通过python-ldap处理ldap服务器

    最近项目中加入LDAP认证方式，那么问题来了，在网站上创建用户的时候，要将用户同步到LDAP服务器上。看了一下python-ldap的文档，实现了对ldap服务器上的用户实现增删改查。

import ldap
from rest_framework.exceptions import APIException, ValidationError


class MyLdap(object):
    def __init__(self, server_uri, server_port=389, bind_name='', bind_passwd=''):
        self.server_uri = server_uri
        self.server_port = server_port
        self.ldap_obj = None

        self.ldap_connect(bind_name, bind_passwd)

    def ldap_connect(self, bind_name='', bind_passwd=''):
        """
        :param bind_name: 绑定的ldap用户，可为空; 添加，删除用户时 bind_name 要有root权限
        :param bind_passwd:
        :return:
        """
        url = self.server_uri + ":" + str(self.server_port)
        conn = ldap.initialize(url)
        # try:
        #     conn.start_tls_s()
        # except ldap.LDAPError as exc:
        #     raise APIException(exc.message)
        if bind_name and not bind_passwd:
            raise APIException("请输入LDAP密码")
        try:
            rest = conn.simple_bind_s(bind_name, bind_passwd)
        except ldap.SERVER_DOWN:
            raise APIException("无法连接到LDAP")
        except ldap.INVALID_CREDENTIALS:
            raise APIException("LDAP账号错误")
        except Exception, ex:
            raise APIException(type(ex))
        if rest[0] != 97:  # 97 表示success
            raise APIException(rest[1])
        self.ldap_obj = conn

    def ldap_search(self, base='', keyword=None, rdn='cn'):
        """
        base: 域 ou=test, dc=test, dc=com
        keyword: 搜索的用户
        rdn: cn/uid
        """
        scope = ldap.SCOPE_SUBTREE
        filter = "%s=%s" % (rdn, keyword)
        retrieve_attributes = None
        try:
            result_id = self.ldap_obj.search(base, scope, filter, retrieve_attributes)
            result_type, result_data = self.ldap_obj.result(result_id)
            if not result_data:
                return False, []
        except ldap.LDAPError, error_message:
            raise APIException(error_message)
        return True, result_data

    def add_user(self, base_dn, password):
        """
        base_dn: cn=test, ou=magicstack,dc=test,dc=com  NOT NONE
        """
        if not base_dn:
            raise ValidationError(u"DN不能为空")
        dn_list = base_dn.split(',')
        user_info = dict()
        for item in dn_list:
            attr, value = item.split('=')
            if not value:
                raise ValidationError(u"DN输入错误:属性的值为空")
            user_info[attr] = value
        add_record = [('objectclass', ['person', 'organizationalperson']),
                      ('cn', ['%s' % user_info.get("cn")]),
                      ('sn', ['%s' % user_info.get("cn")]),
                      ('userpassword', ['%s' % password])]
        try:
            result = self.ldap_obj.add_s(base_dn, add_record)
        except ldap.LDAPError, error_message:
            raise APIException(error_message)
        else:
            if result[0] == 105:
                return True, []
            else:
                return False, result[1]

    def modify_user(self, dn, attr_list):
        """
        MOD_ADD: 如果属性存在，这个属性可以有多个值，那么新值加进去，旧值保留
        MOD_DELETE ：如果属性的值存在，值将被删除
        MOD_REPLACE ：这个属性所有的旧值将会被删除，这个值被加进去

        dn: cn=test, ou=magicstack,dc=test, dc=com
        attr_list: [( ldap.MOD_REPLACE, 'givenName', 'Francis' ),
                    ( ldap.MOD_ADD, 'cn', 'Frank Bacon' )
                   ]
        """
        try:
            result = self.ldap_obj.modify_s(dn, attr_list)
        except ldap.LDAPError, error_message:
            raise APIException(error_message)
        else:
            if result[0] == 103:
                return True, []
            else:
                return False, result[1]

    def delete_user(self, dn):
        """
        dn: cn=test, ou=magicstack,dc=test, dc=com
        """
        try:
            result = self.ldap_obj.delete_s(dn)
        except ldap.LDAPError, error_message:
            raise APIException(error_message)
        else:
            if result[0] == 107:
                return True, []
            else:
                return False, result[1]