python ldap3模块

最新推荐文章于 2024-04-11 09:54:06 发布

yunweigo

最新推荐文章于 2024-04-11 09:54:06 发布

阅读量1w

点赞数 1

分类专栏： DEVOPS 语言之美

DEVOPS 同时被 3 个专栏收录

2 篇文章 0 订阅

订阅专栏

ldap3

1 篇文章 0 订阅

订阅专栏

语言之美

1 篇文章 0 订阅

订阅专栏

一般公司都会使用AD域认证或者OpenLDAP认证管理对账户进行维护，会作为公司内部统一的认证入口，很大程度可以节省维护系统的成本。

ldap3

python 可以通过 ladp3可以对接OpenLDAP服务

https://ldap3.readthedocs.io/tutorial_searches.html ldap3操作说明文档

ldap3 说明

安装

pip install ldap3

导入服务

from ldap3 import Server, Connection, ALL
server = Server('AD域地址')  # 指定服务器 
conn = Connection(server)  # 连接服务器
conn.bind() 绑定信息

缩略写法
conn = Connection('AD域地址', auto_bind=True)
print(conn) 看下下打印的信息
Connection(server=Server(host='xxx.xxx.xxx.xxx', port=xxx, use_ssl=False, allowed_referral_hosts=[('*', True)], get_info='SCHEMA', mode='IP_V6_PREFERRED'), auto_bind='NO_TLS', version=3, authentication='ANONYMOUS', client_strategy='SYNC', auto_referrals=True, check_names=True, read_only=False, lazy=False, raise_exceptions=False, fast_decoder=True, auto_range=True, return_empty_attributes=True, auto_encode=True, auto_escape=True, use_referral_cache=False)

打印server的信息
Server(host='xxx.xxx.xxx.xxx', port=xxx, use_ssl=False, allowed_referral_hosts=[('*', True)], get_info='SCHEMA', mode='IP_V6_PREFERRED')

如果我们想获得一些有服务的一些信息，我们可以通过.info获取Sever的信息

>>> server = Server(<AD域地址>, get_info=ALL)
>>> conn = Connection(server, auto_bind=True)
>>> server.info
DSA info (from DSE):
  Supported LDAP Versions: 2, 3
  Naming Contexts:
    cn=changelog
    dc=demo1,dc=freeipa,dc=org
    o=ipaca
  Alternative Servers: None
  Supported Controls:
    1.2.840.113556.1.4.319 - LDAP Simple Paged Results - Control - RFC2696
    1.2.840.113556.1.4.473 - Sort Request - Control - RFC2891
    1.3.6.1.1.13.1 - LDAP Pre-read - Control - RFC4527
    1.3.6.1.1.13.2 - LDAP Post-read - Control - RFC4527
    1.3.6.1.4.1.1466.29539.12 - Chaining loop detect - Control - SUN microsystems
    1.3.6.1.4.1.42.2.27.8.5.1 - Password policy - Control - IETF DRAFT behera-ldap-password-policy
    1.3.6.1.4.1.42.2.27.9.5.2 - Get effective rights - Control - IETF DRAFT draft-ietf-ldapext-acl-model
    1.3.6.1.4.1.42.2.27.9.5.8 - Account usability - Control - SUN microsystems
    1.3.6.1.4.1.4203.1.9.1.1 - LDAP content synchronization - Control - RFC4533
    1.3.6.1.4.1.4203.666.5.16 - LDAP Dereference - Control - IETF DRAFT draft-masarati-ldap-deref
    2.16.840.1.113730.3.4.12 - Proxied Authorization (old) - Control - Netscape
    2.16.840.1.113730.3.4.13 - iPlanet Directory Server Replication Update Information - Control - Netscape
    2.16.840.1.113730.3.4.14 - Search on specific database - Control - Netscape
    2.16.840.1.113730.3.4.15 - Authorization Identity Response Control - Control - RFC3829
    2.16.840.1.113730.3.4.16 - Authorization Identity Request Control - Control - RFC3829
    2.16.840.1.113730.3.4.17 - Real attribute only request - Control - Netscape
    2.16.840.1.113730.3.4.18 - Proxy Authorization Control - Control - RFC6171
    2.16.840.1.113730.3.4.19 - Chaining loop detection - Control - Netscape
    2.16.840.1.113730.3.4.2 - ManageDsaIT - Control - RFC3296
    2.16.840.1.113730.3.4.20 - Mapping Tree Node - Use one backend [extended] - Control - openLDAP
    2.16.840.1.113730.3.4.3 - Persistent Search - Control - IETF
    2.16.840.1.113730.3.4.4 - Netscape Password Expired - Control - Netscape
    2.16.840.1.113730.3.4.5 - Netscape Password Expiring - Control - Netscape
    2.16.840.1.113730.3.4.9 - Virtual List View Request - Control - IETF
    2.16.840.1.113730.3.8.10.6 - OTP Sync Request - Control - freeIPA
  Supported Extensions:
    1.3.6.1.4.1.1466.20037 - StartTLS - Extension - RFC4511-RFC4513
    1.3.6.1.4.1.4203.1.11.1 - Modify Password - Extension - RFC3062
    1.3.6.1.4.1.4203.1.11.3 - Who am I - Extension - RFC4532
    2.16.840.1.113730.3.5.10 - Distributed Numeric Assignment Extended Request - Extension - Netscape
    2.16.840.1.113730.3.5.12 - Start replication request - Extension - Netscape
    2.16.840.1.113730.3.5.3 - Transaction Response Extended Operation - Extension - Netscape
    2.16.840.1.113730.3.5.4 - iPlanet Replication Response Extended Operation - Extension - Netscape
    2.16.840.1.113730.3.5.5 - iPlanet End Replication Request Extended Operation - Extension - Netscape
    2.16.840.1.113730.3.5.6 - iPlanet Replication Entry Request Extended Operation - Extension - Netscape
    2.16.840.1.113730.3.5.7 - iPlanet Bulk Import Start Extended Operation - Extension - Netscape
    2.16.840.1.113730.3.5.8 - iPlanet Bulk Import Finished Extended Operation - Extension - Netscape
    2.16.840.1.113730.3.5.9 - iPlanet Digest Authentication Calculation Extended Operation - Extension - Netscape
    2.16.840.1.113730.3.6.5 - Replication CleanAllRUV - Extension - Netscape
    2.16.840.1.113730.3.6.6 - Replication Abort CleanAllRUV - Extension - Netscape
    2.16.840.1.113730.3.6.7 - Replication CleanAllRUV Retrieve MaxCSN - Extension - Netscape
    2.16.840.1.113730.3.6.8 - Replication CleanAllRUV Check Status - Extension - Netscape
    2.16.840.1.113730.3.8.10.1 - KeyTab set - Extension - FreeIPA
    2.16.840.1.113730.3.8.10.3 - Enrollment join - Extension - FreeIPA
    2.16.840.1.113730.3.8.10.5 - KeyTab get - Extension - FreeIPA
  Supported SASL Mechanisms:
    EXTERNAL, GSS-SPNEGO, GSSAPI, DIGEST-MD5, CRAM-MD5, PLAIN, LOGIN, ANONYMOUS
  Schema Entry:
    cn=schema
Vendor name: 389 Project
Vendor version: 389-Directory/1.3.3.8 B2015.036.047
Other:
  dataversion:
    020150912040104020150912040104020150912040104
  changeLog:
    cn=changelog
  lastchangenumber:
    3033
  firstchangenumber:
    1713
  lastusn:
    8284
  defaultnamingcontext:
    dc=demo1,dc=freeipa,dc=org
  netscapemdsuffix:
    cn=ldap://dc=ipa,dc=demo1,dc=freeipa,dc=org:389
  objectClass:
    top

但在企业当中，我们需要登入验证后才能获取相关用户的信息

>>>from ldap3 import Server, Connection, ALL, NTUL
>>>server = Server('servername',get_info=ALL)
>>> conn = Connection(Server, user="Domain\\User" password="password", authenication=NTLM)
>>> conn.extend.standard.who_am_i() 向服务器询问身份

正常情况下我们的服务器明文通信端口是389，而LDAP通过TLS(安全)通信的方式默认端口是636

如果通过SSL套接字启动链接，设置 use_ssl方式为True

>>> from ldap3 import Tls
>>> import ssl
>>> tls_configuration = Tls(validate=ssl.CERT_REQUIRED, version=ssl.PROTOCOL_TLSv1)
>>> server = Server('ipa.demo1.freeipa.org', use_ssl=True, tls=tls_configuration)
>>> conn = Connection(server)
>>> conn.open()

其他相关操作可以参考接口文档，里面描述的很清晰