Changeset 28534 for extensions/Ldap_Login/class.ldap.php

Timestamp:

May 25, 2014, 6:52:42 PM (10 years ago)

Author:

22decembre

Message:

add function to sync ldap and piwigo groups
ldap groups correspond to webmasters and admin roles

File:

• extensions/Ldap_Login/class.ldap.php (modified) (6 diffs)

extensions/Ldap_Login/class.ldap.php

@@ -44 +44 @@
         {
                 $this->config['host'] = 'localhost';
-                $this->config['basedn'] = 'ou=people,dc=example,dc=com'; // racine !
+                $this->config['basedn'] = 'dc=example,dc=com'; // racine !
+                $this->config['usersbranch'] = 'ou=people';
+                $this->config['groupbranch'] = 'ou=group';
+                $this->config['ld_search_users'] = False;
+                $this->config['ld_search_groups'] = False;
                 $this->config['port'] = ''; // if port is empty, I count on the software to care of it !
                 $this->config['ld_attr'] = 'uid';
+                $this->config['ld_group'] = 'cn';
+                //$this->config['ld_class'] = 'posixAccount';
                 $this->config['ld_use_ssl'] = False;
                 $this->config['ld_bindpw'] ='';
                 $this->config['ld_binddn'] ='';
-                
                 $this->config['allow_newusers'] = False;
                 $this->config['advertise_admin_new_ldapuser'] = False;
                 $this->config['send_password_by_mail_ldap'] = False;
+                
+                $this->config['users_group'] = False;
+                $this->config['webmasters_group'] = False;
+                $this->config['admins_group'] = False;
         }
         
         function load_config() {
-                // first we load the base config
+                $this->load_default_config();
+                
+                // after the default, we can load the actual conf. That way, no holes !
                 $conf_file = @file_get_contents( LDAP_LOGIN_PATH.'data.dat' );
                 if ($conf_file!==false)
                 {
                         $this->config = unserialize($conf_file);
+                        $this->config['full_usersbranch'] = $this->config['usersbranch'].','.$this->config['basedn'];
+                        $this->config['full_groupbranch'] = $this->config['groupbranch'].','.$this->config['basedn'];
                 }
         }
@@ -102 +115 @@
                 }
 
+                // first, we initializes connection to ldap
                 if ($this->cnx = @ldap_connect($this->config['uri'])){
-                        @ldap_set_option($this->cnx, LDAP_OPT_PROTOCOL_VERSION, 3); // LDAPv3 if possible
-                        return true;
-                }
-                return false;
-                
-                // connect with rootdn in case not anonymous.
-                if (!empty($obj->config['ld_binddn']) && !empty($obj->config['ld_bindpw'])){ // if empty ld_binddn, anonymous work
-                
-                // authentication with rootdn and rootpw for dn search
-                // carefull ! rootdn should be in full ldap style ! Nothing is supposed (to be one of the users the plugin auth…).
-                if (@ldap_bind($obj->config['ld_binddn'],$obj->config['ld_bindpw'])){
-                return false;
-                }
-        }
+                                @ldap_set_option($this->cnx, LDAP_OPT_PROTOCOL_VERSION, 3); // LDAPv3 if possible
+                
+                        // then we authenticate if anonymous search is forbidden
+                        if (!empty($obj->config['ld_binddn']) && !empty($obj->config['ld_bindpw'])){
+                                if (@ldap_bind($this->cnx,$this->config['ld_binddn'],$this->config['ld_bindpw'])){
+                                        return true;
+                                }
+                                else { return false; }
+                        }
+                        // if anonymous search is allowed, we still need a fake auth using ldap_bind
+                        else {
+                                if (@ldap_bind($this->cnx)){
+                                        return true;
+                                }
+                                else { return false; }
+                        }
+                }
+                else { return false; }
         }
 
@@ -126 +144 @@
         // return the name ldap understand
         public function ldap_name($name){
-        return $this->config['ld_attr'].'='.$name.','.$this->config['basedn'];
+                if ($this->config['ld_search_users']) {
+                        return $this->ldap_search_dn($name);
+                }
+                else { return $this->config['ld_attr'].'='.$name.','.$this->config['full_usersbranch']; }
+        }
+        
+        public function ldap_group($groupname){
+                // this should return an array, even if it's only one !
+                if ($this->config['ld_search_groups']) {
+                        return $this->ldap_search_group($groupname);
+                }
+                else {
+                $result[] = $this->config['ld_group'].'='.$groupname.','.$this->config['full_groupbranch'];
+                return $result;
+                }
         }
 
@@ -138 +170 @@
 
         public function ldap_mail($name){
-        
-                //echo $this->cnx;
-                //echo $this->ldap_name($name);
                 $sr=@ldap_read($this->cnx, $this->ldap_name($name), "(objectclass=*)", array('mail'));
                 $entry = @ldap_get_entries($this->cnx, $sr);
@@ -150 +179 @@
         }
         
-        // return userdn (and username) for authentication
-        /* public function ldap_search_dn($to_search){
-                $filter = str_replace('%s',$to_search,$this->config['ld_filter']);
-                //$this->write_log('$filter '.$filter);
-
-                if ($search = @ldap_search($this->cnx,$this->config['basedn'],$filter,array('dn',$this->config['ld_attr']),0,1)){
-                        $entry = @ldap_get_entries($this->cnx, $search);
-                        if (!empty($entry[0][strtolower($this->config['ld_attr'])][0])) {
-                                return $entry;
-                        }
-                }
-                return false;
-        } */
-        
-        
-        public function getAttr() {
+        public function ldap_search_group($to_search){
+                $ld_group = $this->config['ld_group'];
+                
+                $sr=@ldap_search($this->cnx, $this->config['full_groupbranch'], "($ld_group=$to_search)", array('dn'),0,0);
+                $groups = @ldap_get_entries($this->cnx, $sr);
+                $result = array();
+                foreach ($groups as $group) {
+                        $result[] = $group['dn'];
+                }
+                return $result;
+        }
+        
+        public function ldap_search_dn($to_search){
+                $ld_attr = $this->config['ld_attr'];
+                
+                $sr=@ldap_search($this->cnx, $this->config['full_usersbranch'], "($ld_attr=$to_search)", array('dn','mail'),0,0);
+                $entry = @ldap_get_entries($this->cnx, $sr);
+                
+                if (!empty($entry[0]['dn'])) {
+                        return $entry[0]['dn'];
+                        }
+                else { return False; }
+        }
+        
+        public function user_membership($user, $groups){
+                // $groups is an array of groupdn ! (there is a possibility of several groups, we search the user in each of them).
+                foreach ($groups as $groupdn) {
+                        $filter = '(objectClass=*)';
+                        $result = @ldap_read($this->cnx,$groupdn,$filter,array('memberUid'));
+                        $result2 = @ldap_get_entries($this->cnx, $result);
+                        if(isset($result2[0]['memberuid'])){
+                                foreach($result2[0]['memberuid'] as $item){
+                                        if ($item == $user){
+                                                return True;
+                                        }
+                                }
+                        }
+                }
+                return False;
+        }
+        
+        public function ldap_status($username){
+                if ($this->config['webmasters_group']) {
+                        if ($this->user_membership($username,$this->ldap_group($this->config['webmasters_group']))) {
+                                // set status to webmaster and quit (more powerfull, no need to get further)
+                                return 'webmaster';
+                        }
+                }
+                if ($this->config['admins_group']) {
+                        if ($this->user_membership($username,$this->ldap_group($this->config['admins_group']))) {
+                                // set status to admin
+                                return 'admin';
+                        }
+                }
+                else 
+                {
+                return 'normal';
+                }
+        }
+        
+        public function getAttr(){
         $search = @ldap_read($this->cnx, "cn=subschema", "(objectClass=*)", array('*', 'subschemasubentry'));
         $entries = @ldap_get_entries($this->cnx, $search);
-        echo count($entries);
-        }
-        
-        public function getRootDse() {
+        }
+        
+        public function getRootDse(){
 
         $search = @ldap_read($this->cnx, NULL, 'objectClass=*', array("*", "+"));
@@ -177 +250 @@
         return $entries[0];
         }
-
 
         public function ldap_check_basedn(){