LDAP Servers

An LDAP directory information tree (DIT) is a highly specialized database with entries arranged in a tree-like structure.

File-System LDAP DIT

A minimal LDAP DIT that stores entries in the local file system

Code

First, a module that defines our DIT entries– schema.py

COUNTRY = (
    "dc=fr",
    {
        "objectClass": ["dcObject", "country"],
        "dc": ["fr"],
        "description": ["French country 2 letters iso description"],
    },
)
COMPANY = (
    "dc=example",
    {
        "objectClass": ["dcObject", "organization"],
        "dc": ["example"],
        "description": ["My organisation"],
        "o": ["Example, Inc"],
    },
)
PEOPLE = (
    "ou=people",
    {
        "ou": ["people"],
        "description": ["People from Example Inc"],
        "objectclass": ["organizationalunit"],
    },
)
USERS = [
    (
        "uid=yoen",
        {
            "objectClass": ["people", "inetOrgPerson"],
            "cn": ["Yoen Van der Weld"],
            "sn": ["Van der Weld"],
            "givenName": ["Yoen"],
            "uid": ["yoen"],
            "mail": ["/home/yoen/mailDir"],
            "userPassword": ["secret"],
        },
    ),
    (
        "uid=esteban",
        {
            "objectClass": ["people", "inetOrgPerson"],
            "cn": ["Esteban Garcia Marquez"],
            "sn": ["Garcia Marquez"],
            "givenName": ["Esteban"],
            "uid": ["esteban"],
            "mail": ["/home/esteban/mailDir"],
            "userPassword": ["secret2"],
        },
    ),
    (
        "uid=mohamed",
        {
            "objectClass": ["people", "inetOrgPerson"],
            "cn": ["Mohamed Al Ghâlib"],
            "sn": ["Al Ghâlib"],
            "givenName": ["mohamed"],
            "uid": ["mohamed"],
            "mail": ["/home/mohamed/mailDir"],
            "userPassword": ["secret3"],
        },
    ),
]

Next, the server code– ldaptor_basic.py

#! /usr/bin/env python

"""
Testing a simple ldaptor ldap server
Base on an example by Gaston TJEBBES aka "tonthon":
http://tonthon.blogspot.com/2011/02/ldaptor-ldap-with-twisted-server-side.html
"""

import tempfile, sys

from twisted.application import service
from twisted.internet import reactor
from twisted.internet.protocol import ServerFactory
from twisted.python.components import registerAdapter
from twisted.python import log
from ldaptor.interfaces import IConnectedLDAPEntry
from ldaptor.protocols.ldap.ldapserver import LDAPServer
from ldaptor.ldiftree import LDIFTreeEntry

from schema import COUNTRY, COMPANY, PEOPLE, USERS


class Tree:
    def __init__(self):
        dirname = tempfile.mkdtemp(".ldap", "test-server", "/tmp")
        self.db = LDIFTreeEntry(dirname)
        self.init_db()

    def init_db(self):
        """
        Add subtrees to the top entry
        top->country->company->people
        """
        country = self.db.addChild(COUNTRY[0], COUNTRY[1])
        company = country.addChild(COMPANY[0], COMPANY[1])
        people = company.addChild(PEOPLE[0], PEOPLE[1])
        for user in USERS:
            people.addChild(user[0], user[1])


class LDAPServerFactory(ServerFactory):
    """
    Our Factory is meant to persistently store the ldap tree
    """

    protocol = LDAPServer

    def __init__(self, root):
        self.root = root

    def buildProtocol(self, addr):
        proto = self.protocol()
        proto.debug = self.debug
        proto.factory = self
        return proto


if __name__ == "__main__":
    if len(sys.argv) == 2:
        port = int(sys.argv[1])
    else:
        port = 8080
    # First of all, to show logging info in stdout :
    log.startLogging(sys.stderr)
    # We initialize our tree
    tree = Tree()
    # When the ldap protocol handle the ldap tree,
    # it retrieves it from the factory adapting
    # the factory to the IConnectedLDAPEntry interface
    # So we need to register an adapter for our factory
    # to match the IConnectedLDAPEntry
    registerAdapter(lambda x: x.root, LDAPServerFactory, IConnectedLDAPEntry)
    # Run it !!
    factory = LDAPServerFactory(tree.db)
    factory.debug = True
    application = service.Application("ldaptor-server")
    myService = service.IServiceCollection(application)
    reactor.listenTCP(port, factory)
    reactor.run()

LDAP Server which allows BIND with UPN

The LDAP server implemented by Microsoft Active Directory allows using the UPN as the BIND DN.

It is possible to implement something similar using ldaptor.

Below is a proof-of-concept implementation, which should not be used for production as it has an heuristic method for detecting which BIND DN is an UPN.

handle_LDAPBindRequest is the method called when a BIND request is received.

"""
An ldaptor LDAP server which can authenticate based on UPN, as AD does.

The LDAP entry needs to have the ``userPrincipalName`` attribute set:

    dn: uid=bob,ou=people,dc=example,dc=org
    objectclass: top
    objectclass: person
    objectClass: inetOrgPerson
    uid: bob
    cn: bobby
    gn: Bob
    sn: Roberts
    mail: bob@example.org
    homeDirectory: e:\\Users\\bob
    userPassword: pass
    userPrincipalName: bob@ad.example.org

A UPN bind arrives as ``User.Name@ad.example.tld`` in the BIND DN slot
rather than a normal distinguished name. This server intercepts the BIND
request, looks up the entry whose ``userPrincipalName`` matches, and
rewrites the request's DN to that entry's real DN before delegating to
the stock :class:`LDAPServer` bind handler. Non-UPN BIND requests are
forwarded unchanged.
"""

from ldaptor import interfaces
from ldaptor.protocols import pureldap
from twisted.internet import defer
from ldaptor.protocols.ldap.ldapserver import LDAPServer


class LDAPServerWithUPNBind(LDAPServer):
    """
    An LDAP server which supports BIND using a UPN (User Principal Name),
    similar to Active Directory.
    """

    _loginAttribute = b"userPrincipalName"

    @defer.inlineCallbacks
    def handle_LDAPBindRequest(self, request, *args, **kwargs):
        resolved = yield self._resolveUPNBindDN(request)
        result = yield super().handle_LDAPBindRequest(resolved, *args, **kwargs)
        return result

    @defer.inlineCallbacks
    def _resolveUPNBindDN(self, request):
        """
        If ``request`` looks like a UPN bind, resolve it to a real BIND DN.

        A UPN takes the form ``User.Name@ad.example.tld``: it contains an
        ``@`` but no ``,``, so it is not a valid distinguished name. When
        the shape matches, search the directory for the entry whose
        ``userPrincipalName`` matches and return a rewritten
        :class:`LDAPBindRequest` targeting that entry's DN. Otherwise
        return ``request`` unchanged so the caller can fall through to the
        normal DN-based bind path.
        """
        if b"@" not in request.dn or b"," in request.dn:
            # Not a UPN request; leave the DN alone.
            return request

        root = interfaces.IConnectedLDAPEntry(self.factory)
        filter_text = b"(" + self._loginAttribute + b"=" + request.dn + b")"
        results = yield root.search(filterText=filter_text)

        if len(results) != 1:
            # No unambiguous UPN match; fall through to the requested BIND
            # DN and let the stock handler reject it as usual.
            return request

        return pureldap.LDAPBindRequest(
            version=request.version,
            dn=results[0].dn.getText(),
            auth=request.auth,
            tag=request.tag,
            sasl=request.sasl,
        )