Develop Reference

Issue with transform ldapsearch command to flask_ldap3_login settings

I have a problem with transform ldapsearch command to flask_ldap3_login settings.
To check connection to LDAP from Linux server I use this command:
ldapsearch -x -b "ou=intranet,dc=mydreamcorporation,dc=com" -H ldap://ids.mydream-corporation.com -D "myguid=myusername,ou=people,ou=intranet,dc=dreamcorporation,dc=com" -W "uid=myusername" cn uid
Response from LDAP:
extended LDIF
LDAPv3
base <ou=intranet,dc=mydreamcorporation,dc=com> with scope subtree
filter: uid=myusername
requesting: cn uid
MYUSERNAME, people, intranet, mydreamcorporation.com
dn: myguid=myusername,ou=people,ou=intranet,dc=mydreamcorporation,dc=com
cn: my_name
uid: MYUSERNAME
search result
search: 2
result: 0 Success
numResponses: 2
numEntries: 1
My flask_ldap3_login settings:
from flask import Flask, url_for
from flask_ldap3_login import LDAP3LoginManager
from flask_login import LoginManager, login_user, UserMixin, current_user
from flask import render_template_string, redirect
from flask_ldap3_login.forms import LDAPLoginForm
app = Flask(__name__)
app.config['SECRET_KEY'] = 'secret'
app.config['DEBUG'] = True
my_login = "myusername"
my_password = "password"
# Hostname of your LDAP Server
app.config['LDAP_HOST'] = 'ldap://ids.mydream-corporation.com'
# Port number of your LDAP server
app.config['LDAP_PORT'] = 389
# Base DN of your directory
app.config['LDAP_BASE_DN'] = "dc=mydreamcorporation,dc=com"
# Users DN to be prepended to the Base DN
app.config['LDAP_USER_DN'] = "ou=intranet"
# Groups DN to be prepended to the Base DN
app.config['LDAP_GROUP_DN'] = 'ou=people'
# The RDN attribute for your user schema on LDAP
app.config['LDAP_USER_RDN_ATTR'] = 'dn'
# The Attribute you want users to authenticate to LDAP with.
app.config['LDAP_USER_LOGIN_ATTR'] = 'myguid'
# The Username to bind to LDAP with
app.config['LDAP_BIND_USER_DN'] = "myguid=myusername,ou=people,ou=intranet,dc=mydreamcorporation,dc=com"
# The Password to bind to LDAP with
app.config['LDAP_BIND_USER_PASSWORD'] = my_password
login_manager = LoginManager(app) # Setup a Flask-Login Manager
ldap_manager = LDAP3LoginManager(app) # Setup a LDAP3 Login Manager
#app.route('/', methods=['POST','GET'])
def manual_login(my_login=my_login, my_password=my_password):
result = app.ldap3_login_manager.authenticate(my_login, my_password)
return str(result.status)
Unfortunately I have as a script result:
AuthenticationResponseStatus.fail
I think the problem is in wrong configuration, but I cannot find where :(
I tried to add:
app.config['LDAP_USER_SEARCH_SCOPE'] = 'SUBTREE'
app.config['LDAP_ALWAYS_SEARCH_BIND'] = 1
but it didn't help and I have a message:
invalid class in objectClass attribute: group
After Gabriel Luci comment I have change my settings to:
app.config['LDAP_BASE_DN'] = "ou=intranet"
app.config['LDAP_USER_DN'] = "myguid=myusername,ou=people,ou=intranet,dc=mydreamcorporation,dc=com"
#app.config['LDAP_GROUP_DN'] = 'ou=people'
app.config['LDAP_USER_RDN_ATTR'] = 'cn'
app.config['LDAP_USER_LOGIN_ATTR'] = 'uid'
app.config['LDAP_BIND_USER_DN'] = "myguid=myusername"
And now I have the same
AuthenticationResponseStatus.fail
And in console:
LDAPInvalidCredentialsResult - 49 - invalidCredentials - None - None - bindResponse - None

I have an answer to the question. Problem was solved by adding:
app.config['LDAP_SEARCH_FOR_GROUPS'] = False
Final config:
app = Flask(__name__)
app.config['SECRET_KEY'] = 'secret'
app.config['DEBUG'] = True
my_login = "myusername"
my_password = "password"
app.config['LDAP_HOST'] = 'ldaps://ids.mydream-corporation.com'
app.config['LDAP_PORT'] = 636
app.config['LDAP_BASE_DN'] = "dc=mydreamcorporation,dc=com"
app.config['LDAP_USER_DN'] = "ou=people,ou=intranet"
app.config['LDAP_USER_LOGIN_ATTR'] = 'myguid'
app.config['LDAP_BIND_USER_DN'] = "myguid=myusername,ou=people,ou=intranet,dc=mydreamcorporation,dc=com"
app.config['LDAP_BIND_USER_PASSWORD'] = my_password
app.config['LDAP_USER_SEARCH_SCOPE'] = 'SUBTREE'
app.config['LDAP_SEARCH_FOR_GROUPS'] = False
login_manager = LoginManager(app) # Setup a Flask-Login Manager
ldap_manager = LDAP3LoginManager(app) # Setup a LDAP3 Login Manager
#app.route('/', methods=['POST','GET'])
def manual_login(my_login=my_login, my_password=my_password):
result = app.ldap3_login_manager.authenticate(my_login, my_password)
return str(result.status)
Finally I have as a script result:
AuthenticationResponseStatus.success

You tagged active-directory, but I suspect you may not be using AD because you're using uid, which isn't used in AD.
The LDAP_HOST and LDAP_PORT look right.
You have set your LDAP_BASE_DN to the root of your domain, but in your ldapsearch command, you set it to your intranet OU. Why the difference?
The way you set LDAP_USER_DN tells it that all of your user objects are in ou=intranet,dc=mydreamcorporation,dc=com. Is that what you intended?
The way you set LDAP_GROUP_DN tells it that all of the group objects are in ou=people,dc=mydreamcorporation,dc=com. This looks suspicious. I don't think this is what you intended.
You have set LDAP_USER_RDN_ATTR to dn, but if you're using Active Directory, that should be cn according to Microsoft.
You've set LDAP_USER_LOGIN_ATTR to myguid, but this looks suspicious. This should be the attribute that represents the username the user will use to login. In AD, that would be sAMAccountName or userPrincipalName. If you are using some other LDAP server, it will likely be uid.

LDAP mocking in Python (ldap3 module)

My current task is to do QA Automation on our web app, but I don't want to use real credentials for it (for which we use a LDAP server). My idea was to mock the LDAP server when the web app is in TEST_MODE, and to my luck I found out that 'ldap3' (the python module) that we use for authentication, also supports a mocking function. An example code is here:
from ldap3 import Server, Connection, ALL, ALL_ATTRIBUTES, MOCK_SYNC
REAL_SERVER = 'my_real_server'
REAL_USER = 'cn=my_real_user,ou=test,o=lab'
REAL_PASSWORD = 'my_real_password'
# Retrieve server info and schema from a real server
server = Server(REAL_SERVER, get_info=ALL)
connection = Connection(server, REAL_USER, REAL_PASSWORD, auto_bind=True)
# Store server info and schema to json files
server.info.to_file('my_real_server_info.json')
server.schema.to_file('my_real_server_schema.json')
# Read entries from a portion of the DIT from real server and store them in a json file
if connection.search('ou=test,o=lab', '(objectclass=*)', attributes=ALL_ATTRIBUTES):
connection.response_to_file('my_real_server_entries.json', raw=True)
# Close the connection to the real server
connection.unbind()
# Create a fake server from the info and schema json files
fake_server = Server.from_definition('my_fake_server', 'my_real_server_info.json', 'my_real_server_schema.json')
# Create a MockSyncStrategy connection to the fake server
fake_connection = Connection(fake_server, user='cn=my_user,ou=test,o=lab', password='my_password', client_strategy=MOCK_SYNC)
# Populate the DIT of the fake server
fake_connection.strategy.entries_from_json('my_real_server_entries.json')
# Add a fake user for Simple binding
fake_connection.strategy.add_entry('cn=my_user,ou=test,o=lab', {'userPassword': 'my_password', 'sn': 'user_sn', 'revision': 0})
# Bind to the fake server
fake_connection.bind()
I followed this example with our code, and was successful halfway through it. I extracted the real_server_entries in a json file, and now is part to do the fake connection. So to summarise everything is done until this part:
# Create a MockSyncStrategy connection to the fake server
fake_connection = Connection(fake_server, user='cn=my_user,ou=test,o=lab', password='my_password', client_strategy=MOCK_SYNC)
I am not really sure what to put in the place of user and password.
A part of my code:
_USER_SEARCH_FILTER = "(&(objectClass=user)(cn={}))"
_ALL_USERS_SEARCH_FILTER = "(&(objectCategory=person)(objectClass=user))"
_EMAIL_ATTRIBUTE = "mail"
_DISPLAY_NAME_ATTRIBUTE = "displayName"
_USERNAME_ATTRIBUTE = "cn"
_SEARCH_ATTRIBUTES = (
_EMAIL_ATTRIBUTE, _DISPLAY_NAME_ATTRIBUTE, _USERNAME_ATTRIBUTE)
_LDAP_CONNECTION_ERROR = "Connection to LDAP server %s:%s failed: %s"
_LDAP_SERVER = Server(host=LDAP.host, port=int(LDAP.port), get_info='ALL')
server = _LDAP_SERVER
_CONNECTION = Connection(
server,
LDAP.manager_dn, LDAP.manager_password,
auto_bind=True, client_strategy=RESTARTABLE
)
server.info.to_file('my_real_server_info.json')
server.schema.to_file('my_real_server_schema.json')
if _CONNECTION.search(LDAP.root_dn, _ALL_USERS_SEARCH_FILTER, attributes=_SEARCH_ATTRIBUTES):
_CONNECTION.response_to_file('my_real_server_entries.json', raw=True)
_CONNECTION.unbind()
mock_server = Server.from_definition('mock_server', 'my_real_server_info.json', 'my_real_server_schema.json')
mock_connection = Connection(mock_server, user='???', password='???', client_strategy=MOCK_SYNC)
mock_connection.strategy.entries_from_json('my_real_server_entries.json')
mock_connection.strategy.add_entry('LDAP.root_dn', { #My guess is that here I mock the attributes, but this is also the other problem I am having (check below) })
The other problem I have is that I am not even sure if I can add a fake user, because when I took a look into the real_entries.json file the password is not stored there as an attribute (not even an encrypted version of it) and the only attributes we have are:
`cn` - username
`displayName` - LASTNAME, FIRSTNAME
`mail` - example#mail.com

Query for user in AD using python

I am trying to write a python script to validate if a username exists in a particular domain or not .
To query :
username -- > anandabhis
domain name --> example.com
Output : Successfully verified .
For this I have used python-ldap module to connect to LDAP server . But I am unable to proceed further even after reading lots of documentations.
import ldap
def test_login(self):
domain = 'EXAMPLE'
server = 'ldap-001.example.com'
admin_username = 'admin'
admin_password = 'secret-password'
connection = ldap.initialize('ldap://{0}'.format(server))
connection.protocol_version = 3
connection.set_option(ldap.OPT_REFERRALS, 0)
connection.simple_bind_s('{0}\{1}'.format(domain, admin_username), admin_password)
search_username = 'anandabhis'

A simple search for the sAMAccountName of the user should allow you to get the attributes of the user.
user_filter = '(sAMAccountName={})'.format(search_username)
base_dn = 'DC={},DC=com'.format(domain)
result = connection.search_s(base_dn, ldap.SCOPE_SUBTREE, user_filter)
print result

Flask Authentication with LDAP using flask_ldap3_login

I am trying to authenticate my Flask app with the Active Directory using flask_ldap3_login. I have written the code to check the connection with active directory:
from flask_ldap3_login import LDAP3LoginManager
config = dict()
config['LDAP_HOST'] = 'my_ldap_host'
config['LDAP_BASE_DN'] = 'dc=internal,dc=com'
config['LDAP_USER_DN'] = 'ou=users'
config['LDAP_GROUP_DN'] = 'ou=groups'
config['LDAP_USER_RDN_ATTR'] = 'cn'
config['LDAP_USER_LOGIN_ATTR'] = 'dn'
config['LDAP_BIND_USER_DN'] = None
config['LDAP_BIND_USER_PASSWORD'] = None
ldap_manager = LDAP3LoginManager()
ldap_manager.init_config(config)
response = ldap_manager.authenticate('username', 'password')
print response.status
When I provide with my LDAP credentials it throws the error
raise LDAPOperationResult(result=result['result'], description=result['description'], dn=result['dn'], message=result['message'], response_type=result['type'])
ldap3.core.exceptions.LDAPOperationsErrorResult: LDAPOperationsErrorResult - 1 - operationsError - None - 000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1 - searchResDone - None
Can someone tell me the proper way to authenticate the flask application with LDAP?

You need to provide login and password to access your LDAP:
app.config['LDAP_BIND_USER_DN'] = 'CN=someUser,CN=Users,DC=domain,DC=local'
app.config['LDAP_BIND_USER_PASSWORD'] = "secretpw"

Did you get it to work?
Did you have these lines in your code? If you didn't, why?
login_manager = LoginManager(app) # Flask-Login Manager
ldap_manager = LDAP3LoginManager(app) # Setup a LDAP3 Login Manager

Unable to authenticate ,enable the user in active Directory ,the user account created by using python ldap

Here i'm attached the python files to create user and authenticating user in windows active Directory 2008 r2
create.py
import ldap
import ldap.modlist as modlist
name='testing3'
password='p#ssw0rd'
l = ldap.initialize('ldap://##2.168.3#.##')
l.simple_bind_s('Administrator#example.local', 'p#ssw0rd1')
dn="cn="+name+",ou=oli,dc=example,dc=local"
attrs = {}
attrs['objectclass'] = ['Top','person','organizationalPerson','user']
attrs['cn'] = name
attrs['displayName'] = name
attrs['name'] = name
attrs['givenName'] = name
attrs['mail'] = name
attrs['ou'] = "Users"
#attrs['pwdLastSet'] = "-1"
attrs['userPrincipalName'] = name + "#naanal.local
attrs['userAccountControl'] = '514'
attrs['sAMAccountName'] = name
attrs['userPassword'] = password
ldif = modlist.addModlist(attrs)
l.add_s(dn,ldif)
l.unbind_s()
Using this program create user in the Active directory but unable to create the enabled user account. i can user the userAccountcontrol=''512` but it not working .userAccountcontrol='514' its working but user account was disabled.
using ldap modify change the userAccountcontrol getting error "when i'm try to enable the user account getting error "{'info': '0000052D: SvcErr: DSID-031A120C, problem 5003 (WILL_NOT_PERFORM), data 0\n', 'desc': 'Server is unwilling to perform'}""
Authe.py
import ldap
username='shan'
password='p#ssw0rd'
LDAP_SERVER = 'ldap://###.##.##.##'
LDAP_USERNAME = '%s#example.local' % username
LDAP_PASSWORD = password
base_dn = 'DC=example,DC=example'
ldap_filter = 'userPrincipalName=%s#example.local' % username
attrs = ['memberOf']
try:
ldap_client = ldap.initialize(LDAP_SERVER)
ldap_client.set_option(ldap.OPT_REFERRALS,0)
ldap_client.simple_bind_s(LDAP_USERNAME, LDAP_PASSWORD)
print 'successfull'
except ldap.INVALID_CREDENTIALS:
ldap_client.unbind()
print 'Wrong username ili password'
except ldap.SERVER_DOWN:
print 'AD server not awailable'
create the user account using create.py .then enable the user account manually in the active directory.after i'm try to authenticate the created user account not detected.but manually created account detected by using authe.py file
i'm using Ubuntu 14.04 64 bit

There are two problems with your code:
Active Directory stores the password in the unicodePwd attribute and not userPassword. See this link for more details. This article also explains how the value for unicodePwd must be encoded (UTF-16)
The other problem (this is also explained in the referenced article) is that you must connect over a secure connection to Active Directory whenever you are making changes to the password attribute (including creating a user). The URL starting with ldap:// makes me believe that your connection is not secure.
I hope this helps.