capricornxl / ad-password-self-service Goto Github PK
View Code? Open in Web Editor NEW基于Python 3.8 + Django 3.2的密码自助平台,AD用户自助修改密码,结合<钉钉>/<企业微信>应用免密码授权后可自行重置密码、解锁自己的账号。
License: Apache License 2.0
基于Python 3.8 + Django 3.2的密码自助平台,AD用户自助修改密码,结合<钉钉>/<企业微信>应用免密码授权后可自行重置密码、解锁自己的账号。
License: Apache License 2.0
非常优秀,如果能加入支持微信扫码就更棒了.
想问下如何对接飞书
由于现在企业微信应用强制必须配置可信IP,但公司又没有固定公网IP出口的专线,都是动态公网IP,导致出口IP变化之后无法使用企业微信OAuth2认证重置密码,每次IP变化都必须手动在企业微信管理后台修改可信IP,虽然有固定公网IP的云服务器,但考虑到把程序部署到云服务器的话又无法直接访问到内网的域控,操作起来更复杂,在多次考虑和尝试之后决定使用正向代理的方式比较简单
需要有一台固定公网IP的云服务器,在上面搭建 Squid 代理(或其他),我是根据这个教程搭建(一定要加密防止被扫):docker一键安装http代理服务器squid
修改程序的 utils/wework_api/abstract_api.py
文件,在开头的 class 前面添加代理信息:
# 代理服务器
proxy = {
'http': 'http://username:[email protected]:port',
'https': 'http://username:[email protected]:port'
}
然后往下找到 http_post 和 http_get 定义,在 requests 参数里使用代理 proxies=proxy
def __http_post(self, url, args):
real_url = self.__append_token(url)
if DEBUG is True:
print(real_url, args)
return requests.post(real_url, proxies=proxy, data=json.dumps(args, ensure_ascii=False).encode('utf-8')).json()
def __http_get(self, url):
real_url = self.__append_token(url)
if DEBUG is True:
print(real_url)
return requests.get(real_url, proxies=proxy).json()
最后直接重启服务器就可以了,这样程序就会通过代理使用云服务器的IP去访问企业微信的接口,将云服务器的IP加入到可信IP里即可
有同样需求的可以尝试这个操作,希望作者后续也能考虑添加一个代理选项,我只会点三脚猫功夫就只会手动改改代码了
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/core/handlers/wsgi.py", line 133, in call
response = self.get_response(request)
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/core/handlers/base.py", line 130, in get_response
response = self._middleware_chain(request)
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/core/handlers/exception.py", line 49, in inner
response = response_for_exception(request, exc)
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/core/handlers/exception.py", line 114, in response_for_exception
response = handle_uncaught_exception(request, get_resolver(get_urlconf()), sys.exc_info())
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/core/handlers/exception.py", line 152, in handle_uncaught_exception
callback = resolver.resolve_error_handler(500)
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/urls/resolvers.py", line 611, in resolve_error_handler
callback = getattr(self.urlconf_module, 'handler%s' % view_type, None)
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/utils/functional.py", line 48, in get
res = instance.dict[self.name] = self.func(instance)
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/urls/resolvers.py", line 591, in urlconf_module
return import_module(self.urlconf_name)
File "/usr/share/python-3.8.9/lib/python3.8/importlib/init.py", line 127, in import_module
return _bootstrap._gcd_import(name[level:], package, level)
File "", line 1014, in _gcd_import
File "", line 991, in _find_and_load
File "", line 975, in _find_and_load_unlocked
File "", line 671, in _load_unlocked
File "", line 783, in exec_module
File "", line 219, in _call_with_frames_removed
File "./pwdselfservice/urls.py", line 3, in
import resetpwd.views
File "./resetpwd/views.py", line 15, in
from conf.local_settings import SCAN_CODE_TYPE, DING_MO_APP_ID, WEWORK_CORP_ID, WEWORK_AGENT_ID, HOME_URL, DING_CORP_ID
ImportError: cannot import name 'DING_MO_APP_ID' from 'conf.local_settings' (./conf/local_settings.py)
[pid: 5478|app: 0|req: 4/21] 192.168.230.56 () {38 vars in 694 bytes} [Wed Aug 4 01:07:12 2021] GET /favicon.ico => generated 0 bytes in 9 msecs (HTTP/1.0 500) 0 headers in 0 bytes (0 switches on core 3)
搭建完后,尝试修改密码,但提示用户名或密码不正确,用企业微信扫码。扫码后能检索到用户名,但输入新密码后提示报错,报错内容为(错误[LDAPOperationResult - LDAPOperationResult: 0000001F: SvcErr: DSID-031A12D2, problem 5003 (WILL_NOT_PERFORM), data 0 - None - None - None - None - None],请与管理员联系.)
如题,大佬有没有可能实现:
基于企业微信、钉钉实现身份认证后,获取到用户绑定的手机号去实现即可以通过企业微信钉钉重置密码也能实现手机短信重置密码
再次感谢!
因为安全的问题,现在微信接口里获取不到邮箱地址,返回的user_info里email字段是空,提示"None格式化失败,注意:account用户账号是邮箱或DOMAIN\username或username格式!"
环境说明:
主域系统:windwos2008R2
AD域中以部门建立OU,公司的OU下面有各部门的OU
如果BN 写成 :OU=gs,DC=abc,DC=com
连接AD域后,会报如下错误
LDAPInvalidCredentialsResult: 8009030C: LdapErr: DSID-0C0905DF, comment: AcceptSecurityContext error, data 52e, v1db1
错误信息如下:
2021-06-30 15:32:40,298 ERROR ./resetpwd/views.py views.index 68: [异常] 请求方法:POST,请求路径:/
2021-06-30 15:32:40,324 ERROR /usr/share/python-3.8.9/lib/python3.8/site-packages/django/utils/log.py log.log_response 224: Internal Server Error: /
Traceback (most recent call last):
File "./utils/ad_ops.py", line 56, in init
self.conn = Connection(server, auto_bind=self.auto_bind, user=r'{}{}'.format(self.domain, self.user), password=self.password,
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/ldap3/core/connection.py", line 363, in init
self._do_auto_bind()
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/ldap3/core/connection.py", line 389, in _do_auto_bind
self.bind(read_server_info=True)
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/ldap3/core/connection.py", line 628, in bind
response = self.do_ntlm_bind(controls)
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/ldap3/core/connection.py", line 1398, in do_ntlm_bind
response = self.post_send_single_response(self.send('bindRequest', request, controls))
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/ldap3/strategy/sync.py", line 160, in post_send_single_response
responses, result = self.get_response(message_id)
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/ldap3/strategy/base.py", line 403, in get_response
raise LDAPOperationResult(result=result['result'], description=result['description'], dn=result['dn'], message=result['message'], response_type=result['type'])
ldap3.core.exceptions.LDAPInvalidCredentialsResult: LDAPInvalidCredentialsResult - 49 - invalidCredentials - None - 8009030C: LdapErr: DSID-0C0905DF, comment: AcceptSecurityContext error, data 52e, v1db1^@ - bindResponse - None
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/core/handlers/exception.py", line 47, in inner
response = get_response(request)
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/core/handlers/base.py", line 181, in _get_response
response = wrapped_callback(request, *callback_args, **callback_kwargs)
File "./resetpwd/views.py", line 90, in index
auth_status, auth_result = AdOps().ad_auth_user(username=username, password=old_password)
File "./utils/ad_ops.py", line 59, in init
raise LDAPOperationResult("LDAPInvalidCredentialsResult: " + str(lic_e.message))
ldap3.core.exceptions.LDAPOperationResult: LDAPOperationResult - LDAPInvalidCredentialsResult: 8009030C: LdapErr: DSID-0C0905DF, comment: AcceptSecurityContext error, data 52e, v1db1^@ - None - None - None - None - None
请问有测试测试工具么?部署好后进行修改等都提示无法连接域控。
就比如我现在是用ip访问的网址,但微信扫码后默认会跳转到域名的网址上去,请问是否在哪边能更改,还有一个问题就是我发现在一键部署内设置了端口后,其实80端口和该端口都是能访问此页面的
AD 域服务器安装证书服务了,里面也有颁发的证书。不知道这样是不是就可以使用636了。conf里的文件也修改了。授权的用户也添加了修改密码的权限 。但我感觉server error 500应该是没跟AD域连接成功。
系统:centos 8
内核版本:4.18.0-240.el8.x86_64
安装版本:ad-password-self-service-master 2月10日更新版本
现象:使用一键部署脚本安装成功后,打开域名502。
一键安装的时候我是把ad-password-self-service-master这个目录放在/tmp下执行的 部署脚本./auto-install.sh。是否需要把哪个目录复制到nginx所在的什么目录下才不会报502错误?
在页面直接输入原密码,新密码修改,确认后报用户名或原密码错误(确定原密码正确),扫码重置密码能正常修改,不知道大神还有没有空看看什么原因?谢谢。
钉钉修改提示不符合复杂度,老密码修改提示老密码不对
看到现在对密码的复杂度是至少十位,必须要数字+大小写字母+符号,这个判断规则是写在哪儿的,想改成任意三种组合十位即可
错误[cannot unpack non-iterable NoneType object],请与管理员联系.
log.log日志报错信息:
2022-06-24 10:03:05,025 INFO ./resetpwd/views.py views.callback_check 127: [成功] 请求方法:GET,请求路径:/callbackCheck,CODE:ac63e37ee0383316b34e876d82446a72
2022-06-24 10:03:05,275 DEBUG /usr/share/python-3.8.9/lib/python3.8/site-packages/django/template/base.py base._resolve_lookup 869: Exception while resolving variable 'unsecpwd' in template 'resetPassword.v1.html'.
Traceback (most recent call last):
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/template/base.py", line 829, in _resolve_lookup
current = current[bit]
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/template/context.py", line 83, in getitem
raise KeyError(key)
KeyError: 'unsecpwd'
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/template/base.py", line 835, in _resolve_lookup
if isinstance(current, BaseContext) and getattr(type(current), bit):
AttributeError: type object 'RequestContext' has no attribute 'unsecpwd'
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/template/base.py", line 843, in _resolve_lookup
current = current[int(bit)]
ValueError: invalid literal for int() with base 10: 'unsecpwd'
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/share/python-3.8.9/lib/python3.8/site-packages/django/template/base.py", line 848, in _resolve_lookup
raise VariableDoesNotExist("Failed lookup for key "
django.template.base.VariableDoesNotExist: Failed lookup for key [unsecpwd] in [{'True': True, 'False': False, 'None': None}, {'csrf_token': <SimpleLazyObject: 'ztZtQV5e4cpnSFl8CUqSxnL4pp37QHuRMNzhqKx8d3sBy8DsCHWtatBGbIYdVWTn'>, 'request': <WSGIRequest: GET '/resetPassword'>, 'user': <SimpleLazyObject: <function AuthenticationMiddleware.process_request.. at 0x7f068cab6f70>>, 'perms': <django.contrib.auth.context_processors.PermWrapper object at 0x7f068ca54670>, 'messages': <django.contrib.messages.storage.fallback.FallbackStorage object at 0x7f068ca54a90>, 'DEFAULT_MESSAGE_LEVELS': {'DEBUG': 10, 'INFO': 20, 'SUCCESS': 25, 'WARNING': 30, 'ERROR': 40}}, {}, {'username': 'zhaowei'}]
2022-06-24 10:03:30,888 ERROR ./resetpwd/views.py views.reset_pwd_by_callback 221: [异常] :cannot unpack non-iterable NoneType object
系统:centos7.9
内核版本:3.10.0-1160.81.1.el7.x86_64
安装版本:1.0.7.6
现象:使用一键部署脚本安装成功后,打开域名502
请问我该如何修正该错误呢。谢谢
比如默认输入的用户名为:domain\username或者邮箱地址
能否实现输入的用户名为:username (不用加domain或邮箱地址)
这种情况是因为公司邮箱和域控是一个域名,而邮箱是外面租用那种,分开的
首次运行,没能正确加载layui.js文件,console报错Uncaught ReferenceError: layui is not defined,是由什么需要注意的吗?
自动部署完成无报错,打开连接,浏览器提示504 Gateway Time-out,会是什么问题呢?
请教一下是否支持钉钉与ad的用户同步
账号不是锁定状态,老密码正确的
Originally posted by @wangxinhuan in #5 (comment)
密码无法修改的问题,排查的原因是:因为AD修改密码是需要启用SSL或TLS通信。
大神,弄个docker吧
好像是因为企业微信的邮箱与oa账户没有匹配到,会提示这样的报错,请问在哪边可以修改这个报错语句
大佬,企微的接入在重置密码页面需要使用userid为账户信息,如何更改
考虑到安全性,重置AD密码能否添加禁止使用历史密码呢
注意,如果是从2022年8月之后建立的企业微信小应用,在接口上会发和变化,导致现在的代码访问企业微信的接口拿不到用户的邮箱数据。
所以会影响主体的功能,目前暂时没时间修复~~
小白先跪谢大佬开源软件233
有个问题,貌似对于钉钉通讯录的只要有userid就能读到email,jobnumber之类的信息,要改读取规则只要改format username里面就可以。。但是对于钉钉家校通讯录如果要读取学生信息只有userid貌似还不够 需要班级id啥的。。这个可以提供支持么🌝🌝
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.