def auth_user_ldap(self, username, password):
if username is None or username == "<STR_LIT>":<EOL><INDENT>return None<EOL><DEDENT>user = self.find_user(username=username)<EOL>if user is not None and (not user.is_active):<EOL><INDENT>return None<EOL><DEDENT>else:<EOL><INDENT>try:<EOL><INDENT>import ldap<EOL><DEDENT>except Exception:<EOL><INDENT>raise Exception("<STR_LIT>")<EOL><DEDENT>try:<EOL><INDENT>if self.auth_ldap_allow_self_signed:<EOL><INDENT>ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_ALLOW)<EOL>ldap.set_option(ldap.OPT_X_TLS_NEWCTX, <NUM_LIT:0>)<EOL><DEDENT>elif self.auth_ldap_tls_demand:<EOL><INDENT>ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_DEMAND)<EOL>ldap.set_option(ldap.OPT_X_TLS_NEWCTX, <NUM_LIT:0>)<EOL><DEDENT>if self.auth_ldap_tls_cacertdir:<EOL><INDENT>ldap.set_option(<EOL>ldap.OPT_X_TLS_CACERTDIR, self.auth_ldap_tls_cacertdir<EOL>)<EOL><DEDENT>if self.auth_ldap_tls_cacertfile:<EOL><INDENT>ldap.set_option(<EOL>ldap.OPT_X_TLS_CACERTFILE, self.auth_ldap_tls_cacertfile<EOL>)<EOL><DEDENT>if self.auth_ldap_tls_certfile and self.auth_ldap_tls_keyfile:<EOL><INDENT>ldap.set_option(<EOL>ldap.OPT_X_TLS_CERTFILE, self.auth_ldap_tls_certfile<EOL>)<EOL>ldap.set_option(ldap.OPT_X_TLS_KEYFILE, self.auth_ldap_tls_keyfile)<EOL><DEDENT>con = ldap.initialize(self.auth_ldap_server)<EOL>con.set_option(ldap.OPT_REFERRALS, <NUM_LIT:0>)<EOL>if self.auth_ldap_use_tls:<EOL><INDENT>try:<EOL><INDENT>con.start_tls_s()<EOL><DEDENT>except Exception:<EOL><INDENT>log.info(<EOL>LOGMSG_ERR_SEC_AUTH_LDAP_TLS.format(self.auth_ldap_server)<EOL>)<EOL>return None<EOL><DEDENT><DEDENT>if not self._bind_ldap(ldap, con, username, password):<EOL><INDENT>if user:<EOL><INDENT>self.update_user_auth_stat(user, False)<EOL><DEDENT>log.info(LOGMSG_WAR_SEC_LOGIN_FAILED.format(username))<EOL>return None<EOL><DEDENT>if not user and not self.auth_user_registration:<EOL><INDENT>return None<EOL><DEDENT>elif not user and self.auth_user_registration:<EOL><INDENT>self._bind_indirect_user(ldap, con)<EOL>new_user = self._search_ldap(ldap, con, username)<EOL>if not new_user:<EOL><INDENT>log.warning(LOGMSG_WAR_SEC_NOLDAP_OBJ.format(username))<EOL>return None<EOL><DEDENT>ldap_user_info = new_user[<NUM_LIT:0>][<NUM_LIT:1>]<EOL>if self.auth_user_registration and user is None:<EOL><INDENT>user = self.add_user(<EOL>username=username,<EOL>first_name=self.ldap_extract(<EOL>ldap_user_info, self.auth_ldap_firstname_field, username<EOL>),<EOL>last_name=self.ldap_extract(<EOL>ldap_user_info, self.auth_ldap_lastname_field, username<EOL>),<EOL>email=self.ldap_extract(<EOL>ldap_user_info,<EOL>self.auth_ldap_email_field,<EOL>username + "<STR_LIT>",<EOL>),<EOL>role=self.find_role(self.auth_user_registration_role),<EOL>)<EOL><DEDENT><DEDENT>self.update_user_auth_stat(user)<EOL>return user<EOL><DEDENT>except ldap.LDAPError as e:<EOL><INDENT>if type(e.message) == dict and "<STR_LIT>" in e.message:<EOL><INDENT>log.error(LOGMSG_ERR_SEC_AUTH_LDAP.format(e.message["<STR_LIT>"]))<EOL>return None<EOL><DEDENT>else:<EOL><INDENT>log.error(e)<EOL>return None<EOL><DEDENT><DEDENT><DEDENT>
Method for authenticating user, auth LDAP style.
depends on ldap module that is not mandatory requirement
for F.A.B.

:param username:
    The username
:param password:
    The password