ldap3-ad-auth

ldap3-ad-auth adds protected Active Directory binds to synchronous ldap3 connections. It uses Impacket for Kerberos and NTLM authentication and leaves LDAP queries, entries, controls, and binary values with ldap3. It does not require a native GSSAPI library or an ldap3 fork.

On plain LDAP, it negotiates signing and sealing and protects every LDAP message after the bind. On LDAPS, it supplies a tls-server-end-point channel binding token derived from the current TLS peer certificate. The caller's TLS certificate validation settings are preserved.

Installation

The package requires Python 3.9 or newer, ldap3 2.9.1 or newer, and Impacket 0.13.1 or newer. Install it with:

python -m pip install ldap3-ad-auth

Usage

from ldap3 import ALL, BASE, Connection, Server
from ldap3_ad_auth import bind_ntlm

server = Server('dc.example.com', get_info=ALL)
connection = Connection(server, user=r'EXAMPLE\alice', password='...',
                        auto_referrals=False)
bind_ntlm(connection)
connection.search('', '(objectClass=*)', search_scope=BASE,
                  attributes=['defaultNamingContext'])

For Kerberos, create the same unbound connection and call bind_kerberos(connection, hostname='dc.example.com', domain='example.com', username='alice', password='...'). The Kerberos binder also accepts hashes, AES keys, a TGT, or a TGS. bind_ntlm accepts an NT hash or a LM:NT string as well as a password.

Both binders return the original connection. They require ldap3's synchronous strategy and auto_referrals=False. Rebinding, reopening, and StartTLS on the same protected connection are refused; create a new connection for a new bind. An invalid protected message closes the socket and raises ProtectionError.

Attribution

The Kerberos bind and TLS channel binding construction adapt MIT-licensed code from BloodHound.py and krbrelayx. The plain LDAP signing and sealing approach builds on BloodHound.py PR #254 (Kerberos by Pebl3; NTLM by Ahmad Alawneh) and PR #259 (Kerberos by Danila Domoroshchenov). The protected transport and incoming signature verification were rewritten for this package. The original projects' copyright notices are retained in LICENSE.

Tests

After installing from source, run python -m unittest discover -s tests.