Re: [Kimchi-devel] [PATCHv1 3/4] Add LDAP authentication

On 10/20/2014 11:52 AM, lvroyce0210(a)gmail.com wrote: > From: Royce Lv <lvroyce(a)linux.vnet.ibm.com&gt; > > Add LDAP authentication, also deals with invalid user, > LDAP search base configure error and other LDAP errors. > > Signed-off-by: Royce Lv <lvroyce(a)linux.vnet.ibm.com&gt; > --- > contrib/DEBIAN/control.in | 1 + > contrib/kimchi.spec.fedora.in | 1 + > contrib/kimchi.spec.suse.in | 1 + > src/kimchi/auth.py | 44 ++++++++++++++++++++++++++++++++++++++++++- > 4 files changed, 46 insertions(+), 1 deletion(-) > > diff --git a/contrib/DEBIAN/control.in b/contrib/DEBIAN/control.in > index 7372a58..0721960 100644 > --- a/contrib/DEBIAN/control.in > +++ b/contrib/DEBIAN/control.in > @@ -27,6 +27,7 @@ Depends: python-cherrypy3 (>= 3.2.0), > firewalld, > nginx, > python-guestfs, > + python-ldap, > libguestfs-tools > Build-Depends: libxslt, > python-libxml2, > diff --git a/contrib/kimchi.spec.fedora.in > b/contrib/kimchi.spec.fedora.in > index 2ca3076..fcb8c11 100644 > --- a/contrib/kimchi.spec.fedora.in > +++ b/contrib/kimchi.spec.fedora.in > @@ -29,6 +29,7 @@ Requires: nfs-utils > Requires: nginx > Requires: iscsi-initiator-utils > Requires: policycoreutils-python > +Requires: python-ldap > Requires: python-libguestfs > Requires: libguestfs-tools > BuildRequires: libxslt > diff --git a/contrib/kimchi.spec.suse.in b/contrib/kimchi.spec.suse.in > index 9ea240c..b8f0531 100644 > --- a/contrib/kimchi.spec.suse.in > +++ b/contrib/kimchi.spec.suse.in > @@ -23,6 +23,7 @@ Requires: python-psutil >= 0.6.0 > Requires: python-jsonschema >= 1.3.0 > Requires: python-ethtool > Requires: python-ipaddr > +Requires: python-ldap > Requires: python-lxml > Requires: python-xml > Requires: nfs-client > diff --git a/src/kimchi/auth.py b/src/kimchi/auth.py > index 10c7c1f..162bbfd 100644 > --- a/src/kimchi/auth.py > +++ b/src/kimchi/auth.py > @@ -20,6 +20,7 @@ > import base64 > import cherrypy > import fcntl > +import ldap > import multiprocessing > import os > import PAM > @@ -177,6 +178,7 @@ class PAMUser(User): > > class LDAPUser(User): > auth_type = "ldap" > + > def __init__(self, username): > self.user = {} > self.user[USER_NAME] = username > @@ -187,7 +189,47 @@ class LDAPUser(User): > > @staticmethod > def authenticate(username, password): > - return False > + ldap_server = config.get("authentication", "ldap_server").strip('"') > + ldap_search_base = config.get( > + "authentication", "ldap_search_base").strip('"') > + ldap_search_filter = config.get( > + "authentication", "ldap_search_filter", > + vars={"username": username.encode("utf-8")}).strip('"') > + > + connect = ldap.open(ldap_server) > + try: > + try: > + result = connect.search_s( > + ldap_search_base, ldap.SCOPE_SUBTREE, ldap_search_filter) > + if len(result) == 0: > + entity = ldap_search_filter % {'username': username} > + raise ldap.LDAPError("Invalid ldap entity:%s" % entity) > + except ldap.NO_SUCH_OBJECT: > + # ldap search base specified wrongly. > + raise ldap.LDAPError( > + "invalid ldap search base %s" % ldap_search_base) > + > + try: > + connect.bind_s(result[0][0], password) > + except ldap.INVALID_CREDENTIALS: > + # invalid user password > + raise ldap.LDAPError("invalid user/passwd") > + connect.unbind_s() > + return True > + except ldap.LDAPError, e: > + arg = {"username": username, "code": e.message} > + raise OperationFailed("KCHAUTH0001E", arg) > + > + def get_groups(self): > + return self.user[USER_GROUPS] > + > + def get_roles(self): > + self.user[USER_ROLES] = dict.fromkeys(tabs, 'admin') > + return self.user[USER_ROLES] The admin ID's should be listed on Kimchi config file, instead of doing admin permissions to all users. So on __init__(): self.admin_users = config.get("authentication", "ldap_admin_users") self.user[USER_ROLES] = dict.fromkeys(tabs, 'admin') if self.user[USERNAME] in self.admin_users else dict.fromkeys(tabs, 'user') And on get_roles(): def get_roles(self): return self.user[USER_ROLES]

> + > + def get_user(self): > + return self.user > + > > def from_browser(): > # Enable Basic Authentication for REST tools. _______________________________________________ Kimchi-devel mailing list Kimchi-devel(a)ovirt.org http://lists.ovirt.org/mailman/listinfo/kimchi-devel