From abb56b33e0993b3c6a7f114fbd074cc59626c394 Mon Sep 17 00:00:00 2001 From: Andreas Gohr Date: Fri, 28 Oct 2011 14:24:56 +0200 Subject: Check password expiry times in Active Directory backend When a user logs in, the password expiry time is checked and compared to the $conf['auth']['ad']['expirywarn'] setting (in days). If the password is about to expire in the specified timeframe, a warning is issued on login. This patch adds a new method to the adLDAP class for querying domain parameters. --- inc/auth/ad.class.php | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) (limited to 'inc/auth/ad.class.php') diff --git a/inc/auth/ad.class.php b/inc/auth/ad.class.php index 1fddad243..6b022d217 100644 --- a/inc/auth/ad.class.php +++ b/inc/auth/ad.class.php @@ -26,6 +26,8 @@ * $conf['auth']['ad']['use_ssl'] = 1; * $conf['auth']['ad']['use_tls'] = 1; * $conf['auth']['ad']['debug'] = 1; + * // warn user about expiring password in this mayn days in advance: + * $conf['auth']['ad']['expirywarn'] = 5; * * // get additional information to the userinfo array * // add a list of comma separated ldap contact fields. @@ -148,7 +150,7 @@ class auth_ad extends auth_basic { global $conf; if(!$this->_init()) return false; - $fields = array('mail','displayname','samaccountname'); + $fields = array('mail','displayname','samaccountname','lastpwd','pwdlastset','useraccountcontrol'); // add additional fields to read $fields = array_merge($fields, $this->cnf['additional']); @@ -157,10 +159,14 @@ class auth_ad extends auth_basic { //get info for given user $result = $this->adldap->user_info($user, $fields); //general user info - $info['name'] = $result[0]['displayname'][0]; - $info['mail'] = $result[0]['mail'][0]; - $info['uid'] = $result[0]['samaccountname'][0]; - $info['dn'] = $result[0]['dn']; + $info['name'] = $result[0]['displayname'][0]; + $info['mail'] = $result[0]['mail'][0]; + $info['uid'] = $result[0]['samaccountname'][0]; + $info['dn'] = $result[0]['dn']; + //last password set (Windows counts from January 1st 1601) + $info['lastpwd'] = $result[0]['pwdlastset'][0] / 10000000 - 11644473600; + //will it expire? + $info['expires'] = !($result[0]['useraccountcontrol'][0] & 0x10000); //ADS_UF_DONT_EXPIRE_PASSWD // additional information foreach ($this->cnf['additional'] as $field) { @@ -183,6 +189,18 @@ class auth_ad extends auth_basic { $info['grps'][] = $conf['defaultgroup']; } + // password will expire, let's warn the current user + if($_SERVER['REMOTE_USER'] == $user && $info['expires'] && $this->cnf['expirywarn']){ + $result = $this->adldap->domain_info(array('maxpwdage')); // maximum pass age + $maxage = -1 * $result['maxpwdage'][0] / 10000000; // negative 100 nanosecs + $timeleft = $maxage - (time() - $info['lastpwd']); + $timeleft = round($timeleft/(24*60*60)); + + if($timeleft <= $this->cnf['expirywarn']){ + msg('Your password will expire in '.$timeleft.' days. You should change it.'); + } + } + return $info; } -- cgit v1.2.3 From 22ffffcf6892924895d9ad45f749a307d05e09e0 Mon Sep 17 00:00:00 2001 From: Andreas Gohr Date: Mon, 7 Nov 2011 14:15:29 +0100 Subject: always check expire time when configured --- inc/auth/ad.class.php | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'inc/auth/ad.class.php') diff --git a/inc/auth/ad.class.php b/inc/auth/ad.class.php index 6b022d217..c3df2417b 100644 --- a/inc/auth/ad.class.php +++ b/inc/auth/ad.class.php @@ -189,14 +189,16 @@ class auth_ad extends auth_basic { $info['grps'][] = $conf['defaultgroup']; } - // password will expire, let's warn the current user - if($_SERVER['REMOTE_USER'] == $user && $info['expires'] && $this->cnf['expirywarn']){ + // check expiry time + if($info['expires'] && $this->cnf['expirywarn']){ $result = $this->adldap->domain_info(array('maxpwdage')); // maximum pass age $maxage = -1 * $result['maxpwdage'][0] / 10000000; // negative 100 nanosecs $timeleft = $maxage - (time() - $info['lastpwd']); $timeleft = round($timeleft/(24*60*60)); + $info['expiresin'] = $timeleft; - if($timeleft <= $this->cnf['expirywarn']){ + // if this is the current user, warn him + if( ($_SERVER['REMOTE_USER'] == $user) && ($timeleft <= $this->cnf['expirywarn'])){ msg('Your password will expire in '.$timeleft.' days. You should change it.'); } } -- cgit v1.2.3 From 7f99c819166c15279a3214e3439be8efb77f7021 Mon Sep 17 00:00:00 2001 From: Andreas Gohr Date: Mon, 7 Nov 2011 14:31:09 +0100 Subject: do not query AD for empty user name --- inc/auth/ad.class.php | 2 ++ 1 file changed, 2 insertions(+) (limited to 'inc/auth/ad.class.php') diff --git a/inc/auth/ad.class.php b/inc/auth/ad.class.php index c3df2417b..4363cfb07 100644 --- a/inc/auth/ad.class.php +++ b/inc/auth/ad.class.php @@ -150,6 +150,8 @@ class auth_ad extends auth_basic { global $conf; if(!$this->_init()) return false; + if($user == '') return array(); + $fields = array('mail','displayname','samaccountname','lastpwd','pwdlastset','useraccountcontrol'); // add additional fields to read -- cgit v1.2.3 From 9565908d97917c579e2ecb44a0b44a133df598fe Mon Sep 17 00:00:00 2001 From: Andreas Gohr Date: Mon, 7 Nov 2011 14:36:23 +0100 Subject: Don't return any data for non-existant users --- inc/auth/ad.class.php | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'inc/auth/ad.class.php') diff --git a/inc/auth/ad.class.php b/inc/auth/ad.class.php index 4363cfb07..678a32047 100644 --- a/inc/auth/ad.class.php +++ b/inc/auth/ad.class.php @@ -160,6 +160,10 @@ class auth_ad extends auth_basic { //get info for given user $result = $this->adldap->user_info($user, $fields); + if($result == false){ + return array(); + } + //general user info $info['name'] = $result[0]['displayname'][0]; $info['mail'] = $result[0]['mail'][0]; -- cgit v1.2.3 From b2117c6969fc31aa958f6019fd1e4e258f555db7 Mon Sep 17 00:00:00 2001 From: Andreas Gohr Date: Mon, 7 Nov 2011 14:49:29 +0100 Subject: translatable AD expiry warning and link to update profile page --- inc/auth/ad.class.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'inc/auth/ad.class.php') diff --git a/inc/auth/ad.class.php b/inc/auth/ad.class.php index 678a32047..cb59c5a48 100644 --- a/inc/auth/ad.class.php +++ b/inc/auth/ad.class.php @@ -26,7 +26,7 @@ * $conf['auth']['ad']['use_ssl'] = 1; * $conf['auth']['ad']['use_tls'] = 1; * $conf['auth']['ad']['debug'] = 1; - * // warn user about expiring password in this mayn days in advance: + * // warn user about expiring password this many days in advance: * $conf['auth']['ad']['expirywarn'] = 5; * * // get additional information to the userinfo array @@ -148,6 +148,7 @@ class auth_ad extends auth_basic { */ function getUserData($user){ global $conf; + global $lang; if(!$this->_init()) return false; if($user == '') return array(); @@ -205,7 +206,7 @@ class auth_ad extends auth_basic { // if this is the current user, warn him if( ($_SERVER['REMOTE_USER'] == $user) && ($timeleft <= $this->cnf['expirywarn'])){ - msg('Your password will expire in '.$timeleft.' days. You should change it.'); + msg(sprintf($lang['authpwdexpire'],$timeleft)); } } -- cgit v1.2.3 From 69995a164f9dbb51adfe17f09901e0200ea8dc7a Mon Sep 17 00:00:00 2001 From: Andreas Gohr Date: Fri, 17 Feb 2012 13:39:38 +0100 Subject: do not hardcode profile link in AD pass expire message Changing passwords might not be available. --- inc/auth/ad.class.php | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'inc/auth/ad.class.php') diff --git a/inc/auth/ad.class.php b/inc/auth/ad.class.php index cb59c5a48..dc1fef17a 100644 --- a/inc/auth/ad.class.php +++ b/inc/auth/ad.class.php @@ -149,6 +149,7 @@ class auth_ad extends auth_basic { function getUserData($user){ global $conf; global $lang; + global $ID; if(!$this->_init()) return false; if($user == '') return array(); @@ -206,7 +207,12 @@ class auth_ad extends auth_basic { // if this is the current user, warn him if( ($_SERVER['REMOTE_USER'] == $user) && ($timeleft <= $this->cnf['expirywarn'])){ - msg(sprintf($lang['authpwdexpire'],$timeleft)); + $msg = sprintf($lang['authpwdexpire'],$timeleft); + if($this->canDo('modPass')){ + $url = wl($ID,array('do'=>'profile')); + $msg .= ' '.$lang['btn_profile'].''; + } + msg($msg); } } -- cgit v1.2.3 From 1e5105f90f56d0f57111eff37a535480115920c5 Mon Sep 17 00:00:00 2001 From: Andreas Gohr Date: Fri, 17 Feb 2012 13:42:39 +0100 Subject: make sure AD pass expiry message is never shown twice --- inc/auth/ad.class.php | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'inc/auth/ad.class.php') diff --git a/inc/auth/ad.class.php b/inc/auth/ad.class.php index dc1fef17a..cc080dc93 100644 --- a/inc/auth/ad.class.php +++ b/inc/auth/ad.class.php @@ -46,6 +46,7 @@ class auth_ad extends auth_basic { var $opts = null; var $adldap = null; var $users = null; + var $msgshown = false; /** * Constructor @@ -205,14 +206,18 @@ class auth_ad extends auth_basic { $timeleft = round($timeleft/(24*60*60)); $info['expiresin'] = $timeleft; - // if this is the current user, warn him - if( ($_SERVER['REMOTE_USER'] == $user) && ($timeleft <= $this->cnf['expirywarn'])){ + // if this is the current user, warn him (once per request only) + if( ($_SERVER['REMOTE_USER'] == $user) && + ($timeleft <= $this->cnf['expirywarn']) && + !$this->msgshown + ){ $msg = sprintf($lang['authpwdexpire'],$timeleft); if($this->canDo('modPass')){ $url = wl($ID,array('do'=>'profile')); $msg .= ' '.$lang['btn_profile'].''; } msg($msg); + $this->msgshown = true; } } -- cgit v1.2.3 From 63703ba5bd81f50c43bc45f8bf79c514afa3ee49 Mon Sep 17 00:00:00 2001 From: Andreas Gohr Date: Fri, 16 Mar 2012 12:09:30 +0100 Subject: coding style updates --- inc/auth/ad.class.php | 40 +++++++++++++++++++--------------------- 1 file changed, 19 insertions(+), 21 deletions(-) (limited to 'inc/auth/ad.class.php') diff --git a/inc/auth/ad.class.php b/inc/auth/ad.class.php index cc080dc93..bc4168527 100644 --- a/inc/auth/ad.class.php +++ b/inc/auth/ad.class.php @@ -33,10 +33,10 @@ * // add a list of comma separated ldap contact fields. * $conf['auth']['ad']['additional'] = 'field1,field2'; * - * @license GPL 2 (http://www.gnu.org/licenses/gpl.html) - * @author James Van Lommel - * @link http://www.nosq.com/blog/2005/08/ldap-activedirectory-and-dokuwiki/ - * @author Andreas Gohr + * @license GPL 2 (http://www.gnu.org/licenses/gpl.html) + * @author James Van Lommel + * @link http://www.nosq.com/blog/2005/08/ldap-activedirectory-and-dokuwiki/ + * @author Andreas Gohr */ require_once(DOKU_INC.'inc/adLDAP.php'); @@ -51,11 +51,10 @@ class auth_ad extends auth_basic { /** * Constructor */ - function auth_ad() { + function __construct() { global $conf; $this->cnf = $conf['auth']['ad']; - // additional information fields if (isset($this->cnf['additional'])) { $this->cnf['additional'] = str_replace(' ', '', $this->cnf['additional']); @@ -72,21 +71,21 @@ class auth_ad extends auth_basic { // Prepare SSO if($_SERVER['REMOTE_USER'] && $this->cnf['sso']){ - // remove possible NTLM domain - list($dom,$usr) = explode('\\',$_SERVER['REMOTE_USER'],2); - if(!$usr) $usr = $dom; + // remove possible NTLM domain + list($dom,$usr) = explode('\\',$_SERVER['REMOTE_USER'],2); + if(!$usr) $usr = $dom; - // remove possible Kerberos domain - list($usr,$dom) = explode('@',$usr); + // remove possible Kerberos domain + list($usr,$dom) = explode('@',$usr); - $dom = strtolower($dom); - $_SERVER['REMOTE_USER'] = $usr; + $dom = strtolower($dom); + $_SERVER['REMOTE_USER'] = $usr; - // we need to simulate a login - if(empty($_COOKIE[DOKU_COOKIE])){ - $_REQUEST['u'] = $_SERVER['REMOTE_USER']; - $_REQUEST['p'] = 'sso_only'; - } + // we need to simulate a login + if(empty($_COOKIE[DOKU_COOKIE])){ + $_REQUEST['u'] = $_SERVER['REMOTE_USER']; + $_REQUEST['p'] = 'sso_only'; + } } // prepare adLDAP standard configuration @@ -147,7 +146,7 @@ class auth_ad extends auth_basic { * * @author James Van Lommel */ - function getUserData($user){ + function getUserData($user){ global $conf; global $lang; global $ID; @@ -297,7 +296,7 @@ class auth_ad extends auth_basic { * @param $user nick of the user to be changed * @param $changes array of field/value pairs to be changed * @return bool - */ + */ function modifyUser($user, $changes) { $return = true; @@ -380,7 +379,6 @@ class auth_ad extends auth_basic { function _constructPattern($filter) { $this->_pattern = array(); foreach ($filter as $item => $pattern) { -// $this->_pattern[$item] = '/'.preg_quote($pattern,"/").'/i'; // don't allow regex characters $this->_pattern[$item] = '/'.str_replace('/','\/',$pattern).'/i'; // allow regex characters } } -- cgit v1.2.3