ldap.inc.php 7.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223
  1. <?php
  2. // External login module : LDAP
  3. /**
  4. * This files is included by newUser.ldap.php and login.ldap.php
  5. * It implements the functions nedded by both files
  6. * */
  7. //Includes the configuration file
  8. require_once dirname(__FILE__) . '/../../inc/global.inc.php';
  9. require_once dirname(__FILE__) . '/../../inc/conf/auth.conf.php';
  10. /**
  11. * Returns a transcoded and trimmed string
  12. *
  13. * @param string
  14. * @return string
  15. * @author ndiechburg <noel@cblue.be>
  16. * */
  17. function extldap_purify_string($string) {
  18. global $extldap_config;
  19. if (isset($extldap_config['encoding'])) {
  20. return trim(api_to_system_encoding($string, $extldap_config['encoding']));
  21. } else {
  22. return trim($string);
  23. }
  24. }
  25. /**
  26. * Establishes a connection to the LDAP server and sets the protocol version
  27. *
  28. * @return resource ldap link identifier or false
  29. * @author ndiechburg <noel@cblue.be>
  30. * */
  31. function extldap_connect() {
  32. global $extldap_config;
  33. if (!is_array($extldap_config['host']))
  34. $extldap_config['host'] = array($extldap_config['host']);
  35. foreach ($extldap_config['host'] as $host) {
  36. //Trying to connect
  37. if (isset($extldap_config['port'])) {
  38. $ds = ldap_connect($host, $extldap_config['port']);
  39. } else {
  40. $ds = ldap_connect($host);
  41. }
  42. if (!$ds) {
  43. $port = isset($extldap_config['port']) ? $ldap_config['port'] : 389;
  44. error_log('EXTLDAP ERROR : cannot connect to ' . $extldap_config['host'] . ':' . $port);
  45. } else
  46. break;
  47. }
  48. if (!$ds) {
  49. error_log('EXTLDAP ERROR : no valid server found');
  50. return false;
  51. }
  52. //Setting protocol version
  53. if (isset($extldap_config['protocol_version'])) {
  54. if (!ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, $extldap_config['protocol_version'])) {
  55. ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 2);
  56. }
  57. }
  58. //Setting protocol version
  59. if (isset($extldap_config['referrals'])) {
  60. if (!ldap_set_option($ds, LDAP_OPT_REFERRALS, $extldap_config['referrals'])) {
  61. ldap_set_option($ds, LDAP_OPT_REFERRALS, $extldap_config['referrals']);
  62. }
  63. }
  64. return $ds;
  65. }
  66. /**
  67. * Authenticate user on external ldap server and return user ldap entry if that succeeds
  68. *
  69. * @return mixed false if user cannot authenticate on ldap, user ldap entry if tha succeeds
  70. * @author ndiechburg <noel@cblue.be>
  71. * Modified by hubert.borderiou@grenet.fr
  72. * Add possibility to get user info from LDAP without check password (if CAS auth and LDAP profil update)
  73. *
  74. * */
  75. function extldap_authenticate($username, $password, $in_auth_with_no_password = false) {
  76. global $extldap_config;
  77. if (empty($username) or empty($password)) {
  78. return false;
  79. }
  80. $ds = extldap_connect();
  81. if (!$ds) {
  82. return false;
  83. }
  84. //Connection as admin to search dn of user
  85. $ldapbind = @ldap_bind($ds, $extldap_config['admin_dn'], $extldap_config['admin_password']);
  86. if ($ldapbind === false) {
  87. error_log('EXTLDAP ERROR : cannot connect with admin login/password');
  88. return false;
  89. }
  90. $user_search = extldap_get_user_search_string($username);
  91. //Search distinguish name of user
  92. $sr = ldap_search($ds, $extldap_config['base_dn'], $user_search);
  93. if (!$sr) {
  94. error_log('EXTLDAP ERROR : ldap_search(' . $ds . ', ' . $extldap_config['base_dn'] . ", $user_search) failed");
  95. return false;
  96. }
  97. $entries_count = ldap_count_entries($ds, $sr);
  98. if ($entries_count > 1) {
  99. error_log('EXTLDAP ERROR : more than one entry for that user ( ldap_search(ds, ' . $extldap_config['base_dn'] . ", $user_search) )");
  100. return false;
  101. }
  102. if ($entries_count < 1) {
  103. error_log('EXTLDAP ERROR : No entry for that user ( ldap_search(ds, ' . $extldap_config['base_dn'] . ", $user_search) )");
  104. return false;
  105. }
  106. $users = ldap_get_entries($ds, $sr);
  107. $user = $users[0];
  108. // If we just want to have user info from LDAP and not to check password
  109. if ($in_auth_with_no_password) {
  110. return $user;
  111. }
  112. //now we try to autenthicate the user in the ldap
  113. $ubind = @ldap_bind($ds, $user['dn'], $password);
  114. if ($ubind !== false) {
  115. return $user;
  116. } else {
  117. error_log('EXTLDAP : Wrong password for ' . $user['dn']);
  118. return false;
  119. }
  120. }
  121. /**
  122. * Return an array with userinfo compatible with chamilo using $extldap_user_correspondance
  123. * configuration array declared in ldap.conf.php file
  124. *
  125. * @param array ldap user
  126. * @param array correspondance array (if not set use extldap_user_correspondance declared in auth.conf.php
  127. * @return array userinfo array
  128. * @author ndiechburg <noel@cblue.be>
  129. * */
  130. function extldap_get_chamilo_user($ldap_user, $cor = null) {
  131. global $extldap_user_correspondance;
  132. if (is_null($cor)) {
  133. $cor = $extldap_user_correspondance;
  134. }
  135. $chamilo_user = array();
  136. foreach ($cor as $chamilo_field => $ldap_field) {
  137. if (is_array($ldap_field)) {
  138. $chamilo_user[$chamilo_field] = extldap_get_chamilo_user($ldap_user, $ldap_field);
  139. continue;
  140. }
  141. switch ($ldap_field) {
  142. case 'func':
  143. $func = "extldap_get_$chamilo_field";
  144. if (function_exists($func)) {
  145. $chamilo_user[$chamilo_field] = extldap_purify_string($func($ldap_user));
  146. } else {
  147. error_log("EXTLDAP WARNING : You forgot to declare $func");
  148. }
  149. break;
  150. default:
  151. //if string begins with "!", then this is a constant
  152. if ($ldap_field[0] === '!') {
  153. $chamilo_user[$chamilo_field] = trim($ldap_field, "!\t\n\r\0");
  154. break;
  155. }
  156. if (isset($ldap_user[$ldap_field][0])) {
  157. $chamilo_user[$chamilo_field] = extldap_purify_string($ldap_user[$ldap_field][0]);
  158. } else {
  159. error_log('EXTLDAP WARNING : ' . $ldap_field . '[0] field is not set in ldap array');
  160. }
  161. break;
  162. }
  163. }
  164. return $chamilo_user;
  165. }
  166. /**
  167. * Please declare here all the function you use in extldap_user_correspondance
  168. * All these functions must have an $ldap_user parameter. This parameter is the
  169. * array returned by the ldap for the user
  170. * */
  171. /**
  172. * example function for email
  173. * */
  174. /*
  175. function extldap_get_email($ldap_user){
  176. return $ldap_user['cn'].$ldap['sn'].'@gmail.com';
  177. }
  178. */
  179. function extldap_get_status($ldap_user) {
  180. return STUDENT;
  181. }
  182. function extldap_get_admin($ldap_user) {
  183. return false;
  184. }
  185. /**
  186. * return the string used to search a user in ldap
  187. *
  188. * @param string username
  189. * @return string the serach string
  190. * @author ndiechburg <noel@cblue.be>
  191. * */
  192. function extldap_get_user_search_string($username) {
  193. global $extldap_config;
  194. // init
  195. $filter = '(' . $extldap_config['user_search'] . ')';
  196. // replacing %username% by the actual username
  197. $filter = str_replace('%username%', $username, $filter);
  198. // append a global filter if needed
  199. if (isset($extldap_config['filter']) && $extldap_config['filter'] != "")
  200. $filter = '(&' . $filter . '(' . $extldap_config['filter'] . '))';
  201. return $filter;
  202. }