X-Git-Url: http://wagnertech.de/git?a=blobdiff_plain;ds=sidebyside;f=WEB-INF%2Flib%2Fauth%2FAuth_ldap.class.php;h=23ea127e6b692aa416b0843c2a7b9ed6dd051de9;hb=1567369ac1fb744b704cacbe77542f55e410d61b;hp=625c47828df7a0b1c13f3151d6fa06d79c3af787;hpb=466c7825f8313f5e3a11c63383537c8bb302a932;p=timetracker.git
diff --git a/WEB-INF/lib/auth/Auth_ldap.class.php b/WEB-INF/lib/auth/Auth_ldap.class.php
index 625c4782..23ea127e 100644
--- a/WEB-INF/lib/auth/Auth_ldap.class.php
+++ b/WEB-INF/lib/auth/Auth_ldap.class.php
@@ -53,10 +53,9 @@ class Auth_ldap extends Auth {
function __construct($params)
{
+ global $smarty;
$this->params = $params;
- if (isset($GLOBALS['smarty'])) {
- $GLOBALS['smarty']->assign('Auth_ldap_params', $this->params);
- }
+ $smarty->assign('Auth_ldap_params', $this->params);
}
function ldap_escape($str){
@@ -65,7 +64,7 @@ class Auth_ldap extends Auth {
foreach ($illegal as $id => $char) {
$legal[$id] = "\\".$char;
}
- $str = str_replace($illegal, $legal,$str); //replace them
+ $str = str_replace($illegal, $legal, $str); //replace them
return $str;
}
@@ -97,7 +96,7 @@ class Auth_ldap extends Auth {
$lc = ldap_connect($this->params['server']);
- if (defined('AUTH_DEBUG') && isTrue(AUTH_DEBUG)) {
+ if (isTrue(AUTH_DEBUG)) {
echo '
';
echo '$lc='; var_dump($lc); echo '
';
echo 'ldap_error()='; echo ldap_error($lc); echo '
';
@@ -107,27 +106,26 @@ class Auth_ldap extends Auth {
ldap_set_option($lc, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($lc, LDAP_OPT_REFERRALS, 0);
- if (defined('AUTH_DEBUG') && isTrue(AUTH_DEBUG)) {
+ if (isTrue(AUTH_DEBUG)) {
ldap_set_option($lc, LDAP_OPT_DEBUG_LEVEL, 7);
}
// We need to handle Windows AD and OpenLDAP differently.
- if ($this->params['type'] != 'openldap') {
+ if ($this->params['type'] == 'ad') {
- // check if the user specified full login
+ // Check if user specified full login.
if (strpos($login, '@') === false) {
- // append default domain
+ // Append default domain.
$login .= '@' . $this->params['default_domain'];
}
-
- if (defined('AUTH_DEBUG') && isTrue(AUTH_DEBUG)) {
+ if (isTrue(AUTH_DEBUG)) {
echo '$login='; var_dump($login); echo '
';
}
$lb = @ldap_bind($lc, $login, $password);
- if (defined('AUTH_DEBUG') && isTrue(AUTH_DEBUG)) {
+ if (isTrue(AUTH_DEBUG)) {
echo '$lb='; var_dump($lb); echo '
';
echo 'ldap_error()='; echo ldap_error($lc); echo '
';
}
@@ -138,18 +136,17 @@ class Auth_ldap extends Auth {
}
if ($member_of) {
- // get groups
+ // Get groups the user is a member of from AD LDAP server.
- $filter = 'samaccountname='.Auth_ldap::ldap_escape($login);
- $fields = array('samaccountname', 'mail', 'memberof', 'department', 'displayname', 'telephonenumber', 'primarygroupid');
+ $filter = 'userPrincipalName='.Auth_ldap::ldap_escape($login);
+ $fields = array('memberof');
$sr = @ldap_search($lc, $this->params['base_dn'], $filter, $fields);
- if (defined('AUTH_DEBUG') && isTrue(AUTH_DEBUG)) {
+ if (isTrue(AUTH_DEBUG)) {
echo '$sr='; var_dump($sr); echo '
';
echo 'ldap_error()='; echo ldap_error($lc); echo '
';
}
- // if search failed it's likely that account is disabled
if (!$sr) {
ldap_unbind($lc);
return false;
@@ -157,7 +154,7 @@ class Auth_ldap extends Auth {
$entries = @ldap_get_entries($lc, $sr);
- if (defined('AUTH_DEBUG') && isTrue(AUTH_DEBUG)) {
+ if (isTrue(AUTH_DEBUG)) {
echo '$entries='; var_dump($entries); echo '
';
echo 'ldap_error()='; echo ldap_error($lc); echo '
';
}
@@ -169,20 +166,19 @@ class Auth_ldap extends Auth {
$groups = array();
- // extract group names from
- // assuming the groups are in format: CN=,...
+ // Extract group names. Assume the groups are in format: CN=,...
for ($i = 0; $i < @$entries[0]['memberof']['count']; $i++) {
$grp = $entries[0]['memberof'][$i];
$grp_fields = explode(',', $grp);
$groups[] = substr($grp_fields[0], 3);
}
- if (defined('AUTH_DEBUG') && isTrue(AUTH_DEBUG)) {
+ if (isTrue(AUTH_DEBUG)) {
echo '$member_of'; var_dump($member_of); echo '
';
};
- // check for group membership
- foreach ($member_of as $check_grp) {
+ // Check for group membership.
+ foreach ($member_of as $check_grp) {
if (!in_array($check_grp, $groups)) {
ldap_unbind($lc);
return false;
@@ -191,14 +187,15 @@ class Auth_ldap extends Auth {
}
ldap_unbind($lc);
-
return array('login' => $login, 'data' => $entries, 'member_of' => $groups);
- } else {
+ }
+
+ if ($this->params['type'] == 'openldap') {
// Assuming OpenLDAP server.
$login_oldap = 'uid='.$login.','.$this->params['base_dn'];
- if (defined('AUTH_DEBUG') && isTrue(AUTH_DEBUG)) {
+ if (isTrue(AUTH_DEBUG)) {
echo '$login_oldap='; var_dump($login_oldap); echo '
';
}
@@ -210,7 +207,7 @@ class Auth_ldap extends Auth {
$lb = @ldap_bind($lc, $login_oldap, $password);
- if (defined('AUTH_DEBUG') && isTrue(AUTH_DEBUG)) {
+ if (isTrue(AUTH_DEBUG)) {
echo '$lb='; var_dump($lb); echo '
';
echo 'ldap_error()='; echo ldap_error($lc); echo '
';
}
@@ -221,13 +218,14 @@ class Auth_ldap extends Auth {
}
if ($member_of) {
+ // TODO: Fix this for OpenLDAP, as samaccountname has nothing to do with it.
// get groups
$filter = 'samaccountname='.Auth_ldap::ldap_escape($login_oldap);
$fields = array('samaccountname', 'mail', 'memberof', 'department', 'displayname', 'telephonenumber', 'primarygroupid');
$sr = @ldap_search($lc, $this->params['base_dn'], $filter, $fields);
- if (defined('AUTH_DEBUG') && isTrue(AUTH_DEBUG)) {
+ if (isTrue(AUTH_DEBUG)) {
echo '$sr='; var_dump($sr); echo '
';
echo 'ldap_error()='; echo ldap_error($lc); echo '
';
}
@@ -240,7 +238,7 @@ class Auth_ldap extends Auth {
$entries = @ldap_get_entries($lc, $sr);
- if (defined('AUTH_DEBUG') && isTrue(AUTH_DEBUG)) {
+ if (isTrue(AUTH_DEBUG)) {
echo '$entries='; var_dump($entries); echo '
';
echo 'ldap_error()='; echo ldap_error($lc); echo '
';
}
@@ -260,9 +258,9 @@ class Auth_ldap extends Auth {
$groups[] = substr($grp_fields[0], 3);
}
- if (defined('AUTH_DEBUG') && isTrue(AUTH_DEBUG)) {
+ if (isTrue(AUTH_DEBUG)) {
echo '$member_of'; var_dump($member_of); echo '
';
- };
+ }
// check for group membership
foreach ($member_of as $check_grp) {
@@ -277,6 +275,9 @@ class Auth_ldap extends Auth {
return array('login' => $login, 'data' => $entries, 'member_of' => $groups);
}
+
+ // Server type is neither 'ad' or 'openldap'.
+ return false;
}
function isPasswordExternal() {