Merge branch 'master' into talmdal
BIN
client/Java/Demo.class
Normal file
50
client/Java/Demo.java
Normal file
@ -0,0 +1,50 @@
|
||||
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import java.io.BufferedReader;
|
||||
import java.io.InputStreamReader;
|
||||
|
||||
import com.google.gson.Gson;
|
||||
|
||||
import org.apache.http.HttpEntity;
|
||||
import org.apache.http.HttpResponse;
|
||||
import org.apache.http.NameValuePair;
|
||||
import org.apache.http.client.entity.UrlEncodedFormEntity;
|
||||
import org.apache.http.client.methods.HttpGet;
|
||||
import org.apache.http.client.methods.HttpPost;
|
||||
import org.apache.http.cookie.Cookie;
|
||||
import org.apache.http.impl.client.DefaultHttpClient;
|
||||
import org.apache.http.message.BasicNameValuePair;
|
||||
import org.apache.http.protocol.HTTP;
|
||||
|
||||
public class Demo {
|
||||
public static final String BASE_URL = "http://example.com/gallery3/index.php";
|
||||
public static final String USERNAME = "admin";
|
||||
public static final String PASSWORD = "admin";
|
||||
|
||||
public static void main(String[] argv) throws java.io.UnsupportedEncodingException, java.io.IOException {
|
||||
DefaultHttpClient httpclient = new DefaultHttpClient();
|
||||
HttpResponse response;
|
||||
Gson gson = new Gson();
|
||||
|
||||
// Get the REST API key
|
||||
HttpPost post = new HttpPost(BASE_URL + "/rest");
|
||||
ArrayList<NameValuePair> nvps = new ArrayList <NameValuePair>();
|
||||
nvps.add(new BasicNameValuePair("user", USERNAME));
|
||||
nvps.add(new BasicNameValuePair("password", USERNAME));
|
||||
post.setEntity(new UrlEncodedFormEntity(nvps, HTTP.UTF_8));
|
||||
response = httpclient.execute(post);
|
||||
String api_key = gson.fromJson(new BufferedReader(
|
||||
new InputStreamReader(response.getEntity().getContent())).readLine(), String.class);
|
||||
System.out.println("API Key:" + api_key);
|
||||
|
||||
// Get the JSON representation of the root album, which we know has id 1
|
||||
HttpGet get = new HttpGet(BASE_URL + "/rest/item/1");
|
||||
get.setHeader("X-Gallery-Request-Method", "GET");
|
||||
get.setHeader("X-Gallery-Request-Key", api_key);
|
||||
response = httpclient.execute(get);
|
||||
|
||||
System.out.println(
|
||||
"Response: " + new BufferedReader(new InputStreamReader(response.getEntity().getContent())).readLine());
|
||||
}
|
||||
}
|
10
client/Java/README
Normal file
@ -0,0 +1,10 @@
|
||||
This is very, very rough sample code for how to do some Java REST
|
||||
requests. To run this code:
|
||||
|
||||
1) Edit Demo.java and set the BASE_URL to your Gallery3 install.
|
||||
2) Edit USERNAME and PASSWORD as appropriate
|
||||
3) In a shell, do "sh build.sh"
|
||||
4) In a shell, do "sh run.sh"
|
||||
|
||||
Note that there is NO error checking, so if something goes wrong
|
||||
you'll have to debug it.
|
1
client/Java/build.sh
Normal file
@ -0,0 +1 @@
|
||||
javac -classpath lib/httpclient-4.0.1.jar:lib/httpcore-4.0.1.jar:lib/gson-1.4.jar Demo.java
|
BIN
client/Java/lib/commons-logging-api-1.1.1.jar
Normal file
BIN
client/Java/lib/gson-1.4.jar
Normal file
BIN
client/Java/lib/httpclient-4.0.1.jar
Normal file
BIN
client/Java/lib/httpcore-4.0.1.jar
Normal file
1
client/Java/run.sh
Normal file
@ -0,0 +1 @@
|
||||
java -classpath lib/httpclient-4.0.1.jar:lib/httpcore-4.0.1.jar:lib/commons-logging-api-1.1.1.jar:lib/gson-1.4.jar:. Demo
|
Before Width: | Height: | Size: 22 KiB After Width: | Height: | Size: 22 KiB |
Before Width: | Height: | Size: 8.3 KiB After Width: | Height: | Size: 8.3 KiB |
340
modules/pam/LICENSE
Executable file
@ -0,0 +1,340 @@
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
Version 2, June 1991
|
||||
|
||||
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
|
||||
51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
License is intended to guarantee your freedom to share and change free
|
||||
software--to make sure the software is free for all its users. This
|
||||
General Public License applies to most of the Free Software
|
||||
Foundation's software and to any other program whose authors commit to
|
||||
using it. (Some other Free Software Foundation software is covered by
|
||||
the GNU Library General Public License instead.) You can apply it to
|
||||
your programs, too.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not
|
||||
price. Our General Public Licenses are designed to make sure that you
|
||||
have the freedom to distribute copies of free software (and charge for
|
||||
this service if you wish), that you receive source code or can get it
|
||||
if you want it, that you can change the software or use pieces of it
|
||||
in new free programs; and that you know you can do these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
anyone to deny you these rights or to ask you to surrender the rights.
|
||||
These restrictions translate to certain responsibilities for you if you
|
||||
distribute copies of the software, or if you modify it.
|
||||
|
||||
For example, if you distribute copies of such a program, whether
|
||||
gratis or for a fee, you must give the recipients all the rights that
|
||||
you have. You must make sure that they, too, receive or can get the
|
||||
source code. And you must show them these terms so they know their
|
||||
rights.
|
||||
|
||||
We protect your rights with two steps: (1) copyright the software, and
|
||||
(2) offer you this license which gives you legal permission to copy,
|
||||
distribute and/or modify the software.
|
||||
|
||||
Also, for each author's protection and ours, we want to make certain
|
||||
that everyone understands that there is no warranty for this free
|
||||
software. If the software is modified by someone else and passed on, we
|
||||
want its recipients to know that what they have is not the original, so
|
||||
that any problems introduced by others will not reflect on the original
|
||||
authors' reputations.
|
||||
|
||||
Finally, any free program is threatened constantly by software
|
||||
patents. We wish to avoid the danger that redistributors of a free
|
||||
program will individually obtain patent licenses, in effect making the
|
||||
program proprietary. To prevent this, we have made it clear that any
|
||||
patent must be licensed for everyone's free use or not licensed at all.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow.
|
||||
|
||||
GNU GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License applies to any program or other work which contains
|
||||
a notice placed by the copyright holder saying it may be distributed
|
||||
under the terms of this General Public License. The "Program", below,
|
||||
refers to any such program or work, and a "work based on the Program"
|
||||
means either the Program or any derivative work under copyright law:
|
||||
that is to say, a work containing the Program or a portion of it,
|
||||
either verbatim or with modifications and/or translated into another
|
||||
language. (Hereinafter, translation is included without limitation in
|
||||
the term "modification".) Each licensee is addressed as "you".
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running the Program is not restricted, and the output from the Program
|
||||
is covered only if its contents constitute a work based on the
|
||||
Program (independent of having been made by running the Program).
|
||||
Whether that is true depends on what the Program does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Program's
|
||||
source code as you receive it, in any medium, provided that you
|
||||
conspicuously and appropriately publish on each copy an appropriate
|
||||
copyright notice and disclaimer of warranty; keep intact all the
|
||||
notices that refer to this License and to the absence of any warranty;
|
||||
and give any other recipients of the Program a copy of this License
|
||||
along with the Program.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy, and
|
||||
you may at your option offer warranty protection in exchange for a fee.
|
||||
|
||||
2. You may modify your copy or copies of the Program or any portion
|
||||
of it, thus forming a work based on the Program, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) You must cause the modified files to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
b) You must cause any work that you distribute or publish, that in
|
||||
whole or in part contains or is derived from the Program or any
|
||||
part thereof, to be licensed as a whole at no charge to all third
|
||||
parties under the terms of this License.
|
||||
|
||||
c) If the modified program normally reads commands interactively
|
||||
when run, you must cause it, when started running for such
|
||||
interactive use in the most ordinary way, to print or display an
|
||||
announcement including an appropriate copyright notice and a
|
||||
notice that there is no warranty (or else, saying that you provide
|
||||
a warranty) and that users may redistribute the program under
|
||||
these conditions, and telling the user how to view a copy of this
|
||||
License. (Exception: if the Program itself is interactive but
|
||||
does not normally print such an announcement, your work based on
|
||||
the Program is not required to print an announcement.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Program,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Program, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Program.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Program
|
||||
with the Program (or with a work based on the Program) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may copy and distribute the Program (or a work based on it,
|
||||
under Section 2) in object code or executable form under the terms of
|
||||
Sections 1 and 2 above provided that you also do one of the following:
|
||||
|
||||
a) Accompany it with the complete corresponding machine-readable
|
||||
source code, which must be distributed under the terms of Sections
|
||||
1 and 2 above on a medium customarily used for software interchange; or,
|
||||
|
||||
b) Accompany it with a written offer, valid for at least three
|
||||
years, to give any third party, for a charge no more than your
|
||||
cost of physically performing source distribution, a complete
|
||||
machine-readable copy of the corresponding source code, to be
|
||||
distributed under the terms of Sections 1 and 2 above on a medium
|
||||
customarily used for software interchange; or,
|
||||
|
||||
c) Accompany it with the information you received as to the offer
|
||||
to distribute corresponding source code. (This alternative is
|
||||
allowed only for noncommercial distribution and only if you
|
||||
received the program in object code or executable form with such
|
||||
an offer, in accord with Subsection b above.)
|
||||
|
||||
The source code for a work means the preferred form of the work for
|
||||
making modifications to it. For an executable work, complete source
|
||||
code means all the source code for all modules it contains, plus any
|
||||
associated interface definition files, plus the scripts used to
|
||||
control compilation and installation of the executable. However, as a
|
||||
special exception, the source code distributed need not include
|
||||
anything that is normally distributed (in either source or binary
|
||||
form) with the major components (compiler, kernel, and so on) of the
|
||||
operating system on which the executable runs, unless that component
|
||||
itself accompanies the executable.
|
||||
|
||||
If distribution of executable or object code is made by offering
|
||||
access to copy from a designated place, then offering equivalent
|
||||
access to copy the source code from the same place counts as
|
||||
distribution of the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
4. You may not copy, modify, sublicense, or distribute the Program
|
||||
except as expressly provided under this License. Any attempt
|
||||
otherwise to copy, modify, sublicense or distribute the Program is
|
||||
void, and will automatically terminate your rights under this License.
|
||||
However, parties who have received copies, or rights, from you under
|
||||
this License will not have their licenses terminated so long as such
|
||||
parties remain in full compliance.
|
||||
|
||||
5. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Program or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Program (or any work based on the
|
||||
Program), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Program or works based on it.
|
||||
|
||||
6. Each time you redistribute the Program (or any work based on the
|
||||
Program), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute or modify the Program subject to
|
||||
these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties to
|
||||
this License.
|
||||
|
||||
7. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Program at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Program by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Program.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under
|
||||
any particular circumstance, the balance of the section is intended to
|
||||
apply and the section as a whole is intended to apply in other
|
||||
circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system, which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
8. If the distribution and/or use of the Program is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Program under this License
|
||||
may add an explicit geographical distribution limitation excluding
|
||||
those countries, so that distribution is permitted only in or among
|
||||
countries not thus excluded. In such case, this License incorporates
|
||||
the limitation as if written in the body of this License.
|
||||
|
||||
9. The Free Software Foundation may publish revised and/or new versions
|
||||
of the General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to
|
||||
address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Program
|
||||
specifies a version number of this License which applies to it and "any
|
||||
later version", you have the option of following the terms and conditions
|
||||
either of that version or of any later version published by the Free
|
||||
Software Foundation. If the Program does not specify a version number of
|
||||
this License, you may choose any version ever published by the Free Software
|
||||
Foundation.
|
||||
|
||||
10. If you wish to incorporate parts of the Program into other free
|
||||
programs whose distribution conditions are different, write to the author
|
||||
to ask for permission. For software which is copyrighted by the Free
|
||||
Software Foundation, write to the Free Software Foundation; we sometimes
|
||||
make exceptions for this. Our decision will be guided by the two goals
|
||||
of preserving the free status of all derivatives of our free software and
|
||||
of promoting the sharing and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
|
||||
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
|
||||
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
|
||||
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
|
||||
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
||||
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
|
||||
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
|
||||
REPAIR OR CORRECTION.
|
||||
|
||||
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
|
||||
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
|
||||
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
|
||||
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
|
||||
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
|
||||
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
|
||||
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
|
||||
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
|
||||
POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest
|
||||
possible use to the public, the best way to achieve this is to make it
|
||||
free software which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest
|
||||
to attach them to the start of each source file to most effectively
|
||||
convey the exclusion of warranty; and each file should have at least
|
||||
the "copyright" line and a pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 2 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program; if not, write to the Free Software
|
||||
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If the program is interactive, make it output a short notice like this
|
||||
when it starts in an interactive mode:
|
||||
|
||||
Gnomovision version 69, Copyright (C) year name of author
|
||||
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
|
||||
This is free software, and you are welcome to redistribute it
|
||||
under certain conditions; type `show c' for details.
|
||||
|
||||
The hypothetical commands `show w' and `show c' should show the appropriate
|
||||
parts of the General Public License. Of course, the commands you use may
|
||||
be called something other than `show w' and `show c'; they could even be
|
||||
mouse-clicks or menu items--whatever suits your program.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or your
|
||||
school, if any, to sign a "copyright disclaimer" for the program, if
|
||||
necessary. Here is a sample; alter the names:
|
||||
|
||||
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
|
||||
`Gnomovision' (which makes passes at compilers) written by James Hacker.
|
||||
|
||||
<signature of Ty Coon>, 1 April 1989
|
||||
Ty Coon, President of Vice
|
||||
|
||||
This General Public License does not permit incorporating your program into
|
||||
proprietary programs. If your program is a subroutine library, you may
|
||||
consider it more useful to permit linking proprietary applications with the
|
||||
library. If this is what you want to do, use the GNU Library General
|
||||
Public License instead of this License.
|
82
modules/pam/README
Normal file
@ -0,0 +1,82 @@
|
||||
Gallery3 PAM version 0.1 released 2010-08-12
|
||||
|
||||
ABOUT
|
||||
Allows users to login by using external authentication methods.
|
||||
|
||||
Note: I chose not to use the existing LDAP module because it did not allow me
|
||||
to use both local Gallery accounts along with the LDAP accounts.
|
||||
|
||||
This module replaces the default login link on the user_menu_login. This
|
||||
works for the ajax login but to use the html you need to go to /pam ... I do
|
||||
not know enough about kohana to know how to use the /login url without
|
||||
removing the gallery/controller/login.php file.
|
||||
|
||||
INSTALLATION
|
||||
Copy the pam folder to the gallery3 modules folder.
|
||||
|
||||
CONFIGURATION
|
||||
Add plugins to the plugin folder to enable alternative authentication methods.
|
||||
|
||||
Edit the config/config.php file to override defaults.
|
||||
|
||||
$plugin_path = '';
|
||||
The default path is pam/plugins. You can put them anywhere and use this to set
|
||||
the absolute path.
|
||||
|
||||
$plugins = array('gallery');
|
||||
By default the plugin folder is scanned and whatever folders are found are
|
||||
added to the plugin array. By using this setting you can specify what
|
||||
plugins to include and in what order they will be used.
|
||||
|
||||
$create_account = true;
|
||||
By default this is set to false. Set this to true if you want to
|
||||
automatically create accounts. This assumes the plugin will have a
|
||||
getAccount() method that will return at the very least: name,full_name,email
|
||||
|
||||
Note:
|
||||
Two plugins are included in the pam_plugin folder. Copy a plugin to the
|
||||
plugin folder to make it available to the PAM module.
|
||||
|
||||
mock: will authenticate any matching name/password pair. ex. user/user and if
|
||||
$create_account is true then an account will be created using the name. The
|
||||
fullname will be "Mock {the name used}" and the email will be set to "{the
|
||||
name used}@email.com"
|
||||
|
||||
ad: this is a plugin to authenticate a user via an Active Directory domain
|
||||
controller. It uses the class adLDAP (http://adldap.sourceforge.net/) and
|
||||
assumes that your PHP environment has the LDAP exensions loaded. This
|
||||
plugin has included the adLDAP class version 2.1. I've not tested with later
|
||||
versions.
|
||||
|
||||
USE
|
||||
Login as admin and go to the Gallery Modules page. Check the PAM module and
|
||||
update. The PAM module will replace the "Login" link so that the PAM module
|
||||
will be used instead of the core Login.
|
||||
|
||||
By default the "gallery" plugin is in the plugin folder. This allows
|
||||
authentication via the core identity. You should be able to logout and then
|
||||
login again.
|
||||
|
||||
PROBLEMS
|
||||
If you are not able to login just remove the PAM folder from the modules and
|
||||
refresh your page. Or you can go to the default login by going to {your site
|
||||
url}/login.
|
||||
|
||||
Submit an issue at http://github.com/jimsloan/gallery3-pam/issues or email
|
||||
me.
|
||||
|
||||
FUTURE
|
||||
I will be adding a OpenID plugin soon.
|
||||
|
||||
By using the Mock plugin as an example you should be able to create a
|
||||
connector/plugin to any existing database or web service that will
|
||||
authenticate user credentials.
|
||||
|
||||
AUTHOR
|
||||
Jim Sloan (jsloan.email@gmail.com)
|
||||
|
||||
PROJECT HOME
|
||||
http://github.com/jimsloan/gallery3-pam
|
||||
|
||||
LICENSE
|
||||
see LICENSE
|
16
modules/pam/config/config.php
Normal file
@ -0,0 +1,16 @@
|
||||
<?php defined("SYSPATH") or die("No direct script access.");
|
||||
|
||||
/*
|
||||
* absolute path to the plugin folder
|
||||
*/
|
||||
//$plugin_path = '';
|
||||
|
||||
/*
|
||||
* use this array to set active plugins and precedence.
|
||||
*/
|
||||
//$plugins = array('gallery');
|
||||
|
||||
/*
|
||||
* allow automatic account creation
|
||||
*/
|
||||
//$create_account = true;
|
217
modules/pam/controllers/pam.php
Normal file
@ -0,0 +1,217 @@
|
||||
<?php defined("SYSPATH") or die("No direct script access.");
|
||||
|
||||
/**
|
||||
* Enables authentication via multiple external services using a plugin architecture.
|
||||
*/
|
||||
class pam_Controller extends Login_Controller {
|
||||
|
||||
private $pam_auth;
|
||||
private $plugins;
|
||||
private $plugin_path;
|
||||
private $create_account;
|
||||
|
||||
/**
|
||||
* for now just run _setup
|
||||
*/
|
||||
public function __construct()
|
||||
{
|
||||
$this->_setup();
|
||||
}
|
||||
|
||||
/**
|
||||
* default action for the pam controller
|
||||
*/
|
||||
public function index() {
|
||||
$view = new Theme_View("page.html", "other", "login");
|
||||
$view->page_title = t("Login");
|
||||
$view->content = auth::get_login_form("pam/auth_html");
|
||||
print $view;
|
||||
}
|
||||
|
||||
/**
|
||||
* process login form
|
||||
*/
|
||||
public function auth_html() {
|
||||
access::verify_csrf();
|
||||
|
||||
list ($valid, $form) = $this->_auth("pam/auth__html");
|
||||
if ($valid) {
|
||||
$continue_url = $form->continue_url->value;
|
||||
url::redirect($continue_url ? $continue_url : item::root()->abs_url());
|
||||
} else {
|
||||
$view = new Theme_View("page.html", "other", "login");
|
||||
$view->page_title = t("Log in to Gallery");
|
||||
$view->content = new View("auth_ajax.html");
|
||||
$view->content->form = $form;
|
||||
print $view;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* display the login form via ajax
|
||||
*/
|
||||
public function ajax() {
|
||||
$view = new View("pam_ajax.html");
|
||||
$view->form = auth::get_login_form("pam/auth_ajax");
|
||||
print $view;
|
||||
}
|
||||
|
||||
/**
|
||||
* process login form via ajax
|
||||
*/
|
||||
public function auth_ajax() {
|
||||
access::verify_csrf();
|
||||
|
||||
list ($valid, $form) = $this->_auth("pam/auth_ajax");
|
||||
if ($valid) {
|
||||
print json_encode(
|
||||
array("result" => "success"));
|
||||
} else {
|
||||
print json_encode(array("result" => "error", "form" => (string) $form));
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* authenticate the user
|
||||
*
|
||||
* @param string $url
|
||||
* @return boolean
|
||||
*/
|
||||
private function _auth($url) {
|
||||
$form = auth::get_login_form($url);
|
||||
$validform = $form->validate();
|
||||
$valid = false;
|
||||
|
||||
if ($validform) {
|
||||
|
||||
// retrieve the values from the form
|
||||
$name = $form->login->inputs["name"]->value;
|
||||
$pass = $form->login->password->value;
|
||||
|
||||
// do we have a user?
|
||||
$user = identity::lookup_user_by_name($name);
|
||||
$validuser = empty($user)?false:true;
|
||||
|
||||
// is the user authentic?
|
||||
$checkpass = $this->_checkpass($name,$pass);
|
||||
|
||||
/*
|
||||
* we are concerned with these three possibilities:
|
||||
* 1. there is no valid user or no valid password
|
||||
* 2. there is no valid user but a valid password
|
||||
* 3. there is a valid user and a valid password
|
||||
*/
|
||||
|
||||
// 1. there is no valid user or no valid password: error
|
||||
if (!$validuser || !$checkpass) {
|
||||
$form->login->inputs["name"]->add_error("invalid_login", 1);
|
||||
$name = $form->login->inputs["name"]->value;
|
||||
log::warning("user", t("Failed login for %name", array("name" => $name)));
|
||||
module::event("user_auth_failed", $name);
|
||||
}
|
||||
|
||||
// 2. there is no valid user but a valid password: create account if allowed
|
||||
if (!$validuser && $checkpass && $this->create_account) {
|
||||
$account = $this->pam_auth->getAccount();
|
||||
if ($account){
|
||||
$password = md5(uniqid(mt_rand(), true));
|
||||
$new_user = identity::create_user($account->name, $account->full_name, $password, $account->email);
|
||||
$new_user->url = '';
|
||||
$new_user->admin = false;
|
||||
$new_user->guest = false;
|
||||
$new_user->save();
|
||||
$user = identity::lookup_user_by_name($account->name);
|
||||
$validuser = empty($user)?false:true;
|
||||
}
|
||||
}
|
||||
|
||||
// 3. there is a valid user and a valid password: load user account
|
||||
if ($validuser && $checkpass) {
|
||||
auth::login($user);
|
||||
$valid = true;
|
||||
}
|
||||
}
|
||||
|
||||
// regenerate the session id to avoid session trapping
|
||||
Session::instance()->regenerate();
|
||||
|
||||
return array($valid, $form);
|
||||
}
|
||||
|
||||
/**
|
||||
* check the login name/pass pair against registered services
|
||||
*
|
||||
* @param string $name
|
||||
* @param string $pass
|
||||
* @return boolean
|
||||
*
|
||||
*/
|
||||
private function _checkpass($name, $pass)
|
||||
{
|
||||
// assume failure
|
||||
$result = false;
|
||||
|
||||
// maybe this should be moved to _setup()?
|
||||
if ($this->plugins) {
|
||||
$plugins = $this->plugins;
|
||||
}
|
||||
else {
|
||||
$plugins = $this->_read_plugins();
|
||||
}
|
||||
|
||||
$path_template = $this->plugin_path . '/%s/%s.php';
|
||||
|
||||
// loop over the plugins
|
||||
foreach ($plugins as $plugin){
|
||||
// load and instantiate the class
|
||||
require sprintf($path_template,$plugin,$plugin);
|
||||
$class = 'pam_'.$plugin;
|
||||
$this->pam_auth = new $class($name, $pass);
|
||||
$result = $this->pam_auth->isAuth();
|
||||
/*
|
||||
* if user is authenticated then leave the loop/method.
|
||||
* the $this->pam_auth class is used to create a new account
|
||||
*/
|
||||
if ($result) return $result;
|
||||
}
|
||||
|
||||
return $result;
|
||||
}
|
||||
|
||||
/**
|
||||
* scan the plugin directory and build a list of names
|
||||
*
|
||||
* @return array
|
||||
*/
|
||||
private function _read_plugins() {
|
||||
$plugins = array();
|
||||
$plugin_path = MODPATH .'pam/plugins';
|
||||
|
||||
// build plugin list from plugin folder
|
||||
$d = dir($plugin_path);
|
||||
while (false !== ($entry = $d->read())) {
|
||||
if ($entry != "." && $entry != "..") $plugins[] = $entry ;
|
||||
}
|
||||
$d->close();
|
||||
return $plugins;
|
||||
}
|
||||
|
||||
/**
|
||||
* load the config and set some values
|
||||
*/
|
||||
private function _setup() {
|
||||
|
||||
$default_plugin_path = MODPATH .'pam/plugins';
|
||||
|
||||
if (file_exists(MODPATH .'pam/config/config.php')) {
|
||||
include MODPATH .'pam/config/config.php';
|
||||
}
|
||||
|
||||
$this->plugins = isset($plugins)?$plugins:false;
|
||||
$this->plugin_path = isset($plugin_path)?$plugin_path:$default_plugin_path;
|
||||
$this->create_account = isset($create_account)?$create_account:false;
|
||||
|
||||
}
|
||||
|
||||
}
|
23
modules/pam/helpers/pam_event.php
Normal file
@ -0,0 +1,23 @@
|
||||
<?php defined("SYSPATH") or die("No direct script access.");
|
||||
|
||||
|
||||
class pam_event {
|
||||
|
||||
/**
|
||||
* remove the default login link and use our own
|
||||
*/
|
||||
static function user_menu($menu, $theme) {
|
||||
$user = identity::active_user();
|
||||
if ($user->guest) {
|
||||
// disable the default login
|
||||
$menu->remove('user_menu_login');
|
||||
// add ours
|
||||
$menu->append(Menu::factory("dialog")
|
||||
->id("user_menu_pam")
|
||||
->css_id("g-pam-menu")
|
||||
->url(url::site("pam/ajax"))
|
||||
->label(t("Login")));
|
||||
}
|
||||
}
|
||||
|
||||
}
|
3
modules/pam/module.info
Normal file
@ -0,0 +1,3 @@
|
||||
name = "PAM"
|
||||
description = "Pluggable authentication module allows users to login by using external authentication methods."
|
||||
version = 1
|
88
modules/pam/pam_plugins/ad/ad.php
Normal file
@ -0,0 +1,88 @@
|
||||
<?php defined("SYSPATH") or die("No direct script access.");
|
||||
|
||||
|
||||
/**
|
||||
* a plugin to authenticate user accounts on an Active Directory domain controller
|
||||
*
|
||||
*/
|
||||
class pam_ad
|
||||
{
|
||||
private $adldap;
|
||||
private $name;
|
||||
private $pass;
|
||||
private $auth;
|
||||
|
||||
|
||||
/**
|
||||
*
|
||||
* @param string $name
|
||||
* @param string $pass
|
||||
*/
|
||||
public function __construct($name, $pass)
|
||||
{
|
||||
require("adLDAP/adLDAP.php");
|
||||
// this will load $options
|
||||
require('config.php');
|
||||
|
||||
$this->name = $name;
|
||||
$this->pass = $pass;
|
||||
$this->adldap = new adLDAP($options);
|
||||
$this->_auth();
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
*
|
||||
* @return boolean
|
||||
*/
|
||||
public function isAuth()
|
||||
{
|
||||
return $this->auth;
|
||||
}
|
||||
|
||||
/**
|
||||
*
|
||||
* @return object or false
|
||||
*/
|
||||
public function getAccount()
|
||||
{
|
||||
return $this->_account();
|
||||
}
|
||||
|
||||
/**
|
||||
* perform the AD authentication and set the var auth
|
||||
*/
|
||||
private function _auth()
|
||||
{
|
||||
if ($this->adldap->authenticate($this->name, $this->pass)){
|
||||
$this->auth = TRUE;
|
||||
}
|
||||
else {
|
||||
$this->auth = FALSE;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
*
|
||||
* @return object or false
|
||||
*/
|
||||
public function _account()
|
||||
{
|
||||
$result = $this->adldap->user_info($this->name);
|
||||
$user_info = $result[0];
|
||||
if (isset($user_info)){
|
||||
$account = array(
|
||||
'name' => $this->name,
|
||||
'full_name' => $user_info['displayname'][0],
|
||||
'email' => $user_info['mail'][0],
|
||||
);
|
||||
return (object) $account;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
|
457
modules/pam/pam_plugins/ad/adLDAP/LICENCE.txt
Normal file
@ -0,0 +1,457 @@
|
||||
GNU LESSER GENERAL PUBLIC LICENSE
|
||||
Version 2.1, February 1999
|
||||
|
||||
Copyright (C) 1991, 1999 Free Software Foundation, Inc.
|
||||
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
||||
Everyone is permitted to copy and distribute verbatim copies
|
||||
of this license document, but changing it is not allowed.
|
||||
|
||||
[This is the first released version of the Lesser GPL. It also counts
|
||||
as the successor of the GNU Library Public License, version 2, hence
|
||||
the version number 2.1.]
|
||||
|
||||
Preamble
|
||||
|
||||
The licenses for most software are designed to take away your
|
||||
freedom to share and change it. By contrast, the GNU General Public
|
||||
Licenses are intended to guarantee your freedom to share and change
|
||||
free software--to make sure the software is free for all its users.
|
||||
|
||||
This license, the Lesser General Public License, applies to some
|
||||
specially designated software packages--typically libraries--of the
|
||||
Free Software Foundation and other authors who decide to use it. You
|
||||
can use it too, but we suggest you first think carefully about whether
|
||||
this license or the ordinary General Public License is the better
|
||||
strategy to use in any particular case, based on the explanations below.
|
||||
|
||||
When we speak of free software, we are referring to freedom of use,
|
||||
not price. Our General Public Licenses are designed to make sure that
|
||||
you have the freedom to distribute copies of free software (and charge
|
||||
for this service if you wish); that you receive source code or can get
|
||||
it if you want it; that you can change the software and use pieces of
|
||||
it in new free programs; and that you are informed that you can do
|
||||
these things.
|
||||
|
||||
To protect your rights, we need to make restrictions that forbid
|
||||
distributors to deny you these rights or to ask you to surrender these
|
||||
rights. These restrictions translate to certain responsibilities for
|
||||
you if you distribute copies of the library or if you modify it.
|
||||
|
||||
For example, if you distribute copies of the library, whether gratis
|
||||
or for a fee, you must give the recipients all the rights that we gave
|
||||
you. You must make sure that they, too, receive or can get the source
|
||||
code. If you link other code with the library, you must provide
|
||||
complete object files to the recipients, so that they can relink them
|
||||
with the library after making changes to the library and recompiling
|
||||
it. And you must show them these terms so they know their rights.
|
||||
|
||||
We protect your rights with a two-step method: (1) we copyright the
|
||||
library, and (2) we offer you this license, which gives you legal
|
||||
permission to copy, distribute and/or modify the library.
|
||||
|
||||
To protect each distributor, we want to make it very clear that
|
||||
there is no warranty for the free library. Also, if the library is
|
||||
modified by someone else and passed on, the recipients should know
|
||||
that what they have is not the original version, so that the original
|
||||
author's reputation will not be affected by problems that might be
|
||||
introduced by others.
|
||||
|
||||
Finally, software patents pose a constant threat to the existence of
|
||||
any free program. We wish to make sure that a company cannot
|
||||
effectively restrict the users of a free program by obtaining a
|
||||
restrictive license from a patent holder. Therefore, we insist that
|
||||
any patent license obtained for a version of the library must be
|
||||
consistent with the full freedom of use specified in this license.
|
||||
|
||||
Most GNU software, including some libraries, is covered by the
|
||||
ordinary GNU General Public License. This license, the GNU Lesser
|
||||
General Public License, applies to certain designated libraries, and
|
||||
is quite different from the ordinary General Public License. We use
|
||||
this license for certain libraries in order to permit linking those
|
||||
libraries into non-free programs.
|
||||
|
||||
When a program is linked with a library, whether statically or using
|
||||
a shared library, the combination of the two is legally speaking a
|
||||
combined work, a derivative of the original library. The ordinary
|
||||
General Public License therefore permits such linking only if the
|
||||
entire combination fits its criteria of freedom. The Lesser General
|
||||
Public License permits more lax criteria for linking other code with
|
||||
the library.
|
||||
|
||||
We call this license the "Lesser" General Public License because it
|
||||
does Less to protect the user's freedom than the ordinary General
|
||||
Public License. It also provides other free software developers Less
|
||||
of an advantage over competing non-free programs. These disadvantages
|
||||
are the reason we use the ordinary General Public License for many
|
||||
libraries. However, the Lesser license provides advantages in certain
|
||||
special circumstances.
|
||||
|
||||
For example, on rare occasions, there may be a special need to
|
||||
encourage the widest possible use of a certain library, so that it becomes
|
||||
a de-facto standard. To achieve this, non-free programs must be
|
||||
allowed to use the library. A more frequent case is that a free
|
||||
library does the same job as widely used non-free libraries. In this
|
||||
case, there is little to gain by limiting the free library to free
|
||||
software only, so we use the Lesser General Public License.
|
||||
|
||||
In other cases, permission to use a particular library in non-free
|
||||
programs enables a greater number of people to use a large body of
|
||||
free software. For example, permission to use the GNU C Library in
|
||||
non-free programs enables many more people to use the whole GNU
|
||||
operating system, as well as its variant, the GNU/Linux operating
|
||||
system.
|
||||
|
||||
Although the Lesser General Public License is Less protective of the
|
||||
users' freedom, it does ensure that the user of a program that is
|
||||
linked with the Library has the freedom and the wherewithal to run
|
||||
that program using a modified version of the Library.
|
||||
|
||||
The precise terms and conditions for copying, distribution and
|
||||
modification follow. Pay close attention to the difference between a
|
||||
"work based on the library" and a "work that uses the library". The
|
||||
former contains code derived from the library, whereas the latter must
|
||||
be combined with the library in order to run.
|
||||
|
||||
GNU LESSER GENERAL PUBLIC LICENSE
|
||||
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
|
||||
|
||||
0. This License Agreement applies to any software library or other
|
||||
program which contains a notice placed by the copyright holder or
|
||||
other authorized party saying it may be distributed under the terms of
|
||||
this Lesser General Public License (also called "this License").
|
||||
Each licensee is addressed as "you".
|
||||
|
||||
A "library" means a collection of software functions and/or data
|
||||
prepared so as to be conveniently linked with application programs
|
||||
(which use some of those functions and data) to form executables.
|
||||
|
||||
The "Library", below, refers to any such software library or work
|
||||
which has been distributed under these terms. A "work based on the
|
||||
Library" means either the Library or any derivative work under
|
||||
copyright law: that is to say, a work containing the Library or a
|
||||
portion of it, either verbatim or with modifications and/or translated
|
||||
straightforwardly into another language. (Hereinafter, translation is
|
||||
included without limitation in the term "modification".)
|
||||
|
||||
"Source code" for a work means the preferred form of the work for
|
||||
making modifications to it. For a library, complete source code means
|
||||
all the source code for all modules it contains, plus any associated
|
||||
interface definition files, plus the scripts used to control compilation
|
||||
and installation of the library.
|
||||
|
||||
Activities other than copying, distribution and modification are not
|
||||
covered by this License; they are outside its scope. The act of
|
||||
running a program using the Library is not restricted, and output from
|
||||
such a program is covered only if its contents constitute a work based
|
||||
on the Library (independent of the use of the Library in a tool for
|
||||
writing it). Whether that is true depends on what the Library does
|
||||
and what the program that uses the Library does.
|
||||
|
||||
1. You may copy and distribute verbatim copies of the Library's
|
||||
complete source code as you receive it, in any medium, provided that
|
||||
you conspicuously and appropriately publish on each copy an
|
||||
appropriate copyright notice and disclaimer of warranty; keep intact
|
||||
all the notices that refer to this License and to the absence of any
|
||||
warranty; and distribute a copy of this License along with the
|
||||
Library.
|
||||
|
||||
You may charge a fee for the physical act of transferring a copy,
|
||||
and you may at your option offer warranty protection in exchange for a
|
||||
fee.
|
||||
|
||||
2. You may modify your copy or copies of the Library or any portion
|
||||
of it, thus forming a work based on the Library, and copy and
|
||||
distribute such modifications or work under the terms of Section 1
|
||||
above, provided that you also meet all of these conditions:
|
||||
|
||||
a) The modified work must itself be a software library.
|
||||
|
||||
b) You must cause the files modified to carry prominent notices
|
||||
stating that you changed the files and the date of any change.
|
||||
|
||||
c) You must cause the whole of the work to be licensed at no
|
||||
charge to all third parties under the terms of this License.
|
||||
|
||||
d) If a facility in the modified Library refers to a function or a
|
||||
table of data to be supplied by an application program that uses
|
||||
the facility, other than as an argument passed when the facility
|
||||
is invoked, then you must make a good faith effort to ensure that,
|
||||
in the event an application does not supply such function or
|
||||
table, the facility still operates, and performs whatever part of
|
||||
its purpose remains meaningful.
|
||||
|
||||
(For example, a function in a library to compute square roots has
|
||||
a purpose that is entirely well-defined independent of the
|
||||
application. Therefore, Subsection 2d requires that any
|
||||
application-supplied function or table used by this function must
|
||||
be optional: if the application does not supply it, the square
|
||||
root function must still compute square roots.)
|
||||
|
||||
These requirements apply to the modified work as a whole. If
|
||||
identifiable sections of that work are not derived from the Library,
|
||||
and can be reasonably considered independent and separate works in
|
||||
themselves, then this License, and its terms, do not apply to those
|
||||
sections when you distribute them as separate works. But when you
|
||||
distribute the same sections as part of a whole which is a work based
|
||||
on the Library, the distribution of the whole must be on the terms of
|
||||
this License, whose permissions for other licensees extend to the
|
||||
entire whole, and thus to each and every part regardless of who wrote
|
||||
it.
|
||||
|
||||
Thus, it is not the intent of this section to claim rights or contest
|
||||
your rights to work written entirely by you; rather, the intent is to
|
||||
exercise the right to control the distribution of derivative or
|
||||
collective works based on the Library.
|
||||
|
||||
In addition, mere aggregation of another work not based on the Library
|
||||
with the Library (or with a work based on the Library) on a volume of
|
||||
a storage or distribution medium does not bring the other work under
|
||||
the scope of this License.
|
||||
|
||||
3. You may opt to apply the terms of the ordinary GNU General Public
|
||||
License instead of this License to a given copy of the Library. To do
|
||||
this, you must alter all the notices that refer to this License, so
|
||||
that they refer to the ordinary GNU General Public License, version 2,
|
||||
instead of to this License. (If a newer version than version 2 of the
|
||||
ordinary GNU General Public License has appeared, then you can specify
|
||||
that version instead if you wish.) Do not make any other change in
|
||||
these notices.
|
||||
|
||||
Once this change is made in a given copy, it is irreversible for
|
||||
that copy, so the ordinary GNU General Public License applies to all
|
||||
subsequent copies and derivative works made from that copy.
|
||||
|
||||
This option is useful when you wish to copy part of the code of
|
||||
the Library into a program that is not a library.
|
||||
|
||||
4. You may copy and distribute the Library (or a portion or
|
||||
derivative of it, under Section 2) in object code or executable form
|
||||
under the terms of Sections 1 and 2 above provided that you accompany
|
||||
it with the complete corresponding machine-readable source code, which
|
||||
must be distributed under the terms of Sections 1 and 2 above on a
|
||||
medium customarily used for software interchange.
|
||||
|
||||
If distribution of object code is made by offering access to copy
|
||||
from a designated place, then offering equivalent access to copy the
|
||||
source code from the same place satisfies the requirement to
|
||||
distribute the source code, even though third parties are not
|
||||
compelled to copy the source along with the object code.
|
||||
|
||||
5. A program that contains no derivative of any portion of the
|
||||
Library, but is designed to work with the Library by being compiled or
|
||||
linked with it, is called a "work that uses the Library". Such a
|
||||
work, in isolation, is not a derivative work of the Library, and
|
||||
therefore falls outside the scope of this License.
|
||||
|
||||
However, linking a "work that uses the Library" with the Library
|
||||
creates an executable that is a derivative of the Library (because it
|
||||
contains portions of the Library), rather than a "work that uses the
|
||||
library". The executable is therefore covered by this License.
|
||||
Section 6 states terms for distribution of such executables.
|
||||
|
||||
When a "work that uses the Library" uses material from a header file
|
||||
that is part of the Library, the object code for the work may be a
|
||||
derivative work of the Library even though the source code is not.
|
||||
Whether this is true is especially significant if the work can be
|
||||
linked without the Library, or if the work is itself a library. The
|
||||
threshold for this to be true is not precisely defined by law.
|
||||
|
||||
If such an object file uses only numerical parameters, data
|
||||
structure layouts and accessors, and small macros and small inline
|
||||
functions (ten lines or less in length), then the use of the object
|
||||
file is unrestricted, regardless of whether it is legally a derivative
|
||||
work. (Executables containing this object code plus portions of the
|
||||
Library will still fall under Section 6.)
|
||||
|
||||
Otherwise, if the work is a derivative of the Library, you may
|
||||
distribute the object code for the work under the terms of Section 6.
|
||||
Any executables containing that work also fall under Section 6,
|
||||
whether or not they are linked directly with the Library itself.
|
||||
|
||||
6. As an exception to the Sections above, you may also combine or
|
||||
link a "work that uses the Library" with the Library to produce a
|
||||
work containing portions of the Library, and distribute that work
|
||||
under terms of your choice, provided that the terms permit
|
||||
modification of the work for the customer's own use and reverse
|
||||
engineering for debugging such modifications.
|
||||
|
||||
You must give prominent notice with each copy of the work that the
|
||||
Library is used in it and that the Library and its use are covered by
|
||||
this License. You must supply a copy of this License. If the work
|
||||
during execution displays copyright notices, you must include the
|
||||
copyright notice for the Library among them, as well as a reference
|
||||
directing the user to the copy of this License. Also, you must do one
|
||||
of these things:
|
||||
|
||||
a) Accompany the work with the complete corresponding
|
||||
machine-readable source code for the Library including whatever
|
||||
changes were used in the work (which must be distributed under
|
||||
Sections 1 and 2 above); and, if the work is an executable linked
|
||||
with the Library, with the complete machine-readable "work that
|
||||
uses the Library", as object code and/or source code, so that the
|
||||
user can modify the Library and then relink to produce a modified
|
||||
executable containing the modified Library. (It is understood
|
||||
that the user who changes the contents of definitions files in the
|
||||
Library will not necessarily be able to recompile the application
|
||||
to use the modified definitions.)
|
||||
|
||||
b) Use a suitable shared library mechanism for linking with the
|
||||
Library. A suitable mechanism is one that (1) uses at run time a
|
||||
copy of the library already present on the user's computer system,
|
||||
rather than copying library functions into the executable, and (2)
|
||||
will operate properly with a modified version of the library, if
|
||||
the user installs one, as long as the modified version is
|
||||
interface-compatible with the version that the work was made with.
|
||||
|
||||
c) Accompany the work with a written offer, valid for at
|
||||
least three years, to give the same user the materials
|
||||
specified in Subsection 6a, above, for a charge no more
|
||||
than the cost of performing this distribution.
|
||||
|
||||
d) If distribution of the work is made by offering access to copy
|
||||
from a designated place, offer equivalent access to copy the above
|
||||
specified materials from the same place.
|
||||
|
||||
e) Verify that the user has already received a copy of these
|
||||
materials or that you have already sent this user a copy.
|
||||
|
||||
For an executable, the required form of the "work that uses the
|
||||
Library" must include any data and utility programs needed for
|
||||
reproducing the executable from it. However, as a special exception,
|
||||
the materials to be distributed need not include anything that is
|
||||
normally distributed (in either source or binary form) with the major
|
||||
components (compiler, kernel, and so on) of the operating system on
|
||||
which the executable runs, unless that component itself accompanies
|
||||
the executable.
|
||||
|
||||
It may happen that this requirement contradicts the license
|
||||
restrictions of other proprietary libraries that do not normally
|
||||
accompany the operating system. Such a contradiction means you cannot
|
||||
use both them and the Library together in an executable that you
|
||||
distribute.
|
||||
|
||||
7. You may place library facilities that are a work based on the
|
||||
Library side-by-side in a single library together with other library
|
||||
facilities not covered by this License, and distribute such a combined
|
||||
library, provided that the separate distribution of the work based on
|
||||
the Library and of the other library facilities is otherwise
|
||||
permitted, and provided that you do these two things:
|
||||
|
||||
a) Accompany the combined library with a copy of the same work
|
||||
based on the Library, uncombined with any other library
|
||||
facilities. This must be distributed under the terms of the
|
||||
Sections above.
|
||||
|
||||
b) Give prominent notice with the combined library of the fact
|
||||
that part of it is a work based on the Library, and explaining
|
||||
where to find the accompanying uncombined form of the same work.
|
||||
|
||||
8. You may not copy, modify, sublicense, link with, or distribute
|
||||
the Library except as expressly provided under this License. Any
|
||||
attempt otherwise to copy, modify, sublicense, link with, or
|
||||
distribute the Library is void, and will automatically terminate your
|
||||
rights under this License. However, parties who have received copies,
|
||||
or rights, from you under this License will not have their licenses
|
||||
terminated so long as such parties remain in full compliance.
|
||||
|
||||
9. You are not required to accept this License, since you have not
|
||||
signed it. However, nothing else grants you permission to modify or
|
||||
distribute the Library or its derivative works. These actions are
|
||||
prohibited by law if you do not accept this License. Therefore, by
|
||||
modifying or distributing the Library (or any work based on the
|
||||
Library), you indicate your acceptance of this License to do so, and
|
||||
all its terms and conditions for copying, distributing or modifying
|
||||
the Library or works based on it.
|
||||
|
||||
10. Each time you redistribute the Library (or any work based on the
|
||||
Library), the recipient automatically receives a license from the
|
||||
original licensor to copy, distribute, link with or modify the Library
|
||||
subject to these terms and conditions. You may not impose any further
|
||||
restrictions on the recipients' exercise of the rights granted herein.
|
||||
You are not responsible for enforcing compliance by third parties with
|
||||
this License.
|
||||
|
||||
11. If, as a consequence of a court judgment or allegation of patent
|
||||
infringement or for any other reason (not limited to patent issues),
|
||||
conditions are imposed on you (whether by court order, agreement or
|
||||
otherwise) that contradict the conditions of this License, they do not
|
||||
excuse you from the conditions of this License. If you cannot
|
||||
distribute so as to satisfy simultaneously your obligations under this
|
||||
License and any other pertinent obligations, then as a consequence you
|
||||
may not distribute the Library at all. For example, if a patent
|
||||
license would not permit royalty-free redistribution of the Library by
|
||||
all those who receive copies directly or indirectly through you, then
|
||||
the only way you could satisfy both it and this License would be to
|
||||
refrain entirely from distribution of the Library.
|
||||
|
||||
If any portion of this section is held invalid or unenforceable under any
|
||||
particular circumstance, the balance of the section is intended to apply,
|
||||
and the section as a whole is intended to apply in other circumstances.
|
||||
|
||||
It is not the purpose of this section to induce you to infringe any
|
||||
patents or other property right claims or to contest validity of any
|
||||
such claims; this section has the sole purpose of protecting the
|
||||
integrity of the free software distribution system which is
|
||||
implemented by public license practices. Many people have made
|
||||
generous contributions to the wide range of software distributed
|
||||
through that system in reliance on consistent application of that
|
||||
system; it is up to the author/donor to decide if he or she is willing
|
||||
to distribute software through any other system and a licensee cannot
|
||||
impose that choice.
|
||||
|
||||
This section is intended to make thoroughly clear what is believed to
|
||||
be a consequence of the rest of this License.
|
||||
|
||||
12. If the distribution and/or use of the Library is restricted in
|
||||
certain countries either by patents or by copyrighted interfaces, the
|
||||
original copyright holder who places the Library under this License may add
|
||||
an explicit geographical distribution limitation excluding those countries,
|
||||
so that distribution is permitted only in or among countries not thus
|
||||
excluded. In such case, this License incorporates the limitation as if
|
||||
written in the body of this License.
|
||||
|
||||
13. The Free Software Foundation may publish revised and/or new
|
||||
versions of the Lesser General Public License from time to time.
|
||||
Such new versions will be similar in spirit to the present version,
|
||||
but may differ in detail to address new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Library
|
||||
specifies a version number of this License which applies to it and
|
||||
"any later version", you have the option of following the terms and
|
||||
conditions either of that version or of any later version published by
|
||||
the Free Software Foundation. If the Library does not specify a
|
||||
license version number, you may choose any version ever published by
|
||||
the Free Software Foundation.
|
||||
|
||||
14. If you wish to incorporate parts of the Library into other free
|
||||
programs whose distribution conditions are incompatible with these,
|
||||
write to the author to ask for permission. For software which is
|
||||
copyrighted by the Free Software Foundation, write to the Free
|
||||
Software Foundation; we sometimes make exceptions for this. Our
|
||||
decision will be guided by the two goals of preserving the free status
|
||||
of all derivatives of our free software and of promoting the sharing
|
||||
and reuse of software generally.
|
||||
|
||||
NO WARRANTY
|
||||
|
||||
15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
|
||||
WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
|
||||
EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
|
||||
OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
|
||||
KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
||||
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
|
||||
LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
|
||||
THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
|
||||
|
||||
16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
|
||||
WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
|
||||
AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
|
||||
FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
|
||||
CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
|
||||
LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
|
||||
RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
|
||||
FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
|
||||
SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
|
||||
DAMAGES.
|
||||
|
30
modules/pam/pam_plugins/ad/adLDAP/README.txt
Normal file
@ -0,0 +1,30 @@
|
||||
PHP LDAP CLASS FOR MANIPULATING ACTIVE DIRECTORY
|
||||
Version 2.1
|
||||
|
||||
Written by Scott Barnett
|
||||
email: scott@wiggumworld.com
|
||||
http://adldap.sourceforge.net/
|
||||
|
||||
I'd appreciate any improvements or additions to be submitted back
|
||||
to benefit the entire community :)
|
||||
|
||||
Works with both PHP 4 and PHP 5
|
||||
|
||||
I generally install libraries and classes in a folder in the document root
|
||||
called "includes/". If you want to use somewhere else, just edit the
|
||||
include directives in the scripts.
|
||||
|
||||
The examples should be pretty self explanatory. If you require more
|
||||
information, please visit http://adldap.sourceforge.net/
|
||||
|
||||
|
||||
This library is free software; you can redistribute it and/or
|
||||
modify it under the terms of the GNU Lesser General Public
|
||||
License as published by the Free Software Foundation; either
|
||||
version 2.1 of the License, or (at your option) any later version.
|
||||
|
||||
This library is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
Lesser General Public License for more details.
|
||||
|
691
modules/pam/pam_plugins/ad/adLDAP/adLDAP.php
Normal file
@ -0,0 +1,691 @@
|
||||
<?php
|
||||
/*
|
||||
PHP LDAP CLASS FOR MANIPULATING ACTIVE DIRECTORY
|
||||
Version 2.1
|
||||
|
||||
Written by Scott Barnett
|
||||
email: scott@wiggumworld.com
|
||||
http://adldap.sourceforge.net/
|
||||
|
||||
Copyright (C) 2006-2007 Scott Barnett
|
||||
|
||||
I'd appreciate any improvements or additions to be submitted back
|
||||
to benefit the entire community :)
|
||||
|
||||
Works with PHP 5, should be fine with PHP 4, let me know if/where it doesn't :)
|
||||
|
||||
Please visit the project website for a full list of the functions and
|
||||
documentation on using them.
|
||||
http://adldap.sourceforge.net/documentation.php
|
||||
|
||||
This library is free software; you can redistribute it and/or
|
||||
modify it under the terms of the GNU Lesser General Public
|
||||
License as published by the Free Software Foundation; either
|
||||
version 2.1 of the License, or (at your option) any later version.
|
||||
|
||||
This library is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
Lesser General Public License for more details.
|
||||
|
||||
********************************************************************
|
||||
Something to keep in mind is that Active Directory is a permissions
|
||||
based directory. If you bind as a domain user, you can't fetch as
|
||||
much information on other users as you could as a domain admin.
|
||||
********************************************************************
|
||||
*/
|
||||
|
||||
// Different type of accounts in AD
|
||||
define ('ADLDAP_NORMAL_ACCOUNT', 805306368);
|
||||
define ('ADLDAP_WORKSTATION_TRUST', 805306369);
|
||||
define ('ADLDAP_INTERDOMAIN_TRUST', 805306370);
|
||||
define ('ADLDAP_SECURITY_GLOBAL_GROUP', 268435456);
|
||||
define ('ADLDAP_DISTRIBUTION_GROUP', 268435457);
|
||||
define ('ADLDAP_SECURITY_LOCAL_GROUP', 536870912);
|
||||
define ('ADLDAP_DISTRIBUTION_LOCAL_GROUP', 536870913);
|
||||
|
||||
class adLDAP {
|
||||
// BEFORE YOU ASK A QUESTION, PLEASE READ THE DOCUMENTATION AND THE FAQ
|
||||
// http://adldap.sourceforge.net/documentation.php
|
||||
// http://adldap.sourceforge.net/faq.php
|
||||
|
||||
// You can set your default variables here, or when you invoke the class
|
||||
var $_account_suffix="@mydomain.local";
|
||||
var $_base_dn = "DC=mydomain,DC=local";
|
||||
|
||||
// An array of domain controllers. Specify multiple controllers if you
|
||||
// would like the class to balance the LDAP queries amongst multiple servers
|
||||
var $_domain_controllers = array ("dc01.mydomain.local");
|
||||
|
||||
// optional account with higher privileges for searching
|
||||
// not really that optional because you can't query much as a user
|
||||
var $_ad_username=NULL;
|
||||
var $_ad_password=NULL;
|
||||
|
||||
// AD does not return the primary group. http://support.microsoft.com/?kbid=321360
|
||||
// This tweak will resolve the real primary group, but may be resource intensive.
|
||||
// Setting to false will fudge "Domain Users" and is much faster. Keep in mind though that if
|
||||
// someone's primary group is NOT domain users, this is obviously going to bollocks the results
|
||||
var $_real_primarygroup=true;
|
||||
|
||||
// Use SSL, your server needs to be setup, please see - http://adldap.sourceforge.net/ldap_ssl.php
|
||||
var $_use_ssl=false;
|
||||
|
||||
// When querying group memberships, do it recursively
|
||||
// eg. User Fred is a member of Group A, which is a member of Group B, which is a member of Group C
|
||||
// user_ingroup("Fred","C") will returns true with this option turned on, false if turned off
|
||||
var $_recursive_groups=true;
|
||||
|
||||
// You should not need to edit anything below this line
|
||||
//******************************************************************************************
|
||||
|
||||
//other variables
|
||||
var $_conn;
|
||||
var $_bind;
|
||||
|
||||
// default constructor
|
||||
function adLDAP($options=array()){
|
||||
//you can specifically overide any of the default configuration options setup above
|
||||
if (count($options)>0){
|
||||
if (array_key_exists("account_suffix",$options)){ $this->_account_suffix=$options["account_suffix"]; }
|
||||
if (array_key_exists("base_dn",$options)){ $this->_base_dn=$options["base_dn"]; }
|
||||
if (array_key_exists("domain_controllers",$options)){ $this->_domain_controllers=$options["domain_controllers"]; }
|
||||
if (array_key_exists("ad_username",$options)){ $this->_ad_username=$options["ad_username"]; }
|
||||
if (array_key_exists("ad_password",$options)){ $this->_ad_password=$options["ad_password"]; }
|
||||
if (array_key_exists("real_primarygroup",$options)){ $this->_real_primarygroup=$options["real_primarygroup"]; }
|
||||
if (array_key_exists("use_ssl",$options)){ $this->_use_ssl=$options["use_ssl"]; }
|
||||
if (array_key_exists("recursive_groups",$options)){ $this->_recursive_groups=$options["recursive_groups"]; }
|
||||
}
|
||||
|
||||
//connect to the LDAP server as the username/password
|
||||
$dc=$this->random_controller();
|
||||
if ($this->_use_ssl){
|
||||
$this->_conn = ldap_connect("ldaps://".$dc);
|
||||
} else {
|
||||
$this->_conn = ldap_connect($dc);
|
||||
}
|
||||
|
||||
//set some ldap options for talking to AD
|
||||
ldap_set_option($this->_conn, LDAP_OPT_PROTOCOL_VERSION, 3);
|
||||
ldap_set_option($this->_conn, LDAP_OPT_REFERRALS, 0);
|
||||
|
||||
//bind as a domain admin if they've set it up
|
||||
if ($this->_ad_username!=NULL && $this->_ad_password!=NULL){
|
||||
$this->_bind = @ldap_bind($this->_conn,$this->_ad_username.$this->_account_suffix,$this->_ad_password);
|
||||
if (!$this->_bind){
|
||||
if ($this->_use_ssl){
|
||||
//if you have problems troubleshooting, remove the @ character from the ldap_bind command above to get the actual error message
|
||||
echo ("FATAL: AD bind failed. Either the LDAPS connection failed or the login credentials are incorrect."); exit();
|
||||
} else {
|
||||
echo ("FATAL: AD bind failed. Check the login credentials."); exit();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
// default destructor
|
||||
function __destruct(){ ldap_close ($this->_conn); }
|
||||
|
||||
//validate a users login credentials
|
||||
function authenticate($username,$password,$prevent_rebind=false){
|
||||
if ($username==NULL || $password==NULL){ return (false); } //prevent null binding
|
||||
|
||||
//bind as the user
|
||||
$this->_bind = @ldap_bind($this->_conn,$username.$this->_account_suffix,$password);
|
||||
if (!$this->_bind){ return (false); }
|
||||
|
||||
//once we've checked their details, kick back into admin mode if we have it
|
||||
if ($this->_ad_username!=NULL && !$prevent_rebind){
|
||||
$this->_bind = @ldap_bind($this->_conn,$this->_ad_username.$this->_account_suffix,$this->_ad_password);
|
||||
if (!$this->_bind){ echo ("FATAL: AD rebind failed."); exit(); } //this should never happen in theory
|
||||
}
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
//*****************************************************************************************************************
|
||||
// GROUP FUNCTIONS
|
||||
|
||||
// Add a group to a group
|
||||
function group_add_group($parent,$child){
|
||||
|
||||
//find the parent group's dn
|
||||
$parent_group=$this->group_info($parent,array("cn"));
|
||||
if ($parent_group[0]["dn"]==NULL){ return (false); }
|
||||
$parent_dn=$parent_group[0]["dn"];
|
||||
|
||||
//find the child group's dn
|
||||
$child_group=$this->group_info($child,array("cn"));
|
||||
if ($child_group[0]["dn"]==NULL){ return (false); }
|
||||
$child_dn=$child_group[0]["dn"];
|
||||
|
||||
$add=array();
|
||||
$add["member"] = $child_dn;
|
||||
|
||||
$result=@ldap_mod_add($this->_conn,$parent_dn,$add);
|
||||
if ($result==false){ return (false); }
|
||||
return (true);
|
||||
}
|
||||
|
||||
// Add a user to a group
|
||||
function group_add_user($group,$user){
|
||||
//adding a user is a bit fiddly, we need to get the full DN of the user
|
||||
//and add it using the full DN of the group
|
||||
|
||||
//find the user's dn
|
||||
$user_info=$this->user_info($user,array("cn"));
|
||||
if ($user_info[0]["dn"]==NULL){ return (false); }
|
||||
$user_dn=$user_info[0]["dn"];
|
||||
|
||||
//find the group's dn
|
||||
$group_info=$this->group_info($group,array("cn"));
|
||||
if ($group_info[0]["dn"]==NULL){ return (false); }
|
||||
$group_dn=$group_info[0]["dn"];
|
||||
|
||||
$add=array();
|
||||
$add["member"] = $user_dn;
|
||||
|
||||
$result=@ldap_mod_add($this->_conn,$group_dn,$add);
|
||||
if ($result==false){ return (false); }
|
||||
return (true);
|
||||
}
|
||||
|
||||
// Create a group
|
||||
function group_create($attributes){
|
||||
if (!is_array($attributes)){ return ("Attributes must be an array"); }
|
||||
if (!array_key_exists("group_name",$attributes)){ return ("Missing compulsory field [group_name]"); }
|
||||
if (!array_key_exists("container",$attributes)){ return ("Missing compulsory field [container]"); }
|
||||
if (!array_key_exists("description",$attributes)){ return ("Missing compulsory field [description]"); }
|
||||
if (!is_array($attributes["container"])){ return ("Container attribute must be an array."); }
|
||||
$attributes["container"]=array_reverse($attributes["container"]);
|
||||
|
||||
//$member_array = array();
|
||||
//$member_array[0] = "cn=user1,cn=Users,dc=yourdomain,dc=com";
|
||||
//$member_array[1] = "cn=administrator,cn=Users,dc=yourdomain,dc=com";
|
||||
|
||||
$add=array();
|
||||
$add["cn"] = $attributes["group_name"];
|
||||
$add["samaccountname"] = $attributes["group_name"];
|
||||
$add["objectClass"] = "Group";
|
||||
$add["description"] = $attributes["description"];
|
||||
//$add["member"] = $member_array; UNTESTED
|
||||
|
||||
$container="OU=".implode(",OU=",$attributes["container"]);
|
||||
$result=ldap_add($this->_conn,"CN=".$add["cn"].", ".$container.",".$this->_base_dn,$add);
|
||||
if ($result!=true){ return (false); }
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
// Remove a group from a group
|
||||
function group_del_group($parent,$child){
|
||||
|
||||
//find the parent dn
|
||||
$parent_group=$this->group_info($parent,array("cn"));
|
||||
if ($parent_group[0]["dn"]==NULL){ return (false); }
|
||||
$parent_dn=$parent_group[0]["dn"];
|
||||
|
||||
//find the child dn
|
||||
$child_group=$this->group_info($child,array("cn"));
|
||||
if ($child_group[0]["dn"]==NULL){ return (false); }
|
||||
$child_dn=$child_group[0]["dn"];
|
||||
|
||||
$del=array();
|
||||
$del["member"] = $child_dn;
|
||||
|
||||
$result=@ldap_mod_del($this->_conn,$parent_dn,$del);
|
||||
if ($result==false){ return (false); }
|
||||
return (true);
|
||||
}
|
||||
|
||||
// Remove a user from a group
|
||||
function group_del_user($group,$user){
|
||||
|
||||
//find the parent dn
|
||||
$group_info=$this->group_info($group,array("cn"));
|
||||
if ($group_info[0]["dn"]==NULL){ return (false); }
|
||||
$group_dn=$group_info[0]["dn"];
|
||||
|
||||
//find the child dn
|
||||
$user_info=$this->user_info($user,array("cn"));
|
||||
if ($user_info[0]["dn"]==NULL){ return (false); }
|
||||
$user_dn=$user_info[0]["dn"];
|
||||
|
||||
$del=array();
|
||||
$del["member"] = $user_dn;
|
||||
|
||||
$result=@ldap_mod_del($this->_conn,$group_dn,$del);
|
||||
if ($result==false){ return (false); }
|
||||
return (true);
|
||||
}
|
||||
|
||||
// Returns an array of information for a specified group
|
||||
function group_info($group_name,$fields=NULL){
|
||||
if ($group_name==NULL){ return (false); }
|
||||
if (!$this->_bind){ return (false); }
|
||||
|
||||
$filter="(&(objectCategory=group)(name=".$this->ldap_slashes($group_name)."))";
|
||||
//echo ($filter."!!!<br>");
|
||||
if ($fields==NULL){ $fields=array("member","memberof","cn","description","distinguishedname","objectcategory","samaccountname"); }
|
||||
$sr=ldap_search($this->_conn,$this->_base_dn,$filter,$fields);
|
||||
$entries = ldap_get_entries($this->_conn, $sr);
|
||||
//print_r($entries);
|
||||
return ($entries);
|
||||
}
|
||||
|
||||
// Retun a complete list of "groups in groups"
|
||||
function recursive_groups($group){
|
||||
if ($group==NULL){ return (false); }
|
||||
|
||||
$ret_groups=array();
|
||||
|
||||
$groups=$this->group_info($group,array("memberof"));
|
||||
$groups=$groups[0]["memberof"];
|
||||
|
||||
if ($groups){
|
||||
$group_names=$this->nice_names($groups);
|
||||
$ret_groups=array_merge($ret_groups,$group_names); //final groups to return
|
||||
|
||||
foreach ($group_names as $id => $group_name){
|
||||
$child_groups=$this->recursive_groups($group_name);
|
||||
$ret_groups=array_merge($ret_groups,$child_groups);
|
||||
}
|
||||
}
|
||||
|
||||
return ($ret_groups);
|
||||
}
|
||||
|
||||
//*****************************************************************************************************************
|
||||
// USER FUNCTIONS
|
||||
|
||||
//create a user
|
||||
function user_create($attributes){
|
||||
//check for compulsory fields
|
||||
if (!array_key_exists("username",$attributes)){ return ("Missing compulsory field [username]"); }
|
||||
if (!array_key_exists("firstname",$attributes)){ return ("Missing compulsory field [firstname]"); }
|
||||
if (!array_key_exists("surname",$attributes)){ return ("Missing compulsory field [surname]"); }
|
||||
if (!array_key_exists("email",$attributes)){ return ("Missing compulsory field [email]"); }
|
||||
if (!array_key_exists("container",$attributes)){ return ("Missing compulsory field [container]"); }
|
||||
if (!is_array($attributes["container"])){ return ("Container attribute must be an array."); }
|
||||
|
||||
if (array_key_exists("password",$attributes) && !$this->_use_ssl){ echo ("FATAL: SSL must be configured on your webserver and enabled in the class to set passwords."); exit(); }
|
||||
|
||||
if (!array_key_exists("display_name",$attributes)){ $attributes["display_name"]=$attributes["firstname"]." ".$attributes["surname"]; }
|
||||
|
||||
//translate the schema
|
||||
$add=$this->adldap_schema($attributes);
|
||||
|
||||
//additional stuff only used for adding accounts
|
||||
$add["cn"][0]=$attributes["display_name"];
|
||||
$add["samaccountname"][0]=$attributes["username"];
|
||||
$add["objectclass"][0]="top";
|
||||
$add["objectclass"][1]="person";
|
||||
$add["objectclass"][2]="organizationalPerson";
|
||||
$add["objectclass"][3]="user"; //person?
|
||||
//$add["name"][0]=$attributes["firstname"]." ".$attributes["surname"];
|
||||
|
||||
//set the account control attribute
|
||||
$control_options=array("NORMAL_ACCOUNT");
|
||||
if (!$attributes["enabled"]){ $control_options[]="ACCOUNTDISABLE"; }
|
||||
$add["userAccountControl"][0]=$this->account_control($control_options);
|
||||
//echo ("<pre>"); print_r($add);
|
||||
|
||||
//determine the container
|
||||
$attributes["container"]=array_reverse($attributes["container"]);
|
||||
$container="OU=".implode(",OU=",$attributes["container"]);
|
||||
|
||||
//add the entry
|
||||
$result=@ldap_add($this->_conn, "CN=".$add["cn"][0].", ".$container.",".$this->_base_dn, $add);
|
||||
if ($result!=true){ return (false); }
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
// user_groups($user)
|
||||
// Returns an array of groups that a user is a member off
|
||||
function user_groups($username,$recursive=NULL){
|
||||
if ($username==NULL){ return (false); }
|
||||
if ($recursive==NULL){ $recursive=$this->_recursive_groups; } //use the default option if they haven't set it
|
||||
if (!$this->_bind){ return (false); }
|
||||
|
||||
//search the directory for their information
|
||||
$info=@$this->user_info($username,array("memberof","primarygroupid"));
|
||||
$groups=$this->nice_names($info[0]["memberof"]); //presuming the entry returned is our guy (unique usernames)
|
||||
|
||||
if ($recursive){
|
||||
foreach ($groups as $id => $group_name){
|
||||
$extra_groups=$this->recursive_groups($group_name);
|
||||
$groups=array_merge($groups,$extra_groups);
|
||||
}
|
||||
}
|
||||
|
||||
return ($groups);
|
||||
}
|
||||
|
||||
// Returns an array of information for a specific user
|
||||
function user_info($username,$fields=NULL){
|
||||
if ($username==NULL){ return (false); }
|
||||
if (!$this->_bind){ return (false); }
|
||||
|
||||
$filter="samaccountname=".$username;
|
||||
if ($fields==NULL){ $fields=array("samaccountname","mail","memberof","department","displayname","telephonenumber","primarygroupid"); }
|
||||
$sr=ldap_search($this->_conn,$this->_base_dn,$filter,$fields);
|
||||
$entries = ldap_get_entries($this->_conn, $sr);
|
||||
|
||||
// AD does not return the primary group in the ldap query, we may need to fudge it
|
||||
if ($this->_real_primarygroup){
|
||||
$entries[0]["memberof"][]=$this->group_cn($entries[0]["primarygroupid"][0]);
|
||||
} else {
|
||||
$entries[0]["memberof"][]="CN=Domain Users,CN=Users,".$this->_base_dn;
|
||||
}
|
||||
|
||||
$entries[0]["memberof"]["count"]++;
|
||||
return ($entries);
|
||||
}
|
||||
|
||||
// Returns true if the user is a member of the group
|
||||
function user_ingroup($username,$group,$recursive=NULL){
|
||||
if ($username==NULL){ return (false); }
|
||||
if ($group==NULL){ return (false); }
|
||||
if (!$this->_bind){ return (false); }
|
||||
if ($recursive==NULL){ $recursive=$this->_recursive_groups; } //use the default option if they haven't set it
|
||||
|
||||
//get a list of the groups
|
||||
$groups=$this->user_groups($username,array("memberof"),$recursive);
|
||||
|
||||
//return true if the specified group is in the group list
|
||||
if (in_array($group,$groups)){ return (true); }
|
||||
|
||||
return (false);
|
||||
}
|
||||
|
||||
//modify a user
|
||||
function user_modify($username,$attributes){
|
||||
if ($username==NULL){ return ("Missing compulsory field [username]"); }
|
||||
if (array_key_exists("password",$attributes) && !$this->_use_ssl){ echo ("FATAL: SSL must be configured on your webserver and enabled in the class to set passwords."); exit(); }
|
||||
//if (array_key_exists("container",$attributes)){
|
||||
//if (!is_array($attributes["container"])){ return ("Container attribute must be an array."); }
|
||||
//$attributes["container"]=array_reverse($attributes["container"]);
|
||||
//}
|
||||
|
||||
//find the dn of the user
|
||||
$user=$this->user_info($username,array("cn"));
|
||||
if ($user[0]["dn"]==NULL){ return (false); }
|
||||
$user_dn=$user[0]["dn"];
|
||||
|
||||
//translate the update to the LDAP schema
|
||||
$mod=$this->adldap_schema($attributes);
|
||||
if (!$mod){ return (false); }
|
||||
|
||||
//set the account control attribute (only if specified)
|
||||
if (array_key_exists("enabled",$attributes)){
|
||||
if ($attributes["enabled"]){ $control_options=array("NORMAL_ACCOUNT"); }
|
||||
else { $control_options=array("NORMAL_ACCOUNT","ACCOUNTDISABLE"); }
|
||||
$mod["userAccountControl"][0]=$this->account_control($control_options);
|
||||
}
|
||||
|
||||
//do the update
|
||||
$result=ldap_modify($this->_conn,$user_dn,$mod);
|
||||
if ($result==false){ return (false); }
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
// Set the password of a user
|
||||
function user_password($username,$password){
|
||||
if ($username==NULL){ return (false); }
|
||||
if ($password==NULL){ return (false); }
|
||||
if (!$this->_bind){ return (false); }
|
||||
if (!$this->_use_ssl){ echo ("FATAL: SSL must be configured on your webserver and enabled in the class to set passwords."); exit(); }
|
||||
|
||||
$user=$this->user_info($username,array("cn"));
|
||||
if ($user[0]["dn"]==NULL){ return (false); }
|
||||
$user_dn=$user[0]["dn"];
|
||||
|
||||
$add=array();
|
||||
$add["unicodePwd"][0]=$this->encode_password($password);
|
||||
|
||||
$result=ldap_mod_replace($this->_conn,$user_dn,$add);
|
||||
if ($result==false){ return (false); }
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
//*****************************************************************************************************************
|
||||
// COMPUTER FUNCTIONS
|
||||
|
||||
// Returns an array of information for a specific computer
|
||||
function computer_info($computer_name,$fields=NULL){
|
||||
if ($computer_name==NULL){ return (false); }
|
||||
if (!$this->_bind){ return (false); }
|
||||
|
||||
$filter="(&(objectClass=computer)(cn=".$computer_name."))";
|
||||
if ($fields==NULL){ $fields=array("memberof","cn","displayname","dnshostname","distinguishedname","objectcategory","operatingsystem","operatingsystemservicepack","operatingsystemversion"); }
|
||||
$sr=ldap_search($this->_conn,$this->_base_dn,$filter,$fields);
|
||||
$entries = ldap_get_entries($this->_conn, $sr);
|
||||
|
||||
return ($entries);
|
||||
}
|
||||
|
||||
// Returns all AD users
|
||||
function all_users($include_desc = false, $search = "*", $sorted = true){
|
||||
if (!$this->_bind){ return (false); }
|
||||
|
||||
//perform the search and grab all their details
|
||||
$filter = "(&(objectClass=user)(samaccounttype=". ADLDAP_NORMAL_ACCOUNT .")(objectCategory=person)(cn=".$search."))";
|
||||
$fields=array("samaccountname","displayname");
|
||||
$sr=ldap_search($this->_conn,$this->_base_dn,$filter,$fields);
|
||||
$entries = ldap_get_entries($this->_conn, $sr);
|
||||
|
||||
$users_array = array();
|
||||
for ($i=0; $i<$entries["count"]; $i++){
|
||||
if ($include_desc && strlen($entries[$i]["displayname"][0])>0){
|
||||
$users_array[ $entries[$i]["samaccountname"][0] ] = $entries[$i]["displayname"][0];
|
||||
} elseif ($include_desc){
|
||||
$users_array[ $entries[$i]["samaccountname"][0] ] = $entries[$i]["samaccountname"][0];
|
||||
} else {
|
||||
array_push($users_array, $entries[$i]["samaccountname"][0]);
|
||||
}
|
||||
}
|
||||
if ($sorted){ asort($users_array); }
|
||||
return ($users_array);
|
||||
}
|
||||
|
||||
// Returns a complete list of the groups in AD
|
||||
function all_groups($include_desc = false, $search = "*", $sorted = true){
|
||||
if (!$this->_bind){ return (false); }
|
||||
|
||||
//perform the search and grab all their details
|
||||
$filter = "(&(objectCategory=group)(samaccounttype=". ADLDAP_SECURITY_GLOBAL_GROUP .")(cn=".$search."))";
|
||||
$fields=array("samaccountname","description");
|
||||
$sr=ldap_search($this->_conn,$this->_base_dn,$filter,$fields);
|
||||
$entries = ldap_get_entries($this->_conn, $sr);
|
||||
|
||||
$groups_array = array();
|
||||
for ($i=0; $i<$entries["count"]; $i++){
|
||||
if ($include_desc && strlen($entries[$i]["description"][0]) > 0 ){
|
||||
$groups_array[ $entries[$i]["samaccountname"][0] ] = $entries[$i]["description"][0];
|
||||
} elseif ($include_desc){
|
||||
$groups_array[ $entries[$i]["samaccountname"][0] ] = $entries[$i]["samaccountname"][0];
|
||||
} else {
|
||||
array_push($groups_array, $entries[$i]["samaccountname"][0]);
|
||||
}
|
||||
}
|
||||
if( $sorted ){ asort($groups_array); }
|
||||
return ($groups_array);
|
||||
}
|
||||
|
||||
//************************************************************************************************************
|
||||
// UTILITY FUNCTIONS (not intended to be called directly but I spose you could?)
|
||||
|
||||
function adldap_schema($attributes){
|
||||
|
||||
//ldap doesn't like NULL attributes, only set them if they have values
|
||||
// I'd like to know how to set an LDAP attribute to NULL though, at the moment I set it to a space
|
||||
$mod=array();
|
||||
if ($attributes["address_city"]){ $mod["l"][0]=$attributes["address_city"]; }
|
||||
if ($attributes["address_code"]){ $mod["postalCode"][0]=$attributes["address_code"]; }
|
||||
//if ($attributes["address_country"]){ $mod["countryCode"][0]=$attributes["address_country"]; } // use country codes?
|
||||
if ($attributes["address_pobox"]){ $mod["postOfficeBox"][0]=$attributes["address_pobox"]; }
|
||||
if ($attributes["address_state"]){ $mod["st"][0]=$attributes["address_state"]; }
|
||||
if ($attributes["address_street"]){ $mod["streetAddress"][0]=$attributes["address_street"]; }
|
||||
if ($attributes["company"]){ $mod["company"][0]=$attributes["company"]; }
|
||||
if ($attributes["change_password"]){ $mod["pwdLastSet"][0]=0; }
|
||||
if ($attributes["company"]){ $mod["company"][0]=$attributes["company"]; }
|
||||
if ($attributes["department"]){ $mod["department"][0]=$attributes["department"]; }
|
||||
if ($attributes["description"]){ $mod["description"][0]=$attributes["description"]; }
|
||||
if ($attributes["display_name"]){ $mod["displayName"][0]=$attributes["display_name"]; }
|
||||
if ($attributes["email"]){ $mod["mail"][0]=$attributes["email"]; }
|
||||
if ($attributes["expires"]){ $mod["accountExpires"][0]=$attributes["expires"]; } //unix epoch format?
|
||||
if ($attributes["firstname"]){ $mod["givenName"][0]=$attributes["firstname"]; }
|
||||
if ($attributes["home_directory"]){ $mod["homeDirectory"][0]=$attributes["home_directory"]; }
|
||||
if ($attributes["home_drive"]){ $mod["homeDrive"][0]=$attributes["home_drive"]; }
|
||||
if ($attributes["initials"]){ $mod["initials"][0]=$attributes["initials"]; }
|
||||
if ($attributes["logon_name"]){ $mod["userPrincipalName"][0]=$attributes["logon_name"]; }
|
||||
if ($attributes["manager"]){ $mod["manager"][0]=$attributes["manager"]; } //UNTESTED ***Use DistinguishedName***
|
||||
if ($attributes["office"]){ $mod["physicalDeliveryOfficeName"][0]=$attributes["office"]; }
|
||||
if ($attributes["password"]){ $mod["unicodePwd"][0]=$this->encode_password($attributes["password"]); }
|
||||
if ($attributes["profile_path"]){ $mod["profilepath"][0]=$attributes["profile_path"]; }
|
||||
if ($attributes["script_path"]){ $mod["scriptPath"][0]=$attributes["script_path"]; }
|
||||
if ($attributes["surname"]){ $mod["sn"][0]=$attributes["surname"]; }
|
||||
if ($attributes["title"]){ $mod["title"][0]=$attributes["title"]; }
|
||||
if ($attributes["telephone"]){ $mod["telephoneNumber"][0]=$attributes["telephone"]; }
|
||||
if ($attributes["web_page"]){ $mod["wWWHomePage"][0]=$attributes["web_page"]; }
|
||||
//echo ("<pre>"); print_r($mod);
|
||||
/*
|
||||
// modifying a name is a bit fiddly
|
||||
if ($attributes["firstname"] && $attributes["surname"]){
|
||||
$mod["cn"][0]=$attributes["firstname"]." ".$attributes["surname"];
|
||||
$mod["displayname"][0]=$attributes["firstname"]." ".$attributes["surname"];
|
||||
$mod["name"][0]=$attributes["firstname"]." ".$attributes["surname"];
|
||||
}
|
||||
*/
|
||||
|
||||
|
||||
if (count($mod)==0){ return (false); }
|
||||
return ($mod);
|
||||
}
|
||||
|
||||
|
||||
function group_cn($gid){
|
||||
// coping with AD not returning the primary group
|
||||
// http://support.microsoft.com/?kbid=321360
|
||||
// for some reason it's not possible to search on primarygrouptoken=XXX
|
||||
// if someone can show otherwise, I'd like to know about it :)
|
||||
// this way is resource intensive and generally a pain in the @#%^
|
||||
|
||||
if ($gid==NULL){ return (false); }
|
||||
$r=false;
|
||||
|
||||
$filter="(&(objectCategory=group)(samaccounttype=". ADLDAP_SECURITY_GLOBAL_GROUP ."))";
|
||||
$fields=array("primarygrouptoken","samaccountname","distinguishedname");
|
||||
$sr=ldap_search($this->_conn,$this->_base_dn,$filter,$fields);
|
||||
$entries = ldap_get_entries($this->_conn, $sr);
|
||||
|
||||
for ($i=0; $i<$entries["count"]; $i++){
|
||||
if ($entries[$i]["primarygrouptoken"][0]==$gid){
|
||||
$r=$entries[$i]["distinguishedname"][0];
|
||||
$i=$entries["count"];
|
||||
}
|
||||
}
|
||||
|
||||
return ($r);
|
||||
}
|
||||
|
||||
// Encode a password for transmission over LDAP
|
||||
function encode_password($password){
|
||||
$password="\"".$password."\"";
|
||||
$encoded="";
|
||||
for ($i=0; $i <strlen($password); $i++){ $encoded.="{$password{$i}}\000"; }
|
||||
return ($encoded);
|
||||
}
|
||||
|
||||
// Escape bad characters
|
||||
// DEVELOPERS SHOULD BE DOING PROPER FILTERING IF THEY'RE ACCEPTING USER INPUT
|
||||
// this is just a list of characters with known problems and I'm trying not to strip out other languages
|
||||
function ldap_slashes($str){
|
||||
$illegal=array("(",")","#"); // the + character has problems too, but it's an illegal character
|
||||
|
||||
$legal=array();
|
||||
foreach ($illegal as $id => $char){ $legal[$id]="\\".$char; } //make up the array of legal chars
|
||||
|
||||
$str=str_replace($illegal,$legal,$str); //replace them
|
||||
return ($str);
|
||||
}
|
||||
|
||||
// Return a random controller
|
||||
function random_controller(){
|
||||
//select a random domain controller
|
||||
mt_srand(doubleval(microtime()) * 100000000); // for older php versions
|
||||
return ($this->_domain_controllers[array_rand($this->_domain_controllers)]);
|
||||
}
|
||||
|
||||
function account_control($options){
|
||||
$val=0;
|
||||
|
||||
if (is_array($options)){
|
||||
if (in_array("SCRIPT",$options)){ $val=$val+1; }
|
||||
if (in_array("ACCOUNTDISABLE",$options)){ $val=$val+2; }
|
||||
if (in_array("HOMEDIR_REQUIRED",$options)){ $val=$val+8; }
|
||||
if (in_array("LOCKOUT",$options)){ $val=$val+16; }
|
||||
if (in_array("PASSWD_NOTREQD",$options)){ $val=$val+32; }
|
||||
//PASSWD_CANT_CHANGE Note You cannot assign this permission by directly modifying the UserAccountControl attribute.
|
||||
//For information about how to set the permission programmatically, see the "Property flag descriptions" section.
|
||||
if (in_array("ENCRYPTED_TEXT_PWD_ALLOWED",$options)){ $val=$val+128; }
|
||||
if (in_array("TEMP_DUPLICATE_ACCOUNT",$options)){ $val=$val+256; }
|
||||
if (in_array("NORMAL_ACCOUNT",$options)){ $val=$val+512; }
|
||||
if (in_array("INTERDOMAIN_TRUST_ACCOUNT",$options)){ $val=$val+2048; }
|
||||
if (in_array("WORKSTATION_TRUST_ACCOUNT",$options)){ $val=$val+4096; }
|
||||
if (in_array("SERVER_TRUST_ACCOUNT",$options)){ $val=$val+8192; }
|
||||
if (in_array("DONT_EXPIRE_PASSWORD",$options)){ $val=$val+65536; }
|
||||
if (in_array("MNS_LOGON_ACCOUNT",$options)){ $val=$val+131072; }
|
||||
if (in_array("SMARTCARD_REQUIRED",$options)){ $val=$val+262144; }
|
||||
if (in_array("TRUSTED_FOR_DELEGATION",$options)){ $val=$val+524288; }
|
||||
if (in_array("NOT_DELEGATED",$options)){ $val=$val+1048576; }
|
||||
if (in_array("USE_DES_KEY_ONLY",$options)){ $val=$val+2097152; }
|
||||
if (in_array("DONT_REQ_PREAUTH",$options)){ $val=$val+4194304; }
|
||||
if (in_array("PASSWORD_EXPIRED",$options)){ $val=$val+8388608; }
|
||||
if (in_array("TRUSTED_TO_AUTH_FOR_DELEGATION",$options)){ $val=$val+16777216; }
|
||||
}
|
||||
return ($val);
|
||||
}
|
||||
|
||||
// Take an ldap query and return the nice names, without all the LDAP prefixes (eg. CN, DN)
|
||||
function nice_names($groups){
|
||||
|
||||
$group_array=array();
|
||||
for ($i=0; $i<$groups["count"]; $i++){ //for each group
|
||||
$line=$groups[$i];
|
||||
|
||||
if (strlen($line)>0){
|
||||
//more presumptions, they're all prefixed with CN=
|
||||
//so we ditch the first three characters and the group
|
||||
//name goes up to the first comma
|
||||
$bits=explode(",",$line);
|
||||
$group_array[]=substr($bits[0],3,(strlen($bits[0])-3));
|
||||
}
|
||||
}
|
||||
return ($group_array);
|
||||
}
|
||||
|
||||
|
||||
|
||||
// Returns an array of information for a specific user
|
||||
function user_dump($dn){
|
||||
if ($dn==NULL){ return (false); }
|
||||
if (!$this->_bind){ return (false); }
|
||||
|
||||
|
||||
$filter = "(objectclass=*)";
|
||||
|
||||
$sr=ldap_read($this->_conn,$dn,$filter);
|
||||
$entries = ldap_get_entries($this->_conn, $sr);
|
||||
|
||||
return ($entries);
|
||||
}
|
||||
|
||||
} // End class
|
||||
|
||||
?>
|
60
modules/pam/pam_plugins/ad/adLDAP/authenticate.php
Normal file
@ -0,0 +1,60 @@
|
||||
<?php
|
||||
|
||||
$username=strtoupper($_POST["username"]); //remove case sensitivity on the username
|
||||
$password=$_POST["password"];
|
||||
|
||||
$options = array(
|
||||
'account_suffix' => "@trinity-health.org",
|
||||
'base_dn' => "dc=trinity-health,dc=org",
|
||||
'domain_controllers' => array ("ldap://addir.trinity-health.org"),
|
||||
'ad_username' => 'js224113',
|
||||
'ad_password' => 'pass4tis'
|
||||
);
|
||||
|
||||
|
||||
|
||||
if ($_POST["oldform"]){ //prevent null bind
|
||||
|
||||
if ($username!=NULL && $password!=NULL){
|
||||
//include the class and create a connection
|
||||
include ("adLDAP.php");
|
||||
$adldap = new adLDAP($options);
|
||||
|
||||
//authenticate the user
|
||||
if ($adldap -> authenticate($username,$password)){
|
||||
//establish your session and redirect
|
||||
$failed=0;
|
||||
}
|
||||
}
|
||||
$failed=1;
|
||||
}
|
||||
|
||||
?>
|
||||
|
||||
|
||||
<html>
|
||||
<head>
|
||||
<title>adLDAP example</title>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
Please login to continue.<br>
|
||||
|
||||
<form method='post' action='<?php echo $_SERVER["PHP_SELF"]; ?>'>
|
||||
<input type='hidden' name='oldform' value='1'>
|
||||
|
||||
Username: <input type='text' name='username' value='<?php echo ($username); ?>'><br>
|
||||
Password: <input type='password' name='password'><br>
|
||||
<br>
|
||||
|
||||
<input type='submit' name='submit' value='Submit'><br>
|
||||
<?php if ($failed){ echo ("<br>Login Failed!<br><br>\n"); } ?>
|
||||
</form>
|
||||
|
||||
<?php if ($logout=="yes") { echo ("<br>You have successfully logged out."); } ?>
|
||||
|
||||
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
102
modules/pam/pam_plugins/ad/adLDAP/examples.php
Normal file
@ -0,0 +1,102 @@
|
||||
<?
|
||||
/*
|
||||
Examples file
|
||||
|
||||
To test any of the functions, just change the 0 to a 1.
|
||||
*/
|
||||
|
||||
//error_reporting(E_ALL ^ E_NOTICE);
|
||||
|
||||
include ("adLDAP.php");
|
||||
$ldap=new adLDAP($options);
|
||||
//var_dump($ldap);
|
||||
|
||||
echo ("<pre>\n");
|
||||
|
||||
// authenticate a username/password
|
||||
if (0){
|
||||
$result=$ldap->authenticate("username","password");
|
||||
var_dump($result);
|
||||
}
|
||||
|
||||
// add a group to a group
|
||||
if (0){
|
||||
$result=$ldap->group_add_group("Parent Group Name","Child Group Name");
|
||||
var_dump($result);
|
||||
}
|
||||
|
||||
// add a user to a group
|
||||
if (0){
|
||||
$result=$ldap->group_add_user("Group Name","username");
|
||||
var_dump($result);
|
||||
}
|
||||
|
||||
// create a group
|
||||
if (0){
|
||||
$attributes=array(
|
||||
"group_name"=>"Test Group",
|
||||
"description"=>"Just Testing",
|
||||
"container"=>array("Groups","A Container"),
|
||||
);
|
||||
$result=$ldap->group_create($attributes);
|
||||
var_dump($result);
|
||||
}
|
||||
|
||||
// retrieve information about a group
|
||||
if (0){
|
||||
$result=$ldap->group_info("Group Name");
|
||||
var_dump($result);
|
||||
}
|
||||
|
||||
// create a user account
|
||||
if (0){
|
||||
$attributes=array(
|
||||
"username"=>"freds",
|
||||
"logon_name"=>"freds@mydomain.local",
|
||||
"firstname"=>"Fred",
|
||||
"surname"=>"Smith",
|
||||
"company"=>"My Company",
|
||||
"department"=>"My Department",
|
||||
"email"=>"freds@mydomain.local",
|
||||
"container"=>array("Container Parent","Container Child"),
|
||||
"enabled"=>1,
|
||||
"password"=>"Password123",
|
||||
);
|
||||
|
||||
$result=$ldap->user_create($attributes);
|
||||
var_dump($result);
|
||||
}
|
||||
|
||||
// retrieve the group membership for a user
|
||||
if (0){
|
||||
$result=$ldap->user_groups("username");
|
||||
print_r($result);
|
||||
}
|
||||
|
||||
// retrieve information about a user
|
||||
if (0){
|
||||
$result=$ldap->user_info("username");
|
||||
print_r($result);
|
||||
}
|
||||
|
||||
// check if a user is a member of a group
|
||||
if (0){
|
||||
$result=$ldap->user_ingroup("username","Group Name");
|
||||
var_dump($result);
|
||||
}
|
||||
|
||||
// modify a user account (this example will set "user must change password at next logon")
|
||||
if (0){
|
||||
$attributes=array(
|
||||
"change_password"=>1,
|
||||
);
|
||||
$result=$ldap->user_modify("username",$attributes);
|
||||
var_dump($result);
|
||||
}
|
||||
|
||||
// change the password of a user
|
||||
if (0){
|
||||
$result=$ldap->user_password("username","Password123");
|
||||
var_dump($result);
|
||||
}
|
||||
?>
|
11
modules/pam/pam_plugins/ad/config.php
Normal file
@ -0,0 +1,11 @@
|
||||
<?php defined("SYSPATH") or die("No direct script access.");
|
||||
|
||||
$options = array(
|
||||
'account_suffix' => "@domain.com",
|
||||
'base_dn' => "DC=USER,DC=COM",
|
||||
'domain_controllers' => array ("ldap://doamin.controller.com"),
|
||||
'ad_username' => 'username',
|
||||
'ad_password' => 'password'
|
||||
);
|
||||
|
||||
|
57
modules/pam/pam_plugins/mock/mock.php
Normal file
@ -0,0 +1,57 @@
|
||||
<?php defined("SYSPATH") or die("No direct script access.");
|
||||
|
||||
|
||||
/**
|
||||
* a plugin to test the PAM module
|
||||
*
|
||||
*/
|
||||
class pam_mock
|
||||
{
|
||||
private $result;
|
||||
private $name;
|
||||
private $full_name;
|
||||
private $email;
|
||||
|
||||
/**
|
||||
*
|
||||
* @param string $name
|
||||
* @param string $pass
|
||||
*/
|
||||
public function __construct($name, $pass)
|
||||
{
|
||||
$this->result = ($name == $pass)?true:false;
|
||||
$this->name = $name;
|
||||
$this->full_name = 'Mock ' . $name;
|
||||
$this->email = $name . '@email.com';
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
*
|
||||
* @return boolean
|
||||
*/
|
||||
public function isAuth()
|
||||
{
|
||||
return $this->result;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
*
|
||||
* @return object or false
|
||||
*/
|
||||
public function getAccount()
|
||||
{
|
||||
$account = array(
|
||||
'name' => $this->name,
|
||||
'full_name' => $this->full_name,
|
||||
'email' => $this->email,
|
||||
);
|
||||
|
||||
return (object) $account;
|
||||
}
|
||||
|
||||
|
||||
|
||||
}
|
||||
?>
|
24
modules/pam/plugins/gallery/gallery.php
Normal file
@ -0,0 +1,24 @@
|
||||
<?php defined("SYSPATH") or die("No direct script access.");
|
||||
|
||||
|
||||
/**
|
||||
* a plugin to authenticate users using the Gallery3 identity
|
||||
*
|
||||
*/
|
||||
class pam_gallery
|
||||
{
|
||||
private $result;
|
||||
|
||||
public function __construct($name, $pass)
|
||||
{
|
||||
$user = identity::lookup_user_by_name($name);
|
||||
$this->result = identity::is_correct_password($user, $pass);
|
||||
}
|
||||
|
||||
public function isAuth()
|
||||
{
|
||||
return $this->result;
|
||||
}
|
||||
|
||||
}
|
||||
?>
|
18
modules/pam/views/pam_ajax.html.php
Normal file
@ -0,0 +1,18 @@
|
||||
<?php defined("SYSPATH") or die("No direct script access.") ?>
|
||||
|
||||
<script type="text/javascript">
|
||||
$("#g-login-form").ready(function() {
|
||||
|
||||
// Setting the focus here doesn't work on IE7, perhaps because the field is
|
||||
// not ready yet? So set a timeout and do it the next time we're idle
|
||||
setTimeout('$("#g-username").focus()', 100);
|
||||
});
|
||||
|
||||
</script>
|
||||
<div id="g-login">
|
||||
<ul>
|
||||
<li id="g-login-form">
|
||||
<?= $form ?>
|
||||
</li>
|
||||
</ul>
|
||||
</div>
|
Before Width: | Height: | Size: 12 KiB After Width: | Height: | Size: 12 KiB |
Before Width: | Height: | Size: 260 B After Width: | Height: | Size: 260 B |
Before Width: | Height: | Size: 251 B After Width: | Height: | Size: 251 B |
Before Width: | Height: | Size: 178 B After Width: | Height: | Size: 178 B |
Before Width: | Height: | Size: 104 B After Width: | Height: | Size: 104 B |
Before Width: | Height: | Size: 153 B After Width: | Height: | Size: 153 B |
Before Width: | Height: | Size: 105 B After Width: | Height: | Size: 105 B |
Before Width: | Height: | Size: 3.7 KiB After Width: | Height: | Size: 3.7 KiB |
Before Width: | Height: | Size: 90 B After Width: | Height: | Size: 90 B |
Before Width: | Height: | Size: 129 B After Width: | Height: | Size: 129 B |
Before Width: | Height: | Size: 4.3 KiB After Width: | Height: | Size: 4.3 KiB |
Before Width: | Height: | Size: 4.3 KiB After Width: | Height: | Size: 4.3 KiB |
Before Width: | Height: | Size: 4.3 KiB After Width: | Height: | Size: 4.3 KiB |
Before Width: | Height: | Size: 4.3 KiB After Width: | Height: | Size: 4.3 KiB |
Before Width: | Height: | Size: 4.3 KiB After Width: | Height: | Size: 4.3 KiB |
Before Width: | Height: | Size: 23 KiB After Width: | Height: | Size: 23 KiB |