ldap.inc.php 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321
  1. <?php
  2. // External login module : LDAP
  3. /**
  4. * This files is included by newUser.ldap.php and login.ldap.php
  5. * It implements the functions nedded by both files
  6. * */
  7. //Includes the configuration file
  8. require_once dirname(__FILE__) . '/../../inc/global.inc.php';
  9. /**
  10. * Returns a transcoded and trimmed string
  11. *
  12. * @param string
  13. * @return string
  14. * @author ndiechburg <noel@cblue.be>
  15. * */
  16. function extldap_purify_string($string) {
  17. global $extldap_config;
  18. if (isset($extldap_config['encoding'])) {
  19. return trim(api_to_system_encoding($string, $extldap_config['encoding']));
  20. } else {
  21. return trim($string);
  22. }
  23. }
  24. /**
  25. * Establishes a connection to the LDAP server and sets the protocol version
  26. *
  27. * @return resource ldap link identifier or false
  28. * @author ndiechburg <noel@cblue.be>
  29. * */
  30. function extldap_connect() {
  31. global $extldap_config;
  32. if (!is_array($extldap_config['host']))
  33. $extldap_config['host'] = array($extldap_config['host']);
  34. foreach ($extldap_config['host'] as $host) {
  35. //Trying to connect
  36. if (isset($extldap_config['port'])) {
  37. $ds = ldap_connect($host, $extldap_config['port']);
  38. } else {
  39. $ds = ldap_connect($host);
  40. }
  41. if (!$ds) {
  42. $port = isset($extldap_config['port']) ? $ldap_config['port'] : 389;
  43. error_log('EXTLDAP ERROR : cannot connect to ' . $extldap_config['host'] . ':' . $port);
  44. } else
  45. break;
  46. }
  47. if (!$ds) {
  48. error_log('EXTLDAP ERROR : no valid server found');
  49. return false;
  50. }
  51. //Setting protocol version
  52. if (isset($extldap_config['protocol_version'])) {
  53. if (!ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, $extldap_config['protocol_version'])) {
  54. ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 2);
  55. }
  56. }
  57. //Setting protocol version
  58. if (isset($extldap_config['referrals'])) {
  59. if (!ldap_set_option($ds, LDAP_OPT_REFERRALS, $extldap_config['referrals'])) {
  60. ldap_set_option($ds, LDAP_OPT_REFERRALS, $extldap_config['referrals']);
  61. }
  62. }
  63. return $ds;
  64. }
  65. /**
  66. * Authenticate user on external ldap server and return user ldap entry if that succeeds
  67. *
  68. * @return mixed false if user cannot authenticate on ldap, user ldap entry if tha succeeds
  69. * @author ndiechburg <noel@cblue.be>
  70. * Modified by hubert.borderiou@grenet.fr
  71. * Add possibility to get user info from LDAP without check password (if CAS auth and LDAP profil update)
  72. *
  73. * */
  74. function extldap_authenticate($username, $password, $in_auth_with_no_password = false) {
  75. global $extldap_config;
  76. if (empty($username) or empty($password)) {
  77. return false;
  78. }
  79. $ds = extldap_connect();
  80. if (!$ds) {
  81. return false;
  82. }
  83. //Connection as admin to search dn of user
  84. $ldapbind = @ldap_bind($ds, $extldap_config['admin_dn'], $extldap_config['admin_password']);
  85. if ($ldapbind === false) {
  86. error_log('EXTLDAP ERROR : cannot connect with admin login/password');
  87. return false;
  88. }
  89. $user_search = extldap_get_user_search_string($username);
  90. //Search distinguish name of user
  91. $sr = ldap_search($ds, $extldap_config['base_dn'], $user_search);
  92. if (!$sr) {
  93. error_log('EXTLDAP ERROR : ldap_search(' . $ds . ', ' . $extldap_config['base_dn'] . ", $user_search) failed");
  94. return false;
  95. }
  96. $entries_count = ldap_count_entries($ds, $sr);
  97. if ($entries_count > 1) {
  98. error_log('EXTLDAP ERROR : more than one entry for that user ( ldap_search(ds, ' . $extldap_config['base_dn'] . ", $user_search) )");
  99. return false;
  100. }
  101. if ($entries_count < 1) {
  102. error_log('EXTLDAP ERROR : No entry for that user ( ldap_search(ds, ' . $extldap_config['base_dn'] . ", $user_search) )");
  103. return false;
  104. }
  105. $users = ldap_get_entries($ds, $sr);
  106. $user = $users[0];
  107. // If we just want to have user info from LDAP and not to check password
  108. if ($in_auth_with_no_password) {
  109. return $user;
  110. }
  111. //now we try to autenthicate the user in the ldap
  112. $ubind = @ldap_bind($ds, $user['dn'], $password);
  113. if ($ubind !== false) {
  114. return $user;
  115. } else {
  116. error_log('EXTLDAP : Wrong password for ' . $user['dn']);
  117. return false;
  118. }
  119. }
  120. /**
  121. * Return an array with userinfo compatible with chamilo using $extldap_user_correspondance
  122. * configuration array declared in ldap.conf.php file
  123. *
  124. * @param array ldap user
  125. * @param array correspondance array (if not set use extldap_user_correspondance declared in auth.conf.php
  126. * @return array userinfo array
  127. * @author ndiechburg <noel@cblue.be>
  128. * */
  129. function extldap_get_chamilo_user($ldap_user, $cor = null) {
  130. global $extldap_user_correspondance;
  131. if (is_null($cor)) {
  132. $cor = $extldap_user_correspondance;
  133. }
  134. $chamilo_user = array();
  135. foreach ($cor as $chamilo_field => $ldap_field) {
  136. if (is_array($ldap_field)) {
  137. $chamilo_user[$chamilo_field] = extldap_get_chamilo_user($ldap_user, $ldap_field);
  138. continue;
  139. }
  140. switch ($ldap_field) {
  141. case 'func':
  142. $func = "extldap_get_$chamilo_field";
  143. if (function_exists($func)) {
  144. $chamilo_user[$chamilo_field] = extldap_purify_string($func($ldap_user));
  145. } else {
  146. error_log("EXTLDAP WARNING : You forgot to declare $func");
  147. }
  148. break;
  149. default:
  150. //if string begins with "!", then this is a constant
  151. if ($ldap_field[0] === '!') {
  152. $chamilo_user[$chamilo_field] = trim($ldap_field, "!\t\n\r\0");
  153. break;
  154. }
  155. if (isset($ldap_user[$ldap_field][0])) {
  156. $chamilo_user[$chamilo_field] = extldap_purify_string($ldap_user[$ldap_field][0]);
  157. } else {
  158. error_log('EXTLDAP WARNING : ' . $ldap_field . '[0] field is not set in ldap array');
  159. }
  160. break;
  161. }
  162. }
  163. return $chamilo_user;
  164. }
  165. /**
  166. * Please declare here all the function you use in extldap_user_correspondance
  167. * All these functions must have an $ldap_user parameter. This parameter is the
  168. * array returned by the ldap for the user
  169. * */
  170. /**
  171. * example function for email
  172. * */
  173. /*
  174. function extldap_get_email($ldap_user){
  175. return $ldap_user['cn'].$ldap['sn'].'@gmail.com';
  176. }
  177. */
  178. function extldap_get_status($ldap_user) {
  179. return STUDENT;
  180. }
  181. function extldap_get_admin($ldap_user) {
  182. return false;
  183. }
  184. /**
  185. * return the string used to search a user in ldap
  186. *
  187. * @param string username
  188. * @return string the serach string
  189. * @author ndiechburg <noel@cblue.be>
  190. * */
  191. function extldap_get_user_search_string($username) {
  192. global $extldap_config;
  193. // init
  194. $filter = '(' . $extldap_config['user_search'] . ')';
  195. // replacing %username% by the actual username
  196. $filter = str_replace('%username%', $username, $filter);
  197. // append a global filter if needed
  198. if (isset($extldap_config['filter']) && $extldap_config['filter'] != "")
  199. $filter = '(&' . $filter . '(' . $extldap_config['filter'] . '))';
  200. return $filter;
  201. }
  202. /**
  203. * Imports all LDAP users into Chamilo
  204. * @return bool false on error, true otherwise
  205. */
  206. function extldap_import_all_users() {
  207. global $extldap_config;
  208. //echo "Connecting...\n";
  209. $ds = extldap_connect();
  210. if (!$ds) {
  211. return false;
  212. }
  213. //echo "Binding...\n";
  214. $ldapbind = false;
  215. //Connection as admin to search dn of user
  216. $ldapbind = @ldap_bind($ds, $extldap_config['admin_dn'], $extldap_config['admin_password']);
  217. if ($ldapbind === false) {
  218. error_log('EXTLDAP ERROR : cannot connect with admin login/password');
  219. return false;
  220. }
  221. //browse ASCII values from a to z to avoid 1000 results limit of LDAP
  222. $count = 0;
  223. $alphanum = array('0','1','2','3','4','5','6','7','8','9');
  224. for ($a=97;$a<=122;$a++) {
  225. $alphanum[] = chr($a);
  226. }
  227. foreach ($alphanum as $char1) {
  228. foreach ($alphanum as $char2) {
  229. //$user_search = "uid=*";
  230. $user_search = "sAMAccountName=$char1$char2*";
  231. //Search distinguish name of user
  232. $sr = ldap_search($ds, $extldap_config['base_dn'], $user_search);
  233. if (!$sr) {
  234. error_log('EXTLDAP ERROR : ldap_search(' . $ds . ', ' . $extldap_config['base_dn'] . ", $user_search) failed");
  235. return false;
  236. }
  237. //echo "Getting entries\n";
  238. $users = ldap_get_entries($ds, $sr);
  239. //echo "Entries: ".$users['count']."\n";
  240. for ($key = 0; $key < $users['count']; $key ++) {
  241. $user_id = extldap_add_user_by_array($users[$key], true);
  242. $count ++;
  243. if ($user_id) {
  244. // echo "User #$user_id created or updated\n";
  245. } else {
  246. // echo "User was not created\n";
  247. }
  248. }
  249. }
  250. }
  251. //echo "Found $count users in total\n";
  252. @ldap_close($ds);
  253. }
  254. /**
  255. * Insert users from an array of user fields
  256. */
  257. function extldap_add_user_by_array($data, $update_if_exists = true) {
  258. $lastname = api_convert_encoding($data['sn'][0], api_get_system_encoding(), 'UTF-8');
  259. $firstname = api_convert_encoding($data['cn'][0], api_get_system_encoding(), 'UTF-8');
  260. $email = $data['mail'][0];
  261. // Get uid from dn
  262. $dn_array=ldap_explode_dn($data['dn'],1);
  263. $username = $dn_array[0]; // uid is first key
  264. $outab[] = $data['edupersonprimaryaffiliation'][0]; // Here, "student"
  265. //$val = ldap_get_values_len($ds, $entry, "userPassword");
  266. //$val = ldap_get_values_len($ds, $data, "userPassword");
  267. //$password = $val[0];
  268. // TODO the password, if encrypted at the source, will be encrypted twice, which makes it useless. Try to fix that.
  269. $password = $data['userPassword'][0];
  270. $structure=$data['edupersonprimaryorgunitdn'][0];
  271. $array_structure=explode(",", $structure);
  272. $array_val=explode("=", $array_structure[0]);
  273. $etape=$array_val[1];
  274. $array_val=explode("=", $array_structure[1]);
  275. $annee=$array_val[1];
  276. // To ease management, we add the step-year (etape-annee) code
  277. $official_code=$etape."-".$annee;
  278. $auth_source='ldap';
  279. // No expiration date for students (recover from LDAP's shadow expiry)
  280. $expiration_date='0000-00-00 00:00:00';
  281. $active=1;
  282. if(empty($status)){$status = 5;}
  283. if(empty($phone)){$phone = '';}
  284. if(empty($picture_uri)){$picture_uri = '';}
  285. // Adding user
  286. $user_id = 0;
  287. if (UserManager::is_username_available($username)) {
  288. //echo "$username\n";
  289. $user_id = UserManager::create_user($firstname,$lastname,$status,$email,$username,$password,$official_code,api_get_setting('platformLanguage'),$phone,$picture_uri,$auth_source,$expiration_date,$active);
  290. } else {
  291. if ($update_if_exists) {
  292. $user = UserManager::get_user_info($username);
  293. $user_id=$user['user_id'];
  294. //echo "$username\n";
  295. UserManager::update_user($user_id, $firstname, $lastname, $username, null, null, $email, $status, $official_code, $phone, $picture_uri, $expiration_date, $active);
  296. }
  297. }
  298. return $user_id;
  299. }