def create(self, samaccountname, cn, path, CONSTattributes={}):
""" Create a new account with the specified attributes set.
All 'attributes' are expected to be LDAP attributes except
for attributes['password'] which is properly converted for
AD's unicodePwd field.
:type samaccountname: str
:param samaccountname: Username to create
:type cn: str
:param cn: CN of new account (only the CN=(whatever))
:type path: str
:param path: ldap path of OU for new account
:type CONSTattributes: dict
:param CONSTattributes: A dict of LDAP attributes for the new account.
"""
# Dictionaries are passed by reference, I do not want to
# modify it outside of function scope.
# SRGM - Jun 1, 2010
attributes = dict(CONSTattributes)
if not self.exists(samaccountname):
dn = "CN=%s,%s" % (cn, path)
# The default password is 'changeme'
if 'password' not in attributes:
attributes['password'] = '******'
# Encode password as unicode for AD.
attributes['password'] = unicodePasswd(attributes['password'])
# TODO: Make this more general
userprincipalname = "%s@%s" % (samaccountname, self.LDAP_DOMAIN)
add_record = [
('objectclass', 'user'),
('userPrincipalName', userprincipalname),
('samaccountname', samaccountname),
('cn', cn),
('unicodePwd', attributes['password']),
# This will cause the account to be enabled/"normal"
('userAccountControl', '512'),
#('ou', path)
]
# Any additional attributes?
for i in attributes:
if i != 'password':
entry = (i, attributes[i])
add_record.append(entry)
try:
self.ldap_client.add_s(dn, add_record)
except ldap.CONSTRAINT_VIOLATION, info:
print info
def resetpw_by_objectguid(self, objectGUID, newpass):
""" Perform an administrative password reset. To perform this
reset, the account that was used to bind to ldap must have
permissions in AD to reset the password belonging to
`objectGUID` object. """
self.replace_by_objectguid(objectGUID,
'unicodePwd',
unicodePasswd(newpass))
def resetpw(self, sAMAccountName, newpass):
"""Wraps around L{self.replace()} to reset a given
password.
.. note:: This attempts the administrative reset using the
user this instance used to bind, make sure that it has the
proper AD permissions.
"""
self.replace(sAMAccountName,
'unicodePwd',
unicodePasswd(newpass))
