Ticket #5370: ldap_user_filter.patch

mediagoblin/plugins/ldap/tools.py

@@ -48 +48 @@
 
         return email
 
+    def is_user_allowed(self, config, username):
+        """ Apply a configured user filter.
+
+        If an user filter is configured apply it and check whether there is
+        exactly one result.
+
+        Do nothing if there is no filter.
+
+        Args:
+            config (dict of str: str): The mediagoblin config dictionary.
+            username (string): Username to use (replaces '{username}' in the filter).
+        Returns:
+            bool: True if the filter yields ecactly one result or if there is
+                  no filter configured, False otherwise.
+        """
+        user_allowed = True
+        use_user_filter = (config['LDAP_USER_FILTER'] is not None
+            if 'LDAP_USER_FILTER' in config else False)
+
+        if use_user_filter:
+            _log.info('Applying user filter')
+
+            user_filter_result = self.conn.search_s(
+                config['LDAP_SEARCH_BASE'],
+                ldap.SCOPE_SUBTREE,
+                config['LDAP_USER_FILTER'].format(username=username))
+
+            user_allowed = len(user_filter_result) == 1
+
+        return user_allowed
+
     def login(self, username, password):
         for k, v in six.iteritems(self.ldap_settings):
             try:
@@ -55 +86 @@
                 user_dn = v['LDAP_USER_DN_TEMPLATE'].format(username=username)
                 self.conn.simple_bind_s(user_dn, password.encode('utf8'))
                 email = self._get_email(v, username)
-                return username, email
+
+                user_allowed = self.is_user_allowed(v, username)
+
+                return (username, email) if user_allowed else (False, None)
 
             except ldap.LDAPError, e:
                 _log.info(e)