cwinfo/powerdns-admin
4
0
Fork 0
mirror of https://github.com/cwinfo/powerdns-admin.git synced 2025-06-14 20:16:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Initial support for LDAP group based security.

Browse Source
This commit is contained in:
Ivan Filippov
2016-04-11 06:11:02 -06:00
parent 64531999f6
commit d417cfb8dc
3 changed files with 46 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
app/models.py
View File

@ -19,6 +19,9 @@ LDAP_USERNAME = app.config['LDAP_USERNAME']
LDAP_PASSWORD = app.config['LDAP_PASSWORD']
LDAP_SEARCH_BASE = app.config['LDAP_SEARCH_BASE']
LDAP_TYPE = app.config['LDAP_TYPE']
LDAP_GROUP_SECURITY = app.config['LDAP_GROUP_SECURITY']
LDAP_ADMIN_GROUP = app.config['LDAP_ADMIN_GROUP']
LDAP_USER_GROUP = app.config['LDAP_USER_GROUP']
PDNS_STATS_URL = app.config['PDNS_STATS_URL']
PDNS_API_KEY = app.config['PDNS_API_KEY']
@ -172,6 +175,25 @@ class User(db.Model):
try:
ldap_username = result[0][0][0]
l.simple_bind_s(ldap_username, self.password)
if LDAP_GROUP_SECURITY:
try:
groupSearchFilter = "(&(objectcategory=group)(member=%s))" % ldap_username
groups = self.ldap_search(groupSearchFilter, LDAP_SEARCH_BASE)
allowedlogin = False
isadmin = False
for group in groups:
if (group[0][0] == LDAP_ADMIN_GROUP):
allowedlogin = True
isadmin = True
logging.info('User %s is part of the "%s" group that allows admin access to PowerDNS-Admin' % (self.username,LDAP_ADMIN_GROUP))
if (group[0][0] == LDAP_USER_GROUP):
allowedlogin = True
logging.info('User %s is part of the "%s" group that allows user access to PowerDNS-Admin' % (self.username,LDAP_USER_GROUP))
if allowedlogin == False:
logging.error('User %s is not part of the "%s" or "%s" groups that allow access to PowerDNS-Admin' % (self.username,LDAP_ADMIN_GROUP,LDAP_USER_GROUP))
return False
except:
logging.error('LDAP group lookup for user %s has failed' % self.username)
logging.info('User "%s" logged in successfully' % self.username)
# create user if not exist in the db
@ -185,17 +207,26 @@ class User(db.Model):
self.firstname = self.username
self.lastname = ''
# first register user will be in Administrator role
if User.query.count() == 0:
# first registered user will be in Administrator role or if part of LDAP Admin group
if (User.query.count() == 0):
self.role_id = Role.query.filter_by(name='Administrator').first().id
else:
self.role_id = Role.query.filter_by(name='User').first().id
self.role_id = Role.query.filter_by(name='User').first().id
#
if LDAP_GROUP_SECURITY:
if isadmin == True:
self.role_id = Role.query.filter_by(name='Administrator').first().id
self.create_user()
logging.info('Created user "%s" in the DB' % self.username)
else:
# user already exists in database, set their admin status based on group membership (if enabled)
if LDAP_GROUP_SECURITY:
self.set_admin(isadmin)
return True
except:
logging.error('User "%s" input a wrong password' % self.username)
logging.error('User "%s" input a wrong password(stage2)' % self.username)
return False
else:
logging.error('Unsupported authentication method')