mirror of
https://github.com/stylersnico/librenms.git
synced 2026-07-27 16:08:55 +02:00
Merge pull request #2411 from fstern/active_directory_auth
Adding active directory authentication to librenms
This commit is contained in:
Neil Lathwood
@@ -9,7 +9,9 @@ Here we will provide configuration details for these modules.
|
||||
|
||||
- LDAP: ldap
|
||||
|
||||
HTTP Auth: http-auth
|
||||
- Active Directory: active_directory
|
||||
|
||||
- HTTP Auth: http-auth
|
||||
|
||||
#### User levels
|
||||
|
||||
@@ -99,3 +101,27 @@ $config['auth_ldap_groupmemberattr'] = "memberUid";
|
||||
```
|
||||
|
||||
Replace {id} with the unique ID provided by Jumpcloud.
|
||||
|
||||
#### Active Directory Authentication
|
||||
|
||||
Config option: `active_directory`
|
||||
|
||||
This is similar to LDAP Authentication. Install __php_ldap__ for CentOS/RHEL or __php5-ldap__ for Debian/Ubuntu.
|
||||
|
||||
If you have issues with secure LDAP try setting `$config['auth_ad_dont_check_certificates']` to `1`.
|
||||
|
||||
##### Require actual membership of the configured groups
|
||||
|
||||
If you set ```$config['auth_ad_require_groupmembership']``` to 1, the authenticated user has to be a member of the specific group. Otherwise all users can authenticate, but are limited to user level 0 and only have access to shared dashboards.
|
||||
|
||||
##### Sample configuration
|
||||
|
||||
```
|
||||
$config['auth_ad_url'] = "ldaps://your-domain.controll.er";
|
||||
$config['auth_ad_dont_check_certificates'] = 1; // or 0
|
||||
$config['auth_ad_domain'] = "your-domain.com";
|
||||
$config['auth_ad_base_dn'] = "dc=your-domain,dc=com";
|
||||
$config['auth_ad_groups']['admin']['level'] = 10;
|
||||
$config['auth_ad_groups']['pfy']['level'] = 7;
|
||||
$config['auth_ad_require_groupmembership'] = 0;
|
||||
```
|
||||
|
||||
@@ -0,0 +1,288 @@
|
||||
<?php
|
||||
|
||||
// easier to rewrite for Active Directory than to bash it into existing LDAP implementation
|
||||
|
||||
$ds = @ldap_connect($config['auth_ad_url']);
|
||||
|
||||
// disable referrals and force ldap version to 3
|
||||
|
||||
ldap_set_option($ds, LDAP_OPT_REFERRALS, 0);
|
||||
ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
|
||||
|
||||
// disable certificate checking if required
|
||||
|
||||
if (isset($config['auth_ad_dont_check_certificates']) &&
|
||||
$config['auth_ad_dont_check_certificates'] > 0) {
|
||||
putenv('LDAPTLS_REQCERT=never');
|
||||
};
|
||||
|
||||
function authenticate($username, $password) {
|
||||
global $config, $ds;
|
||||
|
||||
if ($username && $ds) {
|
||||
// bind with sAMAccountName instead of full LDAP DN
|
||||
if (ldap_bind($ds, "{$username}@{$config['auth_ad_domain']}", $password)) {
|
||||
// group membership in one of the configured groups is required
|
||||
if (isset($config['auth_ad_require_groupmembership']) &&
|
||||
$config['auth_ad_require_groupmembership'] > 0) {
|
||||
$search = ldap_search($ds, $config['auth_ad_base_dn'],
|
||||
"(samaccountname={$username})", array('memberOf'));
|
||||
$entries = ldap_get_entries($ds, $search);
|
||||
|
||||
$user_authenticated = 0;
|
||||
|
||||
foreach ($entries[0]['memberof'] as $entry) {
|
||||
$group_cn = get_cn($entry);
|
||||
if (isset($config['auth_ad_groups'][$group_cn]['level'])) {
|
||||
// user is in one of the defined groups
|
||||
$user_authenticated = 1;
|
||||
}
|
||||
}
|
||||
|
||||
return $user_authenticated;
|
||||
|
||||
}
|
||||
else {
|
||||
// group membership is not required and user is valid
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
else {
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
else {
|
||||
echo ldap_error($ds);
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
function reauthenticate() {
|
||||
// not supported so return 0
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
function passwordscanchange() {
|
||||
// not supported so return 0
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
function changepassword() {
|
||||
// not supported so return 0
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
function auth_usermanagement() {
|
||||
// not supported so return 0
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
function adduser() {
|
||||
// not supported so return 0
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
function user_exists($username) {
|
||||
global $config, $ds;
|
||||
|
||||
$search = ldap_search($ds, $config['auth_ad_base_dn'],
|
||||
"(samaccountname={$username})",array('samaccountname'));
|
||||
$entries = ldap_get_entries($ds, $search);
|
||||
|
||||
|
||||
if ($entries['count']) {
|
||||
return 1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
function get_userlevel($username) {
|
||||
global $config, $ds;
|
||||
|
||||
$userlevel = 0;
|
||||
|
||||
// Find all defined groups $username is in
|
||||
$search = ldap_search($ds, $config['auth_ad_base_dn'],
|
||||
"(samaccountname={$username})", array('memberOf'));
|
||||
$entries = ldap_get_entries($ds, $search);
|
||||
|
||||
// Loop the list and find the highest level
|
||||
foreach ($entries[0]['memberof'] as $entry) {
|
||||
$group_cn = get_cn($entry);
|
||||
if ($config['auth_ad_groups'][$group_cn]['level'] > $userlevel) {
|
||||
$userlevel = $config['auth_ad_groups'][$group_cn]['level'];
|
||||
}
|
||||
}
|
||||
|
||||
return $userlevel;
|
||||
}
|
||||
|
||||
|
||||
function get_userid($username) {
|
||||
global $config, $ds;
|
||||
|
||||
$attributes = array('objectsid');
|
||||
$search = ldap_search($ds, $config['auth_ad_base_dn'],
|
||||
"(samaccountname={$username})", $attributes);
|
||||
$entries = ldap_get_entries($ds, $search);
|
||||
|
||||
if ($entries['count']) {
|
||||
return preg_replace('/.*-(\d+)$/','$1',sid_from_ldap($entries[0]['objectsid'][0]));
|
||||
}
|
||||
|
||||
return -1;
|
||||
}
|
||||
|
||||
|
||||
function deluser() {
|
||||
// not supported so return 0
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
function get_userlist() {
|
||||
global $config, $ds;
|
||||
$userlist = array();
|
||||
$userhash = array();
|
||||
|
||||
$ldap_groups = get_group_list();
|
||||
|
||||
foreach($ldap_groups as $ldap_group) {
|
||||
$group_cn = get_cn($ldap_group);
|
||||
$search = ldap_search($ds, $config['auth_ad_base_dn'], "(cn={$group_cn})", array('member'));
|
||||
$entries = ldap_get_entries($ds, $search);
|
||||
|
||||
foreach($entries[0]['member'] as $member) {
|
||||
$member_cn = get_cn($member);
|
||||
$search = ldap_search($ds, $config['auth_ad_base_dn'], "(cn={$member_cn})",
|
||||
array('sAMAccountname', 'displayName', 'objectSID', 'mail'));
|
||||
$results = ldap_get_entries($ds, $search);
|
||||
foreach($results as $result) {
|
||||
if(isset($result['samaccountname'][0])) {
|
||||
$userid = preg_replace('/.*-(\d+)$/','$1',
|
||||
sid_from_ldap($result['objectsid'][0]));
|
||||
|
||||
// don't make duplicates, user may be member of more than one group
|
||||
$userhash[$result['samaccountname'][0]] = array(
|
||||
'realname' => $result['displayName'][0],
|
||||
'user_id' => $userid,
|
||||
'email' => $result['mail'][0]
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
foreach(array_keys($userhash) as $key) {
|
||||
$userlist[] = array(
|
||||
'username' => $key,
|
||||
'realname' => $userhash[$key]['realname'],
|
||||
'user_id' => $userhash[$key]['user_id'],
|
||||
'email' => $userhash[$key]['email']
|
||||
);
|
||||
}
|
||||
|
||||
return $userlist;
|
||||
}
|
||||
|
||||
|
||||
function can_update_users() {
|
||||
// not supported so return 0
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
function get_user($user_id) {
|
||||
// not supported so return 0
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
function update_user($user_id, $realname, $level, $can_modify_passwd, $email) {
|
||||
// not supported so return 0
|
||||
return 0;
|
||||
|
||||
}
|
||||
|
||||
|
||||
function get_fullname($username) {
|
||||
global $config, $ds;
|
||||
|
||||
$attributes = array('name');
|
||||
$result = ldap_search($ds, $config['auth_ad_base_dn'],
|
||||
"(samaccountname={$username})", $attributes);
|
||||
$entries = ldap_get_entries($ds, $result);
|
||||
if ($entries['count'] > 0) {
|
||||
$membername = $entries[0]['name'][0];
|
||||
}
|
||||
else {
|
||||
$membername = $username;
|
||||
}
|
||||
|
||||
return $membername;
|
||||
}
|
||||
|
||||
|
||||
function get_group_list() {
|
||||
global $config;
|
||||
|
||||
$ldap_groups = array();
|
||||
|
||||
// show all Active Directory Users by default
|
||||
$default_group = 'Users';
|
||||
|
||||
if (isset($config['auth_ad_group'])) {
|
||||
if ($config['auth_ad_group'] !== $default_group) {
|
||||
$ldap_groups[] = $config['auth_ad_group'];
|
||||
}
|
||||
}
|
||||
|
||||
if (!isset($config['auth_ad_groups']) && !isset($config['auth_ad_group'])) {
|
||||
$ldap_groups[] = get_dn($default_group);
|
||||
}
|
||||
|
||||
foreach ($config['auth_ad_groups'] as $key => $value) {
|
||||
$ldap_groups[] = get_dn($key);
|
||||
}
|
||||
|
||||
return $ldap_groups;
|
||||
|
||||
}
|
||||
|
||||
function get_dn($samaccountname) {
|
||||
global $config, $ds;
|
||||
|
||||
|
||||
$attributes = array('dn');
|
||||
$result = ldap_search($ds, $config['auth_ad_base_dn'],
|
||||
"(samaccountname={$samaccountname})", $attributes);
|
||||
$entries = ldap_get_entries($ds, $result);
|
||||
if ($entries['count'] > 0) {
|
||||
return $entries[0]['dn'];
|
||||
}
|
||||
else {
|
||||
return '';
|
||||
}
|
||||
}
|
||||
|
||||
function get_cn($dn) {
|
||||
preg_match('/[^,]*/', $dn, $matches, PREG_OFFSET_CAPTURE, 3);
|
||||
return $matches[0][0];
|
||||
}
|
||||
|
||||
function sid_from_ldap($sid)
|
||||
{
|
||||
$sidHex = unpack('H*hex', $sid);
|
||||
$subAuths = unpack('H2/H2/n/N/V*', $sid);
|
||||
$revLevel = hexdec(substr($sidHex, 0, 2));
|
||||
$authIdent = hexdec(substr($sidHex, 4, 12));
|
||||
return 'S-'.$revLevel.'-'.$authIdent.'-'.implode('-', $subAuths);
|
||||
}
|
||||
Reference in New Issue
Block a user