authentik.sources.ldap.sync.base

  1"""Sync LDAP Users and groups into authentik"""
  2
  3from collections.abc import Generator
  4
  5from django.conf import settings
  6from ldap3 import DEREF_ALWAYS, SUBTREE, Connection
  7from structlog.stdlib import BoundLogger, get_logger
  8
  9from authentik.core.sources.mapper import SourceMapper
 10from authentik.lib.config import CONFIG
 11from authentik.lib.sync.mapper import PropertyMappingManager
 12from authentik.sources.ldap.models import LDAPSource, flatten
 13from authentik.tasks.models import Task
 14
 15
 16class BaseLDAPSynchronizer:
 17    """Sync LDAP Users and groups into authentik"""
 18
 19    _source: LDAPSource
 20    _task: Task
 21    _logger: BoundLogger
 22    _connection: Connection
 23    mapper: SourceMapper
 24    manager: PropertyMappingManager
 25
 26    def __init__(self, source: LDAPSource, task: Task):
 27        self._source = source
 28        self._task = task
 29        self._connection = source.connection()
 30        self._logger = get_logger().bind(source=source, syncer=self.__class__.__name__)
 31
 32    @staticmethod
 33    def name() -> str:
 34        """UI name for the type of object this class synchronizes"""
 35        raise NotImplementedError
 36
 37    def sync_full(self):
 38        """Run full sync, this function should only be used in tests"""
 39        if not settings.TEST:  # noqa
 40            raise RuntimeError(
 41                f"{self.__class__.__name__}.sync_full() should only be used in tests"
 42            )
 43        for page in self.get_objects():
 44            self.sync(page)
 45
 46    def sync(self, page_data: list) -> int:
 47        """Sync function, implemented in subclass"""
 48        raise NotImplementedError()
 49
 50    @property
 51    def base_dn_users(self) -> str:
 52        """Shortcut to get full base_dn for user lookups"""
 53        if self._source.additional_user_dn:
 54            return f"{self._source.additional_user_dn},{self._source.base_dn}"
 55        return self._source.base_dn
 56
 57    @property
 58    def base_dn_groups(self) -> str:
 59        """Shortcut to get full base_dn for group lookups"""
 60        if self._source.additional_group_dn:
 61            return f"{self._source.additional_group_dn},{self._source.base_dn}"
 62        return self._source.base_dn
 63
 64    def get_objects(self, **kwargs) -> Generator:
 65        """Get objects from LDAP, implemented in subclass"""
 66        raise NotImplementedError()
 67
 68    def get_attributes(self, object):
 69        if "attributes" not in object:
 70            return
 71        return object.get("attributes", {})
 72
 73    def get_identifier(self, attributes: dict):
 74        if not attributes.get(self._source.object_uniqueness_field):
 75            return
 76        return flatten(attributes[self._source.object_uniqueness_field])
 77
 78    def search_paginator(  # noqa: PLR0913
 79        self,
 80        search_base,
 81        search_filter,
 82        search_scope=SUBTREE,
 83        dereference_aliases=DEREF_ALWAYS,
 84        attributes=None,
 85        size_limit=0,
 86        time_limit=0,
 87        types_only=False,
 88        get_operational_attributes=False,
 89        controls=None,
 90        paged_size=None,
 91        paged_criticality=False,
 92    ):
 93        """Search in pages, returns each page"""
 94        cookie = True
 95        if not paged_size:
 96            paged_size = CONFIG.get_int("ldap.page_size", 50)
 97        while cookie:
 98            self._connection.search(
 99                search_base,
100                search_filter,
101                search_scope,
102                dereference_aliases,
103                attributes,
104                size_limit,
105                time_limit,
106                types_only,
107                get_operational_attributes,
108                controls,
109                paged_size,
110                paged_criticality,
111                None if cookie is True else cookie,
112            )
113            try:
114                cookie = self._connection.result["controls"]["1.2.840.113556.1.4.319"]["value"][
115                    "cookie"
116                ]
117            except KeyError:
118                cookie = None
119            yield self._connection.response