mavis external python module about event-driven-servers HOT 10 CLOSED

import ldap, os, sys, logging, re
from datetime import datetime

# Import AV constants
import mavis

logger = logging.getLogger(__name__)
logger.setLevel(logging.DEBUG)
formatLogger = logging.Formatter("{asctime} {message}", style = "{")
fileLogger = logging.FileHandler("ldappy.log", mode = "w", encoding='utf-8')
fileLogger.setFormatter(formatLogger)
logger.addHandler(fileLogger)

ldapHosts = os.environ.get('LDAP_HOSTS') or "ldaps://<server>"
ldapPass = os.environ.get('LDAP_PASSWD') or "<pass>"
ldapBase = os.environ.get('LDAP_BASE') or "<DN>"
ldapDomain = os.environ.get('LDAP_DOMAIN') or "<domain>"
ldapUser = "{}@{}".format(os.environ.get('LDAP_USER'), os.environ.get('LDAP_DOMAIN')) or "<user>"
ldapFilter = "(&(objectclass=user)(sAMAccountName={}))"

def parseStdin():
    avPairs = dict()
    for line in sys.stdin:
        #logger.info(line.rstrip())
        if line.rstrip() != "=":
            avPairs[int(line.split()[0])] = line.split()[1]
        else:
            return avPairs

def writeStdout(avPairs, result):
    for key in sorted(avPairs):
        sys.stdout.write("%d %s\n" % (int(key), avPairs[key]))
    sys.stdout.write("=%d\n" % result)

logger.info("start")
avDict = parseStdin()
result = mavis.MAVIS_DEFERRED
flagFinish = False
try:
    # ldapConnection = ldap.initialize(ldapHosts, trace_level=0)
    ldapConnection = ldap.ldapobject.ReconnectLDAPObject(ldapHosts, trace_level=0, retry_max=5, retry_delay=10.0)
    ldapConnection.set_option(ldap.OPT_DEFBASE, ldapBase)
    #ldapConnection.set_option(ldap.OPT_DEBUG_LEVEL,9)
except:
    avDict[mavis.AV_A_USER_RESPONSE] = "Unable to connect to the server."
    result = mavis.MAVIS_FINAL
    flagFinish = True

if not flagFinish and (avDict[mavis.AV_A_TYPE] != mavis.AV_V_TYPE_TACPLUS):
    result = mavis.MAVIS_DOWN
    flagFinish = True

if not flagFinish and (not mavis.AV_A_USER in avDict):
    avDict[mavis.AV_A_USER_RESPONSE] = "User not set."
    avDict[mavis.AV_A_RESULT] = mavis.AV_V_RESULT_ERROR
    result = mavis.MAVIS_FINAL
    flagFinish = True
else:
    ldapFilter = ldapFilter.format(avDict[mavis.AV_A_USER])

if not flagFinish and (re.match('\(|\)|,|\||&|\*', avDict[mavis.AV_A_USER])):
    avDict[mavis.AV_A_USER_RESPONSE] = "Username not valid."
    avDict[mavis.AV_A_RESULT] = mavis.AV_V_RESULT_ERROR;
    result = mavis.MAVIS_FINAL
    flagFinish = True

if not flagFinish and (avDict[mavis.AV_A_TACTYPE] == mavis.AV_V_TACTYPE_AUTH and not mavis.AV_A_PASSWORD in avDict):
    avDict[mavis.AV_A_USER_RESPONSE] = "Password not set."
    avDict[mavis.AV_A_RESULT] = mavis.AV_V_RESULT_ERROR;
    result = mavis.MAVIS_FINAL
    flagFinish = True

if not flagFinish and not mavis.AV_A_PASSWORD in avDict:
    ldapConnection.simple_bind_s(ldapUser, ldapPass)
    try:
        userData = ldapConnection.search_ext_s(ldapBase, ldap.SCOPE_SUBTREE, filterstr = ldapFilter)
        #logger.info("user data type {} with {}".format(type(userData), userData))
        if userData is not None and len(userData) != 0:
            avDict[mavis.AV_A_USER_RESPONSE] = "Authorization passed."
            avDict[mavis.AV_A_RESULT] = mavis.AV_V_RESULT_OK
            result = mavis.MAVIS_FINAL
        else:
            avDict[mavis.AV_A_USER_RESPONSE] = "User not found."
            avDict[mavis.AV_A_RESULT] = mavis.AV_V_RESULT_NOTFOUND
            result = mavis.MAVIS_DOWN
    except ldap.TIMEOUT as lto:
        #logger.info("timeout {}".format(lto))
        avDict[mavis.AV_A_USER_RESPONSE] = "Time out looking up the user."
        avDict[mavis.AV_A_RESULT] = mavis.AV_V_RESULT_ERROR
        result = mavis.MAVIS_TIMEOUT
    finally:
        ldapConnection.unbind_s()
        flagFinish = True

if not flagFinish and mavis.AV_A_PASSWORD in avDict:
    ldapConnection = ldap.ldapobject.ReconnectLDAPObject(ldapHosts, trace_level=0, retry_max=5, retry_delay=10.0)
    ldapConnection.set_option(ldap.OPT_DEFBASE, ldapBase)
    try:
        #logger.info("av received {}".format(avDict))
        #logger.info("mypass {}".format(avDict[mavis.AV_A_PASSWORD]))
        ldapConnection.simple_bind_s("{}@{}".format(avDict[mavis.AV_A_USER], ldapDomain), avDict[mavis.AV_A_PASSWORD])
        #logger.info("ok")
        userData = ldapConnection.search_ext_s(ldapBase, ldap.SCOPE_SUBTREE, filterstr = ldapFilter)
        #logger.info("user data type {} with {}".format(type(userData), userData))
        avDict[mavis.AV_A_DBPASSWORD] = avDict[mavis.AV_A_PASSWORD]
        avDict[mavis.AV_A_DN] = userData[0][0]
        avDict[mavis.AV_A_MEMBEROF] = '"{}"'.format(userData[0][1]['memberOf'][0].decode('UTF-8'))
        avDict[mavis.AV_A_RESULT] = mavis.AV_V_RESULT_OK
        result = mavis.MAVIS_FINAL
    except ldap.INVALID_CREDENTIALS as lic:
        #logger.info("invalid credentials {}".format(lic))
        avDict[mavis.AV_A_RESULT] = mavis.AV_V_RESULT_FAIL
        result = mavis.MAVIS_DOWN
    finally:
        flagFinish = True
        ldapConnection.unbind_s()

writeStdout(avDict, result)