sources/ldap(major): implement membership sync, add more settings

This commit is contained in:
Langhammer, Jens 2019-10-11 13:41:12 +02:00
parent e972f2b289
commit 8478b03892
4 changed files with 93 additions and 14 deletions

View File

@ -49,11 +49,9 @@ class Connector:
def sync_groups(self):
"""Iterate over all LDAP Groups and create passbook_core.Group instances"""
attributes = [
'objectSid', # Used as unique Identifier
'name',
'dn',
]
if not self._source.sync_groups:
LOGGER.debug("Group syncing is disabled for this Source")
return
groups = self._connection.extend.standard.paged_search(
search_base=self.base_dn_groups,
search_filter=self._source.group_object_filter,
@ -62,8 +60,16 @@ class Connector:
for group in groups:
attributes = group.get('attributes', {})
_, created = Group.objects.update_or_create(
attributes__objectSid=attributes.get('objectSid', ''),
defaults=self._build_object_properties(attributes),
attributes__ldap_uniq=attributes.get(self._source.object_uniqueness_field, ''),
parent=self._source.sync_parent_group,
# defaults=self._build_object_properties(attributes),
defaults={
'name': attributes.get('name', ''),
'attributes': {
'ldap_uniq': attributes.get(self._source.object_uniqueness_field, ''),
'distinguishedName': attributes.get('distinguishedName')
}
}
)
LOGGER.debug("Synced group", group=attributes.get('name', ''), created=created)
@ -77,14 +83,43 @@ class Connector:
for user in users:
attributes = user.get('attributes', {})
_, created = User.objects.update_or_create(
attributes__objectSid=attributes.get('objectSid', ''),
attributes__ldap_uniq=attributes.get(self._source.object_uniqueness_field, ''),
defaults=self._build_object_properties(attributes),
)
LOGGER.debug("Synced User", user=attributes.get('name', ''), created=created)
def sync_membership(self):
"""Iterate over all Users and assign Groups using memberOf Field"""
pass
users = self._connection.extend.standard.paged_search(
search_base=self.base_dn_users,
search_filter=self._source.user_object_filter,
search_scope=ldap3.SUBTREE,
attributes=[
self._source.user_group_membership_field,
self._source.object_uniqueness_field])
group_cache: Dict[str, Group] = {}
for user in users:
member_of = user.get('attributes', {}).get(self._source.user_group_membership_field, [])
uniq = user.get('attributes', {}).get(self._source.object_uniqueness_field, [])
for group_dn in member_of:
# Check if group_dn is within our base_dn_groups, and skip if not
if not group_dn.endswith(self.base_dn_groups):
continue
# Check if we fetched the group already, and if not cache it for later
if group_dn not in group_cache:
groups = Group.objects.filter(attributes__distinguishedName=group_dn)
if not groups.exists():
LOGGER.warning("Group does not exist in our DB yet, run sync_groups first.",
group=group_dn)
return
group_cache[group_dn] = groups.first()
group = group_cache[group_dn]
users = User.objects.filter(attributes__ldap_uniq=uniq)
group.user_set.add(*list(users))
# Now that all users are added, lets write everything
for _, group in group_cache.items():
group.save()
LOGGER.debug("Successfully updated group membership")
def _build_object_properties(self, attributes: Dict[str, Any]) -> Dict[str, Dict[Any, Any]]:
properties = {
@ -92,8 +127,9 @@ class Connector:
}
for mapping in self._source.property_mappings.all().select_subclasses():
properties[mapping.object_field] = attributes.get(mapping.ldap_property, '')
if 'objectSid' in attributes:
properties['attributes']['objectSid'] = attributes.get('objectSid')
if self._source.object_uniqueness_field in attributes:
properties['attributes']['ldap_uniq'] = \
attributes.get(self._source.object_uniqueness_field)
properties['attributes']['distinguishedName'] = attributes.get('distinguishedName')
return properties

View File

@ -24,6 +24,8 @@ class LDAPSourceForm(forms.ModelForm):
'additional_group_dn',
'user_object_filter',
'group_object_filter',
'user_group_membership_field',
'object_uniqueness_field',
'sync_groups',
'sync_parent_group',
'property_mappings',
@ -32,12 +34,14 @@ class LDAPSourceForm(forms.ModelForm):
'name': forms.TextInput(),
'server_uri': forms.TextInput(),
'bind_cn': forms.TextInput(),
'bind_password': forms.PasswordInput(),
'bind_password': forms.TextInput(),
'base_dn': forms.TextInput(),
'additional_user_dn': forms.TextInput(),
'additional_group_dn': forms.TextInput(),
'user_object_filter': forms.TextInput(),
'group_object_filter': forms.TextInput(),
'user_group_membership_field': forms.TextInput(),
'object_uniqueness_field': forms.TextInput(),
'policies': FilteredSelectMultiple(_('policies'), False),
'property_mappings': FilteredSelectMultiple(_('Property Mappings'), False)
}

View File

@ -0,0 +1,33 @@
# Generated by Django 2.2.6 on 2019-10-11 10:59
from django.db import migrations, models
class Migration(migrations.Migration):
dependencies = [
('passbook_sources_ldap', '0004_auto_20191011_0839'),
]
operations = [
migrations.AddField(
model_name='ldapsource',
name='object_uniqueness_field',
field=models.TextField(default='objectSid', help_text='Field which contains a unique Identifier.'),
),
migrations.AddField(
model_name='ldapsource',
name='user_group_membership_field',
field=models.TextField(default='memberOf', help_text='Field which contains Groups of user.'),
),
migrations.AlterField(
model_name='ldapsource',
name='group_object_filter',
field=models.TextField(default='(objectCategory=Group)', help_text='Consider Objects matching this filter to be Groups.'),
),
migrations.AlterField(
model_name='ldapsource',
name='user_object_filter',
field=models.TextField(default='(objectCategory=Person)', help_text='Consider Objects matching this filter to be Users.'),
),
]

View File

@ -19,8 +19,14 @@ class LDAPSource(Source):
additional_user_dn = models.TextField(help_text=_('Prepended to Base DN for User-queries.'))
additional_group_dn = models.TextField(help_text=_('Prepended to Base DN for Group-queries.'))
user_object_filter = models.TextField()
group_object_filter = models.TextField()
user_object_filter = models.TextField(default="(objectCategory=Person)", help_text=_(
'Consider Objects matching this filter to be Users.'))
user_group_membership_field = models.TextField(default="memberOf", help_text=_(
"Field which contains Groups of user."))
group_object_filter = models.TextField(default="(objectCategory=Group)", help_text=_(
'Consider Objects matching this filter to be Groups.'))
object_uniqueness_field = models.TextField(default="objectSid", help_text=_(
'Field which contains a unique Identifier.'))
sync_groups = models.BooleanField(default=True)
sync_parent_group = models.ForeignKey(Group, blank=True, null=True,