Python通过LDAP验证、查找用户（class,logging）

定义一个类，用于初始化ldap连接，验证、查找用户等功能

# -*- coding: UTF-8 -*-
import sys
reload(sys)
sys.setdefaultencoding('utf-8') 

import ldap,logging,time
logfile = 'e:\\a.txt'
# logging.basicConfig(filename=logfile,level=logging.INFO)
# logging.basicConfig(format='%(time.asctime)s %(message)s', datefmt='%m/%d/%Y %I:%M:%S %p')
logging.basicConfig(level=logging.INFO,
                    #format='%(asctime)s %(filename)s[line:%(lineno)d] %(levelname)s %(message)s', #返回值：Thu, 26 May 2016 15:09:31 t11.py[line:92] INFO
                    format='%(asctime)s %(levelname)s %(message)s',
                    #datefmt='%a, %d %b %Y %H:%M:%S',
                    #datefmt='%Y/%m/%d %I:%M:%S %p', #返回2016/05/26 03:12:56 PM
                    datefmt='%Y-%m-%d %H:%M:%S', #返回2016/05/26 03:12:56 PM
                    filename=logfile#,
                    #filemode='a' #默认为a
                   )
#logging输出结果：
#2016-05-26 15:22:29 INFO liu1 valid passed.
#2016-05-26 15:22:37 INFO liu1 valid passed.

class ldapc:
    def __init__(self,ldap_path,baseDN,domainname,ldap_authuser,ldap_authpass):
        self.baseDN = baseDN
        self.ldap_error = None
        ldap_authduser = '%s\%s' %(domainname,ldap_authuser)
        self.l=ldap.initialize(ldap_path)
        self.l.protocol_version = ldap.VERSION3
        try:
            self.l.simple_bind_s(ldap_authduser,ldap_authpass)
        except ldap.LDAPError,err:
            self.ldap_error = 'Connect to %s failed, Error:%s.' %(ldap_path,err.message['desc'])
            print self.ldap_error
        # finally:
        #     self.l.unbind_s()
        #     del self.l

    def search_users(self,username): #模糊查找，返回一个list，使用search_s()
        if self.ldap_error is None:
            try:
                searchScope = ldap.SCOPE_SUBTREE
                searchFiltername = "sAMAccountName" #通过samaccountname查找用户
                retrieveAttributes = None
                searchFilter = '(' + searchFiltername + "=" + username +'*)'
                ldap_result =self.l.search_s(self.baseDN, searchScope, searchFilter, retrieveAttributes)
                if len(ldap_result) == 0: #ldap_result is a list.
                    return "%s doesn't exist." %username
                else:
                    # result_type, result_data = self.l.result(ldap_result, 0)
                    # return result_type, ldap_result
                    return ldap_result
            except ldap.LDAPError,err:
                return err

    def search_user(self,username): #精确查找，返回值为list，使用search()
        if self.ldap_error is None:
            try:
                searchScope = ldap.SCOPE_SUBTREE
                searchFiltername = "sAMAccountName" #通过samaccountname查找用户
                retrieveAttributes = None
                searchFilter = '(' + searchFiltername + "=" + username +')'
                ldap_result_id =self.l.search(self.baseDN, searchScope, searchFilter, retrieveAttributes)
                result_type, result_data = self.l.result(ldap_result_id, 0)
                if result_type == ldap.RES_SEARCH_ENTRY:
                    return result_data
                else:
                    return "%s doesn't exist." %username
            except ldap.LDAPError,err:
                return err

    def search_userDN(self,username): #精确查找，最后返回该用户的DN值
        if self.ldap_error is None:
            try:
                searchScope = ldap.SCOPE_SUBTREE
                searchFiltername = "sAMAccountName" #通过samaccountname查找用户
                retrieveAttributes = None
                searchFilter = '(' + searchFiltername + "=" + username +')'
                ldap_result_id =self.l.search(self.baseDN, searchScope, searchFilter, retrieveAttributes)
                result_type, result_data = self.l.result(ldap_result_id, 0)
                if result_type == ldap.RES_SEARCH_ENTRY:
                    return result_data[0][0] #list第一个值为用户的DN，第二个值是一个dict，包含了用户属性信息
                else:
                    return "%s doesn't exist." %username
            except ldap.LDAPError,err:
                return err

    def valid_user(self,username,userpassword): #验证用户密码是否正确
        if self.ldap_error is None:
            target_user = self.search_userDN(username) #使用前面定义的search_userDN函数获取用户的DN
            if target_user.find("doesn't exist") == -1:
                try:
                    self.l.simple_bind_s(target_user,userpassword)
                    logging.info('%s valid passed.\r'%(username)) #logging会自动在每行log后面添加"\000"换行，windows下未自动换行
                    return True
                except ldap.LDAPError,err:
                    return err
            else:
                return target_user

    def update_pass(self,username,oldpassword,newpassword): #####未测试#########
        if self.ldap_error is None:
            target_user = self.search_userDN(username)
            if target_user.find("doesn't exist") == -1:
                try:
                    self.l.simple_bind_s(target_user,oldpassword)
                    self.l.passwd_s(target_user,oldpassword,newpassword)
                    return 'Change password success.'
                except ldap.LDAPError,err:
                    return err
            else:
                return target_user

ldap_authuser='liu1'
ldap_authpass='pass'
domainname='uu'
ldappath='ldap://192.168.200.25:389'

baseDN='OU=优优,DC=uu,DC=yuu,DC=com' #ldap_authuser在连接到LDAP的时候不会用到baseDN，在验证其他用户的时候才需要使用
username = 'liu1' #要查找/验证的用户
p=ldapc(ldappath,baseDN,domainname,ldap_authuser,ldap_authpass)
print p.valid_user('Lily','lpass') #调用valid_user()方法验证用户是否为合法用户

遍历OU下的用户函数：

def search_OU(self): #精确查找，最后返回该用户的DN值
        if self.ldap_error is None:
            try:
                searchScope = ldap.SCOPE_SUBTREE
                #searchFiltername = "sAMAccountName" #通过samaccountname查找用户
                retrieveAttributes = None
                searchFilter = '(&(objectClass=person))'
                ldap_result =self.l.search_s(self.baseDN, searchScope, searchFilter, retrieveAttributes)
                if ldap_result is not None:
                    udict = {}
                    usersinfor = []
                    for pinfor in ldap_result:
                    #pinfor是一个tuple，第一个元素是该用户的CN，第二个元素是一个dict，包含有用户的所有属性
                        if pinfor[1]:
                            p=pinfor[1]
                            sAMAccountName = p['sAMAccountName'][0] #返回值是一个list
                            displayName = p['displayName'][0]
                            #如果用户的某个属性为空，则dict中不会包含有相应的key
                            if 'department' in p:
                                department = p['department'][0]
                            else:
                                department = None
                            #print sAMAccountName,displayName,department
                            udict['sAMAccountName'] = sAMAccountName
                            udict['displayName'] = displayName
                            udict['department'] = department
                            usersinfor.append(udict)
                            # print udict
                    return usersinfor
            except ldap.LDAPError,err:
                return err
            finally:
                self.l.unbind_s()
                del self.l

baseDN='OU=Admin,DC=u,DC=y,DC=com' #需要遍历的OU
p=ldapc(ldappath,baseDN,domainname,ldap_authuser,ldap_authpass)
users = p.search_OU()
print users[0]['department']

#retrieveAttributes = None
searchFilter = '(&(objectClass=person))'
attrs = ['cn','uid','mail']
ldap_result =self.l.search_s(self.baseDN, searchScope, searchFilter, attrs) #只过滤attrs属性，如果为*，则过滤所有属性

分页返回LDAP查询结果：

import ldap
from ldap.controls import SimplePagedResultsControl  

l = ldap.initialize('ldap://1.1.1.16')
l.simple_bind_s('user', 'Password')
baseDN=unicode('OU=集团,DC=uxin,DC=youxinpai,DC=com','utf8')
PAGE_SIZE = 500  #设置每页返回的条数
ATTRLIST = ['sAMAccountName','name', 'mail','department','title']  #设置返回的属性值
# ATTRLIST = None #设置为None则返回用户的所有属性
searchFilter =  '(&(objectCategory=person)(objectClass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))' #查询Enabled的用户
pg_ctrl = SimplePagedResultsControl(True, size=PAGE_SIZE, cookie="")
userdata = []  

while True:
    msgid = l.search_ext(baseDN,ldap.SCOPE_SUBTREE, searchFilter, ATTRLIST, serverctrls=[pg_ctrl])
    _a, res_data, _b, srv_ctrls = l.result3(msgid)
    # print 'res_data', len(res_data) ,msgid
    userdata.extend(res_data)
    cookie = srv_ctrls[0].cookie
    if cookie:
        pg_ctrl.cookie = cookie
    else:
        break  

print 'totalnum:', len(userdata)
print userdata[0]

ObjectClass类型如下：详细参考：http://www.cnblogs.com/dreamer-fish/p/5832735.html（LDAP查询过滤语法）http://www.morgantechspace.com/2013/05/ldap-search-filter-examples.html

objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson