |
| 97 | else: |
| 98 | LOGGER.warning( |
| 99 | 'Cannot resolve LDAP base dn, so using empty. Please specify it using "base_dn" attribute') |
| 100 | self._base_dn = '' |
| 101 | |
| 102 | self.version = params_dict.get("version") |
| 103 | if not self.version: |
| 104 | self.version = 3 |
| 105 | |
| 106 | self._groups_file = os.path.join(temp_folder, 'ldap_groups.json') |
| 107 | self._user_groups = self._load_groups(self._groups_file) |
| 108 | |
| 109 | def authenticate(self, request_handler): |
| 110 | username = request_handler.get_argument('username') |
| 111 | password = request_handler.get_argument('password') |
| 112 | |
| 113 | return self._authenticate_internal(username, password) |
| 114 | |
| 115 | def perform_basic_auth(self, user, password): |
| 116 | self._authenticate_internal(user, password) |
| 117 | return True |
| 118 | |
| 119 | def _authenticate_internal(self, username, password): |
| 120 | LOGGER.info('Logging in user ' + username) |
| 121 | |
| 122 | if self.username_template: |
| 123 | full_username = self.username_template.substitute(username=username) |
| 124 | else: |
| 125 | full_username = username |
| 126 | |
| 127 | try: |
| 128 | connection = self._connect(full_username, password) |
| 129 | |
| 130 | if connection.bound: |
| 131 | try: |
| 132 | user_dn, user_uid = self._get_user_ids(full_username, connection) |
| 133 | LOGGER.debug('user ids: ' + str((user_dn, user_uid))) |
no outgoing calls