[27036] | 1 | <?php |
---|
| 2 | class Ldap { |
---|
| 3 | |
---|
| 4 | var $cnx; |
---|
| 5 | var $config; |
---|
| 6 | |
---|
| 7 | // for debug |
---|
| 8 | public function write_log($message){ |
---|
| 9 | @file_put_contents('/var/log/ldap_login.log',$message."\n",FILE_APPEND); |
---|
| 10 | } |
---|
| 11 | |
---|
| 12 | /** |
---|
| 13 | * check ldap configuration |
---|
| 14 | * |
---|
| 15 | * Dans le cas ou l'acces au ldap est anonyme il faut impérativement faire une recherche |
---|
| 16 | * pour tester la connection. |
---|
| 17 | * |
---|
| 18 | * When OpenLDAP 2.x.x is used, ldap_connect() will always return a resource as it does not actually connect |
---|
| 19 | * but just initializes the connecting parameters. The actual connect happens with the next calls |
---|
| 20 | * to ldap_* funcs, usually with ldap_bind(). |
---|
| 21 | */ |
---|
| 22 | public function check_ldap(){ |
---|
| 23 | |
---|
| 24 | if (!$this->ldap_conn()) { |
---|
| 25 | return $this->getErrorString(); |
---|
| 26 | } |
---|
| 27 | |
---|
| 28 | // test du compte root si renseigné |
---|
| 29 | if (!empty($this->config['ld_binddn']) && !empty($this->config['ld_bindpw'])){ // if empty ld_binddn, anonymous search |
---|
| 30 | // authentication with rootdn and rootpw for search |
---|
| 31 | if (!$this->ldap_bind_as($this->config['ld_binddn'],$this->config['ld_bindpw'])){ |
---|
| 32 | return $this->getErrorString(); |
---|
| 33 | } |
---|
| 34 | } else { |
---|
| 35 | // sinon recherche du basedn (cf comportement ldap_connect avec OpenLDAP) |
---|
| 36 | if (!$this->ldap_check_basedn()){ // search userdn |
---|
| 37 | return $this->getErrorString(); |
---|
| 38 | } |
---|
| 39 | } |
---|
| 40 | return true; |
---|
| 41 | } |
---|
| 42 | |
---|
| 43 | function load_config() |
---|
| 44 | { |
---|
| 45 | // init to defaults |
---|
| 46 | $this->config['host'] = 'localhost'; |
---|
| 47 | $this->config['basedn'] = 'ou=people,dc=example,dc=com'; // racine ! |
---|
| 48 | $this->config['port'] = ''; // if port is empty, I count on the software to care of it ! |
---|
| 49 | $this->config['ld_attr'] = 'uid'; |
---|
| 50 | $this->config['ld_use_ssl'] = False; |
---|
| 51 | $this->config['ld_bindpw'] =''; |
---|
| 52 | $this->config['ld_binddn'] =''; |
---|
| 53 | |
---|
| 54 | $this->config['allow_newusers'] = False; |
---|
| 55 | $this->config['advertise_admin_new_ldapuser'] = False; |
---|
| 56 | $this->config['send_password_by_mail_ldap'] = False; |
---|
| 57 | |
---|
| 58 | echo $this->config['send_password_by_mail_ldap']; |
---|
| 59 | // fetch the actual config |
---|
| 60 | $x = @file_get_contents( LDAP_LOGIN_PATH.'data.dat' ); |
---|
| 61 | if ($x!==false) |
---|
| 62 | { |
---|
| 63 | $c = unserialize($x); |
---|
| 64 | // do some more tests here |
---|
| 65 | $this->config = $c; |
---|
| 66 | } |
---|
| 67 | } |
---|
| 68 | |
---|
| 69 | function save_config() |
---|
| 70 | { |
---|
| 71 | $file = fopen( LDAP_LOGIN_PATH.'/data.dat', 'w' ); |
---|
| 72 | fwrite($file, serialize($this->config) ); |
---|
| 73 | fclose( $file ); |
---|
| 74 | } |
---|
| 75 | |
---|
| 76 | function ldap_admin_menu($menu) |
---|
| 77 | { |
---|
| 78 | array_push($menu, |
---|
| 79 | array( |
---|
| 80 | 'NAME' => 'Ldap Login', |
---|
| 81 | 'URL' => get_admin_plugin_menu_link(LDAP_LOGIN_PATH.'/admin.php') ) |
---|
| 82 | ); |
---|
| 83 | return $menu; |
---|
| 84 | } |
---|
| 85 | |
---|
| 86 | public function ldap_conn(){ |
---|
| 87 | |
---|
| 88 | if ($this->config['use_ssl'] == 1){ |
---|
| 89 | if (empty($this->config['port'])){ |
---|
| 90 | $this->config['uri'] = 'ldaps://'.$this->config['host']; |
---|
| 91 | } |
---|
| 92 | else { |
---|
| 93 | $this->config['uri'] = 'ldaps://'.$this->config['host'].':'.$this->config['port']; |
---|
| 94 | } |
---|
| 95 | } |
---|
| 96 | |
---|
| 97 | // now, it's without ssl |
---|
| 98 | else { |
---|
| 99 | if (empty($this->config['port'])){ |
---|
| 100 | $this->config['uri'] = 'ldap://'.$this->config['host']; |
---|
| 101 | } |
---|
| 102 | else { |
---|
| 103 | $this->config['uri'] = 'ldap://'.$this->config['host'].':'.$this->config['port']; |
---|
| 104 | } |
---|
| 105 | } |
---|
| 106 | |
---|
| 107 | if ($this->cnx = @ldap_connect($this->config['uri'])){ |
---|
| 108 | @ldap_set_option($this->cnx, LDAP_OPT_PROTOCOL_VERSION, 3); // LDAPv3 if possible |
---|
| 109 | return true; |
---|
| 110 | } |
---|
| 111 | return false; |
---|
| 112 | |
---|
| 113 | // connect with rootdn in case not anonymous. |
---|
| 114 | if (!empty($obj->config['ld_binddn']) && !empty($obj->config['ld_bindpw'])){ // if empty ld_binddn, anonymous work |
---|
| 115 | |
---|
| 116 | // authentication with rootdn and rootpw for dn search |
---|
| 117 | // carefull ! rootdn should be in full ldap style ! Nothing is supposed (to be one of the users the plugin auth…). |
---|
| 118 | if (@ldap_bind($obj->config['ld_binddn'],$obj->config['ld_bindpw'])){ |
---|
| 119 | return false; |
---|
| 120 | } |
---|
| 121 | } |
---|
| 122 | } |
---|
| 123 | |
---|
| 124 | // return ldap error |
---|
| 125 | public function getErrorString(){ |
---|
| 126 | return ldap_err2str(ldap_errno($this->cnx)); |
---|
| 127 | } |
---|
| 128 | |
---|
| 129 | // return the name ldap understand |
---|
| 130 | public function ldap_name($name){ |
---|
| 131 | return $this->config['ld_attr'].'='.$name.','.$this->config['basedn']; |
---|
| 132 | } |
---|
| 133 | |
---|
| 134 | // authentication |
---|
| 135 | public function ldap_bind_as($user,$user_passwd){ |
---|
| 136 | if (@ldap_bind($this->cnx,$this->ldap_name($user),$user_passwd)){ |
---|
| 137 | return true; |
---|
| 138 | } |
---|
| 139 | return false; |
---|
| 140 | } |
---|
| 141 | |
---|
| 142 | public function ldap_mail($name){ |
---|
| 143 | |
---|
| 144 | //echo $this->cnx; |
---|
| 145 | //echo $this->ldap_name($name); |
---|
| 146 | $sr=@ldap_read($this->cnx, $this->ldap_name($name), "(objectclass=*)", array('mail')); |
---|
| 147 | $entry = @ldap_get_entries($this->cnx, $sr); |
---|
| 148 | |
---|
| 149 | if (!empty($entry[0]['mail'])) { |
---|
| 150 | return $entry[0]['mail'][0]; |
---|
| 151 | } |
---|
| 152 | return False; |
---|
| 153 | } |
---|
| 154 | |
---|
| 155 | // return userdn (and username) for authentication |
---|
| 156 | /* public function ldap_search_dn($to_search){ |
---|
| 157 | $filter = str_replace('%s',$to_search,$this->config['ld_filter']); |
---|
| 158 | //$this->write_log('$filter '.$filter); |
---|
| 159 | |
---|
| 160 | if ($search = @ldap_search($this->cnx,$this->config['basedn'],$filter,array('dn',$this->config['ld_attr']),0,1)){ |
---|
| 161 | $entry = @ldap_get_entries($this->cnx, $search); |
---|
| 162 | if (!empty($entry[0][strtolower($this->config['ld_attr'])][0])) { |
---|
| 163 | return $entry; |
---|
| 164 | } |
---|
| 165 | } |
---|
| 166 | return false; |
---|
| 167 | } */ |
---|
| 168 | |
---|
| 169 | |
---|
| 170 | public function getAttr() { |
---|
| 171 | $search = @ldap_read($this->cnx, "cn=subschema", "(objectClass=*)", array('*', 'subschemasubentry')); |
---|
| 172 | $entries = @ldap_get_entries($this->cnx, $search); |
---|
| 173 | echo count($entries); |
---|
| 174 | } |
---|
| 175 | |
---|
| 176 | public function getRootDse() { |
---|
| 177 | |
---|
| 178 | $search = @ldap_read($this->cnx, NULL, 'objectClass=*', array("*", "+")); |
---|
| 179 | $entries = @ldap_get_entries($this->cnx, $search); |
---|
| 180 | return $entries[0]; |
---|
| 181 | } |
---|
| 182 | |
---|
| 183 | |
---|
| 184 | public function ldap_check_basedn(){ |
---|
| 185 | if ($read = @ldap_read($this->cnx,$this->config['basedn'],'(objectClass=*)',array('dn'))){ |
---|
| 186 | $entry = @ldap_get_entries($this->cnx, $read); |
---|
| 187 | if (!empty($entry[0]['dn'])) { |
---|
| 188 | return true; |
---|
| 189 | } |
---|
| 190 | } |
---|
| 191 | return false; |
---|
| 192 | } |
---|
| 193 | |
---|
| 194 | } |
---|
| 195 | ?> |
---|