diff --git a/README.markdown b/README.markdown index 72d0772..d42a67a 100644 --- a/README.markdown +++ b/README.markdown @@ -33,7 +33,8 @@ From command line: Infos ----- -Kanboard v1.0.21 +Kanboard v1.0.24 +Reverse-Proxy Authentication with LDAP user provider plugin v1.0.0 https://github.com/kanboard/plugin-reverse-proxy-ldap Yunohost forum thread: diff --git a/conf/config.php b/conf/config.php index cdd245a..fd637cb 100644 --- a/conf/config.php +++ b/conf/config.php @@ -50,7 +50,7 @@ define('DB_PORT', null); define('LDAP_AUTH', false); // LDAP server hostname -define('LDAP_SERVER', ''); +define('LDAP_SERVER', 'localhost'); // LDAP server port (389 by default) define('LDAP_PORT', 389); @@ -78,12 +78,12 @@ define('LDAP_PASSWORD', null); // LDAP DN for users // Example for ActiveDirectory: CN=Users,DC=kanboard,DC=local // Example for OpenLDAP: ou=People,dc=example,dc=com -define('LDAP_USER_BASE_DN', ''); +define('LDAP_USER_BASE_DN', 'ou=users,dc=yunohost,dc=org'); // LDAP pattern to use when searching for a user account // Example for ActiveDirectory: '(&(objectClass=user)(sAMAccountName=%s))' // Example for OpenLDAP: 'uid=%s' -define('LDAP_USER_FILTER', ''); +define('LDAP_USER_FILTER', 'uid=%s'); // LDAP attribute for username // Example for ActiveDirectory: 'samaccountname' @@ -93,7 +93,7 @@ define('LDAP_USER_ATTRIBUTE_USERNAME', 'uid'); // LDAP attribute for user full name // Example for ActiveDirectory: 'displayname' // Example for OpenLDAP: 'cn' -define('LDAP_USER_ATTRIBUTE_FULLNAME', 'cn'); +define('LDAP_USER_ATTRIBUTE_FULLNAME', 'displayname'); // LDAP attribute for user email define('LDAP_USER_ATTRIBUTE_EMAIL', 'mail'); @@ -172,7 +172,7 @@ define('GITLAB_OAUTH_TOKEN_URL', 'https://gitlab.com/oauth/token'); define('GITLAB_API_URL', 'https://gitlab.com/api/v3/'); // Enable/disable the reverse proxy authentication -define('REVERSE_PROXY_AUTH', true); +define('REVERSE_PROXY_AUTH', false); // Header name to use for the username define('REVERSE_PROXY_USER_HEADER', 'REMOTE_USER'); diff --git a/sources/plugins/.gitignore b/sources/plugins/.gitignore deleted file mode 100644 index 120f485..0000000 --- a/sources/plugins/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -* -!/.gitignore diff --git a/sources/plugins/ReverseProxyLdap/Auth/ReverseProxyLdapAuth.php b/sources/plugins/ReverseProxyLdap/Auth/ReverseProxyLdapAuth.php new file mode 100644 index 0000000..466f761 --- /dev/null +++ b/sources/plugins/ReverseProxyLdap/Auth/ReverseProxyLdapAuth.php @@ -0,0 +1,66 @@ +request->getRemoteUser(); + + if (! empty($username)) { + + $client = LdapClient::connect(); + $user = LdapUser::getUser($client, $username); + + if ($user === null) { + $this->logger->info('User not found in LDAP server'); + return false; + } + + if ($user->getUsername() === '') { + throw new LogicException('Username not found in LDAP profile, check the parameter LDAP_USER_ATTRIBUTE_USERNAME'); + } + + $this->userInfo = $user; + + return true; + } + + } catch (LdapException $e) { + $this->logger->error($e->getMessage()); + } + + return false; + } +} diff --git a/sources/plugins/ReverseProxyLdap/LICENSE b/sources/plugins/ReverseProxyLdap/LICENSE new file mode 100644 index 0000000..95e5a2e --- /dev/null +++ b/sources/plugins/ReverseProxyLdap/LICENSE @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2015 Frédéric Guillot + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/sources/plugins/ReverseProxyLdap/Makefile b/sources/plugins/ReverseProxyLdap/Makefile new file mode 100644 index 0000000..e10760a --- /dev/null +++ b/sources/plugins/ReverseProxyLdap/Makefile @@ -0,0 +1,3 @@ +all: + @ echo "Build archive for plugin ${plugin} version=${version}" + @ git archive HEAD --prefix=${plugin}/ --format=zip -o ${plugin}-${version}.zip diff --git a/sources/plugins/ReverseProxyLdap/Plugin.php b/sources/plugins/ReverseProxyLdap/Plugin.php new file mode 100644 index 0000000..c440e92 --- /dev/null +++ b/sources/plugins/ReverseProxyLdap/Plugin.php @@ -0,0 +1,40 @@ +authenticationManager->register(new ReverseProxyLdapAuth($this->container)); + } + + public function getPluginDescription() + { + return 'Authenticate users with Reverse-Proxy method but populate user information from the LDAP directory'; + } + + public function getPluginAuthor() + { + return 'Frédéric Guillot'; + } + + public function getPluginVersion() + { + return '1.0.0'; + } + + public function getPluginHomepage() + { + return 'https://github.com/kanboard/plugin-reverse-proxy-ldap'; + } +} diff --git a/sources/plugins/ReverseProxyLdap/README.md b/sources/plugins/ReverseProxyLdap/README.md new file mode 100644 index 0000000..f9557cf --- /dev/null +++ b/sources/plugins/ReverseProxyLdap/README.md @@ -0,0 +1,23 @@ +Reverse-Proxy Authentication plugin with LDAP support for Kanboard +================================================================== + +Authenticate users with Reverse-Proxy method but populate user information from the LDAP directory. + +Author +------ + +- Frédéric Guillot +- License MIT + +Installation +------------ + +- Create a folder **plugins/ReverseProxyLdap** or uncompress the latest archive in the folder **plugins** +- Copy all files under this directory + +Configuration +------------- + +- You must have LDAP configured in proxy mode in Kanboard +- Reverse-Proxy server configured correctly, the config parameter `REVERSE_PROXY_USER_HEADER` must be defined +- You **don't need** to set to `true` those constants: `LDAP_AUTH` and `REVERSE_PROXY_AUTH`