[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3  *
   4  * LDAP auth plug-in for phpBB3
   5  *
   6  * Authentication plug-ins is largely down to Sergey Kanareykin, our thanks to him.
   7  *
   8  * @package login
   9  * @version $Id$
  10  * @copyright (c) 2005 phpBB Group
  11  * @license http://opensource.org/licenses/gpl-license.php GNU Public License
  12  *
  13  */
  14  
  15  /**
  16  * @ignore
  17  */
  18  if (!defined('IN_PHPBB'))
  19  {
  20      exit;
  21  }
  22  
  23  /**
  24  * Connect to ldap server
  25  * Only allow changing authentication to ldap if we can connect to the ldap server
  26  * Called in acp_board while setting authentication plugins
  27  */
  28  function init_ldap()
  29  {
  30      global $config, $user;
  31  
  32      if (!@extension_loaded('ldap'))
  33      {
  34          return $user->lang['LDAP_NO_LDAP_EXTENSION'];
  35      }
  36  
  37      $config['ldap_port'] = (int) $config['ldap_port'];
  38      if ($config['ldap_port'])
  39      {
  40          $ldap = @ldap_connect($config['ldap_server'], $config['ldap_port']);
  41      }
  42      else
  43      {
  44          $ldap = @ldap_connect($config['ldap_server']);
  45      }
  46  
  47      if (!$ldap)
  48      {
  49          return $user->lang['LDAP_NO_SERVER_CONNECTION'];
  50      }
  51  
  52      @ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
  53      @ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
  54  
  55      if ($config['ldap_user'] || $config['ldap_password'])
  56      {
  57          if (!@ldap_bind($ldap, htmlspecialchars_decode($config['ldap_user']), htmlspecialchars_decode($config['ldap_password'])))
  58          {
  59              return $user->lang['LDAP_INCORRECT_USER_PASSWORD'];
  60          }
  61      }
  62  
  63      // ldap_connect only checks whether the specified server is valid, so the connection might still fail
  64      $search = @ldap_search(
  65          $ldap,
  66          htmlspecialchars_decode($config['ldap_base_dn']),
  67          ldap_user_filter($user->data['username']),
  68          (empty($config['ldap_email'])) ?
  69              array(htmlspecialchars_decode($config['ldap_uid'])) :
  70              array(htmlspecialchars_decode($config['ldap_uid']), htmlspecialchars_decode($config['ldap_email'])),
  71          0,
  72          1
  73      );
  74  
  75      if ($search === false)
  76      {
  77          return $user->lang['LDAP_SEARCH_FAILED'];
  78      }
  79  
  80      $result = @ldap_get_entries($ldap, $search);
  81  
  82      @ldap_close($ldap);
  83  
  84  
  85      if (!is_array($result) || sizeof($result) < 2)
  86      {
  87          return sprintf($user->lang['LDAP_NO_IDENTITY'], $user->data['username']);
  88      }
  89  
  90      if (!empty($config['ldap_email']) && !isset($result[0][htmlspecialchars_decode($config['ldap_email'])]))
  91      {
  92          return $user->lang['LDAP_NO_EMAIL'];
  93      }
  94  
  95      return false;
  96  }
  97  
  98  /**
  99  * Login function
 100  */
 101  function login_ldap(&$username, &$password)
 102  {
 103      global $db, $config, $user;
 104  
 105      // do not allow empty password
 106      if (!$password)
 107      {
 108          return array(
 109              'status'    => LOGIN_ERROR_PASSWORD,
 110              'error_msg'    => 'NO_PASSWORD_SUPPLIED',
 111              'user_row'    => array('user_id' => ANONYMOUS),
 112          );
 113      }
 114  
 115      if (!$username)
 116      {
 117          return array(
 118              'status'    => LOGIN_ERROR_USERNAME,
 119              'error_msg'    => 'LOGIN_ERROR_USERNAME',
 120              'user_row'    => array('user_id' => ANONYMOUS),
 121          );
 122      }
 123  
 124      if (!@extension_loaded('ldap'))
 125      {
 126          return array(
 127              'status'        => LOGIN_ERROR_EXTERNAL_AUTH,
 128              'error_msg'        => 'LDAP_NO_LDAP_EXTENSION',
 129              'user_row'        => array('user_id' => ANONYMOUS),
 130          );
 131      }
 132  
 133      $config['ldap_port'] = (int) $config['ldap_port'];
 134      if ($config['ldap_port'])
 135      {
 136          $ldap = @ldap_connect($config['ldap_server'], $config['ldap_port']);
 137      }
 138      else
 139      {
 140          $ldap = @ldap_connect($config['ldap_server']);
 141      }
 142  
 143      if (!$ldap)
 144      {
 145          return array(
 146              'status'        => LOGIN_ERROR_EXTERNAL_AUTH,
 147              'error_msg'        => 'LDAP_NO_SERVER_CONNECTION',
 148              'user_row'        => array('user_id' => ANONYMOUS),
 149          );
 150      }
 151  
 152      @ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
 153      @ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
 154  
 155      if ($config['ldap_user'] || $config['ldap_password'])
 156      {
 157          if (!@ldap_bind($ldap, htmlspecialchars_decode($config['ldap_user']), htmlspecialchars_decode($config['ldap_password'])))
 158          {
 159              return array(
 160                  'status'        => LOGIN_ERROR_EXTERNAL_AUTH,
 161                  'error_msg'        => 'LDAP_NO_SERVER_CONNECTION',
 162                  'user_row'        => array('user_id' => ANONYMOUS),
 163              );
 164          }
 165      }
 166  
 167      $search = @ldap_search(
 168          $ldap,
 169          htmlspecialchars_decode($config['ldap_base_dn']),
 170          ldap_user_filter($username),
 171          (empty($config['ldap_email'])) ?
 172              array(htmlspecialchars_decode($config['ldap_uid'])) :
 173              array(htmlspecialchars_decode($config['ldap_uid']), htmlspecialchars_decode($config['ldap_email'])),
 174          0,
 175          1
 176      );
 177  
 178      $ldap_result = @ldap_get_entries($ldap, $search);
 179  
 180      if (is_array($ldap_result) && sizeof($ldap_result) > 1)
 181      {
 182          if (@ldap_bind($ldap, $ldap_result[0]['dn'], htmlspecialchars_decode($password)))
 183          {
 184              @ldap_close($ldap);
 185  
 186              $sql ='SELECT user_id, username, user_password, user_passchg, user_email, user_type
 187                  FROM ' . USERS_TABLE . "
 188                  WHERE username_clean = '" . $db->sql_escape(utf8_clean_string($username)) . "'";
 189              $result = $db->sql_query($sql);
 190              $row = $db->sql_fetchrow($result);
 191              $db->sql_freeresult($result);
 192  
 193              if ($row)
 194              {
 195                  unset($ldap_result);
 196  
 197                  // User inactive...
 198                  if ($row['user_type'] == USER_INACTIVE || $row['user_type'] == USER_IGNORE)
 199                  {
 200                      return array(
 201                          'status'        => LOGIN_ERROR_ACTIVE,
 202                          'error_msg'        => 'ACTIVE_ERROR',
 203                          'user_row'        => $row,
 204                      );
 205                  }
 206  
 207                  // Successful login... set user_login_attempts to zero...
 208                  return array(
 209                      'status'        => LOGIN_SUCCESS,
 210                      'error_msg'        => false,
 211                      'user_row'        => $row,
 212                  );
 213              }
 214              else
 215              {
 216                  // retrieve default group id
 217                  $sql = 'SELECT group_id
 218                      FROM ' . GROUPS_TABLE . "
 219                      WHERE group_name = '" . $db->sql_escape('REGISTERED') . "'
 220                          AND group_type = " . GROUP_SPECIAL;
 221                  $result = $db->sql_query($sql);
 222                  $row = $db->sql_fetchrow($result);
 223                  $db->sql_freeresult($result);
 224  
 225                  if (!$row)
 226                  {
 227                      trigger_error('NO_GROUP');
 228                  }
 229  
 230                  // generate user account data
 231                  $ldap_user_row = array(
 232                      'username'        => $username,
 233                      'user_password'    => phpbb_hash($password),
 234                      'user_email'    => (!empty($config['ldap_email'])) ? utf8_htmlspecialchars($ldap_result[0][htmlspecialchars_decode($config['ldap_email'])][0]) : '',
 235                      'group_id'        => (int) $row['group_id'],
 236                      'user_type'        => USER_NORMAL,
 237                      'user_ip'        => $user->ip,
 238                      'user_new'        => ($config['new_member_post_limit']) ? 1 : 0,
 239                  );
 240  
 241                  unset($ldap_result);
 242  
 243                  // this is the user's first login so create an empty profile
 244                  return array(
 245                      'status'        => LOGIN_SUCCESS_CREATE_PROFILE,
 246                      'error_msg'        => false,
 247                      'user_row'        => $ldap_user_row,
 248                  );
 249              }
 250          }
 251          else
 252          {
 253              unset($ldap_result);
 254              @ldap_close($ldap);
 255  
 256              // Give status about wrong password...
 257              return array(
 258                  'status'        => LOGIN_ERROR_PASSWORD,
 259                  'error_msg'        => 'LOGIN_ERROR_PASSWORD',
 260                  'user_row'        => array('user_id' => ANONYMOUS),
 261              );
 262          }
 263      }
 264  
 265      @ldap_close($ldap);
 266  
 267      return array(
 268          'status'    => LOGIN_ERROR_USERNAME,
 269          'error_msg'    => 'LOGIN_ERROR_USERNAME',
 270          'user_row'    => array('user_id' => ANONYMOUS),
 271      );
 272  }
 273  
 274  /**
 275  * Generates a filter string for ldap_search to find a user
 276  *
 277  * @param    $username    string    Username identifying the searched user
 278  *
 279  * @return                string    A filter string for ldap_search
 280  */
 281  function ldap_user_filter($username)
 282  {
 283      global $config;
 284  
 285      $filter = '(' . $config['ldap_uid'] . '=' . ldap_escape(htmlspecialchars_decode($username)) . ')';
 286      if ($config['ldap_user_filter'])
 287      {
 288          $_filter = ($config['ldap_user_filter'][0] == '(' && substr($config['ldap_user_filter'], -1) == ')') ? $config['ldap_user_filter'] : "({$config['ldap_user_filter']})";
 289          $filter = "(&{$filter}{$_filter})";
 290      }
 291      return $filter;
 292  }
 293  
 294  /**
 295  * Escapes an LDAP AttributeValue
 296  */
 297  function ldap_escape($string)
 298  {
 299      return str_replace(array('*', '\\', '(', ')'), array('\\*', '\\\\', '\\(', '\\)'), $string);
 300  }
 301  
 302  /**
 303  * This function is used to output any required fields in the authentication
 304  * admin panel. It also defines any required configuration table fields.
 305  */
 306  function acp_ldap(&$new)
 307  {
 308      global $user;
 309  
 310      $tpl = '
 311  
 312      <dl>
 313          <dt><label for="ldap_server">' . $user->lang['LDAP_SERVER'] . ':</label><br /><span>' . $user->lang['LDAP_SERVER_EXPLAIN'] . '</span></dt>
 314          <dd><input type="text" id="ldap_server" size="40" name="config[ldap_server]" value="' . $new['ldap_server'] . '" /></dd>
 315      </dl>
 316      <dl>
 317          <dt><label for="ldap_port">' . $user->lang['LDAP_PORT'] . ':</label><br /><span>' . $user->lang['LDAP_PORT_EXPLAIN'] . '</span></dt>
 318          <dd><input type="text" id="ldap_port" size="40" name="config[ldap_port]" value="' . $new['ldap_port'] . '" /></dd>
 319      </dl>
 320      <dl>
 321          <dt><label for="ldap_dn">' . $user->lang['LDAP_DN'] . ':</label><br /><span>' . $user->lang['LDAP_DN_EXPLAIN'] . '</span></dt>
 322          <dd><input type="text" id="ldap_dn" size="40" name="config[ldap_base_dn]" value="' . $new['ldap_base_dn'] . '" /></dd>
 323      </dl>
 324      <dl>
 325          <dt><label for="ldap_uid">' . $user->lang['LDAP_UID'] . ':</label><br /><span>' . $user->lang['LDAP_UID_EXPLAIN'] . '</span></dt>
 326          <dd><input type="text" id="ldap_uid" size="40" name="config[ldap_uid]" value="' . $new['ldap_uid'] . '" /></dd>
 327      </dl>
 328      <dl>
 329          <dt><label for="ldap_user_filter">' . $user->lang['LDAP_USER_FILTER'] . ':</label><br /><span>' . $user->lang['LDAP_USER_FILTER_EXPLAIN'] . '</span></dt>
 330          <dd><input type="text" id="ldap_user_filter" size="40" name="config[ldap_user_filter]" value="' . $new['ldap_user_filter'] . '" /></dd>
 331      </dl>
 332      <dl>
 333          <dt><label for="ldap_email">' . $user->lang['LDAP_EMAIL'] . ':</label><br /><span>' . $user->lang['LDAP_EMAIL_EXPLAIN'] . '</span></dt>
 334          <dd><input type="text" id="ldap_email" size="40" name="config[ldap_email]" value="' . $new['ldap_email'] . '" /></dd>
 335      </dl>
 336      <dl>
 337          <dt><label for="ldap_user">' . $user->lang['LDAP_USER'] . ':</label><br /><span>' . $user->lang['LDAP_USER_EXPLAIN'] . '</span></dt>
 338          <dd><input type="text" id="ldap_user" size="40" name="config[ldap_user]" value="' . $new['ldap_user'] . '" /></dd>
 339      </dl>
 340      <dl>
 341          <dt><label for="ldap_password">' . $user->lang['LDAP_PASSWORD'] . ':</label><br /><span>' . $user->lang['LDAP_PASSWORD_EXPLAIN'] . '</span></dt>
 342          <dd><input type="password" id="ldap_password" size="40" name="config[ldap_password]" value="' . $new['ldap_password'] . '" autocomplete="off" /></dd>
 343      </dl>
 344      ';
 345  
 346      // These are fields required in the config table
 347      return array(
 348          'tpl'        => $tpl,
 349          'config'    => array('ldap_server', 'ldap_port', 'ldap_base_dn', 'ldap_uid', 'ldap_user_filter', 'ldap_email', 'ldap_user', 'ldap_password')
 350      );
 351  }
 352  
 353  ?>