python django 使用django_python3_ldap集成ldap验证域用户

落日映苍穹つ 2023-02-26 12:26 26阅读 0赞

### 1、安装django\_python3\_ldap ###

pip install django\_python3\_ldap

### 2、配置setting.py，适配Micrsoft Active Directory，网上一坑垃圾写的全是照抄openldap的配置 ###

INSTALLED_APPS = [
        'django.contrib.admin',
        'django.contrib.auth',
        'django.contrib.contenttypes',
        'django.contrib.sessions',
        'django.contrib.messages',
        'django.contrib.staticfiles',
        'django_python3_ldap', ###添加这一行
    ]
    ### 以下内容都需要
    
    AUTHENTICATION_BACKENDS = [
        'django_python3_ldap.auth.LDAPBackend',
        'django.contrib.auth.backends.ModelBackend',
    ]
    # The URL of the LDAP server.
    LDAP_AUTH_URL = "ldap://192.168.98.138:389"
    
    
    # Initiate TLS on connection.
    LDAP_AUTH_USE_TLS = True
    
    
    # The LDAP search base for looking up users.
    LDAP_AUTH_SEARCH_BASE = "OU=test,DC=test,DC=com"
    
    
    # The LDAP class that represents a user.
    LDAP_AUTH_OBJECT_CLASS = "user"
    
    
    # User model fields mapped to the LDAP
    # attributes that represent them.
    LDAP_AUTH_USER_FIELDS = { 
        "username": "sAMAccountName",
        "first_name": "givenName",
        "last_name": "sn",
        "email": "mail",
    }
    # A tuple of django model fields used to uniquely identify a user.
    # LDAP_AUTH_USER_LOOKUP_FIELDS = ("username",)
    LDAP_AUTH_CLEAN_USER_DATA = "django_python3_ldap.utils.clean_user_data"
    LDAP_AUTH_SYNC_USER_RELATIONS = "django_python3_ldap.utils.sync_user_relations"
    LDAP_AUTH_FORMAT_SEARCH_FILTERS =  "django_python3_ldap.utils.format_search_filters"
    LDAP_AUTH_FORMAT_USERNAME =  "django_python3_ldap.utils.format_username_active_directory_principal"
    #LDAP_AUTH_FORMAT_USERNAME = "django_python3_ldap.utils.format_username_active_directory"
    # Sets the login domain for Active Directory users.
    # LDAP_AUTH_ACTIVE_DIRECTORY_DOMAIN = "EMCHENX.COM"
    
    
    # The LDAP username and password of a user for querying the LDAP database for user
    # details. If None, then the authenticated user will be used for querying, and
    # the `ldap_sync_users` command will perform an anonymous query.
    LDAP_AUTH_CONNECTION_USERNAME = "##############" #需要同步用户才需要
    LDAP_AUTH_CONNECTION_PASSWORD = "#############" #需要同步用户才需要
    LDAP_AUTH_ACTIVE_DIRECTORY_DOMAIN = "TEST.COM"
    LDAP_AUTH_CONNECT_TIMEOUT = None
    LDAP_AUTH_RECEIVE_TIMEOUT = None

到此，完工！