splitbrain /
dokuwiki
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 83 | $this->loadConfig(); |
||
| 84 | |||
| 85 | // additional information fields |
||
| 86 | if(isset($this->conf['additional'])) { |
||
|
|
|||
| 87 | $this->conf['additional'] = str_replace(' ', '', $this->conf['additional']); |
||
| 88 | $this->conf['additional'] = explode(',', $this->conf['additional']); |
||
| 89 | } else $this->conf['additional'] = array(); |
||
| 90 | |||
| 91 | // ldap extension is needed |
||
| 92 | if(!function_exists('ldap_connect')) { |
||
| 93 | if($this->conf['debug']) |
||
| 94 | msg("AD Auth: PHP LDAP extension not found.", -1); |
||
| 95 | $this->success = false; |
||
| 96 | return; |
||
| 107 | } |
||
| 108 | |||
| 109 | // trust the incoming user |
||
| 110 | if($this->conf['sso']) { |
||
| 111 | $_SERVER['REMOTE_USER'] = $this->cleanUser($_SERVER['REMOTE_USER']); |
||
| 112 | |||
| 113 | // we need to simulate a login |
||
| 152 | public function checkPass($user, $pass) { |
||
| 153 | if($_SERVER['REMOTE_USER'] && |
||
| 154 | $_SERVER['REMOTE_USER'] == $user && |
||
| 155 | $this->conf['sso'] |
||
| 156 | ) return true; |
||
| 157 | |||
| 158 | $adldap = $this->_adldap($this->_userDomain($user)); |
||
| 198 | $fields = array('mail', 'displayname', 'samaccountname', 'lastpwd', 'pwdlastset', 'useraccountcontrol'); |
||
| 199 | |||
| 200 | // add additional fields to read |
||
| 201 | $fields = array_merge($fields, $this->conf['additional']); |
||
| 202 | $fields = array_unique($fields); |
||
| 203 | $fields = array_filter($fields); |
||
| 204 | |||
| 220 | $info['expires'] = !($result[0]['useraccountcontrol'][0] & 0x10000); //ADS_UF_DONT_EXPIRE_PASSWD |
||
| 221 | |||
| 222 | // additional information |
||
| 223 | foreach($this->conf['additional'] as $field) { |
||
| 224 | if(isset($result[0][strtolower($field)])) { |
||
| 225 | $info[$field] = $result[0][strtolower($field)][0]; |
||
| 226 | } |
||
| 247 | } |
||
| 248 | |||
| 249 | // check expiry time |
||
| 250 | if($info['expires'] && $this->conf['expirywarn']){ |
||
| 251 | $expiry = $adldap->user()->passwordExpiry($user); |
||
| 252 | if(is_array($expiry)){ |
||
| 253 | $info['expiresat'] = $expiry['expiryts']; |
||
| 255 | |||
| 256 | // if this is the current user, warn him (once per request only) |
||
| 257 | if(($_SERVER['REMOTE_USER'] == $user) && |
||
| 258 | ($info['expiresin'] <= $this->conf['expirywarn']) && |
||
| 259 | !$this->msgshown |
||
| 260 | ) { |
||
| 261 | $msg = sprintf($this->getLang('authpwdexpire'), $info['expiresin']); |
||
| 313 | $user = utf8_strtolower(trim($user)); |
||
| 314 | |||
| 315 | // is this a known, valid domain? if not discard |
||
| 316 | if(!is_array($this->conf[$domain])) { |
||
| 317 | $domain = ''; |
||
| 318 | } |
||
| 319 | |||
| 532 | try { |
||
| 533 | $return = $adldap->user()->password($this->_userName($user),$changes['pass']); |
||
| 534 | } catch (adLDAPException $e) { |
||
| 535 | if ($this->conf['debug']) msg('AD Auth: '.$e->getMessage(), -1); |
||
| 536 | $return = false; |
||
| 537 | } |
||
| 538 | if(!$return) msg($this->getLang('passchangefail'), -1); |
||
| 554 | try { |
||
| 555 | $return = $return & $adldap->user()->modify($this->_userName($user),$adchanges); |
||
| 556 | } catch (adLDAPException $e) { |
||
| 557 | if ($this->conf['debug']) msg('AD Auth: '.$e->getMessage(), -1); |
||
| 558 | $return = false; |
||
| 559 | } |
||
| 560 | if(!$return) msg($this->getLang('userchangefail'), -1); |
||
| 586 | $this->adldap[$domain] = new adLDAP($this->opts); |
||
| 587 | return $this->adldap[$domain]; |
||
| 588 | } catch(adLDAPException $e) { |
||
| 589 | if($this->conf['debug']) { |
||
| 590 | msg('AD Auth: '.$e->getMessage(), -1); |
||
| 591 | } |
||
| 592 | $this->success = false; |
||
| 625 | */ |
||
| 626 | protected function _loadServerConfig($domain) { |
||
| 627 | // prepare adLDAP standard configuration |
||
| 628 | $opts = $this->conf; |
||
| 629 | |||
| 630 | $opts['domain'] = $domain; |
||
| 631 | |||
| 632 | // add possible domain specific configuration |
||
| 633 | if($domain && is_array($this->conf[$domain])) foreach($this->conf[$domain] as $key => $val) { |
||
| 634 | $opts[$key] = $val; |
||
| 635 | } |
||
| 636 | |||
| 673 | */ |
||
| 674 | public function _getConfiguredDomains() { |
||
| 675 | $domains = array(); |
||
| 676 | if(empty($this->conf['account_suffix'])) return $domains; // not configured yet |
||
| 677 | |||
| 678 | // add default domain, using the name from account suffix |
||
| 679 | $domains[''] = ltrim($this->conf['account_suffix'], '@'); |
||
| 680 | |||
| 681 | // find additional domains |
||
| 682 | foreach($this->conf as $key => $val) { |
||
| 683 | if(is_array($val) && isset($val['account_suffix'])) { |
||
| 684 | $domains[$key] = ltrim($val['account_suffix'], '@'); |
||
| 685 | } |
||
| 730 |
Andreas Gohr
Loading history...
This check looks for access to properties that are not accessible from the current context.
If you need to make a property accessible to another context you can either raise its visibility level or provide an accessible getter in the defining class.