Authenticating against active directory using python + ldap

Question

How do I authenticate against AD using Python + LDAP. I'm currently using the python-ldap library and all it is producing is tears.

I can't even bind to perform a simple query:

import sys
import ldap


Server = "ldap://my-ldap-server"
DN, Secret, un = sys.argv[1:4]

Base = "dc=mydomain,dc=co,dc=uk"
Scope = ldap.SCOPE_SUBTREE
Filter = "(&(objectClass=user)(sAMAccountName="+un+"))"
Attrs = ["displayName"]

l = ldap.initialize(Server)
l.protocol_version = 3
print l.simple_bind_s(DN, Secret)

r = l.search(Base, Scope, Filter, Attrs)
Type,user = l.result(r,60)
Name,Attrs = user[0]
if hasattr(Attrs, 'has_key') and Attrs.has_key('displayName'):
  displayName = Attrs['displayName'][0]
  print displayName

sys.exit()

Running this with myusername@mydomain.co.uk password username gives me one of two errors:

Invalid Credentials - When I mistype or intentionally use wrong credentials it fails to authenticate.

ldap.INVALID_CREDENTIALS: {'info': '80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece', 'desc': 'Invalid credentials'}

Or

ldap.OPERATIONS_ERROR: {'info': '00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece', 'desc': 'Operations error'}

What am I missing out to bind properly?

I am getting the same errors on fedora and windows.

"...and all it is producing is tears." Does **tears** rhyme with Bears or Beers? — philshem, Aug 07 '14 at 08:31

score 52 · Accepted Answer · answered Sep 26 '08 at 16:18

52

I was missing

l.set_option(ldap.OPT_REFERRALS, 0)

From the init.

answered Sep 26 '08 at 16:18

1729

4,961
2
28
17

3

The root cause of this bug is that you have referrals in the initial response and the windows LDAP code does not send the credentials to the referral server. If you used kerberos credentials it should work. – schlenk Dec 17 '09 at 23:04
2

I had different symptoms but this same option fixed my problem. Summarized it in a blog post: http://www.chaverma.com/blog/index.php/2013/06/python-ldap-functions-run-forever-against-activedirectory/ – Chris Jun 30 '13 at 19:41
Not sure if related, but I had the same problem and it seems 1729's solution did something - But sometimes the LDAP server just answers INVALID CREDENTIALS immediately. After a while it calms down and works again. – Nitay May 26 '14 at 14:11

score 33 · Answer 2 · answered Sep 26 '08 at 20:23

33

If you are open to using pywin32, you can use Win32 calls from Python. This is what we do in our CherryPy web server:

import win32security
token = win32security.LogonUser(
    username,
    domain,
    password,
    win32security.LOGON32_LOGON_NETWORK,
    win32security.LOGON32_PROVIDER_DEFAULT)
authenticated = bool(token)

answered Sep 26 '08 at 20:23

davidavr

14,143
4
27
31

4

simple and clean! Thanks! – alexroat Oct 02 '13 at 15:07
1

This solution worked for me in a Python Flask application while behind a restrictive NTLM corporate proxy. Some other LDAP-based options simply wouldn't work. – Gigaflop Jan 02 '19 at 20:53
@Gigaflop I had similar issues, after debugging for 4 hours I finally found this thread – McSebi Jan 28 '22 at 09:49

score 7 · Answer 3 · answered Jul 14 '09 at 16:02

7

That worked for me, l.set_option(ldap.OPT_REFERRALS, 0) was the key to access the ActiveDirectory. Moreover, I think that you should add an "con.unbind()" in order to close the connection before finishing the script.

answered Jul 14 '09 at 16:02

alfredocambera

3,155
34
29

8

From the [python-ldap documentation](http://www.python-ldap.org/doc/html/ldap.html): Instances of `LDAPObject` are returned by `initialize()`. The connection is automatically unbound and closed when the LDAP object is deleted. – Søren Løvborg Aug 16 '11 at 16:31
You close the session, not the connection. – Romulus Jan 21 '15 at 21:04

score 6 · Answer 4 · edited May 23 '17 at 12:26

6

Here's some simple code that works for me.

import ldap  # run 'pip install python-ldap' to install ldap module.
conn = ldap.open("ldaphost.company.com")
conn.simple_bind_s("myuser@company.com", "mypassword")

This is based on a previous answer.

edited May 23 '17 at 12:26

Community

1
1

answered Aug 16 '13 at 21:32

JohnMudd

13,607
2
26
24

1

This doesn't work anymore, you'll receive `AttributeError: module 'ldap' has no attribute 'open'` – Josh Correia May 07 '20 at 18:50

score 4 · Answer 5 · edited Jul 13 '23 at 21:43

4

Based on the excellent ldap3 tutorial:

from ldap3 import Server, Connection, ALL, NTLM
server = Server('server_name_or_ip', get_info=ALL)
conn = Connection(server, user="user_name", password="password", auto_bind=True)
conn.extend.standard.who_am_i()
server.info

I did the above in Python3 but it's supposed to be compatible with Python 2.

edited Jul 13 '23 at 21:43

jeffmcc

263
3
9

answered Jan 29 '19 at 08:22

Nagev

10,835
4
58
69

score 3 · Answer 6 · edited Oct 28 '11 at 22:23

if you have Kerberos installed and talking to AD, as would be the case with, say, Centrify Express installed and running, you might just use python-kerberos. E.g.

import kerberos
kerberos.checkPassword('joe','pizza','krbtgt/x.pizza.com','X.PIZZA.COM')`

would return True a user 'joe' has password 'pizza' in the Kerberos realm X.PIZZA.COM. (typically, I think, the latter would be the same as the name of the AD Domain)

score 2 · Answer 7 · answered Sep 30 '08 at 14:36

I see your comment to @Johan Buret about the DN not fixing your problem, but I also believe that is what you should look into.

Given your example, the DN for the default administrator account in AD will be: cn=Administrator,cn=Users,dc=mydomain,dc=co,dc=uk - please try that.

score 1 · Answer 8 · answered Jul 13 '16 at 10:01

1

I had the same issue, but it was regarding the password encoding

.encode('iso-8859-1')

Solved the problem.

answered Jul 13 '16 at 10:01

Dr.Ü

121
4

score 1 · Answer 9 · edited Jun 22 '13 at 19:33

I tried to add

l.set_option(ldap.OPT_REFERRALS, 0)

but instead of an error Python just hangs and won't respond to anything any more. Maybe I'm building the search query wrong, what is the Base part of the search? I'm using the same as the DN for the simple bind (oh, and I had to do l.simple_bind, instead of l.simple_bind_s):

import ldap
local = ldap.initialize("ldap://127.0.0.1")
local.simple_bind("CN=staff,DC=mydomain,DC=com")
#my pc is not actually connected to this domain 
result_id = local.search("CN=staff,DC=mydomain,DC=com", ldap.SCOPE_SUBTREE, "cn=foobar", None)
local.set_option(ldap.OPT_REFERRALS, 0)
result_type, result_data = local.result(result_id, 0)

I'm using AD LDS and the instance is registered for the current account.

score 0 · Answer 10 · answered Sep 26 '08 at 17:14

0

Use a Distinguished Name to log on your system."CN=Your user,CN=Users,DC=b2t,DC=local" It should work on any LDAP system, including AD

answered Sep 26 '08 at 17:14

Johan Buret

2,614
24
32

score 0 · Answer 11 · answered Mar 30 '12 at 13:25

0

For me changing from simple_bind_s() to bind() did the trick.

answered Mar 30 '12 at 13:25

xcl

9
1

Authenticating against active directory using python + ldap

11 Answers11

Linked