예제 #1
0
    def handle(self, *args, **options):
        for opt, value in settings.AUTH_LDAP_GLOBAL_OPTIONS.items():
            ldap.set_option(opt, value)

        query = ldap.initialize(
            settings.AUTH_LDAP_SERVER_URI)  # Set connection URI
        query.bind_s(
            settings.AUTH_LDAP_BIND_DN,
            settings.AUTH_LDAP_BIND_PASSWORD)  # Define user credentials

        # Get only user objects from the given DN
        results = query.search_s(settings.AUTH_LDAP_USER_DN,
                                 ldap.SCOPE_SUBTREE, "(objectClass=User)")

        total_created = 0
        total_demoted = 0
        users_found = []

        for a, r in results:
            # Get the username and pass it to the django-ldap-auth function.
            # This results another ldap query but this way we don't need to handle the saving and attribute mappings
            # It also handles group mirroring and assignment
            username = r["sAMAccountName"][0].decode(
                "utf-8"
            )  # returns bytes by default so we need to decode to string
            user = LDAPBackend().populate_user(username)

            # If the user was created in the last minute count it as new user.
            if user is None:
                raise Exception(f"No user named {username}")
            else:
                users_found.append(username)
                if user.date_joined > localtime() - timedelta(minutes=1):
                    total_created += 1

        # Demote users who have staff or admin privileges but were not found in AD
        for user in User.objects.filter(
                Q(is_superuser=True)
                | Q(is_staff=True)).exclude(username__in=users_found):
            user.is_superuser = False
            user.is_staff = False
            user.groups.clear()
            user.save()  # Save modifications
            total_demoted += 1
            logging.warning(
                f"{user.get_full_name()} ({user.username}) has been demoted.")

        self.stdout.write(
            self.style.SUCCESS(
                f"Found {len(users_found)} user(s), {total_created} new, {total_demoted} demoted."
            ))