1

import ldap

     2

     3

import pvl.ldap.domain

     4

import pvl.users.group

     5

     6

import logging; log = logging.getLogger('pvl.login.auth')

     7

     8

class AuthError (Exception) :

     9

    def __init__ (self, error) :

    10

        self.error = error

    11

    12

    def __unicode__ (self) :

    13

        return u"Authenticating against the backend failed: {self.error}".format(self=self)

    14

    15

class LDAPAuth (object) :

    16

    def __init__ (self, ldap) :

    17

        self.ldap = ldap

    18

    19

    def auth (self, username, password) :

    20

        """

    21

            Attempt to bind against LDAP with given user object and password.

    22

    23

            Returns None if the user does not seem to exist, False on invalid auth, True on valid auth.

    24

    25

            Raises AuthError.

    26

        """

    27

    28

        # search

    29

        try :

    30

            user = self.ldap.users.get(username)

    31

        except KeyError :

    32

            log.info("%s: not found", username)

    33

            return None

    34

        else :

    35

            log.info("%s: %s", username, user)

    36

    37

        # bind

    38

        bind = self.bind(user, password)

    39

    40

        if bind :

    41

            return user

    42

        else :

    43

            return False

    44

    45

    def bind (self, user, password) :

    46

        """

    47

            Attempt to bind against LDAP with given user object and password.

    48

    49

            Returns the bound connection, or

    50

                None        - if the user does not seem toe xist

    51

                False       - invalid auth

    52

    53

            Raises AuthError.

    54

        """

    55

    56

        conn = self.ldap.open()

    57

    58

        try :

    59

            conn.bind(user.dn, password)

    60

    61

        except ldap.INVALID_CREDENTIALS as ex :

    62

            log.info("%s: INVALID_CREDENTIALS", user)

    63

            return False

    64

    65

        except ldap.NO_SUCH_OBJECT as ex :

    66

            log.info("%s: ldap.NO_SUCH_OBJECT", user)

    67

            return None

    68

    69

        except ldap.LDAPError as ex :

    70

            log.exception("%s", user)

    71

            raise AuthError(ex)

    72

    73

        else :

    74

            log.info("%s", user)

    75

            return conn

    76

    77

    def access (self, user) :

    78

        """

    79

            Yield a list of access control tokens for the given auth username.

    80

        """

    81

    82

        yield pvl.users.group.Group.fromldap(self.ldap.users.group(user))

    83

    84

        for group in self.ldap.users.groups(user) :

    85

            yield pvl.users.group.Group.fromldap(group)

    86

    87

    def userdata (self, user) :

    88

        """

    89

            Yield arbitrary userdata for given auth state.

    90

        """

    91

    92

        return user.get('cn')

    93

    94

    def renew (self, username) :

    95

        """

    96

            Re-lookup auth state for given username.

    97

        """

    98

    99

        try :

   100

            return self.ldap.users.get(username)

   101

        except KeyError :

   102

            return None

   103