Add reverse-proxy with ldap plugin

README.markdown

@@ -33,7 +33,8 @@ From command line:
 
 Infos
 -----
-Kanboard v1.0.21
+Kanboard v1.0.24
+Reverse-Proxy Authentication with LDAP user provider plugin v1.0.0 https://github.com/kanboard/plugin-reverse-proxy-ldap
 
 Yunohost forum thread:  <https://forum.yunohost.org/t/kanboard-package/78>
 

conf/config.php

@@ -50,7 +50,7 @@ define('DB_PORT', null);
 define('LDAP_AUTH', false);
 
 // LDAP server hostname
-define('LDAP_SERVER', '');
+define('LDAP_SERVER', 'localhost');
 
 // LDAP server port (389 by default)
 define('LDAP_PORT', 389);
@@ -78,12 +78,12 @@ define('LDAP_PASSWORD', null);
 // LDAP DN for users
 // Example for ActiveDirectory: CN=Users,DC=kanboard,DC=local
 // Example for OpenLDAP: ou=People,dc=example,dc=com
-define('LDAP_USER_BASE_DN', '');
+define('LDAP_USER_BASE_DN', 'ou=users,dc=yunohost,dc=org');
 
 // LDAP pattern to use when searching for a user account
 // Example for ActiveDirectory: '(&(objectClass=user)(sAMAccountName=%s))'
 // Example for OpenLDAP: 'uid=%s'
-define('LDAP_USER_FILTER', '');
+define('LDAP_USER_FILTER', 'uid=%s');
 
 // LDAP attribute for username
 // Example for ActiveDirectory: 'samaccountname'
@@ -93,7 +93,7 @@ define('LDAP_USER_ATTRIBUTE_USERNAME', 'uid');
 // LDAP attribute for user full name
 // Example for ActiveDirectory: 'displayname'
 // Example for OpenLDAP: 'cn'
-define('LDAP_USER_ATTRIBUTE_FULLNAME', 'cn');
+define('LDAP_USER_ATTRIBUTE_FULLNAME', 'displayname');
 
 // LDAP attribute for user email
 define('LDAP_USER_ATTRIBUTE_EMAIL', 'mail');
@@ -172,7 +172,7 @@ define('GITLAB_OAUTH_TOKEN_URL', 'https://gitlab.com/oauth/token');
 define('GITLAB_API_URL', 'https://gitlab.com/api/v3/');
 
 // Enable/disable the reverse proxy authentication
-define('REVERSE_PROXY_AUTH', true);
+define('REVERSE_PROXY_AUTH', false);
 
 // Header name to use for the username
 define('REVERSE_PROXY_USER_HEADER', 'REMOTE_USER');

sources/plugins/.gitignore

@@ -1,2 +0,0 @@
-*
-!/.gitignore

sources/plugins/ReverseProxyLdap/Auth/ReverseProxyLdapAuth.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace Kanboard\Plugin\ReverseProxyLdap\Auth;
+
+use Kanboard\Auth\ReverseProxyAuth;
+use Kanboard\Core\Ldap\Client as LdapClient;
+use Kanboard\Core\Ldap\ClientException as LdapException;
+use Kanboard\Core\Ldap\User as LdapUser;
+
+/**
+ * Reverse-Proxy Ldap Authentication Provider
+ *
+ * @package  auth
+ * @author   Frederic Guillot
+ */
+class ReverseProxyLdapAuth extends ReverseProxyAuth
+{
+    /**
+     * Get authentication provider name
+     *
+     * @access public
+     * @return string
+     */
+    public function getName()
+    {
+        return 'ReverseProxyLdap';
+    }
+
+    /**
+     * Authenticate the user
+     *
+     * @access public
+     * @return boolean
+     */
+    public function authenticate()
+    {
+        try {
+
+            $username = $this->request->getRemoteUser();
+
+            if (! empty($username)) {
+
+                $client = LdapClient::connect();
+                $user = LdapUser::getUser($client, $username);
+
+                if ($user === null) {
+                    $this->logger->info('User not found in LDAP server');
+                    return false;
+                }
+
+                if ($user->getUsername() === '') {
+                    throw new LogicException('Username not found in LDAP profile, check the parameter LDAP_USER_ATTRIBUTE_USERNAME');
+                }
+
+                $this->userInfo = $user;
+
+                return true;
+            }
+
+        } catch (LdapException $e) {
+            $this->logger->error($e->getMessage());
+        }
+
+        return false;
+    }
+}

sources/plugins/ReverseProxyLdap/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2015 Frédéric Guillot
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

sources/plugins/ReverseProxyLdap/Makefile

@@ -0,0 +1,3 @@
+all:
+	@ echo "Build archive for plugin ${plugin} version=${version}"
+	@ git archive HEAD --prefix=${plugin}/ --format=zip -o ${plugin}-${version}.zip

sources/plugins/ReverseProxyLdap/Plugin.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Kanboard\Plugin\ReverseProxyLdap;
+
+use Kanboard\Core\Plugin\Base;
+use Kanboard\Plugin\ReverseProxyLdap\Auth\ReverseProxyLdapAuth;
+
+/**
+ * Reverse-Proxy Authentication with LDAP support
+ *
+ * @package  reverseproxyldap
+ * @author   Frederic Guillot
+ */
+class Plugin extends Base
+{
+    public function initialize()
+    {
+        $this->authenticationManager->register(new ReverseProxyLdapAuth($this->container));
+    }
+
+    public function getPluginDescription()
+    {
+        return 'Authenticate users with Reverse-Proxy method but populate user information from the LDAP directory';
+    }
+
+    public function getPluginAuthor()
+    {
+        return 'Frédéric Guillot';
+    }
+
+    public function getPluginVersion()
+    {
+        return '1.0.0';
+    }
+
+    public function getPluginHomepage()
+    {
+        return 'https://github.com/kanboard/plugin-reverse-proxy-ldap';
+    }
+}

sources/plugins/ReverseProxyLdap/README.md

@@ -0,0 +1,23 @@
+Reverse-Proxy Authentication plugin with LDAP support for Kanboard
+==================================================================
+
+Authenticate users with Reverse-Proxy method but populate user information from the LDAP directory.
+
+Author
+------
+
+- Frédéric Guillot
+- License MIT
+
+Installation
+------------
+
+- Create a folder **plugins/ReverseProxyLdap** or uncompress the latest archive in the folder **plugins**
+- Copy all files under this directory
+
+Configuration
+-------------
+
+- You must have LDAP configured in proxy mode in Kanboard
+- Reverse-Proxy server configured correctly, the config parameter `REVERSE_PROXY_USER_HEADER` must be defined
+- You **don't need** to set to `true` those constants: `LDAP_AUTH` and `REVERSE_PROXY_AUTH`