python操作windows AD的代码

3150阅读　0评论2015-09-21　expert1
分类：系统运维


  1. import ldap
  2. import ldap.modlist as modlist
  3. import test_Passwords
  4. class new:
  5.         def __init__(self,server='ad.xxx.com'):
  6.                 login = test_Passwords.new()
  7.                 username, password = login.credentials('ad')
  8.                 self.dn = {'base':'dc=ad,dc=xxx,dc=com'}
  9.                 self.dgattrs = {'user':{},'chat':{},'mail':{}}
  10.                 self.dgattrs['user']['dn'] = ','.join(['ou=Basers',self.dn['base']])
  11.                 self.dgattrs['user']['objectClass'] = ['top','group']
  12.                 self.dgattrs['user']['description'] = ['user_group']
  13.                 self.dgattrs['user']['member_field'] = 'member'
  14.                 self.dgattrs['user']['filter'] = '(objectClass=group)'
  15.                 self.dgattrs['all'] = self.dgattrs['user']
  16.                 self.dgattrs['chat']['dn'] = ','.join(['ou=Chat Groups',self.dn['base']])
  17.                 self.dgattrs['chat']['objectClass'] = ['top','groupOfUniqueNames']
  18.                 self.dgattrs['chat']['description'] = ['chat_group']
  19.                 self.dgattrs['chat']['member_field'] = 'uniqueMember'
  20.                 self.dgattrs['chat']['filter'] = '(&(objectClass=groupOfUniqueNames)(description=chat_group))'
  21.                 self.dgattrs['mail']['dn'] = ','.join(['ou=Email Aliases',self.dn['base']])
  22.                 self.dgattrs['mail']['objectClass'] = ['top','groupOfUniqueNames']
  23.                 self.dgattrs['mail']['description'] = ['mail_group']
  24.                 self.dgattrs['mail']['member_field'] = 'uniqueMember'
  25.                 self.dgattrs['mail']['filter'] = '(&(objectClass=groupOfUniqueNames)(description=mail_group))'
  26.                 host = 'ldap://%s' % server
  27.                 self.conn = ldap.initialize(host)
  28.                 self.conn.set_option(ldap.OPT_NETWORK_TIMEOUT,10)
  29.                 self.conn.set_option(ldap.OPT_TIMEOUT,10)
  30.                 self.conn.set_option(ldap.OPT_TIMELIMIT,10)
  31.                 self.conn.set_option(ldap.OPT_SIZELIMIT,0)
  32.                 self.conn.bind(username,password)
  33.                 self.conn.whoami_s()
  34.                 self.group_users = {}
  35.                 self.groups = []

  37.         def disconnect(self):
  38.                 self.conn.unbind()

  40.         def search(self,dn='dc=ad,dc=xxx,dc=com',search_filter='',attrs='cn',scope=ldap.SCOPE_SUBTREE):
  41.                 if isinstance(attrs,basestring): attrs=[attrs]
  42.                 results = []
  43.                 if not dn:
  44.                         dn = self.dn['base']

  46.                 try:
  47.                         s = self.conn.search_ext(dn, scope, search_filter, attrs, sizelimit=-1)
  48.                         while True:
  49.                                 stype,sresult = self.conn.result(s,0)
  50.                                 if stype == ldap.RES_SEARCH_ENTRY:
  51.                                         results.extend([sresult])
  52.                                 else:
  53.                                         break
  54.                 except ldap.NO_SUCH_OBJECT:
  55.                         return
  56.                 return results

  58.         def get_users(self,refresh=False):
  59.                 if refresh: del self.users
  60.                 try:
  61.                         return self.users
  62.                 except:
  63.                         self.users = []
  64.                         for userline in self.search(search_filter='(&(objectClass=user)(!(objectClass=computer))(!(userAccountControl=514))(!(userAccountControl=546))(!(userAccountControl=66050))(!(userAccountControl=66082))(!(userAccoun
  65. tControl=262658))(!(userAccountControl=262690))(!(userAccountControl=328194))(!(userAccountControl=328226)))'):
  66.                                 self.users.extend([userline[0][1]['cn'][0]])
  67.                         return self.users

  69.         def get_real_users(self,refresh=False):
  70.                 if refresh: del self.real_users
  71.                 try:
  72.                         return self.real_users
  73.                 except:
  74.                         self.real_users = []
  75.                         for userline in self.search(search_filter='(&(objectClass=user)(!(objectClass=computer))(!(userAccountControl=514))(!(userAccountControl=546))(!(userAccountControl=66050))(!(userAccountControl=66082))(!(userAccoun
  76. tControl=262658))(!(userAccountControl=262690))(!(userAccountControl=328194))(!(userAccountControl=328226))(!(UserAccountControl=66080)))'):
  77.                                 self.real_users.extend([userline[0][1]['cn'][0]])
  78.                         return self.real_users
  79.         def get_groups(self,gtype='all',refresh=False):
  80.                 if refresh and gtype in self.groups:
  81.                         del self.groups[gtype]
  82.                 try:
  83.                         return self.groups[gtype]
  84.                 except:
  85.                         self.groups = {'user':[],'chat':[],'mail':[],'all':[]}
  86.                         for g in self.groups:
  87.                                 if g == 'all': continue
  88.                                 dn = self.dgattrs[g]['dn']
  89.                                 search_filter = self.dgattrs[g]['filter']
  90.                                 #print g,dn,search_filter
  91.                                 for groupline in self.search(dn=dn,search_filter=search_filter):
  92.                                         self.groups[g].extend([groupline[0][1]['cn'][0]])
  93.                                         self.groups['all'].extend([groupline[0][1]['cn'][0]])
  94.                 return self.groups[gtype]

  96.         def create_group(self,group,users=[],gtype='user'):
  97.                 if isinstance(users,basestring): users=[users]
  98.                 if group in self.get_groups(gtype=gtype,refresh=True):
  99.                         print 'group exists skipping'
  100.                         return
  101.                 attrs = {}
  102.                 attrs['objectClass'] = self.dgattrs[gtype]['objectClass']
  103.                 attrs['description'] = self.dgattrs[gtype]['description']
  104.                 if users:
  105.                         for user in users:
  106.                                 if user in self.get_users():
  107.                                         if user not in self.get_groups(gtype=gtype):
  108.                                                 attrs.setdefault(self.dgattrs[gtype]['member_field'],[]).extend([self.get_user_attr(user,'distinguishedName')])
  109.                                         else:
  110.                                                 print user,'-> already in group skipping'
  111.                                 else:
  112.                                         print user,'-> not valid skipping'
  113.                         if self.dgattrs[gtype]['member_field'] not in attrs:
  114.                                 print 'all users invalid or already in group'
  115.                                 return
  116.                 elif gtype != 'user':
  117.                         print 'need users for that group type skipping'
  118.                         return

  120.                 attrs[self.dgattrs[gtype]['member_field']] = list(set(attrs[self.dgattrs[gtype]['member_field']]))

  122.                 dn = ','.join(['cn=%s'%group,self.dgattrs[gtype]['dn']])
  123.                 print dn,modlist.addModlist(attrs)
  124.                 self.conn.add_s(dn,modlist.addModlist(attrs))

  126.         def get_group_users(self,group,gtype='user',refresh=False):
  127.                 if group not in self.get_groups(gtype=gtype):
  128.                         print group,'-> not found skipping'
  129.                         return
  130.                 try:
  131.                         return self.group_users[gtype][group]
  132.                 except:
  133.                         pass
  134.                 self.group_users.setdefault(gtype,{})[group] = []
  135.                 attr = self.dgattrs[gtype]['member_field']
  136.                 users = self.get_group_attr(group=group,gtype=gtype,attr=attr)
  137.                 if isinstance(users,basestring): users = [users]
  138.                 for user in users:
  139.                         cn = user.split(',')[0].split('=')[1]
  140.                         self.group_users[gtype][group].extend([cn])
  141.                 return self.group_users[gtype][group]


  144.         def add_users_to_group(self,users,group,gtype='user'):
  145.                 dn = self.get_group_attr(group,gtype,'distinguishedName')
  146.                 if isinstance(users,basestring): users = [users]
  147.                 for user in users:
  148.                         if user in self.get_users():
  149.                                 if group in self.get_groups(gtype=gtype):
  150.                                         if user not in self.get_group_users(group,gtype=gtype):
  151.                                                 self.conn.modify_s(dn,[(ldap.MOD_ADD,self.dgattrs[gtype]['member_field'],self.get_user_attr(user,'distinguishedName'))])
  152.                                         else:
  153.                                                 print user,'-> already in group %s skipping'%group
  154.                                 else:
  155.                                         print group,'-> invalid group skipping'
  156.                         else:
  157.                                 print user,'-> invalid user skipping'

  159.         def remove_users_from_group(self,users,group,gtype='user'):
  160.                 dn = self.get_group_attr(group,gtype,'distinguishedName')
  161.                 if isinstance(users,basestring): users = [users]
  162.                 for user in users:
  163.                         if user in self.get_users():
  164.                                 if group in self.get_groups(gtype=gtype):
  165.                                         if user in self.get_group_users(group,gtype=gtype):
  166.                                                 self.conn.modify_s(dn,[(ldap.MOD_DELETE,self.dgattrs[gtype]['member_field'],self.get_user_attr(user,'distinguishedName'))])
  167.                                         else:
  168.                                                 print user,'-> already not in group %s skipping'%group
  169.                                 else:
  170.                                         print group,'-> invalid group skipping'
  171.                         else:
  172.                                 print user,'-> invalid user skipping'

  174.         def change_users_group(self,users,source_group,target_group,gtype='user'):
  175.                 self.remove_users_from_group(users,source_group,gtype=gtype)
  176.                 self.add_users_to_group(users,target_group,gtype=gtype)


  179.         def get_group_attr(self,group,gtype='user',attr='cn'):
  180.                 if group not in self.get_groups(gtype=gtype): return
  181.                 dn = ','.join(["cn=%s"%group,self.dgattrs[gtype]['dn']])
  182.                 search_filter = self.dgattrs[gtype]['filter']
  183.                 ret = self.search(dn=dn,search_filter=search_filter,attrs=attr)
  184.                 try:
  185.                         ret[0][0][1][attr]
  186.                 except KeyError:
  187.                         return

  189.                 val = ret[0][0][1][attr]
  190.                 if len(val) == 1:
  191.                         return val[0]
  192.                 else:
  193.                         return val


  196.         def get_user_attr(self,user,attr='cn',return_dn=False):
  197.                 if user not in self.get_users(): return
  198.                 dn = self.dgattrs['user']['dn']
  199.                 ret = self.search(dn=dn,search_filter="(&(objectClass=user)(!(objectClass=computer))(cn=%s))"%user,attrs=[attr])
  200.                 try:
  201.                         ret[0][0][1][attr]
  202.                 except:
  203.                         if return_dn:
  204.                                 return (ret[0][0][0],None)
  205.                         return
  206.                 val = ret[0][0][1][attr]
  207.                 if len(val) == 1:
  208.                         if return_dn:
  209.                                 return (ret[0][0][0],val[0])
  210.                         return val[0]
  211.                 else:
  212.                         if return_dn:
  213.                                 return (ret[0][0][0],val)
  214.                         return val

  216.         def set_user_attr(self,user,attr,val):
  217.                 if user not in self.get_users(): return
  218.                 dn,current_val = self.get_user_attr(user,attr,return_dn=True)

  220.                 if current_val:
  221.                         current_val = current_val[0]
  222.                 else:
  223.                         current_val = ''
  224.                 ldif = modlist.modifyModlist({attr:current_val},{attr:val})
  225.                 self.conn.modify_s(dn,ldif)

上一篇：Python来实现zabbix自动化
下一篇：python VS awk 在处理文本的不同之处