initial commit
This commit is contained in:
commit
602127cbdc
GPG key ID:
12E3D2136B818350
7 changed files with 353 additions and 0 deletions
3
.gitignore
vendored
Normal file
3
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,3 @@
|
||||||
|
.venv/
|
||||||
|
*.pyc
|
||||||
|
config.json
|
||||||
84
ldap_frontend/__init__.py
Normal file
84
ldap_frontend/__init__.py
Normal file
|
|
@ -0,0 +1,84 @@
|
||||||
|
from json import load
|
||||||
|
from os import environ
|
||||||
|
|
||||||
|
from flask import Flask, flash, redirect, request, session, url_for
|
||||||
|
from ldap3.core.exceptions import LDAPException
|
||||||
|
|
||||||
|
from .helpers.ldap import login_required, try_auth, get_user, template, update_user
|
||||||
|
|
||||||
|
app = Flask(__name__)
|
||||||
|
app.secret_key = environ.get("FLASK_SECRET_KEY", default="test")
|
||||||
|
|
||||||
|
with open(environ["APP_CONFIG"]) as f:
|
||||||
|
APP_CONFIG = load(f)
|
||||||
|
|
||||||
|
|
||||||
|
@app.route("/")
|
||||||
|
def slash():
|
||||||
|
return redirect(url_for("login"))
|
||||||
|
|
||||||
|
|
||||||
|
@app.route("/login", methods=["GET", "POST"])
|
||||||
|
def login():
|
||||||
|
session["is_logged_in"] = False
|
||||||
|
|
||||||
|
if request.method == "POST":
|
||||||
|
if try_auth(
|
||||||
|
request.form["username"],
|
||||||
|
request.form["password"],
|
||||||
|
):
|
||||||
|
session["is_logged_in"] = True
|
||||||
|
session["username"] = request.form["username"]
|
||||||
|
session["password"] = request.form["password"]
|
||||||
|
|
||||||
|
flash("logged in")
|
||||||
|
|
||||||
|
return redirect(url_for("selfservice"))
|
||||||
|
else:
|
||||||
|
flash("username or password is wrong")
|
||||||
|
|
||||||
|
return template(None, "login.html")
|
||||||
|
|
||||||
|
|
||||||
|
@app.route("/logout")
|
||||||
|
def logout():
|
||||||
|
session["is_logged_in"] = False
|
||||||
|
session["username"] = ""
|
||||||
|
session["password"] = ""
|
||||||
|
|
||||||
|
flash("logged out")
|
||||||
|
|
||||||
|
return redirect(url_for("login"))
|
||||||
|
|
||||||
|
|
||||||
|
@app.route("/selfservice", methods=["GET", "POST"])
|
||||||
|
@login_required
|
||||||
|
def selfservice(ldap):
|
||||||
|
if request.method == "POST":
|
||||||
|
try:
|
||||||
|
update_user(
|
||||||
|
ldap,
|
||||||
|
session["username"],
|
||||||
|
{
|
||||||
|
"givenName": request.form["givenName"],
|
||||||
|
"sn": request.form["sn"],
|
||||||
|
"cn": "{} {}".format(
|
||||||
|
request.form["givenName"],
|
||||||
|
request.form["sn"],
|
||||||
|
),
|
||||||
|
"mail": request.form["mail"]
|
||||||
|
},
|
||||||
|
)
|
||||||
|
flash("data updated")
|
||||||
|
return redirect(url_for("selfservice"))
|
||||||
|
except LDAPException as e:
|
||||||
|
app.logger.error(
|
||||||
|
"Updating {} failed: {}\n{}".format(
|
||||||
|
APP_CONFIG["template"]["user_dn"].format(session["username"]),
|
||||||
|
repr(e),
|
||||||
|
repr(request.form),
|
||||||
|
),
|
||||||
|
)
|
||||||
|
flash(e)
|
||||||
|
|
||||||
|
return template(ldap, "selfservice.html")
|
||||||
117
ldap_frontend/helpers/ldap.py
Normal file
117
ldap_frontend/helpers/ldap.py
Normal file
|
|
@ -0,0 +1,117 @@
|
||||||
|
from functools import wraps
|
||||||
|
from json import load
|
||||||
|
from os import environ
|
||||||
|
|
||||||
|
from flask import redirect, session, url_for, render_template
|
||||||
|
from ldap3 import ALL, Connection, Server
|
||||||
|
from ldap3 import ALL_ATTRIBUTES, MODIFY_REPLACE
|
||||||
|
from ldap3.core.exceptions import LDAPException
|
||||||
|
|
||||||
|
with open(environ["APP_CONFIG"]) as f:
|
||||||
|
APP_CONFIG = load(f)
|
||||||
|
|
||||||
|
|
||||||
|
def login_required(func):
|
||||||
|
@wraps(func)
|
||||||
|
def wrapper(*args, **kwargs):
|
||||||
|
if session["is_logged_in"]:
|
||||||
|
if try_auth(
|
||||||
|
session["username"],
|
||||||
|
session["password"],
|
||||||
|
):
|
||||||
|
ldap = connect()
|
||||||
|
|
||||||
|
return func(ldap, *args, **kwargs)
|
||||||
|
else:
|
||||||
|
return redirect(url_for("login"))
|
||||||
|
else:
|
||||||
|
return redirect(url_for("login"))
|
||||||
|
|
||||||
|
return wrapper
|
||||||
|
|
||||||
|
|
||||||
|
def admin_required(func):
|
||||||
|
@wraps(func)
|
||||||
|
@login_required
|
||||||
|
def wrapper(*args, **kwargs):
|
||||||
|
if session["is_logged_in"]:
|
||||||
|
if try_auth(
|
||||||
|
session["username"],
|
||||||
|
session["password"],
|
||||||
|
):
|
||||||
|
ldap = connect()
|
||||||
|
|
||||||
|
return func(ldap, *args, **kwargs)
|
||||||
|
else:
|
||||||
|
return redirect(url_for("login"))
|
||||||
|
else:
|
||||||
|
return redirect(url_for("login"))
|
||||||
|
|
||||||
|
return wrapper
|
||||||
|
|
||||||
|
|
||||||
|
def try_auth(user, password):
|
||||||
|
try:
|
||||||
|
connect(
|
||||||
|
user=APP_CONFIG["template"]["user_dn"].format(user),
|
||||||
|
password=password,
|
||||||
|
)
|
||||||
|
return True
|
||||||
|
except LDAPException:
|
||||||
|
return False
|
||||||
|
|
||||||
|
|
||||||
|
def connect(user=None, password=None):
|
||||||
|
server = Server(APP_CONFIG["ldap"]["server"])
|
||||||
|
|
||||||
|
if not user and not password:
|
||||||
|
user = APP_CONFIG["ldap"]["username"]
|
||||||
|
password = APP_CONFIG["ldap"]["password"]
|
||||||
|
|
||||||
|
conn = Connection(
|
||||||
|
server,
|
||||||
|
user=user,
|
||||||
|
password=password,
|
||||||
|
)
|
||||||
|
conn.bind()
|
||||||
|
|
||||||
|
return conn
|
||||||
|
|
||||||
|
|
||||||
|
def get_user(ldap, username):
|
||||||
|
ldap.search(
|
||||||
|
APP_CONFIG["ldap"]["user_base"],
|
||||||
|
APP_CONFIG["template"]["user_search"].format(username),
|
||||||
|
attributes=ALL_ATTRIBUTES,
|
||||||
|
)
|
||||||
|
if len(ldap.entries) == 1:
|
||||||
|
return ldap.entries[0]
|
||||||
|
else:
|
||||||
|
raise UserNotFoundException(username)
|
||||||
|
|
||||||
|
def update_user(ldap, username, settings):
|
||||||
|
attrs = {}
|
||||||
|
for attr, value in settings.items():
|
||||||
|
attrs[attr] = [(MODIFY_REPLACE, value)]
|
||||||
|
|
||||||
|
return ldap.modify(
|
||||||
|
APP_CONFIG["template"]["user_dn"].format(username),
|
||||||
|
attrs,
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
def template(ldap, name, **kwargs):
|
||||||
|
user = None
|
||||||
|
if ldap:
|
||||||
|
user = get_user(ldap, session["username"])
|
||||||
|
|
||||||
|
return render_template(
|
||||||
|
name,
|
||||||
|
APP_CONFIG=APP_CONFIG,
|
||||||
|
CURRENT_USER=user,
|
||||||
|
**kwargs,
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
class UserNotFoundException(Exception):
|
||||||
|
pass
|
||||||
44
ldap_frontend/templates/layout/default.html
Normal file
44
ldap_frontend/templates/layout/default.html
Normal file
|
|
@ -0,0 +1,44 @@
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<title>{% block title %}LDAP{% endblock %} | {{ APP_CONFIG["title"] }}</title>
|
||||||
|
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||||
|
|
||||||
|
<!-- FIXME deploy CSS/JS locally -->
|
||||||
|
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous">
|
||||||
|
<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js" integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p" crossorigin="anonymous"></script>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
{% if session.is_logged_in %}
|
||||||
|
<nav class="navbar navbar-expand-lg navbar-light bg-light">
|
||||||
|
<div class="container-fluid">
|
||||||
|
<span class="navbar-brand">{{ APP_CONFIG["title"] }}</span>
|
||||||
|
<button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarSupportedContent" aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
|
||||||
|
<span class="navbar-toggler-icon"></span>
|
||||||
|
</button>
|
||||||
|
<div class="collapse navbar-collapse" id="navbarSupportedContent">
|
||||||
|
<ul class="navbar-nav me-auto mb-2 mb-lg-0">
|
||||||
|
<li class="nav-item">
|
||||||
|
<a class="nav-link" href="{{ url_for("selfservice") }}">self service</a>
|
||||||
|
</li>
|
||||||
|
<li class="nav-item">
|
||||||
|
<a class="nav-link" href="#">groups</a>
|
||||||
|
</li>
|
||||||
|
</ul>
|
||||||
|
<span class="navbar-text navbar-right">Signed in as <em>{{ CURRENT_USER["uid"] }}</em> - <a href="{{ url_for("logout") }}">logout</a></span>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</nav>
|
||||||
|
{% endif %}
|
||||||
|
<div class="container-md p-3">
|
||||||
|
{% for message in get_flashed_messages() %}
|
||||||
|
<div class="alert alert-primary" role="alert">
|
||||||
|
{{ message }}
|
||||||
|
</div>
|
||||||
|
{% endfor %}
|
||||||
|
{% block content %}
|
||||||
|
{% endblock %}
|
||||||
|
</div>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
20
ldap_frontend/templates/login.html
Normal file
20
ldap_frontend/templates/login.html
Normal file
|
|
@ -0,0 +1,20 @@
|
||||||
|
{% extends "layout/default.html" %}
|
||||||
|
{% block content %}
|
||||||
|
<form action="{{ url_for("login") }}" method="post">
|
||||||
|
<fieldset>
|
||||||
|
<legend>Login</legend>
|
||||||
|
|
||||||
|
<div class="mb-3">
|
||||||
|
<label for="username" class="form-label">Username</label>
|
||||||
|
<input type="text" name="username" id="username" required class="form-control">
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="mb-3">
|
||||||
|
<label for="password" class="form-label">Password</label>
|
||||||
|
<input type="password" name="password" id="password" required class="form-control">
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<input type="submit" value="Login" class="btn btn-primary mb-3">
|
||||||
|
</fieldset>
|
||||||
|
</form>
|
||||||
|
{% endblock %}
|
||||||
77
ldap_frontend/templates/selfservice.html
Normal file
77
ldap_frontend/templates/selfservice.html
Normal file
|
|
@ -0,0 +1,77 @@
|
||||||
|
{% extends "layout/default.html" %}
|
||||||
|
{% block title %}self service{% endblock %}
|
||||||
|
{% block content %}
|
||||||
|
<form action="{{ url_for("selfservice") }}" method="post" class="row g-3 needs-validation">
|
||||||
|
<fieldset>
|
||||||
|
<legend>user data</legend>
|
||||||
|
|
||||||
|
<div class="row mb-3">
|
||||||
|
<label for="uid" class="form-label col-sm-2">uid</label>
|
||||||
|
<div class="col-sm-10">
|
||||||
|
<input type="text" name="uid" id="uid" value="{{ CURRENT_USER["uid"]|e }}" disabled readonly class="form-control" aria-describedby="uidHelp">
|
||||||
|
<div id="uidHelp" class="form-text">contact an administrator if you want to change this</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="row mb-3">
|
||||||
|
<label for="cn" class="form-label col-sm-2">common name</label>
|
||||||
|
<div class="col-sm-10">
|
||||||
|
<input type="text" name="cn" id="cn" value="{{ CURRENT_USER["cn"]|e }}" disabled readonly class="form-control" aria-describedby="cnHelp">
|
||||||
|
<div id="cnHelp" class="form-text">gets adjusted automatically</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="row mb-3">
|
||||||
|
<label for="sn" class="form-label col-sm-2">surname</label>
|
||||||
|
<div class="col-sm-10">
|
||||||
|
<input type="text" name="sn" id="sn" value="{{ CURRENT_USER["sn"]|e }}" required class="form-control">
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="row mb-3">
|
||||||
|
<label for="givenName" class="form-label col-sm-2">given name</label>
|
||||||
|
<div class="col-sm-10">
|
||||||
|
<input type="text" name="givenName" id="givenName" value="{{ CURRENT_USER["givenName"]|e }}" required class="form-control">
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="row mb-3">
|
||||||
|
<label for="mail" class="form-label col-sm-2">email address</label>
|
||||||
|
<div class="col-sm-10">
|
||||||
|
<input type="email" name="mail" id="mail" value="{{ CURRENT_USER["mail"]|e }}" required class="form-control">
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<input type="submit" value="update" class="btn btn-primary mb-3"><br>
|
||||||
|
</fieldset>
|
||||||
|
</form>
|
||||||
|
|
||||||
|
<form action="{{ url_for("selfservice") }}" method="post">
|
||||||
|
<fieldset>
|
||||||
|
<legend>password</legend>
|
||||||
|
|
||||||
|
<div class="row mb-3">
|
||||||
|
<label for="current" class="form-label col-sm-2">current password</label>
|
||||||
|
<div class="col-sm-10">
|
||||||
|
<input type="password" name="current" id="current" value="" class="form-control">
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="row mb-3">
|
||||||
|
<label for="new" class="form-label col-sm-2">new password</label>
|
||||||
|
<div class="col-sm-10">
|
||||||
|
<input type="password" name="new" id="new" value="" class="form-control">
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="row mb-3">
|
||||||
|
<label for="repeat" class="form-label col-sm-2">repeat new password</label>
|
||||||
|
<div class="col-sm-10">
|
||||||
|
<input type="password" name="repeat" id="repeat" value="" class="form-control">
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<input type="submit" value="change password" class="btn btn-primary mb-3"><br>
|
||||||
|
</fieldset>
|
||||||
|
</form>
|
||||||
|
{% endblock %}
|
||||||
8
requirements.txt
Normal file
8
requirements.txt
Normal file
|
|
@ -0,0 +1,8 @@
|
||||||
|
click==8.0.3
|
||||||
|
Flask==2.0.2
|
||||||
|
itsdangerous==2.0.1
|
||||||
|
Jinja2==3.0.3
|
||||||
|
ldap3==2.9.1
|
||||||
|
MarkupSafe==2.0.1
|
||||||
|
pyasn1==0.4.8
|
||||||
|
Werkzeug==2.0.2
|
||||||
Loading…
Reference in a new issue