Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LDAP Support #16

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

LDAP Support #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f6b2583
ldap support
m1k1o Jun 11, 2020
258ee10
Merge branch 'master' of github.com:m1k1o/blog into ldap-support
m1k1o Jun 25, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 12 additions & 4 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ FROM php:7.4-apache

MAINTAINER Miroslav Sedivy

ARG LDAP=false

RUN set -eux; apt-get update; \
apt-get install -y --no-install-recommends \
#
Expand All @@ -12,18 +14,24 @@ RUN set -eux; apt-get update; \
zlib1g-dev libpng-dev libjpeg-dev \
libwebp-dev libxpm-dev libfreetype6-dev; \
#
# clean up
rm -rf /var/lib/apt/lists/*; \
#
# configure extensions
docker-php-ext-configure gd --enable-gd \
--with-jpeg --with-webp --with-xpm --with-freetype; \
#
# install extensions
docker-php-ext-install curl gd pdo pdo_mysql; \
#
# LDAP support
if [ -n "$LDAP" ] && [ "$LDAP" = "true" ]; then \
apt-get install -y --no-install-recommends libldb-dev libldap2-dev; \
docker-php-ext-install ldap; \
fi; \
#
# set up environment
a2enmod rewrite;
a2enmod rewrite; \
#
# clean up
rm -rf /var/lib/apt/lists/*;

#
# copy files
Expand Down
44 changes: 43 additions & 1 deletion app/user.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,13 @@ public static function is_logged_in(){
return true;
}

return !empty($_SESSION[User::SESSION_NAME]) && $_SESSION[User::SESSION_NAME] === hash("crc32", Config::get("nick").Config::get_safe("pass", ""), false);
if(Config::get_safe("ldap_enabled", false)){
return !empty($_SESSION[User::SESSION_NAME]) &&
$_SESSION[User::SESSION_NAME] === 'admin';
}

return !empty($_SESSION[User::SESSION_NAME]) &&
$_SESSION[User::SESSION_NAME] === hash("crc32", Config::get("nick").Config::get_safe("pass", ""), false);
}

public static function login($nick, $pass){
Expand All @@ -30,6 +36,14 @@ public static function login($nick, $pass){
throw new Exception(__("You are already logged in."));
}

if(Config::get_safe("ldap_enabled", false)){
return static::LDAP_login($nick, $pass);
} else {
return static::config_login($nick, $pass);
}
}

private static function config_login($nick, $pass){
if(Config::get("nick") === $nick && Config::get_safe("pass", "") === $pass){
$_SESSION[User::SESSION_NAME] = hash("crc32", $nick.$pass, false);
return ["logged_in" => true, "is_visitor" => false];
Expand All @@ -45,6 +59,34 @@ public static function login($nick, $pass){
throw new Exception(__("The nick or password is incorrect."));
}

private static function LDAP_login($nick, $pass){
$ldap_host = Config::get("ldap_host");
$ldap_port = Config::get_safe("ldap_port", 389);
$ldap_admin_dn = Config::get_safe("ldap_admin_dn", false);
$ldap_visitor_dn = Config::get_safe("ldap_visitor_dn", false);

if(!($ds = ldap_connect($ldap_host, $ldap_port))) {
throw new Exception(__("Could not connect to LDAP server."));
}

ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_set_option($ds, LDAP_OPT_REFERRALS, 0);
ldap_set_option($ds, LDAP_OPT_NETWORK_TIMEOUT, 10);

if ($ldap_admin_dn !== false && ldap_bind($ds, "cn=".$nick.",".$ldap_admin_dn, $pass)) {
$_SESSION[User::SESSION_NAME] = 'admin';
return ["logged_in" => true, "is_visitor" => false];
}

if ($ldap_visitor_dn !== false && ldap_bind($ds, "cn=".$nick.",".$ldap_visitor_dn, $pass)) {
$_SESSION[User::SESSION_NAME] = 'visitor';
return ["logged_in" => false, "is_visitor" => true];
}

Log::put("login_fails", $nick);
throw new Exception(__("The nick or password is incorrect."));
}

public static function logout(){
if(!Config::get_safe("force_login", false)){
throw new Exception(__("You can't log out. There is no account."));
Expand Down
7 changes: 7 additions & 0 deletions config.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,13 @@ pass = demo
;visitor[user] = pass
;visitor[user] = pass

;[ldap]
;ldap_enabled = true
;ldap_host = localhost
;ldap_port = 389
;ldap_admin_dn = 'ou=admin,dc=example,dc=org'
;ldap_visitor_dn = 'ou=visitor,dc=example,dc=org'

[directories]
images_path = data/i/
thumbnails_path = data/t/
Expand Down