import logging
logging.basicConfig(level=logging.DEBUG)
log = logging.getLogger('ldap')

#==============================================================================
# LDAP
#Name     = Just a description for the auth modes page
#Host     = DepartmentName.OrganizationName.local/ IP
#Port     = 389 default for ldap
#LDAPS    = no set True if You need to use ldaps
#Account  = DepartmentName\UserName (or UserName@MyDomain depending on AD server)
#Password = <password>
#Base DN  = DC=DepartmentName,DC=OrganizationName,DC=local
#
#On-the-fly user creation = yes
#Attributes
#  Login     = sAMAccountName
#  Firstname = givenName
#  Lastname  = sN
#  Email     = mail

#==============================================================================
class UsernameError(Exception):pass
class PasswordError(Exception):pass

LDAP_USE_LDAPS = False
ldap_server_type = 'ldap'
LDAP_SERVER_ADDRESS = 'myldap.com'
LDAP_SERVER_PORT = '389'

#USE FOR READ ONLY BIND TO LDAP SERVER
LDAP_BIND_DN = ''
LDAP_BIND_PASS = ''

if LDAP_USE_LDAPS:ldap_server_type = ldap_server_type + 's'
LDAP_SERVER = "%s://%s:%s" % (ldap_server_type,
                                       LDAP_SERVER_ADDRESS,
                                       LDAP_SERVER_PORT)

BASE_DN = "ou=people,dc=server,dc=com"
AUTH_DN = "uid=%s,%s"

def authenticate_ldap(username, password):
    """Authenticate a user via LDAP and return his/her LDAP properties.

    Raises AuthenticationError if the credentials are rejected, or
    EnvironmentError if the LDAP server can't be reached.
    """
    try:
        import ldap
    except ImportError:
        raise Exception('Could not import ldap make sure You install python-ldap')

    from rhodecode.lib.helpers import chop_at

    uid = chop_at(username, "@%s" % LDAP_SERVER_ADDRESS)
    dn = AUTH_DN % (uid, BASE_DN)
    log.debug("Authenticating %r at %s", dn, LDAP_SERVER)
    if "," in username:
        raise UsernameError("invalid character in username: ,")
    try:
        #ldap.set_option(ldap.OPT_X_TLS_CACERTFILE, '/etc/openldap/cacerts')
        server = ldap.initialize(LDAP_SERVER)
        server.protocol = ldap.VERSION3
        
        if LDAP_BIND_DN and LDAP_BIND_PASS:
            server.simple_bind_s(AUTH_DN % (LDAP_BIND_DN,
                                            LDAP_BIND_PASS),
                                            password)
        
        server.simple_bind_s(dn, password)
        properties = server.search_s(dn, ldap.SCOPE_SUBTREE)
        if not properties:
            raise ldap.NO_SUCH_OBJECT()
    except ldap.NO_SUCH_OBJECT, e:
        log.debug("LDAP says no such user '%s' (%s)", uid, username)
        raise UsernameError()
    except ldap.INVALID_CREDENTIALS, e:
        log.debug("LDAP rejected password for user '%s' (%s)", uid, username)
        raise PasswordError()
    except ldap.SERVER_DOWN, e:
        raise EnvironmentError("can't access authentication server")
    return properties


print authenticate_ldap('test', 'test')