通过python-ldap操作管理AD/LDAP用户及组织结构
LDAP/AD是两种应用最广泛的认证服务器,AD是微软基于LDAP开发而成的,应用于Windows平台,而LDAP主要应用于Linux平台(LDAP用在Windows平台比较少)。既然AD是基于LDAP的扩展,则LDAP大部分协议,AD均可原生支持,这位我们操作和管理AD认证服务器提供了大大的便利。
创新互联公司是一家专注于网站制作、做网站与策划设计,宜春网站建设哪家好?创新互联公司做网站,专注于网站建设10余年,网设计领域的专业建站公司;建站业务涵盖:宜春等地区。宜春做网站价格咨询:18982081108
在软件开发过程中,很多公司都采用AD/LDAP用于自己的用户认证体系,本文重点研究通过Python语言提供的Python-Ldap框架,来操作和管理AD/LDAP中的用户,组织结构等,希望对大家有所帮助。
基本概念:
o– organization(组织-公司)
ou – organization unit(组织单元/部门)
c - countryName(国家)
dc - domainComponent(域名组件)
sn – suer name(真实名称)
cn - common name(常用名称)
dn - distinguished name(唯一标识)
AD和LDAP中的字段及含义:
- 用户表字段对应关系:
字段描述 表示值 唯一标识 dn 用户名 userPrincipalName(AD)/cn(LDAP) 密码 userPassword 真实姓名 displayName 工作地点 physicalDeliveryOfficeName 职务 title 邮箱 mail 个人电话 telephoneNumber 公司电话 homePhone
- 组织结构表对应关系:
字段描述 表示值 唯一标识 dn 组织名称 ou 组织描述 description
- 在AD中创建用户
import ldap
def create_ad_user(username, unicode_password, org_dn):
l = ldap.initialize('ldap://172.16.1.163:636') #use secure port default:636
l.protocol_version = 3
l.set_option(ldap.OPT_REFERRALS, 0)
l.simple_bind_s('Administrator', 'P@ssword')
user = {}
user['objectclass'] = ['top', 'person', 'organizationalPerson', 'user']
user_dn = 'cn=%s,%s' % (username,org_dn)
user['userPrincipalName'] = '%s@%s' % (username, domain)
user['userAccountControl'] = '66048' # active user account
user['unicodePwd'] = unicode_password
ldif = modlist.addModlist(user)
ret, _ = l.add_s(user_dn, ldif)
print ret
- 在LDAP中创建用户
import ldap def create_ldap_user(username, password, org_dn): l = ldap.initialize('ldap://172.16.1.163:389') l.protocol_version = 3 l.set_option(ldap.OPT_REFERRALS, 0) l.simple_bind_s('Administrator', 'P@ssword') user = {} user['objectclass'] = ['top', 'person', 'inetOrgPerson'] user['cn'] = username user['sn'] = user['cn'] user['password'] = password user_dn = 'cn=%s,%s' % (username,org_dn) ldif = modlist.addModlist(user) ret, _ = l.add_s(user_dn, ldif) print ret
- 修改AD/LDAP用户基本信息
import ldap def modify_user(username): firstname = 'Abel' lastname = 'Lee' l = ldap.initialize('ldap://172.16.1.163:389') l.protocol_version = 3 l.set_option(ldap.OPT_REFERRALS, 0) l.simple_bind_s('Administrator', 'P@ssword') cn = username dn = 'cn=%s,ou=org1,dc=testad,dc=com' % cn old = {'description': 'old description'} new = {'description': 'new description'} ldif = ldap.modifyModlist(old, new) ret = l.modify_s(dn, ldif) l.unbind_s() print ret
- 删除AD/LDAP用户
import ldap def delete_users(user_dn): l = ldap.initialize('ldap://172.16.1.163:389') l.protocol_version = 3 l.set_option(ldap.OPT_REFERRALS, 0) l.simple_bind_s('Administrator', 'P@ssword') ret = l.delete_s(user_dn) l.unbind_s() print ret
- 查询AD用户信息
import ldap def describe_ad_users(org_dn='', usernames = []): l = ldap.initialize('ldap://172.16.1.163:389') l.protocol_version = 3 l.set_option(ldap.OPT_REFERRALS, 0) l.simple_bind_s('Administrator', 'P@ssword') USER_ATTRS = ['userAccountControl','displayName','description','homePhone','physicalDeliveryOfficeName','title','mail','telephoneNumber'] filterstr = '(&(objectclass=user)' if len(usernames) > 0: filterstr = filterstr + '(|' for username in usernames: username = '%s@%s' % (username, domain) userPrincipalName = '(userPrincipalName=%s)' % username filterstr += userPrincipalName if len(usernames) > 0: filterstr += '))' else: filterstr += ')' if org_dn: ret = l.search_s(org_dn, ldap.SCOPE_SUBTREE, filterstr, attrlist=USER_ATTRS) else: ret = l.search_s(base_dn, ldap.SCOPE_SUBTREE, filterstr, attrlist=USER_ATTRS) print ret
- 查询LDAP中的用户
import ldap def describe_ldap_users(org_dn='', usernames = []): l = ldap.initialize('ldap://172.16.1.163:389') l.protocol_version = 3 l.set_option(ldap.OPT_REFERRALS, 0) l.simple_bind_s('Administrator', 'P@ssword') USER_ATTRS = ['userAccountControl','displayName','description','homePhone','physicalDeliveryOfficeName','title','mail','telephoneNumber'] filterstr = '(&(objectclass=person)' if len(usernames) > 0: filterstr = filterstr + '(|' for cn in usernames: cn = '(cn=%s)' % cn filterstr += cn if len(usernames) > 0: filterstr += '))' else: filterstr += ')' if org_dn: ret = l.search_s(org_dn, ldap.SCOPE_SUBTREE, filterstr, attrlist=USER_ATTRS) else: ret = l.search_s(base_dn, ldap.SCOPE_SUBTREE, filterstr, attrlist=USER_ATTRS) print ret
- AD用户认证
import ldap def login_ad(user_dn, password): l = ldap.initialize('ldap://172.16.1.163:389') l.protocol_version = 3 l.set_option(ldap.OPT_REFERRALS, 0) l.simple_bind_s(user_dn, password) cn = user_dn.split(',')[0].split('=') base_dn = 'dc=testad,dc=com' domain = 'testad.com' username = '%s@%s' % (cn[1], domain) ret = l.search_s(base_dn, ldap.SCOPE_SUBTREE,"(userPrincipalName=%s)" % username, ["userPrincipalName"]) if ret is None or len(ret) == 0: return False return True
- LDAP用户认证
import ldap def login_ldap(user_dn, password): l = ldap.initialize('ldap://172.16.1.163:389') l.protocol_version = 3 l.set_option(ldap.OPT_REFERRALS, 0) l.simple_bind_s(user_dn, password) cn = user_dn.split(',')[0].split('=') base_dn = 'dc=testad,dc=com' ret = l.search_s(base_dn, ldap.SCOPE_SUBTREE,"%s=%s" % (cn[0], cn[1])) if ret is None or len(ret) == 0: return False return True
- 设置AD用户密码,修改AD用户密码可以先认证再设置
import ldap def set_ad_password(user_dn, unicode_password): l = ldap.initialize('ldap://172.16.1.163:636') #use secure port l.simple_bind_s('Administrator', 'P@ssword') param_pwd = [(ldap.MOD_REPLACE, 'unicodePwd', [password_utf16]), (ldap.MOD_REPLACE, 'unicodePwd', [password_utf16])] ret,_ = l.modify_s(user_dn, param_pwd) print ret
- 设置LDAP用户密码
import ldap def set_ldap_password(user_dn, password): l = ldap.initialize('ldap://172.16.1.163:389') l.protocol_version = 3 l.set_option(ldap.OPT_REFERRALS, 0) l.simple_bind_s('Administrator', 'P@ssword') l.passwd_s(user_dn, None, password)
- 修改LDAP用户密码
import ldap def modify_ldap_password(user_dn, old_password, new_password): l = ldap.initialize('ldap://172.16.1.163:389') l.protocol_version = 3 l.set_option(ldap.OPT_REFERRALS, 0) l.simple_bind_s('Administrator', 'P@ssword') l.passwd_s(user_dn, old_password, new_password)
- 创建AD/LDAP组织结构
import ldap def create_ou(parent_dn, ou): l = ldap.initialize('ldap://172.16.1.163:389') l.protocol_version = 3 l.set_option(ldap.OPT_REFERRALS, 0) l.simple_bind_s('Administrator', 'P@ssword') attrs= {'ou': ou} attrs['description'] = 'this is description' attrs['objectClass'] = ['organizationalUnit','top'] dn = 'ou=%s,%s' % (attrs['ou'], parent_dn) ldif = modlist.addModlist(attrs) ret, _ = l.add_s(dn,ldif) print ret
- 修改AD/LDAP组织结构
import ldap def modify_ou(attrs={'description': 'new_description'}): l = ldap.initialize('ldap://172.16.1.163:389') l.protocol_version = 3 l.set_option(ldap.OPT_REFERRALS, 0) l.simple_bind_s('Administrator', 'P@ssword') old_attrs = {'description': 'old_description'} ldif = modlist.modifyModlist(old_attrs, attrs) l.modify_s(dn,ldif)
- 删除AD/LDAP组织结构
import ldap def delete_ou(dn): l = ldap.initialize('ldap://172.16.1.163:389') l.protocol_version = 3 l.set_option(ldap.OPT_REFERRALS, 0) l.simple_bind_s('Administrator', 'P@ssword') l.delete_s(dn)
- 查询AD/LDAP组织结构
import ldap def describe_ou(parent_dn='', org_DNS=[]): ORGANIZATION_ATTRS = ['ou', 'description'] l = ldap.initialize('ldap://172.16.1.163:389') l.protocol_version = 3 l.set_option(ldap.OPT_REFERRALS, 0) l.simple_bind_s('Administrator', 'P@ssword') filterstr = '(&(objectclass=organizationalUnit)' for dn in org_dns: objectGUID = '(ou=%s)' % dn filterstr += objectGUID filterstr += ')' if parent_dn: ret = l.search_s(parent_dn, ldap.SCOPE_SUBTREE, filterstr, attrlist=ORGANIZATION_ATTRS) else: ret = l.search_s(base_dn, ldap.SCOPE_SUBTREE, filterstr, attrlist=ORGANIZATION_ATTRS) print ret
- 修改用户所属组织结构
import ldap def change_user_in_ou(user_dn, new_org_dn): l = ldap.initialize('ldap://172.16.1.163:389') l.protocol_version = 3 l.set_option(ldap.OPT_REFERRALS, 0) l.simple_bind_s('Administrator', 'P@ssword') cn = user_dn.split(',')[0] ret = l.rename_s(user_dn, cn, new_org_dn) print ret
注意:AD和LDAP中如:创建用户,查询用户等操作,其使用端口和查询字段均有差异,还请格外注意,另外,代码如有不明确指出,欢迎留言讨论。
网页标题:通过python-ldap操作管理AD/LDAP用户及组织结构
本文路径:http://myzitong.com/article/pshdjo.html