Python ldap3 라이브러리로 LDAP 연동
from ldap3 import Server, Connection, ALL, SUBTREE
from ldap3.core.exceptions import LDAPBindError, LDAPException
from typing import Optional, List, Dict
# LDAP 서버 설정
LDAP_SERVER = "ldap://ldap.example.com:389"
LDAP_BASE_DN = "dc=example,dc=com"
LDAP_BIND_DN = "cn=admin,dc=example,dc=com"
LDAP_BIND_PASSWORD = "admin_password"
class LDAPClient:
"""LDAP 연동 클라이언트"""
def __init__(self, server_url: str, base_dn: str):
self.server = Server(server_url, get_info=ALL)
self.base_dn = base_dn
self.conn = None
def bind_admin(self, bind_dn: str, password: str) -> bool:
"""관리자 계정으로 바인딩"""
try:
self.conn = Connection(
self.server,
user=bind_dn,
password=password,
auto_bind=True
)
return True
except LDAPBindError:
return False
def authenticate_user(self, username: str, password: str) -> Optional[dict]:
"""사용자 인증 (Bind 방식)"""
# 1. 먼저 사용자 DN 검색
user_dn = self._find_user_dn(username)
if not user_dn:
return None
# 2. 사용자 계정으로 직접 바인딩 시도
try:
user_conn = Connection(
self.server,
user=user_dn,
password=password,
auto_bind=True
)
user_conn.unbind()
# 3. 인증 성공 시 사용자 정보 반환
return self.get_user_info(username)
except LDAPBindError:
return None # 인증 실패
def _find_user_dn(self, username: str) -> Optional[str]:
"""사용자 DN 검색"""
search_filter = f"(sAMAccountName={username})" # AD 환경
# OpenLDAP인 경우: f"(uid={username})"
self.conn.search(
search_base=self.base_dn,
search_filter=search_filter,
search_scope=SUBTREE,
attributes=['distinguishedName']
)
if self.conn.entries:
return str(self.conn.entries[0].distinguishedName)
return None
def get_user_info(self, username: str) -> Optional[dict]:
"""사용자 상세 정보 조회"""
search_filter = f"(sAMAccountName={username})"
self.conn.search(
search_base=self.base_dn,
search_filter=search_filter,
search_scope=SUBTREE,
attributes=[
'cn', 'mail', 'displayName', 'department',
'memberOf', 'telephoneNumber', 'title'
]
)
if not self.conn.entries:
return None
entry = self.conn.entries[0]
return {
'username': username,
'dn': str(entry.entry_dn),
'name': str(entry.cn) if entry.cn else None,
'email': str(entry.mail) if entry.mail else None,
'display_name': str(entry.displayName) if entry.displayName else None,
'department': str(entry.department) if entry.department else None,
'title': str(entry.title) if entry.title else None,
'groups': [str(g) for g in entry.memberOf] if entry.memberOf else []
}
def get_user_groups(self, username: str) -> List[str]:
"""사용자가 속한 그룹 목록 조회"""
user_info = self.get_user_info(username)
if not user_info:
return []
# memberOf에서 그룹 CN만 추출
groups = []
for group_dn in user_info.get('groups', []):
# "CN=Developers,OU=Groups,DC=example,DC=com" -> "Developers"
cn_part = group_dn.split(',')[0]
if cn_part.startswith('CN='):
groups.append(cn_part[3:])
return groups
def is_member_of(self, username: str, group_name: str) -> bool:
"""특정 그룹 멤버십 확인"""
groups = self.get_user_groups(username)
return group_name in groups
def search_users(self, search_term: str, limit: int = 100) -> List[dict]:
"""사용자 검색"""
search_filter = f"(&(objectClass=person)(|(cn=*{search_term}*)(mail=*{search_term}*)))"
self.conn.search(
search_base=self.base_dn,
search_filter=search_filter,
search_scope=SUBTREE,
attributes=['cn', 'mail', 'sAMAccountName'],
size_limit=limit
)
results = []
for entry in self.conn.entries:
results.append({
'username': str(entry.sAMAccountName) if entry.sAMAccountName else None,
'name': str(entry.cn) if entry.cn else None,
'email': str(entry.mail) if entry.mail else None,
})
return results
def close(self):
"""연결 종료"""
if self.conn:
self.conn.unbind()
# 사용 예시
if __name__ == "__main__":
# LDAP 클라이언트 초기화
ldap = LDAPClient(LDAP_SERVER, LDAP_BASE_DN)
# 관리자로 바인딩
if ldap.bind_admin(LDAP_BIND_DN, LDAP_BIND_PASSWORD):
print("관리자 바인딩 성공")
# 사용자 인증 테스트
user = ldap.authenticate_user("hong.gildong", "user_password")
if user:
print(f"인증 성공: {user['display_name']} ({user['email']})")
print(f"소속 그룹: {ldap.get_user_groups('hong.gildong')}")
# 권한 확인
if ldap.is_member_of("hong.gildong", "Administrators"):
print("관리자 권한 있음")
else:
print("인증 실패")
# 사용자 검색
users = ldap.search_users("개발")
for u in users:
print(f"검색 결과: {u['name']} - {u['email']}")
ldap.close()