From 70e4a085e6a861a12a7b927ba9dfa10d5961f958 Mon Sep 17 00:00:00 2001
From: Andreas Gohr <andi@splitbrain.org>
Date: Fri, 9 Nov 2012 15:36:35 +0100
Subject: [PATCH] fixes for authldap
* makes proper use of plugin config
* adds a few first defaults, but the whole config metadata is still
missing
* proper PHP5 use and comments
---
lib/plugins/authldap/auth.php | 389 ++++++++++++++------------
lib/plugins/authldap/conf/default.php | 7 +
2 files changed, 224 insertions(+), 172 deletions(-)
create mode 100644 lib/plugins/authldap/conf/default.php
diff --git a/lib/plugins/authldap/auth.php b/lib/plugins/authldap/auth.php
index 93683bc16..6e7bde1f0 100644
--- a/lib/plugins/authldap/auth.php
+++ b/lib/plugins/authldap/auth.php
@@ -11,31 +11,31 @@ if(!defined('DOKU_INC')) die();
* @author Jan Schumann <js@schumann-it.com>
*/
class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
- var $cnf = null;
- var $con = null;
- var $bound = 0; // 0: anonymous, 1: user, 2: superuser
+ /* @var resource $con holds the LDAP connection*/
+ protected $con = null;
+
+ /* @var int $bound What type of connection does already exist? */
+ protected $bound = 0; // 0: anonymous, 1: user, 2: superuser
+
+ /* @var array $users User data cache */
+ protected $users = null;
+
+ /* @var array $_pattern User filter pattern */
+ protected $_pattern = null;
/**
* Constructor
*/
- function __construct(){
+ public function __construct() {
parent::__construct();
- global $conf;
- $this->cnf = $conf['auth']['ldap'];
-
// ldap extension is needed
if(!function_exists('ldap_connect')) {
- if ($this->cnf['debug'])
- msg("LDAP err: PHP LDAP extension not found.",-1,__LINE__,__FILE__);
+ $this->_debug("LDAP err: PHP LDAP extension not found.", -1, __LINE__, __FILE__);
$this->success = false;
return;
}
- if(empty($this->cnf['groupkey'])) $this->cnf['groupkey'] = 'cn';
- if(empty($this->cnf['userscope'])) $this->cnf['userscope'] = 'sub';
- if(empty($this->cnf['groupscope'])) $this->cnf['groupscope'] = 'sub';
-
// auth_ldap currently just handles authentication, so no
// capabilities are set
}
@@ -48,40 +48,45 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
* to the LDAP server
*
* @author Andreas Gohr <andi@splitbrain.org>
+ * @param string $user
+ * @param string $pass
* @return bool
*/
- function checkPass($user,$pass){
+ public function checkPass($user, $pass) {
// reject empty password
if(empty($pass)) return false;
if(!$this->_openLDAP()) return false;
// indirect user bind
- if($this->cnf['binddn'] && $this->cnf['bindpw']){
+ if($this->getConf('binddn') && $this->getConf('bindpw')) {
// use superuser credentials
- if(!@ldap_bind($this->con,$this->cnf['binddn'],$this->cnf['bindpw'])){
- if($this->cnf['debug'])
- msg('LDAP bind as superuser: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
+ if(!@ldap_bind($this->con, $this->getConf('binddn'), $this->getConf('bindpw'))) {
+ $this->_debug('LDAP bind as superuser: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
return false;
}
$this->bound = 2;
- }else if($this->cnf['binddn'] &&
- $this->cnf['usertree'] &&
- $this->cnf['userfilter']) {
+ } else if($this->getConf('binddn') &&
+ $this->getConf('usertree') &&
+ $this->getConf('userfilter')
+ ) {
// special bind string
- $dn = $this->_makeFilter($this->cnf['binddn'],
- array('user'=>$user,'server'=>$this->cnf['server']));
+ $dn = $this->_makeFilter(
+ $this->getConf('binddn'),
+ array('user'=> $user, 'server'=> $this->getConf('server'))
+ );
- }else if(strpos($this->cnf['usertree'], '%{user}')) {
+ } else if(strpos($this->getConf('usertree'), '%{user}')) {
// direct user bind
- $dn = $this->_makeFilter($this->cnf['usertree'],
- array('user'=>$user,'server'=>$this->cnf['server']));
+ $dn = $this->_makeFilter(
+ $this->getConf('usertree'),
+ array('user'=> $user, 'server'=> $this->getConf('server'))
+ );
- }else{
+ } else {
// Anonymous bind
- if(!@ldap_bind($this->con)){
- msg("LDAP: can not bind anonymously",-1);
- if($this->cnf['debug'])
- msg('LDAP anonymous bind: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
+ if(!@ldap_bind($this->con)) {
+ msg("LDAP: can not bind anonymously", -1);
+ $this->_debug('LDAP anonymous bind: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
return false;
}
}
@@ -89,18 +94,16 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
// Try to bind to with the dn if we have one.
if(!empty($dn)) {
// User/Password bind
- if(!@ldap_bind($this->con,$dn,$pass)){
- if($this->cnf['debug']){
- msg("LDAP: bind with $dn failed", -1,__LINE__,__FILE__);
- msg('LDAP user dn bind: '.htmlspecialchars(ldap_error($this->con)),0);
- }
+ if(!@ldap_bind($this->con, $dn, $pass)) {
+ $this->_debug("LDAP: bind with $dn failed", -1, __LINE__, __FILE__);
+ $this->_debug('LDAP user dn bind: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
return false;
}
$this->bound = 1;
return true;
- }else{
+ } else {
// See if we can find the user
- $info = $this->getUserData($user,true);
+ $info = $this->getUserData($user, true);
if(empty($info['dn'])) {
return false;
} else {
@@ -108,18 +111,14 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
}
// Try to bind with the dn provided
- if(!@ldap_bind($this->con,$dn,$pass)){
- if($this->cnf['debug']){
- msg("LDAP: bind with $dn failed", -1,__LINE__,__FILE__);
- msg('LDAP user bind: '.htmlspecialchars(ldap_error($this->con)),0);
- }
+ if(!@ldap_bind($this->con, $dn, $pass)) {
+ $this->_debug("LDAP: bind with $dn failed", -1, __LINE__, __FILE__);
+ $this->_debug('LDAP user bind: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
return false;
}
$this->bound = 1;
return true;
}
-
- return false;
}
/**
@@ -144,52 +143,52 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
* @author Dan Allen <dan.j.allen@gmail.com>
* @author <evaldas.auryla@pheur.org>
* @author Stephane Chazelas <stephane.chazelas@emerson.com>
+ *
+ * @param string $user
+ * @param bool $inbind authldap specific, true if in bind phase
* @return array containing user data or false
*/
- function getUserData($user,$inbind=false) {
+ public function getUserData($user, $inbind = false) {
global $conf;
if(!$this->_openLDAP()) return false;
// force superuser bind if wanted and not bound as superuser yet
- if($this->cnf['binddn'] && $this->cnf['bindpw'] && $this->bound < 2){
+ if($this->getConf('binddn') && $this->getConf('bindpw') && $this->bound < 2) {
// use superuser credentials
- if(!@ldap_bind($this->con,$this->cnf['binddn'],$this->cnf['bindpw'])){
- if($this->cnf['debug'])
- msg('LDAP bind as superuser: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
+ if(!@ldap_bind($this->con, $this->getConf('binddn'), $this->getConf('bindpw'))) {
+ $this->_debug('LDAP bind as superuser: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
return false;
}
$this->bound = 2;
- }elseif($this->bound == 0 && !$inbind) {
+ } elseif($this->bound == 0 && !$inbind) {
// in some cases getUserData is called outside the authentication workflow
// eg. for sending email notification on subscribed pages. This data might not
// be accessible anonymously, so we try to rebind the current user here
- list($loginuser,$loginsticky,$loginpass) = auth_getCookie();
- if($loginuser && $loginpass){
+ list($loginuser, $loginsticky, $loginpass) = auth_getCookie();
+ if($loginuser && $loginpass) {
$loginpass = PMA_blowfish_decrypt($loginpass, auth_cookiesalt(!$loginsticky));
$this->checkPass($loginuser, $loginpass);
}
}
$info['user'] = $user;
- $info['server'] = $this->cnf['server'];
+ $info['server'] = $this->getConf('server');
//get info for given user
- $base = $this->_makeFilter($this->cnf['usertree'], $info);
- if(!empty($this->cnf['userfilter'])) {
- $filter = $this->_makeFilter($this->cnf['userfilter'], $info);
+ $base = $this->_makeFilter($this->getConf('usertree'), $info);
+ if($this->getConf('userfilter')) {
+ $filter = $this->_makeFilter($this->getConf('userfilter'), $info);
} else {
$filter = "(ObjectClass=*)";
}
- $sr = $this->_ldapsearch($this->con, $base, $filter, $this->cnf['userscope']);
+ $sr = $this->_ldapsearch($this->con, $base, $filter, $this->getConf('userscope'));
$result = @ldap_get_entries($this->con, $sr);
- if($this->cnf['debug']){
- msg('LDAP user search: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
- msg('LDAP search at: '.htmlspecialchars($base.' '.$filter),0,__LINE__,__FILE__);
- }
+ $this->_debug('LDAP user search: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
+ $this->_debug('LDAP search at: '.htmlspecialchars($base.' '.$filter), 0, __LINE__, __FILE__);
// Don't accept more or less than one response
- if(!is_array($result) || $result['count'] != 1){
+ if(!is_array($result) || $result['count'] != 1) {
return false; //user not found
}
@@ -204,13 +203,13 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
$info['grps'] = array();
// overwrite if other attribs are specified.
- if(is_array($this->cnf['mapping'])){
- foreach($this->cnf['mapping'] as $localkey => $key) {
+ if(is_array($this->getConf('mapping'))) {
+ foreach($this->getConf('mapping') as $localkey => $key) {
if(is_array($key)) {
// use regexp to clean up user_result
list($key, $regexp) = each($key);
- if($user_result[$key]) foreach($user_result[$key] as $grp){
- if (preg_match($regexp,$grp,$match)) {
+ if($user_result[$key]) foreach($user_result[$key] as $grp) {
+ if(preg_match($regexp, $grp, $match)) {
if($localkey == 'grps') {
$info[$localkey][] = $match[1];
} else {
@@ -223,35 +222,33 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
}
}
}
- $user_result = array_merge($info,$user_result);
+ $user_result = array_merge($info, $user_result);
//get groups for given user if grouptree is given
- if ($this->cnf['grouptree'] || $this->cnf['groupfilter']) {
- $base = $this->_makeFilter($this->cnf['grouptree'], $user_result);
- $filter = $this->_makeFilter($this->cnf['groupfilter'], $user_result);
- $sr = $this->_ldapsearch($this->con, $base, $filter, $this->cnf['groupscope'], array($this->cnf['groupkey']));
- if($this->cnf['debug']){
- msg('LDAP group search: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
- msg('LDAP search at: '.htmlspecialchars($base.' '.$filter),0,__LINE__,__FILE__);
- }
- if(!$sr){
- msg("LDAP: Reading group memberships failed",-1);
+ if($this->getConf('grouptree') || $this->getConf('groupfilter')) {
+ $base = $this->_makeFilter($this->getConf('grouptree'), $user_result);
+ $filter = $this->_makeFilter($this->getConf('groupfilter'), $user_result);
+ $sr = $this->_ldapsearch($this->con, $base, $filter, $this->getConf('groupscope'), array($this->getConf('groupkey')));
+ $this->_debug('LDAP group search: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
+ $this->_debug('LDAP search at: '.htmlspecialchars($base.' '.$filter), 0, __LINE__, __FILE__);
+
+ if(!$sr) {
+ msg("LDAP: Reading group memberships failed", -1);
return false;
}
$result = ldap_get_entries($this->con, $sr);
ldap_free_result($sr);
- if(is_array($result)) foreach($result as $grp){
- if(!empty($grp[$this->cnf['groupkey']][0])){
- if($this->cnf['debug'])
- msg('LDAP usergroup: '.htmlspecialchars($grp[$this->cnf['groupkey']][0]),0,__LINE__,__FILE__);
- $info['grps'][] = $grp[$this->cnf['groupkey']][0];
+ if(is_array($result)) foreach($result as $grp) {
+ if(!empty($grp[$this->getConf('groupkey')][0])) {
+ $this->_debug('LDAP usergroup: '.htmlspecialchars($grp[$this->getConf('groupkey')][0]), 0, __LINE__, __FILE__);
+ $info['grps'][] = $grp[$this->getConf('groupkey')][0];
}
}
}
// always add the default group to the list of groups
- if(!in_array($conf['defaultgroup'],$info['grps'])){
+ if(!in_array($conf['defaultgroup'], $info['grps'])) {
$info['grps'][] = $conf['defaultgroup'];
}
return $info;
@@ -259,8 +256,10 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
/**
* Most values in LDAP are case-insensitive
+ *
+ * @return bool
*/
- function isCaseSensitive(){
+ public function isCaseSensitive() {
return false;
}
@@ -268,47 +267,47 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
* Bulk retrieval of user data
*
* @author Dominik Eckelmann <dokuwiki@cosmocode.de>
- * @param start index of first user to be returned
- * @param limit max number of users to be returned
- * @param filter array of field/pattern pairs, null for no filter
+ * @param int $start index of first user to be returned
+ * @param int $limit max number of users to be returned
+ * @param array $filter array of field/pattern pairs, null for no filter
* @return array of userinfo (refer getUserData for internal userinfo details)
*/
- function retrieveUsers($start=0,$limit=-1,$filter=array()) {
+ function retrieveUsers($start = 0, $limit = -1, $filter = array()) {
if(!$this->_openLDAP()) return false;
- if (!isset($this->users)) {
+ if(is_null($this->users)) {
// Perform the search and grab all their details
- if(!empty($this->cnf['userfilter'])) {
- $all_filter = str_replace('%{user}', '*', $this->cnf['userfilter']);
+ if($this->getConf('userfilter')) {
+ $all_filter = str_replace('%{user}', '*', $this->getConf('userfilter'));
} else {
$all_filter = "(ObjectClass=*)";
}
- $sr=ldap_search($this->con,$this->cnf['usertree'],$all_filter);
- $entries = ldap_get_entries($this->con, $sr);
+ $sr = ldap_search($this->con, $this->getConf('usertree'), $all_filter);
+ $entries = ldap_get_entries($this->con, $sr);
$users_array = array();
- for ($i=0; $i<$entries["count"]; $i++){
+ for($i = 0; $i < $entries["count"]; $i++) {
array_push($users_array, $entries[$i]["uid"][0]);
}
asort($users_array);
$result = $users_array;
- if (!$result) return array();
+ if(!$result) return array();
$this->users = array_fill_keys($result, false);
}
- $i = 0;
+ $i = 0;
$count = 0;
$this->_constructPattern($filter);
$result = array();
- foreach ($this->users as $user => &$info) {
- if ($i++ < $start) {
+ foreach($this->users as $user => &$info) {
+ if($i++ < $start) {
continue;
}
- if ($info === false) {
+ if($info === false) {
$info = $this->getUserData($user);
}
- if ($this->_filter($user, $info)) {
+ if($this->_filter($user, $info)) {
$result[$user] = $info;
- if (($limit >= 0) && (++$count >= $limit)) break;
+ if(($limit >= 0) && (++$count >= $limit)) break;
}
}
return $result;
@@ -320,50 +319,61 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
* Used by auth_getUserData to make the filter
* strings for grouptree and groupfilter
*
- * filter string ldap search filter with placeholders
- * placeholders array array with the placeholders
- *
* @author Troels Liebe Bentsen <tlb@rapanden.dk>
+ * @param string $filter ldap search filter with placeholders
+ * @param array $placeholders placeholders to fill in
* @return string
*/
- function _makeFilter($filter, $placeholders) {
+ protected function _makeFilter($filter, $placeholders) {
preg_match_all("/%{([^}]+)/", $filter, $matches, PREG_PATTERN_ORDER);
//replace each match
- foreach ($matches[1] as $match) {
+ foreach($matches[1] as $match) {
//take first element if array
if(is_array($placeholders[$match])) {
$value = $placeholders[$match][0];
} else {
$value = $placeholders[$match];
}
- $value = $this->_filterEscape($value);
+ $value = $this->_filterEscape($value);
$filter = str_replace('%{'.$match.'}', $value, $filter);
}
return $filter;
}
/**
- * return 1 if $user + $info match $filter criteria, 0 otherwise
+ * return true if $user + $info match $filter criteria, false otherwise
+ *
+ * @author Chris Smith <chris@jalakai.co.uk>
*
- * @author Chris Smith <chris@jalakai.co.uk>
+ * @param string $user the user's login name
+ * @param array $info the user's userinfo array
+ * @return bool
*/
- function _filter($user, $info) {
- foreach ($this->_pattern as $item => $pattern) {
- if ($item == 'user') {
- if (!preg_match($pattern, $user)) return 0;
- } else if ($item == 'grps') {
- if (!count(preg_grep($pattern, $info['grps']))) return 0;
+ protected function _filter($user, $info) {
+ foreach($this->_pattern as $item => $pattern) {
+ if($item == 'user') {
+ if(!preg_match($pattern, $user)) return false;
+ } else if($item == 'grps') {
+ if(!count(preg_grep($pattern, $info['grps']))) return false;
} else {
- if (!preg_match($pattern, $info[$item])) return 0;
+ if(!preg_match($pattern, $info[$item])) return false;
}
}
- return 1;
+ return true;
}
- function _constructPattern($filter) {
+ /**
+ * Set the filter pattern
+ *
+ * @author Chris Smith <chris@jalakai.co.uk>
+ *
+ * @param $filter
+ * @return void
+ */
+ protected function _constructPattern($filter) {
$this->_pattern = array();
- foreach ($filter as $item => $pattern) {
- $this->_pattern[$item] = '/'.str_replace('/','\/',$pattern).'/i'; // allow regex characters
+ foreach($filter as $item => $pattern) {
+ $this->_pattern[$item] = '/'.str_replace('/', '\/', $pattern).'/i'; // allow regex characters
}
}
@@ -373,11 +383,15 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
* Ported from Perl's Net::LDAP::Util escape_filter_value
*
* @author Andreas Gohr
+ * @param string $string
+ * @return string
*/
- function _filterEscape($string){
- return preg_replace('/([\x00-\x1F\*\(\)\\\\])/e',
- '"\\\\\".join("",unpack("H2","$1"))',
- $string);
+ protected function _filterEscape($string) {
+ return preg_replace(
+ '/([\x00-\x1F\*\(\)\\\\])/e',
+ '"\\\\\".join("",unpack("H2","$1"))',
+ $string
+ );
}
/**
@@ -386,18 +400,18 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
*
* @author Andreas Gohr <andi@splitbrain.org>
*/
- function _openLDAP(){
+ protected function _openLDAP() {
if($this->con) return true; // connection already established
$this->bound = 0;
- $port = ($this->cnf['port']) ? $this->cnf['port'] : 389;
- $bound = false;
- $servers = explode(',', $this->cnf['server']);
- foreach ($servers as $server) {
- $server = trim($server);
+ $port = $this->getConf('port');
+ $bound = false;
+ $servers = explode(',', $this->getConf('server'));
+ foreach($servers as $server) {
+ $server = trim($server);
$this->con = @ldap_connect($server, $port);
- if (!$this->con) {
+ if(!$this->con) {
continue;
}
@@ -410,80 +424,111 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
*/
//set protocol version and dependend options
- if($this->cnf['version']){
- if(!@ldap_set_option($this->con, LDAP_OPT_PROTOCOL_VERSION,
- $this->cnf['version'])){
- msg('Setting LDAP Protocol version '.$this->cnf['version'].' failed',-1);
- if($this->cnf['debug'])
- msg('LDAP version set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
- }else{
+ if($this->getConf('version')) {
+ if(!@ldap_set_option(
+ $this->con, LDAP_OPT_PROTOCOL_VERSION,
+ $this->getConf('version')
+ )
+ ) {
+ msg('Setting LDAP Protocol version '.$this->getConf('version').' failed', -1);
+ $this->_debug('LDAP version set: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
+ } else {
//use TLS (needs version 3)
- if($this->cnf['starttls']) {
- if (!@ldap_start_tls($this->con)){
- msg('Starting TLS failed',-1);
- if($this->cnf['debug'])
- msg('LDAP TLS set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
+ if($this->getConf('starttls')) {
+ if(!@ldap_start_tls($this->con)) {
+ msg('Starting TLS failed', -1);
+ $this->_debug('LDAP TLS set: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
}
}
// needs version 3
- if(isset($this->cnf['referrals'])) {
- if(!@ldap_set_option($this->con, LDAP_OPT_REFERRALS,
- $this->cnf['referrals'])){
- msg('Setting LDAP referrals to off failed',-1);
- if($this->cnf['debug'])
- msg('LDAP referal set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
+ if($this->getConf('referrals')) {
+ if(!@ldap_set_option(
+ $this->con, LDAP_OPT_REFERRALS,
+ $this->getConf('referrals')
+ )
+ ) {
+ msg('Setting LDAP referrals to off failed', -1);
+ $this->_debug('LDAP referal set: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
}
}
}
}
//set deref mode
- if($this->cnf['deref']){
- if(!@ldap_set_option($this->con, LDAP_OPT_DEREF, $this->cnf['deref'])){
- msg('Setting LDAP Deref mode '.$this->cnf['deref'].' failed',-1);
- if($this->cnf['debug'])
- msg('LDAP deref set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
+ if($this->getConf('deref')) {
+ if(!@ldap_set_option($this->con, LDAP_OPT_DEREF, $this->getConf('deref'))) {
+ msg('Setting LDAP Deref mode '.$this->getConf('deref').' failed', -1);
+ $this->_debug('LDAP deref set: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
}
}
/* As of PHP 5.3.0 we can set timeout to speedup skipping of invalid servers */
- if (defined('LDAP_OPT_NETWORK_TIMEOUT')) {
+ if(defined('LDAP_OPT_NETWORK_TIMEOUT')) {
ldap_set_option($this->con, LDAP_OPT_NETWORK_TIMEOUT, 1);
}
$bound = @ldap_bind($this->con);
- if ($bound) {
+ if($bound) {
break;
}
}
if(!$bound) {
- msg("LDAP: couldn't connect to LDAP server",-1);
+ msg("LDAP: couldn't connect to LDAP server", -1);
return false;
}
-
- $this->canDo['getUsers'] = true;
+ $this->cando['getUsers'] = true;
return true;
}
/**
* Wraps around ldap_search, ldap_list or ldap_read depending on $scope
*
- * @param $scope string - can be 'base', 'one' or 'sub'
* @author Andreas Gohr <andi@splitbrain.org>
+ * @param resource $link_identifier
+ * @param string $base_dn
+ * @param string $filter
+ * @param string $scope can be 'base', 'one' or 'sub'
+ * @param null $attributes
+ * @param int $attrsonly
+ * @param int $sizelimit
+ * @param int $timelimit
+ * @param int $deref
+ * @return resource
*/
- function _ldapsearch($link_identifier, $base_dn, $filter, $scope='sub', $attributes=null,
- $attrsonly=0, $sizelimit=0, $timelimit=0, $deref=LDAP_DEREF_NEVER){
+ protected function _ldapsearch($link_identifier, $base_dn, $filter, $scope = 'sub', $attributes = null,
+ $attrsonly = 0, $sizelimit = 0, $timelimit = 0, $deref = LDAP_DEREF_NEVER) {
if(is_null($attributes)) $attributes = array();
- if($scope == 'base'){
- return @ldap_read($link_identifier, $base_dn, $filter, $attributes,
- $attrsonly, $sizelimit, $timelimit, $deref);
- }elseif($scope == 'one'){
- return @ldap_list($link_identifier, $base_dn, $filter, $attributes,
- $attrsonly, $sizelimit, $timelimit, $deref);
- }else{
- return @ldap_search($link_identifier, $base_dn, $filter, $attributes,
- $attrsonly, $sizelimit, $timelimit, $deref);
+ if($scope == 'base') {
+ return @ldap_read(
+ $link_identifier, $base_dn, $filter, $attributes,
+ $attrsonly, $sizelimit, $timelimit, $deref
+ );
+ } elseif($scope == 'one') {
+ return @ldap_list(
+ $link_identifier, $base_dn, $filter, $attributes,
+ $attrsonly, $sizelimit, $timelimit, $deref
+ );
+ } else {
+ return @ldap_search(
+ $link_identifier, $base_dn, $filter, $attributes,
+ $attrsonly, $sizelimit, $timelimit, $deref
+ );
}
}
+
+ /**
+ * Wrapper around msg() but outputs only when debug is enabled
+ *
+ * @param string $message
+ * @param int $err
+ * @param int $line
+ * @param string $file
+ * @return void
+ */
+ protected function _debug($message, $err, $line, $file) {
+ if(!$this->getConf('debug')) return;
+ msg($message, $err, $line, $file);
+ }
+
}
diff --git a/lib/plugins/authldap/conf/default.php b/lib/plugins/authldap/conf/default.php
new file mode 100644
index 000000000..35971d41d
--- /dev/null
+++ b/lib/plugins/authldap/conf/default.php
@@ -0,0 +1,7 @@
+<?php
+
+$conf['port'] = 389;
+
+$conf['groupkey'] = 'cn';
+$conf['userscope'] = 'sub';
+$conf['groupscope'] = 'sub';
\ No newline at end of file
--
GitLab