From 74ee2c073a05995d454a5c35a753d92f43a179f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Am=C3=A9lie=20Krej=C4=8D=C3=AD?= Date: Mon, 11 Sep 2023 21:19:36 +0200 Subject: [PATCH] Remove old LDAP backend files --- webvirtcloud/.dec_ldap_pwd.sh | 18 ----- webvirtcloud/ldapbackend.py | 142 ---------------------------------- 2 files changed, 160 deletions(-) delete mode 100755 webvirtcloud/.dec_ldap_pwd.sh delete mode 100644 webvirtcloud/ldapbackend.py diff --git a/webvirtcloud/.dec_ldap_pwd.sh b/webvirtcloud/.dec_ldap_pwd.sh deleted file mode 100755 index 2cda920..0000000 --- a/webvirtcloud/.dec_ldap_pwd.sh +++ /dev/null @@ -1,18 +0,0 @@ -#!/bin/bash - -##### - -# - -# LDAP PASSWORD DECRYPTION SCRIPT - -# - -# - -##### - -ENC_PASSWD=$1 - -echo $(echo $ENC_PASSWD | base64 -d | openssl enc -pbkdf2 -salt -d -pass pass:MYPASSPHRASE ) - diff --git a/webvirtcloud/ldapbackend.py b/webvirtcloud/ldapbackend.py deleted file mode 100644 index 0f7a797..0000000 --- a/webvirtcloud/ldapbackend.py +++ /dev/null @@ -1,142 +0,0 @@ -from django.contrib.auth.backends import ModelBackend -from django.contrib.auth.models import User, Group -from django.conf import settings -from accounts.models import UserAttributes, UserInstance, UserSSHKey -from django.contrib.auth.models import Permission -from logs.models import Logs -import uuid - -try: - from ldap3 import Server, Connection, ALL - #/srv/webvirtcloud/ldap/ldapbackend.py - class LdapAuthenticationBackend(ModelBackend): - - def get_LDAP_user(self, username, password, filterString): - print('get_LDAP_user {}'.format(username)) - try: - server = Server(settings.LDAP_URL, port=settings.LDAP_PORT, - use_ssl=settings.USE_SSL,get_info=ALL) - connection = Connection(server, - settings.LDAP_MASTER_DN, - settings.LDAP_MASTER_PW, auto_bind=True) - connection.search(settings.LDAP_ROOT_DN, - '(&({attr}={login})({filter}))'.format( - attr=settings.LDAP_USER_UID_PREFIX, - login=username, - filter=filterString), attributes=['*']) - - if len(connection.response) == 0: - print('get_LDAP_user-no response') - return None - specificUser = connection.response[0] - userDn = str(specificUser.get('raw_dn'),'utf-8') - userGivenName = connection.entries[0].givenName - userSn = connection.entries[0].sn - userMail = connection.entries[0].mail - with Connection(server, userDn, password) as con: - return username, userGivenName, userSn, userMail - except Exception as e: - print("LDAP Exception: {}".format(e)) - return None - return None - - def authenticate(self, request, username=None, password=None, **kwargs): - if not settings.LDAP_ENABLED: - return None - print("authenticate_ldap") - # Get the user information from the LDAP if he can be authenticated - isAdmin = False - isStaff = False - isTechnician = False - - requeteLdap = self.get_LDAP_user(username, password, settings.LDAP_SEARCH_GROUP_FILTER_ADMINS) - isAdmin = requeteLdap is not None - isStaff = requeteLdap is not None - - if requeteLdap is None: - requeteLdap = self.get_LDAP_user(username, password, settings.LDAP_SEARCH_GROUP_FILTER_STAFF) - isStaff = requeteLdap is not None - - if requeteLdap is None: - requeteLdap = self.get_LDAP_user(username, password, settings.LDAP_SEARCH_GROUP_FILTER_TECHNICIANS) - isTechnician = requeteLdap is not None - - if requeteLdap is None: - requeteLdap = self.get_LDAP_user(username, password, settings.LDAP_SEARCH_GROUP_FILTER_USERS) - - if requeteLdap is None: - print("User does not belong to any search group. Check LDAP_SEARCH_GROUP_FILTER in settings.") - return None - - techniciansGroup = Group.objects.get(name='Technicians') - - try: - user = User.objects.get(username=username) - attributes = UserAttributes.objects.get(user=user) - user.is_staff = isStaff - user.is_superuser = isAdmin - if not isTechnician and user.groups.filter(name='Technicians').exists(): - user.groups.remove(techniciansGroup) - elif isTechnician and not user.groups.filter(name='Technicians').exists(): - user.groups.add(techniciansGroup) - else: - print("The user is already in the Technicians group") - user.save() - # TODO VERIFY - except User.DoesNotExist: - print(f"authenticate-create new user: {username}") - user = User(username=username) - user.first_name = requeteLdap[1] - user.last_name = requeteLdap[2] - user.email = requeteLdap[3] - user.is_active = True - user.is_staff = isStaff - user.is_superuser = isAdmin - user.set_password(uuid.uuid4().hex) - user.save() - if isTechnician: - user.groups.add(techniciansGroup) - maxInstances = 1 - maxCpus = 1 - maxMemory = 128 - maxDiskSize = 1 - if isStaff: - maxMemory = 2048 - maxDiskSize = 20 - permission = Permission.objects.get(codename='clone_instances') - user.user_permissions.add(permission) - if isAdmin: - maxInstances = -1 - maxCpus = -1 - maxMemory = -1 - maxDiskSize = -1 - permission = Permission.objects.get(codename='clone_instances') - user.user_permissions.add(permission) - user.save() - UserAttributes.objects.create( - user=user, - max_instances=maxInstances, - max_cpus=maxCpus, - max_memory=maxMemory, - max_disk_size=maxDiskSize, - ) - user.save() - - print("authenticate-user created") - return user - - def get_user(self, user_id): - if not settings.LDAP_ENABLED: - return None - print("get_user_ldap") - try: - return User.objects.get(pk=user_id) - except User.DoesNotExist: - print("get_user-user not found") - return None -except: - class LdapAuthenticationBackend(ModelBackend): - def authenticate(self, request, username=None, password=None, **kwargs): - return None - def get_user(self, user_id): - return None