From eeb257661cc22fb9309c58bc17f3ac991e2053d0 Mon Sep 17 00:00:00 2001
From: Stefan Rijnhart <stefan@therp.nl>
Date: Wed, 8 Jun 2011 16:06:38 +0200
Subject: [PATCH 1/4] [IMP] adds a function to populate the OpenERP user base
 from an LDAP server

lp bug: https://launchpad.net/bugs/794584 fixed

bzr revid: stefan@therp.nl-20110608140638-2l721ot37v6fll38
---
 addons/users_ldap/users_ldap.py       | 65 ++++++++++++++++++++++++++-
 addons/users_ldap/users_ldap_view.xml |  1 +
 2 files changed, 65 insertions(+), 1 deletion(-)

diff --git a/addons/users_ldap/users_ldap.py b/addons/users_ldap/users_ldap.py
index e4fec6a391f..f04f1d2debf 100644
--- a/addons/users_ldap/users_ldap.py
+++ b/addons/users_ldap/users_ldap.py
@@ -25,12 +25,75 @@ import logging
 from service import security
 import ldap
 from ldap.filter import filter_format
-
+import re
 
 class CompanyLDAP(osv.osv):
     _name = 'res.company.ldap'
     _order = 'sequence'
     _rec_name = 'ldap_server'
+
+    def populate(self, cr, uid, ids, context=None):
+        """ 
+        Populate OpenERP user base from LDAP.
+        Call from the button on the form or from the task scheduler.
+        """
+        logger = logging.getLogger('orm.ldap')
+        action_obj = self.pool.get('ir.actions.actions') 
+        action_id = action_obj.search(cr, 1, [('usage', '=', 'menu')])[0]
+        user_obj = self.pool.get('res.users')
+        for res_company_ldap in self.browse(cr, uid, ids, context):
+            if not res_company_ldap['create_user']:
+                continue
+            try:
+                l = ldap.open(res_company_ldap.ldap_server, res_company_ldap.ldap_server_port)
+                if l.simple_bind_s(res_company_ldap.ldap_binddn, res_company_ldap.ldap_password):
+                    base = res_company_ldap.ldap_base
+                    scope = ldap.SCOPE_SUBTREE
+                    attr_match = re.search('([a-zA-Z_]+)=\%s', res_company_ldap['ldap_filter'])
+                    if attr_match:
+                        login_attr = str(attr_match.group(1))
+                    else:
+                        logger.debug("Could not extract attribute found in ldap_filter %s." % res_company_ldap['ldap_filter'])
+                        continue
+                    filter = res_company_ldap.ldap_filter % '*'
+                    retrieve_attributes = ['cn', login_attr]
+                    result_id = l.search(base, scope, filter, retrieve_attributes)
+                    timeout = 60
+                    result_type, result_data = l.result(result_id, timeout)
+                    if not result_data:
+                        continue
+                    if result_type == ldap.RES_SEARCH_RESULT:
+                        for entry in result_data:
+                            dn = entry[0]
+                            name = entry[1]['cn'][0]
+                            login = entry[1][login_attr][0]
+                            cr.execute("SELECT id FROM res_users WHERE login=%s",(login,))
+                            res = cr.fetchone()
+                            if res:
+                                continue
+                            logger.debug("Creating new OpenERP user \"%s\" from LDAP" % login)
+                            if res_company_ldap['user']:
+                                res = user_obj.copy(cr, 1, res_company_ldap['user'].id,
+                                        default={'active': True})
+                                user_obj.write(cr, 1, res, {
+                                    'name': name,
+                                    'login': login.encode('utf-8'),
+                                    'company_id': res_company_ldap['company'].id,
+                                    })
+                            else:
+                                res = user_obj.create(cr, 1, {
+                                    'name': name,
+                                    'login': login.encode('utf-8'),
+                                    'company_id': res_company_ldap['company'].id,
+                                    'action_id': action_id,
+                                    'menu_id': action_id,
+                                    })
+                l.unbind()
+            except Exception:
+                logger.warning('cannot check', exc_info=True)
+                pass
+        return True
+    
     _columns = {
         'sequence': fields.integer('Sequence'),
         'company': fields.many2one('res.company', 'Company', required=True,
diff --git a/addons/users_ldap/users_ldap_view.xml b/addons/users_ldap/users_ldap_view.xml
index b055ef2938d..569d5b554aa 100644
--- a/addons/users_ldap/users_ldap_view.xml
+++ b/addons/users_ldap/users_ldap_view.xml
@@ -20,6 +20,7 @@
                             <field name="user"/>
                             <newline/>
                             <field name="sequence"/>
+			    <button name="populate" string="Populate" type="object" colspan="2"/>
                         </form>
                         <tree string="LDAP Configuration">
                             <field name="sequence"/>

From b6e9a293b6256c19de4b4853a030c3061d438757 Mon Sep 17 00:00:00 2001
From: Stefan Rijnhart <stefan@therp.nl>
Date: Wed, 22 Jun 2011 12:21:18 +0200
Subject: [PATCH 2/4] [REM] reverted the populate functionality, moving to
 extra addon [REF] split up LDAP authentication in atomic methods [REF] remove
 unnecessary lambdas from defaults [REF] improve pep8 compatibility [REF]
 remove unnecessary conditionals when an exception is raised anyway [IMP] do
 not log redundant exception ldap.INVALID_CREDENTIALS [IMP] replaced generic
 exceptions by ldap subclass [FIX] update timestamp when LDAP user logs in
 [FIX] prevent inactive LDAP users from logging in [FIX] select first menu
 item for new users by id, not by name [FIX] use ldap.search_st() which
 actually does take the timeout argument

lp bug: https://launchpad.net/bugs/784501 fixed

bzr revid: stefan@therp.nl-20110622102118-syfszkpb0mwme4q5
---
 addons/users_ldap/users_ldap.py       | 352 +++++++++++++-------------
 addons/users_ldap/users_ldap_view.xml |   1 -
 2 files changed, 183 insertions(+), 170 deletions(-)

diff --git a/addons/users_ldap/users_ldap.py b/addons/users_ldap/users_ldap.py
index c62e41f4a9c..518dfe44147 100644
--- a/addons/users_ldap/users_ldap.py
+++ b/addons/users_ldap/users_ldap.py
@@ -18,82 +18,149 @@
 #
 ##############################################################################
 
+import ldap
+from ldap.filter import filter_format
 from osv import fields, osv
 import pooler
 import tools
 import logging
 from service import security
-import ldap
-from ldap.filter import filter_format
-import re
 
 class CompanyLDAP(osv.osv):
     _name = 'res.company.ldap'
     _order = 'sequence'
     _rec_name = 'ldap_server'
 
-    def populate(self, cr, uid, ids, context=None):
+    def get_ldap_dicts(self, cr, ids=None):
         """ 
-        Populate OpenERP user base from LDAP.
-        Call from the button on the form or from the task scheduler.
+        Return res_company_ldap resources in the database as a list of
+        dictionaries.
+
+        @param cr : database cursor
+        @param ids : optional list of res_company_ldap ids
         """
+
+        if ids:
+            id_clause = 'AND id IN (%s)'
+            args = [tuple(ids)]
+        else:
+            id_clause = ''
+            args = []
+        cr.execute("""
+            SELECT id, company, ldap_server, ldap_server_port, ldap_binddn,
+                   ldap_password, ldap_filter, ldap_base, "user", create_user
+            FROM res_company_ldap
+            WHERE ldap_server != '' """ + id_clause + """ ORDER BY sequence
+        """, args)
+        return cr.dictfetchall()
+
+    def connect(self, conf):
+        """ 
+        Compose an LDAP uri from an ldap configuration dictionary
+        and return a connection to it.
+
+        @param conf : LDAP configuration dictionary
+        """
+
+        uri = 'ldap://%s:%d' % (conf['ldap_server'],
+                                conf['ldap_server_port'])
+        return ldap.initialize(uri)
+
+    def authenticate(self, conf, dn, password):
+        """
+        Perform an atomic LDAP authentication.
+        
+        @param conf : LDAP configuration dictionary
+        @param dn : LDAP dn
+        @param password : Password for the LDAP user
+        """
+
+        conn = self.connect(conf)
+        conn.simple_bind_s(dn, password)
+        conn.unbind()
+        
+    def query(self, conf, filter, retrieve_attributes=None):
+        """ 
+        Query an LDAP server with the filter argument and scope subtree.
+        Return the results in native python-ldap format, ie. a list of
+        tuples (dn, attrs).
+
+        @param conf : LDAP configuration dictionary
+        @param filter : valid LDAP filter
+        @param retrieve_attributes : optional list of LDAP attributes to be
+              retrieved. If not specified, return all attributes.
+        """
+
+        results = []
         logger = logging.getLogger('orm.ldap')
-        action_obj = self.pool.get('ir.actions.actions') 
-        action_id = action_obj.search(cr, 1, [('usage', '=', 'menu')])[0]
-        user_obj = self.pool.get('res.users')
-        for res_company_ldap in self.browse(cr, uid, ids, context):
-            if not res_company_ldap['create_user']:
-                continue
-            try:
-                l = ldap.open(res_company_ldap.ldap_server, res_company_ldap.ldap_server_port)
-                if l.simple_bind_s(res_company_ldap.ldap_binddn, res_company_ldap.ldap_password):
-                    base = res_company_ldap.ldap_base
-                    scope = ldap.SCOPE_SUBTREE
-                    attr_match = re.search('([a-zA-Z_]+)=\%s', res_company_ldap['ldap_filter'])
-                    if attr_match:
-                        login_attr = str(attr_match.group(1))
-                    else:
-                        logger.debug("Could not extract attribute found in ldap_filter %s." % res_company_ldap['ldap_filter'])
-                        continue
-                    filter = res_company_ldap.ldap_filter % '*'
-                    retrieve_attributes = ['cn', login_attr]
-                    result_id = l.search(base, scope, filter, retrieve_attributes)
-                    timeout = 60
-                    result_type, result_data = l.result(result_id, timeout)
-                    if not result_data:
-                        continue
-                    if result_type == ldap.RES_SEARCH_RESULT:
-                        for entry in result_data:
-                            dn = entry[0]
-                            name = entry[1]['cn'][0]
-                            login = entry[1][login_attr][0]
-                            cr.execute("SELECT id FROM res_users WHERE login=%s",(login,))
-                            res = cr.fetchone()
-                            if res:
-                                continue
-                            logger.debug("Creating new OpenERP user \"%s\" from LDAP" % login)
-                            if res_company_ldap['user']:
-                                res = user_obj.copy(cr, 1, res_company_ldap['user'].id,
-                                        default={'active': True})
-                                user_obj.write(cr, 1, res, {
-                                    'name': name,
-                                    'login': login.encode('utf-8'),
-                                    'company_id': res_company_ldap['company'].id,
-                                    })
-                            else:
-                                res = user_obj.create(cr, 1, {
-                                    'name': name,
-                                    'login': login.encode('utf-8'),
-                                    'company_id': res_company_ldap['company'].id,
-                                    'action_id': action_id,
-                                    'menu_id': action_id,
-                                    })
-                l.unbind()
-            except Exception:
-                logger.warning('cannot check', exc_info=True)
-                pass
-        return True
+        try:
+            conn = self.connect(conf)
+            conn.simple_bind_s(conf['ldap_binddn'] or '',
+                               conf['ldap_password'] or '')
+            results = conn.search_st(conf['ldap_base'], ldap.SCOPE_SUBTREE,
+                                     filter, retrieve_attributes, timeout=60)
+            conn.unbind()
+        except ldap.LDAPError, e:
+            logger.warning('An LDAP exception occurred: %s' % e)
+            pass
+        return results
+
+    def map_ldap_attributes(self, cr, uid, login, conf, ldap_entry):
+        """
+        Compose a list of field values for creating a new resource of model
+        res_users, based upon the retrieved ldap entry and the LDAP settings.
+        
+        @param cr : the database cursor
+        @param uid : the OpenERP user id
+        @param login : the new user's login
+        @param conf : LDAP configuration dictionary
+        @param ldap_entry : single LDAP result in (dn, attrs) format
+        """
+
+        values = { 'name': ldap_entry[1]['cn'][0],
+                   'login': login,
+                   'company_id': conf['company']
+                   }
+        if not conf['user']:
+            action_obj = self.pool.get('ir.actions.actions')
+            values['action_id'] = values['menu_id'] = action_obj.search(
+                cr, uid, [('usage', '=', 'menu')], order='id')[0]
+        return values
     
+    def get_or_create_user(self, cr, uid, login, conf, ldap_entry,
+                           context=None):
+        """
+        Return the id of an active res_users resource with the specified
+        login. Create the user if it is not initially found.
+
+        @param cr : the database cursor
+        @param uid : the OpenERP user id
+        @param login : the user's login
+        @param conf : LDAP configuration dictionary
+        @param ldap_entry : single LDAP result in (dn, attrs) format
+        @param context : the OpenERP context
+        """
+        
+        user_id = False
+        login = tools.ustr(login)
+        cr.execute("SELECT id, active FROM res_users WHERE login=%s", (login,))
+        res = cr.fetchone()
+        if res:
+            if res[1]:
+                user_id = res[0]
+        elif conf['create_user']:
+            logger = logging.getLogger('orm.ldap')
+            logger.debug("Creating new OpenERP user \"%s\" from LDAP" % login)
+            user_obj = self.pool.get('res.users')
+            values = self.map_ldap_attributes(cr, uid, login, conf, ldap_entry)
+            if conf['user']:
+                user_id = user_obj.copy(cr, 1, conf['user'],
+                                        default={'active': True})
+                user_obj.write(cr, 1, user_id, values)
+            else:
+                user_id = user_obj.create(cr, 1, values)
+        return user_id
+
     _columns = {
         'sequence': fields.integer('Sequence'),
         'company': fields.many2one('res.company', 'Company', required=True,
@@ -114,10 +181,10 @@ class CompanyLDAP(osv.osv):
             help="Create the user if not in database"),
     }
     _defaults = {
-        'ldap_server': lambda *a: '127.0.0.1',
-        'ldap_server_port': lambda *a: 389,
-        'sequence': lambda *a: 10,
-        'create_user': lambda *a: True,
+        'ldap_server': '127.0.0.1',
+        'ldap_server_port': 389,
+        'sequence': 10,
+        'create_user': True,
     }
 
 CompanyLDAP()
@@ -126,87 +193,44 @@ CompanyLDAP()
 class res_company(osv.osv):
     _inherit = "res.company"
     _columns = {
-        'ldaps': fields.one2many('res.company.ldap', 'company', 'LDAP Parameters'),
+        'ldaps': fields.one2many(
+            'res.company.ldap', 'company', 'LDAP Parameters'),
     }
 res_company()
 
+
 class users(osv.osv):
     _inherit = "res.users"
     def login(self, db, login, password):
-
-        if not password:
-            # empty passwords are disallowed for obvious security reasons
-            return False
-
-        ret = super(users,self).login(db, login, password)
-        if ret:
-            return ret
-        logger = logging.getLogger('orm.ldap')
-        pool = pooler.get_pool(db)
+        user_id = super(users, self).login(db, login, password)
+        if user_id:
+            return user_id
         cr = pooler.get_db(db).cursor()
-        action_obj = pool.get('ir.actions.actions')
-        cr.execute("""
-            SELECT id, company, ldap_server, ldap_server_port, ldap_binddn, ldap_password,
-                   ldap_filter, ldap_base, "user", create_user
-            FROM res_company_ldap
-            WHERE ldap_server != '' ORDER BY sequence""")
-        for res_company_ldap in cr.dictfetchall():
-            logger.debug(res_company_ldap)
-            try:
-                l = ldap.open(res_company_ldap['ldap_server'], res_company_ldap['ldap_server_port'])
-                # An empty binddn means anonymous auth, so it should be replaced w/ an empty string
-                # See LDAP RFC 4513, Section 5.1.1
-                if l.simple_bind_s(res_company_ldap['ldap_binddn'] or '',
-                                   res_company_ldap['ldap_password'] or ''):
-                    base = res_company_ldap['ldap_base']
-                    scope = ldap.SCOPE_SUBTREE
-                    filter = filter_format(res_company_ldap['ldap_filter'], (login,))
-                    retrieve_attributes = None
-                    result_id = l.search(base, scope, filter, retrieve_attributes)
-                    timeout = 60
-                    result_type, result_data = l.result(result_id, timeout)
-                    if not result_data:
-                        continue
-                    if result_type == ldap.RES_SEARCH_RESULT and len(result_data) == 1:
-                        dn = result_data[0][0]
-                        logger.debug(dn)
-                        name = result_data[0][1]['cn'][0]
-                        if l.bind_s(dn, password):
-                            l.unbind()
-                            cr.execute("SELECT id FROM res_users WHERE login=%s",(tools.ustr(login),))
-                            res = cr.fetchone()
-                            logger.debug(res)
-                            if res:
-                                cr.close()
-                                return res[0]
-                            if not res_company_ldap['create_user']:
-                                continue
-                            action_id = action_obj.search(cr, 1, [('usage', '=', 'menu')])[0]
-                            if res_company_ldap['user']:
-                                res = self.copy(cr, 1, res_company_ldap['user'],
-                                        default={'active': True})
-                                self.write(cr, 1, res, {
-                                    'name': name,
-                                    'login': login.encode('utf-8'),
-                                    'company_id': res_company_ldap['company'],
-                                    })
-                            else:
-                                res = self.create(cr, 1, {
-                                    'name': name,
-                                    'login': login.encode('utf-8'),
-                                    'company_id': res_company_ldap['company'],
-                                    'action_id': action_id,
-                                    'menu_id': action_id,
-                                    })
-                            cr.commit()
-                            cr.close()
-                            return res
-                    l.unbind()
-            except Exception:
-                logger.warning("Cannot auth", exc_info=True)
-                continue
+        ldap_obj = pooler.get_pool(db).get('res.company.ldap')
+        for conf in ldap_obj.get_ldap_dicts(cr):
+            filter = filter_format(conf['ldap_filter'], (login,))
+            results = ldap_obj.query(conf, filter)
+            if results and len(results) == 1:
+                entry = results[0]
+                dn = entry[0]
+                name = entry[1]['cn'][0]
+                try:
+                    ldap_obj.authenticate(conf, dn, password)
+                    user_id = ldap_obj.get_or_create_user(
+                        cr, 1, login, conf, entry)
+                    if user_id:
+                        cr.execute('UPDATE res_users SET date=now() WHERE '
+                                   'login=%s', (tools.ustr(login),))
+                        cr.commit()
+                    break
+                except ldap.INVALID_CREDENTIALS:
+                    pass
+                except ldap.LDAPError, e:
+                    logger = logging.getLogger('orm.ldap')
+                    logger.warning('An LDAP exception occurred: %s' % e)
+                    pass
         cr.close()
-        return False
+        return user_id
 
     def check(self, db, uid, passwd):
         try:
@@ -219,39 +243,29 @@ class users(osv.osv):
             raise security.ExceptionNoTb('AccessDenied')
 
         cr = pooler.get_db(db).cursor()
-        user = self.browse(cr, 1, uid)
-        logger = logging.getLogger('orm.ldap')
-        if user and user.company_id.ldaps:
-            for res_company_ldap in user.company_id.ldaps:
-                try:
-                    l = ldap.open(res_company_ldap.ldap_server, res_company_ldap.ldap_server_port)
-                    # An empty binddn means anonymous auth, so it should be replaced w/ an empty string
-                    # See LDAP RFC 4513, Section 5.1.1
-                    if l.simple_bind_s(res_company_ldap.ldap_binddn or '',
-                                       res_company_ldap.ldap_password or ''):
-                        base = res_company_ldap.ldap_base
-                        scope = ldap.SCOPE_SUBTREE
-                        filter = filter_format(res_company_ldap.ldap_filter, (user.login,))
-                        retrieve_attributes = None
-                        result_id = l.search(base, scope, filter, retrieve_attributes)
-                        timeout = 60
-                        result_type, result_data = l.result(result_id, timeout)
-                        if result_data and result_type == ldap.RES_SEARCH_RESULT and len(result_data) == 1:
-                            dn = result_data[0][0]
-                            # some LDAP servers allow anonymous binding with blank passwords,
-                            # but these have been rejected above, so we're safe to use bind()
-                            if l.bind_s(dn, passwd):
-                                l.unbind()
-                                self._uid_cache.setdefault(db, {})[uid] = passwd
-                                cr.close()
-                                return True
-                        l.unbind()
-                except Exception:
-                    logger.warning('cannot check', exc_info=True)
-                    pass
+        cr.execute('SELECT login FROM res_users WHERE id=%s AND active=TRUE',
+                   (int(uid),))
+        res = cr.fetchone()
+        if res:
+            ldap_obj = pooler.get_pool(db).get('res.company.ldap')
+            for conf in ldap_obj.get_ldap_dicts(cr):
+                filter = filter_format(conf['ldap_filter'], (res[0],))
+                results = ldap_obj.query(conf, filter)
+                if results and len(results) == 1:
+                    dn = results[0][0]
+                    # some LDAP servers allow anonymous binding with blank passwords,
+                    # but these have been rejected above, so we're safe to use bind()
+                    try:
+                        ldap_obj.authenticate(conf, dn, passwd)
+                        self._uid_cache.setdefault(db, {})[uid] = passwd
+                        cr.close()
+                        return True
+                    except ldap.LDAPError, e:
+                        logger = logging.getLogger('orm.ldap')
+                        logger.warning('An LDAP exception occurred: %s' % e)
+                        pass
         cr.close()
         raise security.ExceptionNoTb('AccessDenied')
         
 users()
 # vim:expandtab:smartindent:tabstop=4:softtabstop=4:shiftwidth=4:
-
diff --git a/addons/users_ldap/users_ldap_view.xml b/addons/users_ldap/users_ldap_view.xml
index 569d5b554aa..b055ef2938d 100644
--- a/addons/users_ldap/users_ldap_view.xml
+++ b/addons/users_ldap/users_ldap_view.xml
@@ -20,7 +20,6 @@
                             <field name="user"/>
                             <newline/>
                             <field name="sequence"/>
-			    <button name="populate" string="Populate" type="object" colspan="2"/>
                         </form>
                         <tree string="LDAP Configuration">
                             <field name="sequence"/>

From 6437267e2315d035125f75f216f5f5a520b3d602 Mon Sep 17 00:00:00 2001
From: Stefan Rijnhart <stefan@therp.nl>
Date: Wed, 22 Jun 2011 13:55:33 +0200
Subject: [PATCH 3/4] [IMP] leave it to res.users' defaults to select menu item
 for new users

bzr revid: stefan@therp.nl-20110622115533-q9aryag887u245uc
---
 addons/users_ldap/users_ldap.py | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/addons/users_ldap/users_ldap.py b/addons/users_ldap/users_ldap.py
index 518dfe44147..fb45df5ec8f 100644
--- a/addons/users_ldap/users_ldap.py
+++ b/addons/users_ldap/users_ldap.py
@@ -121,10 +121,6 @@ class CompanyLDAP(osv.osv):
                    'login': login,
                    'company_id': conf['company']
                    }
-        if not conf['user']:
-            action_obj = self.pool.get('ir.actions.actions')
-            values['action_id'] = values['menu_id'] = action_obj.search(
-                cr, uid, [('usage', '=', 'menu')], order='id')[0]
         return values
     
     def get_or_create_user(self, cr, uid, login, conf, ldap_entry,

From 6adef2a8957fa9dfd2469a2d666a0b123b14c410 Mon Sep 17 00:00:00 2001
From: Stefan Rijnhart <stefan@therp.nl>
Date: Thu, 28 Jul 2011 00:03:38 +0200
Subject: [PATCH 4/4] [REF] Moved to RST docstrings, leave out well known
 parameters [FIX] Unauthorized login with empty password introduced in
 previous commit [REF] Further refactored out duplicate code around
 authorization [FIX] Filter length is too short (64)

lp bug: https://launchpad.net/bugs/806914 fixed

bzr revid: stefan@therp.nl-20110727220338-n1u19efzubngu0qt
---
 addons/users_ldap/users_ldap.py | 169 +++++++++++++++++---------------
 1 file changed, 89 insertions(+), 80 deletions(-)

diff --git a/addons/users_ldap/users_ldap.py b/addons/users_ldap/users_ldap.py
index fb45df5ec8f..584dae3da1a 100644
--- a/addons/users_ldap/users_ldap.py
+++ b/addons/users_ldap/users_ldap.py
@@ -33,11 +33,13 @@ class CompanyLDAP(osv.osv):
 
     def get_ldap_dicts(self, cr, ids=None):
         """ 
-        Return res_company_ldap resources in the database as a list of
-        dictionaries.
+        Retrieve res_company_ldap resources from the database in dictionary
+        format.
 
-        @param cr : database cursor
-        @param ids : optional list of res_company_ldap ids
+        :param list ids: Valid ids of model res_company_ldap. If not \
+        specified, process all resources (unlike other ORM methods).
+        :return: ldap configurations
+        :rtype: list of dictionaries
         """
 
         if ids:
@@ -56,39 +58,73 @@ class CompanyLDAP(osv.osv):
 
     def connect(self, conf):
         """ 
-        Compose an LDAP uri from an ldap configuration dictionary
-        and return a connection to it.
+        Connect to an LDAP server specified by an ldap
+        configuration dictionary.
 
-        @param conf : LDAP configuration dictionary
+        :param dict conf: LDAP configuration
+        :return: an LDAP object
         """
 
         uri = 'ldap://%s:%d' % (conf['ldap_server'],
                                 conf['ldap_server_port'])
         return ldap.initialize(uri)
 
-    def authenticate(self, conf, dn, password):
+    def authenticate(self, conf, login, password):
         """
-        Perform an atomic LDAP authentication.
+        Authenticate a user against the specified LDAP server.
+
+        In order to prevent an unintended 'unauthenticated authentication',
+        which is an anonymous bind with a valid dn and a blank password,
+        check for empty passwords explicitely (:rfc:`4513#section-6.3.1`)
         
-        @param conf : LDAP configuration dictionary
-        @param dn : LDAP dn
-        @param password : Password for the LDAP user
+        :param dict conf: LDAP configuration
+        :param login: username
+        :param password: Password for the LDAP user
+        :return: LDAP entry of authenticated user or False
+        :rtype: dictionary of attributes
         """
 
-        conn = self.connect(conf)
-        conn.simple_bind_s(dn, password)
-        conn.unbind()
+        if not password:
+            return False
+
+        entry = False
+        filter = filter_format(conf['ldap_filter'], (login,))
+        try:
+            results = self.query(conf, filter)
+            if results and len(results) == 1:
+                dn = results[0][0]
+                conn = self.connect(conf)
+                conn.simple_bind_s(dn, password)
+                conn.unbind()
+                entry = results[0]
+        except ldap.INVALID_CREDENTIALS:
+            return False
+        except ldap.LDAPError, e:
+            logger = logging.getLogger('orm.ldap')
+            logger.error('An LDAP exception occurred: %s', e)
+        return entry
         
     def query(self, conf, filter, retrieve_attributes=None):
         """ 
         Query an LDAP server with the filter argument and scope subtree.
-        Return the results in native python-ldap format, ie. a list of
-        tuples (dn, attrs).
 
-        @param conf : LDAP configuration dictionary
-        @param filter : valid LDAP filter
-        @param retrieve_attributes : optional list of LDAP attributes to be
-              retrieved. If not specified, return all attributes.
+        Allow for all authentication methods of the simple authentication
+        method:
+
+        - authenticated bind (non-empty binddn + valid password)
+        - anonymous bind (empty binddn + empty password)
+        - unauthenticated authentication (non-empty binddn + empty password)
+
+        .. seealso::
+           :rfc:`4513#section-5.1` - LDAP: Simple Authentication Method.
+
+        :param dict conf: LDAP configuration
+        :param filter: valid LDAP filter
+        :param list retrieve_attributes: LDAP attributes to be retrieved. \
+        If not specified, return all attributes.
+        :return: ldap entries
+        :rtype: list of tuples (dn, attrs)
+
         """
 
         results = []
@@ -100,21 +136,22 @@ class CompanyLDAP(osv.osv):
             results = conn.search_st(conf['ldap_base'], ldap.SCOPE_SUBTREE,
                                      filter, retrieve_attributes, timeout=60)
             conn.unbind()
+        except ldap.INVALID_CREDENTIALS:
+            logger.error('LDAP bind failed.')
         except ldap.LDAPError, e:
-            logger.warning('An LDAP exception occurred: %s' % e)
-            pass
+            logger.error('An LDAP exception occurred: %s', e)
         return results
 
-    def map_ldap_attributes(self, cr, uid, login, conf, ldap_entry):
+    def map_ldap_attributes(self, cr, uid, conf, login, ldap_entry):
         """
-        Compose a list of field values for creating a new resource of model
-        res_users, based upon the retrieved ldap entry and the LDAP settings.
+        Compose values for a new resource of model res_users,
+        based upon the retrieved ldap entry and the LDAP settings.
         
-        @param cr : the database cursor
-        @param uid : the OpenERP user id
-        @param login : the new user's login
-        @param conf : LDAP configuration dictionary
-        @param ldap_entry : single LDAP result in (dn, attrs) format
+        :param dict conf: LDAP configuration
+        :param login: the new user's login
+        :param tuple ldap_entry: single LDAP result (dn, attrs)
+        :return: parameters for a new resource of model res_users
+        :rtype: dict
         """
 
         values = { 'name': ldap_entry[1]['cn'][0],
@@ -123,18 +160,17 @@ class CompanyLDAP(osv.osv):
                    }
         return values
     
-    def get_or_create_user(self, cr, uid, login, conf, ldap_entry,
+    def get_or_create_user(self, cr, uid, conf, login, ldap_entry,
                            context=None):
         """
-        Return the id of an active res_users resource with the specified
+        Retrieve an active resource of model res_users with the specified
         login. Create the user if it is not initially found.
 
-        @param cr : the database cursor
-        @param uid : the OpenERP user id
-        @param login : the user's login
-        @param conf : LDAP configuration dictionary
-        @param ldap_entry : single LDAP result in (dn, attrs) format
-        @param context : the OpenERP context
+        :param dict conf: LDAP configuration
+        :param login: the user's login
+        :param tuple ldap_entry: single LDAP result (dn, attrs)
+        :return: res_users id
+        :rtype: int
         """
         
         user_id = False
@@ -148,7 +184,7 @@ class CompanyLDAP(osv.osv):
             logger = logging.getLogger('orm.ldap')
             logger.debug("Creating new OpenERP user \"%s\" from LDAP" % login)
             user_obj = self.pool.get('res.users')
-            values = self.map_ldap_attributes(cr, uid, login, conf, ldap_entry)
+            values = self.map_ldap_attributes(cr, uid, conf, login, ldap_entry)
             if conf['user']:
                 user_id = user_obj.copy(cr, 1, conf['user'],
                                         default={'active': True})
@@ -169,7 +205,7 @@ class CompanyLDAP(osv.osv):
         'ldap_password': fields.char('LDAP password', size=64,
             help=("The password of the user account on the LDAP server that is "
                   "used to query the directory.")),
-        'ldap_filter': fields.char('LDAP filter', size=64, required=True),
+        'ldap_filter': fields.char('LDAP filter', size=256, required=True),
         'ldap_base': fields.char('LDAP base', size=64, required=True),
         'user': fields.many2one('res.users', 'Model User',
             help="Model used for user creation"),
@@ -204,27 +240,15 @@ class users(osv.osv):
         cr = pooler.get_db(db).cursor()
         ldap_obj = pooler.get_pool(db).get('res.company.ldap')
         for conf in ldap_obj.get_ldap_dicts(cr):
-            filter = filter_format(conf['ldap_filter'], (login,))
-            results = ldap_obj.query(conf, filter)
-            if results and len(results) == 1:
-                entry = results[0]
-                dn = entry[0]
-                name = entry[1]['cn'][0]
-                try:
-                    ldap_obj.authenticate(conf, dn, password)
-                    user_id = ldap_obj.get_or_create_user(
-                        cr, 1, login, conf, entry)
-                    if user_id:
-                        cr.execute('UPDATE res_users SET date=now() WHERE '
-                                   'login=%s', (tools.ustr(login),))
-                        cr.commit()
+            entry = ldap_obj.authenticate(conf, login, password)
+            if entry:
+                user_id = ldap_obj.get_or_create_user(
+                    cr, 1, conf, login, entry)
+                if user_id:
+                    cr.execute('UPDATE res_users SET date=now() WHERE '
+                               'login=%s', (tools.ustr(login),))
+                    cr.commit()
                     break
-                except ldap.INVALID_CREDENTIALS:
-                    pass
-                except ldap.LDAPError, e:
-                    logger = logging.getLogger('orm.ldap')
-                    logger.warning('An LDAP exception occurred: %s' % e)
-                    pass
         cr.close()
         return user_id
 
@@ -234,10 +258,6 @@ class users(osv.osv):
         except security.ExceptionNoTb: # AccessDenied
             pass
 
-        if not passwd:
-            # empty passwords disallowed for obvious security reasons
-            raise security.ExceptionNoTb('AccessDenied')
-
         cr = pooler.get_db(db).cursor()
         cr.execute('SELECT login FROM res_users WHERE id=%s AND active=TRUE',
                    (int(uid),))
@@ -245,21 +265,10 @@ class users(osv.osv):
         if res:
             ldap_obj = pooler.get_pool(db).get('res.company.ldap')
             for conf in ldap_obj.get_ldap_dicts(cr):
-                filter = filter_format(conf['ldap_filter'], (res[0],))
-                results = ldap_obj.query(conf, filter)
-                if results and len(results) == 1:
-                    dn = results[0][0]
-                    # some LDAP servers allow anonymous binding with blank passwords,
-                    # but these have been rejected above, so we're safe to use bind()
-                    try:
-                        ldap_obj.authenticate(conf, dn, passwd)
-                        self._uid_cache.setdefault(db, {})[uid] = passwd
-                        cr.close()
-                        return True
-                    except ldap.LDAPError, e:
-                        logger = logging.getLogger('orm.ldap')
-                        logger.warning('An LDAP exception occurred: %s' % e)
-                        pass
+                if ldap_obj.authenticate(conf, res[0], passwd):
+                    self._uid_cache.setdefault(db, {})[uid] = passwd
+                    cr.close()
+                    return True
         cr.close()
         raise security.ExceptionNoTb('AccessDenied')