所以我试图在我的活动目录中修改用户。截至目前,我可以作为AD用户登录,但是当我尝试编辑我的配置文件时,它不会在AD中实现。
我将django-auth-ldap
用于AD后端。
我与具有读写权限的用户建立了联系。
AUTH_LDAP_SERVER_URI = "ldap://192.168.1.12"
AUTH_LDAP_BIND_DN = "user"
AUTH_LDAP_BIND_PASSWORD = "password"
AUTH_LDAP_CONNECTION_OPTIONS = {
ldap.OPT_DEBUG_LEVEL: 1,
ldap.OPT_REFERRALS: 0
}
AUTH_LDAP_USER_SEARCH = LDAPSearch("DC=sb,DC=ch", ldap.SCOPE_SUBTREE, "(sAMAccountName=%(user)s)")
# Set up the basic group parameters.
AUTH_LDAP_GROUP_SEARCH = LDAPSearch("DC=sb,DC=ch", ldap.SCOPE_SUBTREE, "(objectClass=group)")
AUTH_LDAP_GROUP_TYPE = NestedActiveDirectoryGroupType()
# What to do once the user is authenticated
AUTH_LDAP_USER_ATTR_MAP = {
"first_name": "givenName",
"last_name": "sn",
"email": "mail"
}
AUTH_LDAP_USER_FLAGS_BY_GROUP = {
"is_active": "CN=ipa-users,cn=users,DC=sb,DC=ch",
"is_staff": "CN=ipa-users,cn=users,DC=sb,DC=ch",
"is_superuser": "CN=ipa-users,cn=users,DC=sb,DC=ch"
}
# This is the default, but be explicit.
AUTH_LDAP_ALWAYS_UPDATE_USER = True
# Use LDAP group membership to calculate group permissions.
AUTH_LDAP_FIND_GROUP_PERMS = True
# Cache settings
AUTH_LDAP_CACHE_GROUPS = True
AUTH_LDAP_GROUP_CACHE_TIMEOUT = 3600
AUTHENTICATION_BACKENDS = (
'django_auth_ldap.backend.LDAPBackend',
'django.contrib.auth.backends.ModelBackend',
)
那么我需要设置或获取任何内容的地方和地点?
这是我的edit_profile.html:
<form method="post">
{% csrf_token %}
<label for="first_name">Vorname </label>
<input style="margin-bottom: 1em;" id="first_name" class="form-control" type="text" name="first_name" value="{{ user.first_name }}"><br>
<label for="last_name">Nachname </label>
<input style=" margin-bottom: 1em;" id="last_name" class="form-control" type="text" name="last_name" value="{{ user.last_name }}"><br>
<label for="email">E-Mail </label>
<input style="margin-bottom: 1em;" id="email" class="form-control" type="email" required=True unique=True name="email" value="{{ user.email }}"><br>
<button class="btn btn-success btn-sm" type="submit">Bestätigen</button>
答案 0 :(得分:3)
django-auth-ldap
粗略猜测表明您正在使用django-auth-ldap
(我更新了您的问题)。一眼就可以看出它只有一个后端,不能做任何事情。
如果您确实想要更新AD中的某些数据,则需要自行完成。我使用python-ldap3我可以为此目的推荐。它还包括一些专门针对AD的助手。
python-ldap3
类似的东西,不确定下面的代码是否有效(它是现有代码的混搭)。但它应该让你知道你应该做什么。欢迎来到LDAP的地狱。
import ldap3
conn = ldap3.Connection(
server="ldaps://foobar",
user="username@domain", # normally full DN, but AD supports this format as well
password="password",
auto_bind=ldap3.AUTO_BIND_NONE,
authentication=ldap3.SIMPLE,
raise_exceptions=True,
auto_referrals=False, # 90% you want it set to False
receive_timeout=10, # seconds, exception afterwards
)
conn.start_tls()
conn.bind()
search = conn.extend.standard.paged_search(
search_base="dc=domain",
search_filter="(userPrincipalName=username@domain)", # or (cn=username) or (sAMAccountName=username) or whatever
search_scope=ldap3.SUBTREE,
attributes=ldap3.ALL_ATTRIBUTES,
dereference_aliases=ldap3.DEREF_NEVER,
generator=True,
)
entries = [entry for entry in search if entry["type"] == "searchResEntry"] # not sure how to get rid of all the aliases otherwise
assert len(entries) is 1, "got {0} entries".format(len(entries))
entry = entries[0]
dn = entry["dn"]
changes = {
"attributeName": [
[ldap3.MODIFY_DELETE, ["old value 1", "old value 2",]],
[ldap3.MODIFY_ADD, ["a new value"]],
]
}
conn.modify(dn, changes)
conn.unbind()
答案 1 :(得分:0)
不是不可能,但并不容易。
首先,您需要对用户进行身份验证或在LDAP中找到他。示例:
user = authenticate(
username=request.user.username,
password=request.POST['password']
)
现在,用户拥有request.user
对象没有的某些属性,例如ldap_user
。此属性可用于修改密码,例如:
# remember to add: import ldap.modlist as modlist
pwd = "new password"
ldif = modlist.modifyModlist(
{'userpassword': user.ldap_user.attrs['userpassword']},
{'userpassword': [pwd.encode()]}
)
user.ldap_user.connection.modify_s(user.ldap_user.dn, ldif)
就是这样。