Flask-LDAP3-登录过滤器问题 - 用户无法登录

Question

使用 flask-ldap3-login 查询 AD 以获取我的网络应用登录信息。适用于所有人；但是，对于在 AD 中名字中包含“()”的用户。这是调试日志。

未成功登录

DEBUG:root:Validating LDAPLoginForm against LDAP
DEBUG:flask_ldap3_login:Opening connection with bind user 'mybinduser@mydomain.com'
DEBUG:flask_ldap3_login:Successfully bound to LDAP as 'mybinduser@mydomain.com' for search_bind method
DEBUG:flask_ldap3_login:Performing an LDAP Search using filter '(&(objectclass=person)(sAMAccountName=ebadu))', base 'DC=mydomain,DC=com', and scope 'SUBTREE'
DEBUG:flask_ldap3_login:Opening connection with bind user 'CN=Badu\, Ericka (EB),OU=HELPDESK,DC=mydomain,DC=com'
DEBUG:flask_ldap3_login:Directly binding a connection to a server with user:'CN=Badu\, ericka (EB),OU=HELPDESK,DC=mydomain,DC=com'
DEBUG:flask_ldap3_login:Authentication was successful for user 'ebadu'
DEBUG:flask_ldap3_login:Searching for groups for specific user with filter '(&(objectclass=group)(uniqueMember=CN=Badu\, Ericka (EB),OU=HELPDESK,DC=mydomain,DC=com))' , base 'DC=mydomain,DC=com' and scope 'LEVEL'
ERROR:flask_ldap3_login:malformed filter
DEBUG:flask_ldap3_login:Destroying connection at <0x7f8629604c50>
DEBUG:flask_ldap3_login:Destroying connection at <0x7f8628eabf98>

登录成功

DEBUG:root:Validating LDAPLoginForm against LDAP
DEBUG:flask_ldap3_login:Opening connection with bind user 'mybinduser@mydomain.com'
DEBUG:flask_ldap3_login:Successfully bound to LDAP as 'mybinduser@mydomain.com' for search_bind method
DEBUG:flask_ldap3_login:Performing an LDAP Search using filter '(&(objectclass=person)(sAMAccountName=mpeters))', base 'DC=mydomain,DC=com', and scope 'SUBTREE'
DEBUG:flask_ldap3_login:Opening connection with bind user 'CN=Peters\, Mike,OU=HELPDESK,DC=mydomain,DC=com'
DEBUG:flask_ldap3_login:Directly binding a connection to a server with user:'CN=Peters\, Mike,OU=HELPDESK,DC=mydomain,DC=com'
DEBUG:flask_ldap3_login:Authentication was successful for user 'mpeters'
DEBUG:flask_ldap3_login:Searching for groups for specific user with filter '(&(objectclass=group)(uniqueMember=CN=Peters\, Mike,OU=HELPDESK,DC=mydomain,DC=com))' , base 'DC=mydomain,DC=com' and scope 'LEVEL'
DEBUG:flask_ldap3_login:Destroying connection at <0x7f8629683828>
DEBUG:flask_ldap3_login:Destroying connection at <0x7f8628e91048>

AD 日志显示 "An account was successfully logged on"；但是，用户没有登录到该应用程序。用户在其他任何地方使用 AD 凭据登录都没有问题。

可能是什么问题？

这是 flask-ldap3-登录代码：

LDAP_USER_RDN_ATTR = 'cn'
LDAP_USER_LOGIN_ATTR = 'sAMAccountName'
LDAP_BASE_DN = 'DC=mydomain,DC=com'
LDAP_REQUIRED_GROUP = 'ou=helpdesk,dc=mydomain,dc=com'
LDAP_USER_SEARCH_SCOPE = 'SUBTREE'

Answer 1

但是 "malformed filter" 通常意味着发送到 AD 的 LDAP 查询不知何故无效。我询问了帐户中的奇怪字符，因为如果某些特殊字符没有正确编码，它们可能会被误解为 LDAP 查询中使用的特殊字符。

这可能是您的代码中的错误，或者是 flask-ldap3-login 中的错误。如果你展示你的代码，我可能可以给你一些指导。

另外，看看您是否可以启用调试日志记录。它可能会告诉您使它成为炸弹的实际过滤器是什么。我不熟悉 flask-ldap3-login，但是，查看文档，这可能可以吗？:

app.config['DEBUG'] = True

Answer 2

已解决！好像在最新版的flask-ldap3-login中解决了。我没有升级但修改了现有代码：

替换为：

    `search_filter = '(&{group_filter}({members_attr}={user_dn}))'.format('`    
    `group_filter=self.config.get('LDAP_GROUP_OBJECT_FILTER'),`    
    `members_attr=self.config.get('LDAP_GROUP_MEMBERS_ATTR'),`  
    `user_dn=dn`

有了这个：

    `safe_dn = ldap3.utils.conv.escape_filter_chars(dn)`  
    `search_filter = '(&{group_filter}({members_attr}={user_dn}))'.format(`  
    `group_filter=self.config.get('LDAP_GROUP_OBJECT_FILTER'),`  
    `members_attr=self.config.get('LDAP_GROUP_MEMBERS_ATTR'),`  
    `user_dn=safe_dn`

Flask-LDAP3-登录过滤器问题 - 用户无法登录

Flask-LDAP3-Login Filter issue - User cannot login

flask

active-directory

python-3.6

ldap3