AD: поиск по нескольким OU (AD_BASES)

- config.py: AD_BASE -> AD_BASES (кортеж OU)
- utils/ad_search.py: новая утилита для поиска по всем OU
- utils/ad_checker.py: использовать ad_search
- utils/otp_service.py: использовать ad_search
- lk/handlers.py: использовать ad_search
- transcription_bot/handlers.py: использовать ad_search
- service_desk/handlers.py: использовать ad_search
- instruct/handlers.py: использовать ad_search
- photo_bot/ad_helper.py: использовать ad_search
- photo_bot/check_ad_photo.py: использовать ad_search
- check_ad_2fa.py: использовать ad_search
- debug_ad_filter.py: обновить для AD_BASES
- lk/test_lk_payslip.py: обновить для AD_BASES

lk/handlers.py

@@ -129,19 +129,18 @@ async def handle_lk_error(msg: Message, user_id: str, action: str, error_details
 # ИНТЕГРАЦИЯ С ACTIVE DIRECTORY ЧЕРЕЗ extensionAttribute2
 # =========================================================
 def get_card_id_from_ad(user_id: str) -> str:
+    # Поиск CARD_ID по всем OU из AD_BASES
+    from utils.ad_search import search_by_user_id
     try:
-        server = Server(config.AD_SERVER, get_info=ALL)
-        conn = Connection(server, user=config.AD_USER, password=config.AD_PASSWORD, auto_bind=True)
-        safe_user_id = escape_filter_chars(user_id)
-        short_username = user_id.split('@')[0]
-        search_filter = f"(&(objectClass=user)(|(mail={safe_user_id})(userPrincipalName={safe_user_id})(userPrincipalName={escape_filter_chars(f'{short_username}@sibcem.ru')})(sAMAccountName={escape_filter_chars(short_username)})))"
-        
-        conn.search(config.AD_BASE, search_filter, attributes=['extensionAttribute2'])
-        
-        if conn.entries and 'extensionAttribute2' in conn.entries[0] and conn.entries[0].extensionAttribute2.value:
-            return str(conn.entries[0].extensionAttribute2.value).strip()
+        entries = search_by_user_id(user_id, ['extensionAttribute2'])
+        if not entries:
+            raise Exception("Пользователь не найден в AD.")
+        entry = entries[0]
+        if 'extensionAttribute2' in entry and entry.extensionAttribute2.value:
+            return str(entry.extensionAttribute2.value).strip()
         raise Exception("Поле extensionAttribute2 не заполнено в AD.")
-    except Exception as e: raise Exception(f"AD Card Query Error: {e}")
+    except Exception as e:
+        raise Exception("AD Card Query Error: {}".format(e))
 
 # =========================================================
 # МОДНОЕ УНИВЕРСАЛЬНОЕ ЯДРО ПАГИНАЦИИ СПИСКОВ ДЛЯ ЧАТА

lk/test_lk_payslip.py

@@ -13,7 +13,10 @@ from ldap3.utils.conv import escape_filter_chars
 TEST_USER = "man.bogov@tcs.sibcem.ru"
 
 AD_SERVER = "ldap://172.16.20.20"
-AD_BASE = "OU=-Пользователи,DC=sibcem,DC=ru"
+AD_BASES = (
+    "OU=-Пользователи,DC=sibcem,DC=ru",
+    "OU=Планшеты,OU=enabled,OU=БезКомпьютеров,DC=sibcem,DC=ru",
+)
 
 AD_USER = "sdesk-mail"
 AD_PASSWORD = "fne?e!q.m8phcrGVAcqr"
@@ -32,7 +35,6 @@ DB_PASSWORD = "Bav:fX#UwH8%atv4"
 def get_phone_from_ad(user_id: str) -> str:
 
     server = Server(AD_SERVER, get_info=ALL)
-
     conn = Connection(
         server,
         user=AD_USER,
@@ -41,22 +43,29 @@ def get_phone_from_ad(user_id: str) -> str:
     )
 
     safe_user_id = escape_filter_chars(user_id)
-
     short_username = user_id.split("@")[0]
 
     search_filter = (
-        f"(&(objectClass=user)"
-        f"(|(mail={safe_user_id})"
-        f"(userPrincipalName={safe_user_id})"
-        f"(userPrincipalName={escape_filter_chars(f'{short_username}@sibcem.ru')})"
-        f"(sAMAccountName={escape_filter_chars(short_username)})))"
+        "(&(objectClass=user)"
+        "(|(mail={})"
+        "(userPrincipalName={})"
+        "(userPrincipalName={}))"
+        "(sAMAccountName={}))".format(
+            safe_user_id,
+            safe_user_id,
+            escape_filter_chars(short_username) + "@sibcem.ru",
+            escape_filter_chars(short_username),
+        )
     )
 
-    conn.search(
-        AD_BASE,
-        search_filter,
-        attributes=['mobile', 'telephoneNumber']
-    )
+    for base in AD_BASES:
+        conn.search(
+            base,
+            search_filter,
+            attributes=['mobile', 'telephoneNumber']
+        )
+        if conn.entries:
+            break
 
     if not conn.entries:
         raise Exception("Пользователь не найден в AD")