YunoHost-Apps/baikal_ynh
1
0
Fork 0
mirror of https://github.com/YunoHost-Apps/baikal_ynh.git synced 2024-09-03 18:16:11 +02:00
Code Issues Activity Actions
baikal_ynh/sources/patches/app-add-ldap-auth.patch
Maniack Crudelis 1aea3f3c49 Fix install + refactoring
2017-08-26 19:19:30 +02:00

317 lines
11 KiB
Diff
Raw Blame History

--- b/Core/Frameworks/Baikal/Core/AbstractExternalAuth.php
+++ b/Core/Frameworks/Baikal/Core/AbstractExternalAuth.php
@@ -0,0 +1,130 @@
+<?php
+
+namespace Baikal\Core;
+
+/**
+ * This is an abstract authentication, that allows to create external
+ * authentication backends. User are automatic created, when the does not exists
+ * in baikal (can disabled).
+ *
+ * @author Sascha Kuehndel (InuSasha) <dev@inusasha.de>
+ * @license http://code.google.com/p/sabredav/wiki/License Modified BSD License
+ */
+abstract class AbstractExternalAuth extends \Sabre\DAV\Auth\Backend\AbstractBasic {
+
+ /**
+ * enable autocreation of user
+ *
+ * @var PDO
+ */
+ protected $enableAutoCreation;
+
+ /**
+ * Reference to PDO connection
+ *
+ * @var PDO
+ */
+ private $pdo;
+
+ /**
+ * PDO table name we'll be using
+ *
+ * @var string
+ */
+ private $tableName;
+
+ /**
+ * Creates the backend object.
+ *
+ * If the filename argument is passed in, it will parse out the specified file fist.
+ *
+ * @param PDO $pdo
+ * @param string $realm
+ * @param string $tableName The PDO table name to use
+ */
+ public function __construct(\PDO $pdo, $realm = 'BaikalDAV', $tableName = 'users') {
+
+ $this->pdo = $pdo;
+ $this->tableName = $tableName;
+ $this->enableAutoCreation = true;
+ }
+
+ /**
+ * Validates a username and password
+ *
+ * This method should return true or false depending on if login
+ * succeeded.
+ *
+ * @param string $username
+ * @param string $password
+ * @return bool
+ */
+ public function validateUserPass($username, $password) {
+
+ if (!$this->validateUserPassExternal($username, $password))
+ return false;
+
+ $this->currentUser = $username;
+ if ($this->enableAutoCreation)
+ $this->autoUserCreation($username);
+
+ return true;
+ }
+
+ /**
+ * Validates a username and password agains external backend
+ *
+ * This method should return true or false depending on if login
+ * succeeded.
+ *
+ * @param string $username
+ * @param string $password
+ * @return bool
+ */
+ public abstract function validateUserPassExternal($username, $password);
+
+ /**
+ * return the displayname and email from the external Backend
+ *
+ * @param string $username
+ * @return array ('displayname' => string, 'email' => string)
+ */
+ public function getAccountValues($username) {
+
+ return array();
+ }
+
+ /**
+ * create an internal user, when user not exists
+ *
+ * @param string $username
+ */
+ private function autoUserCreation($username) {
+
+ /* search user in DB and do nothing, when user exists */
+ $stmt = $this->pdo->prepare('SELECT username FROM '.$this->tableName.' WHERE username = ?');
+ $stmt->execute(array($username));
+ $result = $stmt->fetchAll();
+ if (count($result) != 0)
+ return;
+
+ /* get account values from backend */
+ $values = $this->getAccountValues($username);
+ if (!isset($values['displayname']) OR strlen($values['displayname']) === 0)
+ $values['displayname'] = $username;
+ if (!isset($values['email']) OR strlen($values['email']) === 0) {
+ if(filter_var($username, FILTER_VALIDATE_EMAIL))
+ $values['email'] = $username;
+ else
+ $values['email'] = 'unset-mail';
+ }
+
+ /* create user */
+ $user = new \Baikal\Model\User();
+ $user->set('username', $username);
+ $user->set('displayname', $values['displayname']);
+ $user->set('email', $values['email']);
+ $user->persist();
+ }
+
+}
--- b/Core/Frameworks/Baikal/Core/LDAPUserBindAuth.php
+++ b/Core/Frameworks/Baikal/Core/LDAPUserBindAuth.php
@@ -0,0 +1,75 @@
+<?php
+
+namespace Baikal\Core;
+
+/**
+ * This is an authentication backend that uses a ldap backend to authenticate user.
+ *
+ * @author Sascha Kuehndel (InuSasha) <dev@inusasha.de>
+ * @license http://code.google.com/p/sabredav/wiki/License Modified BSD License
+ */
+class LDAPUserBindAuth extends AbstractExternalAuth {
+
+ /**
+ * AccountValues for getAccountValues
+ *
+ * @var array ('displayname' => string, 'email' => string)
+ */
+ private $accountValues;
+
+ /**
+ * Validates a username and password over ldap
+ *
+ * @param string $username
+ * @param string $password
+ * @return bool
+ */
+ public function validateUserPassExternal($username, $password) {
+
+ /* create ldap connection */
+ $conn = ldap_connect(BAIKAL_DAV_LDAP_URI);
+ if (!$conn)
+ return false;
+ if (!ldap_set_option($conn, LDAP_OPT_PROTOCOL_VERSION, 3))
+ return false;
+
+ /* bind with user
+ * error_handler have to change, because a failed bind raises an error
+ * this raise a secuity issue because in the stack trace is the password of user readable
+ */
+ $arr = explode('@', $username, 2);
+ $dn = str_replace('%n', $username, BAIKAL_DAV_LDAP_DN_TEMPLATE);
+ $dn = str_replace('%u', $arr[0], $dn);
+ if(isset($arr[1])) $dn = str_replace('%d', $arr[1], $dn);
+
+ set_error_handler("\Baikal\Core\LDAPUserBindAuth::exception_error_handler");
+ $bind = ldap_bind($conn, $dn, $password);
+ restore_error_handler();
+ if (!$bind) {
+ ldap_close($conn);
+ return false;
+ }
+
+ /* read displayname and email from user */
+ $this->accountValues = array();
+ $sr = ldap_read($conn, $dn, '(objectclass=*)', array(BAIKAL_DAV_LDAP_DISPLAYNAME_ATTR, BAIKAL_DAV_LDAP_EMAIL_ATTR));
+ $entry = ldap_get_entries($conn, $sr);
+ if (isset($entry[0][BAIKAL_DAV_LDAP_DISPLAYNAME_ATTR][0]))
+ $this->accountValues['displayname'] = $entry[0][BAIKAL_DAV_LDAP_DISPLAYNAME_ATTR][0];
+ if (isset($entry[0][BAIKAL_DAV_LDAP_EMAIL_ATTR][0]))
+ $this->accountValues['email'] = $entry[0][BAIKAL_DAV_LDAP_EMAIL_ATTR][0];
+
+ /* close */
+ ldap_close($conn);
+ return true;
+ }
+
+ public function getAccountValues($username) {
+
+ return $this->accountValues;
+ }
+
+ # WorkAround error_handler in failed bind of LDAP
+ public static function exception_error_handler($errno, $errstr, $errfile, $errline) {
+ }
+}
diff --git a/Core/Frameworks/Baikal/Core/Server.php b/Core/Frameworks/Baikal/Core/Server.php
index 8026854..8d306fe 100644
--- a/Core/Frameworks/Baikal/Core/Server.php
+++ b/Core/Frameworks/Baikal/Core/Server.php
@@ -133,6 +133,8 @@ class Server {
if ($this->authType === 'Basic') {
$authBackend = new \Baikal\Core\PDOBasicAuth($this->pdo, $this->authRealm);
+ } elseif ($this->authType === 'LDAP-UserBind') {
+ $authBackend = new \Baikal\Core\LDAPUserBindAuth($this->pdo, $this->authRealm);
} else {
$authBackend = new \Sabre\DAV\Auth\Backend\PDO($this->pdo);
$authBackend->setRealm($this->authRealm);
diff --git a/Core/Frameworks/Baikal/Model/Config/Standard.php b/Core/Frameworks/Baikal/Model/Config/Standard.php
index 6107377..39f90bd 100644
--- a/Core/Frameworks/Baikal/Model/Config/Standard.php
+++ b/Core/Frameworks/Baikal/Model/Config/Standard.php
@@ -46,6 +46,22 @@ class Standard extends \Baikal\Model\Config {
"type" => "string",
"comment" => "HTTP authentication type for WebDAV; default Digest"
],
+ "BAIKAL_DAV_LDAP_URI" => [
+ "type" => "string",
+ "comment" => "URI to LDAP Server (for ldap-userbind auth); default ldapi:///"
+ ],
+ "BAIKAL_DAV_LDAP_DN_TEMPLATE" => [
+ "type" => "string",
+ "comment" => "User DN for bind; with replacments %n => username, %u => user part, %d => domain part of username"
+ ],
+ "BAIKAL_DAV_LDAP_DISPLAYNAME_ATTR" => [
+ "type" => "string",
+ "comment" => "LDAP-attribute for displayname; default cn"
+ ],
+ "BAIKAL_DAV_LDAP_EMAIL_ATTR" => [
+ "type" => "string",
+ "comment" => "LDAP-attribute for email; default mail"
+ ],
"BAIKAL_ADMIN_PASSWORDHASH" => [
"type" => "string",
"comment" => "Baïkal Web admin password hash; Set via Baïkal Web Admin",
@@ -58,6 +74,10 @@ class Standard extends \Baikal\Model\Config {
"BAIKAL_CARD_ENABLED" => true,
"BAIKAL_CAL_ENABLED" => true,
"BAIKAL_DAV_AUTH_TYPE" => "Digest",
+ "BAIKAL_DAV_LDAP_URI" => "ldapi:///",
+ "BAIKAL_DAV_LDAP_DN_TEMPLATE" => "uid=%n,dc=example,dc=com",
+ "BAIKAL_DAV_LDAP_DISPLAYNAME_ATTR" => "cn",
+ "BAIKAL_DAV_LDAP_EMAIL_ATTR" => "mail",
"BAIKAL_ADMIN_PASSWORDHASH" => ""
];
@@ -85,7 +105,31 @@ class Standard extends \Baikal\Model\Config {
$oMorpho->add(new \Formal\Element\Listbox([
"prop" => "BAIKAL_DAV_AUTH_TYPE",
"label" => "WebDAV authentication type",
- "options" => [ "Digest", "Basic" ]
+ "options" => [ "Digest", "Basic", "LDAP-UserBind" ]
+ ]));
+
+ $oMorpho->add(new \Formal\Element\Text([
+ "prop" => "BAIKAL_DAV_LDAP_URI",
+ "label" => "LDAP URI"
+ ]));
+
+ $oMorpho->add(new \Formal\Element\Text([
+ "prop" => "BAIKAL_DAV_LDAP_DN_TEMPLATE",
+ "label" => "LDAP DN template",
+ "popover" => [
+ "title" => "posible placeholder",
+ "content" => "<strong>%n</strong> - username<br /><strong>%u</strong> - user part of username , when it is an email address)<br /><strong>%d</strong> - domain part",
+ ]
+ ]));
+
+ $oMorpho->add(new \Formal\Element\Text([
+ "prop" => "BAIKAL_DAV_LDAP_DISPLAYNAME_ATTR",
+ "label" => "LDAP attribute for DisplayName"
+ ]));
+
+ $oMorpho->add(new \Formal\Element\Text([
+ "prop" => "BAIKAL_DAV_LDAP_EMAIL_ATTR",
+ "label" => "LDAP attribute for eMail"
]));
$oMorpho->add(new \Formal\Element\Password([
@@ -180,6 +224,21 @@ define("BAIKAL_CAL_ENABLED", TRUE);
# WebDAV authentication type; default Digest
define("BAIKAL_DAV_AUTH_TYPE", "Digest");
+# Auth Backend LDAP-UserBind; LDAP URI
+define("BAIKAL_DAV_LDAP_URI", 'ldapi:///');
+
+# Auth Backend LDAP-UserBind; Template for userbind
+# %n => username
+# %u => user part of username when it is an email
+# %u => domain part of username when it is an email
+define("BAIKAL_DAV_LDAP_DN_TEMPLATE", 'cn=%u,dc=%d,ou=domains,o=server');
+
+# Auth Backend LDAP-UserBind; attribute for displayname
+define("BAIKAL_DAV_LDAP_DISPLAYNAME_ATTR", 'cn');
+
+# Auth Backend LDAP-UserBind; attribute for email
+define("BAIKAL_DAV_LDAP_EMAIL_ATTR", 'mail');
+
# Baïkal Web admin password hash; Set via Baïkal Web Admin
define("BAIKAL_ADMIN_PASSWORDHASH", "");
CODE;
Reference in a new issue View git blame Copy permalink