洛卡特利,chiluogaoyang,春晚吧
ldap(light directory access portocol)是轻量目录访问协议,基于x.500标准,支持tcp/ip。
ldap目录以树状的层次结构来存储数据。每个目录记录都有标识名(distinguished name,简称dn),用来读取单个记录,一般是这样的:
cn=username,ou=people,dc=test,dc=com
几个关键字的含义如下:
所以上面的dn代表一条记录,代表一位在test.com公司people部门的用户username。
python一般使用python-ldap库操作ldap,文档:。
下载:
pip install python-ldap
还要安装一些环境,ubuntu:
apt-get install build-essential python3-dev python2.7-dev \
libldap2-dev libsasl2-dev slapd ldap-utils python-tox \
lcov valgrind
centos:
yum groupinstall "development tools"
yum install openldap-devel python-devel
获取ldap地址后即可与ldap建立连接:
import ldap
ldapconn = ldap.initialize('ldap://192.168.1.111:389')
绑定用户,可用于用户验证,用户名必须是dn:
ldapconn.simple_bind_s('cn=username,ou=people,dc=test,dc=com', pwd)
成功认证时会返回一个tuple:
(97, [], 1, [])
验证失败会报异常ldap.invalid_credentials:
{'desc': u'invalid credentials'}
注意验证时传空值验证也是可以通过的,注意要对dn和pwd进行检查。
查询ldap用户信息时,需要登录管理员rootdn帐号:
ldapconn.simple_bind_s('cn=admin,dc=test,dc=com', 'adminpwd')
searchscope = ldap.scope_subtree
searchfilter = 'cn=username'
base_dn = 'ou=people,dc=test,dc=com'
print ldapconn.search_s(base_dn, searchscope, searchfilter, none)
添加用户add_s(dn, modlist),dn为要添加的条目dn,modlist为存储信息:
dn = 'cn=test,ou=people,dc=test,dc=com'
modlist = [
('objectclass', ['person', 'organizationalperson'],
('cn', ['test']),
('uid', [''testuid]),
('userpassword', ['pwd']),
]
result = ldapconn.add_s(dn, modlist)
添加成功会返回元组:
(105, [], 2, [])
失败会报ldap.ldaperror异常
一个很简单的ldap验证backend:
import ldap
class ldapbackend(object):
"""
authenticates with ldap.
"""
_connection = none
_connection_bound = false
def authenticate(self, username=none, passwd=none, **kwargs):
if not username or not passwd:
return none
if self._authenticate_user_dn(username, passwd):
user = self._get_or_create_user(username, passwd)
return user
else:
return none
@property
def connection(self):
if not self._connection_bound:
self._bind()
return self._get_connection()
def _bind(self):
self._bind_as(
ldap_config['username'], ldap_config['password'], true
)
def _bind_as(self, bind_dn, bind_password, sticky=false):
self._get_connection().simple_bind_s(
bind_dn, bind_password
)
self._connection_bound = sticky
def _get_connection(self):
if not self._connection:
self._connection = ldap.initialize(ldap_config['host'])
return self._connection
def _authenticate_user_dn(self, username, passwd):
bind_dn = 'cn=%s,%s' % (username, ldap_config['base_dn'])
try:
self._bind_as(bind_dn, passwd, false)
return true
except ldap.invalid_credentials:
return false
def _get_or_create_user(self, username, passwd):
# 获取或者新建user
return user
不想自己写的话,django与flask都有现成的库:
如对本文有疑问,请在下面进行留言讨论,广大热心网友会与你互动!! 点击进行留言回复
Python 实现将numpy中的nan和inf,nan替换成对应的均值
python爬虫把url链接编码成gbk2312格式过程解析
网友评论