Skip to content

Commit 8b33547

Browse files
Vijay VishwakarmaVijay Vishwakarma
Vijay Vishwakarma
authored and
Vijay Vishwakarma
committed
first
0 parents  commit 8b33547

24 files changed

+6151
-0
lines changed

‎.gitignore‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# Python
2+
__pycache__/
3+
*.py[cod]
4+
*$py.class
5+
*.so
6+
.Python
7+
build/
8+
develop-eggs/
9+
dist/
10+
downloads/
11+
eggs/
12+
.eggs/
13+
lib/
14+
lib64/
15+
parts/
16+
sdist/
17+
var/
18+
wheels/
19+
pip-wheel-metadata/
20+
share/python-wheels/
21+
*.egg-info/
22+
.installed.cfg
23+
*.egg
24+
MANIFEST
25+
26+
# Virtual Environment
27+
.venv/
28+
venv/
29+
ENV/
30+
env/
31+
32+
# Flask
33+
flask_session/
34+
instance/
35+
36+
# Environment variables and configuration
37+
.env
38+
.env.local
39+
.env.production
40+
config/production.env
41+
config/*.env
42+
43+
# IDE
44+
.vscode/
45+
.idea/
46+
*.swp
47+
*.swo
48+
*~
49+
50+
# OS
51+
.DS_Store
52+
.DS_Store?
53+
._*
54+
.Spotlight-V100
55+
.Trashes
56+
ehthumbs.db
57+
Thumbs.db
58+
59+
# Logs
60+
*.log
61+
logs/
62+
63+
# Temporary files
64+
*.tmp
65+
*.temp
66+
67+
# LDIF files (examples in documentation)
68+
*.ldif
69+
70+
# Test files
71+
test_*.py
72+
*_test.py

‎POSIX_LOCKING_SUMMARY.md‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
# POSIX Account Locking Enhancement Summary
2+
3+
## Issue Identified
4+
- Standard accounts could be locked using `shadowFlag=1`
5+
- POSIX accounts showed as "locked" in the UI but users could still log in
6+
- The `shadowFlag` attribute alone is insufficient for POSIX account locking
7+
8+
## Solution Implemented
9+
Enhanced the locking mechanism with a three-tier approach:
10+
11+
### 1. Enhanced `lock_user_account()` Function
12+
**Multi-step locking process:**
13+
1. **Primary Method**: Set `shadowFlag=1` (standard shadow account locking)
14+
2. **POSIX Method**: Change `loginShell` to `/bin/false` (prevents login for POSIX accounts)
15+
3. **Fallback Method**: Add "ACCOUNT_LOCKED" to description field
16+
17+
### 2. Enhanced `unlock_user_account()` Function
18+
**Multi-step unlocking process:**
19+
1. **Primary Method**: Set `shadowFlag=0` (re-enable shadow account)
20+
2. **POSIX Method**: Restore original `loginShell` (re-enable login for POSIX accounts)
21+
3. **Fallback Method**: Remove "ACCOUNT_LOCKED" from description field
22+
23+
### 3. Enhanced `is_user_locked()` Function
24+
**Multi-tier detection:**
25+
1. Check `shadowFlag == '1'` (traditional method)
26+
2. Check `loginShell == '/bin/false'` (POSIX method)
27+
3. Check description contains "ACCOUNT_LOCKED" (fallback method)
28+
29+
### 4. Updated Template Logic
30+
Updated `templates/admin/users.html` to properly detect all locking methods:
31+
```jinja2
32+
{% set is_shadow_locked = user.attributes.get('shadowFlag', [''])[0] == '1' %}
33+
{% set is_shell_locked = user.attributes.get('loginShell', [''])[0] == '/bin/false' %}
34+
{% set is_desc_locked = 'ACCOUNT_LOCKED' in (user.attributes.get('description', [''])[0] or '') %}
35+
{% set is_locked = is_shadow_locked or is_shell_locked or is_desc_locked %}
36+
```
37+
38+
## Technical Details
39+
40+
### Why loginShell=/bin/false Works
41+
- When a user's login shell is set to `/bin/false`, login attempts are immediately terminated
42+
- This effectively prevents both SSH and local login access
43+
- Works for all POSIX-compliant systems
44+
45+
### Fallback Protection
46+
- Description field method ensures no account can bypass locking
47+
- Provides admin visibility of lock reason
48+
- Works even if LDAP schema doesn't support other methods
49+
50+
### Backwards Compatibility
51+
- Still supports standard `shadowFlag` locking for non-POSIX accounts
52+
- Graceful degradation if attributes are missing
53+
- No disruption to existing functionality
54+
55+
## Security Benefits
56+
1. **Comprehensive Coverage**: Both standard and POSIX accounts properly locked
57+
2. **Multiple Redundancy**: Three independent locking mechanisms
58+
3. **Immediate Effect**: Login blocking takes effect immediately
59+
4. **Admin Visibility**: Clear indication of lock status in UI
60+
5. **Audit Trail**: Lock reason preserved in description field
61+
62+
## Testing Verified
63+
- ✅ Standard account locking (shadowFlag=1)
64+
- ✅ POSIX account locking (loginShell=/bin/false)
65+
- ✅ Fallback locking (description field)
66+
- ✅ Mixed account type detection
67+
- ✅ Template UI correctly shows lock status
68+
- ✅ Application loads without errors
69+
70+
## Production Ready
71+
The enhanced POSIX account locking mechanism is now production-ready with:
72+
- Proper error handling
73+
- Debug mode conditioning
74+
- Comprehensive attribute management
75+
- Full backwards compatibility

‎README.md‎

Lines changed: 247 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,247 @@
1+
# LDAP Management Portal
2+
3+
A comprehensive Flask-based web application for LDAP administration and user self-service portal built with Bootstrap 5.
4+
5+
## Features
6+
7+
### 👤 User Self-Service Portal
8+
- **User Login**: Normal users can login with their LDAP credentials
9+
- **Profile Management**: Users can update their personal information (email, phone, description, etc.)
10+
- **Profile Photos**: Upload and manage profile photos using jpegPhoto attribute with automatic resizing
11+
- **Password Change**: Secure password change functionality with SSHA encryption
12+
- **Password Expiry Information**: View password expiry status and remaining days (POSIX users)
13+
- **User Directory**: Browse and search other users in the organization
14+
- **Clean Dashboard**: Intuitive interface showing account status and quick actions
15+
16+
### 🛡️ Multi-Tier Admin System
17+
#### Super Administrator (`cn=admin,dc=mylab,dc=lan`)
18+
- **Full system access** with all administrative privileges
19+
- **System account protection** (cannot modify own profile)
20+
- **Login**: Use username `admin` with admin DN credentials
21+
22+
#### Group Administrators (members of `cn=admins` group)
23+
- **User management** capabilities
24+
- **Group management** access
25+
- **Limited administrative privileges**
26+
- **Self-profile modification** allowed
27+
28+
### 🔧 Administrative Features
29+
- ✅ **Complete User Management**: Create, read, update, delete user accounts
30+
- ✅ **POSIX User Support**: Create users with POSIX attributes (UID, GID, home directory, shell)
31+
- ✅ **Complete Group Management**:
32+
- Create both standard and POSIX groups
33+
- Delete existing groups
34+
- Add/remove members from groups
35+
- View group membership details
36+
- ✅ **Bulk User Creation**: Upload CSV files to create multiple users at once
37+
- ✅ **Profile Photo Management**: Upload, preview, and manage user photos (jpegPhoto attribute)
38+
- ✅ **Password Expiry Management**: View and manage password expiration for POSIX users
39+
- ✅ **User Search & Filtering**: Search users by name, email, or other attributes
40+
- ✅ **Comprehensive Statistics**: LDAP server statistics dashboard with user/group counts
41+
- ✅ **Generic Entry Editor**: Edit any LDAP entry with all attributes
42+
- ✅ **Lock/Unlock Users**: Temporarily disable user accounts
43+
- ✅ **Admin Dashboard**: Comprehensive administrative interface with real-time statistics
44+
- ✅ **Security Features**: Environment-based configuration, secure password handling
45+
46+
## Technology Stack
47+
48+
- **Backend**: Python 3.12+ with Flask
49+
- **Frontend**: Bootstrap 5 with Font Awesome icons
50+
- **LDAP Client**: ldap3 library for robust LDAP operations
51+
- **Authentication**: Session-based authentication with LDAP bind
52+
- **Security**: Environment variable configuration, no hardcoded passwords
53+
54+
## Quick Start
55+
56+
1. **Set up environment variables**:
57+
```bash
58+
export LDAP_ADMIN_PASSWORD="your_admin_password"
59+
```
60+
Or use the interactive setup script:
61+
```bash
62+
./setup_env.sh
63+
```
64+
65+
2. **Install dependencies**:
66+
```bash
67+
python -m venv .venv
68+
source .venv/bin/activate
69+
pip install -r requirements.txt
70+
```
71+
72+
3. **Run the application**:
73+
```bash
74+
python app.py
75+
```
76+
77+
4. **Access the portal**:
78+
- **URL**: http://localhost:5000
79+
- **Admin Login**: Username `admin` + your LDAP admin password
80+
- **User Login**: Any valid LDAP user credentials
81+
82+
## Production Deployment
83+
84+
For production deployment with systemd service, Nginx proxy, and complete LDAP server setup, see the comprehensive [SETUP.md](SETUP.md) guide.
85+
86+
## Configuration
87+
88+
The application supports environment-based configuration:
89+
90+
| Environment Variable | Default Value | Description |
91+
|---------------------|---------------|-------------|
92+
| `LDAP_SERVER` | `192.168.1.1` | LDAP server hostname/IP |
93+
| `LDAP_PORT` | `389` | LDAP server port |
94+
| `LDAP_BASE_DN` | `dc=mylab,dc=lan` | LDAP base DN |
95+
| `LDAP_ADMIN_DN` | `cn=admin,dc=mylab,dc=lan` | LDAP admin DN |
96+
| `LDAP_ADMIN_PASSWORD` | **(Required)** | LDAP admin password |
97+
| `DEBUG_MODE` | `False` | Enable debug logging (set to `true` only for development) |
98+
99+
## Security Features
100+
101+
- ✅ **No hardcoded passwords** - All credentials via environment variables
102+
- ✅ **Secure session management** - Flask-Session with filesystem storage
103+
- ✅ **LDAP authentication** - Direct LDAP bind for user verification
104+
- ✅ **Multi-tier access control** - Super admin vs Group admin privileges
105+
- ✅ **Input validation** - Form validation and LDAP injection prevention
106+
- ✅ **Secure configuration** - Environment-based sensitive data handling
107+
108+
## File Structure
109+
110+
```
111+
pythonldapman/
112+
├── app.py # Main Flask application
113+
├── requirements.txt # Python dependencies
114+
├── setup_env.sh # Environment setup script
115+
├── INSTALLATION.md # Complete installation guide
116+
├── static/ # Frontend assets (CSS, JS, images)
117+
├── templates/ # Jinja2 HTML templates
118+
└── config/ # Configuration files (created during setup)
119+
```
120+
121+
## License
122+
123+
This project is developed for LDAP administration and user self-service purposes.
124+
125+
## Support
126+
127+
For installation and configuration issues, refer to [SETUP.md](SETUP.md) or check the application logs.
128+
```bash
129+
python app.py
130+
```
131+
132+
2. Open your web browser and go to: `http://localhost:5000`
133+
134+
3. Login credentials:
135+
- **Admin**: Username `admin` with your admin password
136+
- **Users**: Use their LDAP username and password
137+
138+
## User Guide
139+
140+
### For Regular Users
141+
1. Login with your LDAP username and password
142+
2. Navigate to "My Profile" to update your information
143+
3. Use "Change Password" to update your password
144+
4. All changes are saved directly to the LDAP directory
145+
146+
### For Administrators
147+
1. Login with username `admin` and your admin password
148+
2. Access the "Admin Panel" from the navigation menu
149+
3. Manage users through "Manage Users"
150+
4. Create new users with "Add New User"
151+
5. Edit any LDAP entry with the generic entry editor
152+
6. Delete entries with confirmation dialogs
153+
154+
## Security Features
155+
156+
- **LDAP Authentication**: All logins verified against LDAP server
157+
- **Session Management**: Secure session handling with Flask-Session
158+
- **Password Hashing**: SSHA password hashing for new passwords
159+
- **Access Control**: Role-based access with user/admin separation
160+
- **Input Validation**: Form validation and sanitization
161+
162+
## LDAP Schema Support
163+
164+
The application supports standard LDAP object classes:
165+
166+
### User Accounts (inetOrgPerson)
167+
- uid (username)
168+
- cn (common name)
169+
- sn (surname)
170+
- givenName (first name)
171+
- mail (email)
172+
- telephoneNumber (phone)
173+
- userPassword (password)
174+
- description
175+
176+
### Groups (groupOfNames)
177+
- cn (group name)
178+
- description
179+
- member (group members)
180+
181+
## File Structure
182+
183+
```
184+
pythonldapman/
185+
├── app.py # Main Flask application
186+
├── requirements.txt # Python dependencies
187+
├── templates/ # Jinja2 templates
188+
│ ├── base.html # Base template with Bootstrap
189+
│ ├── login.html # Login page
190+
│ ├── dashboard.html # User dashboard
191+
│ ├── profile.html # User profile editor
192+
│ ├── change_password.html # Password change form
193+
│ └── admin/ # Admin templates
194+
│ ├── panel.html # Admin dashboard
195+
│ ├── users.html # User management
196+
│ ├── groups.html # Group management
197+
│ ├── add_user.html # Add user form
198+
│ └── edit_entry.html # Generic entry editor
199+
└── static/ # Static files (if needed)
200+
```
201+
202+
## Customization
203+
204+
### LDAP Configuration
205+
Edit the configuration variables in `app.py`:
206+
207+
```python
208+
LDAP_SERVER = '192.168.1.1'
209+
LDAP_PORT = 389
210+
LDAP_BASE_DN = 'dc=mylab,dc=lan'
211+
LDAP_ADMIN_DN = 'cn=admin,dc=mylab,dc=com'
212+
```
213+
214+
### UI Customization
215+
- Templates use Bootstrap 5 classes for easy customization
216+
- Modify `templates/base.html` for global layout changes
217+
- Add custom CSS in the `static/` directory
218+
219+
## Error Handling
220+
221+
The application includes comprehensive error handling:
222+
- LDAP connection errors
223+
- Authentication failures
224+
- Invalid form data
225+
- Missing entries
226+
- Permission denied scenarios
227+
228+
## Development
229+
230+
To contribute or modify the application:
231+
232+
1. The main application logic is in `app.py`
233+
2. Templates are in the `templates/` directory
234+
3. Use the Flask development server for testing
235+
4. All LDAP operations go through the `LDAPManager` class
236+
237+
## License
238+
239+
This project is open-source and available for modification and distribution.
240+
241+
## Support
242+
243+
For issues or questions:
244+
1. Check the LDAP server connectivity
245+
2. Verify credentials and DN configuration
246+
3. Review Flask application logs
247+
4. Test LDAP operations manually with ldapsearch

0 commit comments

Comments
 (0)