authentik.sources.ldap.sync.vendor.ms_ad

 1"""Active Directory specific"""
 2
 3from collections.abc import Generator
 4from datetime import UTC, datetime
 5from enum import IntFlag
 6from typing import Any
 7
 8from authentik.core.models import User
 9from authentik.sources.ldap.sync.base import BaseLDAPSynchronizer
10
11
12class UserAccountControl(IntFlag):
13    """UserAccountControl attribute for Active directory users"""
14
15    # https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity
16    #   /useraccountcontrol-manipulate-account-properties
17
18    SCRIPT = 1
19    ACCOUNTDISABLE = 2
20    HOMEDIR_REQUIRED = 8
21    LOCKOUT = 16
22    PASSWD_NOTREQD = 32
23    PASSWD_CANT_CHANGE = 64
24    ENCRYPTED_TEXT_PWD_ALLOWED = 128
25    TEMP_DUPLICATE_ACCOUNT = 256
26    NORMAL_ACCOUNT = 512
27    INTERDOMAIN_TRUST_ACCOUNT = 2048
28    WORKSTATION_TRUST_ACCOUNT = 4096
29    SERVER_TRUST_ACCOUNT = 8192
30    DONT_EXPIRE_PASSWORD = 65536
31    MNS_LOGON_ACCOUNT = 131072
32    SMARTCARD_REQUIRED = 262144
33    TRUSTED_FOR_DELEGATION = 524288
34    NOT_DELEGATED = 1048576
35    USE_DES_KEY_ONLY = 2097152
36    DONT_REQ_PREAUTH = 4194304
37    PASSWORD_EXPIRED = 8388608
38    TRUSTED_TO_AUTH_FOR_DELEGATION = 16777216
39    PARTIAL_SECRETS_ACCOUNT = 67108864
40
41
42class MicrosoftActiveDirectory(BaseLDAPSynchronizer):
43    """Microsoft-specific LDAP"""
44
45    @staticmethod
46    def name() -> str:
47        return "microsoft_ad"
48
49    def get_objects(self, **kwargs) -> Generator:
50        yield None
51
52    def sync(self, attributes: dict[str, Any], user: User, created: bool):
53        self.ms_check_pwd_last_set(attributes, user, created)
54        self.ms_check_uac(attributes, user)
55
56    def ms_check_pwd_last_set(self, attributes: dict[str, Any], user: User, created: bool):
57        """Check pwdLastSet"""
58        if "pwdLastSet" not in attributes:
59            return
60        pwd_last_set: datetime = attributes.get("pwdLastSet", datetime.now())
61        pwd_last_set = pwd_last_set.replace(tzinfo=UTC)
62        if created or pwd_last_set >= user.password_change_date:
63            self._task.info(f"'{user.username}': Reset user's password")
64            self._logger.debug(
65                "Reset user's password",
66                user=user.username,
67                created=created,
68                pwd_last_set=pwd_last_set,
69            )
70            user.set_unusable_password()
71            user.save()
72
73    def ms_check_uac(self, attributes: dict[str, Any], user: User):
74        """Check userAccountControl"""
75        if "userAccountControl" not in attributes:
76            return
77        # Default from https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity
78        #   /useraccountcontrol-manipulate-account-properties
79        uac_bit = attributes.get("userAccountControl", 512)
80        uac = UserAccountControl(uac_bit)
81        is_active = (
82            UserAccountControl.ACCOUNTDISABLE not in uac and UserAccountControl.LOCKOUT not in uac
83        )
84        if is_active != user.is_active:
85            user.is_active = is_active
86            user.save()