Ldap.php

Go to the documentation of this file.

<?php
/*
 You may not change or alter any portion of this comment or credits
 of supporting developers from this source code or any supporting source code
 which is considered copyrighted (c) material of the original comment or credit authors.

 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
*/

namespace Xoops\Auth;

use Xoops\Core\Database\Connection;

class Ldap extends AuthAbstract
{

    public $ldap_server;

    public $ldap_port = '389';
    public $ldap_version = '3';

    public $ldap_base_dn;

    public $ldap_loginname_asdn;

    public $ldap_loginldap_attr;

    public $ldap_mail_attr;

    public $ldap_name_attr;

    public $ldap_surname_attr;

    public $ldap_givenname_attr;

    public $ldap_manager_dn;

    public $ldap_manager_pass;

    public $ds;

    public $ldap_use_TLS;

    public $ldap_domain_name;

    public $ldap_filter_person;

    public function __construct(Connection $dao = null)
    {
        if (!extension_loaded('ldap')) {
            trigger_error(sprintf(\XoopsLocale::F_EXTENSION_PHP_NOT_LOADED, 'LDAP'), E_USER_ERROR);
            return;
        }

        $xoops = \Xoops::getInstance();
        $this->dao = $dao;
        //Configuration options that are stored in the database
        $configs = $xoops->getConfigs();
        foreach ($configs as $key => $val) {
            $this->$key = $val;
        }
    }

    public function authenticate($uname, $pwd = null)
    {
        $authenticated = false;
        $this->ds = ldap_connect($this->ldap_server, $this->ldap_port);
        if ($this->ds) {
            ldap_set_option($this->ds, LDAP_OPT_PROTOCOL_VERSION, $this->ldap_version);
            if ($this->ldap_use_TLS) { // We use TLS secure connection
                if (!ldap_start_tls($this->ds)) {
                    $this->setErrors(0, \XoopsLocale::E_TLS_CONNECTION_NOT_OPENED);
                }
            }
            // If the uid is not in the DN we proceed to a search
            // The uid is not always in the dn
            $userDN = $this->getUserDN($uname);
            if (!(is_string($userDN))) {
                return false;
            }
            // We bind as user to test the credentials
            $authenticated = ldap_bind($this->ds, $userDN, stripslashes($pwd));
            if ($authenticated) {
                // We load the Xoops User database
                return $this->loadXoopsUser($userDN, $uname, $pwd);
            } else {
                $this->setErrors(ldap_errno($this->ds), ldap_err2str(ldap_errno($this->ds)) . '(' . $userDN . ')');
            }
        } else {
            $this->setErrors(0, \XoopsLocale::E_CANNOT_CONNECT_TO_SERVER);
        }
        @ldap_close($this->ds);

        return $authenticated;
    }

    public function getUserDN($uname)
    {
        $userDN = false;
        if (!$this->ldap_loginname_asdn) {
            // Bind with the manager
            if (!ldap_bind($this->ds, $this->ldap_manager_dn, stripslashes($this->ldap_manager_pass))) {
                $this->setErrors(
                    ldap_errno($this->ds),
                    ldap_err2str(ldap_errno($this->ds)) . '(' . $this->ldap_manager_dn . ')'
                );

                return false;
            }
            $filter = $this->getFilter($uname);
            $sr = ldap_search($this->ds, $this->ldap_base_dn, $filter);
            $info = ldap_get_entries($this->ds, $sr);
            if ($info['count'] > 0) {
                $userDN = $info[0]['dn'];
            } else {
                $this->setErrors(0, sprintf(
                    \XoopsLocale::EF_USER_NOT_FOUND_IN_DIRECTORY_SERVER,
                    $uname,
                    $filter,
                    $this->ldap_base_dn
                ));
            }
        } else {
            $userDN = $this->ldap_loginldap_attr . '=' . $uname . ',' . $this->ldap_base_dn;
        }

        return $userDN;
    }

    public function getFilter($uname)
    {
        if ($this->ldap_filter_person != '') {
            $filter = str_replace('@@loginname@@', $uname, $this->ldap_filter_person);
        } else {
            $filter = $this->ldap_loginldap_attr . '=' . $uname;
        }

        return $filter;
    }

    public function loadXoopsUser($userdn, $uname, $pwd = null)
    {
        $xoopsUser = false;
        $provisHandler = Provisioning::getInstance($this);
        $sr = ldap_read($this->ds, $userdn, '(objectclass=*)');
        $entries = ldap_get_entries($this->ds, $sr);
        if ($entries['count'] > 0) {
            $xoopsUser = $provisHandler->sync($entries[0], $uname, $pwd);
        } else {
            $this->setErrors(0, sprintf('loadXoopsUser - ' . \XoopsLocale::EF_ENTRY_NOT_READ, $userdn));
        }

        return $xoopsUser;
    }
}