LDAPAuthPlugin.inc.php

<?php
 
import('lib.pkp.classes.plugins.AuthPlugin');
 
class LDAPAuthPlugin extends AuthPlugin {
   function register($category, $path, $mainContextId = null) {
      $success = parent::register($category, $path, $mainContextId);
      $this->addLocaleData();
      return $success;
   }
 
   // LDAP-specific configuration settings:
   // - hostname
   // - port
   // - basedn
   // - managerdn
   // - managerpwd
   // - pwhash
   // - SASL: sasl, saslmech, saslrealm, saslauthzid, saslprop
 
   var $conn;
 
   function getName() {
      return 'ldap';
   }
 
   function getDisplayName() {
      return __('plugins.auth.ldap.displayName');
   }
 
   function getDescription() {
      return __('plugins.auth.ldap.description');
   }
 
 
   //
   // Core Plugin Functions
   // (Must be implemented by every authentication plugin)
   //
 
   function getInstance($settings, $authId) {
      return new LDAPAuthPlugin($settings, $authId);
   }
 
   function authenticate($username, $password) {
      $valid = false;
      if ($password != null) {
         if ($this->open()) {
            if ($entry = $this->getUserEntry($username)) {
               $userdn = ldap_get_dn($this->conn, $entry);
               if ($this->bind($userdn, $password)) {
                  $valid = true;
               }
            }
            $this->close();
         }
         return $valid;
      }
   }
 
 
   //
   // Optional Plugin Functions
   //
 
   function userExists($username) {
      $exists = true;
      if ($this->open()) {
         if ($this->bind()) {
            $result = ldap_search($this->conn, $this->settings['basedn'], $this->settings['uid'] . '=' . $username);
            $exists = (ldap_count_entries($this->conn, $result) != 0);
         }
         $this->close();
      }
      return $exists;
   }
 
   function getUserInfo($user) {
      $valid = false;
      if ($this->open()) {
         if ($entry = $this->getUserEntry($user->getUsername())) {
            $valid = true;
            $attr = ldap_get_attributes($this->conn, $entry);
            $this->userFromAttr($user, $attr);
         }
         $this->close();
      }
      return $valid;
   }
 
   function setUserInfo($user) {
      $valid = false;
      if ($this->open()) {
         if ($entry = $this->getUserEntry($user->getUsername())) {
            $userdn = ldap_get_dn($this->conn, $entry);
            if ($this->bind($this->settings['managerdn'], $this->settings['managerpwd'])) {
               $attr = array();
               $this->userToAttr($user, $attr);
               $valid = ldap_modify($this->conn, $userdn, $attr);
            }
         }
         $this->close();
      }
      return $valid;
   }
 
   function setUserPassword($username, $password) {
      if ($this->open()) {
         if ($entry = $this->getUserEntry($username)) {
            $userdn = ldap_get_dn($this->conn, $entry);
            if ($this->bind($this->settings['managerdn'], $this->settings['managerpwd'])) {
               $attr = array('userPassword' => $this->encodePassword($password));
               $valid = ldap_modify($this->conn, $userdn, $attr);
            }
         }
         $this->close();
      }
   }
 
   function createUser($user) {
      $valid = false;
      if ($this->open()) {
         if (!($entry = $this->getUserEntry($user->getUsername()))) {
            if ($this->bind($this->settings['managerdn'], $this->settings['managerpwd'])) {
               $userdn = $this->settings['uid'] . '=' . $user->getUsername() . ',' . $this->settings['basedn'];
               $attr = array(
                  'objectclass' => array('top', 'person', 'organizationalPerson', 'inetorgperson'),
                  $this->settings['uid'] => $user->getUsername(),
                  'userPassword' => $this->encodePassword($user->getPassword())
               );
               $this->userToAttr($user, $attr);
               $valid = ldap_add($this->conn, $userdn, $attr);
            }
         }
         $this->close();
      }
      return $valid;
   }
 
   function deleteUser($username) {
      $valid = false;
      if ($this->open()) {
         if ($entry = $this->getUserEntry($username)) {
            $userdn = ldap_get_dn($this->conn, $entry);
            if ($this->bind($this->settings['managerdn'], $this->settings['managerpwd'])) {
               $valid = ldap_delete($this->conn, $userdn);
            }
         }
         $this->close();
      }
      return $valid;
   }
 
 
   //
   // LDAP Helper Functions
   //
 
   function open() {
      $this->conn = ldap_connect($this->settings['hostname'], (int)$this->settings['port']);
      ldap_set_option($this->conn, LDAP_OPT_PROTOCOL_VERSION, 3);
      return $this->conn;
   }
 
   function close() {
      ldap_close($this->conn);
      $this->conn = null;
   }
 
   function bind($binddn = null, $password = null) {
      if (isset($this->settings['sasl'])) {
         // FIXME ldap_sasl_bind requires PHP5, haven't tested this
         return @ldap_sasl_bind($this->conn, $binddn, $password, $this->settings['saslmech'], $this->settings['saslrealm'], $this->settings['saslauthzid'], $this->settings['saslprop']);
      }
      return @ldap_bind($this->conn, $binddn, $password);
   }
 
   function getUserEntry($username) {
      $entry = false;
      if ($this->bind($this->settings['managerdn'], $this->settings['managerpwd'])) {
         $result = ldap_search($this->conn, $this->settings['basedn'], $this->settings['uid'] . '=' . $username);
         if (ldap_count_entries($this->conn, $result) == 1) {
            $entry = ldap_first_entry($this->conn, $result);
         }
      }
      return $entry;
   }
 
   function userFromAttr(&$user, &$uattr) {
      $siteDao = DAORegistry::getDAO('SiteDAO'); /* @var $siteDao SiteDAO */
      $site = $siteDao->getSite();
 
      $attr = array_change_key_case($uattr, CASE_LOWER); // Note:  array_change_key_case requires PHP >= 4.2.0
      $givenName = @$attr['givenname'][0];
      $familyName = @$attr['sn'][0];
      if (!isset($familyName))
         $familyName = @$attr['surname'][0];
      $affiliation = @$attr['o'][0];
      if (!isset($affiliation))
         $affiliation = @$attr['organizationname'][0];
      $email = @$attr['mail'][0];
      if (!isset($email))
         $email = @$attr['email'][0];
      $phone = @$attr['telephonenumber'][0];
      $mailingAddress = @$attr['postaladdress'][0];
      if (!isset($mailingAddress))
         $mailingAddress = @$attr['registeredAddress'][0];
      $biography = null;
      $interests = null;
 
      // Only update fields that exist
      if (isset($givenName))
         $user->setGivenName($givenName, AppLocale::getLocale());
      if (isset($familyName))
         $user->setFamilyName($familyName, AppLocale::getLocale());
      if (isset($affiliation))
         $user->setAffiliation($affiliation, AppLocale::getLocale());
      if (isset($email))
         $user->setEmail($email);
      if (isset($phone))
         $user->setPhone($phone);
      if (isset($mailingAddress))
         $user->setMailingAddress($mailingAddress);
      if (isset($biography))
         $user->setBiography($biography, AppLocale::getLocale());
      if (isset($interests))
         $user->setInterests($interests, AppLocale::getLocale());
   }
 
   function userToAttr(&$user, &$attr) {
      $siteDao = DAORegistry::getDAO('SiteDAO'); /* @var $siteDao SiteDAO */
      $site = $siteDao->getSite();
      // FIXME empty strings for unset fields?
      if ($user->getFullName())
         $attr['cn'] = $user->getFullName();
      if ($user->getLocalizedGivenName())
         $attr['givenName'] = $user->getLocalizedGivenName();
      if ($user->getLocalizedFamilyName())
         $attr['sn'] = $user->getLocalizedFamilyName();
      if ($user->getLocalizedAffiliation())
         $attr['organizationName'] = $user->getLocalizedAffiliation();
      if ($user->getEmail())
         $attr['mail'] = $user->getEmail();
      if ($user->getPhone())
         $attr['telephoneNumber'] = $user->getPhone();
      if ($user->getMailingAddress())
         $attr['postalAddress'] = $user->getMailingAddress();
   }
 
   function encodePassword($password) {
      switch ($this->settings['pwhash']) {
         case 'md5':
            return '{MD5}' . base64_encode(pack('H*', md5($password)));
         case 'smd5':
            $salt = pack('C*', mt_rand(), mt_rand(), mt_rand(), mt_rand(), mt_rand(), mt_rand());
            return '{SMD5}' . base64_encode(pack('H*', md5($password . $salt)) . $salt);
         case 'sha':
            return '{SHA}' . base64_encode(pack('H*', sha1($password))); // Note: sha1 requres PHP >= 4.3.0
         case 'ssha':
            $salt = pack('C*', mt_rand(), mt_rand(), mt_rand(), mt_rand(), mt_rand(), mt_rand());
            return '{SSHA}' . base64_encode(pack('H*', sha1($password . $salt)) . $salt);
         case 'crypt':
            return '{CRYPT}' . crypt($password);
         default:
            //return '{CLEARTEXT}'. $password;
            return $password;
      }
   }
}