# -*- coding: utf-8 -*- import cgi import urllib import urlparse import functools import re import random from openid.store.interface import OpenIDStore from openid.association import Association as OIDAssociation from openid.extensions import sreg from openid import store as openid_store import oauth2 as oauth # OAuth1 protocol from django.db.models.query import Q from django.conf import settings from django.core.urlresolvers import reverse from django.utils import simplejson from django.utils.datastructures import SortedDict from django.utils.translation import ugettext as _ from django.core.exceptions import ImproperlyConfigured try: from hashlib import md5 except: from md5 import md5 from askbot.conf import settings as askbot_settings # needed for some linux distributions like debian try: from openid.yadis import xri except: from yadis import xri import time, base64, hmac, hashlib, operator, logging from models import Association, Nonce __all__ = ['OpenID', 'DjangoOpenIDStore', 'from_openid_response', 'clean_next'] ALLOWED_LOGIN_TYPES = ('password', 'oauth', 'openid-direct', 'openid-username', 'wordpress') class OpenID: def __init__(self, openid_, issued, attrs=None, sreg_=None): logging.debug('init janrain openid object') self.openid = openid_ self.issued = issued self.attrs = attrs or {} self.sreg = sreg_ or {} self.is_iname = (xri.identifierScheme(openid_) == 'XRI') def __repr__(self): return '' % self.openid def __str__(self): return self.openid class DjangoOpenIDStore(OpenIDStore): def __init__(self): self.max_nonce_age = 6 * 60 * 60 # Six hours def storeAssociation(self, server_url, association): assoc = Association( server_url = server_url, handle = association.handle, secret = base64.encodestring(association.secret), issued = association.issued, lifetime = association.issued, assoc_type = association.assoc_type ) assoc.save() def getAssociation(self, server_url, handle=None): assocs = [] if handle is not None: assocs = Association.objects.filter( server_url = server_url, handle = handle ) else: assocs = Association.objects.filter( server_url = server_url ) if not assocs: return None associations = [] for assoc in assocs: association = OIDAssociation( assoc.handle, base64.decodestring(assoc.secret), assoc.issued, assoc.lifetime, assoc.assoc_type ) if association.getExpiresIn() == 0: self.removeAssociation(server_url, assoc.handle) else: associations.append((association.issued, association)) if not associations: return None return associations[-1][1] def removeAssociation(self, server_url, handle): assocs = list(Association.objects.filter( server_url = server_url, handle = handle )) assocs_exist = len(assocs) > 0 for assoc in assocs: assoc.delete() return assocs_exist def useNonce(self, server_url, timestamp, salt): if abs(timestamp - time.time()) > openid_store.nonce.SKEW: return False query = [ Q(server_url__exact=server_url), Q(timestamp__exact=timestamp), Q(salt__exact=salt), ] try: ononce = Nonce.objects.get(reduce(operator.and_, query)) except Nonce.DoesNotExist: ononce = Nonce( server_url=server_url, timestamp=timestamp, salt=salt ) ononce.save() return True ononce.delete() return False def cleanupAssociations(self): Association.objects.extra(where=['issued + lifetimeint<(%s)' % time.time()]).delete() def getAuthKey(self): # Use first AUTH_KEY_LEN characters of md5 hash of SECRET_KEY return hashlib.md5(settings.SECRET_KEY).hexdigest()[:self.AUTH_KEY_LEN] def isDumb(self): return False def from_openid_response(openid_response): """ return openid object from response """ issued = int(time.time()) sreg_resp = sreg.SRegResponse.fromSuccessResponse(openid_response) \ or [] return OpenID( openid_response.identity_url, issued, openid_response.signed_fields, dict(sreg_resp) ) def get_provider_name(openid_url): """returns provider name from the openid_url """ openid_str = openid_url bits = openid_str.split('/') base_url = bits[2] #assume this is base url url_bits = base_url.split('.') return url_bits[-2].lower() def use_password_login(): """password login is activated either if USE_RECAPTCHA is false of if recaptcha keys are set correctly Currently hotfixed to disable this """ return False if askbot_settings.SIGNIN_WORDPRESS_SITE_ENABLED: return True if askbot_settings.USE_RECAPTCHA: if askbot_settings.RECAPTCHA_KEY and askbot_settings.RECAPTCHA_SECRET: return True else: logging.critical('if USE_RECAPTCHA == True, set recaptcha keys!!!') return False else: return True def filter_enabled_providers(data): """deletes data about disabled providers from the input dictionary """ delete_list = list() for provider_key, provider_settings in data.items(): name = provider_settings['name'] if name == 'fasopenid': is_enabled = True else: is_enabled = getattr(askbot_settings, 'SIGNIN_' + name.upper() + '_ENABLED') if is_enabled == False: delete_list.append(provider_key) for provider_key in delete_list: del data[provider_key] return data class LoginMethod(object): """Helper class to add custom authentication modules as plugins for the askbot's version of django_authopenid """ def __init__(self, login_module_path): from askbot.utils.loading import load_module self.mod = load_module(login_module_path) self.mod_path = login_module_path self.read_params() def get_required_attr(self, attr_name, required_for_what): attr_value = getattr(self.mod, attr_name, None) if attr_value is None: raise ImproperlyConfigured( '%s.%s is required for %s' % ( self.mod_path, attr_name, required_for_what ) ) return attr_value def read_params(self): self.is_major = getattr(self.mod, 'BIG_BUTTON', True) if not isinstance(self.is_major, bool): raise ImproperlyConfigured( 'Boolean value expected for %s.BIG_BUTTON' % self.mod_path ) self.order_number = getattr(self.mod, 'ORDER_NUMBER', 1) if not isinstance(self.order_number, int): raise ImproperlyConfigured( 'Integer value expected for %s.ORDER_NUMBER' % self.mod_path ) self.name = getattr(self.mod, 'NAME', None) if self.name is None or not isinstance(self.name, basestring): raise ImproperlyConfigured( '%s.NAME is required as a string parameter' % self.mod_path ) if not re.search(r'^[a-zA-Z0-9]+$', self.name): raise ImproperlyConfigured( '%s.NAME must be a string of ASCII letters and digits only' ) self.display_name = getattr(self.mod, 'DISPLAY_NAME', None) if self.display_name is None or not isinstance(self.display_name, basestring): raise ImproperlyConfigured( '%s.DISPLAY_NAME is required as a string parameter' % self.mod_path ) self.extra_token_name = getattr(self.mod, 'EXTRA_TOKEN_NAME', None) self.login_type = getattr(self.mod, 'TYPE', None) if self.login_type is None or self.login_type not in ALLOWED_LOGIN_TYPES: raise ImproperlyConfigured( "%s.TYPE must be a string " "and the possible values are : 'password', 'oauth', " "'openid-direct', 'openid-username'." % self.mod_path ) self.icon_media_path = getattr(self.mod, 'ICON_MEDIA_PATH', None) if self.icon_media_path is None: raise ImproperlyConfigured( '%s.ICON_MEDIA_PATH is required and must be a url ' 'to the image used as login button' % self.mod_path ) self.create_password_prompt = getattr(self.mod, 'CREATE_PASSWORD_PROMPT', None) self.change_password_prompt = getattr(self.mod, 'CHANGE_PASSWORD_PROMPT', None) if self.login_type == 'password': self.check_password_function = self.get_required_attr( 'check_password', 'custom password login' ) if self.login_type == 'oauth': for_what = 'custom OAuth login' self.oauth_consumer_key = self.get_required_attr('OAUTH_CONSUMER_KEY', for_what) self.oauth_consumer_secret = self.get_required_attr('OAUTH_CONSUMER_SECRET', for_what) self.oauth_request_token_url = self.get_required_attr('OAUTH_REQUEST_TOKEN_URL', for_what) self.oauth_access_token_url = self.get_required_attr('OAUTH_ACCESS_TOKEN_URL', for_what) self.oauth_authorize_url = self.get_required_attr('OAUTH_AUTHORIZE_URL', for_what) self.oauth_get_user_id_function = self.get_required_attr('oauth_get_user_id_function', for_what) if self.login_type.startswith('openid'): self.openid_endpoint = self.get_required_attr('OPENID_ENDPOINT', 'custom OpenID login') if self.login_type == 'openid-username': if '%(username)s' not in self.openid_endpoint: msg = 'If OpenID provider requires a username, ' + \ 'then value of %s.OPENID_ENDPOINT must contain ' + \ '%(username)s so that the username can be transmitted to the provider' raise ImproperlyConfigured(msg % self.mod_path) self.tooltip_text = getattr(self.mod, 'TOOLTIP_TEXT', None) def as_dict(self): """returns parameters as dictionary that can be inserted into one of the provider data dictionaries for the use in the UI""" params = ( 'name', 'display_name', 'type', 'icon_media_path', 'extra_token_name', 'create_password_prompt', 'change_password_prompt', 'consumer_key', 'consumer_secret', 'request_token_url', 'access_token_url', 'authorize_url', 'get_user_id_function', 'openid_endpoint', 'tooltip_text', 'check_password', ) #some parameters in the class have different names from those #in the dictionary parameter_map = { 'type': 'login_type', 'consumer_key': 'oauth_consumer_key', 'consumer_secret': 'oauth_consumer_secret', 'request_token_url': 'oauth_request_token_url', 'access_token_url': 'oauth_access_token_url', 'authorize_url': 'oauth_authorize_url', 'get_user_id_function': 'oauth_get_user_id_function', 'check_password': 'check_password_function' } data = dict() for param in params: attr_name = parameter_map.get(param, param) data[param] = getattr(self, attr_name, None) if self.login_type == 'password': #passwords in external login systems are not changeable data['password_changeable'] = False return data def add_custom_provider(func): @functools.wraps(func) def wrapper(): providers = func() login_module_path = getattr(settings, 'ASKBOT_CUSTOM_AUTH_MODULE', None) if login_module_path: mod = LoginMethod(login_module_path) if mod.is_major != func.is_major: return providers#only patch the matching provider set providers.insert(mod.order_number - 1, mod.name, mod.as_dict()) return providers return wrapper def get_enabled_major_login_providers(): """returns a dictionary with data about login providers whose icons are to be shown in large format disabled providers are excluded items of the dictionary are dictionaries with keys: * name * display_name * icon_media_path (relative to /media directory) * type (oauth|openid-direct|openid-generic|openid-username|password) Fields dependent on type of the login provider type --------------------------------------------------- Password (type = password) - login provider using login name and password: * extra_token_name - a phrase describing what the login name and the password are from * create_password_prompt - a phrase prompting to create an account * change_password_prompt - a phrase prompting to change password OpenID (type = openid) - Provider of login using the OpenID protocol * openid_endpoint (required for type=openid|openid-username) for type openid-username - the string must have %(username)s format variable, plain string url otherwise * extra_token_name - required for type=openid-username describes name of required extra token - e.g. "XYZ user name" OAuth2 (type = oauth) * request_token_url - url to initiate OAuth2 protocol with the resource * access_token_url - url to access users data on the resource via OAuth2 * authorize_url - url at which user can authorize the app to access a resource * authenticate_url - url to authenticate user (lower privilege than authorize) * get_user_id_function - a function that returns user id from data dictionary containing: response to the access token url & consumer_key and consumer secret. The purpose of this function is to hide the differences between the ways user id is accessed from the different OAuth providers """ data = SortedDict() if use_password_login(): site_name = askbot_settings.APP_SHORT_NAME prompt = _('%(site)s user name and password') % {'site': site_name} data['local'] = { 'name': 'local', 'display_name': site_name, 'extra_token_name': prompt, 'type': 'password', 'create_password_prompt': _('Create a password-protected account'), 'change_password_prompt': _('Change your password'), 'icon_media_path': askbot_settings.LOCAL_LOGIN_ICON, 'password_changeable': True } data['fasopenid'] = { 'name': 'fasopenid', 'display_name': 'FAS-OpenID', 'type': 'openid-direct', 'icon_media_path': 'https://fedoraproject.org/w/uploads/d/d6/Guidelines-fedora-logo.jpg', 'openid_endpoint': 'https://id.fedoraproject.org/', } def get_facebook_user_id(client): """returns facebook user id given the access token""" profile = client.request('me') return profile['id'] if askbot_settings.FACEBOOK_KEY and askbot_settings.FACEBOOK_SECRET: data['facebook'] = { 'name': 'facebook', 'display_name': 'Facebook', 'type': 'oauth2', 'auth_endpoint': 'https://www.facebook.com/dialog/oauth/', 'token_endpoint': 'https://graph.facebook.com/oauth/access_token', 'resource_endpoint': 'https://graph.facebook.com/', 'icon_media_path': '/jquery-openid/images/facebook.gif', 'get_user_id_function': get_facebook_user_id, 'response_parser': lambda data: dict(urlparse.parse_qsl(data)) } if askbot_settings.TWITTER_KEY and askbot_settings.TWITTER_SECRET: data['twitter'] = { 'name': 'twitter', 'display_name': 'Twitter', 'type': 'oauth', 'request_token_url': 'https://api.twitter.com/oauth/request_token', 'access_token_url': 'https://api.twitter.com/oauth/access_token', 'authorize_url': 'https://api.twitter.com/oauth/authorize', 'authenticate_url': 'https://api.twitter.com/oauth/authenticate', 'get_user_id_url': 'https://twitter.com/account/verify_credentials.json', 'icon_media_path': '/jquery-openid/images/twitter.gif', 'get_user_id_function': lambda data: data['user_id'], } def get_linked_in_user_id(data): consumer = oauth.Consumer(data['consumer_key'], data['consumer_secret']) token = oauth.Token(data['oauth_token'], data['oauth_token_secret']) client = oauth.Client(consumer, token=token) url = 'https://api.linkedin.com/v1/people/~:(first-name,last-name,id)' response, content = client.request(url, 'GET') if response['status'] == '200': id_re = re.compile(r'([^<]+)') matches = id_re.search(content) if matches: return matches.group(1) raise OAuthError() if askbot_settings.SIGNIN_WORDPRESS_SITE_ENABLED and askbot_settings.WORDPRESS_SITE_URL: data['wordpress_site'] = { 'name': 'wordpress_site', 'display_name': 'Self hosted wordpress blog', #need to be added as setting. 'icon_media_path': askbot_settings.WORDPRESS_SITE_ICON, 'type': 'wordpress_site', } if askbot_settings.LINKEDIN_KEY and askbot_settings.LINKEDIN_SECRET: data['linkedin'] = { 'name': 'linkedin', 'display_name': 'LinkedIn', 'type': 'oauth', 'request_token_url': 'https://api.linkedin.com/uas/oauth/requestToken', 'access_token_url': 'https://api.linkedin.com/uas/oauth/accessToken', 'authorize_url': 'https://www.linkedin.com/uas/oauth/authorize', 'authenticate_url': 'https://www.linkedin.com/uas/oauth/authenticate', 'icon_media_path': '/jquery-openid/images/linkedin.gif', 'get_user_id_function': get_linked_in_user_id } data['google'] = { 'name': 'google', 'display_name': 'Google', 'type': 'openid-direct', 'icon_media_path': '/jquery-openid/images/google.gif', 'openid_endpoint': 'https://www.google.com/accounts/o8/id', } data['yahoo'] = { 'name': 'yahoo', 'display_name': 'Yahoo', 'type': 'openid-direct', 'icon_media_path': '/jquery-openid/images/yahoo.gif', 'tooltip_text': _('Sign in with Yahoo'), 'openid_endpoint': 'http://yahoo.com', } data['aol'] = { 'name': 'aol', 'display_name': 'AOL', 'type': 'openid-username', 'extra_token_name': _('AOL screen name'), 'icon_media_path': '/jquery-openid/images/aol.gif', 'openid_endpoint': 'http://openid.aol.com/%(username)s' } data['openid'] = { 'name': 'openid', 'display_name': 'OpenID', 'type': 'openid-generic', 'extra_token_name': _('OpenID url'), 'icon_media_path': '/jquery-openid/images/openid.gif', 'openid_endpoint': None, } return filter_enabled_providers(data) get_enabled_major_login_providers.is_major = True get_enabled_major_login_providers = add_custom_provider(get_enabled_major_login_providers) def get_enabled_minor_login_providers(): """same as get_enabled_major_login_providers but those that are to be displayed with small buttons disabled providers are excluded structure of dictionary values is the same as in get_enabled_major_login_providers """ data = SortedDict() #data['myopenid'] = { # 'name': 'myopenid', # 'display_name': 'MyOpenid', # 'type': 'openid-username', # 'extra_token_name': _('MyOpenid user name'), # 'icon_media_path': '/jquery-openid/images/myopenid-2.png', # 'openid_endpoint': 'http://%(username)s.myopenid.com' #} data['flickr'] = { 'name': 'flickr', 'display_name': 'Flickr', 'type': 'openid-username', 'extra_token_name': _('Flickr user name'), 'icon_media_path': '/jquery-openid/images/flickr.png', 'openid_endpoint': 'http://flickr.com/%(username)s/' } data['technorati'] = { 'name': 'technorati', 'display_name': 'Technorati', 'type': 'openid-username', 'extra_token_name': _('Technorati user name'), 'icon_media_path': '/jquery-openid/images/technorati-1.png', 'openid_endpoint': 'http://technorati.com/people/technorati/%(username)s/' } data['wordpress'] = { 'name': 'wordpress', 'display_name': 'WordPress', 'type': 'openid-username', 'extra_token_name': _('WordPress blog name'), 'icon_media_path': '/jquery-openid/images/wordpress.png', 'openid_endpoint': 'http://%(username)s.wordpress.com' } data['blogger'] = { 'name': 'blogger', 'display_name': 'Blogger', 'type': 'openid-username', 'extra_token_name': _('Blogger blog name'), 'icon_media_path': '/jquery-openid/images/blogger-1.png', 'openid_endpoint': 'http://%(username)s.blogspot.com' } data['livejournal'] = { 'name': 'livejournal', 'display_name': 'LiveJournal', 'type': 'openid-username', 'extra_token_name': _('LiveJournal blog name'), 'icon_media_path': '/jquery-openid/images/livejournal-1.png', 'openid_endpoint': 'http://%(username)s.livejournal.com' } data['claimid'] = { 'name': 'claimid', 'display_name': 'ClaimID', 'type': 'openid-username', 'extra_token_name': _('ClaimID user name'), 'icon_media_path': '/jquery-openid/images/claimid-0.png', 'openid_endpoint': 'http://claimid.com/%(username)s/' } data['vidoop'] = { 'name': 'vidoop', 'display_name': 'Vidoop', 'type': 'openid-username', 'extra_token_name': _('Vidoop user name'), 'icon_media_path': '/jquery-openid/images/vidoop.png', 'openid_endpoint': 'http://%(username)s.myvidoop.com/' } data['verisign'] = { 'name': 'verisign', 'display_name': 'Verisign', 'type': 'openid-username', 'extra_token_name': _('Verisign user name'), 'icon_media_path': '/jquery-openid/images/verisign-2.png', 'openid_endpoint': 'http://%(username)s.pip.verisignlabs.com/' } return filter_enabled_providers(data) get_enabled_minor_login_providers.is_major = False get_enabled_minor_login_providers = add_custom_provider(get_enabled_minor_login_providers) def have_enabled_federated_login_methods(): providers = get_enabled_major_login_providers() providers.update(get_enabled_minor_login_providers()) provider_types = [provider['type'] for provider in providers.values()] for provider_type in provider_types: if provider_type.startswith('openid') or provider_type == 'oauth': return True return False def get_enabled_login_providers(): """return all login providers in one sorted dict """ data = get_enabled_major_login_providers() data.update(get_enabled_minor_login_providers()) return data def set_login_provider_tooltips(provider_dict, active_provider_names = None): """adds appropriate tooltip_text field to each provider record, if second argument is None, then tooltip is of type signin with ..., otherwise it's more elaborate - depending on the type of provider and whether or not it's one of currently used """ for provider in provider_dict.values(): if active_provider_names: if provider['name'] in active_provider_names: if provider['type'] == 'password': tooltip = _('Change your %(provider)s password') % \ {'provider': provider['display_name']} else: tooltip = _( 'Click to see if your %(provider)s ' 'signin still works for %(site_name)s' ) % { 'provider': provider['display_name'], 'site_name': askbot_settings.APP_SHORT_NAME } else: if provider['type'] == 'password': tooltip = _( 'Create password for %(provider)s' ) % {'provider': provider['display_name']} else: tooltip = _( 'Connect your %(provider)s account ' 'to %(site_name)s' ) % { 'provider': provider['display_name'], 'site_name': askbot_settings.APP_SHORT_NAME } else: if provider['type'] == 'password': tooltip = _( 'Signin with %(provider)s user name and password' ) % { 'provider': provider['display_name'], 'site_name': askbot_settings.APP_SHORT_NAME } else: tooltip = _( 'Sign in with your %(provider)s account' ) % {'provider': provider['display_name']} provider['tooltip_text'] = tooltip def get_oauth_parameters(provider_name): """retrieves OAuth protocol parameters from hardcoded settings and adds some from the livesettings because this function uses livesettings it should not be called at compile time otherwise there may be strange errors """ providers = get_enabled_login_providers() data = providers[provider_name] if data['type'] != 'oauth': raise ValueError('oauth provider expected, %s found' % data['type']) if provider_name == 'twitter': consumer_key = askbot_settings.TWITTER_KEY consumer_secret = askbot_settings.TWITTER_SECRET elif provider_name == 'linkedin': consumer_key = askbot_settings.LINKEDIN_KEY consumer_secret = askbot_settings.LINKEDIN_SECRET elif provider_name == 'facebook': consumer_key = askbot_settings.FACEBOOK_KEY consumer_secret = askbot_settings.FACEBOOK_SECRET else: raise ValueError('unexpected oauth provider %s' % provider_name) data['consumer_key'] = consumer_key data['consumer_secret'] = consumer_secret return data class OAuthError(Exception): """Error raised by the OAuthConnection class """ pass class OAuthConnection(object): """a simple class wrapping oauth2 library """ def __init__(self, provider_name, callback_url = None): """initializes oauth connection """ self.provider_name = provider_name self.parameters = get_oauth_parameters(provider_name) self.callback_url = callback_url self.consumer = oauth.Consumer( self.parameters['consumer_key'], self.parameters['consumer_secret'], ) def start(self, callback_url = None): """starts the OAuth protocol communication and saves request token as :attr:`request_token`""" if callback_url is None: callback_url = self.callback_url client = oauth.Client(self.consumer) request_url = self.parameters['request_token_url'] if callback_url: callback_url = '%s%s' % (askbot_settings.APP_URL, callback_url) request_body = urllib.urlencode(dict(oauth_callback=callback_url)) self.request_token = self.send_request( client = client, url = request_url, method = 'POST', body = request_body ) else: self.request_token = self.send_request( client, request_url, 'GET' ) def send_request(self, client=None, url=None, method='GET', **kwargs): response, content = client.request(url, method, **kwargs) if response['status'] == '200': return dict(cgi.parse_qsl(content)) else: raise OAuthError('response is %s' % response) def get_token(self): return self.request_token def get_user_id(self, oauth_token = None, oauth_verifier = None): """Returns user ID within the OAuth provider system, based on ``oauth_token`` and ``oauth_verifier`` """ token = oauth.Token( oauth_token['oauth_token'], oauth_token['oauth_token_secret'] ) token.set_verifier(oauth_verifier) client = oauth.Client(self.consumer, token = token) url = self.parameters['access_token_url'] #there must be some provider-specific post-processing data = self.send_request(client = client, url=url, method='GET') data['consumer_key'] = self.parameters['consumer_key'] data['consumer_secret'] = self.parameters['consumer_secret'] return self.parameters['get_user_id_function'](data) def get_auth_url(self, login_only = False): """returns OAuth redirect url. if ``login_only`` is True, authentication endpoint will be used, if available, otherwise authorization url (potentially granting full access to the server) will be used. Typically, authentication-only endpoint simplifies the signin process, but does not allow advanced access to the content on the OAuth-enabled server """ endpoint_url = self.parameters.get('authorize_url', None) if login_only == True: endpoint_url = self.parameters.get( 'authenticate_url', endpoint_url ) if endpoint_url is None: raise ImproperlyConfigured('oauth parameters are incorrect') auth_url = '%s?oauth_token=%s' % \ ( endpoint_url, self.request_token['oauth_token'], ) return auth_url def get_oauth2_starter_url(provider_name, csrf_token): """returns redirect url for the oauth2 protocol for a given provider""" from sanction.client import Client providers = get_enabled_login_providers() params = providers[provider_name] client_id = getattr(askbot_settings, provider_name.upper() + '_KEY') redirect_uri = askbot_settings.APP_URL + reverse('user_complete_oauth2_signin') client = Client( auth_endpoint=params['auth_endpoint'], client_id=client_id, redirect_uri=redirect_uri ) return client.auth_uri(state=csrf_token) def ldap_check_password(username, password): import ldap try: ldap_session = ldap.initialize(askbot_settings.LDAP_URL) ldap_session.simple_bind_s(username, password) ldap_session.unbind_s() return True except ldap.LDAPError, e: logging.critical(unicode(e)) return False