Gramex：LDAP认证后补充用户详情并实现条件重定向

Hey there! Let's break down exactly how to implement this workflow—from fetching user metadata post-LDAP auth to redirecting based on access levels. Here's a hands-on guide tailored to your setup:

First, once LDAP auth succeeds, grab the authenticated user's user_id (this should match the user_id in your SQLite user table). Use that to pull their additional metadata with a safe, parameterized SQL query:

SELECT first_name, last_name, access_level FROM user WHERE user_id = ?;

Here's a Python example using the built-in sqlite3 library to execute this query:

import sqlite3

def fetch_user_metadata(user_id):
    # Connect to your SQLite database
    conn = sqlite3.connect('your_db_file.db')
    cursor = conn.cursor()
    
    # Parameterized query to avoid SQL injection
    cursor.execute(
        "SELECT first_name, last_name, access_level FROM user WHERE user_id = ?",
        (user_id,)
    )
    user_record = cursor.fetchone()
    conn.close()
    
    # Convert the result to a dictionary for easy access
    if user_record:
        return {
            'first_name': user_record[0],
            'last_name': user_record[1],
            'access_level': user_record[2]
        }
    return None

With the metadata in hand, update your current_user object (this could be a framework-provided object like Flask-Login's current_user or a custom one you've built):

# Assume this runs right after successful LDAP auth
ldap_user_id = "authenticated_user_id_from_ldap"  # Replace with actual value
user_metadata = fetch_user_metadata(ldap_user_id)

if user_metadata:
    # Update the current_user's attributes
    current_user.first_name = user_metadata['first_name']
    current_user.last_name = user_metadata['last_name']
    current_user.access_level = user_metadata['access_level']
    
    # If your framework requires persisting changes (e.g., SQLAlchemy), commit them here
    # db.session.commit()
else:
    # Handle the case where the user doesn't exist in your SQLite table
    # Options: Redirect to a setup page, show an error, or auto-create a basic entry
    abort(404, description="User not found in local database")

Finally, use the access_level value to send the user to the appropriate view. Below is a Flask-specific example, but you can adapt this to any framework:

from flask import redirect, url_for

def handle_post_auth_redirect():
    # Map access levels to corresponding views
    if current_user.access_level == "admin":
        return redirect(url_for("admin_dashboard"))
    elif current_user.access_level == "editor":
        return redirect(url_for("editor_dashboard"))
    elif current_user.access_level == "viewer":
        return redirect(url_for("viewer_portal"))
    else:
        # Fallback for unknown access levels
        return redirect(url_for("unauthorized_page"))

• Security First: Always use parameterized queries (like the example above) to prevent SQL injection attacks. Never concatenate user input directly into your SQL string.
• Error Handling: Don't forget to handle edge cases—like when an LDAP-authenticated user isn't present in your SQLite table. You might want to auto-provision a basic user entry or redirect them to a setup flow.
• Framework Adaptations: If you're using Django, FastAPI, or another framework, adjust the code to fit its conventions. For example, in Django, you'd use User.objects.get(user_id=ldap_user_id) instead of raw sqlite3 calls.

内容的提问来源于stack exchange，提问作者Vikram