Question

我的Django应用程序正在使用python-ldap库（ldap_groups django应用程序），并且必须在Windows 2003虚拟机域上针对Active Directory添加用户。我在Ubuntu虚拟机上运行的应用程序不是Windows域的成员。

以下是代码：

settings.py

DNS_NAME='IP_ADRESS'

LDAP_PORT=389
LDAP_URL='ldap://%s:%s' % (DNS_NAME,LDAP_PORT)
BIND_USER='cn=administrateur,cn=users,dc=my,dc=domain,dc=fr'
BIND_PASSWORD="AdminPassword"

SEARCH_DN='cn=users,dc=my,dc=domain,dc=fr'
NT4_DOMAIN='E2C'
SEARCH_FIELDS= ['mail','givenName','sn','sAMAccountName','memberOf']
MEMBERSHIP_REQ=['Group_Required','Alternative_Group']

AUTHENTICATION_BACKENDS  = (

    'ldap_groups.accounts.backends.ActiveDirectoryGroupMembershipSSLBackend',
    'django.contrib.auth.backends.ModelBackend',
)

DEBUG=True
DEBUG_FILE='/$HOME/ldap.debug'

backends.py

import ldap
import ldap.modlist as modlist

username, email, password = kwargs['username'], kwargs['email'], kwargs['password1']

ldap.set_option(ldap.OPT_REFERRALS, 0)

# Open a connection
l = ldap.initialize(settings.LDAP_URL)

# Bind/authenticate with a user with apropriate rights to add objects
l.simple_bind_s(settings.BIND_USER,settings.BIND_PASSWORD)

# The dn of our new entry/object
dn="cn=%s,%s" % (username,settings.SEARCH_DN)


# A dict to help build the "body" of the object
attrs = {}
attrs['objectclass'] = ['top','organizationalRole','simpleSecurityObject']
attrs['cn'] = username.encode('utf-16')
attrs['userPassword'] = password.encode('utf-16')
attrs['description'] = 'User object for replication using slurpd'

# Convert our dict to nice syntax for the add-function using modlist-module
ldif = modlist.addModlist(attrs)

# Do the actual synchronous add-operation to the ldapserver
l.add_s(dn,ldif)

# Its nice to the server to disconnect and free resources when done
l.unbind_s()

当我追踪我的代码时，似乎在添加用户调用“l.add_s”时出现问题。

但是它返回以下错误：

UNWILLING_TO_PERFORM at /accounts/register/

{'info': '00002077: SvcErr: DSID-031907B4, problem 5003 (WILL_NOT_PERFORM), data 0\n', 'desc': 'Server is unwilling to perform'}

如果我使用了错误的凭据，服务器将返回INVALID CREDENTIAL，因此我认为上面使用的凭据在ldap目录上绑定是正确的。

Pehaps我的Ubuntu应该是域的成员还是我的代码有问题？

Answer 1

我发现了问题。实际上我的objectclass不符合Active Directory。此外，通过python字符串更改信息编码。

以下是要使用的代码：

 attrs = {}
        attrs['objectclass'] = ['top','person','organizationalPerson','user']
        attrs['cn'] = str(username)
        attrs['userPassword'] = str(password)
        attrs['mail']=str(email)
        attrs['givenName']=str(firstname)
        attrs['sn']=str(surname)
        attrs['description'] = 'User object for replication using slurpd'

我可以在Active Directory中成功添加帐户。

希望它会对你有所帮助。

ldap引发了一个UNWILLING TO PERFORM错误

1 个答案: