0基本上手python、PHP编程，域自助服务台，自助改密解锁等功能-天涯论坛

j8typz 发表于 2024-10-4 12:43:10

0基本上手python、PHP编程，域自助服务台，自助改密解锁等功能

<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-qvj2lq49k0/3c6c8bba849b4266a9d7e33d16991226~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1728207527&x-signature=ZxUFcKInq59i%2BR8%2FD%2Fjc7KKrjo4%3D" style="width: 50%; margin-bottom: 20px;"></div>
王工自研域自助服务台架构图，具备长时间未改密企业微X提醒、自助改密解锁等功能
全面对标宁盾微软AD自助修改秘码处理方法https://www.nington.com/solution-adpassword/每年可为机构节省5W-10W元

说明王工域控为windows2022，Self Service Password搭建在OracleLinux8上，python版本为python3最新版本，PHP为OracleLinux8默认源中的PHP7
预览通告改密
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-qvj2lq49k0/d7bfe9aadb8c4fa798d226dc47414842~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1728207527&x-signature=gGoj0u%2B7Jv0yXaQ%2Fg92izMPD1WM%3D" style="width: 50%; margin-bottom: 20px;"></div>
自助改密
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-qvj2lq49k0/f7efe0ae15ff44c59a7c17a5ebed503b~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1728207527&x-signature=45sjHPj2R4fAMdqpMBM%2BqWPX8KA%3D" style="width: 50%; margin-bottom: 20px;"></div>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-qvj2lq49k0/b7689e35693e4a409124d0b88a6b8542~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1728207527&x-signature=jYAOf1BCAPXbjUff9k%2BjGSEJ3oA%3D" style="width: 50%; margin-bottom: 20px;"></div>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-qvj2lq49k0/396e9ddd76474cc4a25f3104d4d7a594~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1728207527&x-signature=ealjP8OITh7YlYKlmY36rIVM0Fk%3D" style="width: 50%; margin-bottom: 20px;"></div>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-qvj2lq49k0/eb2e51948b77409da893f63daf5f4df8~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1728207527&x-signature=E4K0Y7398%2BwKi%2F3rWgoWCX6JCV4%3D" style="width: 50%; margin-bottom: 20px;"></div>
<div style="color: black; text-align: left; margin-bottom: 10px;"><img src="https://p3-sign.toutiaoimg.com/tos-cn-i-qvj2lq49k0/aeeacbad9e53449abba96d3327ef9848~noop.image?_iz=58558&from=article.pc_detail&lk3s=953192f4&x-expires=1728207527&x-signature=%2FHfVWNlXO0W3nVv7Z6RxRrmDHHU%3D" style="width: 50%; margin-bottom: 20px;"></div>
架构解析：
1、域控上域账户守护pager属性(寻呼机)，修改为企业微XID
2、域控运行扫描脚本，经过计算上次修改秘码时间，超过指定日期，进行企业微X提醒；倘若未守护pager属性，写入日志
3、Self Service Password域控自助服务台二次研发，改为企业微X接收验证码改密
4、进行企业微X提醒时，先查找redis缓存，倘若access_token不存在，则获取一次，倘若存在，直接运用，缓存5400秒自动过期。5、创立企业微X应用，可参考我的zabbix文案
搭建前提
1、已守护域控pager属性为企业微Xuserid，此信息需要企业微X管理员后台查找。
2、已正确安排Self Service Password，能够看我之前的文案。
3、已安排redis，意见运用docker安排，必定要设置redis秘码4、已为php增多php-redis扩展
docker一键安排redis红帽系系统默认为podman替代dockerpodman pull redis
podman run --restart=always -p 6379:6379 --name myredis -d redis --requirepass passwd@123
扫描脚本：
扫描脚本一样有两部分构成，第1部分是powershell脚本，用于获取域用户信息
可指定OU、可自定义要获取的用户属性，生成的文件放在C盘根目录下1.txt，与python脚本对应
adgetuser.ps1Get-ADUser -Filter Name -like "*" -SearchBase "OU=测试组,OU=用户OU,DC=90apt,DC=com" -Properties * | Select-Object name,passwordlastset,pager > c:/1.txt
运行结果
name passwordlastset pager
---- --------------- -----王忘杰1 2023/5/18 16:39:05 WangWangJie1
王忘杰2 2022/9/26 16:50:41 WangWangJie2
第二部分是扫描通告脚本，由主python文件和配置文件ad.config构成，运行后生成errlog.txt日志文件
ad.config
属性说明
corpid:
appsecret:
agentid:
content:内容1
content1:内容2
content2:内容3
admin:闲置属性
ip:redis位置
port:redis端口
passwd:redis秘码passwddate:秘码多少天未修改进行提醒
{
"corpid" : "xxxx",
"appsecret" : "xxxx",
"agentid" : "xxxx",
"content" : "亲爱的 ",
"content1" : " 域用户 :\n您的计算机域账户已然超过 ",
"content2" : " 天无修改秘码了（电脑登录秘码），请您立即更改。\n重置秘码过程请遵循以下原则：\n○秘码长度最少 8 位；\n○秘码中不可显现机构和自己中英文拼写\n○秘码符合繁杂性需要（大写字母、小写字母、数字和符号四种中必须有三种）\n操作方式：\n您能够经过 自助秘码服务台http://xx/修改秘码，在机构内网中，手机、笔记本、台式机均可拜访",
"admin" : "xxxx",
"ip" : "xxxx",
"port" : "xxxx",
"passwd" : "xxxx",
"passwddate" : xx
}主python文件import requests,json,redis,time,logging
from datetime import datetime, timedelta

def get_weixintoken():
#获取微Xtoken
token_url =https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid= + config[0] + &corpsecret= + config[1]
req = requests.get(token_url)
accesstoken = req.json()[access_token]
returnaccesstoken

def get_redistoken():
readredis = redis.Redis(connection_pool=redis.ConnectionPool(host=config[7],port=config[8],password=config[9],decode_responses=True))
if readredis.get(key) == None:
readredis.set(key, get_weixintoken(),ex=5400)
return (readredis.get(key))
else:
return readredis.get(key)

def post_weixin(userweixin,content):
body = {
"touser": userweixin,
"msgtype": "text",
"agentid": config[2],
"text": {
"content": content
}
}
postweixin = requests.post(
https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token=+get_redistoken(),data=json.dumps(body))
return(postweixin.text)

def get_config():
config = json.loads(open("ad.config", encoding=utf-8).read())
return [config[corpid],config[appsecret],config[agentid],config[content],config[content1],config[content2],config[admin],config[ip],config[port],config[passwd],config[passwddate]]

def user_check():
f = open("C:\\1.txt", "r", encoding=utf-16)
lines = f.readlines()
f = open(errlog.txt, w)
for line in lines:
try:
x = line.replace("/", "-")
y = x.split()
time_1 = y[1]
time_2 = time.strftime("%Y-%m-%d", time.localtime())
time_1_struct = datetime.strptime(time_1,"%Y-%m-%d")
time_2_struct = datetime.strptime(time_2, "%Y-%m-%d")
day = (time_2_struct - time_1_struct).days
userweixin = y[3]
username= y[0]
if day > config[10]:
day = str(day)
time.sleep(1)
try:
post = post_weixin(userweixin,config[3]+username+config[4]+day+config[5])
postjson=json.loads(post)
if postjson[errmsg] != "ok":
f.write("发送失败,可能微X号错误 " + userweixin+"\n")

except :
Noneelse:
None
except:
f.write("无微X号 "+ line)
f.close()

config = get_config()
#post_weixin()
user_check()脚本运用编译为EXE文件，和ad.config，放在域控服务器经过按时任务运行就可。
Self Service Password企业微X脚本项目目录/usr/share/self-service-password/配置文件/usr/share/self-service-password/conf/config.inc.local.php配置文件中修改短信通告方式## SMS
# Use sms
$use_sms = true;
# SMS method (mail, api)
$sms_method = "api";
$sms_api_lib = "lib/weixin.inc.php";
# GSM number attribute$sms_attributes =array( "pager" );编写企业微X通告脚本/usr/share/self-service-password/lib/weixin.inc.php<?php
 //连接本地的 Redis 服务
 function get_token(){
 $redis = new Redis();
 $redis->connect(修改用自己的IP位置, 修改用自己的端口);
 $redis->auth(修改用自己的redis秘码);
 $key = $redis->get("key");
 if ($key)
 {
 return $key;
 }
 else
 {
 $url=https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=修改用自己的&corpsecret=修改用自己的;
 $jsondb = file_get_contents($url);
 $jsondb = json_decode($jsondb,true);
 $key = $jsondb[access_token];
 $redis->set("key", $key);
 $redis->expire("key", 5400);
 return $key;
 }
 }

 function send_sms_by_api($mobile, $message) {
 $postdata = array(
 touser => "$mobile",
 msgtype => text,
 agentid => 修改用自己的,
 text => array(
 content => "$message"
 )

 );

 $ch = curl_init();
 curl_setopt($ch, CURLOPT_URL, https://qyapi.weixin.qq.com/cgi-bin/message/send?access_token= . get_token());
 curl_setopt($ch, CURLOPT_POST, true);
 curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($postdata));
 curl_setopt($ch, CURLOPT_SSL_VERIFYPEER,0);
 curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
 curl_setopt($ch, CURLOPT_RETURNTRANSFER,true);
 $errmsg = json_decode(curl_exec($ch))->errmsg;
 if ($errmsg=="ok")
 {
 return 1;
 }
 else
 {
 return 0;
 }

 }?>
修改中文表示例如把短信修改成企业微X，可直接修改语言文件/usr/share/self-service-password/lang/zh-CN.inc.phpPHP安装redis扩展
总结简单

qzmjef 发表于 2024-10-24 07:27:30

你字句如珍珠，我珍藏这份情。

页: [1]

天涯论坛's Archiver

0基本上手python、PHP编程，域自助服务台，自助改密解锁等功能