1

I am working on a project that must use LDAP authentication. I am using the server at ldap.forumsys.com after finding the link on Stack Overflow to practice before adding to my Flask application.

If I run the ldapsearch bash command inside of my python code I get a whole bunch of usernames (Tesla etc...) and their associated data (there are no password hashes though). I am able to extract the usernames/user-data as shown here:

username = request.form['username']
password = request.form['password']
cmd = "ldapsearch -h ldap.forumsys.com -D cn=read-only-admin,dc=example,dc=com -w" + os.environ['LDAP_PWD'] + " -b dc=example,dc=com"
ldap_query = os.popen(cmd).read()
user_str = re.sub("\n", "", ldap_query)
users = user_str.split("#")
user_data = ""
for line in users:
    if username in line:
        user_data = line
        break

But then I realized that I LDAP is not the same as a database. I was hoping to find password hashes that I could use to authenticate a user's login information.

So then I tried the python-ldap3 module:

>>> conn = Connection(server, 'uid=tesla,dc=example,dc=com', 'password', auto_bind=True)
>>> conn.bound
True
>>> conn.entries
[]

Unfortunately I can't seem to get any data returned in the list after calling conn.entries.

I can see that the ldap3 module binded the connection. Does the ldapsearch command bind as well? If there are no password hashes, how should I authenticate the username/password entered by the user on the client side?

Thank you all very much.

  • 1
    You don't need to extract passwords or their hashes. You just need to try to bind as that user. If it succeeds, the username and password were correct. – user207421 Jun 23 '18 at 08:03
  • So if conn.bound results in true, it’s ok to authenticate? Thanks for the input –  Jun 23 '18 at 13:16
  • If it results in true you *have* authenticated. – user207421 Jun 23 '18 at 17:35
  • okay. I think what I was confused about was that typically an administrator password is used to log into a database. The password ( 'password' ) for that LDAP server is actually any user's password I suppose. It's a little unclear on the website. But if 'password' is the individual user's password then that makes perfect sense. Thanks –  Jun 24 '18 at 00:01

1 Answers1

1

If the statement...

conn.bound == True

Then the connection has been authenticated via LDAP