authentik.sources.ldap.sync.membership

  1"""Sync LDAP Users and groups into authentik"""
  2
  3from collections.abc import Generator
  4from typing import Any
  5
  6from django.db.models import Q
  7from ldap3 import SUBTREE
  8from ldap3.utils.conv import escape_filter_chars
  9
 10from authentik.core.models import Group, User
 11from authentik.sources.ldap.models import LDAP_DISTINGUISHED_NAME, LDAP_UNIQUENESS, LDAPSource
 12from authentik.sources.ldap.sync.base import BaseLDAPSynchronizer
 13from authentik.tasks.models import Task
 14
 15
 16class MembershipLDAPSynchronizer(BaseLDAPSynchronizer):
 17    """Sync LDAP Users and groups into authentik"""
 18
 19    group_cache: dict[str, Group]
 20
 21    def __init__(self, source: LDAPSource, task: Task):
 22        super().__init__(source, task)
 23        self.group_cache: dict[str, Group] = {}
 24
 25    @staticmethod
 26    def name() -> str:
 27        return "membership"
 28
 29    def get_objects(self, **kwargs) -> Generator:
 30        if not self._source.sync_groups:
 31            self._task.info("Group syncing is disabled for this Source")
 32            return iter(())
 33
 34        # If we are looking up groups from users, we don't need to fetch the group membership field
 35        attributes = [self._source.object_uniqueness_field, LDAP_DISTINGUISHED_NAME]
 36        if not self._source.lookup_groups_from_user:
 37            attributes.append(self._source.group_membership_field)
 38
 39        return self.search_paginator(
 40            search_base=self.base_dn_groups,
 41            search_filter=self._source.group_object_filter,
 42            search_scope=SUBTREE,
 43            attributes=attributes,
 44            **kwargs,
 45        )
 46
 47    def sync(self, page_data: list) -> int:
 48        """Iterate over all Users and assign Groups using memberOf Field"""
 49        if not self._source.sync_groups:
 50            self._task.info("Group syncing is disabled for this Source")
 51            return -1
 52        membership_count = 0
 53        for group_data in page_data:
 54            if self._source.lookup_groups_from_user:
 55                group_dn = group_data.get("dn", {})
 56                escaped_dn = escape_filter_chars(group_dn)
 57                group_filter = f"({self._source.group_membership_field}={escaped_dn})"
 58                group_members = self._source.connection().extend.standard.paged_search(
 59                    search_base=self.base_dn_users,
 60                    search_filter=group_filter,
 61                    search_scope=SUBTREE,
 62                    attributes=[self._source.object_uniqueness_field],
 63                )
 64                members = []
 65                for group_member in group_members:
 66                    group_member_dn = group_member.get("dn", {})
 67                    members.append(group_member_dn)
 68            else:
 69                if (attributes := self.get_attributes(group_data)) is None:
 70                    continue
 71                members = attributes.get(self._source.group_membership_field, [])
 72
 73            group = self.get_group(group_data)
 74            if not group:
 75                continue
 76
 77            users = User.objects.filter(
 78                Q(**{f"attributes__{self._source.user_membership_attribute}__in": members})
 79                | Q(
 80                    **{
 81                        f"attributes__{self._source.user_membership_attribute}__isnull": True,
 82                        "groups__in": [group],
 83                    }
 84                )
 85            ).distinct()
 86            membership_count += 1
 87            membership_count += users.count()
 88            group.users.set(users)
 89            group.save()
 90        self._logger.debug("Successfully updated group membership")
 91        return membership_count
 92
 93    def get_group(self, group_dict: dict[str, Any]) -> Group | None:
 94        """Check if we fetched the group already, and if not cache it for later"""
 95        group_dn = group_dict.get("attributes", {}).get(LDAP_DISTINGUISHED_NAME, [])
 96        group_uniq = group_dict.get("attributes", {}).get(self._source.object_uniqueness_field, [])
 97        # group_uniq might be a single string or an array with (hopefully) a single string
 98        if isinstance(group_uniq, list):
 99            if len(group_uniq) < 1:
100                self._task.info(
101                    f"Group does not have a uniqueness attribute: '{group_dn}'",
102                    group=group_dn,
103                )
104                return None
105            group_uniq = group_uniq[0]
106        if group_uniq not in self.group_cache:
107            groups = Group.objects.filter(**{f"attributes__{LDAP_UNIQUENESS}": group_uniq})
108            if not groups.exists():
109                if self._source.sync_groups:
110                    self._task.info(
111                        f"Group does not exist in our DB yet, run sync_groups first: '{group_dn}'",
112                        group=group_dn,
113                    )
114                return None
115            self.group_cache[group_uniq] = groups.first()
116        return self.group_cache[group_uniq]