Python-ldap：是否可以在不显式写入密码的情况下进行绑定？答案

【问题标题】：Python-ldap: is it possible to bind without explicitly writing the password?Python-ldap：是否可以在不显式写入密码的情况下进行绑定？
【发布时间】：2018-02-14 19:27:12
【问题描述】：

编写一个 Python 脚本，我想知道是否可以在不以明文形式写入密码的情况下绑定到 LDAP 服务器，如下例所示：

import ldap

l = ldap.open("myserver")
username = "cn=Manager, o=mydomain.com"

## I don't want to write the password here in plaintext
password  = "secret"

l.simple_bind(username, password)

【问题讨论】：

是的，这是可能的，我通常使用 PyCrypto 将凭据加密到文件中。然后我会解密该文件并传递值。

标签： python ldap python-ldap

【解决方案1】：

用于解密名为“.credentials”的文件的示例函数。这当然会有一个单独的脚本，在尝试使用它之前首先将凭据加密到文件中。

所以你会调用这个函数：

username, password = decrypt()

l.simple_bind(username, password)

from Crypto.Cipher import AES
import base64
from local_logging import info

def decrypt(dir_path):
    #Read '.credentials' file and return unencrypted credentials (user_decoded, pass_decoded)

    lines = [line.rstrip('\n') for line in open(dir_path + '/.credentials')]

    user_encoded = lines[0]
    user_secret = lines[1]
    pass_encoded = lines[2]
    pass_secret = lines[3]

    # the character used for padding--with a block cipher such as AES, the value
    # you encrypt must be a multiple of BLOCK_SIZE in length.  This character is
    # used to ensure that your value is always a multiple of BLOCK_SIZE
    PADDING = '{'

    DecodeAES = lambda c, e: c.decrypt(base64.b64decode(e)).rstrip(PADDING)

    # create a cipher object using the random secret
    user_cipher = AES.new(user_secret)
    pass_cipher = AES.new(pass_secret)

    # decode the encoded string
    user_decoded = DecodeAES(user_cipher, user_encoded)
    pass_decoded = DecodeAES(pass_cipher, pass_encoded)

    return (user_decoded, pass_decoded)

【讨论】：