quay/data/users/externalldap.py

import ldap
import logging
import os

from collections import namedtuple
from data.users.federated import FederatedUsers, VerifiedCredentials

logger = logging.getLogger(__name__)


class LDAPConnectionBuilder(object):
  def __init__(self, ldap_uri, user_dn, user_pw, allow_tls_fallback=False):
    self._ldap_uri = ldap_uri
    self._user_dn = user_dn
    self._user_pw = user_pw
    self._allow_tls_fallback = allow_tls_fallback

  def get_connection(self):
    return LDAPConnection(self._ldap_uri, self._user_dn, self._user_pw, self._allow_tls_fallback)


class LDAPConnection(object):
  def __init__(self, ldap_uri, user_dn, user_pw, allow_tls_fallback=False):
    self._ldap_uri = ldap_uri
    self._user_dn = user_dn
    self._user_pw = user_pw
    self._allow_tls_fallback = allow_tls_fallback

    self._conn = None

  def __enter__(self):
    trace_level = 2 if os.environ.get('USERS_DEBUG') == '1' else 0
    self._conn = ldap.initialize(self._ldap_uri, trace_level=trace_level)
    self._conn.set_option(ldap.OPT_REFERRALS, 1)

    if self._allow_tls_fallback:
      logger.debug('TLS Fallback enabled in LDAP')
      self._conn.set_option(ldap.OPT_X_TLS_TRY, 1)

    self._conn.simple_bind_s(self._user_dn, self._user_pw)
    return self._conn

  def __exit__(self, exc_type, value, tb):
    self._conn.unbind_s()


class LDAPUsers(FederatedUsers):
  _LDAPResult = namedtuple('LDAPResult', ['dn', 'attrs'])

  def __init__(self, ldap_uri, base_dn, admin_dn, admin_passwd, user_rdn, uid_attr, email_attr,
               allow_tls_fallback=False, secondary_user_rdns=None):

    super(LDAPUsers, self).__init__('ldap')
    self._ldap = LDAPConnectionBuilder(ldap_uri, admin_dn, admin_passwd, allow_tls_fallback)
    self._ldap_uri = ldap_uri
    self._uid_attr = uid_attr
    self._email_attr = email_attr
    self._allow_tls_fallback = allow_tls_fallback

    # Note: user_rdn is a list of RDN pieces (for historical reasons), and secondary_user_rds
    # is a list of RDN strings.
    relative_user_dns = [','.join(user_rdn)] + (secondary_user_rdns or [])

    def get_full_rdn(relative_dn):
      prefix = relative_dn.split(',') if relative_dn else []
      return ','.join(prefix + base_dn)

    # Create the set of full DN paths.
    self._user_dns = [get_full_rdn(relative_dn) for relative_dn in relative_user_dns]

  def _get_ldap_referral_dn(self, referral_exception):
    logger.debug('Got referral: %s', referral_exception.args[0])
    if not referral_exception.args[0] or not referral_exception.args[0].get('info'):
      logger.debug('LDAP referral missing info block')
      return None

    referral_info = referral_exception.args[0]['info']
    if not referral_info.startswith('Referral:\n'):
      logger.debug('LDAP referral missing Referral header')
      return None

    referral_uri = referral_info[len('Referral:\n'):]
    if not referral_uri.startswith('ldap:///'):
      logger.debug('LDAP referral URI does not start with ldap:///')
      return None

    referral_dn = referral_uri[len('ldap:///'):]
    return referral_dn

  def _ldap_user_search_with_rdn(self, conn, username_or_email, user_search_dn):
    query = u'(|({0}={2})({1}={2}))'.format(self._uid_attr, self._email_attr,
                                            username_or_email)
    logger.debug('Conducting user search: %s under %s', query, user_search_dn)
    try:
      return (conn.search_s(user_search_dn, ldap.SCOPE_SUBTREE, query.encode('utf-8')), None)
    except ldap.REFERRAL as re:
      referral_dn = self._get_ldap_referral_dn(re)
      if not referral_dn:
        return (None, 'Failed to follow referral when looking up username')

      try:
        subquery = u'(%s=%s)' % (self._uid_attr, username_or_email)
        return (conn.search_s(referral_dn, ldap.SCOPE_BASE, subquery), None)
      except ldap.LDAPError:
        logger.exception('LDAP referral search exception')
        return (None, 'Username not found')

    except ldap.LDAPError:
      logger.exception('LDAP search exception')
      return (None, 'Username not found')

  def _ldap_user_search(self, username_or_email):
    # Verify the admin connection works first. We do this here to avoid wrapping
    # the entire block in the INVALID CREDENTIALS check.
    try:
      with self._ldap.get_connection():
        pass
    except ldap.INVALID_CREDENTIALS:
      return (None, 'LDAP Admin dn or password is invalid')

    with self._ldap.get_connection() as conn:
      logger.debug('Incoming username or email param: %s', username_or_email.__repr__())

      for user_search_dn in self._user_dns:
        (pairs, err_msg) = self._ldap_user_search_with_rdn(conn, username_or_email, user_search_dn)
        if pairs is not None and len(pairs) > 0:
          break

      if err_msg is not None:
        return (None, err_msg)

      logger.debug('Found matching pairs: %s', pairs)
      results = [LDAPUsers._LDAPResult(*pair) for pair in pairs]

      # Filter out pairs without DNs. Some LDAP impls will return such
      # pairs.
      with_dns = [result for result in results if result.dn]
      if len(with_dns) < 1:
        return (None, 'Username not found')

      # If we have found a single pair, then return it.
      if len(with_dns) == 1:
        return (with_dns[0], None)

      # Otherwise, there are multiple pairs with DNs, so find the one with the mail
      # attribute (if any).
      with_mail = [result for result in results if result.attrs.get(self._email_attr)]
      return (with_mail[0] if with_mail else with_dns[0], None)

  def verify_credentials(self, username_or_email, password):
    """ Verify the credentials with LDAP. """
    # Make sure that even if the server supports anonymous binds, we don't allow it
    if not password:
      return (None, 'Anonymous binding not allowed')

    (found_user, err_msg) = self._ldap_user_search(username_or_email)
    if found_user is None:
      return (None, err_msg)

    found_dn, found_response = found_user
    logger.debug('Found user for LDAP username %s; validating password', username_or_email)
    logger.debug('DN %s found: %s', found_dn, found_response)

    # First validate the password by binding as the user
    try:
      with LDAPConnection(self._ldap_uri, found_dn, password.encode('utf-8'),
                          self._allow_tls_fallback):
        pass
    except ldap.REFERRAL as re:
      referral_dn = self._get_ldap_referral_dn(re)
      if not referral_dn:
        return (None, 'Invalid username')

      try:
        with LDAPConnection(self._ldap_uri, referral_dn, password.encode('utf-8'),
                            self._allow_tls_fallback):
          pass
      except ldap.INVALID_CREDENTIALS:
        logger.exception('Invalid LDAP credentials')
        return (None, 'Invalid password')

    except ldap.INVALID_CREDENTIALS:
      logger.exception('Invalid LDAP credentials')
      return (None, 'Invalid password')

    # Now check if we have a federated login for this user
    if not found_response.get(self._uid_attr):
      return (None, 'Missing uid field "%s" in user record' % self._uid_attr)

    if not found_response.get(self._email_attr):
      return (None, 'Missing mail field "%s" in user record' % self._email_attr)

    username = found_response[self._uid_attr][0].decode('utf-8')
    email = found_response[self._email_attr][0]
    return (VerifiedCredentials(username=username, email=email), None)