Qual: Externalisation en fichier modules des modes de connexion
This commit is contained in:
Laurent Destailleur
parent
db68503057
commit
2fb0e5a6fd
@ -124,12 +124,14 @@ $character_set_client="ISO-8859-1";
|
|||||||
# This parameter contains the way authentication is done.
|
# This parameter contains the way authentication is done.
|
||||||
# If value "ldap" is used, you must also set parameters dolibarr_main_auth_ldap_*
|
# If value "ldap" is used, you must also set parameters dolibarr_main_auth_ldap_*
|
||||||
# Default value: dolibarr
|
# Default value: dolibarr
|
||||||
# Possible values: http, dolibarr, ldap
|
# Possible values: Any values found in files in htdocs/includes/login directory after
|
||||||
|
# the "function_" string and before the ".php" string.
|
||||||
# Examples:
|
# Examples:
|
||||||
# $dolibarr_main_authentication="http";
|
# $dolibarr_main_authentication="http";
|
||||||
# $dolibarr_main_authentication="dolibarr";
|
# $dolibarr_main_authentication="dolibarr";
|
||||||
# $dolibarr_main_authentication="ldap";
|
# $dolibarr_main_authentication="ldap";
|
||||||
#
|
#
|
||||||
|
$dolibarr_main_authentication="dolibarr"
|
||||||
|
|
||||||
|
|
||||||
# Parameters used to setup LDAP authentication.
|
# Parameters used to setup LDAP authentication.
|
||||||
@ -150,7 +152,7 @@ $character_set_client="ISO-8859-1";
|
|||||||
|
|
||||||
|
|
||||||
# Parameters not used yet
|
# Parameters not used yet
|
||||||
# dolibarr_smarty_libs_dir
|
# dolibarr_smarty_libs_dir,dolibarr_smarty_compile,dolibarr_smarty_cache
|
||||||
# Examples:
|
# Examples:
|
||||||
# $dolibarr_smarty_libs_dir="/var/www/dolibarr/external-libs/smarty/libs/";
|
# $dolibarr_smarty_libs_dir="/var/www/dolibarr/external-libs/smarty/libs/";
|
||||||
# $dolibarr_smarty_compile="/var/www/dolibarr/documents/temp/smarty_templates";
|
# $dolibarr_smarty_compile="/var/www/dolibarr/documents/temp/smarty_templates";
|
||||||
|
|||||||
115
htdocs/includes/login/functions_dolibarr.php
Normal file
115
htdocs/includes/login/functions_dolibarr.php
Normal file
@ -0,0 +1,115 @@
|
|||||||
|
<?php
|
||||||
|
/* Copyright (C) 2007 Laurent Destailleur <eldy@users.sourceforge.net>
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or modify
|
||||||
|
* it under the terms of the GNU General Public License as published by
|
||||||
|
* the Free Software Foundation; either version 2 of the License, or
|
||||||
|
* (at your option) any later version.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||||
|
*
|
||||||
|
* $Id$
|
||||||
|
*/
|
||||||
|
|
||||||
|
/**
|
||||||
|
\file htdocs/includes/login/functions_dolibarr.php
|
||||||
|
\ingroup core
|
||||||
|
\brief Authentication functions for Dolibarr mode
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
/**
|
||||||
|
\brief Check user and password
|
||||||
|
\param usertotest Login
|
||||||
|
\param passwordtotest Password
|
||||||
|
\return string Login if ok, '' if ko.
|
||||||
|
*/
|
||||||
|
function check_user_password_dolibarr($usertotest,$passwordtotest)
|
||||||
|
{
|
||||||
|
global $_POST,$db,$conf,$langs;
|
||||||
|
|
||||||
|
dolibarr_syslog("functions_dolibarr::check_user_password_dolibarr usertotest=".$usertotest);
|
||||||
|
|
||||||
|
$login='';
|
||||||
|
|
||||||
|
if (! empty($_POST["username"]))
|
||||||
|
{
|
||||||
|
// If test username/password asked, we define $test=false and $login var if ok, set $_SESSION["dol_loginmesg"] if ko
|
||||||
|
$table = MAIN_DB_PREFIX."user";
|
||||||
|
$usernamecol = 'login';
|
||||||
|
|
||||||
|
$sql ='SELECT pass, pass_crypted';
|
||||||
|
$sql.=' from '.$table;
|
||||||
|
$sql.=' where '.$usernamecol." = '".addslashes($_POST["username"])."'";
|
||||||
|
|
||||||
|
dolibarr_syslog("functions_dolibarr::check_user_password_dolibarr sql=".$sql);
|
||||||
|
$resql=$db->query($sql);
|
||||||
|
if ($resql)
|
||||||
|
{
|
||||||
|
$obj=$db->fetch_object($resql);
|
||||||
|
if ($obj)
|
||||||
|
{
|
||||||
|
$passclear=$obj->pass;
|
||||||
|
$passcrypted=$obj->pass_crypted;
|
||||||
|
$passtyped=$_POST["password"];
|
||||||
|
|
||||||
|
$passok=false;
|
||||||
|
|
||||||
|
// Check crypted password
|
||||||
|
$cryptType='';
|
||||||
|
if ($conf->global->DATABASE_PWD_ENCRYPTED) $cryptType='md5';
|
||||||
|
if ($cryptType == 'md5')
|
||||||
|
{
|
||||||
|
if (md5($passtyped) == $passcrypted) $passok=true;
|
||||||
|
}
|
||||||
|
|
||||||
|
// For compatibility with old versions
|
||||||
|
if (! $passok)
|
||||||
|
{
|
||||||
|
if ($passtyped == $passclear) $passok=true;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Password ok ?
|
||||||
|
if ($passok)
|
||||||
|
{
|
||||||
|
dolibarr_syslog("functions_dolibarr::check_user_password_dolibarr Authentification ok");
|
||||||
|
$login=$_POST["username"];
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
dolibarr_syslog("functions_dolibarr::check_user_password_dolibarr Authentification ko bad password pour '".$_POST["username"]."'");
|
||||||
|
sleep(1);
|
||||||
|
$langs->load('main');
|
||||||
|
$langs->load('other');
|
||||||
|
$_SESSION["dol_loginmesg"]=$langs->trans("ErrorBadLoginPassword");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
dolibarr_syslog("functions_dolibarr::check_user_password_dolibarr Authentification ko user not found pour '".$_POST["username"]."'");
|
||||||
|
sleep(1);
|
||||||
|
$langs->load('main');
|
||||||
|
$langs->load('other');
|
||||||
|
$_SESSION["dol_loginmesg"]=$langs->trans("ErrorBadLoginPassword");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
dolibarr_syslog("functions_dolibarr::check_user_password_dolibarr Authentification ko db error pour '".$_POST["username"]."' error=".$db->lasterror());
|
||||||
|
sleep(1);
|
||||||
|
$_SESSION["dol_loginmesg"]=$db->lasterror();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return $login;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
?>
|
||||||
50
htdocs/includes/login/functions_forceuser.php
Normal file
50
htdocs/includes/login/functions_forceuser.php
Normal file
@ -0,0 +1,50 @@
|
|||||||
|
<?php
|
||||||
|
/* Copyright (C) 2007 Laurent Destailleur <eldy@users.sourceforge.net>
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or modify
|
||||||
|
* it under the terms of the GNU General Public License as published by
|
||||||
|
* the Free Software Foundation; either version 2 of the License, or
|
||||||
|
* (at your option) any later version.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||||
|
*
|
||||||
|
* $Id$
|
||||||
|
*/
|
||||||
|
|
||||||
|
/**
|
||||||
|
\file htdocs/includes/login/functions_forceuser.php
|
||||||
|
\ingroup core
|
||||||
|
\brief Authentication functions for forceuser
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
/**
|
||||||
|
\brief Check user and password
|
||||||
|
\param usertotest Login
|
||||||
|
\param passwordtotest Password
|
||||||
|
\return string Login if ok, '' if ko.
|
||||||
|
*/
|
||||||
|
function check_user_password_forceuser($usertotest,$passwordtotest)
|
||||||
|
{
|
||||||
|
// Variable dolibarr_auto_user must be defined in conf.php file
|
||||||
|
global $dolibarr_auto_user;
|
||||||
|
|
||||||
|
dolibarr_syslog("functions_forceuser::check_user_password_forceuser");
|
||||||
|
|
||||||
|
$login=$dolibarr_auto_user;
|
||||||
|
if (empty($login)) $login='auto';
|
||||||
|
|
||||||
|
if ($_SESSION["dol_loginmesg"]) $login='';
|
||||||
|
|
||||||
|
return $login;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
?>
|
||||||
48
htdocs/includes/login/functions_http.php
Normal file
48
htdocs/includes/login/functions_http.php
Normal file
@ -0,0 +1,48 @@
|
|||||||
|
<?php
|
||||||
|
/* Copyright (C) 2007 Laurent Destailleur <eldy@users.sourceforge.net>
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or modify
|
||||||
|
* it under the terms of the GNU General Public License as published by
|
||||||
|
* the Free Software Foundation; either version 2 of the License, or
|
||||||
|
* (at your option) any later version.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||||
|
*
|
||||||
|
* $Id$
|
||||||
|
*/
|
||||||
|
|
||||||
|
/**
|
||||||
|
\file htdocs/includes/login/functions_http.php
|
||||||
|
\ingroup core
|
||||||
|
\brief Authentication functions for HTTP Basic
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
/**
|
||||||
|
\brief Check user and password
|
||||||
|
\param usertotest Login
|
||||||
|
\param passwordtotest Password
|
||||||
|
\return string Login if ok, '' if ko.
|
||||||
|
*/
|
||||||
|
function check_user_password_http($usertotest,$passwordtotest)
|
||||||
|
{
|
||||||
|
dolibarr_syslog("functions_http::check_user_password_http _SERVER[REMOTE_USER]=".$_SERVER["REMOTE_USER"]);
|
||||||
|
|
||||||
|
$login='';
|
||||||
|
if (! empty($_SERVER["REMOTE_USER"]))
|
||||||
|
{
|
||||||
|
$login=$_SERVER["REMOTE_USER"];
|
||||||
|
}
|
||||||
|
|
||||||
|
return $login;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
?>
|
||||||
196
htdocs/includes/login/functions_ldap.php
Normal file
196
htdocs/includes/login/functions_ldap.php
Normal file
@ -0,0 +1,196 @@
|
|||||||
|
<?php
|
||||||
|
/* Copyright (C) 2007 Laurent Destailleur <eldy@users.sourceforge.net>
|
||||||
|
*
|
||||||
|
* This program is free software; you can redistribute it and/or modify
|
||||||
|
* it under the terms of the GNU General Public License as published by
|
||||||
|
* the Free Software Foundation; either version 2 of the License, or
|
||||||
|
* (at your option) any later version.
|
||||||
|
*
|
||||||
|
* This program is distributed in the hope that it will be useful,
|
||||||
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
* GNU General Public License for more details.
|
||||||
|
*
|
||||||
|
* You should have received a copy of the GNU General Public License
|
||||||
|
* along with this program; if not, write to the Free Software
|
||||||
|
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||||
|
*
|
||||||
|
* $Id$
|
||||||
|
*/
|
||||||
|
|
||||||
|
/**
|
||||||
|
\file htdocs/includes/login/functions_ldap.php
|
||||||
|
\ingroup core
|
||||||
|
\brief Authentication functions for LDAP
|
||||||
|
*/
|
||||||
|
|
||||||
|
|
||||||
|
/**
|
||||||
|
\brief Check user and password
|
||||||
|
\param usertotest Login
|
||||||
|
\param passwordtotest Password
|
||||||
|
\return string Login if ok, '' if ko.
|
||||||
|
\remarks If test is ko, reason must be filled into $_SESSION["dol_loginmesg"]
|
||||||
|
*/
|
||||||
|
function check_user_password_ldap($usertotest,$passwordtotest)
|
||||||
|
{
|
||||||
|
global $_POST,$db,$conf,$langs;
|
||||||
|
global $dolibarr_main_auth_ldap_host,$dolibarr_main_auth_ldap_port;
|
||||||
|
global $dolibarr_main_auth_ldap_version,$dolibarr_main_auth_ldap_servertype;
|
||||||
|
global $dolibarr_main_auth_ldap_login_attribute,$dolibarr_main_auth_ldap_dn;
|
||||||
|
global $dolibarr_main_auth_ldap_admin_login,$dolibarr_main_auth_ldap_admin_pass;
|
||||||
|
global $dolibarr_main_auth_ldap_debug;
|
||||||
|
|
||||||
|
dolibarr_syslog("functions_ldap::check_user_password_ldap usertotest=".$usertotest);
|
||||||
|
|
||||||
|
if (! function_exists("ldap_connect"))
|
||||||
|
{
|
||||||
|
dolibarr_syslog("functions_ldap::check_user_password_ldap Authentification ko failed to connect to LDAP. LDAP functions are disabled on this PHP");
|
||||||
|
sleep(1);
|
||||||
|
$langs->load('main');
|
||||||
|
$langs->load('other');
|
||||||
|
$_SESSION["dol_loginmesg"]=$langs->trans("ErrorLDAPFunctionsAreDisabledOnThisPHP").' '.$langs->trans("TryAnotherConnectionMode");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
$login='';
|
||||||
|
$resultFetchUser='';
|
||||||
|
|
||||||
|
if (! empty($_POST["username"]))
|
||||||
|
{
|
||||||
|
// If test username/password asked, we define $test=false and $login var if ok, set $_SESSION["dol_loginmesg"] if ko
|
||||||
|
$ldaphost=$dolibarr_main_auth_ldap_host;
|
||||||
|
$ldapport=$dolibarr_main_auth_ldap_port;
|
||||||
|
$ldapversion=$dolibarr_main_auth_ldap_version;
|
||||||
|
$ldapservertype=(empty($dolibarr_main_auth_ldap_servertype) ? 'openldap' : $dolibarr_main_auth_ldap_servertype);
|
||||||
|
|
||||||
|
$ldapuserattr=$dolibarr_main_auth_ldap_login_attribute;
|
||||||
|
$ldapdn=$dolibarr_main_auth_ldap_dn;
|
||||||
|
$ldapadminlogin=$dolibarr_main_auth_ldap_admin_login;
|
||||||
|
$ldapadminpass=$dolibarr_main_auth_ldap_admin_pass;
|
||||||
|
$ldapdebug=(empty($dolibarr_main_auth_ldap_debug) || $dolibarr_main_auth_ldap_debug=="false" ? false : true);
|
||||||
|
|
||||||
|
if ($ldapdebug) print "DEBUG: Logging LDAP steps<br>\n";
|
||||||
|
|
||||||
|
// Debut code pour compatibilite (prend info depuis config en base)
|
||||||
|
// Ne plus utiliser. La config LDAP de connexion doit etre dans le fichier conf.php
|
||||||
|
if (! $ldapuserattr && $conf->ldap->enabled)
|
||||||
|
{
|
||||||
|
if ($conf->global->LDAP_SERVER_TYPE == "activedirectory")
|
||||||
|
{
|
||||||
|
$ldapuserattr = $conf->global->LDAP_FIELD_LOGIN_SAMBA;
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
$ldapuserattr = $conf->global->LDAP_FIELD_LOGIN;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (! $ldaphost) $ldaphost=$conf->global->LDAP_SERVER_HOST;
|
||||||
|
if (! $ldapport) $ldapport=$conf->global->LDAP_SERVER_PORT;
|
||||||
|
if (! $ldapservertype) $ldapservertype=$conf->global->LDAP_SERVER_TYPE;
|
||||||
|
if (! $ldapversion) $ldapversion=$conf->global->LDAP_SERVER_PROTOCOLVERSION;
|
||||||
|
if (! $ldapdn) $ldapdn=$conf->global->LDAP_SERVER_DN;
|
||||||
|
if (! $ldapadminlogin) $ldapadminlogin=$conf->global->LDAP_ADMIN_DN;
|
||||||
|
if (! $ldapadminpass) $ldapadminpass=$conf->global->LDAP_ADMIN_PASS;
|
||||||
|
// Fin code pour compatiblite
|
||||||
|
|
||||||
|
require_once(DOL_DOCUMENT_ROOT."/lib/ldap.class.php");
|
||||||
|
$ldap=new Ldap();
|
||||||
|
$ldap->server=array($ldaphost);
|
||||||
|
$ldap->serverPort=$ldapport;
|
||||||
|
$ldap->ldapProtocolVersion=$ldapversion;
|
||||||
|
$ldap->serverType=$ldapservertype;
|
||||||
|
$ldap->searchUser=$ldapadminlogin;
|
||||||
|
$ldap->searchPassword=$ldapadminpass;
|
||||||
|
|
||||||
|
if ($ldapdebug) dolibarr_syslog("Authentification LDAP --> Server:".join(',',$ldap->server).", Port:".$ldap->serverPort.", Protocol:".$ldap->ldapProtocolVersion.", Type:".$ldap->serverType.", Admin:".$ldap->searchUser.", Pass:".$ldap->searchPassword);
|
||||||
|
|
||||||
|
// Code to get user in LDAP (may differ from Dolibarr user)
|
||||||
|
$result=$ldap->connect_bind();
|
||||||
|
$resultCheckUserDN = $ldap->checkPass($usertotest,$passwordtotest);
|
||||||
|
$ldap->close();
|
||||||
|
|
||||||
|
$ldap->searchUser=$usertotest;
|
||||||
|
if ($resultCheckUserDN) $ldap->searchUser = $ldap->ldapUserDN;
|
||||||
|
$ldap->searchPassword=$passwordtotest;
|
||||||
|
|
||||||
|
$result=$ldap->connect_bind(); // Test with this->seachUser and this->searchPassword
|
||||||
|
if ($result > 0)
|
||||||
|
{
|
||||||
|
if ($result == 2)
|
||||||
|
{
|
||||||
|
dolibarr_syslog("functions_ldap::check_user_password_ldap Authentification ok");
|
||||||
|
$login=$_POST["username"];
|
||||||
|
|
||||||
|
// ldap2dolibarr synchronisation
|
||||||
|
if ($login && $conf->ldap->enabled && $conf->global->LDAP_SYNCHRO_ACTIVE == 'ldap2dolibarr')
|
||||||
|
{
|
||||||
|
// On charge les attributs du user ldap
|
||||||
|
if ($ldapdebug) print "DEBUG: login ldap = ".$login."<br>\n";
|
||||||
|
$ldap->fetch($login);
|
||||||
|
|
||||||
|
if ($ldapdebug) print "DEBUG: UACF = ".join(',',$ldap->uacf)."<br>\n";
|
||||||
|
if ($ldapdebug) print "DEBUG: pwdLastSet = ".dolibarr_print_date($ldap->pwdlastset,'day')."<br>\n";
|
||||||
|
if ($ldapdebug) print "DEBUG: badPasswordTime = ".dolibarr_print_date($ldap->badpwdtime,'day')."<br>\n";
|
||||||
|
|
||||||
|
|
||||||
|
// On stop si le mot de passe ldap doit etre modifie
|
||||||
|
if ($ldap->pwdlastset == 0)
|
||||||
|
{
|
||||||
|
session_destroy();
|
||||||
|
dolibarr_syslog('User '.$login.' must change password next logon');
|
||||||
|
if ($ldapdebug) print "DEBUG: User ".$login." must change password<br>\n";
|
||||||
|
$ldap->close();
|
||||||
|
|
||||||
|
// On repart sur page accueil
|
||||||
|
session_name($sessionname);
|
||||||
|
session_start();
|
||||||
|
$langs->load('ldap');
|
||||||
|
$_SESSION["loginmesg"]=$langs->trans("UserMustChangePassNextLogon");
|
||||||
|
header('Location: '.DOL_URL_ROOT.'/index.php');
|
||||||
|
exit;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
// On recherche le user dolibarr en fonction de son SID ldap
|
||||||
|
$sid = $ldap->getObjectSid($login);
|
||||||
|
if ($ldapdebug) print "DEBUG: sid = ".$sid."<br>\n";
|
||||||
|
$resultFetchUser=$user->fetch($login,$sid);
|
||||||
|
if ($resultFetchUser > 0)
|
||||||
|
{
|
||||||
|
//TODO: on verifie si le login a change et on met a jour les attributs dolibarr
|
||||||
|
if ($user->login != $ldap->login && $ldap->login)
|
||||||
|
{
|
||||||
|
$user->login = $ldap->login;
|
||||||
|
$user->update($user);
|
||||||
|
}
|
||||||
|
//$resultUpdate = $user->update_ldap2dolibarr();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if ($result == 1)
|
||||||
|
{
|
||||||
|
dolibarr_syslog("functions_ldap::check_user_password_ldap Authentification ko bad user/password pour '".$_POST["username"]."'");
|
||||||
|
sleep(1);
|
||||||
|
$langs->load('main');
|
||||||
|
$langs->load('other');
|
||||||
|
$_SESSION["dol_loginmesg"]=$langs->trans("ErrorBadLoginPassword");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
dolibarr_syslog("functions_ldap::check_user_password_ldap Authentification ko failed to connect to LDAP pour '".$_POST["username"]."'");
|
||||||
|
sleep(1);
|
||||||
|
$langs->load('main');
|
||||||
|
$langs->load('other');
|
||||||
|
$_SESSION["dol_loginmesg"]=$langs->trans("ErrorBadLoginPassword");
|
||||||
|
}
|
||||||
|
|
||||||
|
$ldap->close();
|
||||||
|
}
|
||||||
|
|
||||||
|
return $login;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
?>
|
||||||
@ -1,10 +1,10 @@
|
|||||||
<?php
|
<?php
|
||||||
/* Copyright (C) 2002-2007 Rodolphe Quiedeville <rodolphe@quiedeville.org>
|
/* Copyright (C) 2002-2007 Rodolphe Quiedeville <rodolphe@quiedeville.org>
|
||||||
* Copyright (C) 2003 Xavier Dutoit <doli@sydesy.com>
|
* Copyright (C) 2003 Xavier Dutoit <doli@sydesy.com>
|
||||||
* Copyright (C) 2004-2008 Laurent Destailleur <eldy@users.sourceforge.net>
|
* Copyright (C) 2004-2007 Laurent Destailleur <eldy@users.sourceforge.net>
|
||||||
* Copyright (C) 2004 Sebastien Di Cintio <sdicintio@ressource-toi.org>
|
* Copyright (C) 2004 Sebastien Di Cintio <sdicintio@ressource-toi.org>
|
||||||
* Copyright (C) 2004 Benoit Mortier <benoit.mortier@opensides.be>
|
* Copyright (C) 2004 Benoit Mortier <benoit.mortier@opensides.be>
|
||||||
* Copyright (C) 2005-2008 Regis Houssin <regis@dolibarr.fr>
|
* Copyright (C) 2005-2007 Regis Houssin <regis@dolibarr.fr>
|
||||||
*
|
*
|
||||||
* This program is free software; you can redistribute it and/or modify
|
* This program is free software; you can redistribute it and/or modify
|
||||||
* it under the terms of the GNU General Public License as published by
|
* it under the terms of the GNU General Public License as published by
|
||||||
@ -91,42 +91,20 @@ $bc[1]="class=\"pair\"";
|
|||||||
* Phase identification
|
* Phase identification
|
||||||
*/
|
*/
|
||||||
|
|
||||||
// $authmode contient la liste des differents modes d'identification a tester
|
// $authmode contient la liste des differents modes d'identification a tester par ordre de preference.
|
||||||
// par ordre de preference. Attention, rares sont les combinaisons possibles si
|
// Example: 'http'
|
||||||
// plusieurs modes sont indiques.
|
// Example: 'dolibarr'
|
||||||
// Example: array('http','dolibarr');
|
// Example: 'ldap'
|
||||||
// Example: array('ldap');
|
// Example: 'http,forceuser'
|
||||||
// Example: array('forceuser');
|
|
||||||
$authmode=array();
|
|
||||||
|
|
||||||
// Authentication mode: non defini (cas de compatibilite ascendante)
|
// Authentication mode
|
||||||
if (! $dolibarr_main_authentication)
|
if (empty($dolibarr_main_authentication)) $dolibarr_main_authentication='http,dolibarr';
|
||||||
{
|
|
||||||
// Mode par defaut, on test http + dolibarr
|
|
||||||
$authmode=array('http','dolibarr');
|
|
||||||
}
|
|
||||||
|
|
||||||
// Authentication mode: http
|
|
||||||
if ($dolibarr_main_authentication == 'http')
|
|
||||||
{
|
|
||||||
$authmode=array('http');
|
|
||||||
}
|
|
||||||
// Authentication mode: dolibarr
|
|
||||||
if ($dolibarr_main_authentication == 'dolibarr')
|
|
||||||
{
|
|
||||||
$authmode=array('dolibarr');
|
|
||||||
}
|
|
||||||
// Authentication mode: ldap
|
|
||||||
if ($dolibarr_main_authentication == 'ldap')
|
|
||||||
{
|
|
||||||
$authmode=array('ldap');
|
|
||||||
}
|
|
||||||
// Authentication mode: forceuser
|
// Authentication mode: forceuser
|
||||||
if ($dolibarr_main_authentication == 'forceuser' || isset($dolibarr_auto_user))
|
if ($dolibarr_main_authentication == 'forceuser' && empty($dolibarr_auto_user)) $dolibarr_auto_user='auto';
|
||||||
{
|
|
||||||
$authmode=array('forceuser');
|
// Set authmode
|
||||||
if (! isset($dolibarr_auto_user)) $dolibarr_auto_user='auto';
|
$authmode=split(',',$dolibarr_main_authentication);
|
||||||
}
|
|
||||||
// No authentication mode
|
// No authentication mode
|
||||||
if (! sizeof($authmode))
|
if (! sizeof($authmode))
|
||||||
{
|
{
|
||||||
@ -144,8 +122,6 @@ $test=true;
|
|||||||
if (! isset($_SESSION["dol_login"]))
|
if (! isset($_SESSION["dol_login"]))
|
||||||
{
|
{
|
||||||
// On est pas deja authentifie, on demande le login/mot de passe
|
// On est pas deja authentifie, on demande le login/mot de passe
|
||||||
// A l'issu de cette demande, le login doivent avoir ete place dans dol_login
|
|
||||||
// et en session on place dol_login et dol_password
|
|
||||||
|
|
||||||
// Verification du code securite graphique
|
// Verification du code securite graphique
|
||||||
if ($test && isset($_POST["username"]) && $conf->global->MAIN_SECURITY_ENABLECAPTCHA)
|
if ($test && isset($_POST["username"]) && $conf->global->MAIN_SECURITY_ENABLECAPTCHA)
|
||||||
@ -167,252 +143,43 @@ if (! isset($_SESSION["dol_login"]))
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// MODE AUTO
|
// Tests de validation user/mot de passe
|
||||||
if ($test && in_array('forceuser',$authmode) && ! $login)
|
// Si ok, la variable login doit avoir ete initialisee
|
||||||
|
// Si erreur, on a place message erreur dans session sous le nom dol_loginmesg
|
||||||
|
foreach($authmode as $mode)
|
||||||
{
|
{
|
||||||
$login=$dolibarr_auto_user;
|
if ($test && $mode && ! $login)
|
||||||
dolibarr_syslog ("Authentification ok (en mode force, login=".$login.")");
|
|
||||||
$test=false;
|
|
||||||
}
|
|
||||||
|
|
||||||
// MODE HTTP (Basic)
|
|
||||||
if ($test && in_array('http',$authmode) && ! $login)
|
|
||||||
{
|
|
||||||
if (! empty($_SERVER["REMOTE_USER"]))
|
|
||||||
{
|
{
|
||||||
$login=$_SERVER["REMOTE_USER"];
|
$authfile=DOL_DOCUMENT_ROOT.'/includes/login/functions_'.$mode.'.php';
|
||||||
$test=false;
|
$result=include_once($authfile);
|
||||||
}
|
if ($result)
|
||||||
}
|
|
||||||
|
|
||||||
// MODE DOLIBARR
|
|
||||||
if ($test && in_array('dolibarr',$authmode) && ! $login)
|
|
||||||
{
|
|
||||||
$login='';
|
|
||||||
$usertotest=$_POST["username"];
|
|
||||||
$passwordtotest=$_POST["password"];
|
|
||||||
|
|
||||||
if (! empty($_POST["username"]))
|
|
||||||
{
|
|
||||||
// If test username/password asked, we define $test=false and $login var if ok, set $_SESSION["dol_loginmesg"] if ko
|
|
||||||
$table = MAIN_DB_PREFIX."user";
|
|
||||||
$usernamecol = 'login';
|
|
||||||
|
|
||||||
$sql ='SELECT pass, pass_crypted';
|
|
||||||
$sql.=' from '.$table;
|
|
||||||
$sql.=' where '.$usernamecol." = '".addslashes($_POST["username"])."'";
|
|
||||||
|
|
||||||
dolibarr_syslog("main.inc::get password sql=".$sql);
|
|
||||||
$resql=$db->query($sql);
|
|
||||||
if ($resql)
|
|
||||||
{
|
|
||||||
$obj=$db->fetch_object($resql);
|
|
||||||
if ($obj)
|
|
||||||
{
|
|
||||||
$passclear=$obj->pass;
|
|
||||||
$passcrypted=$obj->pass_crypted;
|
|
||||||
$passtyped=$_POST["password"];
|
|
||||||
|
|
||||||
$passok=false;
|
|
||||||
|
|
||||||
// Check crypted password
|
|
||||||
$cryptType='';
|
|
||||||
if ($conf->global->DATABASE_PWD_ENCRYPTED) $cryptType='md5';
|
|
||||||
if ($cryptType == 'md5')
|
|
||||||
{
|
|
||||||
if (md5($passtyped) == $passcrypted) $passok=true;
|
|
||||||
}
|
|
||||||
|
|
||||||
// For compatibility with old versions
|
|
||||||
if (! $passok)
|
|
||||||
{
|
|
||||||
if ($passtyped == $passclear) $passok=true;
|
|
||||||
}
|
|
||||||
|
|
||||||
// Password ok ?
|
|
||||||
if ($passok)
|
|
||||||
{
|
|
||||||
dolibarr_syslog("Authentification ok (en mode Base Dolibarr)");
|
|
||||||
$login=$_POST["username"];
|
|
||||||
$test=false;
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
dolibarr_syslog("Authentification ko bad password (en mode Base Dolibarr) pour '".$_POST["username"]."'");
|
|
||||||
sleep(1);
|
|
||||||
$langs->load('main');
|
|
||||||
$langs->load('other');
|
|
||||||
$_SESSION["dol_loginmesg"]=$langs->trans("ErrorBadLoginPassword");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
dolibarr_syslog("Authentification ko user not found (en mode Base Dolibarr) pour '".$_POST["username"]."'");
|
|
||||||
sleep(1);
|
|
||||||
$langs->load('main');
|
|
||||||
$langs->load('other');
|
|
||||||
$_SESSION["dol_loginmesg"]=$langs->trans("ErrorBadLoginPassword");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
dolibarr_syslog("Authentification ko db error (en mode Base Dolibarr) pour '".$_POST["username"]."', sql=".$sql);
|
|
||||||
sleep(1);
|
|
||||||
$_SESSION["dol_loginmesg"]=$db->lasterror();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// MODE LDAP
|
|
||||||
if ($test && in_array('ldap',$authmode) && ! $login)
|
|
||||||
{
|
|
||||||
$login='';
|
|
||||||
$usertotest=$_POST["username"];
|
|
||||||
$passwordtotest=$_POST["password"];
|
|
||||||
|
|
||||||
if (! empty($_POST["username"]))
|
|
||||||
{
|
|
||||||
// If test username/password asked, we define $test=false and $login var if ok, set $_SESSION["dol_loginmesg"] if ko
|
|
||||||
$ldaphost=$dolibarr_main_auth_ldap_host;
|
|
||||||
$ldapport=$dolibarr_main_auth_ldap_port;
|
|
||||||
$ldapversion=$dolibarr_main_auth_ldap_version;
|
|
||||||
$ldapservertype=(empty($dolibarr_main_auth_ldap_servertype) ? 'openldap' : $dolibarr_main_auth_ldap_servertype);
|
|
||||||
|
|
||||||
$ldapuserattr=$dolibarr_main_auth_ldap_login_attribute;
|
|
||||||
$ldapdn=$dolibarr_main_auth_ldap_dn;
|
|
||||||
$ldapadminlogin=$dolibarr_main_auth_ldap_admin_login;
|
|
||||||
$ldapadminpass=$dolibarr_main_auth_ldap_admin_pass;
|
|
||||||
$ldapdebug=(empty($dolibarr_main_auth_ldap_debug) || $dolibarr_main_auth_ldap_debug=="false" ? false : true);
|
|
||||||
|
|
||||||
if ($ldapdebug) print "DEBUG: Logging LDAP steps<br>\n";
|
|
||||||
|
|
||||||
// Debut code pour compatibilite (prend info depuis config en base)
|
|
||||||
// Ne plus utiliser. La config LDAP de connexion doit etre dans le
|
|
||||||
// fichier conf.php
|
|
||||||
if (! $ldapuserattr && $conf->ldap->enabled)
|
|
||||||
{
|
{
|
||||||
if ($conf->global->LDAP_SERVER_TYPE == "activedirectory")
|
$usertotest=$_POST["username"];
|
||||||
{
|
$passwordtotest=$_POST["password"];
|
||||||
$ldapuserattr = $conf->global->LDAP_FIELD_LOGIN_SAMBA;
|
$function='check_user_password_'.$mode;
|
||||||
}
|
$login=$function($usertotest,$passwordtotest);
|
||||||
else
|
if ($login) $test=false;
|
||||||
{
|
|
||||||
$ldapuserattr = $conf->global->LDAP_FIELD_LOGIN;
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
if (! $ldaphost) $ldaphost=$conf->global->LDAP_SERVER_HOST;
|
else
|
||||||
if (! $ldapport) $ldapport=$conf->global->LDAP_SERVER_PORT;
|
|
||||||
if (! $ldapservertype) $ldapservertype=$conf->global->LDAP_SERVER_TYPE;
|
|
||||||
if (! $ldapversion) $ldapversion=$conf->global->LDAP_SERVER_PROTOCOLVERSION;
|
|
||||||
if (! $ldapdn) $ldapdn=$conf->global->LDAP_SERVER_DN;
|
|
||||||
if (! $ldapadminlogin) $ldapadminlogin=$conf->global->LDAP_ADMIN_DN;
|
|
||||||
if (! $ldapadminpass) $ldapadminpass=$conf->global->LDAP_ADMIN_PASS;
|
|
||||||
// Fin code pour compatiblite
|
|
||||||
|
|
||||||
require_once(DOL_DOCUMENT_ROOT."/lib/ldap.class.php");
|
|
||||||
$ldap=new Ldap();
|
|
||||||
$ldap->server=array($ldaphost);
|
|
||||||
$ldap->serverPort=$ldapport;
|
|
||||||
$ldap->ldapProtocolVersion=$ldapversion;
|
|
||||||
$ldap->serverType=$ldapservertype;
|
|
||||||
$ldap->searchUser=$ldapadminlogin;
|
|
||||||
$ldap->searchPassword=$ldapadminpass;
|
|
||||||
|
|
||||||
if ($ldapdebug) dolibarr_syslog("Authentification LDAP --> Server:".join(',',$ldap->server).", Port:".$ldap->serverPort.", Protocol:".$ldap->ldapProtocolVersion.", Type:".$ldap->serverType.", Admin:".$ldap->searchUser.", Pass:".$ldap->searchPassword);
|
|
||||||
|
|
||||||
$result=$ldap->connect_bind();
|
|
||||||
$resultCheckUserDN = $ldap->checkPass($usertotest,$passwordtotest);
|
|
||||||
$ldap->close();
|
|
||||||
|
|
||||||
$ldap->searchUser=$usertotest;
|
|
||||||
if ($resultCheckUserDN) $ldap->searchUser = $ldap->ldapUserDN;
|
|
||||||
$ldap->searchPassword=$passwordtotest;
|
|
||||||
|
|
||||||
$result=$ldap->connect_bind();
|
|
||||||
if ($result > 0)
|
|
||||||
{
|
{
|
||||||
if ($result == 2)
|
dolibarr_syslog("Authentification ko - failed to load file '".$authfile."'");
|
||||||
{
|
|
||||||
dolibarr_syslog("Authentification ok (en mode LDAP)");
|
|
||||||
$login=$_POST["username"];
|
|
||||||
$test=false;
|
|
||||||
|
|
||||||
// ldap2dolibarr synchronisation
|
|
||||||
if ($login && $conf->ldap->enabled && $conf->global->LDAP_SYNCHRO_ACTIVE == 'ldap2dolibarr')
|
|
||||||
{
|
|
||||||
// On charge les attributs du user ldap
|
|
||||||
if ($ldapdebug) print "DEBUG: login ldap = ".$login."<br>\n";
|
|
||||||
$ldap->fetch($login);
|
|
||||||
|
|
||||||
if ($ldapdebug) print "DEBUG: UACF = ".join(',',$ldap->uacf)."<br>\n";
|
|
||||||
if ($ldapdebug) print "DEBUG: pwdLastSet = ".dolibarr_print_date($ldap->pwdlastset,'day')."<br>\n";
|
|
||||||
if ($ldapdebug) print "DEBUG: badPasswordTime = ".dolibarr_print_date($ldap->badpwdtime,'day')."<br>\n";
|
|
||||||
|
|
||||||
|
|
||||||
// On stop si le mot de passe ldap doit etre modifie
|
|
||||||
if ($ldap->pwdlastset == 0)
|
|
||||||
{
|
|
||||||
session_destroy();
|
|
||||||
dolibarr_syslog('User '.$login.' must change password next logon');
|
|
||||||
if ($ldapdebug) print "DEBUG: User ".$login." must change password<br>\n";
|
|
||||||
$ldap->close();
|
|
||||||
|
|
||||||
// On repart sur page accueil
|
|
||||||
session_name($sessionname);
|
|
||||||
session_start();
|
|
||||||
$langs->load('ldap');
|
|
||||||
$_SESSION["loginmesg"]=$langs->trans("UserMustChangePassNextLogon");
|
|
||||||
header('Location: '.DOL_URL_ROOT.'/index.php');
|
|
||||||
exit;
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
// On recherche le user dolibarr en fonction de son SID ldap
|
|
||||||
$sid = $ldap->getObjectSid($login);
|
|
||||||
if ($ldapdebug) print "DEBUG: sid = ".$sid."<br>\n";
|
|
||||||
$resultFetchUser=$user->fetch($login,$sid);
|
|
||||||
if ($resultFetchUser > 0)
|
|
||||||
{
|
|
||||||
//TODO: on verifie si le login a change et on met a jour les attributs dolibarr
|
|
||||||
if ($user->login != $ldap->login && $ldap->login)
|
|
||||||
{
|
|
||||||
$user->login = $ldap->login;
|
|
||||||
$user->update($user);
|
|
||||||
}
|
|
||||||
//$resultUpdate = $user->update_ldap2dolibarr();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if ($result == 1)
|
|
||||||
{
|
|
||||||
dolibarr_syslog("Authentification ko bad password (en mode LDAP) pour '".$_POST["username"]."'");
|
|
||||||
sleep(1);
|
|
||||||
$langs->load('main');
|
|
||||||
$langs->load('other');
|
|
||||||
$_SESSION["dol_loginmesg"]=$langs->trans("ErrorBadLoginPassword");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
else
|
|
||||||
{
|
|
||||||
dolibarr_syslog("Authentification ko failed to connect to LDAP (en mode LDAP) pour '".$_POST["username"]."'");
|
|
||||||
sleep(1);
|
sleep(1);
|
||||||
$langs->load('main');
|
$langs->load('main');
|
||||||
$langs->load('other');
|
$langs->load('other');
|
||||||
$_SESSION["dol_loginmesg"]=$langs->trans("ErrorBadLoginPassword");
|
$_SESSION["dol_loginmesg"]=$langs->trans("ErrorFailedToLoadLoginFileForMode",$mode);
|
||||||
}
|
}
|
||||||
$ldap->close();
|
}
|
||||||
}
|
}
|
||||||
}
|
|
||||||
|
// Fin des tests de login/passwords
|
||||||
if (! $login)
|
if (! $login)
|
||||||
{
|
{
|
||||||
// We show login page
|
// We show login page
|
||||||
dol_loginfunction($langs,$conf,$mysoc);
|
dol_loginfunction($langs,$conf,$mysoc);
|
||||||
exit;
|
exit;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (!$resultFetchUser) $resultFetchUser=$user->fetch($login);
|
if (!$resultFetchUser) $resultFetchUser=$user->fetch($login);
|
||||||
|
|
||||||
if ($resultFetchUser <= 0)
|
if ($resultFetchUser <= 0)
|
||||||
{
|
{
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user