fixes for authldap

* makes proper use of plugin config
* adds a few first defaults, but the whole config metadata is still
  missing
* proper PHP5 use and comments

2 files changed, 224 insertions, 172 deletions

diff --git a/lib/plugins/authldap/auth.php b/lib/plugins/authldap/auth.php
index 93683bc16..6e7bde1f0 100644
--- a/lib/plugins/authldap/auth.php
+++ b/lib/plugins/authldap/auth.php
@@ -11,31 +11,31 @@ if(!defined('DOKU_INC')) die();
  * @author    Jan Schumann <js@schumann-it.com>
  */
 class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
-    var $cnf = null;
-    var $con = null;
-    var $bound = 0; // 0: anonymous, 1: user, 2: superuser
+    /* @var resource $con holds the LDAP connection*/
+    protected $con = null;
+
+    /* @var int $bound What type of connection does already exist? */
+    protected $bound = 0; // 0: anonymous, 1: user, 2: superuser
+
+    /* @var array $users User data cache */
+    protected $users = null;
+
+    /* @var array $_pattern User filter pattern */
+    protected $_pattern = null;
 
     /**
      * Constructor
      */
-    function __construct(){
+    public function __construct() {
         parent::__construct();
 
-        global $conf;
-        $this->cnf = $conf['auth']['ldap'];
-
         // ldap extension is needed
         if(!function_exists('ldap_connect')) {
-            if ($this->cnf['debug'])
-                msg("LDAP err: PHP LDAP extension not found.",-1,__LINE__,__FILE__);
+            $this->_debug("LDAP err: PHP LDAP extension not found.", -1, __LINE__, __FILE__);
             $this->success = false;
             return;
         }
 
-        if(empty($this->cnf['groupkey']))   $this->cnf['groupkey']   = 'cn';
-        if(empty($this->cnf['userscope']))  $this->cnf['userscope']  = 'sub';
-        if(empty($this->cnf['groupscope'])) $this->cnf['groupscope'] = 'sub';
-
         // auth_ldap currently just handles authentication, so no
         // capabilities are set
     }
@@ -48,40 +48,45 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
      * to the LDAP server
      *
      * @author  Andreas Gohr <andi@splitbrain.org>
+     * @param string $user
+     * @param string $pass
      * @return  bool
      */
-    function checkPass($user,$pass){
+    public function checkPass($user, $pass) {
         // reject empty password
         if(empty($pass)) return false;
         if(!$this->_openLDAP()) return false;
 
         // indirect user bind
-        if($this->cnf['binddn'] && $this->cnf['bindpw']){
+        if($this->getConf('binddn') && $this->getConf('bindpw')) {
             // use superuser credentials
-            if(!@ldap_bind($this->con,$this->cnf['binddn'],$this->cnf['bindpw'])){
-                if($this->cnf['debug'])
-                    msg('LDAP bind as superuser: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
+            if(!@ldap_bind($this->con, $this->getConf('binddn'), $this->getConf('bindpw'))) {
+                $this->_debug('LDAP bind as superuser: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
                 return false;
             }
             $this->bound = 2;
-        }else if($this->cnf['binddn'] &&
-                 $this->cnf['usertree'] &&
-                 $this->cnf['userfilter']) {
+        } else if($this->getConf('binddn') &&
+            $this->getConf('usertree') &&
+            $this->getConf('userfilter')
+        ) {
             // special bind string
-            $dn = $this->_makeFilter($this->cnf['binddn'],
-                                     array('user'=>$user,'server'=>$this->cnf['server']));
+            $dn = $this->_makeFilter(
+                $this->getConf('binddn'),
+                array('user'=> $user, 'server'=> $this->getConf('server'))
+            );
 
-        }else if(strpos($this->cnf['usertree'], '%{user}')) {
+        } else if(strpos($this->getConf('usertree'), '%{user}')) {
             // direct user bind
-            $dn = $this->_makeFilter($this->cnf['usertree'],
-                                     array('user'=>$user,'server'=>$this->cnf['server']));
+            $dn = $this->_makeFilter(
+                $this->getConf('usertree'),
+                array('user'=> $user, 'server'=> $this->getConf('server'))
+            );
 
-        }else{
+        } else {
             // Anonymous bind
-            if(!@ldap_bind($this->con)){
-                msg("LDAP: can not bind anonymously",-1);
-                if($this->cnf['debug'])
-                    msg('LDAP anonymous bind: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
+            if(!@ldap_bind($this->con)) {
+                msg("LDAP: can not bind anonymously", -1);
+                $this->_debug('LDAP anonymous bind: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
                 return false;
             }
         }
@@ -89,18 +94,16 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
         // Try to bind to with the dn if we have one.
         if(!empty($dn)) {
             // User/Password bind
-            if(!@ldap_bind($this->con,$dn,$pass)){
-                if($this->cnf['debug']){
-                    msg("LDAP: bind with $dn failed", -1,__LINE__,__FILE__);
-                    msg('LDAP user dn bind: '.htmlspecialchars(ldap_error($this->con)),0);
-                }
+            if(!@ldap_bind($this->con, $dn, $pass)) {
+                $this->_debug("LDAP: bind with $dn failed", -1, __LINE__, __FILE__);
+                $this->_debug('LDAP user dn bind: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
                 return false;
             }
             $this->bound = 1;
             return true;
-        }else{
+        } else {
             // See if we can find the user
-            $info = $this->getUserData($user,true);
+            $info = $this->getUserData($user, true);
             if(empty($info['dn'])) {
                 return false;
             } else {
@@ -108,18 +111,14 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
             }
 
             // Try to bind with the dn provided
-            if(!@ldap_bind($this->con,$dn,$pass)){
-                if($this->cnf['debug']){
-                    msg("LDAP: bind with $dn failed", -1,__LINE__,__FILE__);
-                    msg('LDAP user bind: '.htmlspecialchars(ldap_error($this->con)),0);
-                }
+            if(!@ldap_bind($this->con, $dn, $pass)) {
+                $this->_debug("LDAP: bind with $dn failed", -1, __LINE__, __FILE__);
+                $this->_debug('LDAP user bind: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
                 return false;
             }
             $this->bound = 1;
             return true;
         }
-
-        return false;
     }
 
     /**
@@ -144,52 +143,52 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
      * @author  Dan Allen <dan.j.allen@gmail.com>
      * @author  <evaldas.auryla@pheur.org>
      * @author  Stephane Chazelas <stephane.chazelas@emerson.com>
+     *
+     * @param   string $user
+     * @param   bool   $inbind authldap specific, true if in bind phase
      * @return  array containing user data or false
      */
-    function getUserData($user,$inbind=false) {
+    public function getUserData($user, $inbind = false) {
         global $conf;
         if(!$this->_openLDAP()) return false;
 
         // force superuser bind if wanted and not bound as superuser yet
-        if($this->cnf['binddn'] && $this->cnf['bindpw'] && $this->bound < 2){
+        if($this->getConf('binddn') && $this->getConf('bindpw') && $this->bound < 2) {
             // use superuser credentials
-            if(!@ldap_bind($this->con,$this->cnf['binddn'],$this->cnf['bindpw'])){
-                if($this->cnf['debug'])
-                    msg('LDAP bind as superuser: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
+            if(!@ldap_bind($this->con, $this->getConf('binddn'), $this->getConf('bindpw'))) {
+                $this->_debug('LDAP bind as superuser: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
                 return false;
             }
             $this->bound = 2;
-        }elseif($this->bound == 0 && !$inbind) {
+        } elseif($this->bound == 0 && !$inbind) {
             // in some cases getUserData is called outside the authentication workflow
             // eg. for sending email notification on subscribed pages. This data might not
             // be accessible anonymously, so we try to rebind the current user here
-            list($loginuser,$loginsticky,$loginpass) = auth_getCookie();
-            if($loginuser && $loginpass){
+            list($loginuser, $loginsticky, $loginpass) = auth_getCookie();
+            if($loginuser && $loginpass) {
                 $loginpass = PMA_blowfish_decrypt($loginpass, auth_cookiesalt(!$loginsticky));
                 $this->checkPass($loginuser, $loginpass);
             }
         }
 
         $info['user']   = $user;
-        $info['server'] = $this->cnf['server'];
+        $info['server'] = $this->getConf('server');
 
         //get info for given user
-        $base = $this->_makeFilter($this->cnf['usertree'], $info);
-        if(!empty($this->cnf['userfilter'])) {
-            $filter = $this->_makeFilter($this->cnf['userfilter'], $info);
+        $base = $this->_makeFilter($this->getConf('usertree'), $info);
+        if($this->getConf('userfilter')) {
+            $filter = $this->_makeFilter($this->getConf('userfilter'), $info);
         } else {
             $filter = "(ObjectClass=*)";
         }
 
-        $sr     = $this->_ldapsearch($this->con, $base, $filter, $this->cnf['userscope']);
+        $sr     = $this->_ldapsearch($this->con, $base, $filter, $this->getConf('userscope'));
         $result = @ldap_get_entries($this->con, $sr);
-        if($this->cnf['debug']){
-            msg('LDAP user search: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
-            msg('LDAP search at: '.htmlspecialchars($base.' '.$filter),0,__LINE__,__FILE__);
-        }
+        $this->_debug('LDAP user search: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
+        $this->_debug('LDAP search at: '.htmlspecialchars($base.' '.$filter), 0, __LINE__, __FILE__);
 
         // Don't accept more or less than one response
-        if(!is_array($result) || $result['count'] != 1){
+        if(!is_array($result) || $result['count'] != 1) {
             return false; //user not found
         }
 
@@ -204,13 +203,13 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
         $info['grps'] = array();
 
         // overwrite if other attribs are specified.
-        if(is_array($this->cnf['mapping'])){
-            foreach($this->cnf['mapping'] as $localkey => $key) {
+        if(is_array($this->getConf('mapping'))) {
+            foreach($this->getConf('mapping') as $localkey => $key) {
                 if(is_array($key)) {
                     // use regexp to clean up user_result
                     list($key, $regexp) = each($key);
-                    if($user_result[$key]) foreach($user_result[$key] as $grp){
-                        if (preg_match($regexp,$grp,$match)) {
+                    if($user_result[$key]) foreach($user_result[$key] as $grp) {
+                        if(preg_match($regexp, $grp, $match)) {
                             if($localkey == 'grps') {
                                 $info[$localkey][] = $match[1];
                             } else {
@@ -223,35 +222,33 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
                 }
             }
         }
-        $user_result = array_merge($info,$user_result);
+        $user_result = array_merge($info, $user_result);
 
         //get groups for given user if grouptree is given
-        if ($this->cnf['grouptree'] || $this->cnf['groupfilter']) {
-            $base   = $this->_makeFilter($this->cnf['grouptree'], $user_result);
-            $filter = $this->_makeFilter($this->cnf['groupfilter'], $user_result);
-            $sr = $this->_ldapsearch($this->con, $base, $filter, $this->cnf['groupscope'], array($this->cnf['groupkey']));
-            if($this->cnf['debug']){
-                msg('LDAP group search: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
-                msg('LDAP search at: '.htmlspecialchars($base.' '.$filter),0,__LINE__,__FILE__);
-            }
-            if(!$sr){
-                msg("LDAP: Reading group memberships failed",-1);
+        if($this->getConf('grouptree') || $this->getConf('groupfilter')) {
+            $base   = $this->_makeFilter($this->getConf('grouptree'), $user_result);
+            $filter = $this->_makeFilter($this->getConf('groupfilter'), $user_result);
+            $sr     = $this->_ldapsearch($this->con, $base, $filter, $this->getConf('groupscope'), array($this->getConf('groupkey')));
+            $this->_debug('LDAP group search: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
+            $this->_debug('LDAP search at: '.htmlspecialchars($base.' '.$filter), 0, __LINE__, __FILE__);
+
+            if(!$sr) {
+                msg("LDAP: Reading group memberships failed", -1);
                 return false;
             }
             $result = ldap_get_entries($this->con, $sr);
             ldap_free_result($sr);
 
-            if(is_array($result)) foreach($result as $grp){
-                if(!empty($grp[$this->cnf['groupkey']][0])){
-                    if($this->cnf['debug'])
-                        msg('LDAP usergroup: '.htmlspecialchars($grp[$this->cnf['groupkey']][0]),0,__LINE__,__FILE__);
-                    $info['grps'][] = $grp[$this->cnf['groupkey']][0];
+            if(is_array($result)) foreach($result as $grp) {
+                if(!empty($grp[$this->getConf('groupkey')][0])) {
+                    $this->_debug('LDAP usergroup: '.htmlspecialchars($grp[$this->getConf('groupkey')][0]), 0, __LINE__, __FILE__);
+                    $info['grps'][] = $grp[$this->getConf('groupkey')][0];
                 }
             }
         }
 
         // always add the default group to the list of groups
-        if(!in_array($conf['defaultgroup'],$info['grps'])){
+        if(!in_array($conf['defaultgroup'], $info['grps'])) {
             $info['grps'][] = $conf['defaultgroup'];
         }
         return $info;
@@ -259,8 +256,10 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
 
     /**
      * Most values in LDAP are case-insensitive
+     *
+     * @return bool
      */
-    function isCaseSensitive(){
+    public function isCaseSensitive() {
         return false;
     }
 
@@ -268,47 +267,47 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
      * Bulk retrieval of user data
      *
      * @author  Dominik Eckelmann <dokuwiki@cosmocode.de>
-     * @param   start     index of first user to be returned
-     * @param   limit     max number of users to be returned
-     * @param   filter    array of field/pattern pairs, null for no filter
+     * @param   int   $start     index of first user to be returned
+     * @param   int   $limit     max number of users to be returned
+     * @param   array $filter  array of field/pattern pairs, null for no filter
      * @return  array of userinfo (refer getUserData for internal userinfo details)
      */
-    function retrieveUsers($start=0,$limit=-1,$filter=array()) {
+    function retrieveUsers($start = 0, $limit = -1, $filter = array()) {
         if(!$this->_openLDAP()) return false;
 
-        if (!isset($this->users)) {
+        if(is_null($this->users)) {
             // Perform the search and grab all their details
-            if(!empty($this->cnf['userfilter'])) {
-                $all_filter = str_replace('%{user}', '*', $this->cnf['userfilter']);
+            if($this->getConf('userfilter')) {
+                $all_filter = str_replace('%{user}', '*', $this->getConf('userfilter'));
             } else {
                 $all_filter = "(ObjectClass=*)";
             }
-            $sr=ldap_search($this->con,$this->cnf['usertree'],$all_filter);
-            $entries = ldap_get_entries($this->con, $sr);
+            $sr          = ldap_search($this->con, $this->getConf('usertree'), $all_filter);
+            $entries     = ldap_get_entries($this->con, $sr);
             $users_array = array();
-            for ($i=0; $i<$entries["count"]; $i++){
+            for($i = 0; $i < $entries["count"]; $i++) {
                 array_push($users_array, $entries[$i]["uid"][0]);
             }
             asort($users_array);
             $result = $users_array;
-            if (!$result) return array();
+            if(!$result) return array();
             $this->users = array_fill_keys($result, false);
         }
-        $i = 0;
+        $i     = 0;
         $count = 0;
         $this->_constructPattern($filter);
         $result = array();
 
-        foreach ($this->users as $user => &$info) {
-            if ($i++ < $start) {
+        foreach($this->users as $user => &$info) {
+            if($i++ < $start) {
                 continue;
             }
-            if ($info === false) {
+            if($info === false) {
                 $info = $this->getUserData($user);
             }
-            if ($this->_filter($user, $info)) {
+            if($this->_filter($user, $info)) {
                 $result[$user] = $info;
-                if (($limit >= 0) && (++$count >= $limit)) break;
+                if(($limit >= 0) && (++$count >= $limit)) break;
             }
         }
         return $result;
@@ -320,50 +319,61 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
      * Used by auth_getUserData to make the filter
      * strings for grouptree and groupfilter
      *
-     * filter      string  ldap search filter with placeholders
-     * placeholders array   array with the placeholders
-     *
      * @author  Troels Liebe Bentsen <tlb@rapanden.dk>
+     * @param   string $filter ldap search filter with placeholders
+     * @param   array  $placeholders placeholders to fill in
      * @return  string
      */
-    function _makeFilter($filter, $placeholders) {
+    protected function _makeFilter($filter, $placeholders) {
         preg_match_all("/%{([^}]+)/", $filter, $matches, PREG_PATTERN_ORDER);
         //replace each match
-        foreach ($matches[1] as $match) {
+        foreach($matches[1] as $match) {
             //take first element if array
             if(is_array($placeholders[$match])) {
                 $value = $placeholders[$match][0];
             } else {
                 $value = $placeholders[$match];
             }
-            $value = $this->_filterEscape($value);
+            $value  = $this->_filterEscape($value);
             $filter = str_replace('%{'.$match.'}', $value, $filter);
         }
         return $filter;
     }
 
     /**
-     * return 1 if $user + $info match $filter criteria, 0 otherwise
+     * return true if $user + $info match $filter criteria, false otherwise
+     *
+     * @author Chris Smith <chris@jalakai.co.uk>
      *
-     * @author   Chris Smith <chris@jalakai.co.uk>
+     * @param  string $user the user's login name
+     * @param  array  $info the user's userinfo array
+     * @return bool
      */
-    function _filter($user, $info) {
-        foreach ($this->_pattern as $item => $pattern) {
-            if ($item == 'user') {
-                if (!preg_match($pattern, $user)) return 0;
-            } else if ($item == 'grps') {
-                if (!count(preg_grep($pattern, $info['grps']))) return 0;
+    protected  function _filter($user, $info) {
+        foreach($this->_pattern as $item => $pattern) {
+            if($item == 'user') {
+                if(!preg_match($pattern, $user)) return false;
+            } else if($item == 'grps') {
+                if(!count(preg_grep($pattern, $info['grps']))) return false;
             } else {
-                if (!preg_match($pattern, $info[$item])) return 0;
+                if(!preg_match($pattern, $info[$item])) return false;
             }
         }
-        return 1;
+        return true;
     }
 
-    function _constructPattern($filter) {
+    /**
+     * Set the filter pattern
+     *
+     * @author Chris Smith <chris@jalakai.co.uk>
+     *
+     * @param $filter
+     * @return void
+     */
+    protected function _constructPattern($filter) {
         $this->_pattern = array();
-        foreach ($filter as $item => $pattern) {
-            $this->_pattern[$item] = '/'.str_replace('/','\/',$pattern).'/i';    // allow regex characters
+        foreach($filter as $item => $pattern) {
+            $this->_pattern[$item] = '/'.str_replace('/', '\/', $pattern).'/i'; // allow regex characters
         }
     }
 
@@ -373,11 +383,15 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
      * Ported from Perl's Net::LDAP::Util escape_filter_value
      *
      * @author Andreas Gohr
+     * @param  string $string
+     * @return string
      */
-    function _filterEscape($string){
-        return preg_replace('/([\x00-\x1F\*\(\)\\\\])/e',
-                            '"\\\\\".join("",unpack("H2","$1"))',
-                            $string);
+    protected function _filterEscape($string) {
+        return preg_replace(
+            '/([\x00-\x1F\*\(\)\\\\])/e',
+            '"\\\\\".join("",unpack("H2","$1"))',
+            $string
+        );
     }
 
     /**
@@ -386,18 +400,18 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
      *
      * @author  Andreas Gohr <andi@splitbrain.org>
      */
-    function _openLDAP(){
+    protected function _openLDAP() {
         if($this->con) return true; // connection already established
 
         $this->bound = 0;
 
-        $port = ($this->cnf['port']) ? $this->cnf['port'] : 389;
-        $bound = false;
-        $servers = explode(',', $this->cnf['server']);
-        foreach ($servers as $server) {
-            $server = trim($server);
+        $port    = $this->getConf('port');
+        $bound   = false;
+        $servers = explode(',', $this->getConf('server'));
+        foreach($servers as $server) {
+            $server    = trim($server);
             $this->con = @ldap_connect($server, $port);
-            if (!$this->con) {
+            if(!$this->con) {
                 continue;
             }
 
@@ -410,80 +424,111 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin {
              */
 
             //set protocol version and dependend options
-            if($this->cnf['version']){
-                if(!@ldap_set_option($this->con, LDAP_OPT_PROTOCOL_VERSION,
-                                     $this->cnf['version'])){
-                    msg('Setting LDAP Protocol version '.$this->cnf['version'].' failed',-1);
-                    if($this->cnf['debug'])
-                        msg('LDAP version set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
-                }else{
+            if($this->getConf('version')) {
+                if(!@ldap_set_option(
+                    $this->con, LDAP_OPT_PROTOCOL_VERSION,
+                    $this->getConf('version')
+                )
+                ) {
+                    msg('Setting LDAP Protocol version '.$this->getConf('version').' failed', -1);
+                    $this->_debug('LDAP version set: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
+                } else {
                     //use TLS (needs version 3)
-                    if($this->cnf['starttls']) {
-                        if (!@ldap_start_tls($this->con)){
-                            msg('Starting TLS failed',-1);
-                            if($this->cnf['debug'])
-                                msg('LDAP TLS set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
+                    if($this->getConf('starttls')) {
+                        if(!@ldap_start_tls($this->con)) {
+                            msg('Starting TLS failed', -1);
+                            $this->_debug('LDAP TLS set: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
                         }
                     }
                     // needs version 3
-                    if(isset($this->cnf['referrals'])) {
-                        if(!@ldap_set_option($this->con, LDAP_OPT_REFERRALS,
-                           $this->cnf['referrals'])){
-                            msg('Setting LDAP referrals to off failed',-1);
-                            if($this->cnf['debug'])
-                                msg('LDAP referal set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
+                    if($this->getConf('referrals')) {
+                        if(!@ldap_set_option(
+                            $this->con, LDAP_OPT_REFERRALS,
+                            $this->getConf('referrals')
+                        )
+                        ) {
+                            msg('Setting LDAP referrals to off failed', -1);
+                            $this->_debug('LDAP referal set: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
                         }
                     }
                 }
             }
 
             //set deref mode
-            if($this->cnf['deref']){
-                if(!@ldap_set_option($this->con, LDAP_OPT_DEREF, $this->cnf['deref'])){
-                    msg('Setting LDAP Deref mode '.$this->cnf['deref'].' failed',-1);
-                    if($this->cnf['debug'])
-                        msg('LDAP deref set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__);
+            if($this->getConf('deref')) {
+                if(!@ldap_set_option($this->con, LDAP_OPT_DEREF, $this->getConf('deref'))) {
+                    msg('Setting LDAP Deref mode '.$this->getConf('deref').' failed', -1);
+                    $this->_debug('LDAP deref set: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__);
                 }
             }
             /* As of PHP 5.3.0 we can set timeout to speedup skipping of invalid servers */
-            if (defined('LDAP_OPT_NETWORK_TIMEOUT')) {
+            if(defined('LDAP_OPT_NETWORK_TIMEOUT')) {
                 ldap_set_option($this->con, LDAP_OPT_NETWORK_TIMEOUT, 1);
             }
             $bound = @ldap_bind($this->con);
-            if ($bound) {
+            if($bound) {
                 break;
             }
         }
 
         if(!$bound) {
-            msg("LDAP: couldn't connect to LDAP server",-1);
+            msg("LDAP: couldn't connect to LDAP server", -1);
             return false;
         }
 
-
-        $this->canDo['getUsers'] = true;
+        $this->cando['getUsers'] = true;
         return true;
     }
 
     /**
      * Wraps around ldap_search, ldap_list or ldap_read depending on $scope
      *
-     * @param  $scope string - can be 'base', 'one' or 'sub'
      * @author Andreas Gohr <andi@splitbrain.org>
+     * @param resource $link_identifier
+     * @param string   $base_dn
+     * @param string   $filter
+     * @param string   $scope can be 'base', 'one' or 'sub'
+     * @param null     $attributes
+     * @param int      $attrsonly
+     * @param int      $sizelimit
+     * @param int      $timelimit
+     * @param int      $deref
+     * @return resource
      */
-    function _ldapsearch($link_identifier, $base_dn, $filter, $scope='sub', $attributes=null,
-                         $attrsonly=0, $sizelimit=0, $timelimit=0, $deref=LDAP_DEREF_NEVER){
+    protected function _ldapsearch($link_identifier, $base_dn, $filter, $scope = 'sub', $attributes = null,
+                         $attrsonly = 0, $sizelimit = 0, $timelimit = 0, $deref = LDAP_DEREF_NEVER) {
         if(is_null($attributes)) $attributes = array();
 
-        if($scope == 'base'){
-            return @ldap_read($link_identifier, $base_dn, $filter, $attributes,
-                             $attrsonly, $sizelimit, $timelimit, $deref);
-        }elseif($scope == 'one'){
-            return @ldap_list($link_identifier, $base_dn, $filter, $attributes,
-                             $attrsonly, $sizelimit, $timelimit, $deref);
-        }else{
-            return @ldap_search($link_identifier, $base_dn, $filter, $attributes,
-                                $attrsonly, $sizelimit, $timelimit, $deref);
+        if($scope == 'base') {
+            return @ldap_read(
+                $link_identifier, $base_dn, $filter, $attributes,
+                $attrsonly, $sizelimit, $timelimit, $deref
+            );
+        } elseif($scope == 'one') {
+            return @ldap_list(
+                $link_identifier, $base_dn, $filter, $attributes,
+                $attrsonly, $sizelimit, $timelimit, $deref
+            );
+        } else {
+            return @ldap_search(
+                $link_identifier, $base_dn, $filter, $attributes,
+                $attrsonly, $sizelimit, $timelimit, $deref
+            );
         }
     }
+
+    /**
+     * Wrapper around msg() but outputs only when debug is enabled
+     *
+     * @param string $message
+     * @param int    $err
+     * @param int    $line
+     * @param string $file
+     * @return void
+     */
+    protected function _debug($message, $err, $line, $file) {
+        if(!$this->getConf('debug')) return;
+        msg($message, $err, $line, $file);
+    }
+
 }
diff --git a/lib/plugins/authldap/conf/default.php b/lib/plugins/authldap/conf/default.php
new file mode 100644
index 000000000..35971d41d
--- /dev/null
+++ b/lib/plugins/authldap/conf/default.php
@@ -0,0 +1,7 @@
+<?php
+
+$conf['port'] = 389;
+
+$conf['groupkey']   = 'cn';
+$conf['userscope']  = 'sub';
+$conf['groupscope'] = 'sub';
\ No newline at end of file