From 00f77f8bdf33b3a1d7d671045951c30824788d57 Mon Sep 17 00:00:00 2001 From: Tyler Christiansen Date: Tue, 7 Apr 2015 11:48:29 -0700 Subject: [PATCH 1/6] add feature to loop all groups for auth --- html/includes/authentication/ldap.inc.php | 31 +++++++++++++++++------ 1 file changed, 23 insertions(+), 8 deletions(-) diff --git a/html/includes/authentication/ldap.inc.php b/html/includes/authentication/ldap.inc.php index 3073b1e65..d39ecd8b7 100644 --- a/html/includes/authentication/ldap.inc.php +++ b/html/includes/authentication/ldap.inc.php @@ -15,7 +15,7 @@ if ($config['auth_ldap_starttls'] && ($config['auth_ldap_starttls'] == 'optional function authenticate($username,$password) { global $config, $ds; - + if ($username && $ds) { if ($config['auth_ldap_version']) @@ -30,9 +30,12 @@ function authenticate($username,$password) } else { - if (ldap_compare($ds,$config['auth_ldap_group'], $config['auth_ldap_groupmemberattr'],get_membername($username))===true) - { - return 1; + $ldap_groups = get_group_list(); + foreach($ldap_groups as $ldap_group) { + if (ldap_compare($ds,$ldap_group, $config['auth_ldap_groupmemberattr'],get_membername($username))===true) + { + return 1; + } } } } @@ -153,10 +156,12 @@ function get_userlist() $username = $entry['uid'][0]; $realname = $entry['cn'][0]; $user_id = $entry['uidnumber'][0]; - - if (!isset($config['auth_ldap_group']) || ldap_compare($ds,$config['auth_ldap_group'],$config['auth_ldap_groupmemberattr'],get_membername($username))===true) - { - $userlist[] = array('username' => $username, 'realname' => $realname, 'user_id' => $user_id); + $ldap_groups = get_group_list(); + foreach($ldap_groups as $ldap_group) { + if (!isset($config['auth_ldap_group']) || ldap_compare($ds,$config['auth_ldap_group'],$config['auth_ldap_groupmemberattr'],get_membername($username))===true) + { + $userlist[] = array('username' => $username, 'realname' => $realname, 'user_id' => $user_id); + } } } } @@ -196,4 +201,14 @@ function get_membername ($username) return $membername; } +function get_group_list() { + $ldap_groups = []; + $ldap_groups[] = $config['auth_ldap_groupbase']; + foreach($config['auth_ldap_groups'] as $key => $value) { + $dn = "cn=$key," . $config['auth_ldap_groupbase']; + $ldap_groups[] = $dn; + } + return $ldap_groups; +} + ?> From 2e233e0d5c92969cf715d9985202a7c190a85410 Mon Sep 17 00:00:00 2001 From: Tyler Christiansen Date: Tue, 7 Apr 2015 12:10:55 -0700 Subject: [PATCH 2/6] add global config, fix get_userlist --- html/includes/authentication/ldap.inc.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/html/includes/authentication/ldap.inc.php b/html/includes/authentication/ldap.inc.php index d39ecd8b7..a142807c2 100644 --- a/html/includes/authentication/ldap.inc.php +++ b/html/includes/authentication/ldap.inc.php @@ -32,7 +32,7 @@ function authenticate($username,$password) { $ldap_groups = get_group_list(); foreach($ldap_groups as $ldap_group) { - if (ldap_compare($ds,$ldap_group, $config['auth_ldap_groupmemberattr'],get_membername($username))===true) + if (ldap_compare($ds, $ldap_group, $config['auth_ldap_groupmemberattr'], get_membername($username))===true) { return 1; } @@ -158,7 +158,7 @@ function get_userlist() $user_id = $entry['uidnumber'][0]; $ldap_groups = get_group_list(); foreach($ldap_groups as $ldap_group) { - if (!isset($config['auth_ldap_group']) || ldap_compare($ds,$config['auth_ldap_group'],$config['auth_ldap_groupmemberattr'],get_membername($username))===true) + if (!isset($config['auth_ldap_group']) || ldap_compare($ds, $ldap_group, $config['auth_ldap_groupmemberattr'], get_membername($username))===true) { $userlist[] = array('username' => $username, 'realname' => $realname, 'user_id' => $user_id); } @@ -202,6 +202,8 @@ function get_membername ($username) } function get_group_list() { + global $config; + $ldap_groups = []; $ldap_groups[] = $config['auth_ldap_groupbase']; foreach($config['auth_ldap_groups'] as $key => $value) { From cb5a62087e3cc9cfa5978a91ae8e62d1276b545e Mon Sep 17 00:00:00 2001 From: Tyler Christiansen Date: Tue, 7 Apr 2015 12:21:52 -0700 Subject: [PATCH 3/6] make code more backward-compatible --- html/includes/authentication/ldap.inc.php | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/html/includes/authentication/ldap.inc.php b/html/includes/authentication/ldap.inc.php index a142807c2..ab2f100ac 100644 --- a/html/includes/authentication/ldap.inc.php +++ b/html/includes/authentication/ldap.inc.php @@ -204,11 +204,14 @@ function get_membername ($username) function get_group_list() { global $config; - $ldap_groups = []; - $ldap_groups[] = $config['auth_ldap_groupbase']; + $ldap_groups = array(); + $default_group = 'cn=groupname,ou=groups,dc=example,dc=com'; + if($config['auth_ldap_group'] !== $default_group) { + array_push($ldap_groups, $config['auth_ldap_group']); + } foreach($config['auth_ldap_groups'] as $key => $value) { $dn = "cn=$key," . $config['auth_ldap_groupbase']; - $ldap_groups[] = $dn; + array_push($ldap_groups, $dn); } return $ldap_groups; } From b41605a13a402eeaa857dfe632772925bcbbd5dd Mon Sep 17 00:00:00 2001 From: Tyler Christiansen Date: Tue, 7 Apr 2015 12:30:02 -0700 Subject: [PATCH 4/6] clean up code and add more detection --- html/includes/authentication/ldap.inc.php | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/html/includes/authentication/ldap.inc.php b/html/includes/authentication/ldap.inc.php index ab2f100ac..ef122771b 100644 --- a/html/includes/authentication/ldap.inc.php +++ b/html/includes/authentication/ldap.inc.php @@ -32,8 +32,11 @@ function authenticate($username,$password) { $ldap_groups = get_group_list(); foreach($ldap_groups as $ldap_group) { - if (ldap_compare($ds, $ldap_group, $config['auth_ldap_groupmemberattr'], get_membername($username))===true) - { + $ldap_comparison = ldap_compare($ds, + $ldap_group, + $config['auth_ldap_groupmemberattr'], + get_membername($username)); + if($ldap_comparison === true) { return 1; } } @@ -158,8 +161,11 @@ function get_userlist() $user_id = $entry['uidnumber'][0]; $ldap_groups = get_group_list(); foreach($ldap_groups as $ldap_group) { - if (!isset($config['auth_ldap_group']) || ldap_compare($ds, $ldap_group, $config['auth_ldap_groupmemberattr'], get_membername($username))===true) - { + $ldap_comparison = ldap_compare($ds, + $ldap_group, + $config['auth_ldap_groupmemberattr'], + get_membername($username)); + if (!isset($config['auth_ldap_group']) || ldap_compare($ldap_comparison === true)) { $userlist[] = array('username' => $username, 'realname' => $realname, 'user_id' => $user_id); } } @@ -206,8 +212,10 @@ function get_group_list() { $ldap_groups = array(); $default_group = 'cn=groupname,ou=groups,dc=example,dc=com'; - if($config['auth_ldap_group'] !== $default_group) { - array_push($ldap_groups, $config['auth_ldap_group']); + if(isset($config['auth_ldap_group'])) { + if($config['auth_ldap_group'] !== $default_group) { + array_push($ldap_groups, $config['auth_ldap_group']); + } } foreach($config['auth_ldap_groups'] as $key => $value) { $dn = "cn=$key," . $config['auth_ldap_groupbase']; From d4f472e9cbe3567462ea469f5d155beab4933b6c Mon Sep 17 00:00:00 2001 From: Tyler Christiansen Date: Tue, 7 Apr 2015 13:58:31 -0700 Subject: [PATCH 5/6] stop ldap_compare() from running against ldap_comparison, which would result in an error --- html/includes/authentication/ldap.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/includes/authentication/ldap.inc.php b/html/includes/authentication/ldap.inc.php index ef122771b..c5e2fb686 100644 --- a/html/includes/authentication/ldap.inc.php +++ b/html/includes/authentication/ldap.inc.php @@ -165,7 +165,7 @@ function get_userlist() $ldap_group, $config['auth_ldap_groupmemberattr'], get_membername($username)); - if (!isset($config['auth_ldap_group']) || ldap_compare($ldap_comparison === true)) { + if (!isset($config['auth_ldap_group']) || $ldap_comparison === true) { $userlist[] = array('username' => $username, 'realname' => $realname, 'user_id' => $user_id); } } From 1663b743db2b7bce5a6da9037a0ae1773fd9659f Mon Sep 17 00:00:00 2001 From: Tyler Christiansen Date: Tue, 7 Apr 2015 14:03:30 -0700 Subject: [PATCH 6/6] remove array_push is inefficient and we dont care about its return value --- html/includes/authentication/ldap.inc.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/html/includes/authentication/ldap.inc.php b/html/includes/authentication/ldap.inc.php index c5e2fb686..7b479f7f7 100644 --- a/html/includes/authentication/ldap.inc.php +++ b/html/includes/authentication/ldap.inc.php @@ -214,12 +214,12 @@ function get_group_list() { $default_group = 'cn=groupname,ou=groups,dc=example,dc=com'; if(isset($config['auth_ldap_group'])) { if($config['auth_ldap_group'] !== $default_group) { - array_push($ldap_groups, $config['auth_ldap_group']); + $ldap_groups[] = $config['auth_ldap_group']; } } foreach($config['auth_ldap_groups'] as $key => $value) { $dn = "cn=$key," . $config['auth_ldap_groupbase']; - array_push($ldap_groups, $dn); + $ldap_groups[] = $dn; } return $ldap_groups; }