finallycoffee/self-service-api
2
0
Fork 1
Code Issues Pull Requests 1 Projects Releases Wiki Activity

add bcrypt password hashing and clean up code #1

Open
julia wants to merge 5 commits from julia/self-service-api:main into main
pull from: julia/self-service-api:main
merge into: finallycoffee:main
Conversation 0 Commits 5 Files Changed 3 +29 -19
3 changed files with 29 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Dockerfile
View File

@ -3,8 +3,8 @@ FROM python:3.9-alpine
WORKDIR /opt/self-service
COPY requirements.txt ./
RUN apk add --no-cache build-base openldap-dev python2-dev python3-dev
RUN apk add --no-cache build-base openldap-dev python2-dev python3-dev musl-dev gcc libffi-dev
RUN pip install --no-cache-dir -r requirements.txt
COPY ./src ./src
CMD ["/usr/local/bin/uvicorn", "src.main:app"]
CMD ["/usr/local/bin/uvicorn", "--host", "::", "--port", "8080", "src.main:app"]
transcaffeine commented 2021-06-16 19:21:03 +00:00
Review
Copy Link

Ok, so after a lot of testing, it appears that for some reason, uvicorn does not accept :: properly, but starts up anyways (and just does not bind).

Binding to 0.0.0.0 works however, so i suggest using that for now.

Ok, so after a lot of testing, it appears that for some reason, `uvicorn` does not accept `::` properly, but starts up anyways (and just does not bind). Binding to `0.0.0.0` works however, so i suggest using that for now.

1
requirements.txt
View File

@ -8,3 +8,4 @@ python-ldap==3.3.1
starlette==0.14.2
typing-extensions==3.10.0.0
uvicorn==0.13.4
bcrypt==3.2.0

21
src/main.py
View File

@ -1,24 +1,27 @@
import bcrypt
import ldap
from fastapi import FastAPI, HTTPException, Response
from pydantic import BaseModel
from ldap import modlist
from config import LDAP_URI, LDAP_BASE_DN
from config import LDAP_BASE_DN, LDAP_URI
app = FastAPI()
class PasswordUpdate(BaseModel):
bind_pw: str
userPassword: str
@app.post("/users/{rdn}/updatePassword", status_code=204, response_class=Response)
def change_password(rdn: str, updateRequest: PasswordUpdate):
def change_password(rdn: str, update_request: PasswordUpdate):
try:
ldap_conn = _connect_ldap_simple_bind(LDAP_URI, f"{rdn},{LDAP_BASE_DN}", updateRequest.bind_pw)
ldap_conn = _connect_ldap_simple_bind(LDAP_URI, f"{rdn},{LDAP_BASE_DN}", update_request.bind_pw)
except ldap.INVALID_CREDENTIALS as e:
raise HTTPException(status_code=401, detail=str(e))
_update_ldap_userPassword(ldap_conn, f"{rdn},{LDAP_BASE_DN}", updateRequest.userPassword)
new_pass = _hash_password(update_request.userPassword)
_update_ldap_userPassword(ldap_conn, f"{rdn},{LDAP_BASE_DN}", new_pass)
def _connect_ldap_simple_bind(server_uri: str, bind_dn: str, bind_pw: str):
ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
@ -26,6 +29,12 @@ def _connect_ldap_simple_bind(server_uri: str, bind_dn: str, bind_pw: str):
conn.simple_bind_s(bind_dn, bind_pw)
return conn
def _update_ldap_userPassword(conn, dn: str, new_pass: str):
changes = [( ldap.MOD_REPLACE, 'userPassword', bytes(str(new_pass), 'utf-8') )]
result = conn.modify_ext_s(dn, changes)
def _hash_password(pw: str):
hash_b = bcrypt.hashpw(pw.encode(), bcrypt.gensalt())
return '{BCRYPT}' + hash_b.decode()