f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(active-directory): LDAP directory administration integration

Browse Source 
Active Directory over LDAP/LDAPS via the ldap3 library, designed to run on a
remote engine inside the AD network. 24 commands: raw search, get
user/computer/group-members (with userAccountControl decoding), enable/disable/
unlock accounts, set/expire password, password-never-expire, add/remove group
membership, move user/computer OU, create/update/delete user/contact/group, and
credential testing.

Scripts share an ldap3 connection helper that handles SSL/LDAPS/Start TLS, NTLM
bind, certificate trust and paged search. ldap3 is imported defensively: if it
is missing on the engine host the command returns a clear "pip install ldap3"
message instead of crashing. No ingestion source, so no OCSF mapper.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-06-26 17:22:22 +02:00
parent dd1ca83d7d
commit 07fe4b50a7
25 changed files with 5971 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/active-directory/scripts/ad_add_to_group.py
+240
View File
@@ -0,0 +1,240 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
sb = base_dn_arg()
if I.get("username") and I.get("computer-name"):
fail("Provide either username or computer-name, not both")
member_dns = []
if I.get("username"):
member_dns = [user_dn(conn, u, sb) for u in _list(I["username"])]
elif I.get("computer-name"):
member_dns = [computer_dn(conn, cn, sb) for cn in _list(I["computer-name"])]
elif I.get("nested_group_cn"):
member_dns = [group_dn(conn, I["nested_group_cn"], sb)]
else:
fail("Provide username, computer-name, or nested_group_cn")
grp = group_dn(conn, I["group-cn"], sb)
if not microsoft.addMembersToGroups.ad_add_members_to_groups(conn, member_dns, [grp], True):
fail("Failed to add member(s) to group " + I["group-cn"])
out({"added": member_dns, "group": I["group-cn"]})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_create_contact.py
+239
View File
@@ -0,0 +1,239 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
contact_dn = I["contact-dn"]
attributes = {}
if I.get("custom-attributes"):
try:
attributes = json.loads(I["custom-attributes"])
except Exception as e:
fail("Failed to parse custom-attributes JSON: " + str(e))
field_map = {"display-name": "displayName", "description": "description", "email": "mail",
"telephone-number": "telephoneNumber", "title": "title"}
for arg, attr in field_map.items():
if I.get(arg):
attributes[attr] = I[arg]
if not conn.add(contact_dn, ["top", "person", "organizationalPerson", "contact"], attributes):
fail("Failed to create contact: " + json.dumps(conn.result, default=str))
out({"created": contact_dn})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_create_group.py
+235
View File
@@ -0,0 +1,235 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
dn = I["dn"]
name = I["name"]
type_map = {"security": "2147483650", "distribution": "2"}
if I["group-type"] not in type_map:
fail("group-type must be 'security' or 'distribution'")
attributes = {"samAccountName": name, "groupType": type_map[I["group-type"]]}
if I.get("members"):
attributes["member"] = _list(I["members"])
if not conn.add(dn, ["top", "group"], attributes):
fail("Failed to create group: " + json.dumps(conn.result, default=str))
out({"created": dn})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_create_user.py
+246
View File
@@ -0,0 +1,246 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
if c["secure"] not in ("SSL", "TLS"):
fail("Creating a user requires a secure connection (SSL or TLS).")
user_dn_val = I["user-dn"]
object_classes = ["top", "person", "organizationalPerson", "user"]
attributes = {"sAMAccountName": I["username"]}
field_map = {"display-name": "displayName", "description": "description", "email": "mail",
"telephone-number": "telephoneNumber", "title": "title"}
for arg, attr in field_map.items():
if I.get(arg):
attributes[attr] = I[arg]
if I.get("custom-attributes"):
try:
attributes.update(json.loads(I["custom-attributes"]))
except Exception as e:
fail("Failed to parse custom-attributes JSON: " + str(e))
if not conn.add(user_dn_val, object_classes, attributes):
fail("Failed to create user: " + json.dumps(conn.result, default=str))
if not conn.extend.microsoft.modify_password(user_dn_val, I["password"]):
fail("User created but failed to set password: " + json.dumps(conn.result, default=str))
modify(conn, user_dn_val, {"userAccountControl": [(MODIFY_REPLACE, [512])],
"pwdLastSet": [(MODIFY_REPLACE, ["0"])]})
out({"created": user_dn_val})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_delete_group.py
+227
View File
@@ -0,0 +1,227 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
if not conn.delete(I["dn"]):
fail("Failed to delete group: " + json.dumps(conn.result, default=str))
out({"deleted": I["dn"]})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_delete_user.py
+228
View File
@@ -0,0 +1,228 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
dn = I["user-dn"]
if not conn.delete(dn):
fail("Failed to delete: " + json.dumps(conn.result, default=str))
out({"deleted": dn})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_disable_account.py
+229
View File
@@ -0,0 +1,229 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
sb = I.get("base-dn") or base_dn_arg()
dn = user_dn(conn, I["username"], sb)
options = current_uac(conn, sb)
modify(conn, dn, {"userAccountControl": [(MODIFY_REPLACE, [options | 0x2])]})
out({"disabled": I["username"]})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_enable_account.py
+232
View File
@@ -0,0 +1,232 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
sb = I.get("base-dn") or base_dn_arg()
dn = user_dn(conn, I["username"], sb)
options = 512
if str(I.get("restore_user")).lower() == "true":
options = current_uac(conn, sb)
options = options & ~0x2
modify(conn, dn, {"userAccountControl": [(MODIFY_REPLACE, [options])]})
out({"enabled": I["username"]})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_expire_password.py
+227
View File
@@ -0,0 +1,227 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
dn = user_dn(conn, I["username"], I.get("base-dn") or base_dn_arg())
modify(conn, dn, {"pwdLastSet": [(MODIFY_REPLACE, ["0"])]})
out({"expired": I["username"]})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_get_computer.py
+243
View File
@@ -0,0 +1,243 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
defaults = ["name", "memberOf"]
query = "(&(objectClass=user)(objectCategory=computer))"
esc = escape_filter_chars
if I.get("dn"):
query = f"(&(objectClass=user)(objectCategory=computer)(distinguishedName={esc(I['dn'])}))"
elif I.get("name"):
query = f"(&(objectClass=user)(objectCategory=computer)(name={esc(I['name'])}))"
elif I.get("custom-field-type"):
if not I.get("custom-field-data"):
fail("custom-field-data is required when custom-field-type is given")
query = f"(&(objectClass=user)(objectCategory=computer)({esc(I['custom-field-type'])}={esc(I['custom-field-data'])}))"
custom = I["attributes"].split(",") if I.get("attributes") else []
attributes = list(set(custom) | set(defaults))
size_limit = int(I.get("limit") or 0)
page_size = int(I.get("page-size") or c["page_size"])
if I.get("page-size"):
size_limit = page_size
flat = search_paging(conn, query, base_dn_arg(), attributes=attributes, page_size=page_size, size_limit=size_limit)
out({"computers": flat, "count": len(flat)})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_get_group_members.py
+248
View File
@@ -0,0 +1,248 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
member_type = I.get("member-type") or "person"
group = I["group-dn"]
nested = "" if str(I.get("disable-nested-search")).lower() == "true" else ":1.2.840.113556.1.4.1941:"
account = I.get("sAMAccountName") or "*"
time_limit = int(I.get("time_limit") or 180)
defaults = {
"person": ["name", "displayName", "memberOf", "mail", "sAMAccountName", "manager", "userAccountControl"],
"group": ["name", "memberOf"],
"computer": ["name", "memberOf"],
}.get(member_type, ["name", "memberOf"])
custom = I["attributes"].split(",") if I.get("attributes") else []
attributes = list(set(custom) | set(defaults))
if member_type == "group":
query = f"(&(objectCategory={member_type})(memberOf{nested}={group})(sAMAccountName={account}))"
else:
query = f"(&(objectCategory={member_type})(objectClass=user)(memberOf{nested}={group})(sAMAccountName={account}))"
size_limit = int(I.get("limit") or 0)
page_size = int(I.get("page-size") or c["page_size"])
if I.get("page-size"):
size_limit = page_size
flat = search_paging(conn, query, base_dn_arg(), attributes=attributes,
page_size=page_size, size_limit=size_limit, time_limit=time_limit)
members = [{"dn": e["dn"], "category": member_type} for e in flat]
out({"group_dn": group, "members": members, "entries": flat, "count": len(flat)})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_get_user.py
+254
View File
@@ -0,0 +1,254 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
defaults = ["name", "displayName", "memberOf", "mail", "sAMAccountName", "manager", "userAccountControl"]
query = S.get("default_base_query") or "(&(objectClass=User)(objectCategory=person))"
esc = escape_filter_chars
if I.get("dn"):
query = f"(&(objectClass=User)(objectCategory=person)(distinguishedName={esc(I['dn'])}))"
elif I.get("name"):
query = f"(&(objectClass=User)(objectCategory=person)(cn={esc(I['name'])}))"
elif I.get("email"):
query = f"(&(objectClass=User)(objectCategory=person)(mail={esc(I['email'])}))"
elif I.get("username") or I.get("sAMAccountName"):
u = esc(I.get("username") or I.get("sAMAccountName"))
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={u}))"
elif I.get("custom-field-type"):
if not I.get("custom-field-data"):
fail("custom-field-data is required when custom-field-type is given")
query = f"(&(objectClass=User)(objectCategory=person)({esc(I['custom-field-type'])}={esc(I['custom-field-data'])}))"
custom = I["attributes"].split(",") if I.get("attributes") else []
exclude = [a.strip() for a in (I.get("attributes-to-exclude") or "").split(",") if a.strip()]
attributes = list((set(custom) | set(defaults)) - set(exclude))
limit = int(I.get("limit") or 20)
if limit <= 0:
limit = 20
page_size = int(I.get("page-size") or c["page_size"])
if I.get("page-size"):
limit = int(I["page-size"])
flat = search_paging(conn, query, base_dn_arg(), attributes=attributes, size_limit=limit, page_size=page_size)
for user in flat:
if user.get("userAccountControl"):
user["userAccountControlFields"] = uac_fields(first_uac(user["userAccountControl"]))
out({"users": flat, "count": len(flat)})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_modify_computer_ou.py
+229
View File
@@ -0,0 +1,229 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
name = I["computer-name"]
dn = computer_dn(conn, name, I.get("base-dn") or base_dn_arg())
if not conn.modify_dn(dn, f"CN={name}", new_superior=I["full-superior-dn"]):
fail("Failed to move computer: " + json.dumps(conn.result, default=str))
out({"moved": name, "to": I["full-superior-dn"]})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_modify_password_never_expire.py
+236
View File
@@ -0,0 +1,236 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
sam = I["username"]
never = str(I["value"]).lower() == "true"
sb = base_dn_arg()
flat = search_paging(conn, f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))",
sb, attributes=["userAccountControl"], size_limit=1, page_size=1)
if not flat:
fail(f"User {sam} not found")
uac = first_uac(flat[0].get("userAccountControl"))
uac = (uac | (1 << 16)) if never else (uac & ~(1 << 16))
dn = user_dn(conn, sam, sb)
modify(conn, dn, {"userAccountControl": [(MODIFY_REPLACE, [uac])]})
out({"username": sam, "password_never_expire": never})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_modify_user_ou.py
+231
View File
@@ -0,0 +1,231 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
name = I["user-name"]
dn = user_dn(conn, name, I.get("base-dn") or base_dn_arg())
cn = dn.split(",OU=", 1)[0].split(",DC=", 1)[0].replace("\\", "")
dn_clean = dn.replace("\\", "")
if not conn.modify_dn(dn_clean, cn, new_superior=I["full-superior-dn"]):
fail("Failed to move user: " + json.dumps(conn.result, default=str))
out({"moved": name, "to": I["full-superior-dn"]})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_remove_from_group.py
+237
View File
@@ -0,0 +1,237 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
sb = base_dn_arg()
if I.get("username") and I.get("computer-name"):
fail("Provide either username or computer-name, not both")
if I.get("username"):
member_dn = user_dn(conn, I["username"], sb)
elif I.get("computer-name"):
member_dn = computer_dn(conn, I["computer-name"], sb)
else:
fail("Provide username or computer-name")
grp = group_dn(conn, I["group-cn"], sb)
if not microsoft.removeMembersFromGroups.ad_remove_members_from_groups(conn, [member_dn], [grp], True):
fail("Failed to remove member from group " + I["group-cn"])
out({"removed": member_dn, "group": I["group-cn"]})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_search.py
+239
View File
@@ -0,0 +1,239 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
search_filter = I["filter"]
for a, b in {"\(": "\28", "\)": "\29", "\*": "\2a", "\/": "\2f", "\\\\": "\5c"}.items():
search_filter = search_filter.replace(a, b)
search_base = base_dn_arg()
attributes = I.get("attributes")
if attributes:
attributes = ALL_ATTRIBUTES if attributes == "ALL" else [a.strip() for a in attributes.split(",")]
size_limit = int(I.get("size-limit") or 50)
time_limit = int(I.get("time-limit") or 0)
page_size = int(I.get("page-size") or c["page_size"])
if I.get("page-size"):
size_limit = page_size
flat = search_paging(conn, search_filter, search_base, attributes=attributes,
page_size=page_size, size_limit=size_limit, time_limit=time_limit)
out({"results": flat, "count": len(flat)})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_set_new_password.py
+230
View File
@@ -0,0 +1,230 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
if c["secure"] not in ("SSL", "TLS"):
fail("Setting a password requires a secure connection (SSL or TLS).")
dn = user_dn(conn, I["username"], I.get("base-dn") or base_dn_arg())
if not conn.extend.microsoft.modify_password(dn, I["password"]):
fail("Failed to set password: " + json.dumps(conn.result, default=str))
out({"password_set": I["username"]})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_test_credentials.py
+236
View File
@@ -0,0 +1,236 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
server = _server(c)
username = I["username"]
try:
if c["ntlm"]:
domain_user = username if "\\" in username else c["host"] + "\\" + username
test = Connection(server, domain_user, password=I["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
test = Connection(server, user=username, password=I["password"], auto_bind=_auto_bind(c["secure"]))
test.unbind()
except LDAPException:
fail(f"Credential test for {username} failed")
out({"valid": username})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_unlock_account.py
+228
View File
@@ -0,0 +1,228 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
dn = user_dn(conn, I["username"], I.get("base-dn") or base_dn_arg())
if not microsoft.unlockAccount.ad_unlock_account(conn, dn):
fail("Failed to unlock " + I["username"])
out({"unlocked": I["username"]})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_update_contact.py
+226
View File
@@ -0,0 +1,226 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
modify(conn, I["contact-dn"], {I["attribute-name"]: [(MODIFY_REPLACE, [I["attribute-value"]])]})
out({"updated": I["contact-dn"], "attribute": I["attribute-name"], "value": I["attribute-value"]})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_update_group.py
+227
View File
@@ -0,0 +1,227 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
dn = group_dn(conn, I["groupname"], I.get("basedn") or base_dn_arg())
modify(conn, dn, {I["attributename"]: [(MODIFY_REPLACE, [I["attributevalue"]])]})
out({"updated": dn, "attribute": I["attributename"], "value": I["attributevalue"]})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/ad_update_user.py
+227
View File
@@ -0,0 +1,227 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
dn = user_dn(conn, I["username"], I.get("base-dn") or base_dn_arg())
modify(conn, dn, {I["attribute-name"]: [(MODIFY_REPLACE, [I["attribute-value"]])]})
out({"updated": dn, "attribute": I["attribute-name"], "value": I["attribute-value"]})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass
integrations/active-directory/scripts/test_connection.py
+229
View File
@@ -0,0 +1,229 @@
import json, os, sys
S = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
I = json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
def out(value):
print(json.dumps(value, default=str))
def fail(message, **extra):
payload = {"error": message}
payload.update(extra)
print(json.dumps(payload, default=str))
sys.exit(1)
try:
import ssl
from ldap3 import (
Server, Connection, Tls, NTLM, SUBTREE, BASE, ALL_ATTRIBUTES,
MODIFY_REPLACE, AUTO_BIND_NO_TLS, AUTO_BIND_TLS_BEFORE_BIND,
)
from ldap3.core.exceptions import LDAPException
from ldap3.extend import microsoft
from ldap3.utils.conv import escape_filter_chars
except ImportError as _e:
print(json.dumps({
"error": "The 'ldap3' Python library is required for the Active Directory integration. "
"Install it on the execution host (engine): pip install ldap3",
"detail": str(_e),
}))
sys.exit(1)
SSL_VERSIONS = {
"None": None,
"TLS": ssl.PROTOCOL_TLS,
"TLSv1": ssl.PROTOCOL_TLSv1,
"TLSv1_1": ssl.PROTOCOL_TLSv1_1,
"TLSv1_2": ssl.PROTOCOL_TLSv1_2,
"TLS_CLIENT": ssl.PROTOCOL_TLS_CLIENT,
}
CIPHERS = (
"@SECLEVEL=1:ECDHE+AESGCM:ECDHE+CHACHA20:DHE+AESGCM:DHE+CHACHA20:ECDH+AESGCM:"
"DH+AESGCM:ECDH+AES:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS"
)
CONN = None
def _bool(v):
if isinstance(v, bool):
return v
return str(v).lower() in ("1", "true", "yes")
def _list(v):
if isinstance(v, list):
return v
return [x.strip() for x in str(v).split(",") if x.strip()]
def _cfg():
return {
"host": S.get("server_ip") or S.get("host") or "",
"port": int(S["port"]) if S.get("port") else None,
"user": S.get("username") or "",
"password": S.get("password") or "",
"base_dn": S.get("base_dn") or "",
"secure": S.get("secure_connection") or "SSL",
"ssl_version": S.get("ssl_version") or "None",
"ntlm": _bool(S.get("ntlm")),
"unsecure": _bool(S.get("unsecure")),
"page_size": int(S["page_size"]) if S.get("page_size") else 500,
}
def _tls(unsecure, ssl_version):
version = SSL_VERSIONS.get(ssl_version)
if unsecure:
return Tls(validate=ssl.CERT_NONE, ca_certs_file=None, ciphers=CIPHERS, version=version)
return Tls(validate=ssl.CERT_REQUIRED, ca_certs_file=os.environ.get("SSL_CERT_FILE"), version=version)
def _server(c):
secure = c["secure"]
if secure in ("SSL", "TLS"):
return Server(host=c["host"], port=c["port"], use_ssl=True, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
if secure == "Start TLS":
return Server(host=c["host"], port=c["port"], use_ssl=False, tls=_tls(c["unsecure"], c["ssl_version"]), connect_timeout=120)
return Server(host=c["host"], port=c["port"], connect_timeout=120)
def _auto_bind(secure):
return AUTO_BIND_TLS_BEFORE_BIND if secure == "Start TLS" else AUTO_BIND_NO_TLS
def connect():
global CONN
c = _cfg()
server = _server(c)
if c["ntlm"]:
domain_user = c["user"] if "\\" in c["user"] else c["host"] + "\\" + c["user"]
CONN = Connection(server, domain_user, password=c["password"], authentication=NTLM, auto_bind=_auto_bind(c["secure"]))
else:
CONN = Connection(server, user=c["user"], password=c["password"], auto_bind=_auto_bind(c["secure"]))
return CONN, c
def base_dn_arg():
return I.get("base-dn") or I.get("base_dn") or _cfg()["base_dn"]
def search_paging(conn, search_filter, search_base, attributes=None, page_size=100, size_limit=0, time_limit=0):
entries = []
cookie = None
total = 0
left = size_limit
while True:
ps = page_size
if 0 < left < page_size:
ps = left
conn.search(search_base, search_filter, search_scope=SUBTREE, attributes=attributes,
paged_size=ps, paged_cookie=cookie, time_limit=time_limit)
left -= len(conn.entries)
total += len(conn.entries)
try:
cookie = conn.result["controls"]["1.2.840.113556.1.4.319"]["value"]["cookie"]
except (KeyError, TypeError):
cookie = None
entries.extend(conn.entries)
if (size_limit and size_limit <= total) or not cookie:
break
flat = []
for entry in entries:
obj = json.loads(entry.entry_to_json())
flat_entry = {"dn": obj["dn"]}
for attr in obj.get("attributes", {}):
flat_entry[attr] = obj["attributes"][attr]
flat.append(flat_entry)
return flat
def user_dn(conn, sam, search_base):
if "\\" in sam:
sam = sam.split("\\", 1)[1]
flat = search_paging(conn, f"(&(objectClass=user)(sAMAccountName={escape_filter_chars(sam)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find user '{sam}'")
return flat[0]["dn"]
def computer_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=user)(objectCategory=computer)(name={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find computer '{name}'")
return flat[0]["dn"]
def group_dn(conn, name, search_base):
flat = search_paging(conn, f"(&(objectClass=group)(cn={escape_filter_chars(name)}))",
search_base, page_size=1, size_limit=1)
if not flat:
raise Exception(f"Could not find group '{name}'")
return flat[0]["dn"]
def modify(conn, dn, modification):
if not conn.modify(dn, modification):
raise Exception(f"Failed to modify {dn}: {json.dumps(conn.result, default=str)}")
def first_uac(values):
if isinstance(values, list):
return values[0] if values else 0
return values or 0
def uac_fields(value):
value = int(value)
flags = {
"SCRIPT": 0x1, "ACCOUNTDISABLE": 0x2, "HOMEDIR_REQUIRED": 0x8, "LOCKOUT": 0x10,
"PASSWD_NOTREQD": 0x20, "PASSWD_CANT_CHANGE": 0x40, "ENCRYPTED_TEXT_PWD_ALLOWED": 0x80,
"TEMP_DUPLICATE_ACCOUNT": 0x100, "NORMAL_ACCOUNT": 0x200, "INTERDOMAIN_TRUST_ACCOUNT": 0x800,
"WORKSTATION_TRUST_ACCOUNT": 0x1000, "SERVER_TRUST_ACCOUNT": 0x2000, "DONT_EXPIRE_PASSWORD": 0x10000,
"MNS_LOGON_ACCOUNT": 0x20000, "SMARTCARD_REQUIRED": 0x40000, "TRUSTED_FOR_DELEGATION": 0x80000,
"NOT_DELEGATED": 0x100000, "USE_DES_KEY_ONLY": 0x200000, "DONT_REQ_PREAUTH": 0x400000,
"PASSWORD_EXPIRED": 0x800000, "TRUSTED_TO_AUTH_FOR_DELEGATION": 0x1000000, "PARTIAL_SECRETS_ACCOUNT": 0x4000000,
}
return {name: bool(value & mask) for name, mask in flags.items()}
def current_uac(conn, search_base):
sam = I.get("username") or I.get("sAMAccountName")
query = "(&(objectClass=User)(objectCategory=person))"
if sam:
query = f"(&(objectClass=User)(objectCategory=person)(sAMAccountName={escape_filter_chars(sam)}))"
flat = search_paging(conn, query, search_base, attributes=["userAccountControl"], size_limit=1, page_size=1)
if flat and flat[0].get("userAccountControl"):
return first_uac(flat[0]["userAccountControl"])
return 512
def run():
conn, c = connect()
if c["base_dn"]:
found = conn.search(search_base=c["base_dn"], search_filter="(objectClass=*)",
search_scope=BASE, size_limit=1, attributes=["1.1"])
if not found:
fail("Connected, but failed to verify base DN: " + json.dumps(conn.result, default=str))
out({"ok": True})
try:
run()
except SystemExit:
raise
except LDAPException as e:
fail("LDAP error: " + str(e))
except Exception as e:
fail(str(e))
finally:
try:
if CONN is not None:
CONN.unbind()
except Exception:
pass