gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2024-11-26 15:32:13 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ldap search can be filtered

Browse Source
This commit is contained in:
Uwe Steinmann 2016-01-19 15:30:54 +01:00
parent e0ae06441e
commit c43c5e64eb
4 changed files with 24 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
conf/settings.xml.template
View File

@ -111,6 +111,7 @@
- URIs are supported, e.g.: ldaps://ldap.host.com
- port: port of the authentification server
- baseDN: top level of the LDAP directory tree
- filter: Additional filters which are to be checked
-->
<connector
enable = "false"
@ -120,6 +121,7 @@
baseDN = ""
bindDN=""
bindPw=""
filter=""
>
</connector>
<!-- ***** CONNECTOR Microsoft Active Directory *****

3
inc/inc.ClassSettings.php
View File

@ -217,6 +217,7 @@ class Settings { /* {{{ */
var $_ldapBindPw = "";
var $_ldapAccountDomainName = "";
var $_ldapType = 1; // 0 = ldap; 1 = AD
var $_ldapFilter = "";
var $_converters = array(); // list of commands used to convert files to text for Indexer
/**
@ -422,6 +423,7 @@ class Settings { /* {{{ */
$this->_ldapBindDN = strVal($connectorNode["bindDN"]);
$this->_ldapBindPw = strVal($connectorNode["bindPw"]);
$this->_ldapType = 0;
$this->_ldapFilter = strVal($connectorNode["filter"]);
}
else if ($params['enable'] && ($typeConn == "AD"))
{
@ -431,6 +433,7 @@ class Settings { /* {{{ */
$this->_ldapBindDN = strVal($connectorNode["bindDN"]);
$this->_ldapBindPw = strVal($connectorNode["bindPw"]);
$this->_ldapType = 1;
$this->_ldapFilter = strVal($connectorNode["filter"]);
$this->_ldapAccountDomainName = strVal($connectorNode["accountDomainName"]);
}
}

2
install/settings.xml.template_install
View File

@ -118,6 +118,7 @@
- URIs are supported, e.g.: ldaps://ldap.host.com
- port: port of the authentification server
- baseDN: top level of the LDAP directory tree
- filter: Additional filters which are to be checked
-->
<connector
enable = "false"
@ -127,6 +128,7 @@
baseDN = ""
bindDN=""
bindPw=""
filter=""
>
</connector>
<!-- ***** CONNECTOR Microsoft Active Directory *****

26
op/op.Login.php
View File

@ -99,7 +99,7 @@ if (!$user && isset($settings->_ldapHost) && strlen($settings->_ldapHost)>0) {
// and http://stackoverflow.com/questions/6222641/how-to-php-ldap-search-to-get-user-ou-if-i-dont-know-the-ou-for-base-dn
ldap_set_option($ds, LDAP_OPT_REFERRALS, 0);
}
}
}
// Ensure that the LDAP connection is set to use version 3 protocol.
// Required for most authentication methods, including SASL.
@ -116,15 +116,19 @@ if (!$user && isset($settings->_ldapHost) && strlen($settings->_ldapHost)>0) {
}
$dn = false;
/* If bind succeed, then get the dn of for the user */
if ($bind) {
$search = ldap_search($ds, $settings->_ldapBaseDN, $ldapSearchAttribut.$login);
if ($bind) {
if (isset($settings->_ldapFilter) && strlen($settings->_ldapFilter) > 0) {
$search = ldap_search($ds, $settings->_ldapBaseDN, "(&(".$ldapSearchAttribut.$login.")".$settings->_ldapFilter.")");
} else {
$search = ldap_search($ds, $settings->_ldapBaseDN, $ldapSearchAttribut.$login);
}
if (!is_bool($search)) {
$info = ldap_get_entries($ds, $search);
if (!is_bool($info) && $info["count"]>0) {
$dn = $info[0]['dn'];
}
}
}
}
/* If the previous bind failed, try it with the users creditionals
* by simply setting $dn to a default string
@ -142,8 +146,12 @@ if (!$user && isset($settings->_ldapHost) && strlen($settings->_ldapHost)>0) {
$user = $dms->getUserByLogin($login);
if (is_bool($user) && !$settings->_restricted) {
// Retrieve the user's LDAP information.
$search = ldap_search($ds, $settings->_ldapBaseDN, $ldapSearchAttribut . $login);
if (isset($settings->_ldapFilter) && strlen($settings->_ldapFilter) > 0) {
$search = ldap_search($ds, $settings->_ldapBaseDN, "(&(".$ldapSearchAttribut.$login.")".$settings->_ldapFilter.")");
} else {
$search = ldap_search($ds, $settings->_ldapBaseDN, $ldapSearchAttribut.$login);
}
if (!is_bool($search)) {
$info = ldap_get_entries($ds, $search);
if (!is_bool($info) && $info["count"]==1 && $info[0]["count"]>0) {
@ -198,14 +206,14 @@ if (is_bool($user)) {
_printMessage(getMLText("login_disabled_title"), getMLText("login_disabled_text"));
exit;
}
// control admin IP address if required
// TODO: extend control to LDAP autentication
if ($user->isAdmin() && ($_SERVER['REMOTE_ADDR'] != $settings->_adminIP ) && ( $settings->_adminIP != "") ){
_printMessage(getMLText("login_error_title"), getMLText("invalid_user_id"));
exit;
}
/* Clear login failures if login was successful */
$user->clearLoginFailures();
@ -282,7 +290,7 @@ if (isset($_COOKIE["mydms_session"])) {
setcookie("mydms_session", $id, $lifetime, $settings->_httpRoot, null, null, !$settings->_enableLargeFileUpload);
}
// TODO: by the PHP manual: The superglobals $_GET and $_REQUEST are already decoded.
// TODO: by the PHP manual: The superglobals $_GET and $_REQUEST are already decoded.
// Using urldecode() on an element in $_GET or $_REQUEST could have unexpected and dangerous results.
if (isset($_POST["referuri"]) && strlen($_POST["referuri"])>0) {