367 lines
14 KiB
Perl
367 lines
14 KiB
Perl
package WebGUI::Auth::LDAP;
|
|
|
|
#-------------------------------------------------------------------
|
|
# WebGUI is Copyright 2001-2004 Plain Black Corporation.
|
|
#-------------------------------------------------------------------
|
|
# Please read the legal notices (docs/legal.txt) and the license
|
|
# (docs/license.txt) that came with this distribution before using
|
|
# this software.
|
|
#-------------------------------------------------------------------
|
|
# http://www.plainblack.com info@plainblack.com
|
|
#-------------------------------------------------------------------
|
|
|
|
use strict;
|
|
use WebGUI::Auth;
|
|
use WebGUI::DateTime;
|
|
use WebGUI::HTMLForm;
|
|
use WebGUI::Form;
|
|
use WebGUI::Mail;
|
|
use WebGUI::Session;
|
|
use WebGUI::Utility;
|
|
use WebGUI::Operation::Shared;
|
|
use WebGUI::Asset::Template;
|
|
use URI;
|
|
use Net::LDAP;
|
|
|
|
our @ISA = qw(WebGUI::Auth);
|
|
|
|
my %ldapStatusCode = ( 0=>'success (0)', 1=>'Operations Error (1)', 2=>'Protocol Error (2)',
|
|
3=>'Time Limit Exceeded (3)', 4=>'Size Limit Exceeded (4)', 5=>'Compare False (5)',
|
|
6=>'Compare True (6)', 7=>'Auth Method Not Supported (7)', 8=>'Strong Auth Required (8)',
|
|
9=>'Referral (10)', 11=>'Admin Limit Exceeded (11)', 12=>'Unavailable Critical Extension (12)',
|
|
13=>'Confidentiality Required (13)', 14=>'Sasl Bind In Progress (14)',
|
|
15=>'No Such Attribute (16)', 17=>'Undefined Attribute Type (17)',
|
|
18=>'Inappropriate Matching (18)', 19=>'Constraint Violation (19)',
|
|
20=>'Attribute Or Value Exists (20)', 21=>'Invalid Attribute Syntax (21)', 32=>'No Such Object (32)',
|
|
33=>'Alias Problem (33)', 34=>'Invalid DN Syntax (34)', 36=>'Alias Dereferencing Problem (36)',
|
|
48=>'Inappropriate Authentication (48)', 49=>'Invalid Credentials (49)',
|
|
50=>'Insufficient Access Rights (50)', 51=>'Busy (51)', 52=>'Unavailable (52)',
|
|
53=>'Unwilling To Perform (53)', 54=>'Loop Detect (54)', 64=>'Naming Violation (64)',
|
|
65=>'Object Class Violation (65)', 66=>'Not Allowed On Non Leaf (66)', 67=>'Not Allowed On RDN (67)',
|
|
68=>'Entry Already Exists (68)', 69=>'Object Class Mods Prohibited (69)',
|
|
71=>'Affects Multiple DSAs (71)', 80=>'other (80)');
|
|
|
|
#-------------------------------------------------------------------
|
|
sub _isValidLDAPUser {
|
|
my $self = shift;
|
|
my ($uri, $error, $ldap, $search, $auth, $connectDN);
|
|
|
|
$uri = URI->new($session{setting}{ldapURL}) or $error = WebGUI::International::get(2,'AuthLDAP');
|
|
if($error ne ""){
|
|
$self->error($error);
|
|
return 0;
|
|
}
|
|
|
|
if ($ldap = Net::LDAP->new($uri->host, (port=>$uri->port))) {
|
|
if ($ldap->bind) {
|
|
$search = $ldap->search (base=>$uri->dn,filter=>$session{setting}{ldapId}."=".$session{form}{'authLDAP.ldapId'});
|
|
if (defined $search->entry(0)) {
|
|
if ($session{setting}{ldapUserRDN} eq 'dn') {
|
|
$connectDN = $search->entry(0)->dn;
|
|
} else {
|
|
$connectDN = $search->entry(0)->get_value($session{setting}{ldapUserRDN});
|
|
}
|
|
$ldap->unbind;
|
|
$ldap = Net::LDAP->new($uri->host, (port=>$uri->port)) or $error .= WebGUI::International::get(2,'AuthLDAP');
|
|
$auth = $ldap->bind(dn=>$connectDN, password=>$session{form}{'authLDAP.identifier'});
|
|
if ($auth->code == 48 || $auth->code == 49) {
|
|
$error .= '<li>'.WebGUI::International::get(68);
|
|
WebGUI::ErrorHandler::warn("Invalid LDAP information for registration of LDAP ID: ".$session{form}{'authLDAP.ldapId'});
|
|
} elsif ($auth->code > 0) {
|
|
$error .= '<li>LDAP error "'.$ldapStatusCode{$auth->code}.'" occured. '.WebGUI::International::get(69);
|
|
WebGUI::ErrorHandler::warn("LDAP error: ".$ldapStatusCode{$auth->code});
|
|
}
|
|
$ldap->unbind;
|
|
} else {
|
|
$error .= '<li>'.WebGUI::International::get(68);
|
|
WebGUI::ErrorHandler::warn("Invalid LDAP information for registration of LDAP ID: ".$session{form}{'authLDAP.ldapId'});
|
|
}
|
|
} else {
|
|
$error = WebGUI::International::get(2,'AuthLDAP');
|
|
WebGUI::ErrorHandler::warn("Couldn't bind to LDAP server: ".$session{setting}{ldapURL});
|
|
}
|
|
} else {
|
|
$error = WebGUI::International::get(2,'AuthLDAP');
|
|
WebGUI::ErrorHandler::warn("Couldn't create LDAP object: ".$uri->host);
|
|
}
|
|
$self->error($error);
|
|
return $error eq "";
|
|
}
|
|
#-------------------------------------------------------------------
|
|
|
|
=head2 addUserForm ( )
|
|
|
|
Creates user form elements specific to this Auth Method.
|
|
|
|
=cut
|
|
|
|
sub addUserForm {
|
|
my $self = shift;
|
|
my $userData = $self->getParams;
|
|
my $ldapUrl = $session{form}{'authLDAP.ldapUrl'} || $userData->{ldapUrl} || $session{setting}{ldapURL};
|
|
my $connectDN = $session{form}{'authLDAP.connectDN'} || $userData->{connectDN};
|
|
|
|
my $f = WebGUI::HTMLForm->new;
|
|
$f->url("authLDAP.ldapUrl",WebGUI::International::get(3,'AuthLDAP'),$ldapUrl);
|
|
$f->text("authLDAP.connectDN",WebGUI::International::get(4,'AuthLDAP'),$connectDN);
|
|
return $f->printRowsOnly;
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
|
|
=head2 addUserFormSave ( )
|
|
|
|
Saves user elements unique to this authentication method
|
|
|
|
=cut
|
|
|
|
sub addUserFormSave {
|
|
my $self = shift;
|
|
my $properties;
|
|
$properties->{connectDN} = $session{form}{'authLDAP.connectDN'};
|
|
$properties->{ldapUrl} = $session{form}{'authLDAP.ldapUrl'};
|
|
$self->SUPER::addUserFormSave($properties);
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
sub authenticate {
|
|
my $self = shift;
|
|
my ($uri, $ldap, $auth, $result, $error);
|
|
return 0 if !$self->SUPER::authenticate($_[0]); #authenticate that the username entered actually exists and is active
|
|
my $userId = $self->userId;
|
|
my $identifier = $_[1];
|
|
my $userData = $self->getParams;
|
|
|
|
|
|
$error .= WebGUI::International::get(12,'AuthLDAP') if ($userData->{ldapUrl} eq "");
|
|
$error .= WebGUI::International::get(11,'AuthLDAP') if ($userData->{connectDN} eq "");
|
|
|
|
$self->error($error);
|
|
if($error ne ""){
|
|
$self->user(WebGUI::User->new(1));
|
|
return 0 ;
|
|
}
|
|
|
|
if($uri = URI->new($userData->{ldapUrl})) {
|
|
$ldap = Net::LDAP->new($uri->host, (port=>$uri->port)) or $error .= WebGUI::International::get(2,'AuthLDAP');
|
|
if($error ne ""){
|
|
$self->user(WebGUI::User->new(1));
|
|
return 0 ;
|
|
}
|
|
$auth = $ldap->bind(dn=>$userData->{connectDN}, password=>$identifier);
|
|
if ($auth->code == 48 || $auth->code == 49){
|
|
$error .= WebGUI::International::get(68);
|
|
}elsif($auth->code > 0){
|
|
$error .= 'LDAP error "'.$ldapStatusCode{$auth->code}.'" occured.'.WebGUI::International::get(69);
|
|
WebGUI::ErrorHandler::warn("LDAP error: ".$ldapStatusCode{$auth->code});
|
|
}
|
|
$ldap->unbind;
|
|
}else{
|
|
$error .= WebGUI::International::get(13,'AuthLDAP');
|
|
WebGUI::ErrorHandler::warn("Could not process this LDAP URL: ".$userData->{ldapUrl});
|
|
}
|
|
if($error ne ""){
|
|
$self->error($error);
|
|
$self->user(WebGUI::User->new(1));
|
|
}
|
|
return $error eq "";
|
|
}
|
|
|
|
|
|
#-------------------------------------------------------------------
|
|
sub createAccount {
|
|
my $self = shift;
|
|
my $vars;
|
|
if ($session{user}{userId} != 1) {
|
|
return $self->displayAccount;
|
|
} elsif (!$session{setting}{anonymousRegistration}) {
|
|
return $self->displayLogin;
|
|
}
|
|
|
|
$vars->{'create.message'} = $_[0] if ($_[0]);
|
|
$vars->{'create.form.ldapId'} = WebGUI::Form::text({"name"=>"authLDAP.ldapId","value"=>$session{form}{"authLDAP.ldapId"}});
|
|
$vars->{'create.form.ldapId.label'} = $session{setting}{ldapIdName};
|
|
$vars->{'create.form.password'} = WebGUI::Form::password({"name"=>"authLDAP.identifier","value"=>$session{form}{"authLDAP.identifier"}});
|
|
$vars->{'create.form.password.label'} = $session{setting}{ldapPasswordName};
|
|
|
|
$vars->{'create.form.hidden'} = WebGUI::Form::hidden({"name"=>"confirm","value"=>$session{form}{confirm}});
|
|
return $self->SUPER::createAccount("createAccountSave",$vars);
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
sub createAccountSave {
|
|
my $self = shift;
|
|
my $username = $session{form}{'authLDAP.ldapId'};
|
|
my $password = $session{form}{'authLDAP.identifier'};
|
|
my $error = "";
|
|
|
|
#Validate user in LDAP
|
|
if(!$self->_isValidLDAPUser()){
|
|
return $self->createAccount("<h1>".WebGUI::International::get(70)."</h1>".$self->error);
|
|
}
|
|
|
|
#Get connectDN from settings
|
|
my $uri = URI->new($session{setting}{ldapURL});
|
|
my $ldap = Net::LDAP->new($uri->host, (port=>$uri->port));
|
|
$ldap->bind;
|
|
my $search = $ldap->search (base => $uri->dn, filter=>$session{setting}{ldapId}."=".$username);
|
|
my $connectDN = "";
|
|
if (defined $search->entry(0)) {
|
|
if ($session{setting}{ldapUserRDN} eq 'dn') {
|
|
$connectDN = $search->entry(0)->dn;
|
|
} else {
|
|
$connectDN = $search->entry(0)->get_value($session{setting}{ldapUserRDN});
|
|
}
|
|
}
|
|
$ldap->unbind;
|
|
|
|
|
|
#Check that username is valid and not a duplicate in the system.
|
|
$error .= $self->error if($self->validUsername($username));
|
|
#Validate profile data.
|
|
my ($profile, $temp, $warning) = WebGUI::Operation::Profile::validateProfileData();
|
|
$error .= $temp;
|
|
return $self->createAccount("<h1>".WebGUI::International::get(70)."</h1>".$error) unless ($error eq "");
|
|
#If Email address is not unique, a warning is displayed
|
|
if($warning ne "" && !$session{form}{confirm}){
|
|
$session{form}{confirm} = 1;
|
|
return $self->createAccount('<li>'.WebGUI::International::get(1078));
|
|
}
|
|
|
|
my $properties;
|
|
$properties->{connectDN} = $connectDN;
|
|
$properties->{ldapUrl} = $session{setting}{ldapURL};
|
|
|
|
return $self->SUPER::createAccountSave($username,$properties,$password,$profile);
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
sub deactivateAccount {
|
|
my $self = shift;
|
|
return $self->displayLogin if($self->userId eq '1');
|
|
return $self->SUPER::deactivateAccount("deactivateAccountConfirm");
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
sub deactivateAccountConfirm {
|
|
my $self = shift;
|
|
return $self->displayLogin unless ($session{setting}{selfDeactivation});
|
|
return $self->SUPER::deactivateAccountConfirm;
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
sub displayAccount {
|
|
my $self = shift;
|
|
my $vars;
|
|
return $self->displayLogin($_[0]) if ($self->userId eq '1');
|
|
$vars->{displayTitle} = '<h1>'.WebGUI::International::get(61).'</h1>';
|
|
$vars->{'account.message'} = WebGUI::International::get(856);
|
|
if($session{setting}{useKarma}){
|
|
$vars->{'account.form.karma'} = $session{user}{karma};
|
|
$vars->{'account.form.karma.label'} = WebGUI::International::get(537);
|
|
}
|
|
$vars->{'account.options'} = WebGUI::Operation::Shared::accountOptions();
|
|
return WebGUI::Asset::Template->new($self->getAccountTemplateId)->process($vars);
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
sub displayLogin {
|
|
my $self = shift;
|
|
my $vars;
|
|
return $self->displayAccount($_[0]) if ($self->userId != 1);
|
|
$vars->{'login.message'} = $_[0] if ($_[0]);
|
|
return $self->SUPER::displayLogin("login",$vars);
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
|
|
=head2 editUserForm ( )
|
|
|
|
Creates user form elements specific to this Auth Method.
|
|
|
|
=cut
|
|
|
|
sub editUserForm {
|
|
my $self = shift;
|
|
return $self->addUserForm;
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
|
|
=head2 editUserFormSave ( )
|
|
|
|
Saves user elements unique to this authentication method
|
|
|
|
=cut
|
|
|
|
sub editUserFormSave {
|
|
my $self = shift;
|
|
return $self->addUserFormSave;
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
|
|
=head2 editUserSettingsForm ( )
|
|
|
|
Creates form elements for user settings page custom to this auth module
|
|
|
|
=cut
|
|
|
|
sub editUserSettingsForm {
|
|
my $self = shift;
|
|
my $f = WebGUI::HTMLForm->new;
|
|
$f->text("ldapUserRDN",WebGUI::International::get(9,'AuthLDAP'),$session{setting}{ldapUserRDN});
|
|
$f->url("ldapURL",WebGUI::International::get(5,'AuthLDAP'),$session{setting}{ldapURL});
|
|
$f->text("ldapId",WebGUI::International::get(6,'AuthLDAP'),$session{setting}{ldapId});
|
|
$f->text("ldapIdName",WebGUI::International::get(7,'AuthLDAP'),$session{setting}{ldapIdName});
|
|
$f->text("ldapPasswordName",WebGUI::International::get(8,'AuthLDAP'),$session{setting}{ldapPasswordName});
|
|
$f->yesNo(
|
|
-name=>"ldapSendWelcomeMessage",
|
|
-value=>$session{setting}{ldapSendWelcomeMessage},
|
|
-label=>WebGUI::International::get(868)
|
|
);
|
|
$f->textarea(
|
|
-name=>"ldapWelcomeMessage",
|
|
-value=>$session{setting}{ldapWelcomeMessage},
|
|
-label=>WebGUI::International::get(869)
|
|
);
|
|
return $f->printRowsOnly;
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
sub getAccountTemplateId {
|
|
return "PBtmpl0000000000000004";
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
sub getCreateAccountTemplateId {
|
|
return "PBtmpl0000000000000005";
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
sub getLoginTemplateId {
|
|
return "PBtmpl0000000000000006";
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
sub login {
|
|
my $self = shift;
|
|
if(!$self->authenticate($session{form}{username},$session{form}{identifier})){
|
|
WebGUI::ErrorHandler::security("login to account ".$session{form}{username}." with invalid information.");
|
|
return $self->displayLogin("<h1>".WebGUI::International::get(70)."</h1>".$self->error);
|
|
}
|
|
return $self->SUPER::login(); #Standard login routine for login
|
|
}
|
|
|
|
#-------------------------------------------------------------------
|
|
sub new {
|
|
my $class = shift;
|
|
my $authMethod = $_[0];
|
|
my $userId = $_[1];
|
|
my @callable = ('createAccount','deactivateAccount','displayAccount','displayLogin','login','logout','createAccountSave','deactivateAccountConfirm');
|
|
my $self = WebGUI::Auth->new($authMethod,$userId,\@callable);
|
|
bless $self, $class;
|
|
}
|
|
|
|
1;
|
|
|