File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/__pycache__/ldap.cpython-310.pyc
o
�N�g}Y � @ sH d Z ddlZddlZddlmZ ddlZddlZddlm Z m
Z
e� e �Z
zddlZddlZddlZdZW n ey@ dZY nw i dd�d d�d
d �d d
�dd�dd�dd�dd�dd�dd�dd�dd�dd�d d �d d�d d�d g �Zd3d!d"�Zd#d$� ZG d%d&� d&�Zd4d'd(�Zd4d)d*�Zd+d,� Zd-d.� Zd5d/d0�Zd5d1d2�Z dS )6zR
Provide authentication using simple LDAP binds
:depends: - ldap Python module
� N)� Environment)�CommandExecutionError�SaltInvocationErrorTFzauth.ldap.basedn� z
auth.ldap.urizauth.ldap.serverZ localhostzauth.ldap.portZ389zauth.ldap.starttlsz
auth.ldap.tlszauth.ldap.no_verifyzauth.ldap.anonymouszauth.ldap.scope� zauth.ldap.groupouZGroupsz auth.ldap.accountattributenameZ memberUidzauth.ldap.groupattributeZmemberOfzauth.ldap.persontypeZpersonzauth.ldap.groupclassZ
posixGroupzauth.ldap.activedirectoryzauth.ldap.freeipa� auth.ldap.minion_stripdomainsc C s� z|r
|d| � � }W |S t d| � � }W |S ty@ z td| � � }W Y |S ty? |r;d| � d�}t|��Y Y dS w w )zP
Return a value for 'name' from master config file options or defaults.
z
auth.ldap.zmissing auth.ldap.z in master configF)Z__opts__�KeyError� __defopts__r )�key� mandatory�opts�value�msg� r �B/opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/ldap.py�_config3 s" � � � ��r c C s" t � }|�| �}d|i}|�|�S )zD
Render config template, substituting username where found.
�username)r Z from_stringZrender)�paramr �env�templateZ variablesr r r �_render_templateG s
r c @ s e Zd ZdZ ddd�ZdS )�_LDAPConnectionz#
Setup an LDAP connection.
Fc
C s& || _ || _|| _|| _|| _|| _|| _tstd��| jr%| jr%td��|r)dnd} | j dkr=| � d| j� d| j� �| _ z>|rHt �
t j t j � t �
| j � �| _ d| j _| j �
t jd � | sy| jsetd
��| jrm| j �� | j �| j| j� W d S W d S ty� }
z td �| j | j|
���d }
~
ww )
zE
Bind to an LDAP directory using passed credentials.
zzLDAP connection could not be made, the python-ldap module is not installed. Install python-ldap to use LDAP external auth.zVCannot bind with both starttls and tls enabled.Please enable only one of the protocolsZldaps�ldapr z://�:� r zWLDAP bind password is not set: password cannot be empty if auth.ldap.anonymous is Falsez*Failed to bind to LDAP server {} as {}: {}N)�uri�server�port�starttls�tls�binddn�bindpw�HAS_LDAPr r Z
set_optionZOPT_X_TLS_REQUIRE_CERTZOPT_X_TLS_NEVERZ
initializeZprotocol_versionZ
OPT_REFERRALSZ start_tls_sZ
simple_bind_s� Exception�format)�selfr r r r r � no_verifyr r! � anonymous�accountattributename�activedirectoryZschemaZ
ldap_errorr r r �__init__V sR � �
�
�
����z_LDAPConnection.__init__N)F)�__name__�
__module__� __qualname__�__doc__r* r r r r r Q s �r c C s� i }g d�g d�d�}i }|d D ]
}t ||d�||< q|d D ] }t |d|d�||< q | |d < |d
rE|d
|d
< |d rE|d �d � |d D ]}|| ||< qI|d sf|d
rh|d rjtd
i |��jS d S d S d S )z�
Bind with binddn and bindpw only for searching LDAP
:param anonymous: Try binding anonymously
:param opts: Pass in when __opts__ is not available
:return: LDAPConnection object
� r r r r r r& r' r( r) �r r! �filter�
groupclass� auth_by_group_membership_only�r �
additionalr �r r5 F�r r r' r r! Nr )r �appendr r )r' r �connargs�params� paramvaluesr �namer r r �_bind_for_search� s* � �r= c C s� t d|d�}t d|d�}i }g d�g d�d�}i }|d D ]
} t | |d�|| < q |d D ] } t | d |d
�|| < q,||d < |d rSt|d | �|d < tj�|d �|d < |d
rftj�| �}
t|d
|
�|d
< |d r{|d |d < |d r{|d �d� |d D ]} || || < q|d �s|d r�|d r�td!i |��j} t�d|d
||� | � |t
|�|d
�}
|
s�t� d| � d S t |
�dkr�dd� |
D �}t
dd� |D ��}|dkr�t�d| � d S |dkr�t�d| � d S |
d d |d < |d �r|d �s|d |d < n|d �r|d �s|d |d < ||d< |d �r"t�d� nt�d|d � z
td!i |��j}W n t�yR |�dd� t�d |� tjd d d � Y d S w t�d |d � |S )"z'
Authenticate via an LDAP bind
�basednr6 �scoper/ r0 r4 r r5 Fr7 r' r r1 r! z;Running LDAP user dn search with filter:%s, dn:%s, scope:%szUnable to find user %s� c S s g | ]}|d �qS )r r )�.0�tupr r r �
<listcomp>* s z_bind.<locals>.<listcomp>c s s � | ] }|d urdV qd S )Nr@ r )rA �cr r r � <genexpr>+ s � z_bind.<locals>.<genexpr>z.LDAP lookup found multiple results for user %sr z/LDAP lookup--unable to find CN matching user %sz Attempting anonymous LDAP bindz%Attempting LDAP bind with user dn: %sNz+Failed to authenticate user dn via LDAP: %sz&Error authenticating user dn via LDAP:T)�exc_infoz/Successfully authenticated user dn via LDAP: %sr )r r r r1 �escape_filter_charsr8 r �log�debug�search_s�int�warning�len�sum�errorr# �pop)r �passwordr' r r> r? r9 r: r; r �escaped_usernamer< Z_ldap�resultZcnsZtotal_not_noneZ ldap_connr r r �_bind� s� � �
� �� �
�rT c C s� t s t�d� dS d}tddd�r8tddd�r8ttddd�d�}|r7| r7|r7t| |td dd�o4tddd�d�}nt| |td dd�oFtddd�d�}|rRt�d
� |S t�d � dS ) z
Simple LDAP auth
z/LDAP authentication requires python-ldap moduleFNr �r r! r' �r' r3 z LDAP authentication successfulz LDAP _bind authentication FAILED)r" rH rO r r= rT rI )r rQ �bindZ search_bindr r r �authP s2
��
�
rX c K sx g }t ddd�rt ddd�rtt ddd�d�}nt| |�dd�t d dd�o*t ddd�d�}|�r5t�d
� t d �r�zd �t d
�| t d��}|�t d�tj |dg�}W n t
yl } zt� d|� |W Y d}~S d}~ww |swt� d| � |S tj �
|d d �}d�|t d��}t�d|� z|�t d�tj |tjj�t d
��dg�} W n t
y� } zt� d|� |W Y d}~S d}~ww | D ]\}
} d| v r�|�tjj�| d d �� q�t�d| |� |S t d��rktj �
| �} t d �}
tt d �| �}|�|
tj |tjj�t d
��tjj�t d ��dg�} | D ]>\} }t�|�t d
�g �|�t d �g ��D ]&}| tjj�|��d �d �d �d! k�rO|�| �d �d �d �d! � �q*�qt�d| |� t| |d ��sit� d"� g S |S t d#��r{d$�t d#�t d��}
nd%�t d��}
d �t d
�| t d��}|�|
tj |tjj�t d
��dtjj�t d ��g�} | D ]!\}
} | tjj�| t d
� �v �r�|�tjj�| d d �� �q�| D ]<\}} | tjj�|��d �d �d �d! k�rtjj�| t d � �D ]}|�tjj�|��d �d �d �d! � �q�q�t�d| |� d&|v �r3t| |�d�t d dd��o(t ddd�d��s3t� d"� g S |S t� d'� |S )(a�
Authenticate against an LDAP group
Behavior is highly dependent on if Active Directory is in use.
AD handles group membership very differently than OpenLDAP.
See the :ref:`External Authentication <acl-eauth>` documentation for a thorough
discussion of available parameters for customizing the search.
OpenLDAP allows you to search for all groups in the directory
and returns members of those groups. Then we check against
the username entered.
r FrU r! r' rV rQ r r3 z2ldap bind to determine group membership succeeded!r) z(&({}={})(objectClass={}))r( Z
persontyper> ZdistinguishedNamez3Exception thrown while looking up user DN in AD: %sNz,Could not get distinguished name for user %sr z (&(member={})(objectClass={}))r2 z(Running LDAP group membership search: %s�cnz<Exception thrown while retrieving group membership in AD: %sz!User %s is a member of groups: %sZfreeipaZ group_basednZ group_filterZgroupattribute�,�=���z'LDAP username and password do not matchZgroupouzou={},{}z{}Zshow_jidz/ldap bind to determine group membership FAILED!)r r= rT �getrH rI r$ rJ r �
SCOPE_SUBTREEr# rO r1 rG �salt�utilsZ stringutilsZto_strr8 Z
to_unicoder � itertools�chain�splitrX �data�decode)r �kwargsZ
group_listrW Zget_user_dn_searchZuser_dn_results�e�dnZldap_search_string�search_results�_�entryrR � search_base�
search_stringrS �user�groupr r r �groupsv s
�
�� �� � �� ��� �X
� �� � ��� ��
6
����
� � ���
� ����
�
�rp c C sN t |d�}g }| D ]�}t|t�s|�|� q |�� D ]�\}}|}g }|�d�r�|�d��d�} d}
zZ|�| t j
|
dg�} | D ]9} z.| d d d � � }
|� dd �rh|d D ]}|
�
|�rg|
d t|� � }
nqU|�|
� W q> tyw Y q>w |D ] }
|�|
|i� qzt�d
|� W q t jy� Y qw |�||i� qq t�d |� |S ) a�
:param entries: ldap subtree in external_auth config option
:param opts: Opts to use when __opts__ not defined
:return: Dictionary with all allowed operations
Takes the ldap subtree in the external_auth config option and expands it
with actual minion names
webadmins%: <all users in the AD 'webadmins' group>
- server1
- .*
- ldap(OU=webservers,dc=int,dc=bigcompany,dc=com)
- test.ping
- service.restart
- ldap(OU=Domain Controllers,dc=int,dc=bigcompany,dc=com)
- allowed_fn_list_attribute^
This function only gets called if auth.ldap.activedirectory = True
r6 �ldap(�)z(objectClass=computer)rY r@ r r NzExpanded acl_tree is: %sz__expand_ldap_entries: %s)r= �
isinstance�dictr8 �items�
startswith�lstrip�rstriprJ r r^ �lowerr] �endswithrM � TypeErrorrH ZtraceZNO_SUCH_OBJECT)�entriesr rW Zacl_treeZuser_or_group_dictZ minion_or_ouZmatchersZ permissionsZretrieved_minion_idsrl rm ri Z
ldap_matchZ minion_id�domainr r r �__expand_ldap_entries sN
�
� ��� &r~ c C sD g }| D ]}t |t�r q|�dd� |�� D �� q|r t| |�} | S )a+
Query LDAP, retrieve list of minion_ids from an OU or other search.
For each minion_id returned from the LDAP search, copy the perms
matchers into the auth dictionary
:param auth_list:
:param opts: __opts__ for when __opts__ is not injected
:return: Modified auth list.
c S s g | ] }|� d �r|�qS )rq )rv )rA Z potential_our r r rC l s ��z process_acl.<locals>.<listcomp>)rs �str�extend�keysr~ )Z auth_listr Zou_names�itemr r r � process_acl^ s
��
r� )TN)FN)N) r. ra �loggingZjinja2r Zsalt.utils.datar_ Zsalt.utils.stringutilsZsalt.exceptionsr r � getLoggerr+ rH r Z ldap.filterZ ldap.modlistr" � ImportErrorr r r r r= rT rX rp r~ r� r r r r �<module> s|
��������� �
� � �
�����
D
; &
$E