ldap.php

太烦了

    function _getBaseDN()
    {
        if ($this->options['basedn'] == "" && $this->_isValidLink()) {           
            $this->_debug("basedn not set, searching via namingContexts.", __LINE__);

            $result_id = @ldap_read($this->conn_id, "", "(objectclass=*)", array("namingContexts"));
            
            if (ldap_count_entries($this->conn_id, $result_id) == 1) {
                
                $this->_debug("got result for namingContexts", __LINE__);
                
                $entry_id = ldap_first_entry($this->conn_id, $result_id);
                $attrs = ldap_get_attributes($this->conn_id, $entry_id);
                $basedn = $attrs['namingContexts'][0];

                if ($basedn != "") {
                    $this->_debug("result for namingContexts was $basedn", __LINE__);
                    $this->options['basedn'] = $basedn;
                }
            }
            ldap_free_result($result_id);
        }

        // if base ist still not set, raise error
        if ($this->options['basedn'] == "") {
            return PEAR::raiseError("Auth_Container_LDAP: LDAP search base not specified!", 41, PEAR_ERROR_DIE);
        }        
        return true;
    }

    /**
     * determines whether there is a valid ldap conenction or not
     *
     * @accessd private
     * @return boolean
     */
    function _isValidLink() 
    {
        if(is_resource($this->conn_id)) {
            if(get_resource_type($this->conn_id) == 'ldap link') {
                return true;
            }
        }
        return false;
    }

    /**
     * Set some default options
     *
     * @access private
     */
    function _setDefaults()
    {
        $this->options['host']        = 'localhost';
        $this->options['port']        = '389';
        $this->options['binddn']      = '';
        $this->options['bindpw']      = '';
        $this->options['scope']       = 'sub';
        $this->options['basedn']      = '';
        $this->options['userdn']      = '';
        $this->options['userattr']    = "uid";
        $this->options['useroc']      = 'posixAccount';
        $this->options['groupdn']     = '';
        $this->options['groupattr']   = 'cn';
        $this->options['groupoc']     = 'groupOfUniqueNames';
        $this->options['memberattr']  = 'uniqueMember';
        $this->options['memberisdn']  = true;
        $this->options['debug']       = false;
    }

    /**
     * Parse options passed to the container class
     *
     * @access private
     * @param  array
     */
    function _parseOptions($array)
    {
        foreach ($array as $key => $value) {
            $this->options[$key] = $value;
        }

        // get the according search function for selected scope
        switch($this->options['scope']) {
        case 'one':
            $this->ldap_search_func = 'ldap_list';
            break;
        case 'base':
            $this->ldap_search_func = 'ldap_read';
            break;
        default:
            $this->ldap_search_func = 'ldap_search';
            break;
        }
        $this->_debug("LDAP search function will be: {$this->ldap_search_func}", __LINE__);
    }

    /**
     * Fetch data from LDAP server
     *
     * Searches the LDAP server for the given username/password
     * combination.
     *
     * @param  string Username
     * @param  string Password
     * @return boolean
     */
    function fetchData($username, $password)
    {        

        $this->_connect();
        $this->_getBaseDN();
        
        // make search filter
        $filter = sprintf('(&(objectClass=%s)(%s=%s))', $this->options['useroc'], $this->options['userattr'], $username);

        // make search base dn
        $search_basedn = $this->options['userdn'];
        if ($search_basedn != '' && substr($search_basedn, -1) != ',') {
            $search_basedn .= ',';
        }
        $search_basedn .= $this->options['basedn'];
        
        // make functions params array
        $func_params = array($this->conn_id, $search_basedn, $filter, array($this->options['userattr']));

        $this->_debug("Searching with $filter in $search_basedn", __LINE__);

        // search
        if (($result_id = @call_user_func_array($this->ldap_search_func, $func_params)) == false) {
            $this->_debug('User not found', __LINE__);
        } elseif (ldap_count_entries($this->conn_id, $result_id) == 1) { // did we get just one entry?

            $this->_debug('User was found', __LINE__);
            
            // then get the user dn
            $entry_id = ldap_first_entry($this->conn_id, $result_id);
            $user_dn  = ldap_get_dn($this->conn_id, $entry_id);

            ldap_free_result($result_id);

            // need to catch an empty password as openldap seems to return TRUE
            // if anonymous binding is allowed
            if ($password != "") {
                $this->_debug("Bind as $user_dn", __LINE__);                

                // try binding as this user with the supplied password
                if (@ldap_bind($this->conn_id, $user_dn, $password)) {
                    $this->_debug('Bind successful', __LINE__);

                    // check group if appropiate
                    if(isset($this->options['group'])) {
                        // decide whether memberattr value is a dn or the username
                        $this->_debug('Checking group membership', __LINE__);
                        return $this->checkGroup(($this->options['memberisdn']) ? $user_dn : $username);
                    } else {
                        $this->_debug('Authenticated', __LINE__);
                        $this->_disconnect();
                        return true; // user authenticated
                    } // checkGroup
                } // bind
            } // non-empty password
        } // one entry
        // default
        $this->_debug('NOT authenticated!', __LINE__);
        $this->_disconnect();
        return false;
    }

    /**
     * Validate group membership
     *
     * Searches the LDAP server for group membership of the
     * authenticated user
     *
     * @param  string Distinguished Name of the authenticated User
     * @return boolean
     */
    function checkGroup($user) 
    {
        // make filter
        $filter = sprintf('(&(%s=%s)(objectClass=%s)(%s=%s))',
                          $this->options['groupattr'],
                          $this->options['group'],
                          $this->options['groupoc'],
                          $this->options['memberattr'],
                          $user
                          );

        // make search base dn
        $search_basedn = $this->options['groupdn'];
        if($search_basedn != '' && substr($search_basedn, -1) != ',') {
            $search_basedn .= ',';
        }
        $search_basedn .= $this->options['basedn'];
        
        $func_params = array($this->conn_id, $search_basedn, $filter, array($this->options['memberattr']));

        $this->_debug("Searching with $filter in $search_basedn", __LINE__);
        
        // search
        if(($result_id = @call_user_func_array($this->ldap_search_func, $func_params)) != false) {
            if(ldap_count_entries($this->conn_id, $result_id) == 1) {                
                ldap_free_result($result_id);
                $this->_debug('User is member of group', __LINE__);
                $this->_disconnect();
                return true;
            }
        }

        // default
        $this->_debug('User is NOT member of group', __LINE__);
        $this->_disconnect();
        return false;
    }

    /**
     * Outputs debugging messages
     *
     * @access private
     * @param string Debugging Message
     * @param integer Line number
     */
    function _debug($msg = '', $line = 0)
    {
        if($this->options['debug'] === true) {
            if($msg == '' && $this->_isValidLink()) {
                $msg = 'LDAP_Error: ' . @ldap_err2str(@ldap_errno($this->_conn_id));
            }
            print("$line: $msg <br />");
        }
    }
}

?>