Skip to content
This repository was archived by the owner on Mar 21, 2023. It is now read-only.

Commit a307987

Browse files
adubovikovadubovikov
authored
Merge pull request #184 from MrCirca/ldap_auth_fix
LDAP authentication, support multiple ldap groups, delete and rename some variables
2 parents c74b9ba + deb1bfb commit a307987

File tree

2 files changed

+43
-44
lines changed

2 files changed

+43
-44
lines changed

‎api/Authentication/LDAP.php

+36-35
Original file line numberDiff line numberDiff line change
@@ -50,46 +50,41 @@ public function getContainer()
5050

5151
function logIn($param) {
5252

53-
$ds=@ldap_connect(LDAP_HOST,LDAP_PORT);
53+
$ds=ldap_connect(LDAP_HOST,LDAP_PORT);
5454

5555
$_SESSION['loggedin'] = "-1";
5656

5757
// Set LDAP Version, Default is Version 2
58-
@ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, ( LDAP_VERSION) ? LDAP_VERSION : 2);
58+
ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, ( LDAP_VERSION) ? LDAP_VERSION : 2);
5959
// Referrals are disabled
60-
@ldap_set_option($ds, LDAP_OPT_REFERRALS, 0 );
60+
ldap_set_option($ds, LDAP_OPT_REFERRALS, 0 );
6161

6262
// Enable TLS Encryption
6363
if(LDAP_ENCRYPTION == "tls") {
6464

6565
// Documentation says - set to never
6666
putenv('LDAPTLS_REQCERT=never') or die('Failed to setup the env');
67-
@ldap_start_tls($ds);
67+
ldap_start_tls($ds);
6868
}
6969

7070
if (defined('LDAP_BIND_USER') && defined('LDAP_BIND_PASSWORD')) {
71-
if (!@ldap_bind( $ds, LDAP_BIND_USER, LDAP_BIND_PASSWORD)) {
71+
if (!ldap_bind( $ds, LDAP_BIND_USER, LDAP_BIND_PASSWORD)) {
7272
return array();
7373
}
7474
}
75-
$r=@ldap_search( $ds, LDAP_BASEDN, LDAP_USERNAME_ATTRIBUTE_OPEN.@ldap_escape($param['username']).LDAP_USERNAME_ATTRIBUTE_CLOSE);
75+
76+
$r=ldap_search( $ds, LDAP_BASEDN, LDAP_USERNAME_ATTRIBUTE."=".$param['username']);
7677
if ($r) {
77-
$result = @ldap_get_entries( $ds, $r);
78+
$result = ldap_get_entries( $ds, $r);
7879

7980
if ($result[0]) {
80-
if (@ldap_bind( $ds, $result[0]['dn'], $param['password']) ) {
81-
if($result[0] != NULL) {
82-
83-
84-
if (defined("LDAP_GROUPDN")) {
85-
if (!$this->check_filegroup_membership($ds, (defined("LDAP_GROUP_ARRAY") && LDAP_GROUP_ARRAY) ? $result[0][LDAP_GROUP_USER][0] : $result[0][LDAP_GROUP_USER])) {
81+
if (ldap_bind( $ds, $result[0]['dn'], $param['password']) ) {
82+
if($result[0] != NULL) {
83+
if (!$this->check_filegroup_membership($ds, $result[0][LDAP_USERNAME_ATTRIBUTE])) {
8684
return false;
8785
}
88-
}
89-
9086
if(array_key_exists(LDAP_UID, $result[0])) $user['uid'] = $result[0][LDAP_UID][0];
9187
else $user['uid'] = base_convert($param['username'], 16, 10);
92-
9388
if(array_key_exists(LDAP_GID, $result[0])) $user['gid'] = $result[0][LDAP_GID][0];
9489
else $user['gid'] = 10;
9590

@@ -101,43 +96,48 @@ function logIn($param) {
10196

10297
if(array_key_exists(LDAP_EMAIL, $result[0])) $user['email'] = $result[0][LDAP_EMAIL][0];
10398
else $user['email'] = "[email protected]";
104-
99+
105100
$user['username'] = $param['username'];
106101
$user['grp'] = "users";
107102
$user['lastvisit'] = date('c');
108103
$_SESSION['uid'] = $user['uid'];
109104
$_SESSION['loggedin'] = $user['username'];
110-
$_SESSION['userlevel'] = LDAP_USERLEVEL;
105+
$_SESSION['userlevel'] = "users";
111106
$_SESSION['username'] = $user['username'];
112107
$_SESSION['gid'] = $user['gid'];
113-
$_SESSION['grp'] = "users";
108+
$_SESSION['grp'] = "users";
114109
$_SESSION['data'] = $user;
115110

116-
// Assign Admin Privs, should be read from the LDAP Directory in the future
117-
$ADMIN_USER = explode(",", LDAP_ADMIN_USER);
111+
// Assigne Admin Privs, should be read from the LDAP Directory in the future
112+
$ADMIN_USER = LDAP_ADMIN_USERS;
118113
foreach($ADMIN_USER as &$value) {
119-
120-
if ($value == $param['username']) {
121-
$_SESSION['userlevel'] = 1; # LDAP_ADMINLEVEL;
122-
$user['grp'] = "users,admins";
123-
$_SESSION["grp"] = "users,admins";
124-
}
125-
}
126-
return $user;
114+
if ($value == $param['username']) {
115+
$_SESSION['userlevel'] = LDAP_ADMINLEVEL;
116+
$user['grp'] = "users,admins";
117+
$_SESSION['grp'] = "users,admins";
118+
}
119+
}
120+
return $_SESSION;
121+
return $user;
127122
}
128123
}
129124
}
130-
}
125+
}
131126
return array();
132127
}
133128

134129
/* posixGroup schema, rfc2307 */
135130
function check_filegroup_membership($ds, $uid) {
136-
$dn = LDAP_GROUPDN;
137-
$attr = LDAP_GROUP_ATTRIBUTE;
138-
$result = @ldap_compare($ds, $dn, $attr, $uid);
139-
if ($result === true) return true;
140-
else return false;
131+
foreach (LDAP_GROUPS as $ldap_group){
132+
$dn = "cn=".$ldap_group.",".LDAP_GROUP_BASE;
133+
$attr = LDAP_GROUP_ATTRIBUTE;
134+
foreach ($uid as $ldap_user){
135+
$result = ldap_compare($ds, $dn, $attr, $ldap_user);
136+
}
137+
if ($result === true) return true;
138+
else return false;
139+
140+
}
141141
}
142142

143143
//logout function
@@ -171,6 +171,7 @@ function getUser() {
171171
return $_SESSION['data'];
172172
}
173173

174+
174175
//create random password with 8 alphanumerical characters
175176

176177
function createPassword() {

‎api/preferences_example.php

+7-9
Original file line numberDiff line numberDiff line change
@@ -87,24 +87,22 @@
8787
/* LDAP SETTINGS */
8888

8989
/*
90-
define('LDAP_HOST',"localhost");
90+
define('LDAP_HOST',"localhost"); # Example value "ldap://ldap.example.com" or SSL "ldaps://ldap.example.com"
9191
define('LDAP_PORT',389);
9292
define('LDAP_VERSION',3);
93-
define('LDAP_ENCRYPTION',"none");
93+
define('LDAP_ENCRYPTION',"none"); #If you use starttls, set "tls"
9494
define('LDAP_BIND_USER',"cn=HOMER,ou=Apps,dc=example,dc=com");
9595
define('LDAP_BIND_PASSWORD',"secret");
9696
define('LDAP_BASEDN',"dc=example,dc=com");
97-
define('LDAP_USERNAME_ATTRIBUTE_OPEN',"uid=");
98-
define('LDAP_USERNAME_ATTRIBUTE_CLOSE',"");
97+
define('LDAP_USERNAME_ATTRIBUTE',"uid");
9998
define('LDAP_USERLEVEL',3);
100-
define('LDAP_UID',"uidnumber");
101-
define('LDAP_USERNAME',"uid");
102-
define('LDAP_GID',"gidnumber");
99+
define('LDAP_UID',"uid");
100+
define('LDAP_GID',"gid");
103101
define('LDAP_FIRSTNAME',"givenname");
104102
define('LDAP_LASTNAME',"sn");
105103
define('LDAP_EMAIL',"mail");
106-
define('LDAP_GROUPDN',true);
107-
define('LDAP_GROUP_USER','uid');
104+
define('LDAP_GROUP_BASE',"ou=Groups,dc=example,dc=gr"); # Where ldap should search for ldap groups
105+
define('LDAP_GROUPS',array("developers", "sysadmins", "voice-engineers")); # Which LDAP groups have login access
108106
define('LDAP_GROUP_ARRAY',false);
109107
define('LDAP_GROUP_ATTRIBUTE','memberUid');
110108
*/

0 commit comments

Comments
 (0)