mirror of https://github.com/watcha-fr/synapse
Merge pull request #1628 from matrix-org/erikj/ldap_split_out
Use external ldap auth pacakgepull/4/merge
Erik Johnston
8 years ago
committed by
GitHub
commit
dc6cede78e
@ -1,369 +0,0 @@ |
|||||||
|
|
||||||
from twisted.internet import defer |
|
||||||
|
|
||||||
from synapse.config._base import ConfigError |
|
||||||
from synapse.types import UserID |
|
||||||
|
|
||||||
import ldap3 |
|
||||||
import ldap3.core.exceptions |
|
||||||
|
|
||||||
import logging |
|
||||||
|
|
||||||
try: |
|
||||||
import ldap3 |
|
||||||
import ldap3.core.exceptions |
|
||||||
except ImportError: |
|
||||||
ldap3 = None |
|
||||||
pass |
|
||||||
|
|
||||||
|
|
||||||
logger = logging.getLogger(__name__) |
|
||||||
|
|
||||||
|
|
||||||
class LDAPMode(object): |
|
||||||
SIMPLE = "simple", |
|
||||||
SEARCH = "search", |
|
||||||
|
|
||||||
LIST = (SIMPLE, SEARCH) |
|
||||||
|
|
||||||
|
|
||||||
class LdapAuthProvider(object): |
|
||||||
__version__ = "0.1" |
|
||||||
|
|
||||||
def __init__(self, config, account_handler): |
|
||||||
self.account_handler = account_handler |
|
||||||
|
|
||||||
if not ldap3: |
|
||||||
raise RuntimeError( |
|
||||||
'Missing ldap3 library. This is required for LDAP Authentication.' |
|
||||||
) |
|
||||||
|
|
||||||
self.ldap_mode = config.mode |
|
||||||
self.ldap_uri = config.uri |
|
||||||
self.ldap_start_tls = config.start_tls |
|
||||||
self.ldap_base = config.base |
|
||||||
self.ldap_attributes = config.attributes |
|
||||||
if self.ldap_mode == LDAPMode.SEARCH: |
|
||||||
self.ldap_bind_dn = config.bind_dn |
|
||||||
self.ldap_bind_password = config.bind_password |
|
||||||
self.ldap_filter = config.filter |
|
||||||
|
|
||||||
@defer.inlineCallbacks |
|
||||||
def check_password(self, user_id, password): |
|
||||||
""" Attempt to authenticate a user against an LDAP Server |
|
||||||
and register an account if none exists. |
|
||||||
|
|
||||||
Returns: |
|
||||||
True if authentication against LDAP was successful |
|
||||||
""" |
|
||||||
localpart = UserID.from_string(user_id).localpart |
|
||||||
|
|
||||||
try: |
|
||||||
server = ldap3.Server(self.ldap_uri) |
|
||||||
logger.debug( |
|
||||||
"Attempting LDAP connection with %s", |
|
||||||
self.ldap_uri |
|
||||||
) |
|
||||||
|
|
||||||
if self.ldap_mode == LDAPMode.SIMPLE: |
|
||||||
result, conn = self._ldap_simple_bind( |
|
||||||
server=server, localpart=localpart, password=password |
|
||||||
) |
|
||||||
logger.debug( |
|
||||||
'LDAP authentication method simple bind returned: %s (conn: %s)', |
|
||||||
result, |
|
||||||
conn |
|
||||||
) |
|
||||||
if not result: |
|
||||||
defer.returnValue(False) |
|
||||||
elif self.ldap_mode == LDAPMode.SEARCH: |
|
||||||
result, conn = self._ldap_authenticated_search( |
|
||||||
server=server, localpart=localpart, password=password |
|
||||||
) |
|
||||||
logger.debug( |
|
||||||
'LDAP auth method authenticated search returned: %s (conn: %s)', |
|
||||||
result, |
|
||||||
conn |
|
||||||
) |
|
||||||
if not result: |
|
||||||
defer.returnValue(False) |
|
||||||
else: |
|
||||||
raise RuntimeError( |
|
||||||
'Invalid LDAP mode specified: {mode}'.format( |
|
||||||
mode=self.ldap_mode |
|
||||||
) |
|
||||||
) |
|
||||||
|
|
||||||
try: |
|
||||||
logger.info( |
|
||||||
"User authenticated against LDAP server: %s", |
|
||||||
conn |
|
||||||
) |
|
||||||
except NameError: |
|
||||||
logger.warn( |
|
||||||
"Authentication method yielded no LDAP connection, aborting!" |
|
||||||
) |
|
||||||
defer.returnValue(False) |
|
||||||
|
|
||||||
# check if user with user_id exists |
|
||||||
if (yield self.account_handler.check_user_exists(user_id)): |
|
||||||
# exists, authentication complete |
|
||||||
conn.unbind() |
|
||||||
defer.returnValue(True) |
|
||||||
|
|
||||||
else: |
|
||||||
# does not exist, fetch metadata for account creation from |
|
||||||
# existing ldap connection |
|
||||||
query = "({prop}={value})".format( |
|
||||||
prop=self.ldap_attributes['uid'], |
|
||||||
value=localpart |
|
||||||
) |
|
||||||
|
|
||||||
if self.ldap_mode == LDAPMode.SEARCH and self.ldap_filter: |
|
||||||
query = "(&{filter}{user_filter})".format( |
|
||||||
filter=query, |
|
||||||
user_filter=self.ldap_filter |
|
||||||
) |
|
||||||
logger.debug( |
|
||||||
"ldap registration filter: %s", |
|
||||||
query |
|
||||||
) |
|
||||||
|
|
||||||
conn.search( |
|
||||||
search_base=self.ldap_base, |
|
||||||
search_filter=query, |
|
||||||
attributes=[ |
|
||||||
self.ldap_attributes['name'], |
|
||||||
self.ldap_attributes['mail'] |
|
||||||
] |
|
||||||
) |
|
||||||
|
|
||||||
if len(conn.response) == 1: |
|
||||||
attrs = conn.response[0]['attributes'] |
|
||||||
mail = attrs[self.ldap_attributes['mail']][0] |
|
||||||
name = attrs[self.ldap_attributes['name']][0] |
|
||||||
|
|
||||||
# create account |
|
||||||
user_id, access_token = ( |
|
||||||
yield self.account_handler.register(localpart=localpart) |
|
||||||
) |
|
||||||
|
|
||||||
# TODO: bind email, set displayname with data from ldap directory |
|
||||||
|
|
||||||
logger.info( |
|
||||||
"Registration based on LDAP data was successful: %d: %s (%s, %)", |
|
||||||
user_id, |
|
||||||
localpart, |
|
||||||
name, |
|
||||||
mail |
|
||||||
) |
|
||||||
|
|
||||||
defer.returnValue(True) |
|
||||||
else: |
|
||||||
if len(conn.response) == 0: |
|
||||||
logger.warn("LDAP registration failed, no result.") |
|
||||||
else: |
|
||||||
logger.warn( |
|
||||||
"LDAP registration failed, too many results (%s)", |
|
||||||
len(conn.response) |
|
||||||
) |
|
||||||
|
|
||||||
defer.returnValue(False) |
|
||||||
|
|
||||||
defer.returnValue(False) |
|
||||||
|
|
||||||
except ldap3.core.exceptions.LDAPException as e: |
|
||||||
logger.warn("Error during ldap authentication: %s", e) |
|
||||||
defer.returnValue(False) |
|
||||||
|
|
||||||
@staticmethod |
|
||||||
def parse_config(config): |
|
||||||
class _LdapConfig(object): |
|
||||||
pass |
|
||||||
|
|
||||||
ldap_config = _LdapConfig() |
|
||||||
|
|
||||||
ldap_config.enabled = config.get("enabled", False) |
|
||||||
|
|
||||||
ldap_config.mode = LDAPMode.SIMPLE |
|
||||||
|
|
||||||
# verify config sanity |
|
||||||
_require_keys(config, [ |
|
||||||
"uri", |
|
||||||
"base", |
|
||||||
"attributes", |
|
||||||
]) |
|
||||||
|
|
||||||
ldap_config.uri = config["uri"] |
|
||||||
ldap_config.start_tls = config.get("start_tls", False) |
|
||||||
ldap_config.base = config["base"] |
|
||||||
ldap_config.attributes = config["attributes"] |
|
||||||
|
|
||||||
if "bind_dn" in config: |
|
||||||
ldap_config.mode = LDAPMode.SEARCH |
|
||||||
_require_keys(config, [ |
|
||||||
"bind_dn", |
|
||||||
"bind_password", |
|
||||||
]) |
|
||||||
|
|
||||||
ldap_config.bind_dn = config["bind_dn"] |
|
||||||
ldap_config.bind_password = config["bind_password"] |
|
||||||
ldap_config.filter = config.get("filter", None) |
|
||||||
|
|
||||||
# verify attribute lookup |
|
||||||
_require_keys(config['attributes'], [ |
|
||||||
"uid", |
|
||||||
"name", |
|
||||||
"mail", |
|
||||||
]) |
|
||||||
|
|
||||||
return ldap_config |
|
||||||
|
|
||||||
def _ldap_simple_bind(self, server, localpart, password): |
|
||||||
""" Attempt a simple bind with the credentials |
|
||||||
given by the user against the LDAP server. |
|
||||||
|
|
||||||
Returns True, LDAP3Connection |
|
||||||
if the bind was successful |
|
||||||
Returns False, None |
|
||||||
if an error occured |
|
||||||
""" |
|
||||||
|
|
||||||
try: |
|
||||||
# bind with the the local users ldap credentials |
|
||||||
bind_dn = "{prop}={value},{base}".format( |
|
||||||
prop=self.ldap_attributes['uid'], |
|
||||||
value=localpart, |
|
||||||
base=self.ldap_base |
|
||||||
) |
|
||||||
conn = ldap3.Connection(server, bind_dn, password, |
|
||||||
authentication=ldap3.AUTH_SIMPLE) |
|
||||||
logger.debug( |
|
||||||
"Established LDAP connection in simple bind mode: %s", |
|
||||||
conn |
|
||||||
) |
|
||||||
|
|
||||||
if self.ldap_start_tls: |
|
||||||
conn.start_tls() |
|
||||||
logger.debug( |
|
||||||
"Upgraded LDAP connection in simple bind mode through StartTLS: %s", |
|
||||||
conn |
|
||||||
) |
|
||||||
|
|
||||||
if conn.bind(): |
|
||||||
# GOOD: bind okay |
|
||||||
logger.debug("LDAP Bind successful in simple bind mode.") |
|
||||||
return True, conn |
|
||||||
|
|
||||||
# BAD: bind failed |
|
||||||
logger.info( |
|
||||||
"Binding against LDAP failed for '%s' failed: %s", |
|
||||||
localpart, conn.result['description'] |
|
||||||
) |
|
||||||
conn.unbind() |
|
||||||
return False, None |
|
||||||
|
|
||||||
except ldap3.core.exceptions.LDAPException as e: |
|
||||||
logger.warn("Error during LDAP authentication: %s", e) |
|
||||||
return False, None |
|
||||||
|
|
||||||
def _ldap_authenticated_search(self, server, localpart, password): |
|
||||||
""" Attempt to login with the preconfigured bind_dn |
|
||||||
and then continue searching and filtering within |
|
||||||
the base_dn |
|
||||||
|
|
||||||
Returns (True, LDAP3Connection) |
|
||||||
if a single matching DN within the base was found |
|
||||||
that matched the filter expression, and with which |
|
||||||
a successful bind was achieved |
|
||||||
|
|
||||||
The LDAP3Connection returned is the instance that was used to |
|
||||||
verify the password not the one using the configured bind_dn. |
|
||||||
Returns (False, None) |
|
||||||
if an error occured |
|
||||||
""" |
|
||||||
|
|
||||||
try: |
|
||||||
conn = ldap3.Connection( |
|
||||||
server, |
|
||||||
self.ldap_bind_dn, |
|
||||||
self.ldap_bind_password |
|
||||||
) |
|
||||||
logger.debug( |
|
||||||
"Established LDAP connection in search mode: %s", |
|
||||||
conn |
|
||||||
) |
|
||||||
|
|
||||||
if self.ldap_start_tls: |
|
||||||
conn.start_tls() |
|
||||||
logger.debug( |
|
||||||
"Upgraded LDAP connection in search mode through StartTLS: %s", |
|
||||||
conn |
|
||||||
) |
|
||||||
|
|
||||||
if not conn.bind(): |
|
||||||
logger.warn( |
|
||||||
"Binding against LDAP with `bind_dn` failed: %s", |
|
||||||
conn.result['description'] |
|
||||||
) |
|
||||||
conn.unbind() |
|
||||||
return False, None |
|
||||||
|
|
||||||
# construct search_filter like (uid=localpart) |
|
||||||
query = "({prop}={value})".format( |
|
||||||
prop=self.ldap_attributes['uid'], |
|
||||||
value=localpart |
|
||||||
) |
|
||||||
if self.ldap_filter: |
|
||||||
# combine with the AND expression |
|
||||||
query = "(&{query}{filter})".format( |
|
||||||
query=query, |
|
||||||
filter=self.ldap_filter |
|
||||||
) |
|
||||||
logger.debug( |
|
||||||
"LDAP search filter: %s", |
|
||||||
query |
|
||||||
) |
|
||||||
conn.search( |
|
||||||
search_base=self.ldap_base, |
|
||||||
search_filter=query |
|
||||||
) |
|
||||||
|
|
||||||
if len(conn.response) == 1: |
|
||||||
# GOOD: found exactly one result |
|
||||||
user_dn = conn.response[0]['dn'] |
|
||||||
logger.debug('LDAP search found dn: %s', user_dn) |
|
||||||
|
|
||||||
# unbind and simple bind with user_dn to verify the password |
|
||||||
# Note: do not use rebind(), for some reason it did not verify |
|
||||||
# the password for me! |
|
||||||
conn.unbind() |
|
||||||
return self._ldap_simple_bind(server, localpart, password) |
|
||||||
else: |
|
||||||
# BAD: found 0 or > 1 results, abort! |
|
||||||
if len(conn.response) == 0: |
|
||||||
logger.info( |
|
||||||
"LDAP search returned no results for '%s'", |
|
||||||
localpart |
|
||||||
) |
|
||||||
else: |
|
||||||
logger.info( |
|
||||||
"LDAP search returned too many (%s) results for '%s'", |
|
||||||
len(conn.response), localpart |
|
||||||
) |
|
||||||
conn.unbind() |
|
||||||
return False, None |
|
||||||
|
|
||||||
except ldap3.core.exceptions.LDAPException as e: |
|
||||||
logger.warn("Error during LDAP authentication: %s", e) |
|
||||||
return False, None |
|
||||||
|
|
||||||
|
|
||||||
def _require_keys(config, required): |
|
||||||
missing = [key for key in required if key not in config] |
|
||||||
if missing: |
|
||||||
raise ConfigError( |
|
||||||
"LDAP enabled but missing required config values: {}".format( |
|
||||||
", ".join(missing) |
|
||||||
) |
|
||||||
) |
|
||||||
Loading…
Reference in new issue