浏览代码

HUE-978 [useradmin] Add LDAP user/group with DN

Should use DN as base DN when searching for users/groups to import by DN.
Must ensure DN includes base DN, other wise sync will not work.
abec 13 年之前
父节点
当前提交
dbb61b5259
共有 1 个文件被更改,包括 26 次插入11 次删除
  1. 26 11
      apps/useradmin/src/useradmin/ldap_access.py

+ 26 - 11
apps/useradmin/src/useradmin/ldap_access.py

@@ -18,6 +18,8 @@
 This module provides access to LDAP servers, along with some basic functionality required for Hue and
 This module provides access to LDAP servers, along with some basic functionality required for Hue and
 User Admin to work seamlessly with LDAP.
 User Admin to work seamlessly with LDAP.
 """
 """
+import re
+
 import desktop.conf
 import desktop.conf
 import ldap
 import ldap
 import ldap.filter
 import ldap.filter
@@ -81,12 +83,31 @@ class LdapConnection(object):
       except:
       except:
         raise RuntimeError("Failed to bind to LDAP server anonymously")
         raise RuntimeError("Failed to bind to LDAP server anonymously")
 
 
+  def _get_search_params(self, name, attr, find_by_dn=False):
+    """
+      if we are to find this ldap object by full distinguished name,
+      then search by setting search_dn to the 'name'
+      rather than by filtering by 'attr'.
+    """
+    base_dn = self._get_root_dn()
+    if find_by_dn:
+      search_dn = re.sub(r'(\w+=)', lambda match: match.group(0).upper(), name)
+
+      if not search_dn.endswith(base_dn):
+        raise RuntimeError("Distinguished Name provided does not contain configured Base DN. Base DN: %(base_dn)s, DN: %(dn)s" % {
+          'base_dn': base_dn,
+          'dn': search_dn
+        })
+
+      return (search_dn, '')
+    else:
+      return (base_dn, '(' + attr + '=' + name + ')')
+
   def find_users(self, username_pattern, find_by_dn=False):
   def find_users(self, username_pattern, find_by_dn=False):
     """
     """
     LDAP search helper method finding users. This supports searching for users
     LDAP search helper method finding users. This supports searching for users
     by distinguished name, or the configured username attribute.
     by distinguished name, or the configured username attribute.
     """
     """
-    base_dn = self._get_root_dn()
     scope = ldap.SCOPE_SUBTREE
     scope = ldap.SCOPE_SUBTREE
 
 
     user_filter = desktop.conf.LDAP.USERS.USER_FILTER.get()
     user_filter = desktop.conf.LDAP.USERS.USER_FILTER.get()
@@ -96,13 +117,10 @@ class LdapConnection(object):
 
 
     # Allow wild cards on non distinguished names
     # Allow wild cards on non distinguished names
     sanitized_name = ldap.filter.escape_filter_chars(username_pattern).replace(r'\2a', r'*')
     sanitized_name = ldap.filter.escape_filter_chars(username_pattern).replace(r'\2a', r'*')
-    if find_by_dn:
-      user_name_filter = '(distinguishedName=' + sanitized_name + ')'
-    else:
-      user_name_filter = '(' + user_name_attr + '=' + sanitized_name + ')'
+    search_dn, user_name_filter = self._get_search_params(sanitized_name, user_name_attr, find_by_dn)
     ldap_filter = '(&' + user_filter + user_name_filter + ')'
     ldap_filter = '(&' + user_filter + user_name_filter + ')'
 
 
-    ldap_result_id = self.ldap_handle.search(base_dn, scope, ldap_filter)
+    ldap_result_id = self.ldap_handle.search(search_dn, scope, ldap_filter)
     result_type, result_data = self.ldap_handle.result(ldap_result_id)
     result_type, result_data = self.ldap_handle.result(ldap_result_id)
     user_info = []
     user_info = []
     if result_data and result_type == ldap.RES_SEARCH_RESULT:
     if result_data and result_type == ldap.RES_SEARCH_RESULT:
@@ -135,13 +153,10 @@ class LdapConnection(object):
 
 
     # Allow wild cards on non distinguished names
     # Allow wild cards on non distinguished names
     sanitized_name = ldap.filter.escape_filter_chars(groupname_pattern).replace(r'\2a', r'*')
     sanitized_name = ldap.filter.escape_filter_chars(groupname_pattern).replace(r'\2a', r'*')
-    if find_by_dn:
-      group_name_filter = '(distinguishedName=' + sanitized_name + ')'
-    else:
-      group_name_filter = '(' + group_name_attr + '=' + sanitized_name + ')'
+    search_dn, group_name_filter = self._get_search_params(sanitized_name, group_name_attr, find_by_dn)
     ldap_filter = '(&' + group_filter + group_name_filter + ')'
     ldap_filter = '(&' + group_filter + group_name_filter + ')'
 
 
-    ldap_result_id = self.ldap_handle.search(base_dn, scope, ldap_filter)
+    ldap_result_id = self.ldap_handle.search(search_dn, scope, ldap_filter)
     result_type, result_data = self.ldap_handle.result(ldap_result_id)
     result_type, result_data = self.ldap_handle.result(ldap_result_id)
 
 
     group_info = []
     group_info = []