mirror of
https://github.com/wheelybird/ldap-user-manager.git
synced 2025-01-18 23:42:54 +01:00
Update entries with any missing additional objectclasses when updating entries. Update README to describe changes. Initial work to allow file uploads for attributes.
This commit is contained in:
Brian Lycett
parent
9092a3a39b
commit
e46e590c79
63
README.md
63
README.md
@ -92,26 +92,27 @@ For example, if you're using Docker Swarm and you've set the LDAP bind password
|
||||
* `SERVER_HOSTNAME` (default: *ldapusername.org*): The hostname that this interface will be served from.
|
||||
|
||||
* `SERVER_PATH` (default: */*): The path to the user manager on the webserver. Useful if running this behind a reverse proxy.
|
||||
|
||||
|
||||
* `SERVER_PORT` (default: *80 or 80 & 443*): The port the webserver inside the container will listen on. If undefined then the internal webserver will listen on ports 80 and 443 (if `NO_HTTPS` is true it's just 80) and HTTP traffic is redirected to HTTPS. When set this will disable the redirection and the internal webserver will listen for HTTPS traffic on this port (or for HTTP traffic if `NO_HTTPS` is true). This is for use when the container's Docker network mode is set to `host`.
|
||||
|
||||
|
||||
* `NO_HTTPS` (default: *FALSE*): If you set this to *TRUE* then the server will run in HTTP mode, without any encryption. This is insecure and should only be used for testing. See [HTTPS certificates](#https-certificates)
|
||||
|
||||
|
||||
* `SERVER_KEY_FILENAME`: (default *server.key*): The filename of the HTTPS server key file. See [HTTPS certificates](#https-certificates)
|
||||
|
||||
|
||||
* `SERVER_CERT_FILENAME`: (default *server.crt*): The filename of the HTTPS certficate file. See [HTTPS certificates](#https-certificates)
|
||||
|
||||
|
||||
* `CA_CERT_FILENAME`: (default *ca.crt*): The filename of the HTTPS server key file. See [HTTPS certificates](#https-certificates)
|
||||
|
||||
|
||||
* `SESSION_TIMEOUT` (default: *10 minutes*): How long before an idle session will be timed out.
|
||||
|
||||
|
||||
#### Organisation settings
|
||||
#### Interface customisation
|
||||
|
||||
* `ORGANISATION_NAME`: (default: *LDAP*): Your organisation's name.
|
||||
|
||||
* `SITE_NAME` (default: *{ORGANISATION_NAME} user manager*): Change this to replace the title in the menu, e.g. "My Company Account Management".
|
||||
|
||||
* `SITE_NAME` (default: *`ORGANISATION_NAME` user manager*): Change this to replace the title in the menu, e.g. "My Company Account Management".
|
||||
|
||||
* `SIMPLE_INTERFACE` (default: *FALSE*): If set to `TRUE` this will hide most **posixAccount** and **posixGroup** attributes from the account and group forms. This is useful if you won't use the LDAP accounts for server accounts. The Posix values are still set in the background using the default values. Enabling this won't prevent any `LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES` or `LDAP_GROUP_ADDITIONAL_ATTRIBUTES` from being displayed.
|
||||
|
||||
#### LDAP settings
|
||||
|
||||
@ -134,11 +135,15 @@ These settings should only be changed if you're trying to make the user manager
|
||||
* `LDAP_GROUP_ATTRIBUTE` (default: *cn*): The attribute used as the group identifier.
|
||||
|
||||
* `LDAP_GROUP_MEMBERSHIP_ATTRIBUTE` (default: *memberUID* or *uniqueMember*): The attribute used when adding a user's account to a group. When the `groupOfMembers` objectClass is detected `FORCE_RFC2307BIS` is `TRUE` it defaults to `uniqueMember`, otherwise it'll default to `memberUID`. Explicitly setting this variable will override any default.
|
||||
|
||||
|
||||
* `LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES` (no default): A comma-separated list of additional objectClasses to use when creating an account. See [Extra objectClasses and attributes](#extra-objectclasses-and-attributes) for more information.
|
||||
|
||||
|
||||
* `LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES` (no default): A comma-separated list of extra attributes to display when creating an account. See [Extra objectClasses and attributes](#extra-objectclasses-and-attributes) for more information.
|
||||
|
||||
* `GROUP_ACCOUNT_ADDITIONAL_OBJECTCLASSES` (no default): A comma-separated list of additional objectClasses to use when creating a group. See [Extra objectClasses and attributes](#extra-objectclasses-and-attributes) for more information.
|
||||
|
||||
* `GROUP_ACCOUNT_ADDITIONAL_ATTRIBUTES` (no default): A comma-separated list of extra attributes to display when creating a group. See [Extra objectClasses and attributes](#extra-objectclasses-and-attributes) for more information.
|
||||
|
||||
* `LDAP_GROUP_MEMBERSHIP_USES_UID` (default: *TRUE* or *FALSE*): If *TRUE* then the entry for a member of a group will be just the username, otherwise it's the member's full DN. When the `groupOfMembers` objectClass is detected or `FORCE_RFC2307BIS` is `TRUE` it defaults to `FALSE`, otherwise it'll default to `TRUE`. Explicitly setting this variable will override the default.
|
||||
|
||||
* `FORCE_RFC2307BIS` (default: *FALSE*): Set to *TRUE* if the auto-detection is failing to spot that the RFC2307BIS schema is available. When *FALSE* the user manager will use auto-detection. See [Using the RFC2307BIS schema](#using-the-rfc2307bis-schema) for more information.
|
||||
@ -157,7 +162,7 @@ These settings should only be changed if you're trying to make the user manager
|
||||
* `USERNAME_FORMAT` (default: *{first_name}-{last_name}*): The template used to dynamically generate the usernames stored in the `uid` attribute. See [Username format](#username-format).
|
||||
|
||||
* `USERNAME_REGEX` (default: *^[a-z][a-zA-Z0-9\._-]{3,32}$*): The regular expression used to ensure account names and group names are safe to use on servers. See [Username format](#username-format).
|
||||
|
||||
|
||||
* `PASSWORD_HASH` (no default): Select which hashing method which will be used to store passwords in LDAP. Options are (in order of precedence) `SHA512CRYPT`, `SHA256CRYPT`, `MD5CRYPT`, `SSHA`, `SHA`, `SMD5`, `MD5`, `CRYPT` & `CLEAR`. If your chosen method isn't available on your system then the strongest available method will be automatically selected - `SSHA` is the strongest method guaranteed to be available. Cleartext passwords should NEVER be used in any situation outside of a test.
|
||||
|
||||
* `ACCEPT_WEAK_PASSWORDS` (default: *FALSE*): Set this to *TRUE* to prevent a password being rejected for being too weak. The password strength indicators will still gauge the strength of the password. Don't enable this in a production environment.
|
||||
@ -183,9 +188,9 @@ To send emails you'll need to use an existing SMTP server. Email sending will b
|
||||
* `EMAIL_FROM_ADDRESS` (default: *admin@`EMAIL_DOMAIN`*): The FROM email address used when sending out emails. The default domain is taken from `EMAIL_DOMAIN` under **User account settings**.
|
||||
|
||||
* `EMAIL_FROM_NAME` (default: *`SITE_NAME`*): The FROM name used when sending out emails. The default name is taken from `SITE_NAME` under **Organisation settings**.
|
||||
|
||||
|
||||
* `MAIL_SUBJECT` (default: *Your `ORGANISATION_NAME` account has been created.*): The mail subject for new account emails.
|
||||
|
||||
|
||||
* `NEW_ACCOUNT_EMAIL_SUBJECT`, `NEW_ACCOUNT_EMAIL_BODY`, `RESET_PASSWORD_EMAIL_SUBJECT` & `RESET_PASSWORD_EMAIL_BODY`: Change the email contents for emails sent to users when you create an account or reset a password. See [Sending emails](#sending_emails) for full details.
|
||||
|
||||
|
||||
@ -193,8 +198,8 @@ To send emails you'll need to use an existing SMTP server. Email sending will b
|
||||
|
||||
#### Account request settings
|
||||
|
||||
* `ACCOUNT_REQUESTS_ENABLED` (default: *FALSE*): Set to TRUE in order to enable a form that people can fill in to request an account. This will send an email to `ACCOUNT_REQUESTS_EMAIL` with their details and a link to the account creation page where the details will be filled in automatically. You'll need to set up email sending (see **Email sending**, above) for this to work. If this is enabled but email sending isn't then requests will be disabled and an error message sent to the logs.
|
||||
|
||||
* `ACCOUNT_REQUESTS_ENABLED` (default: *FALSE*): Set to TRUE in order to enable a form that people can fill in to request an account. This will send an email to `ACCOUNT_REQUESTS_EMAIL` with their details and a link to the account creation page where the details will be filled in automatically. You'll need to set up email sending (see **Email sending**, above) for this to work. If this is enabled but email sending isn't then requests will be disabled and an error message sent to the logs.
|
||||
|
||||
* `ACCOUNT_REQUESTS_EMAIL` (default: *{EMAIL_FROM_ADDRESS}*): This is the email address that any requests for a new account are sent to.
|
||||
|
||||
|
||||
@ -207,7 +212,6 @@ To send emails you'll need to use an existing SMTP server. Email sending will b
|
||||
* `SESSION_DEBUG` (default: *FALSE*): Set to TRUE to increase the logging level for sessions and user authorisation. This will output cookie passkeys to the error log - don't enable this in a production environment.
|
||||
|
||||
* `SMTP_LOG_LEVEL` (default: *0*): Set to between 1-4 to get SMTP logging information (0 disables SMTP debugging logs though it will still display errors). See https://github.com/PHPMailer/PHPMailer/wiki/SMTP-Debugging for details of the levels.
|
||||
|
||||
|
||||
***
|
||||
|
||||
@ -247,7 +251,7 @@ If you're using LDAP for server accounts then you'll find there are normally co
|
||||
## HTTPS certificates
|
||||
The user manager runs in HTTPS mode by default and so uses HTTPS certificates. You can pass in your own certificates by bind-mounting a local path to `/opt/ssl` in the container and then specifying the names of the files via `SERVER_KEY_FILENAME`, `SERVER_CERT_FILENAME` and optionally `CA_CERT_FILENAME` (this will set Apache's `SSLCertificateChainFile` directive).
|
||||
If the certificate and key files don't exist then a self-signed certificate will be created when the container starts.
|
||||
|
||||
|
||||
When using your own certificates, the certificate's common name (or one of the alternative names) need to match the value you set for `SERVER_HOSTNAME`.
|
||||
|
||||
For example, if your key and certificate files are in `/home/myaccount/ssl` you can bind-mount that folder by adding these lines to the `docker run` example above (place them above the final line):
|
||||
@ -257,14 +261,13 @@ For example, if your key and certificate files are in `/home/myaccount/ssl` you
|
||||
-e "CA_CERT_FILENAME=ca_bundle.pem" \
|
||||
-v /home/myaccount/ssl:/opt/ssl \
|
||||
```
|
||||
|
||||
|
||||
If you don't want to use HTTPS certificates then set `NO_HTTPS` to **TRUE** to run in HTTP mode. It's advised that you only do this when testing.
|
||||
|
||||
***
|
||||
|
||||
## Sending emails
|
||||
|
||||
|
||||
When you create an account you'll have an option to send an email to the person you created the account for. The email will give them their new username, password and a link to the self-service password change utility.
|
||||
|
||||
Emails are sent via SMTP, so you'll need to be able to connect to an SMTP server and pass in the settings for that server via environmental variables - see **Email sending** above.
|
||||
@ -313,12 +316,14 @@ If `EMAIL_DOMAIN` is set then the email address field will be automatically upda
|
||||
|
||||
## Extra objectClasses and attributes
|
||||
|
||||
If you need to use this user manager with an existing LDAP directory and your account records need additional objectClasses and attributes then you can add them via `LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES` and `LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES`.
|
||||
By default accounts are created with `person`, `inetOrgPerson` and `posixAccount` object classes. Groups are created with `posixGroup` - if [the RFC2307BIS schema](#using-the-rfc2307bis-schema) is available then `groupOfUniqueNames` is automatically added too.
|
||||
|
||||
`LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES` is a comma-separated list of objectClasses to add when creating the account record. For example, `LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES=ldappublickey,couriermailaccount`.
|
||||
If you need to add additional objectClasses and attributes to accounts or groups then you can add them via `LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES`, `LDAP_GROUP_ADDITIONAL_OBJECTCLASSES`, `LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES` and `LDAP_GROUP_ADDITIONAL_ATTRIBUTES`.
|
||||
|
||||
`LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES` is a comma-separated list of attributes to be displayed as extra fields on the account management page.
|
||||
By default these fields will be empty, with the field named for the attribute, but you can set the field labels (and optionally the default values) by appending the attribute names with colon-separated values like so: `attribute_name:label:default_value`.
|
||||
`LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES` and `LDAP_GROUP_ADDITIONAL_OBJECTCLASSES take a comma-separated list of objectClasses to add. For example, `LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES=ldappublickey,couriermailaccount`.
|
||||
|
||||
`LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES` and `LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES` take a comma-separated list of attributes to be displayed as extra fields for the account or group.
|
||||
By default these fields will be empty with the field named for the attribute, but you can set the field labels (and optionally the default values) by appending the attribute names with colon-separated values like so: `attribute_name:label:default_value`.
|
||||
Multiple attributes are separated by commas, so you can define the label and default values for several attributes as follows: `attribute1:label1:default_value1,attribute2:label2:default_value2,attribute3:label3`.
|
||||
|
||||
As an example, to set a mailbox name and quota for the `couriermailaccount` schema you can pass these variables to the container:
|
||||
@ -329,7 +334,6 @@ LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES="mailbox:Mailbox:domain.com,quota:Mail quota:
|
||||
|
||||
_Note_: ObjectClasses often have attributes that _must_ have a value, so you should set a default value for these attributes, otherwise if you forget to add a value when filling in the form an error will be thrown on submission.
|
||||
|
||||
|
||||
### Multi-value attributes
|
||||
|
||||
If you have an attribute that could have several values, you can add a `+` to end of the attribute name. This will modify the form so you can add or remove extra values for that attribute. For example, if you want to have multiple email aliases when using the _PostfixBookMailAccount_ schema then you can pass these variables to the container:
|
||||
@ -338,6 +342,14 @@ LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES=PostfixBookMailAccount" \
|
||||
LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES=mailAlias+:Email aliases"
|
||||
```
|
||||
|
||||
### Binary attributes
|
||||
|
||||
If you have an attribute that stores the contents of a binary file (for example, a JPEG) then you can add a `^` to the end of the attribute name. This will modify the form so that this attribute has an upload button. If a file has already been uploaded then a link to view or download the file will be shown. For example, to allow you to set a user's photo:
|
||||
|
||||
```
|
||||
LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES=jpegPhoto^:Photograph"
|
||||
```
|
||||
|
||||
### Caveat
|
||||
|
||||
These settings are advanced usage and the user manager doesn't attempt to validate any objectClasses, attributes, labels or default values you pass in. It's up to you to ensure that your LDAP server has the appropriate schemas and that the labels and values are sane.
|
||||
@ -346,7 +358,6 @@ These settings are advanced usage and the user manager doesn't attempt to valida
|
||||
|
||||
## Using the RFC2307BIS schema
|
||||
|
||||
|
||||
Using the **RFC2307BIS** will allow you to use `memberOf` in LDAP searches which gives you an easy way to check if a user is a member of a group. For example: `(&(objectClass=posixAccount)(memberof=cn=somegroup,ou=groups,dc=ldapusermanager,dc=org))`.
|
||||
|
||||
OpenLDAP will use the RFC2307 (NIS) schema by default; you'll need to configure your server to use the **RFC2307BIS** schema when setting up your directory. See [this guide](https://unofficialaciguide.com/2019/07/31/ldap-schemas-for-aci-administrators-rfc2307-vs-rfc2307bis/) for more information regarding RFC2307 vs RFC2307BIS.
|
||||
|
||||
@ -92,19 +92,6 @@ if (isset($_GET['account_request'])) {
|
||||
$new_account_r['sn'] = $sn;
|
||||
unset($new_account_r['sn']['count']);
|
||||
|
||||
$uid[0] = generate_username($givenname[0],$sn[0]);
|
||||
$new_account_r['uid'] = $uid;
|
||||
unset($new_account_r['uid']['count']);
|
||||
|
||||
if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE) {
|
||||
$cn[0] = $givenname[0] . $sn[0];
|
||||
}
|
||||
else {
|
||||
$cn[0] = $givenname[0] . " " . $sn[0];
|
||||
}
|
||||
$new_account_r['cn'] = $cn;
|
||||
unset($new_account_r['cn']['count']);
|
||||
|
||||
$mail[0]=filter_var($_GET['email'], FILTER_SANITIZE_EMAIL);
|
||||
if ($mail[0] == "") {
|
||||
if (isset($EMAIL_DOMAIN)) {
|
||||
@ -122,6 +109,23 @@ if (isset($_GET['account_request'])) {
|
||||
|
||||
if (isset($_POST['create_account'])) {
|
||||
|
||||
if (!isset($uid[0])) {
|
||||
$uid[0] = generate_username($givenname[0],$sn[0]);
|
||||
$new_account_r['uid'] = $uid;
|
||||
unset($new_account_r['uid']['count']);
|
||||
}
|
||||
|
||||
if (!isset($cn[0])) {
|
||||
if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE) {
|
||||
$cn[0] = $givenname[0] . $sn[0];
|
||||
}
|
||||
else {
|
||||
$cn[0] = $givenname[0] . " " . $sn[0];
|
||||
}
|
||||
$new_account_r['cn'] = $cn;
|
||||
unset($new_account_r['cn']['count']);
|
||||
}
|
||||
|
||||
$password = $_POST['password'];
|
||||
$new_account_r['password'][0] = $password;
|
||||
$account_identifier = $new_account_r[$account_attribute][0];
|
||||
|
||||
@ -44,6 +44,7 @@ $attribute_map = $LDAP['default_group_attribute_map'];
|
||||
if (isset($LDAP['group_additional_attributes'])) {
|
||||
$attribute_map = ldap_complete_attribute_array($attribute_map,$LDAP['group_additional_attributes']);
|
||||
}
|
||||
|
||||
$to_update = array();
|
||||
$this_group = array();
|
||||
|
||||
@ -145,7 +146,15 @@ if (isset($_POST["update_members"])) {
|
||||
$group_add = ldap_new_group($ldap_connection,$group_cn,$initial_member,$to_update);
|
||||
}
|
||||
elseif(count($to_update) > 0) {
|
||||
|
||||
if (isset($this_group[0]['objectclass'])) {
|
||||
$existing_objectclasses = $this_group[0]['objectclass'];
|
||||
unset($existing_objectclasses['count']);
|
||||
if ($existing_objectclasses != $LDAP['group_objectclasses']) { $to_update['objectclass'] = $LDAP['group_objectclasses']; }
|
||||
}
|
||||
|
||||
$updated_attr = ldap_update_group_attributes($ldap_connection,$group_cn,$to_update);
|
||||
|
||||
if ($updated_attr) {
|
||||
render_alert_banner("The group attributes have been updated.");
|
||||
}
|
||||
|
||||
@ -111,6 +111,23 @@ if ($ldap_search) {
|
||||
|
||||
if (isset($_POST['update_account'])) {
|
||||
|
||||
if (!isset($uid[0])) {
|
||||
$uid[0] = generate_username($givenname[0],$sn[0]);
|
||||
$to_update['uid'] = $uid;
|
||||
unset($to_update['uid']['count']);
|
||||
}
|
||||
|
||||
if (!isset($cn[0])) {
|
||||
if ($ENFORCE_SAFE_SYSTEM_NAMES == TRUE) {
|
||||
$cn[0] = $givenname[0] . $sn[0];
|
||||
}
|
||||
else {
|
||||
$cn[0] = $givenname[0] . " " . $sn[0];
|
||||
}
|
||||
$to_update['cn'] = $cn;
|
||||
unset($to_update['cn']['count']);
|
||||
}
|
||||
|
||||
if (isset($_POST['password']) and $_POST['password'] != "") {
|
||||
|
||||
$password = $_POST['password'];
|
||||
@ -143,6 +160,10 @@ if ($ldap_search) {
|
||||
}
|
||||
}
|
||||
|
||||
$existing_objectclasses = $user[0]['objectclass'];
|
||||
unset($existing_objectclasses['count']);
|
||||
if ($existing_objectclasses != $LDAP['account_objectclasses']) { $to_update['objectclass'] = $LDAP['account_objectclasses']; }
|
||||
|
||||
$updated_account = @ ldap_mod_replace($ldap_connection, $dn, $to_update);
|
||||
|
||||
if (!$updated_account) {
|
||||
|
||||
@ -1,9 +1,10 @@
|
||||
<?php
|
||||
|
||||
$log_prefix = "";
|
||||
$log_prefix="";
|
||||
|
||||
#Fixed
|
||||
#Default attributes and objectclasses
|
||||
|
||||
$LDAP['account_attribute'] = (getenv('LDAP_ACCOUNT_ATTRIBUTE') ? getenv('LDAP_ACCOUNT_ATTRIBUTE') : 'uid');
|
||||
$LDAP['account_objectclasses'] = array( 'person', 'inetOrgPerson', 'posixAccount' );
|
||||
$LDAP['default_attribute_map'] = array( "givenname" => array("label" => "First name", "onkeyup" => "update_username(); update_email(); update_cn(); check_email_validity(document.getElementById('mail').value);"),
|
||||
"sn" => array("label" => "Last name", "onkeyup" => "update_username(); update_email(); update_cn(); check_email_validity(document.getElementById('mail').value);"),
|
||||
@ -12,35 +13,46 @@
|
||||
"mail" => array("label" => "Email", "onkeyup" => "auto_email_update = false; check_email_validity(document.getElementById('mail').value);")
|
||||
);
|
||||
|
||||
$LDAP['group_objectclasses'] = array( 'person', 'inetOrgPerson', 'posixAccount' );
|
||||
$LDAP['group_attribute'] = (getenv('LDAP_GROUP_ATTRIBUTE') ? getenv('LDAP_GROUP_ATTRIBUTE') : 'cn');
|
||||
$LDAP['group_objectclasses'] = array( 'top', 'posixGroup' ); #groupOfUniqueNames is added automatically if rfc2307bis is available.
|
||||
$LDAP['default_group_attribute_map'] = array( "gidnumber" => array("label" => "Group ID number")
|
||||
);
|
||||
|
||||
$SIMPLE_INTERFACE = ((strcasecmp(getenv('SIMPLE_INTERFACE'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
|
||||
#Mandatory
|
||||
if ($SIMPLE_INTERFACE == TRUE) {
|
||||
if ($LDAP['account_attribute'] == "uid") {
|
||||
unset($LDAP['default_attribute_map']['cn']);
|
||||
}
|
||||
else {
|
||||
unset($LDAP['default_attribute_map']['uid']);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
## LDAP server
|
||||
|
||||
$LDAP['uri'] = getenv('LDAP_URI');
|
||||
$LDAP['base_dn'] = getenv('LDAP_BASE_DN');
|
||||
$LDAP['admins_group'] = getenv('LDAP_ADMINS_GROUP');
|
||||
$LDAP['admin_bind_dn'] = getenv('LDAP_ADMIN_BIND_DN');
|
||||
$LDAP['admin_bind_pwd'] = getenv('LDAP_ADMIN_BIND_PWD');
|
||||
$LDAP['connection_type'] = "plain";
|
||||
$LDAP['require_starttls'] = ((strcasecmp(getenv('LDAP_REQUIRE_STARTTLS'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
$LDAP['ignore_cert_errors'] = ((strcasecmp(getenv('LDAP_IGNORE_CERT_ERRORS'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
$LDAP['rfc2307bis_check_run'] = FALSE;
|
||||
|
||||
#Optional
|
||||
|
||||
$SIMPLE_INTERFACE = ((strcasecmp(getenv('SIMPLE_INTERFACE'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
# Various advanced LDAP settings
|
||||
|
||||
$LDAP['account_attribute'] = (getenv('LDAP_ACCOUNT_ATTRIBUTE') ? getenv('LDAP_ACCOUNT_ATTRIBUTE') : 'uid');
|
||||
$LDAP['group_attribute'] = (getenv('LDAP_GROUP_ATTRIBUTE') ? getenv('LDAP_GROUP_ATTRIBUTE') : 'cn');
|
||||
$LDAP['admins_group'] = getenv('LDAP_ADMINS_GROUP');
|
||||
$LDAP['group_ou'] = (getenv('LDAP_GROUP_OU') ? getenv('LDAP_GROUP_OU') : 'groups');
|
||||
$LDAP['user_ou'] = (getenv('LDAP_USER_OU') ? getenv('LDAP_USER_OU') : 'people');
|
||||
|
||||
$LDAP['forced_rfc2307bis'] = ((strcasecmp(getenv('FORCE_RFC2307BIS'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
|
||||
if (getenv('LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES')) { $LDAP['account_additional_objectclasses'] = strtolower(getenv('LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES')); }
|
||||
if (getenv('LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES')) { $account_additional_objectclasses = strtolower(getenv('LDAP_ACCOUNT_ADDITIONAL_OBJECTCLASSES')); }
|
||||
if (getenv('LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES')) { $LDAP['account_additional_attributes'] = getenv('LDAP_ACCOUNT_ADDITIONAL_ATTRIBUTES'); }
|
||||
|
||||
if (getenv('LDAP_GROUP_ADDITIONAL_OBJECTCLASSES')) { $LDAP['group_additional_objectclasses'] = getenv('LDAP_GROUP_ADDITIONAL_OBJECTCLASSES'); }
|
||||
if (getenv('LDAP_GROUP_ADDITIONAL_OBJECTCLASSES')) { $group_additional_objectclasses = getenv('LDAP_GROUP_ADDITIONAL_OBJECTCLASSES'); }
|
||||
if (getenv('LDAP_GROUP_ADDITIONAL_ATTRIBUTES')) { $LDAP['group_additional_attributes'] = getenv('LDAP_GROUP_ADDITIONAL_ATTRIBUTES'); }
|
||||
|
||||
if (getenv('LDAP_GROUP_MEMBERSHIP_ATTRIBUTE')) { $LDAP['group_membership_attribute'] = getenv('LDAP_GROUP_MEMBERSHIP_ATTRIBUTE'); }
|
||||
@ -49,12 +61,17 @@
|
||||
if (strtoupper(getenv('LDAP_GROUP_MEMBERSHIP_USES_UID')) == 'FALSE' ) { $LDAP['group_membership_uses_uid'] = FALSE; }
|
||||
}
|
||||
|
||||
$LDAP['require_starttls'] = ((strcasecmp(getenv('LDAP_REQUIRE_STARTTLS'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
$LDAP['ignore_cert_errors'] = ((strcasecmp(getenv('LDAP_IGNORE_CERT_ERRORS'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
$LDAP['rfc2307bis_check_run'] = FALSE;
|
||||
$LDAP['group_dn'] = "ou=${LDAP['group_ou']},${LDAP['base_dn']}";
|
||||
$LDAP['user_dn'] = "ou=${LDAP['user_ou']},${LDAP['base_dn']}";
|
||||
|
||||
$DEFAULT_USER_GROUP = (getenv('DEFAULT_USER_GROUP') ? getenv('DEFAULT_USER_GROUP') : 'everybody');
|
||||
$DEFAULT_USER_SHELL = (getenv('DEFAULT_USER_SHELL') ? getenv('DEFAULT_USER_SHELL') : '/bin/bash');
|
||||
if (isset($account_additional_objectclasses) and $account_additional_objectclasses != "") {
|
||||
$LDAP['account_objectclasses'] = array_merge($LDAP['account_objectclasses'], explode(",", $account_additional_objectclasses));
|
||||
}
|
||||
if (isset($group_additional_objectclasses) and $group_additional_objectclasses != "") {
|
||||
$LDAP['group_objectclasses'] = array_merge($LDAP['group_objectclasses'], explode(",", $group_additional_objectclasses));
|
||||
}
|
||||
|
||||
# Interface customisation
|
||||
|
||||
$ORGANISATION_NAME = (getenv('ORGANISATION_NAME') ? getenv('ORGANISATION_NAME') : 'LDAP');
|
||||
$SITE_NAME = (getenv('SITE_NAME') ? getenv('SITE_NAME') : "$ORGANISATION_NAME user manager");
|
||||
@ -62,39 +79,37 @@
|
||||
$SERVER_HOSTNAME = (getenv('SERVER_HOSTNAME') ? getenv('SERVER_HOSTNAME') : "ldapusermanager.org");
|
||||
$SERVER_PATH = (getenv('SERVER_PATH') ? getenv('SERVER_PATH') : "/");
|
||||
|
||||
$ENFORCE_SAFE_SYSTEM_NAMES = ((strcasecmp(getenv('ENFORCE_SAFE_SYSTEM_NAMES'),'FALSE') == 0) ? FALSE : TRUE);
|
||||
$USERNAME_FORMAT = (getenv('USERNAME_FORMAT') ? getenv('USERNAME_FORMAT') : '{first_name}-{last_name}');
|
||||
$USERNAME_REGEX = (getenv('USERNAME_REGEX') ? getenv('USERNAME_REGEX') : '^[a-z][a-zA-Z0-9\._-]{3,32}$');
|
||||
#We'll use the username regex for groups too.
|
||||
|
||||
if (getenv('PASSWORD_HASH')) { $PASSWORD_HASH = strtoupper(getenv('PASSWORD_HASH')); }
|
||||
|
||||
$ACCEPT_WEAK_PASSWORDS = ((strcasecmp(getenv('ACCEPT_WEAK_PASSWORDS'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
$SESSION_TIMEOUT = (getenv('SESSION_TIMEOUT') ? getenv('SESSION_TIMEOUT') : 10);
|
||||
|
||||
$LDAP_DEBUG = ((strcasecmp(getenv('LDAP_DEBUG'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
$LDAP_VERBOSE_CONNECTION_LOGS = ((strcasecmp(getenv('LDAP_VERBOSE_CONNECTION_LOGS'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
$NO_HTTPS = ((strcasecmp(getenv('NO_HTTPS'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
|
||||
$SESSION_DEBUG = ((strcasecmp(getenv('SESSION_DEBUG'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
$REMOTE_HTTP_HEADERS_LOGIN = ((strcasecmp(getenv('REMOTE_HTTP_HEADERS_LOGIN'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
|
||||
###
|
||||
|
||||
$LDAP['group_dn'] = "ou=${LDAP['group_ou']},${LDAP['base_dn']}";
|
||||
$LDAP['user_dn'] = "ou=${LDAP['user_ou']},${LDAP['base_dn']}";
|
||||
# User account defaults
|
||||
|
||||
###
|
||||
$DEFAULT_USER_GROUP = (getenv('DEFAULT_USER_GROUP') ? getenv('DEFAULT_USER_GROUP') : 'everybody');
|
||||
$DEFAULT_USER_SHELL = (getenv('DEFAULT_USER_SHELL') ? getenv('DEFAULT_USER_SHELL') : '/bin/bash');
|
||||
$ENFORCE_SAFE_SYSTEM_NAMES = ((strcasecmp(getenv('ENFORCE_SAFE_SYSTEM_NAMES'),'FALSE') == 0) ? FALSE : TRUE);
|
||||
$USERNAME_FORMAT = (getenv('USERNAME_FORMAT') ? getenv('USERNAME_FORMAT') : '{first_name}-{last_name}');
|
||||
$USERNAME_REGEX = (getenv('USERNAME_REGEX') ? getenv('USERNAME_REGEX') : '^[a-z][a-zA-Z0-9\._-]{3,32}$'); #We use the username regex for groups too.
|
||||
|
||||
if (getenv('PASSWORD_HASH')) { $PASSWORD_HASH = strtoupper(getenv('PASSWORD_HASH')); }
|
||||
$ACCEPT_WEAK_PASSWORDS = ((strcasecmp(getenv('ACCEPT_WEAK_PASSWORDS'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
|
||||
$min_uid = 2000;
|
||||
$min_gid = 2000;
|
||||
|
||||
# Sending email
|
||||
|
||||
$SMTP['host'] = getenv('SMTP_HOSTNAME');
|
||||
$SMTP['user'] = (getenv('SMTP_USERNAME') ? getenv('SMTP_USERNAME') : NULL);
|
||||
$SMTP['pass'] = (getenv('SMTP_PASSWORD') ? getenv('SMTP_PASSWORD') : NULL);
|
||||
$SMTP['port'] = (getenv('SMTP_HOST_PORT') ? getenv('SMTP_HOST_PORT') : 25);
|
||||
$SMTP['ssl'] = ((strcasecmp(getenv('SMTP_USE_SSL'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
$SMTP['ssl'] = ((strcasecmp(getenv('SMTP_USE_SSL'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
$SMTP['tls'] = ((strcasecmp(getenv('SMTP_USE_TLS'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
if ($SMTP['tls'] == TRUE) { $SMTP['ssl'] = FALSE; }
|
||||
|
||||
$SMTP['debug_level'] = getenv('SMTP_LOG_LEVEL');
|
||||
if (!is_numeric($SMTP['debug_level']) or $SMTP['debug_level'] >4 or $SMTP['debug_level'] <0) { $SMTP['debug_level'] = 0; }
|
||||
|
||||
$EMAIL_DOMAIN = (getenv('EMAIL_DOMAIN') ? getenv('EMAIL_DOMAIN') : Null);
|
||||
|
||||
$default_email_from_domain = ($EMAIL_DOMAIN ? $EMAIL_DOMAIN : 'ldapusermanger.org');
|
||||
@ -104,7 +119,7 @@
|
||||
|
||||
if ($SMTP['host'] != "") { $EMAIL_SENDING_ENABLED = TRUE; } else { $EMAIL_SENDING_ENABLED = FALSE; }
|
||||
|
||||
###
|
||||
# Account requests
|
||||
|
||||
$ACCOUNT_REQUESTS_ENABLED = ((strcasecmp(getenv('ACCOUNT_REQUESTS_ENABLED'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
if (($EMAIL_SENDING_ENABLED == FALSE) && ($ACCOUNT_REQUESTS_ENABLED == TRUE)) {
|
||||
@ -114,17 +129,16 @@
|
||||
|
||||
$ACCOUNT_REQUESTS_EMAIL = (getenv('ACCOUNT_REQUESTS_EMAIL') ? getenv('ACCOUNT_REQUESTS_EMAIL') : $EMAIL['from_address']);
|
||||
|
||||
###
|
||||
|
||||
$NO_HTTPS = ((strcasecmp(getenv('NO_HTTPS'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
# Debugging
|
||||
|
||||
###
|
||||
$LDAP_DEBUG = ((strcasecmp(getenv('LDAP_DEBUG'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
$LDAP_VERBOSE_CONNECTION_LOGS = ((strcasecmp(getenv('LDAP_VERBOSE_CONNECTION_LOGS'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
$SESSION_DEBUG = ((strcasecmp(getenv('SESSION_DEBUG'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
$SMTP['debug_level'] = getenv('SMTP_LOG_LEVEL');
|
||||
if (!is_numeric($SMTP['debug_level']) or $SMTP['debug_level'] >4 or $SMTP['debug_level'] <0) { $SMTP['debug_level'] = 0; }
|
||||
|
||||
###
|
||||
|
||||
$REMOTE_HTTP_HEADERS_LOGIN = ((strcasecmp(getenv('REMOTE_HTTP_HEADERS_LOGIN'),'TRUE') == 0) ? TRUE : FALSE);
|
||||
|
||||
###
|
||||
# Sanity checking
|
||||
|
||||
$errors = "";
|
||||
|
||||
@ -151,8 +165,6 @@
|
||||
exit(1);
|
||||
}
|
||||
|
||||
#POSIX accounts
|
||||
$min_uid = 2000;
|
||||
$min_gid = 2000;
|
||||
|
||||
|
||||
?>
|
||||
|
||||
@ -583,13 +583,9 @@ function ldap_new_group($ldap_connection,$group_name,$initial_member="",$extra_a
|
||||
|
||||
if ($result['count'] == 0) {
|
||||
|
||||
if ($rfc2307bis_available == FALSE) { $objectclasses = array('top','posixGroup'); } else { $objectclasses = array('top','groupOfUniqueNames','posixGroup'); }
|
||||
if (isset($LDAP['group_additional_objectclasses']) and $LDAP['group_additional_objectclasses'] != "") {
|
||||
$objectclasses = array_merge($objectclasses, explode(",", $LDAP['group_additional_objectclasses']));
|
||||
}
|
||||
if ($LDAP['group_membership_uses_uid'] == FALSE and $initial_member != "") { $initial_member = "${LDAP['account_attribute']}=$initial_member,${LDAP['user_dn']}"; }
|
||||
|
||||
$new_group_array=array( 'objectClass' => $objectclasses,
|
||||
$new_group_array=array( 'objectClass' => $LDAP['group_objectclasses'],
|
||||
'cn' => $new_group,
|
||||
$LDAP['group_membership_attribute'] => $initial_member
|
||||
);
|
||||
@ -727,9 +723,7 @@ function ldap_get_gid_of_group($ldap_connection,$group_name) {
|
||||
|
||||
function ldap_complete_attribute_array($default_attributes,$additional_attributes) {
|
||||
|
||||
global $LDAP;
|
||||
|
||||
if (is_array($additional_attributes) and count($additional_attributes > 0)) {
|
||||
if (isset($additional_attributes)) {
|
||||
|
||||
$user_attribute_r = explode(",", $additional_attributes);
|
||||
$to_merge = array();
|
||||
@ -739,6 +733,7 @@ function ldap_complete_attribute_array($default_attributes,$additional_attribute
|
||||
$this_r = array();
|
||||
$kv = explode(":", $this_attr);
|
||||
$attr_name = strtolower(filter_var($kv[0], FILTER_SANITIZE_FULL_SPECIAL_CHARS));
|
||||
|
||||
if (substr($attr_name, -1) == '+') {
|
||||
$this_r['multiple'] = TRUE;
|
||||
$attr_name = rtrim($attr_name, '+');
|
||||
@ -747,6 +742,14 @@ function ldap_complete_attribute_array($default_attributes,$additional_attribute
|
||||
$this_r['multiple'] = FALSE;
|
||||
}
|
||||
|
||||
if (substr($attr_name, -1) == '^') {
|
||||
$this_r['binary'] = TRUE;
|
||||
$attr_name = rtrim($attr_name, '^');
|
||||
}
|
||||
else {
|
||||
$this_r['binary'] = FALSE;
|
||||
}
|
||||
|
||||
if (preg_match('/^[a-zA-Z0-9\-]+$/', $attr_name) == 1) {
|
||||
|
||||
if (isset($kv[1]) and $kv[1] != "") {
|
||||
@ -802,9 +805,6 @@ function ldap_new_account($ldap_connection,$account_r) {
|
||||
unset($account_r['password']);
|
||||
|
||||
$objectclasses = $LDAP['account_objectclasses'];
|
||||
if (isset($LDAP['account_additional_objectclasses']) and $LDAP['account_additional_objectclasses'] != "") {
|
||||
$objectclasses = array_merge($objectclasses, explode(",", $LDAP['account_additional_objectclasses']));
|
||||
}
|
||||
|
||||
$account_attributes = array('objectclass' => $objectclasses,
|
||||
'userpassword' => $hashed_pass,
|
||||
@ -1071,6 +1071,7 @@ function ldap_detect_rfc2307bis($ldap_connection) {
|
||||
if ($LDAP['rfc2307bis_available'] == TRUE) {
|
||||
if (!isset($LDAP['group_membership_attribute'])) { $LDAP['group_membership_attribute'] = 'uniquemember'; }
|
||||
if (!isset($LDAP['group_membership_uses_uid'])) { $LDAP['group_membership_uses_uid'] = FALSE; }
|
||||
if (!in_array('groupOfUniqueNames',$LDAP['group_objectclasses'])) { array_push($LDAP['group_objectclasses'], 'groupOfUniqueNames'); }
|
||||
return TRUE;
|
||||
}
|
||||
else {
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user