python读ad域日志_Python ldap AD域 账户 查询 修改 修改密码

# -*- coding:utf8 -*-

import ldap3

from ldap3import Connection,Server,ALL,SUBTREE,MODIFY_REPLACE

from appimport app, out_logger

import psutil

class AdApi(object):

server =None

connect =None

@staticmethod

def init_connection():

try:

# AdApi.server = Server(app.config['ADSERVER'], app.config['ADSERVERPORT'], get_info=ALL)

AdApi.server = Server(app.config['ADSERVER'], app.config['ADSERVERPORT'], use_ssl=True)

AdApi.connect = Connection(AdApi.server, user=app.config['ADACCOUNT'], password=app.config['ADPASSWORD'], auto_bind=True)

AdApi.connect.start_tls()

except Exception, e:

out_logger.exception("init_connection error: %s", e)

@staticmethod

def list_ad_user(adconfig):

#从AD域服务器拉取用户列表，每次1000

if AdApi.serveris None or AdApi.connectis None:

AdApi.init_connection()

try:

AdApi.connect.search(adconfig, '(objectclass=person)', attributes=['cn', 'description','userAccountControl'], paged_size=1000,

search_scope=SUBTREE)

ad_users_list =list()

ad_users_list.extend(AdApi.connect.entries)

cookie = AdApi.connect.result['controls']['1.2.840.113556.1.4.319']['value']['cookie']

while cookie:

AdApi.connect.search(adconfig, '(objectclass=person)', attributes=['cn', 'description','userAccountControl'], paged_size=1000,

search_scope=SUBTREE, paged_cookie=cookie)

ad_users_list.extend(AdApi.connect.entries)

cookie = AdApi.connect.result['controls']['1.2.840.113556.1.4.319']['value']['cookie']

out_logger.debug(ad_users_list)

return ad_users_list

except Exception, e:

out_logger.exception("init_connection error: %s", e)

AdApi.server =None

AdApi.connect =None

@staticmethod

def delete_ad_user(username,adconfig):

# 删除ad用户

if AdApi.serveris None or AdApi.connectis None:

AdApi.init_connection()

try:

out_logger.info("delete_ad_user :"+username)

res = AdApi.connect.delete('CN=' + username +',' + adconfig)

out_logger.info(res)

return res

except Exception, e:

out_logger.exception("delete_ad_user error: %s", e)

AdApi.server =None

AdApi.connect =None

return False

@staticmethod

def add_ad_user(username, password, description,adflag):

# 增加ad用户

if AdApi.serveris None or AdApi.connectis None:

AdApi.init_connection()

try:

out_logger.info("add_ad_user :"+username)

AdApi.connect.add('CN=' + username +',' + adflag, ['User'],

{'displayName': username, 'description': description,

'userPrincipalName':'%s@%s' % (username, app.config['DN']), 'userAccountControl':'544',

'sAMAccountName': username, 'pwdLastSet': -1})

#增加用户之后，修改密码

USER_DN ='cn=%s,%s' % (username, adflag)

CURREENTPWD =''

NEWPWD = password

ldap3.extend.microsoft.modifyPassword.ad_modify_password(AdApi.connect, USER_DN, NEWPWD, CURREENTPWD, controls=None)

res = AdApi.connect.result

if res['result'] ==0 and res['description'] =='success':

return True

else:

return False

except Exception, e:

out_logger.exception("add_ad_user error: %s", e)

AdApi.server =None

AdApi.connect =None

return False

@staticmethod

def disable_ad_user(username,adconfig):

#禁用ad用户

if AdApi.serveris None or AdApi.connectis None:

AdApi.init_connection()

try:

out_logger.info("disable_ad_user :"+username)

AdApi.connect.modify('CN=' + username +',' + adconfig, {'userAccountControl': [(MODIFY_REPLACE, ['514'])]})

res = AdApi.connect.result

if res['result'] ==0 and res['description'] =='success':

return True

else:

return False

except Exception, e:

out_logger.exception("disable_ad_user error: %s", e)

AdApi.server =None

AdApi.connect =None

return False

@staticmethod

def enable_ad_user(username,adconfig):

# 启用ad用户

if AdApi.serveris None or AdApi.connectis None:

AdApi.init_connection()

try:

out_logger.info("enable_ad_user :" + username)

AdApi.connect.modify('CN=' + username +',' + adconfig,

{'userAccountControl': [(MODIFY_REPLACE, ['544'])]})

res = AdApi.connect.result

if res['result'] ==0 and res['description'] =='success':

return True

else:

return False

except Exception, e:

out_logger.exception("enable_ad_user error: %s", e)

AdApi.server =None

AdApi.connect =None

return False

@staticmethod

def get_user_pwd_last_set(username):

if AdApi.serveris None or AdApi.connectis None:

AdApi.init_connection()

try:

AdApi.connect.search(app.config['BASEDN'], '(&(objectclass=User)(CN=%s))' % username, attributes=['pwdLastSet'])

ens = AdApi.connect.entries

for ein ens:

pwd_last_set = e['pwdLastSet']

pwd_last_set = pwd_last_set.value

return pwd_last_set

except Exception, e:

out_logger.exception("get_user_pwd_last_set error: %s", e)

AdApi.server =None

AdApi.connect =None