rc/friwall
2
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

Improve LDAP lookup of user groups

Browse source
This commit is contained in:
Timotej Lazar 2023-09-07 14:59:57 +02:00
parent 9dc0fbb4fe
commit 719bcf7c55
2 changed files with 10 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
web/__init__.py
View file

@ -16,6 +16,7 @@ def create_app(test_config=None):
'ldap_user': '', 'ldap_user': '',
'ldap_pass': '', 'ldap_pass': '',
'ldap_base_dn': '', 'ldap_base_dn': '',
'user_group': '',
'oidc_tenant': '', 'oidc_tenant': '',
'oidc_client_id': '', 'oidc_client_id': '',
'oidc_client_secret': '', 'oidc_client_secret': '',

15
web/system.py
View file

@ -58,12 +58,15 @@ def save_config():
user_networks = collections.defaultdict(set) user_networks = collections.defaultdict(set)
ldap = ldap3.Connection(ldap3.Server(settings.get('ldap_host'), use_ssl=True), ldap = ldap3.Connection(ldap3.Server(settings.get('ldap_host'), use_ssl=True),
settings.get('ldap_user'), settings.get('ldap_pass'), auto_bind=True) settings.get('ldap_user'), settings.get('ldap_pass'), auto_bind=True)
for group, network in groups.items(): ldap.search(settings.get('ldap_base_dn', ''),
ldap.search(settings.get('ldap_base_dn', ''), '(&(objectClass=user)(objectCategory=person)' + # only people
f'(distinguishedName={group})', attributes='member') '(!(userAccountControl:1.2.840.113556.1.4.803:=2))' + # with enabled accounts
if ldap.entries: f'(memberOf:1.2.840.113556.1.4.1941:={settings.get("user_group", "")}))', # in given group, recursively
for user in ldap.entries[0]['member']: attributes=['userPrincipalName', 'memberOf'])
user_networks[user].add(network) for entry in ldap.entries:
for group in entry.memberOf:
if group in groups:
user_networks[entry.userPrincipalName.value].add(groups[group])
# Now read the settings again and lock the database while generating # Now read the settings again and lock the database while generating
# config files, then increment version before unlocking. # config files, then increment version before unlocking.