lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Dbut ajout gestion utilisateurs ldap

Browse Source
This commit is contained in:
Regis Houssin 2006-07-04 15:29:56 +00:00
parent 32c26597bf
commit 25cb1ea149
3 changed files with 71 additions and 53 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

97
htdocs/lib/authldap.lib.php
View File

@ -80,6 +80,20 @@ class AuthLdap {
* Message texte de l'erreur * Message texte de l'erreur
*/ */
var $ldapErrorText; var $ldapErrorText;
//Fetch user
var $name;
var $firstname;
var $login;
var $phone;
var $fax;
var $mail;
var $mobile;
var $uacf;
var $pwdlastset;
// 1.2 Private properties ---------------------------------------------------- // 1.2 Private properties ----------------------------------------------------
/** /**
@ -94,26 +108,32 @@ class AuthLdap {
/** /**
* Constructor- creates a new instance of the authentication class * Constructor- creates a new instance of the authentication class
* *
* @param string the ldap server to connect to
* @param string the base dn
* @param string the server type- current supports OpenLdap and ActiveDirectory
* @param string the domain to use when authenticating against Active Directory
* @param string the username to authenticate with when searching if anonymous binding is not supported
* @param string the password to authenticate with when searching if anonymous binding is not supported
*/ */
function AuthLdap () { function AuthLdap () {
global $conf; global $conf;
//Server
$this->server = array($conf->global->LDAP_SERVER_HOST, $conf->global->LDAP_SERVER_HOST_SLAVE); $this->server = array($conf->global->LDAP_SERVER_HOST, $conf->global->LDAP_SERVER_HOST_SLAVE);
$this->serverPort = $conf->global->LDAP_SERVER_PORT; $this->serverPort = $conf->global->LDAP_SERVER_PORT;
$this->ldapProtocolVersion = $conf->global->LDAP_SERVER_PROTOCOLVERSION; $this->ldapProtocolVersion = $conf->global->LDAP_SERVER_PROTOCOLVERSION;
$this->dn = $conf->global->LDAP_SERVER_DN; $this->dn = $conf->global->LDAP_SERVER_DN;
$this->serverType = $conf->global->LDAP_SERVER_TYPE; $this->serverType = $conf->global->LDAP_SERVER_TYPE;
$this->domain = $sDomain; $this->domain = $sDomain; //Todo: ajouter en base
$this->searchUser = $conf->global->LDAP_ADMIN_DN; $this->searchUser = $conf->global->LDAP_ADMIN_DN;
$this->searchPassword = $conf->global->LDAP_ADMIN_PASS; $this->searchPassword = $conf->global->LDAP_ADMIN_PASS;
$this->people = $conf->global->LDAP_USER_DN; $this->people = $conf->global->LDAP_USER_DN;
$this->groups = $conf->global->LDAP_GROUP_DN; $this->groups = $conf->global->LDAP_GROUP_DN;
$this->filter = $conf->global->LDAP_FILTER_CONNECTION;
//Users
$this->attr_login = $conf->global->LDAP_FIELD_LOGIN; //unix
$this->attr_sambalogin = $conf->global->LDAP_FIELD_LOGIN_SAMBA; //samba, activedirectory
$this->attr_name = $conf->global->LDAP_FIELD_NAME;
$this->attr_firstname = $conf->global->LDAP_FIELD_FIRSTNAME;
$this->attr_mail = $conf->global->LDAP_FIELD_MAIL;
$this->attr_phone = $conf->global->LDAP_FIELD_PHONE;
$this->attr_fax = $conf->global->LDAP_FIELD_FAX;
$this->attr_mobile = $conf->global->LDAP_FIELD_MOBILE;
} }
// 2.1 Connection handling methods ------------------------------------------- // 2.1 Connection handling methods -------------------------------------------
@ -410,15 +430,12 @@ class AuthLdap {
* results are returned (eg:- multiple email addresses) * results are returned (eg:- multiple email addresses)
*/ */
function getAttribute ( $uname,$attribute) { function getAttribute ( $uname,$attribute) {
// builds the appropriate dn, based on whether $this->people and/or $this->group is set
//$checkDn = $this->setDn( true);
$checkDn = $this->people;
$results[0] = $attribute; $results[0] = $attribute;
$filtre = $this->getUserIdentifier()."=$uname"; $filtre = $this->getUserIdentifier()."=$uname";
// We need to search for this user in order to get their entry. // We need to search for this user in order to get their entry.
$this->result = @ldap_search( $this->connection,$checkDn,$filtre,$results); $this->result = @ldap_search( $this->connection,$this->people,$filtre,$results);
$info = ldap_get_entries( $this->connection, $this->result); $info = ldap_get_entries( $this->connection, $this->result);
// Only one entry should ever be returned (no user will have the same uid) // Only one entry should ever be returned (no user will have the same uid)
@ -473,12 +490,6 @@ class AuthLdap {
* users. The $attributeArray variable contains the required user detail field names * users. The $attributeArray variable contains the required user detail field names
*/ */
function getUsers( $search, $attributeArray) { function getUsers( $search, $attributeArray) {
global $conf;
// builds the appropriate dn, based on whether $this->people and/or $this->group is set
//$checkDn = $this->setDn( true);
$checkDn = $conf->global->LDAP_USER_DN;
// Perform the search and get the entry handles // Perform the search and get the entry handles
@ -487,9 +498,9 @@ class AuthLdap {
$this->authBind($this->searchUser, $this->searchPassword); $this->authBind($this->searchUser, $this->searchPassword);
} }
$filter = '('.$conf->global->LDAP_FILTER_CONNECTION.'('.$this->getUserIdentifier().'='.$search.'))'; $filter = '('.$this->filter.'('.$this->getUserIdentifier().'='.$search.'))';
$this->result = @ldap_search( $this->connection, $checkDn, $filter); $this->result = @ldap_search( $this->connection, $this->People, $filter);
if (!$this->result) if (!$this->result)
{ {
@ -543,13 +554,10 @@ class AuthLdap {
*/ */
function getObjectSid($ldapUser) function getObjectSid($ldapUser)
{ {
global $conf;
$criteria = $this->getUserIdentifier()."=$ldapUser"; $criteria = $this->getUserIdentifier()."=$ldapUser";
$justthese = array("objectsid"); $justthese = array("objectsid");
$checkDn = $conf->global->LDAP_USER_DN;
$ldapSearchResult = ldap_search($this->connection, $checkDn, $criteria, $justthese); $ldapSearchResult = ldap_search($this->connection, $this->people, $criteria, $justthese);
$entry = ldap_first_entry($this->connection, $ldapSearchResult); $entry = ldap_first_entry($this->connection, $ldapSearchResult);
$ldapBinary = ldap_get_values_len ($this->connection, $entry, "objectsid"); $ldapBinary = ldap_get_values_len ($this->connection, $entry, "objectsid");
@ -619,7 +627,6 @@ class AuthLdap {
* \param $user : utilisateur ldap * \param $user : utilisateur ldap
*/ */
function fetch( $user) { function fetch( $user) {
global $conf;
// Perform the search and get the entry handles // Perform the search and get the entry handles
@ -627,10 +634,11 @@ class AuthLdap {
if ($this->serverType == "activedirectory") { if ($this->serverType == "activedirectory") {
$this->authBind($this->searchUser, $this->searchPassword); $this->authBind($this->searchUser, $this->searchPassword);
} }
$checkDn = $this->people; $userIdentifier = $this->getUserIdentifier();
$filter = '('.$conf->global->LDAP_FILTER_CONNECTION.'('.$this->getUserIdentifier().'='.$user.'))';
$this->result = @ldap_search( $this->connection, $checkDn, $filter); $filter = '('.$this->filter.'('.$userIdentifier.'='.$user.'))';
$this->result = @ldap_search( $this->connection, $this->people, $filter);
$result = @ldap_get_entries( $this->connection, $this->result); $result = @ldap_get_entries( $this->connection, $this->result);
@ -641,8 +649,18 @@ class AuthLdap {
} }
else else
{ {
//ldap_free_result($this->result); $this->name = utf8_decode($result[0][$this->attr_name][0]);
return $result; $this->firstname = utf8_decode($result[0][$this->attr_firstname][0]);
$this->login = utf8_decode($result[0][$userIdentifier][0]);
$this->phone = utf8_decode($result[0][$this->attr_phone][0]);
$this->fax = utf8_decode($result[0][$this->attr_fax][0]);
$this->mail = utf8_decode($result[0][$this->attr_mail][0]);
$this->mobile = utf8_decode($result[0][$this->attr_mobile][0]);
$this->uacf = $this->parseUACF(utf8_decode($result[0]["useraccountcontrol"][0]));
$this->pwdlastset = utf8_decode($result[0]["pwdlastset"][0]);
ldap_free_result($this->result);
} }
} }
@ -678,11 +696,10 @@ class AuthLdap {
* Returns the correct user identifier to use, based on the ldap server type * Returns the correct user identifier to use, based on the ldap server type
*/ */
function getUserIdentifier() { function getUserIdentifier() {
global $conf;
if ($this->serverType == "activedirectory") { if ($this->serverType == "activedirectory") {
return $conf->global->LDAP_FIELD_LOGIN_SAMBA; return $this->attr_sambalogin;
} else { } else {
return $conf->global->LDAP_FIELD_LOGIN; return $this->attr_login;
} }
} }

9
htdocs/main.inc.php
View File

@ -69,6 +69,7 @@ $bc[1]="class=\"pair\"";
// plusieurs modes sont indiqués. // plusieurs modes sont indiqués.
// Exemple: array('http','dolibarr'); // Exemple: array('http','dolibarr');
// Exemple: array('ldap'); // Exemple: array('ldap');
//$authmode=array('ldap');
$authmode=array('http','dolibarr'); $authmode=array('http','dolibarr');
if (isset($dolibarr_auto_user)) $authmode=array('auto'); if (isset($dolibarr_auto_user)) $authmode=array('auto');
@ -167,12 +168,12 @@ if (! session_id() && ! isset($_SESSION["dol_user"]) && ! isset($_SESSION["dol_
'basedn' => $conf->global->LDAP_SERVER_DN, 'basedn' => $conf->global->LDAP_SERVER_DN,
'binddn' => $conf->global->LDAP_ADMIN_DN, 'binddn' => $conf->global->LDAP_ADMIN_DN,
'bindpw' => $conf->global->LDAP_ADMIN_PASS, 'bindpw' => $conf->global->LDAP_ADMIN_PASS,
'userattr' => $conf->global->LDAP_FIELD_LOGIN_SAMBA, //'userattr' => $conf->global->LDAP_FIELD_LOGIN_SAMBA,
'userattr' => 'samAccountName',
'userfilter' => '(objectClass=user)', 'userfilter' => '(objectClass=user)',
); );
$aDol = new DOLIAuth("DB", $params, "loginfunction"); $aDol = new DOLIAuth("LDAP", $params, "loginfunction");
$aDol->setSessionName("DOLSESSID_".$dolibarr_main_db_name);
$aDol->start(); $aDol->start();
$result = $aDol->getAuth(); // Si deja logue avec succes, renvoie vrai, sinon effectue un redirect sur page loginfunction et renvoie false $result = $aDol->getAuth(); // Si deja logue avec succes, renvoie vrai, sinon effectue un redirect sur page loginfunction et renvoie false
if ($result) if ($result)

18
htdocs/user/fiche.php
View File

@ -351,10 +351,10 @@ if (($action == 'create') || ($action == 'adduserldap'))
/* /*
* ajout utilisateur ldap * ajout utilisateur ldap
*/ */
if ($conf->ldap->enabled) // if ($conf->ldap->enabled)
{ // {
if ($conf->global->LDAP_SERVER_HOST && $conf->global->LDAP_ADMIN_DN && $conf->global->LDAP_ADMIN_PASS) // if ($conf->global->LDAP_SERVER_HOST && $conf->global->LDAP_ADMIN_DN && $conf->global->LDAP_ADMIN_PASS)
{ // {
$name = $conf->global->LDAP_FIELD_NAME; $name = $conf->global->LDAP_FIELD_NAME;
$firstname = $conf->global->LDAP_FIELD_FIRSTNAME; $firstname = $conf->global->LDAP_FIELD_FIRSTNAME;
$mail = $conf->global->LDAP_FIELD_MAIL; $mail = $conf->global->LDAP_FIELD_MAIL;
@ -430,8 +430,8 @@ if (($action == 'create') || ($action == 'adduserldap'))
print $ldap->ldapErrorCode; print $ldap->ldapErrorCode;
print $ldap->ldapErrorText; print $ldap->ldapErrorText;
} }
} //}
} //}
print '<form action="fiche.php" method="post" name="createuser">'; print '<form action="fiche.php" method="post" name="createuser">';
print '<input type="hidden" name="action" value="add">'; print '<input type="hidden" name="action" value="add">';
@ -605,16 +605,16 @@ else
$message .= $ldap->ldapErrorCode." - ".$ldap->ldapErrorText; $message .= $ldap->ldapErrorCode." - ".$ldap->ldapErrorText;
} }
} }
//On vérifie les options du compte //On vérifie les options du compte
$control = $ldap->parseUACF(utf8_decode($entries[0]["useraccountcontrol"][0])); foreach ($ldap->uacf as $key => $statut)
foreach ($control as $key => $statut)
{ {
if ($key == 65536) if ($key == 65536)
{ {
$passDoNotExpire = $langs->trans("LdapUacf_".$statut); $passDoNotExpire = $langs->trans("LdapUacf_".$statut);
} }
} }
if (utf8_decode($entries[0]["pwdlastset"][0]) == 0 && utf8_decode($entries[0]["pwdlastset"][0]) != "") if ($ldap->pwdlastset == 0 && $ldap->pwdlastset != "")
{ {
$userChangePassNextLogon = $langs->trans("UserMustChangePassNextLogon"); $userChangePassNextLogon = $langs->trans("UserMustChangePassNextLogon");
} }