20 from __future__ import division # XXX why?

    21 

    22 from datetime import datetime

    23 

    25 from ldap.ldapobject import ReconnectLDAPObject

    27 from ldapurl import LDAPUrl

    31 from cubicweb import ValidationError, AuthenticationError, Binary

    32 from cubicweb.server import utils

   182 

   183     _conn = None

   190         self.authmode = typedconfig['auth-mode']

   191         self._authenticate = getattr(self, '_auth_%s' % self.authmode)

   192         self.cnx_dn = typedconfig['data-cnx-dn']

   193         self.cnx_pwd = typedconfig['data-cnx-password']

   194         self.user_base_dn = str(typedconfig['user-base-dn'])

   195         self.user_base_scope = globals()[typedconfig['user-scope']]

   196         self.user_login_attr = typedconfig['user-login-attr']

   197         self.user_default_groups = typedconfig['user-default-group']

   198         self.user_attrs = {'dn': 'eid', 'modifyTimestamp': 'modification_date'}

   199         self.user_attrs.update(typedconfig['user-attrs-map'])

   200         self.user_rev_attrs = dict((v, k) for k, v in self.user_attrs.iteritems())

   201         self.base_filters = [filter_format('(%s=%s)', ('objectClass', o))

   202                              for o in typedconfig['user-classes']]

   203         if typedconfig['user-filter']:

   204             self.base_filters.append(typedconfig['user-filter'])

   215         self._conn = None

   216 

   217     def _entity_update(self, source_entity):

   218         super(LDAPFeedSource, self)._entity_update(source_entity)

   219         if self.urls:

   220             if len(self.urls) > 1:

   221                 raise ValidationError(source_entity.eid, {'url': _('can only have one url')})

   222             try:

   223                 protocol, hostport = self.urls[0].split('://')

   224             except ValueError:

   225                 raise ValidationError(source_entity.eid, {'url': _('badly formatted url')})

   226             if protocol not in PROTO_PORT:

   227                 raise ValidationError(source_entity.eid, {'url': _('unsupported protocol')})

   228 

   229     def connection_info(self):

   230         assert len(self.urls) == 1, self.urls

   231         protocol, hostport = self.urls[0].split('://')

   232         if protocol != 'ldapi' and not ':' in hostport:

   233             hostport = '%s:%s' % (hostport, PROTO_PORT[protocol])

   234         return protocol, hostport

   235 

   236     def get_connection(self):

   237         """open and return a connection to the source"""

   238         if self._conn is None:

   239             try:

   240                 self._connect()

   241             except Exception:

   242                 self.exception('unable to connect to ldap')

   243         return ConnectionWrapper(self._conn)

   244 

   245     def authenticate(self, session, login, password=None, **kwargs):

   246         """return CWUser eid for the given login/password if this account is

   247         defined in this source, else raise `AuthenticationError`

   248 

   249         two queries are needed since passwords are stored crypted, so we have

   250         to fetch the salt first

   251         """

   252         self.info('ldap authenticate %s', login)

   253         if not password:

   254             # On Windows + ADAM this would have succeeded (!!!)

   255             # You get Authenticated as: 'NT AUTHORITY\ANONYMOUS LOGON'.

   256             # we really really don't want that

   257             raise AuthenticationError()

   258         searchfilter = [filter_format('(%s=%s)', (self.user_login_attr, login))]

   259         searchfilter.extend(self.base_filters)

   260         searchstr = '(&%s)' % ''.join(searchfilter)

   261         # first search the user

   262         try:

   263             user = self._search(session, self.user_base_dn,

   264                                 self.user_base_scope, searchstr)[0]

   265         except (IndexError, ldap.SERVER_DOWN):

   266             # no such user

   267             raise AuthenticationError()

   268         # check password by establishing a (unused) connection

   269         try:

   270             self._connect(user, password)

   271         except ldap.LDAPError as ex:

   272             # Something went wrong, most likely bad credentials

   273             self.info('while trying to authenticate %s: %s', user, ex)

   274             raise AuthenticationError()

   275         except Exception:

   276             self.error('while trying to authenticate %s', user, exc_info=True)

   277             raise AuthenticationError()

   278         eid = self.repo.extid2eid(self, user['dn'], 'CWUser', session, {})

   279         if eid < 0:

   280             # user has been moved away from this source

   281             raise AuthenticationError()

   282         return eid

   283 

   284     def _connect(self, user=None, userpwd=None):

   285         protocol, hostport = self.connection_info()

   286         self.info('connecting %s://%s as %s', protocol, hostport,

   287                   user and user['dn'] or 'anonymous')

   288         # don't require server certificate when using ldaps (will

   289         # enable self signed certs)

   290         ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)

   291         url = LDAPUrl(urlscheme=protocol, hostport=hostport)

   292         conn = ReconnectLDAPObject(url.initializeUrl())

   293         # Set the protocol version - version 3 is preferred

   294         try:

   295             conn.set_option(ldap.OPT_PROTOCOL_VERSION, ldap.VERSION3)

   296         except ldap.LDAPError: # Invalid protocol version, fall back safely

   297             conn.set_option(ldap.OPT_PROTOCOL_VERSION, ldap.VERSION2)

   298         # Deny auto-chasing of referrals to be safe, we handle them instead

   299         # Required for AD

   300         try:

   301            conn.set_option(ldap.OPT_REFERRALS, 0)

   302         except ldap.LDAPError: # Cannot set referrals, so do nothing

   303            pass

   304         #conn.set_option(ldap.OPT_NETWORK_TIMEOUT, conn_timeout)

   305         #conn.timeout = op_timeout

   306         # Now bind with the credentials given. Let exceptions propagate out.

   307         if user is None:

   308             # no user specified, we want to initialize the 'data' connection,

   309             assert self._conn is None

   310             self._conn = conn

   311             # XXX always use simple bind for data connection

   312             if not self.cnx_dn:

   313                 conn.simple_bind_s(self.cnx_dn, self.cnx_pwd)

   314             else:

   315                 self._authenticate(conn, {'dn': self.cnx_dn}, self.cnx_pwd)

   316         else:

   317             # user specified, we want to check user/password, no need to return

   318             # the connection which will be thrown out

   319             self._authenticate(conn, user, userpwd)

   320         return conn

   321 

   322     def _auth_simple(self, conn, user, userpwd):

   323         conn.simple_bind_s(user['dn'], userpwd)

   324 

   325     def _auth_cram_md5(self, conn, user, userpwd):

   326         from ldap import sasl

   327         auth_token = sasl.cram_md5(user['dn'], userpwd)

   328         conn.sasl_interactive_bind_s('', auth_token)

   329 

   330     def _auth_digest_md5(self, conn, user, userpwd):

   331         from ldap import sasl

   332         auth_token = sasl.digest_md5(user['dn'], userpwd)

   333         conn.sasl_interactive_bind_s('', auth_token)

   334 

   335     def _auth_gssapi(self, conn, user, userpwd):

   336         # print XXX not proper sasl/gssapi

   337         import kerberos

   338         if not kerberos.checkPassword(user[self.user_login_attr], userpwd):

   339             raise Exception('BAD login / mdp')

   340         #from ldap import sasl

   341         #conn.sasl_interactive_bind_s('', sasl.gssapi())

   342 

   343     def _search(self, session, base, scope,

   344                 searchstr='(objectClass=*)', attrs=()):

   345         """make an ldap query"""

   346         self.debug('ldap search %s %s %s %s %s', self.uri, base, scope,

   347                    searchstr, list(attrs))

   348         # XXX for now, we do not have connections set support for LDAP, so

   349         # this is always self._conn

   350         cnx = self.get_connection().cnx #session.cnxset.connection(self.uri).cnx

   351         if cnx is None:

   352             # cant connect to server

   353             msg = session._("can't connect to source %s, some data may be missing")

   354             session.set_shared_data('sources_error', msg % self.uri, txdata=True)

   355             return []

   356         try:

   357             res = cnx.search_s(base, scope, searchstr, attrs)

   358         except ldap.PARTIAL_RESULTS:

   359             res = cnx.result(all=0)[1]

   360         except ldap.NO_SUCH_OBJECT:

   361             self.info('ldap NO SUCH OBJECT %s %s %s', base, scope, searchstr)

   362             self._process_no_such_object(session, base)

   363             return []

   364         # except ldap.REFERRAL as e:

   365         #     cnx = self.handle_referral(e)

   366         #     try:

   367         #         res = cnx.search_s(base, scope, searchstr, attrs)

   368         #     except ldap.PARTIAL_RESULTS:

   369         #         res_type, res = cnx.result(all=0)

   370         result = []

   371         for rec_dn, rec_dict in res:

   372             # When used against Active Directory, "rec_dict" may not be

   373             # be a dictionary in some cases (instead, it can be a list)

   374             #

   375             # An example of a useless "res" entry that can be ignored

   376             # from AD is

   377             # (None, ['ldap://ForestDnsZones.PORTAL.LOCAL/DC=ForestDnsZones,DC=PORTAL,DC=LOCAL'])

   378             # This appears to be some sort of internal referral, but

   379             # we can't handle it, so we need to skip over it.

   380             try:

   381                 items = rec_dict.iteritems()

   382             except AttributeError:

   383                 continue

   384             else:

   385                 itemdict = self._process_ldap_item(rec_dn, items)

   386                 result.append(itemdict)

   387         self.debug('ldap built results %s', len(result))

   388         return result

   413 

   414     def _process_no_such_object(self, session, dn):

   415         """Some search return NO_SUCH_OBJECT error, handle this (usually because

   416         an object whose dn is no more existent in ldap as been encountered).

   417 

   418         Do nothing by default, let sub-classes handle that.

   419         """