import hashlib import random import base64 from ldap3 import Server, Connection, ObjectDef, Reader, ALL class LdapManager: def __init__(self, server, admin_dn, admin_password): self.server = Server(server, get_info=ALL) self.conn = Connection(server, admin_dn, admin_password, auto_bind=True) self.person_obj_def = ObjectDef('inetOrgPerson', self.conn) def get(self, query=None, search_base='dc=ungleich,dc=ch'): kwargs = { 'connection': self.conn, 'object_def': self.person_obj_def, 'base': search_base, } if query: kwargs['query'] = query r = Reader(**kwargs) return r.search() def is_password_valid(self, email, password, **kwargs): entries = self.get(query='(mail={})'.format(email), **kwargs) if entries: password_in_ldap = entries[0].userPassword.value return self._check_password(password_in_ldap, password) return False @staticmethod def _check_password(tagged_digest_salt, password): digest_salt_b64 = tagged_digest_salt[6:] digest_salt = base64.decodebytes(digest_salt_b64) digest = digest_salt[:20] salt = digest_salt[20:] sha = hashlib.sha1(password.encode('utf-8')) sha.update(salt) return digest == sha.digest() @staticmethod def ssha_password(password): """ Apply the SSHA password hashing scheme to the given *password*. *password* must be a :class:`bytes` object, containing the utf-8 encoded password. Return a :class:`bytes` object containing ``ascii``-compatible data which can be used as LDAP value, e.g. after armoring it once more using base64 or decoding it to unicode from ``ascii``. """ SALT_BYTES = 15 sha1 = hashlib.sha1() salt = random.SystemRandom().getrandbits(SALT_BYTES * 8).to_bytes(SALT_BYTES, 'little') sha1.update(password) sha1.update(salt) digest = sha1.digest() passwd = b'{SSHA}' + base64.b64encode(digest + salt) return passwd