ldap(major): start rewrite

passbook/core/templates/overview/base.html

@@ -141,18 +141,6 @@
                 <span class="list-group-item-value">{% trans 'Audit Log' %}</span>
             </a>
         </li>
-        <li class="list-group-item {% is_active_app 'admin' %}">
-            <a href="{% url 'admin:index' %}">
-                <span class="fa fa-database" data-toggle="tooltip" title="{% trans 'Django' %}"></span>
-                <span class="list-group-item-value">{% trans 'Django' %}</span>
-            </a>
-        </li>
-        <li class="list-group-item {% is_active 'passbook_admin:debug-request' %}">
-            <a href="{% url 'passbook_admin:debug-request' %}">
-                <span class="fa fa-bug" data-toggle="tooltip" title="{% trans 'Debug' %}"></span>
-                <span class="list-group-item-value">{% trans 'Debug' %}</span>
-            </a>
-        </li>
         {% endif %}
     </ul>
 </div>

passbook/sources/ldap/auth.py

@@ -2,7 +2,7 @@
 from django.contrib.auth.backends import ModelBackend
 from structlog import get_logger
 
-from passbook.sources.ldap.ldap_connector import LDAPConnector
+from passbook.sources.ldap.connector import Connector
 from passbook.sources.ldap.models import LDAPSource
 
 LOGGER = get_logger()
@@ -16,7 +16,7 @@ class LDAPBackend(ModelBackend):
         if 'password' not in kwargs:
             return None
         for source in LDAPSource.objects.filter(enabled=True):
-            _ldap = LDAPConnector(source)
+            _ldap = Connector(source)
             user = _ldap.auth_user(**kwargs)
             if user:
                 return user

passbook/sources/ldap/connector.py

@@ -11,16 +11,16 @@ from passbook.sources.ldap.models import LDAPSource
 
 LOGGER = get_logger()
 
-USERNAME_FIELD = CONFIG.y('ldap.username_field', 'sAMAccountName')
+# USERNAME_FIELD = CONFIG.y('ldap.username_field', 'sAMAccountName')
-LOGIN_FIELD = CONFIG.y('ldap.login_field', 'userPrincipalName')
+# LOGIN_FIELD = CONFIG.y('ldap.login_field', 'userPrincipalName')
 
 
-class LDAPConnector:
+class Connector:
     """Wrapper for ldap3 to easily manage user authentication and creation"""
 
-    _server = None
+    _server: ldap3.Server
-    _connection = None
+    _connection = ldap3.Connection
-    _source = None
+    _source: LDAPSource
 
     def __init__(self, source: LDAPSource):
         self._source = source
@@ -28,68 +28,17 @@ class LDAPConnector:
         if not self._source.enabled:
             LOGGER.debug("LDAP not Enabled")
 
-        # if not con_args:
-        #     con_args = {}
-        # if not server_args:
-        #     server_args = {}
-        # Either use mock argument or test is in argv
-        # if mock or any('test' in arg for arg in sys.argv):
-        #     self.mock = True
-        #     self.create_users_enabled = True
-        #     con_args['client_strategy'] = ldap3.MOCK_SYNC
-        #     server_args['get_info'] = ldap3.OFFLINE_AD_2012_R2
-        # if self.mock:
-        #     json_path = os.path.join(os.path.dirname(__file__), 'tests', 'ldap_mock.json')
-        #     self._connection.strategy.entries_from_json(json_path)
-
         self._server = ldap3.Server(source.server_uri) # Implement URI parsing
         self._connection = ldap3.Connection(self._server, raise_exceptions=True,
                                             user=source.bind_cn,
                                             password=source.bind_password)
 
         self._connection.bind()
-        # if CONFIG.y('ldap.server.use_tls'):
+        if source.start_tls:
-        #     self._connection.start_tls()
+            self._connection.start_tls()
-
-    # @staticmethod
-    # def cleanup_mock():
-    #     """Cleanup mock files which are not this PID's"""
-    #     pid = os.getpid()
-    #     json_path = os.path.join(os.path.dirname(__file__), 'test', 'ldap_mock_%d.json' % pid)
-    #     os.unlink(json_path)
-    #     LOGGER.debug("Cleaned up LDAP Mock from PID %d", pid)
-
-    # def apply_db(self):
-    #     """Check if any unapplied LDAPModification's are left"""
-    #     to_apply = LDAPModification.objects.filter(_purgeable=False)
-    #     for obj in to_apply:
-    #         try:
-    #             if obj.action == LDAPModification.ACTION_ADD:
-    #                 self._connection.add(obj.dn, obj.data)
-    #             elif obj.action == LDAPModification.ACTION_MODIFY:
-    #                 self._connection.modify(obj.dn, obj.data)
-
-    #             # Object has been successfully applied to LDAP
-    #             obj.delete()
-    #         except ldap3.core.exceptions.LDAPException as exc:
-    #             LOGGER.error(exc)
-    #     LOGGER.debug("Recovered %d Modifications from DB.", len(to_apply))
-
-    # @staticmethod
-    # def handle_ldap_error(object_dn, action, data):
-    #     """Custom Handler for LDAP methods to write LDIF to DB"""
-    #     LDAPModification.objects.create(
-    #         dn=object_dn,
-    #         action=action,
-    #         data=data)
-
-    # @property
-    # def enabled(self):
-    #     """Returns whether LDAP is enabled or not"""
-    #     return CONFIG.y('ldap.enabled')
 
     @staticmethod
-    def encode_pass(password):
+    def encode_pass(password: str) -> str:
         """Encodes a plain-text password so it can be used by AD"""
         return '"{}"'.format(password).encode('utf-16-le')
 
@@ -128,7 +77,7 @@ class LDAPConnector:
             return None
         # Create the user data.
         field_map = {
-            'username': '%(' + USERNAME_FIELD + ')s',
+            'username': '%(' + ')s',
             'name': '%(givenName)s %(sn)s',
             'email': '%(mail)s',
         }
@@ -168,7 +117,7 @@ class LDAPConnector:
         # FIXME: Adapt user_uid
         # email = filters.pop(CONFIG.y('passport').get('ldap').get, '')
         email = filters.pop('email')
-        user_dn = self.lookup(self.generate_filter(**{LOGIN_FIELD: email}))
+        user_dn = self.lookup(self.generate_filter(**{'email': email}))
         if not user_dn:
             return None
         # Try to bind as new user
@@ -179,7 +128,7 @@ class LDAPConnector:
             temp_connection.bind()
             if self._connection.search(
                     search_base=self._source.search_base,
-                    search_filter=self.generate_filter(**{LOGIN_FIELD: email}),
+                    search_filter=self.generate_filter(**{'email': email}),
                     search_scope=ldap3.SUBTREE,
                     attributes=[ldap3.ALL_ATTRIBUTES, ldap3.ALL_OPERATIONAL_ATTRIBUTES],
                     get_operational_attributes=True,
@@ -198,47 +147,6 @@ class LDAPConnector:
             LOGGER.warning(exception)
         return None
 
-    def is_email_used(self, mail):
-        """Checks whether an email address is already registered in LDAP"""
-        if self._source.create_user:
-            return self.lookup(self.generate_filter(mail=mail))
-        return False
-
-    def create_ldap_user(self, user, raw_password):
-        """Creates a new LDAP User from a django user and raw_password.
-        Returns True on success, otherwise False"""
-        if self._source.create_user:
-            LOGGER.debug("User creation not enabled")
-            return False
-        # The dn of our new entry/object
-        username = user.pk.hex # UUID without dashes
-        # sAMAccountName is limited to 20 chars
-        # https://msdn.microsoft.com/en-us/library/ms679635.aspx
-        username_trunk = username[:20] if len(username) > 20 else username
-        # AD doesn't like sAMAccountName's with . at the end
-        username_trunk = username_trunk[:-1] if username_trunk[-1] == '.' else username_trunk
-        user_dn = 'cn=' + username + ',' + self._source.search_base
-        LOGGER.debug('New DN: %s', user_dn)
-        attrs = {
-            'distinguishedName': str(user_dn),
-            'cn': str(username),
-            'description': 't=' + str(time()),
-            'sAMAccountName': str(username_trunk),
-            'givenName': str(user.name),
-            'displayName': str(user.username),
-            'name': str(user.name),
-            'mail': str(user.email),
-            'userPrincipalName': str(username + '@' + self._source.domain),
-            'objectClass': ['top', 'person', 'organizationalPerson', 'user'],
-        }
-        try:
-            self._connection.add(user_dn, attributes=attrs)
-        except ldap3.core.exceptions.LDAPException as exception:
-            LOGGER.warning("Failed to create user ('%s'), saved to DB", exception)
-            # LDAPConnector.handle_ldap_error(user_dn, LDAPModification.ACTION_ADD, attrs)
-        LOGGER.debug("Signed up user %s", user.email)
-        return self.change_password(raw_password, mail=user.email)
-
     def _do_modify(self, diff, **fields):
         """Do the LDAP modification itself"""
         user_dn = self.lookup(self.generate_filter(**fields))
@@ -246,7 +154,7 @@ class LDAPConnector:
             self._connection.modify(user_dn, diff)
         except ldap3.core.exceptions.LDAPException as exception:
             LOGGER.warning("Failed to modify %s ('%s'), saved to DB", user_dn, exception)
-            # LDAPConnector.handle_ldap_error(user_dn, LDAPModification.ACTION_MODIFY, diff)
+            # Connector.handle_ldap_error(user_dn, LDAPModification.ACTION_MODIFY, diff)
         LOGGER.debug("modified account '%s' [%s]", user_dn, ','.join(diff.keys()))
         return 'result' in self._connection.result and self._connection.result['result'] == 0
 
@@ -270,7 +178,7 @@ class LDAPConnector:
         """Changes LDAP user's password based on mail or user_dn.
         Returns True on success, otherwise False"""
         diff = {
-            'unicodePwd': [(ldap3.MODIFY_REPLACE, [LDAPConnector.encode_pass(new_password)])],
+            'unicodePwd': [(ldap3.MODIFY_REPLACE, [Connector.encode_pass(new_password)])],
         }
         return self._do_modify(diff, **fields)
 

passbook/sources/ldap/forms.py

@@ -5,8 +5,7 @@ from django.contrib.admin.widgets import FilteredSelectMultiple
 from django.utils.translation import gettext_lazy as _
 
 from passbook.admin.forms.source import SOURCE_FORM_FIELDS
-from passbook.core.forms.policies import GENERAL_FIELDS
+from passbook.sources.ldap.models import LDAPSource
-from passbook.sources.ldap.models import LDAPGroupMembershipPolicy, LDAPSource
 
 
 class LDAPSourceForm(forms.ModelForm):
@@ -15,36 +14,36 @@ class LDAPSourceForm(forms.ModelForm):
     class Meta:
 
         model = LDAPSource
-        fields = SOURCE_FORM_FIELDS + ['server_uri', 'bind_cn', 'bind_password',
+        fields = SOURCE_FORM_FIELDS + [
-                                       'type', 'domain', 'base_dn', 'create_user',
+            'server_uri',
-                                       'reset_password']
+            'bind_cn',
+            'bind_password',
+            'start_tls',
+            'base_dn',
+            'additional_user_dn',
+            'additional_group_dn',
+            'user_object_filter',
+            'group_object_filter',
+            'sync_groups',
+            'sync_parent_group',
+        ]
         widgets = {
             'name': forms.TextInput(),
             'server_uri': forms.TextInput(),
             'bind_cn': forms.TextInput(),
-            'bind_password': forms.TextInput(),
+            'bind_password': forms.PasswordInput(),
-            'domain': forms.TextInput(),
             'base_dn': forms.TextInput(),
+            'additional_user_dn': forms.TextInput(),
+            'additional_group_dn': forms.TextInput(),
+            'user_object_filter': forms.TextInput(),
+            'group_object_filter': forms.TextInput(),
             'policies': FilteredSelectMultiple(_('policies'), False)
         }
         labels = {
             'server_uri': _('Server URI'),
             'bind_cn': _('Bind CN'),
+            'start_tls': _('Enable Start TLS'),
             'base_dn': _('Base DN'),
-        }
+            'additional_user_dn': _('Addition User DN'),
-
+            'additional_group_dn': _('Addition Group DN'),
-
-class LDAPGroupMembershipPolicyForm(forms.ModelForm):
-    """LDAPGroupMembershipPolicy Form"""
-
-    class Meta:
-
-        model = LDAPGroupMembershipPolicy
-        fields = GENERAL_FIELDS + ['dn', ]
-        widgets = {
-            'name': forms.TextInput(),
-            'dn': forms.TextInput(),
-        }
-        labels = {
-            'dn': _('DN')
         }

passbook/sources/ldap/migrations/0001_initial.py

@@ -1,5 +1,6 @@
-# Generated by Django 2.2.6 on 2019-10-07 14:07
+# Generated by Django 2.2.6 on 2019-10-08 20:43
 
+import django.core.validators
 import django.db.models.deletion
 from django.db import migrations, models
 
@@ -13,18 +14,33 @@ class Migration(migrations.Migration):
     ]
 
     operations = [
+        migrations.CreateModel(
+            name='LDAPPropertyMapping',
+            fields=[
+                ('propertymapping_ptr', models.OneToOneField(auto_created=True, on_delete=django.db.models.deletion.CASCADE, parent_link=True, primary_key=True, serialize=False, to='passbook_core.PropertyMapping')),
+                ('ldap_property', models.TextField()),
+                ('object_field', models.TextField()),
+            ],
+            options={
+                'abstract': False,
+            },
+            bases=('passbook_core.propertymapping',),
+        ),
         migrations.CreateModel(
             name='LDAPSource',
             fields=[
                 ('source_ptr', models.OneToOneField(auto_created=True, on_delete=django.db.models.deletion.CASCADE, parent_link=True, primary_key=True, serialize=False, to='passbook_core.Source')),
-                ('server_uri', models.TextField()),
+                ('server_uri', models.URLField(validators=[django.core.validators.URLValidator(schemes=['ldap', 'ldaps'])])),
                 ('bind_cn', models.TextField()),
                 ('bind_password', models.TextField()),
-                ('type', models.CharField(choices=[('ad', 'Active Directory'), ('generic', 'Generic')], max_length=20)),
+                ('start_tls', models.BooleanField(default=False)),
-                ('domain', models.TextField()),
                 ('base_dn', models.TextField()),
-                ('create_user', models.BooleanField(default=False)),
+                ('additional_user_dn', models.TextField(help_text='Prepended to Base DN for User-queries.')),
-                ('reset_password', models.BooleanField(default=True)),
+                ('additional_group_dn', models.TextField(help_text='Prepended to Base DN for Group-queries.')),
+                ('user_object_filter', models.TextField()),
+                ('group_object_filter', models.TextField()),
+                ('sync_groups', models.BooleanField(default=True)),
+                ('sync_parent_group', models.ForeignKey(blank=True, default=None, on_delete=django.db.models.deletion.SET_DEFAULT, to='passbook_core.Group')),
             ],
             options={
                 'verbose_name': 'LDAP Source',
@@ -32,17 +48,4 @@ class Migration(migrations.Migration):
             },
             bases=('passbook_core.source',),
         ),
-        migrations.CreateModel(
-            name='LDAPGroupMembershipPolicy',
-            fields=[
-                ('policy_ptr', models.OneToOneField(auto_created=True, on_delete=django.db.models.deletion.CASCADE, parent_link=True, primary_key=True, serialize=False, to='passbook_core.Policy')),
-                ('dn', models.TextField()),
-                ('source', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='passbook_sources_ldap.LDAPSource')),
-            ],
-            options={
-                'verbose_name': 'LDAP Group Membership Policy',
-                'verbose_name_plural': 'LDAP Group Membership Policys',
-            },
-            bases=('passbook_core.policy',),
-        ),
     ]

passbook/sources/ldap/models.py

@@ -1,30 +1,30 @@
 """passbook LDAP Models"""
 
+from django.core.validators import URLValidator
 from django.db import models
 from django.utils.translation import gettext as _
 
-from passbook.core.models import Policy, Source, User
+from passbook.core.models import Group, PropertyMapping, Source
 
 
 class LDAPSource(Source):
     """LDAP Authentication source"""
 
-    TYPE_ACTIVE_DIRECTORY = 'ad'
+    server_uri = models.URLField(validators=[URLValidator(schemes=['ldap', 'ldaps'])])
-    TYPE_GENERIC = 'generic'
-    TYPES = (
-        (TYPE_ACTIVE_DIRECTORY, _('Active Directory')),
-        (TYPE_GENERIC, _('Generic')),
-    )
-
-    server_uri = models.TextField()
     bind_cn = models.TextField()
     bind_password = models.TextField()
-    type = models.CharField(max_length=20, choices=TYPES)
+    start_tls = models.BooleanField(default=False)
 
-    domain = models.TextField()
     base_dn = models.TextField()
-    create_user = models.BooleanField(default=False)
+    additional_user_dn = models.TextField(help_text=_('Prepended to Base DN for User-queries.'))
-    reset_password = models.BooleanField(default=True)
+    additional_group_dn = models.TextField(help_text=_('Prepended to Base DN for Group-queries.'))
+
+    user_object_filter = models.TextField()
+    group_object_filter = models.TextField()
+
+    sync_groups = models.BooleanField(default=True)
+    sync_parent_group = models.ForeignKey(Group, blank=True,
+                                          default=None, on_delete=models.SET_DEFAULT)
 
     form = 'passbook.sources.ldap.forms.LDAPSourceForm'
 
@@ -37,19 +37,8 @@ class LDAPSource(Source):
         verbose_name = _('LDAP Source')
         verbose_name_plural = _('LDAP Sources')
 
-class LDAPGroupMembershipPolicy(Policy):
-    """Policy to check if a user is in a certain LDAP Group"""
 
-    dn = models.TextField()
+class LDAPPropertyMapping(PropertyMapping):
-    source = models.ForeignKey('LDAPSource', on_delete=models.CASCADE)
 
-    form = 'passbook.sources.ldap.forms.LDAPGroupMembershipPolicyForm'
+    ldap_property = models.TextField()
-
+    object_field = models.TextField()
-    def passes(self, user: User):
-        """Check if user instance passes this policy"""
-        raise NotImplementedError()
-
-    class Meta:
-
-        verbose_name = _('LDAP Group Membership Policy')
-        verbose_name_plural = _('LDAP Group Membership Policys')

passbook/sources/ldap/templates/ldap/settings.html

@@ -1,33 +0,0 @@
-{% extends "_admin/module_default.html" %}
-
-{% load i18n %}
-{% load utils %}
-
-{% block title %}
-{% title "Settings" %}
-{% endblock %}
-
-{% block module_content %}
-<h2><clr-icon shape="application" size="32"></clr-icon>{% trans 'LDAP connection' %}</h2>
-<div class="row">
-  <div class="col-md-12">
-    <div class="card">
-      <form role="form" method="POST">
-        <div class="card-block">
-          <h3><clr-icon shape="cog" size="32"></clr-icon>{% trans 'General settings' %}</h3>
-          {% include 'partials/form.html' with form=general %}
-          <h3><clr-icon shape="connect" size="32"></clr-icon>{% trans 'Connection settings' %}</h3>
-          {% include 'partials/form.html' with form=connection %}
-          <h3><clr-icon shape="certificate" size="32"></clr-icon>{% trans 'Authentication backend ' %}</h3>
-          {% include 'partials/form.html' with form=authentication %}
-          <h3><clr-icon shape="users" size="32"></clr-icon>{% trans 'Create users settings' %}</h3>
-          {% include 'partials/form.html' with form=create_users %}
-        </div>
-        <div class="card-footer">
-          <button type="submit" value="general" class="btn btn-sm btn-primary">{% trans 'Update' %}</button>
-        </div>
-      </form>
-    </div>
-  </div>
-</div>
-{% endblock %}

passbook/sources/ldap/urls.py

@@ -1,9 +0,0 @@
-# """passbook LDAP Urls"""
-
-# from django.conf.urls import url
-
-# from passbook.mod.auth.ldap import views
-
-# urlpatterns = [
-#     url(r'^settings/$', views.admin_settings, name='admin_settings'),
-# ]

passbook/sources/ldap/views.py

@@ -1,38 +0,0 @@
-# """passbook LDAP Views"""
-
-
-# from django.contrib import messages
-# from django.contrib.auth.decorators import login_required, user_passes_test
-# from django.http import HttpRequest, HttpResponse
-# from django.shortcuts import redirect, render
-# from django.urls import reverse
-# from django.utils.translation import ugettext as _
-
-# from passbook.sources.ldap.forms import (AuthenticationBackendSettings,
-#                                            ConnectionSettings,
-#                                            CreateUsersSettings,
-#                                            GeneralSettingsForm)
-
-
-# @login_required
-# @user_passes_test(lambda u: u.is_superuser)
-# def admin_settings(request: HttpRequest) -> HttpResponse:
-#     """Default view for modules without admin view"""
-#     form_classes = {
-#         'general': GeneralSettingsForm,
-#         'connection': ConnectionSettings,
-#         'authentication': AuthenticationBackendSettings,
-#         'create_users': CreateUsersSettings,
-#     }
-#     render_data = {}
-#     for form_key, form_class in form_classes.items():
-#         render_data[form_key] = form_class(request.POST if request.method == 'POST' else None)
-#     if request.method == 'POST':
-#         update_count = 0
-#         for form_key, form_class in form_classes.items():
-#             form = form_class(request.POST)
-#             if form.is_valid():
-#                 update_count += form.save()
-#         messages.success(request, _('Successfully updated %d settings.' % update_count))
-#         return redirect(reverse('passbook_ldap:admin_settings'))
-#     return render(request, 'ldap/settings.html', render_data)

passbook/sources/oauth/clients.py

@@ -3,7 +3,6 @@
 import json
 from urllib.parse import parse_qs, urlencode
 
-from django.conf import settings
 from django.utils.crypto import constant_time_compare, get_random_string
 from django.utils.encoding import force_text
 from requests import Session
@@ -11,6 +10,8 @@ from requests.exceptions import RequestException
 from requests_oauthlib import OAuth1
 from structlog import get_logger
 
+from passbook import __version__
+
 LOGGER = get_logger()
 
 
@@ -23,7 +24,7 @@ class BaseOAuthClient:
         self.source = source
         self.token = token
         self._session = Session()
-        self._session.headers.update({'User-Agent': 'web:passbook:%s' % settings.VERSION})
+        self._session.headers.update({'User-Agent': 'web:passbook:%s' % __version__})
 
     def get_access_token(self, request, callback=None):
         "Fetch access token from callback request."