authentik.sources.ldap.password

  1"""Help validate and update passwords in LDAP"""
  2
  3from enum import IntFlag
  4from re import split
  5
  6from ldap3 import BASE
  7from ldap3.core.exceptions import (
  8    LDAPAttributeError,
  9    LDAPNoSuchAttributeResult,
 10    LDAPUnwillingToPerformResult,
 11)
 12from structlog.stdlib import get_logger
 13
 14from authentik.core.models import User
 15from authentik.sources.ldap.auth import LDAP_DISTINGUISHED_NAME
 16from authentik.sources.ldap.models import LDAPSource
 17
 18LOGGER = get_logger()
 19
 20NON_ALPHA = r"~!@#$%^&*_-+=`|\(){}[]:;\"'<>,.?/"
 21RE_DISPLAYNAME_SEPARATORS = r",\.–—_\s#\t"
 22MIN_TOKEN_SIZE = 3
 23
 24
 25class PwdProperties(IntFlag):
 26    """Possible values for the pwdProperties attribute"""
 27
 28    DOMAIN_PASSWORD_COMPLEX = 1
 29    DOMAIN_PASSWORD_NO_ANON_CHANGE = 2
 30    DOMAIN_PASSWORD_NO_CLEAR_CHANGE = 4
 31    DOMAIN_LOCKOUT_ADMINS = 8
 32    DOMAIN_PASSWORD_STORE_CLEARTEXT = 16
 33    DOMAIN_REFUSE_PASSWORD_CHANGE = 32
 34
 35
 36class PasswordCategories(IntFlag):
 37    """Password categories as defined by Microsoft, a category can only be counted
 38    once, hence intflag."""
 39
 40    NONE = 0
 41    ALPHA_LOWER = 1
 42    ALPHA_UPPER = 2
 43    ALPHA_OTHER = 4
 44    NUMERIC = 8
 45    SYMBOL = 16
 46
 47
 48class LDAPPasswordChanger:
 49    """Help validate and update passwords in LDAP"""
 50
 51    _source: LDAPSource
 52
 53    def __init__(self, source: LDAPSource) -> None:
 54        self._source = source
 55        self._connection = source.connection()
 56
 57    @staticmethod
 58    def should_check_user(user: User) -> bool:
 59        """Check if the user has LDAP parameters and needs to be checked"""
 60        return LDAP_DISTINGUISHED_NAME in user.attributes
 61
 62    def get_domain_root_dn(self) -> str:
 63        """Attempt to get root DN via MS specific fields or generic LDAP fields"""
 64        info = self._connection.server.info
 65        if "rootDomainNamingContext" in info.other:
 66            return info.other["rootDomainNamingContext"][0]
 67        naming_contexts = info.naming_contexts
 68        naming_contexts.sort(key=len)
 69        return naming_contexts[0]
 70
 71    def check_ad_password_complexity_enabled(self) -> bool:
 72        """Check if DOMAIN_PASSWORD_COMPLEX is enabled"""
 73        root_dn = self.get_domain_root_dn()
 74        try:
 75            root_attrs = self._connection.extend.standard.paged_search(
 76                search_base=root_dn,
 77                search_filter="(objectClass=*)",
 78                search_scope=BASE,
 79                attributes=["pwdProperties"],
 80            )
 81            root_attrs = list(root_attrs)[0]
 82        except LDAPAttributeError, LDAPUnwillingToPerformResult, KeyError, IndexError:
 83            return False
 84        raw_pwd_properties = root_attrs.get("attributes", {}).get("pwdProperties", None)
 85        if not raw_pwd_properties:
 86            return False
 87
 88        try:
 89            pwd_properties = PwdProperties(raw_pwd_properties)
 90        except ValueError:
 91            return False
 92        if PwdProperties.DOMAIN_PASSWORD_COMPLEX in pwd_properties:
 93            return True
 94
 95        return False
 96
 97    def change_password(self, user: User, password: str):
 98        """Change user's password"""
 99        user_dn = user.attributes.get(LDAP_DISTINGUISHED_NAME, None)
100        if not user_dn:
101            LOGGER.info(f"User has no {LDAP_DISTINGUISHED_NAME} set.")
102            return
103        try:
104            self._connection.extend.microsoft.modify_password(user_dn, password)
105        except LDAPAttributeError, LDAPUnwillingToPerformResult, LDAPNoSuchAttributeResult:
106            self._connection.extend.standard.modify_password(user_dn, new_password=password)
107
108    def _ad_check_password_existing(self, password: str, user_dn: str) -> bool:
109        """Check if a password contains sAMAccount or displayName"""
110        users = list(
111            self._connection.extend.standard.paged_search(
112                search_base=user_dn,
113                search_filter=self._source.user_object_filter,
114                search_scope=BASE,
115                attributes=["displayName", "sAMAccountName"],
116            )
117        )
118        if len(users) != 1:
119            raise AssertionError()
120        user_attributes = users[0]["attributes"]
121        # If sAMAccountName is longer than 3 chars, check if its contained in password
122        if len(user_attributes["sAMAccountName"]) >= MIN_TOKEN_SIZE:
123            if password.lower() in user_attributes["sAMAccountName"].lower():
124                return False
125        # No display name set, can't check any further
126        if len(user_attributes["displayName"]) < 1:
127            return True
128        for display_name in user_attributes["displayName"]:
129            display_name_tokens = split(RE_DISPLAYNAME_SEPARATORS, display_name)
130            for token in display_name_tokens:
131                # Ignore tokens under 3 chars
132                if len(token) < MIN_TOKEN_SIZE:
133                    continue
134                if token.lower() in password.lower():
135                    return False
136        return True
137
138    def ad_password_complexity(self, password: str, user: User | None = None) -> bool:
139        """Check if password matches Active directory password policies
140
141        https://docs.microsoft.com/en-us/windows/security/threat-protection/
142            security-policy-settings/password-must-meet-complexity-requirements
143        """
144        if user:
145            # Check if password contains sAMAccountName or displayNames
146            if LDAP_DISTINGUISHED_NAME in user.attributes:
147                existing_user_check = self._ad_check_password_existing(
148                    password, user.attributes.get(LDAP_DISTINGUISHED_NAME)
149                )
150                if not existing_user_check:
151                    LOGGER.debug("Password failed name check", user=user)
152                    return existing_user_check
153
154        # Step 2, match at least 3 of 5 categories
155        matched_categories = PasswordCategories.NONE
156        required = 3
157        for letter in password:
158            # Only match one category per letter,
159            if letter.islower():
160                matched_categories |= PasswordCategories.ALPHA_LOWER
161            elif letter.isupper():
162                matched_categories |= PasswordCategories.ALPHA_UPPER
163            elif not letter.isascii() and letter.isalpha():
164                # Not exactly matching microsoft's policy, but count it as "Other unicode" char
165                # when its alpha and not ascii
166                matched_categories |= PasswordCategories.ALPHA_OTHER
167            elif letter.isnumeric():
168                matched_categories |= PasswordCategories.NUMERIC
169            elif letter in NON_ALPHA:
170                matched_categories |= PasswordCategories.SYMBOL
171        if bin(matched_categories).count("1") < required:
172            LOGGER.debug(
173                "Password didn't match enough categories",
174                has=matched_categories,
175                must=required,
176            )
177            return False
178        LOGGER.debug("Password matched categories", has=matched_categories, must=required)
179        return True