2025-12-25 upload
This commit is contained in:
“shengyudong”
@@ -0,0 +1,98 @@
|
||||
"""
|
||||
"""
|
||||
|
||||
# Created on 2016.12.26
|
||||
#
|
||||
# Author: Giovanni Cannata
|
||||
#
|
||||
# Copyright 2016 - 2020 Giovanni Cannata
|
||||
#
|
||||
# This file is part of ldap3.
|
||||
#
|
||||
# ldap3 is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU Lesser General Public License as published
|
||||
# by the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# ldap3 is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU Lesser General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU Lesser General Public License
|
||||
# along with ldap3 in the COPYING and COPYING.LESSER files.
|
||||
# If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
from ... import SEQUENCE_TYPES, MODIFY_ADD, BASE, DEREF_NEVER
|
||||
from ...core.exceptions import LDAPInvalidDnError, LDAPOperationsErrorResult
|
||||
from ...utils.dn import safe_dn
|
||||
|
||||
|
||||
def ad_add_members_to_groups(connection,
|
||||
members_dn,
|
||||
groups_dn,
|
||||
fix=True,
|
||||
raise_error=False):
|
||||
"""
|
||||
:param connection: a bound Connection object
|
||||
:param members_dn: the list of members to add to groups
|
||||
:param groups_dn: the list of groups where members are to be added
|
||||
:param fix: checks for group existence and already assigned members
|
||||
:param raise_error: If the operation fails it raises an error instead of returning False
|
||||
:return: a boolean where True means that the operation was successful and False means an error has happened
|
||||
Establishes users-groups relations following the Active Directory rules: users are added to the member attribute of groups.
|
||||
Raises LDAPInvalidDnError if members or groups are not found in the DIT.
|
||||
"""
|
||||
|
||||
if not isinstance(members_dn, SEQUENCE_TYPES):
|
||||
members_dn = [members_dn]
|
||||
|
||||
if not isinstance(groups_dn, SEQUENCE_TYPES):
|
||||
groups_dn = [groups_dn]
|
||||
|
||||
if connection.check_names: # builds new lists with sanitized dn
|
||||
members_dn = [safe_dn(member_dn) for member_dn in members_dn]
|
||||
groups_dn = [safe_dn(group_dn) for group_dn in groups_dn]
|
||||
|
||||
error = False
|
||||
for group in groups_dn:
|
||||
if fix: # checks for existance of group and for already assigned members
|
||||
result = connection.search(group, '(objectclass=*)', BASE, dereference_aliases=DEREF_NEVER, attributes=['member'])
|
||||
if not connection.strategy.sync:
|
||||
response, result = connection.get_response(result)
|
||||
else:
|
||||
if connection.strategy.thread_safe:
|
||||
_, result, response, _ = result
|
||||
else:
|
||||
response = connection.response
|
||||
result = connection.result
|
||||
|
||||
if not result['description'] == 'success':
|
||||
raise LDAPInvalidDnError(group + ' not found')
|
||||
|
||||
existing_members = response[0]['attributes']['member'] if 'member' in response[0]['attributes'] else []
|
||||
existing_members = [element.lower() for element in existing_members]
|
||||
else:
|
||||
existing_members = []
|
||||
|
||||
changes = dict()
|
||||
member_to_add = [element for element in members_dn if element.lower() not in existing_members]
|
||||
if member_to_add:
|
||||
changes['member'] = (MODIFY_ADD, member_to_add)
|
||||
if changes:
|
||||
result = connection.modify(group, changes)
|
||||
if not connection.strategy.sync:
|
||||
_, result = connection.get_response(result)
|
||||
else:
|
||||
if connection.strategy.thread_safe:
|
||||
_, result, _, _ = result
|
||||
else:
|
||||
result = connection.result
|
||||
if result['description'] != 'success':
|
||||
error = True
|
||||
result_error_params = ['result', 'description', 'dn', 'message']
|
||||
if raise_error:
|
||||
raise LDAPOperationsErrorResult([(k, v) for k, v in result.items() if k in result_error_params])
|
||||
break
|
||||
|
||||
return not error # returns True if no error is raised in the LDAP operations
|
||||
94
venv/Lib/site-packages/ldap3/extend/microsoft/dirSync.py
Normal file
94
venv/Lib/site-packages/ldap3/extend/microsoft/dirSync.py
Normal file
@@ -0,0 +1,94 @@
|
||||
"""
|
||||
"""
|
||||
|
||||
# Created on 2015.10.21
|
||||
#
|
||||
# Author: Giovanni Cannata
|
||||
#
|
||||
# Copyright 2015 - 2020 Giovanni Cannata
|
||||
#
|
||||
# This file is part of ldap3.
|
||||
#
|
||||
# ldap3 is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU Lesser General Public License as published
|
||||
# by the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# ldap3 is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU Lesser General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU Lesser General Public License
|
||||
# along with ldap3 in the COPYING and COPYING.LESSER files.
|
||||
# If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
from ...core.exceptions import LDAPExtensionError
|
||||
from ...protocol.microsoft import dir_sync_control, extended_dn_control, show_deleted_control
|
||||
from ... import SUBTREE, DEREF_NEVER
|
||||
from ...utils.dn import safe_dn
|
||||
|
||||
|
||||
class DirSync(object):
|
||||
def __init__(self,
|
||||
connection,
|
||||
sync_base,
|
||||
sync_filter,
|
||||
attributes,
|
||||
cookie,
|
||||
object_security,
|
||||
ancestors_first,
|
||||
public_data_only,
|
||||
incremental_values,
|
||||
max_length,
|
||||
hex_guid
|
||||
):
|
||||
self.connection = connection
|
||||
if self.connection.check_names and sync_base:
|
||||
self. base = safe_dn(sync_base)
|
||||
else:
|
||||
self.base = sync_base
|
||||
self.filter = sync_filter
|
||||
self.attributes = attributes
|
||||
self.cookie = cookie
|
||||
self.object_security = object_security
|
||||
self.ancestors_first = ancestors_first
|
||||
self.public_data_only = public_data_only
|
||||
self.incremental_values = incremental_values
|
||||
self.max_length = max_length
|
||||
self.hex_guid = hex_guid
|
||||
self.more_results = True
|
||||
|
||||
def loop(self):
|
||||
result = self.connection.search(search_base=self.base,
|
||||
search_filter=self.filter,
|
||||
search_scope=SUBTREE,
|
||||
attributes=self.attributes,
|
||||
dereference_aliases=DEREF_NEVER,
|
||||
controls=[dir_sync_control(criticality=True,
|
||||
object_security=self.object_security,
|
||||
ancestors_first=self.ancestors_first,
|
||||
public_data_only=self.public_data_only,
|
||||
incremental_values=self.incremental_values,
|
||||
max_length=self.max_length, cookie=self.cookie),
|
||||
extended_dn_control(criticality=False, hex_format=self.hex_guid),
|
||||
show_deleted_control(criticality=False)]
|
||||
)
|
||||
if not self.connection.strategy.sync:
|
||||
response, result = self.connection.get_response(result)
|
||||
else:
|
||||
if self.connection.strategy.thread_safe:
|
||||
_, result, response, _ = result
|
||||
else:
|
||||
response = self.connection.response
|
||||
result = self.connection.result
|
||||
|
||||
if result['description'] == 'success' and 'controls' in result and '1.2.840.113556.1.4.841' in result['controls']:
|
||||
self.more_results = result['controls']['1.2.840.113556.1.4.841']['value']['more_results']
|
||||
self.cookie = result['controls']['1.2.840.113556.1.4.841']['value']['cookie']
|
||||
return response
|
||||
elif 'controls' in result:
|
||||
raise LDAPExtensionError('Missing DirSync control in response from server')
|
||||
else:
|
||||
raise LDAPExtensionError('error %r in DirSync' % result)
|
||||
|
||||
@@ -0,0 +1,75 @@
|
||||
"""
|
||||
"""
|
||||
|
||||
# Created on 2015.11.27
|
||||
#
|
||||
# Author: Giovanni Cannata
|
||||
#
|
||||
# Copyright 2015 - 2020 Giovanni Cannata
|
||||
#
|
||||
# This file is part of ldap3.
|
||||
#
|
||||
# ldap3 is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU Lesser General Public License as published
|
||||
# by the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# ldap3 is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU Lesser General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU Lesser General Public License
|
||||
# along with ldap3 in the COPYING and COPYING.LESSER files.
|
||||
# If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
|
||||
from ... import MODIFY_REPLACE, MODIFY_DELETE, MODIFY_ADD
|
||||
from ...utils.log import log, log_enabled, PROTOCOL
|
||||
from ...core.results import RESULT_SUCCESS
|
||||
from ...utils.dn import safe_dn
|
||||
from ...utils.conv import to_unicode
|
||||
|
||||
|
||||
def ad_modify_password(connection, user_dn, new_password, old_password, controls=None):
|
||||
# old password must be None to reset password with sufficient privileges
|
||||
if connection.check_names:
|
||||
user_dn = safe_dn(user_dn)
|
||||
if str is bytes: # python2, converts to unicode
|
||||
new_password = to_unicode(new_password)
|
||||
if old_password:
|
||||
old_password = to_unicode(old_password)
|
||||
|
||||
encoded_new_password = ('"%s"' % new_password).encode('utf-16-le')
|
||||
|
||||
if old_password: # normal users must specify old and new password
|
||||
encoded_old_password = ('"%s"' % old_password).encode('utf-16-le')
|
||||
result = connection.modify(user_dn,
|
||||
{'unicodePwd': [(MODIFY_DELETE, [encoded_old_password]),
|
||||
(MODIFY_ADD, [encoded_new_password])]},
|
||||
controls)
|
||||
else: # admin users can reset password without sending the old one
|
||||
result = connection.modify(user_dn,
|
||||
{'unicodePwd': [(MODIFY_REPLACE, [encoded_new_password])]},
|
||||
controls)
|
||||
|
||||
if not connection.strategy.sync:
|
||||
_, result = connection.get_response(result)
|
||||
else:
|
||||
if connection.strategy.thread_safe:
|
||||
_, result, _, _ = result
|
||||
else:
|
||||
result = connection.result
|
||||
|
||||
# change successful, returns True
|
||||
if result['result'] == RESULT_SUCCESS:
|
||||
return True
|
||||
|
||||
# change was not successful, raises exception if raise_exception = True in connection or returns the operation result, error code is in result['result']
|
||||
if connection.raise_exceptions:
|
||||
from ...core.exceptions import LDAPOperationResult
|
||||
if log_enabled(PROTOCOL):
|
||||
log(PROTOCOL, 'operation result <%s> for <%s>', result, connection)
|
||||
raise LDAPOperationResult(result=result['result'], description=result['description'], dn=result['dn'], message=result['message'], response_type=result['type'])
|
||||
|
||||
return False
|
||||
@@ -0,0 +1,117 @@
|
||||
"""
|
||||
"""
|
||||
|
||||
# Created on 2016.07.08
|
||||
#
|
||||
# Author: Giovanni Cannata
|
||||
#
|
||||
# Copyright 2016 - 2020 Giovanni Cannata
|
||||
#
|
||||
# This file is part of ldap3.
|
||||
#
|
||||
# ldap3 is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU Lesser General Public License as published
|
||||
# by the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# ldap3 is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU Lesser General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU Lesser General Public License
|
||||
# along with ldap3 in the COPYING and COPYING.LESSER files.
|
||||
# If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
try:
|
||||
from queue import Empty
|
||||
except ImportError: # Python 2
|
||||
# noinspection PyUnresolvedReferences
|
||||
from Queue import Empty
|
||||
|
||||
from ...core.exceptions import LDAPExtensionError
|
||||
from ...utils.dn import safe_dn
|
||||
from ...protocol.microsoft import persistent_search_control
|
||||
|
||||
|
||||
class ADPersistentSearch(object):
|
||||
def __init__(self,
|
||||
connection,
|
||||
search_base,
|
||||
search_scope,
|
||||
attributes,
|
||||
streaming,
|
||||
callback
|
||||
):
|
||||
if connection.strategy.sync:
|
||||
raise LDAPExtensionError('Persistent Search needs an asynchronous streaming connection')
|
||||
|
||||
if connection.check_names and search_base:
|
||||
search_base = safe_dn(search_base)
|
||||
|
||||
self.connection = connection
|
||||
self.message_id = None
|
||||
self.base = search_base
|
||||
self.scope = search_scope
|
||||
self.attributes = attributes
|
||||
self.controls = [persistent_search_control()]
|
||||
|
||||
# this is the only filter permitted by AD persistent search
|
||||
self.filter = '(objectClass=*)'
|
||||
|
||||
self.connection.strategy.streaming = streaming
|
||||
if callback and callable(callback):
|
||||
self.connection.strategy.callback = callback
|
||||
elif callback:
|
||||
raise LDAPExtensionError('callback is not callable')
|
||||
|
||||
self.start()
|
||||
|
||||
def start(self):
|
||||
if self.message_id: # persistent search already started
|
||||
return
|
||||
|
||||
if not self.connection.bound:
|
||||
self.connection.bind()
|
||||
|
||||
with self.connection.strategy.async_lock:
|
||||
self.message_id = self.connection.search(search_base=self.base,
|
||||
search_filter=self.filter,
|
||||
search_scope=self.scope,
|
||||
attributes=self.attributes,
|
||||
controls=self.controls)
|
||||
self.connection.strategy.persistent_search_message_id = self.message_id
|
||||
|
||||
def stop(self, unbind=True):
|
||||
self.connection.abandon(self.message_id)
|
||||
if unbind:
|
||||
self.connection.unbind()
|
||||
if self.message_id in self.connection.strategy._responses:
|
||||
del self.connection.strategy._responses[self.message_id]
|
||||
if hasattr(self.connection.strategy, '_requests') and self.message_id in self.connection.strategy._requests: # asynchronous strategy has a dict of request that could be returned by get_response()
|
||||
del self.connection.strategy._requests[self.message_id]
|
||||
self.connection.strategy.persistent_search_message_id = None
|
||||
self.message_id = None
|
||||
|
||||
def next(self, block=False, timeout=None):
|
||||
if not self.connection.strategy.streaming and not self.connection.strategy.callback:
|
||||
try:
|
||||
return self.connection.strategy.events.get(block, timeout)
|
||||
except Empty:
|
||||
return None
|
||||
|
||||
raise LDAPExtensionError('Persistent search is not accumulating events in queue')
|
||||
|
||||
def funnel(self, block=False, timeout=None):
|
||||
done = False
|
||||
while not done:
|
||||
try:
|
||||
entry = self.connection.strategy.events.get(block, timeout)
|
||||
except Empty:
|
||||
yield None
|
||||
if entry['type'] == 'searchResEntry':
|
||||
yield entry
|
||||
else:
|
||||
done = True
|
||||
|
||||
yield entry
|
||||
@@ -0,0 +1,99 @@
|
||||
"""
|
||||
"""
|
||||
|
||||
# Created on 2016.12.26
|
||||
#
|
||||
# Author: Giovanni Cannata
|
||||
#
|
||||
# Copyright 2016 - 2020 Giovanni Cannata
|
||||
#
|
||||
# This file is part of ldap3.
|
||||
#
|
||||
# ldap3 is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU Lesser General Public License as published
|
||||
# by the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# ldap3 is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU Lesser General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU Lesser General Public License
|
||||
# along with ldap3 in the COPYING and COPYING.LESSER files.
|
||||
# If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
from ...core.exceptions import LDAPInvalidDnError, LDAPOperationsErrorResult
|
||||
from ... import SEQUENCE_TYPES, MODIFY_DELETE, BASE, DEREF_NEVER
|
||||
from ...utils.dn import safe_dn
|
||||
|
||||
|
||||
def ad_remove_members_from_groups(connection,
|
||||
members_dn,
|
||||
groups_dn,
|
||||
fix,
|
||||
raise_error=False):
|
||||
"""
|
||||
:param connection: a bound Connection object
|
||||
:param members_dn: the list of members to remove from groups
|
||||
:param groups_dn: the list of groups where members are to be removed
|
||||
:param fix: checks for group existence and existing members
|
||||
:param raise_error: If the operation fails it raises an error instead of returning False
|
||||
:return: a boolean where True means that the operation was successful and False means an error has happened
|
||||
Removes users-groups relations following the Activwe Directory rules: users are removed from groups' member attribute
|
||||
|
||||
"""
|
||||
if not isinstance(members_dn, SEQUENCE_TYPES):
|
||||
members_dn = [members_dn]
|
||||
|
||||
if not isinstance(groups_dn, SEQUENCE_TYPES):
|
||||
groups_dn = [groups_dn]
|
||||
|
||||
if connection.check_names: # builds new lists with sanitized dn
|
||||
members_dn = [safe_dn(member_dn) for member_dn in members_dn]
|
||||
groups_dn = [safe_dn(group_dn) for group_dn in groups_dn]
|
||||
|
||||
error = False
|
||||
|
||||
for group in groups_dn:
|
||||
if fix: # checks for existance of group and for already assigned members
|
||||
result = connection.search(group, '(objectclass=*)', BASE, dereference_aliases=DEREF_NEVER, attributes=['member'])
|
||||
|
||||
if not connection.strategy.sync:
|
||||
response, result = connection.get_response(result)
|
||||
else:
|
||||
if connection.strategy.thread_safe:
|
||||
_, result, response, _ = result
|
||||
else:
|
||||
response = connection.response
|
||||
result = connection.result
|
||||
|
||||
if not result['description'] == 'success':
|
||||
raise LDAPInvalidDnError(group + ' not found')
|
||||
|
||||
existing_members = response[0]['attributes']['member'] if 'member' in response[0]['attributes'] else []
|
||||
else:
|
||||
existing_members = members_dn
|
||||
|
||||
existing_members = [element.lower() for element in existing_members]
|
||||
changes = dict()
|
||||
member_to_remove = [element for element in members_dn if element.lower() in existing_members]
|
||||
if member_to_remove:
|
||||
changes['member'] = (MODIFY_DELETE, member_to_remove)
|
||||
if changes:
|
||||
result = connection.modify(group, changes)
|
||||
if not connection.strategy.sync:
|
||||
_, result = connection.get_response(result)
|
||||
else:
|
||||
if connection.strategy.thread_safe:
|
||||
_, result, _, _ = result
|
||||
else:
|
||||
result = connection.result
|
||||
if result['description'] != 'success':
|
||||
error = True
|
||||
result_error_params = ['result', 'description', 'dn', 'message']
|
||||
if raise_error:
|
||||
raise LDAPOperationsErrorResult([(k, v) for k, v in result.items() if k in result_error_params])
|
||||
break
|
||||
|
||||
return not error
|
||||
@@ -0,0 +1,57 @@
|
||||
"""
|
||||
"""
|
||||
|
||||
# Created on 2016.11.01
|
||||
#
|
||||
# Author: Giovanni Cannata
|
||||
#
|
||||
# Copyright 2015 - 2020 Giovanni Cannata
|
||||
#
|
||||
# This file is part of ldap3.
|
||||
#
|
||||
# ldap3 is free software: you can redistribute it and/or modify
|
||||
# it under the terms of the GNU Lesser General Public License as published
|
||||
# by the Free Software Foundation, either version 3 of the License, or
|
||||
# (at your option) any later version.
|
||||
#
|
||||
# ldap3 is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU Lesser General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU Lesser General Public License
|
||||
# along with ldap3 in the COPYING and COPYING.LESSER files.
|
||||
# If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
|
||||
from ... import MODIFY_REPLACE
|
||||
from ...utils.log import log, log_enabled, PROTOCOL
|
||||
from ...core.results import RESULT_SUCCESS
|
||||
from ...utils.dn import safe_dn
|
||||
|
||||
|
||||
def ad_unlock_account(connection, user_dn, controls=None):
|
||||
if connection.check_names:
|
||||
user_dn = safe_dn(user_dn)
|
||||
result = connection.modify(user_dn, {'lockoutTime': [(MODIFY_REPLACE, ['0'])]}, controls)
|
||||
|
||||
if not connection.strategy.sync:
|
||||
_, result = connection.get_response(result)
|
||||
else:
|
||||
if connection.strategy.thread_safe:
|
||||
_, result, _, _ = result
|
||||
else:
|
||||
result = connection.result
|
||||
|
||||
# change successful, returns True
|
||||
if result['result'] == RESULT_SUCCESS:
|
||||
return True
|
||||
|
||||
# change was not successful, raises exception if raise_exception = True in connection or returns the operation result, error code is in result['result']
|
||||
if connection.raise_exceptions:
|
||||
from ...core.exceptions import LDAPOperationResult
|
||||
if log_enabled(PROTOCOL):
|
||||
log(PROTOCOL, 'operation result <%s> for <%s>', result, connection)
|
||||
raise LDAPOperationResult(result=result['result'], description=result['description'], dn=result['dn'], message=result['message'], response_type=result['type'])
|
||||
|
||||
return result
|
||||
Reference in New Issue
Block a user