Metadata-Version: 2.4
Name: ldap3-ad-auth
Version: 0.1.1
Summary: Protected AD LDAP authentication for ldap3
License-Expression: MIT
Keywords: active directory,ldap3,kerberos,ntlm,ldap signing,channel binding
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Topic :: System :: Systems Administration :: Authentication/Directory
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: ldap3>=2.9.1
Requires-Dist: impacket>=0.13.1
Dynamic: license-file

# ldap3-ad-auth

`ldap3-ad-auth` adds protected Active Directory binds to synchronous
[`ldap3`](https://github.com/cannatag/ldap3) connections. It uses Impacket for
Kerberos and NTLM authentication and leaves LDAP queries, entries, controls,
and binary values with ldap3. It does not require a native GSSAPI library or
an ldap3 fork.

On plain LDAP, it negotiates signing and sealing and protects every LDAP
message after the bind. On LDAPS, it supplies a `tls-server-end-point` channel
binding token derived from the current TLS peer certificate. The caller's TLS
certificate validation settings are preserved.

## Installation

The package requires Python 3.9 or newer, ldap3 2.9.1 or newer, and
Impacket 0.13.1 or newer. Install it with:

```sh
python -m pip install ldap3-ad-auth
```

## Usage

```python
from ldap3 import ALL, BASE, Connection, Server
from ldap3_ad_auth import bind_ntlm

server = Server('dc.example.com', get_info=ALL)
connection = Connection(server, user=r'EXAMPLE\alice', password='...',
                        auto_referrals=False)
bind_ntlm(connection)
connection.search('', '(objectClass=*)', search_scope=BASE,
                  attributes=['defaultNamingContext'])
```

For Kerberos, create the same unbound connection and call
`bind_kerberos(connection, hostname='dc.example.com', domain='example.com',
username='alice', password='...')`. The Kerberos binder also accepts hashes,
AES keys, a TGT, or a TGS. `bind_ntlm` accepts an NT hash or a `LM:NT` string
as well as a password.

Both binders return the original connection. They require ldap3's synchronous
strategy and `auto_referrals=False`. Rebinding, reopening, and StartTLS on the
same protected connection are refused; create a new connection for a new
bind. An invalid protected message closes the socket and raises
`ProtectionError`.

## Attribution

The Kerberos bind and TLS channel binding construction adapt MIT-licensed
code from BloodHound.py and krbrelayx. The plain LDAP signing and sealing
approach builds on BloodHound.py [PR #254](https://github.com/dirkjanm/BloodHound.py/pull/254)
(Kerberos by Pebl3; NTLM by Ahmad Alawneh) and
[PR #259](https://github.com/dirkjanm/BloodHound.py/pull/259)
(Kerberos by Danila Domoroshchenov). The protected transport and incoming
signature verification were rewritten for this package. The original
projects' copyright notices are retained in `LICENSE`.

## Tests

After installing from source, run
`python -m unittest discover -s tests`.
