From f4476bd9b5badd36cd0617d76538e47d9649986b Mon Sep 17 00:00:00 2001 From: Jan Schumann Date: Mon, 20 Feb 2012 19:51:26 +0100 Subject: Refactored auth system: All auth methods are now introduced as plugins. --- lib/plugins/authldap/auth.php | 471 +++++++++++++++++++++++++++++++++++ lib/plugins/authldap/plugin.info.txt | 7 + 2 files changed, 478 insertions(+) create mode 100644 lib/plugins/authldap/auth.php create mode 100644 lib/plugins/authldap/plugin.info.txt (limited to 'lib/plugins/authldap') diff --git a/lib/plugins/authldap/auth.php b/lib/plugins/authldap/auth.php new file mode 100644 index 000000000..723685f94 --- /dev/null +++ b/lib/plugins/authldap/auth.php @@ -0,0 +1,471 @@ + + */ +// must be run within Dokuwiki +if(!defined('DOKU_INC')) die(); + +/** + * LDAP authentication backend + * + * @license GPL 2 (http://www.gnu.org/licenses/gpl.html) + * @author Andreas Gohr + * @author Chris Smith + * @author Jan Schumann + */ +class auth_plugin_authldap extends DokuWiki_Auth_Plugin +{ + var $cnf = null; + var $con = null; + var $bound = 0; // 0: anonymous, 1: user, 2: superuser + + /** + * Constructor + */ + function auth_plugin_authldap(){ + global $conf; + $this->cnf = $conf['auth']['ldap']; + + // ldap extension is needed + if(!function_exists('ldap_connect')) { + if ($this->cnf['debug']) + msg("LDAP err: PHP LDAP extension not found.",-1,__LINE__,__FILE__); + $this->success = false; + return; + } + + if(empty($this->cnf['groupkey'])) $this->cnf['groupkey'] = 'cn'; + if(empty($this->cnf['userscope'])) $this->cnf['userscope'] = 'sub'; + if(empty($this->cnf['groupscope'])) $this->cnf['groupscope'] = 'sub'; + + // auth_ldap currently just handles authentication, so no + // capabilities are set + } + + /** + * Check user+password + * + * Checks if the given user exists and the given + * plaintext password is correct by trying to bind + * to the LDAP server + * + * @author Andreas Gohr + * @return bool + */ + function checkPass($user,$pass){ + // reject empty password + if(empty($pass)) return false; + if(!$this->_openLDAP()) return false; + + // indirect user bind + if($this->cnf['binddn'] && $this->cnf['bindpw']){ + // use superuser credentials + if(!@ldap_bind($this->con,$this->cnf['binddn'],$this->cnf['bindpw'])){ + if($this->cnf['debug']) + msg('LDAP bind as superuser: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + return false; + } + $this->bound = 2; + }else if($this->cnf['binddn'] && + $this->cnf['usertree'] && + $this->cnf['userfilter']) { + // special bind string + $dn = $this->_makeFilter($this->cnf['binddn'], + array('user'=>$user,'server'=>$this->cnf['server'])); + + }else if(strpos($this->cnf['usertree'], '%{user}')) { + // direct user bind + $dn = $this->_makeFilter($this->cnf['usertree'], + array('user'=>$user,'server'=>$this->cnf['server'])); + + }else{ + // Anonymous bind + if(!@ldap_bind($this->con)){ + msg("LDAP: can not bind anonymously",-1); + if($this->cnf['debug']) + msg('LDAP anonymous bind: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + return false; + } + } + + // Try to bind to with the dn if we have one. + if(!empty($dn)) { + // User/Password bind + if(!@ldap_bind($this->con,$dn,$pass)){ + if($this->cnf['debug']){ + msg("LDAP: bind with $dn failed", -1,__LINE__,__FILE__); + msg('LDAP user dn bind: '.htmlspecialchars(ldap_error($this->con)),0); + } + return false; + } + $this->bound = 1; + return true; + }else{ + // See if we can find the user + $info = $this->getUserData($user,true); + if(empty($info['dn'])) { + return false; + } else { + $dn = $info['dn']; + } + + // Try to bind with the dn provided + if(!@ldap_bind($this->con,$dn,$pass)){ + if($this->cnf['debug']){ + msg("LDAP: bind with $dn failed", -1,__LINE__,__FILE__); + msg('LDAP user bind: '.htmlspecialchars(ldap_error($this->con)),0); + } + return false; + } + $this->bound = 1; + return true; + } + + return false; + } + + /** + * Return user info + * + * Returns info about the given user needs to contain + * at least these fields: + * + * name string full name of the user + * mail string email addres of the user + * grps array list of groups the user is in + * + * This LDAP specific function returns the following + * addional fields: + * + * dn string distinguished name (DN) + * uid string Posix User ID + * inbind bool for internal use - avoid loop in binding + * + * @author Andreas Gohr + * @author Trouble + * @author Dan Allen + * @author + * @author Stephane Chazelas + * @return array containing user data or false + */ + function getUserData($user,$inbind=false) { + global $conf; + if(!$this->_openLDAP()) return false; + + // force superuser bind if wanted and not bound as superuser yet + if($this->cnf['binddn'] && $this->cnf['bindpw'] && $this->bound < 2){ + // use superuser credentials + if(!@ldap_bind($this->con,$this->cnf['binddn'],$this->cnf['bindpw'])){ + if($this->cnf['debug']) + msg('LDAP bind as superuser: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + return false; + } + $this->bound = 2; + }elseif($this->bound == 0 && !$inbind) { + // in some cases getUserData is called outside the authentication workflow + // eg. for sending email notification on subscribed pages. This data might not + // be accessible anonymously, so we try to rebind the current user here + list($loginuser,$loginsticky,$loginpass) = auth_getCookie(); + if($loginuser && $loginpass){ + $loginpass = PMA_blowfish_decrypt($loginpass, auth_cookiesalt(!$loginsticky)); + $this->checkPass($loginuser, $loginpass); + } + } + + $info['user'] = $user; + $info['server'] = $this->cnf['server']; + + //get info for given user + $base = $this->_makeFilter($this->cnf['usertree'], $info); + if(!empty($this->cnf['userfilter'])) { + $filter = $this->_makeFilter($this->cnf['userfilter'], $info); + } else { + $filter = "(ObjectClass=*)"; + } + + $sr = $this->_ldapsearch($this->con, $base, $filter, $this->cnf['userscope']); + $result = @ldap_get_entries($this->con, $sr); + if($this->cnf['debug']){ + msg('LDAP user search: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + msg('LDAP search at: '.htmlspecialchars($base.' '.$filter),0,__LINE__,__FILE__); + } + + // Don't accept more or less than one response + if(!is_array($result) || $result['count'] != 1){ + return false; //user not found + } + + $user_result = $result[0]; + ldap_free_result($sr); + + // general user info + $info['dn'] = $user_result['dn']; + $info['gid'] = $user_result['gidnumber'][0]; + $info['mail'] = $user_result['mail'][0]; + $info['name'] = $user_result['cn'][0]; + $info['grps'] = array(); + + // overwrite if other attribs are specified. + if(is_array($this->cnf['mapping'])){ + foreach($this->cnf['mapping'] as $localkey => $key) { + if(is_array($key)) { + // use regexp to clean up user_result + list($key, $regexp) = each($key); + if($user_result[$key]) foreach($user_result[$key] as $grp){ + if (preg_match($regexp,$grp,$match)) { + if($localkey == 'grps') { + $info[$localkey][] = $match[1]; + } else { + $info[$localkey] = $match[1]; + } + } + } + } else { + $info[$localkey] = $user_result[$key][0]; + } + } + } + $user_result = array_merge($info,$user_result); + + //get groups for given user if grouptree is given + if ($this->cnf['grouptree'] || $this->cnf['groupfilter']) { + $base = $this->_makeFilter($this->cnf['grouptree'], $user_result); + $filter = $this->_makeFilter($this->cnf['groupfilter'], $user_result); + $sr = $this->_ldapsearch($this->con, $base, $filter, $this->cnf['groupscope'], array($this->cnf['groupkey'])); + if($this->cnf['debug']){ + msg('LDAP group search: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + msg('LDAP search at: '.htmlspecialchars($base.' '.$filter),0,__LINE__,__FILE__); + } + if(!$sr){ + msg("LDAP: Reading group memberships failed",-1); + return false; + } + $result = ldap_get_entries($this->con, $sr); + ldap_free_result($sr); + + if(is_array($result)) foreach($result as $grp){ + if(!empty($grp[$this->cnf['groupkey']][0])){ + if($this->cnf['debug']) + msg('LDAP usergroup: '.htmlspecialchars($grp[$this->cnf['groupkey']][0]),0,__LINE__,__FILE__); + $info['grps'][] = $grp[$this->cnf['groupkey']][0]; + } + } + } + + // always add the default group to the list of groups + if(!in_array($conf['defaultgroup'],$info['grps'])){ + $info['grps'][] = $conf['defaultgroup']; + } + return $info; + } + + /** + * Most values in LDAP are case-insensitive + */ + function isCaseSensitive(){ + return false; + } + + /** + * Bulk retrieval of user data + * + * @author Dominik Eckelmann + * @param start index of first user to be returned + * @param limit max number of users to be returned + * @param filter array of field/pattern pairs, null for no filter + * @return array of userinfo (refer getUserData for internal userinfo details) + */ + function retrieveUsers($start=0,$limit=-1,$filter=array()) { + if(!$this->_openLDAP()) return false; + + if (!isset($this->users)) { + // Perform the search and grab all their details + if(!empty($this->cnf['userfilter'])) { + $all_filter = str_replace('%{user}', '*', $this->cnf['userfilter']); + } else { + $all_filter = "(ObjectClass=*)"; + } + $sr=ldap_search($this->con,$this->cnf['usertree'],$all_filter); + $entries = ldap_get_entries($this->con, $sr); + $users_array = array(); + for ($i=0; $i<$entries["count"]; $i++){ + array_push($users_array, $entries[$i]["uid"][0]); + } + asort($users_array); + $result = $users_array; + if (!$result) return array(); + $this->users = array_fill_keys($result, false); + } + $i = 0; + $count = 0; + $this->_constructPattern($filter); + $result = array(); + + foreach ($this->users as $user => &$info) { + if ($i++ < $start) { + continue; + } + if ($info === false) { + $info = $this->getUserData($user); + } + if ($this->_filter($user, $info)) { + $result[$user] = $info; + if (($limit >= 0) && (++$count >= $limit)) break; + } + } + return $result; + + + } + + /** + * Make LDAP filter strings. + * + * Used by auth_getUserData to make the filter + * strings for grouptree and groupfilter + * + * filter string ldap search filter with placeholders + * placeholders array array with the placeholders + * + * @author Troels Liebe Bentsen + * @return string + */ + function _makeFilter($filter, $placeholders) { + preg_match_all("/%{([^}]+)/", $filter, $matches, PREG_PATTERN_ORDER); + //replace each match + foreach ($matches[1] as $match) { + //take first element if array + if(is_array($placeholders[$match])) { + $value = $placeholders[$match][0]; + } else { + $value = $placeholders[$match]; + } + $value = $this->_filterEscape($value); + $filter = str_replace('%{'.$match.'}', $value, $filter); + } + return $filter; + } + + /** + * return 1 if $user + $info match $filter criteria, 0 otherwise + * + * @author Chris Smith + */ + function _filter($user, $info) { + foreach ($this->_pattern as $item => $pattern) { + if ($item == 'user') { + if (!preg_match($pattern, $user)) return 0; + } else if ($item == 'grps') { + if (!count(preg_grep($pattern, $info['grps']))) return 0; + } else { + if (!preg_match($pattern, $info[$item])) return 0; + } + } + return 1; + } + + function _constructPattern($filter) { + $this->_pattern = array(); + foreach ($filter as $item => $pattern) { +// $this->_pattern[$item] = '/'.preg_quote($pattern,"/").'/i'; // don't allow regex characters + $this->_pattern[$item] = '/'.str_replace('/','\/',$pattern).'/i'; // allow regex characters + } + } + + /** + * Escape a string to be used in a LDAP filter + * + * Ported from Perl's Net::LDAP::Util escape_filter_value + * + * @author Andreas Gohr + */ + function _filterEscape($string){ + return preg_replace('/([\x00-\x1F\*\(\)\\\\])/e', + '"\\\\\".join("",unpack("H2","$1"))', + $string); + } + + /** + * Opens a connection to the configured LDAP server and sets the wanted + * option on the connection + * + * @author Andreas Gohr + */ + function _openLDAP(){ + if($this->con) return true; // connection already established + + $this->bound = 0; + + $port = ($this->cnf['port']) ? $this->cnf['port'] : 389; + $this->con = @ldap_connect($this->cnf['server'],$port); + if(!$this->con){ + msg("LDAP: couldn't connect to LDAP server",-1); + return false; + } + + //set protocol version and dependend options + if($this->cnf['version']){ + if(!@ldap_set_option($this->con, LDAP_OPT_PROTOCOL_VERSION, + $this->cnf['version'])){ + msg('Setting LDAP Protocol version '.$this->cnf['version'].' failed',-1); + if($this->cnf['debug']) + msg('LDAP version set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + }else{ + //use TLS (needs version 3) + if($this->cnf['starttls']) { + if (!@ldap_start_tls($this->con)){ + msg('Starting TLS failed',-1); + if($this->cnf['debug']) + msg('LDAP TLS set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + } + } + // needs version 3 + if(isset($this->cnf['referrals'])) { + if(!@ldap_set_option($this->con, LDAP_OPT_REFERRALS, + $this->cnf['referrals'])){ + msg('Setting LDAP referrals to off failed',-1); + if($this->cnf['debug']) + msg('LDAP referal set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + } + } + } + } + + //set deref mode + if($this->cnf['deref']){ + if(!@ldap_set_option($this->con, LDAP_OPT_DEREF, $this->cnf['deref'])){ + msg('Setting LDAP Deref mode '.$this->cnf['deref'].' failed',-1); + if($this->cnf['debug']) + msg('LDAP deref set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + } + } + + $this->canDo['getUsers'] = true; + return true; + } + + /** + * Wraps around ldap_search, ldap_list or ldap_read depending on $scope + * + * @param $scope string - can be 'base', 'one' or 'sub' + * @author Andreas Gohr + */ + function _ldapsearch($link_identifier, $base_dn, $filter, $scope='sub', $attributes=null, + $attrsonly=0, $sizelimit=0, $timelimit=0, $deref=LDAP_DEREF_NEVER){ + if(is_null($attributes)) $attributes = array(); + + if($scope == 'base'){ + return @ldap_read($link_identifier, $base_dn, $filter, $attributes, + $attrsonly, $sizelimit, $timelimit, $deref); + }elseif($scope == 'one'){ + return @ldap_list($link_identifier, $base_dn, $filter, $attributes, + $attrsonly, $sizelimit, $timelimit, $deref); + }else{ + return @ldap_search($link_identifier, $base_dn, $filter, $attributes, + $attrsonly, $sizelimit, $timelimit, $deref); + } + } +} \ No newline at end of file diff --git a/lib/plugins/authldap/plugin.info.txt b/lib/plugins/authldap/plugin.info.txt new file mode 100644 index 000000000..c36385224 --- /dev/null +++ b/lib/plugins/authldap/plugin.info.txt @@ -0,0 +1,7 @@ +base authldap +author +email +date +name ldap auth plugin +desc Provides authentication against am LDAP server +url -- cgit v1.2.3 From 94c0297d119ce52ad794c18f26220311e3c0ed8c Mon Sep 17 00:00:00 2001 From: Andreas Gohr Date: Sat, 6 Oct 2012 11:31:26 +0200 Subject: completed plugin.info.txt files --- lib/plugins/authldap/plugin.info.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'lib/plugins/authldap') diff --git a/lib/plugins/authldap/plugin.info.txt b/lib/plugins/authldap/plugin.info.txt index c36385224..2af8cf00a 100644 --- a/lib/plugins/authldap/plugin.info.txt +++ b/lib/plugins/authldap/plugin.info.txt @@ -1,7 +1,7 @@ base authldap -author -email -date +author Andreas Gohr +email andi@splitbrain.org +date 2012-10-06 name ldap auth plugin desc Provides authentication against am LDAP server -url +url http://www.dokuwiki.org/plugin:authldap -- cgit v1.2.3 From 454d868b911059adb8889a2d6afefa016d6a21f5 Mon Sep 17 00:00:00 2001 From: Andreas Gohr Date: Fri, 9 Nov 2012 14:04:41 +0100 Subject: make all sub auth classes call the parent constructor This does nothing currently but allows us adding certain things to the base class later. --- lib/plugins/authldap/auth.php | 2 ++ 1 file changed, 2 insertions(+) (limited to 'lib/plugins/authldap') diff --git a/lib/plugins/authldap/auth.php b/lib/plugins/authldap/auth.php index 721abb48e..93683bc16 100644 --- a/lib/plugins/authldap/auth.php +++ b/lib/plugins/authldap/auth.php @@ -19,6 +19,8 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin { * Constructor */ function __construct(){ + parent::__construct(); + global $conf; $this->cnf = $conf['auth']['ldap']; -- cgit v1.2.3 From 70e4a085e6a861a12a7b927ba9dfa10d5961f958 Mon Sep 17 00:00:00 2001 From: Andreas Gohr Date: Fri, 9 Nov 2012 15:36:35 +0100 Subject: fixes for authldap * makes proper use of plugin config * adds a few first defaults, but the whole config metadata is still missing * proper PHP5 use and comments --- lib/plugins/authldap/auth.php | 389 +++++++++++++++++++--------------- lib/plugins/authldap/conf/default.php | 7 + 2 files changed, 224 insertions(+), 172 deletions(-) create mode 100644 lib/plugins/authldap/conf/default.php (limited to 'lib/plugins/authldap') diff --git a/lib/plugins/authldap/auth.php b/lib/plugins/authldap/auth.php index 93683bc16..6e7bde1f0 100644 --- a/lib/plugins/authldap/auth.php +++ b/lib/plugins/authldap/auth.php @@ -11,31 +11,31 @@ if(!defined('DOKU_INC')) die(); * @author Jan Schumann */ class auth_plugin_authldap extends DokuWiki_Auth_Plugin { - var $cnf = null; - var $con = null; - var $bound = 0; // 0: anonymous, 1: user, 2: superuser + /* @var resource $con holds the LDAP connection*/ + protected $con = null; + + /* @var int $bound What type of connection does already exist? */ + protected $bound = 0; // 0: anonymous, 1: user, 2: superuser + + /* @var array $users User data cache */ + protected $users = null; + + /* @var array $_pattern User filter pattern */ + protected $_pattern = null; /** * Constructor */ - function __construct(){ + public function __construct() { parent::__construct(); - global $conf; - $this->cnf = $conf['auth']['ldap']; - // ldap extension is needed if(!function_exists('ldap_connect')) { - if ($this->cnf['debug']) - msg("LDAP err: PHP LDAP extension not found.",-1,__LINE__,__FILE__); + $this->_debug("LDAP err: PHP LDAP extension not found.", -1, __LINE__, __FILE__); $this->success = false; return; } - if(empty($this->cnf['groupkey'])) $this->cnf['groupkey'] = 'cn'; - if(empty($this->cnf['userscope'])) $this->cnf['userscope'] = 'sub'; - if(empty($this->cnf['groupscope'])) $this->cnf['groupscope'] = 'sub'; - // auth_ldap currently just handles authentication, so no // capabilities are set } @@ -48,40 +48,45 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin { * to the LDAP server * * @author Andreas Gohr + * @param string $user + * @param string $pass * @return bool */ - function checkPass($user,$pass){ + public function checkPass($user, $pass) { // reject empty password if(empty($pass)) return false; if(!$this->_openLDAP()) return false; // indirect user bind - if($this->cnf['binddn'] && $this->cnf['bindpw']){ + if($this->getConf('binddn') && $this->getConf('bindpw')) { // use superuser credentials - if(!@ldap_bind($this->con,$this->cnf['binddn'],$this->cnf['bindpw'])){ - if($this->cnf['debug']) - msg('LDAP bind as superuser: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + if(!@ldap_bind($this->con, $this->getConf('binddn'), $this->getConf('bindpw'))) { + $this->_debug('LDAP bind as superuser: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__); return false; } $this->bound = 2; - }else if($this->cnf['binddn'] && - $this->cnf['usertree'] && - $this->cnf['userfilter']) { + } else if($this->getConf('binddn') && + $this->getConf('usertree') && + $this->getConf('userfilter') + ) { // special bind string - $dn = $this->_makeFilter($this->cnf['binddn'], - array('user'=>$user,'server'=>$this->cnf['server'])); + $dn = $this->_makeFilter( + $this->getConf('binddn'), + array('user'=> $user, 'server'=> $this->getConf('server')) + ); - }else if(strpos($this->cnf['usertree'], '%{user}')) { + } else if(strpos($this->getConf('usertree'), '%{user}')) { // direct user bind - $dn = $this->_makeFilter($this->cnf['usertree'], - array('user'=>$user,'server'=>$this->cnf['server'])); + $dn = $this->_makeFilter( + $this->getConf('usertree'), + array('user'=> $user, 'server'=> $this->getConf('server')) + ); - }else{ + } else { // Anonymous bind - if(!@ldap_bind($this->con)){ - msg("LDAP: can not bind anonymously",-1); - if($this->cnf['debug']) - msg('LDAP anonymous bind: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + if(!@ldap_bind($this->con)) { + msg("LDAP: can not bind anonymously", -1); + $this->_debug('LDAP anonymous bind: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__); return false; } } @@ -89,18 +94,16 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin { // Try to bind to with the dn if we have one. if(!empty($dn)) { // User/Password bind - if(!@ldap_bind($this->con,$dn,$pass)){ - if($this->cnf['debug']){ - msg("LDAP: bind with $dn failed", -1,__LINE__,__FILE__); - msg('LDAP user dn bind: '.htmlspecialchars(ldap_error($this->con)),0); - } + if(!@ldap_bind($this->con, $dn, $pass)) { + $this->_debug("LDAP: bind with $dn failed", -1, __LINE__, __FILE__); + $this->_debug('LDAP user dn bind: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__); return false; } $this->bound = 1; return true; - }else{ + } else { // See if we can find the user - $info = $this->getUserData($user,true); + $info = $this->getUserData($user, true); if(empty($info['dn'])) { return false; } else { @@ -108,18 +111,14 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin { } // Try to bind with the dn provided - if(!@ldap_bind($this->con,$dn,$pass)){ - if($this->cnf['debug']){ - msg("LDAP: bind with $dn failed", -1,__LINE__,__FILE__); - msg('LDAP user bind: '.htmlspecialchars(ldap_error($this->con)),0); - } + if(!@ldap_bind($this->con, $dn, $pass)) { + $this->_debug("LDAP: bind with $dn failed", -1, __LINE__, __FILE__); + $this->_debug('LDAP user bind: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__); return false; } $this->bound = 1; return true; } - - return false; } /** @@ -144,52 +143,52 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin { * @author Dan Allen * @author * @author Stephane Chazelas + * + * @param string $user + * @param bool $inbind authldap specific, true if in bind phase * @return array containing user data or false */ - function getUserData($user,$inbind=false) { + public function getUserData($user, $inbind = false) { global $conf; if(!$this->_openLDAP()) return false; // force superuser bind if wanted and not bound as superuser yet - if($this->cnf['binddn'] && $this->cnf['bindpw'] && $this->bound < 2){ + if($this->getConf('binddn') && $this->getConf('bindpw') && $this->bound < 2) { // use superuser credentials - if(!@ldap_bind($this->con,$this->cnf['binddn'],$this->cnf['bindpw'])){ - if($this->cnf['debug']) - msg('LDAP bind as superuser: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + if(!@ldap_bind($this->con, $this->getConf('binddn'), $this->getConf('bindpw'))) { + $this->_debug('LDAP bind as superuser: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__); return false; } $this->bound = 2; - }elseif($this->bound == 0 && !$inbind) { + } elseif($this->bound == 0 && !$inbind) { // in some cases getUserData is called outside the authentication workflow // eg. for sending email notification on subscribed pages. This data might not // be accessible anonymously, so we try to rebind the current user here - list($loginuser,$loginsticky,$loginpass) = auth_getCookie(); - if($loginuser && $loginpass){ + list($loginuser, $loginsticky, $loginpass) = auth_getCookie(); + if($loginuser && $loginpass) { $loginpass = PMA_blowfish_decrypt($loginpass, auth_cookiesalt(!$loginsticky)); $this->checkPass($loginuser, $loginpass); } } $info['user'] = $user; - $info['server'] = $this->cnf['server']; + $info['server'] = $this->getConf('server'); //get info for given user - $base = $this->_makeFilter($this->cnf['usertree'], $info); - if(!empty($this->cnf['userfilter'])) { - $filter = $this->_makeFilter($this->cnf['userfilter'], $info); + $base = $this->_makeFilter($this->getConf('usertree'), $info); + if($this->getConf('userfilter')) { + $filter = $this->_makeFilter($this->getConf('userfilter'), $info); } else { $filter = "(ObjectClass=*)"; } - $sr = $this->_ldapsearch($this->con, $base, $filter, $this->cnf['userscope']); + $sr = $this->_ldapsearch($this->con, $base, $filter, $this->getConf('userscope')); $result = @ldap_get_entries($this->con, $sr); - if($this->cnf['debug']){ - msg('LDAP user search: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); - msg('LDAP search at: '.htmlspecialchars($base.' '.$filter),0,__LINE__,__FILE__); - } + $this->_debug('LDAP user search: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__); + $this->_debug('LDAP search at: '.htmlspecialchars($base.' '.$filter), 0, __LINE__, __FILE__); // Don't accept more or less than one response - if(!is_array($result) || $result['count'] != 1){ + if(!is_array($result) || $result['count'] != 1) { return false; //user not found } @@ -204,13 +203,13 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin { $info['grps'] = array(); // overwrite if other attribs are specified. - if(is_array($this->cnf['mapping'])){ - foreach($this->cnf['mapping'] as $localkey => $key) { + if(is_array($this->getConf('mapping'))) { + foreach($this->getConf('mapping') as $localkey => $key) { if(is_array($key)) { // use regexp to clean up user_result list($key, $regexp) = each($key); - if($user_result[$key]) foreach($user_result[$key] as $grp){ - if (preg_match($regexp,$grp,$match)) { + if($user_result[$key]) foreach($user_result[$key] as $grp) { + if(preg_match($regexp, $grp, $match)) { if($localkey == 'grps') { $info[$localkey][] = $match[1]; } else { @@ -223,35 +222,33 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin { } } } - $user_result = array_merge($info,$user_result); + $user_result = array_merge($info, $user_result); //get groups for given user if grouptree is given - if ($this->cnf['grouptree'] || $this->cnf['groupfilter']) { - $base = $this->_makeFilter($this->cnf['grouptree'], $user_result); - $filter = $this->_makeFilter($this->cnf['groupfilter'], $user_result); - $sr = $this->_ldapsearch($this->con, $base, $filter, $this->cnf['groupscope'], array($this->cnf['groupkey'])); - if($this->cnf['debug']){ - msg('LDAP group search: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); - msg('LDAP search at: '.htmlspecialchars($base.' '.$filter),0,__LINE__,__FILE__); - } - if(!$sr){ - msg("LDAP: Reading group memberships failed",-1); + if($this->getConf('grouptree') || $this->getConf('groupfilter')) { + $base = $this->_makeFilter($this->getConf('grouptree'), $user_result); + $filter = $this->_makeFilter($this->getConf('groupfilter'), $user_result); + $sr = $this->_ldapsearch($this->con, $base, $filter, $this->getConf('groupscope'), array($this->getConf('groupkey'))); + $this->_debug('LDAP group search: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__); + $this->_debug('LDAP search at: '.htmlspecialchars($base.' '.$filter), 0, __LINE__, __FILE__); + + if(!$sr) { + msg("LDAP: Reading group memberships failed", -1); return false; } $result = ldap_get_entries($this->con, $sr); ldap_free_result($sr); - if(is_array($result)) foreach($result as $grp){ - if(!empty($grp[$this->cnf['groupkey']][0])){ - if($this->cnf['debug']) - msg('LDAP usergroup: '.htmlspecialchars($grp[$this->cnf['groupkey']][0]),0,__LINE__,__FILE__); - $info['grps'][] = $grp[$this->cnf['groupkey']][0]; + if(is_array($result)) foreach($result as $grp) { + if(!empty($grp[$this->getConf('groupkey')][0])) { + $this->_debug('LDAP usergroup: '.htmlspecialchars($grp[$this->getConf('groupkey')][0]), 0, __LINE__, __FILE__); + $info['grps'][] = $grp[$this->getConf('groupkey')][0]; } } } // always add the default group to the list of groups - if(!in_array($conf['defaultgroup'],$info['grps'])){ + if(!in_array($conf['defaultgroup'], $info['grps'])) { $info['grps'][] = $conf['defaultgroup']; } return $info; @@ -259,8 +256,10 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin { /** * Most values in LDAP are case-insensitive + * + * @return bool */ - function isCaseSensitive(){ + public function isCaseSensitive() { return false; } @@ -268,47 +267,47 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin { * Bulk retrieval of user data * * @author Dominik Eckelmann - * @param start index of first user to be returned - * @param limit max number of users to be returned - * @param filter array of field/pattern pairs, null for no filter + * @param int $start index of first user to be returned + * @param int $limit max number of users to be returned + * @param array $filter array of field/pattern pairs, null for no filter * @return array of userinfo (refer getUserData for internal userinfo details) */ - function retrieveUsers($start=0,$limit=-1,$filter=array()) { + function retrieveUsers($start = 0, $limit = -1, $filter = array()) { if(!$this->_openLDAP()) return false; - if (!isset($this->users)) { + if(is_null($this->users)) { // Perform the search and grab all their details - if(!empty($this->cnf['userfilter'])) { - $all_filter = str_replace('%{user}', '*', $this->cnf['userfilter']); + if($this->getConf('userfilter')) { + $all_filter = str_replace('%{user}', '*', $this->getConf('userfilter')); } else { $all_filter = "(ObjectClass=*)"; } - $sr=ldap_search($this->con,$this->cnf['usertree'],$all_filter); - $entries = ldap_get_entries($this->con, $sr); + $sr = ldap_search($this->con, $this->getConf('usertree'), $all_filter); + $entries = ldap_get_entries($this->con, $sr); $users_array = array(); - for ($i=0; $i<$entries["count"]; $i++){ + for($i = 0; $i < $entries["count"]; $i++) { array_push($users_array, $entries[$i]["uid"][0]); } asort($users_array); $result = $users_array; - if (!$result) return array(); + if(!$result) return array(); $this->users = array_fill_keys($result, false); } - $i = 0; + $i = 0; $count = 0; $this->_constructPattern($filter); $result = array(); - foreach ($this->users as $user => &$info) { - if ($i++ < $start) { + foreach($this->users as $user => &$info) { + if($i++ < $start) { continue; } - if ($info === false) { + if($info === false) { $info = $this->getUserData($user); } - if ($this->_filter($user, $info)) { + if($this->_filter($user, $info)) { $result[$user] = $info; - if (($limit >= 0) && (++$count >= $limit)) break; + if(($limit >= 0) && (++$count >= $limit)) break; } } return $result; @@ -320,50 +319,61 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin { * Used by auth_getUserData to make the filter * strings for grouptree and groupfilter * - * filter string ldap search filter with placeholders - * placeholders array array with the placeholders - * * @author Troels Liebe Bentsen + * @param string $filter ldap search filter with placeholders + * @param array $placeholders placeholders to fill in * @return string */ - function _makeFilter($filter, $placeholders) { + protected function _makeFilter($filter, $placeholders) { preg_match_all("/%{([^}]+)/", $filter, $matches, PREG_PATTERN_ORDER); //replace each match - foreach ($matches[1] as $match) { + foreach($matches[1] as $match) { //take first element if array if(is_array($placeholders[$match])) { $value = $placeholders[$match][0]; } else { $value = $placeholders[$match]; } - $value = $this->_filterEscape($value); + $value = $this->_filterEscape($value); $filter = str_replace('%{'.$match.'}', $value, $filter); } return $filter; } /** - * return 1 if $user + $info match $filter criteria, 0 otherwise + * return true if $user + $info match $filter criteria, false otherwise + * + * @author Chris Smith * - * @author Chris Smith + * @param string $user the user's login name + * @param array $info the user's userinfo array + * @return bool */ - function _filter($user, $info) { - foreach ($this->_pattern as $item => $pattern) { - if ($item == 'user') { - if (!preg_match($pattern, $user)) return 0; - } else if ($item == 'grps') { - if (!count(preg_grep($pattern, $info['grps']))) return 0; + protected function _filter($user, $info) { + foreach($this->_pattern as $item => $pattern) { + if($item == 'user') { + if(!preg_match($pattern, $user)) return false; + } else if($item == 'grps') { + if(!count(preg_grep($pattern, $info['grps']))) return false; } else { - if (!preg_match($pattern, $info[$item])) return 0; + if(!preg_match($pattern, $info[$item])) return false; } } - return 1; + return true; } - function _constructPattern($filter) { + /** + * Set the filter pattern + * + * @author Chris Smith + * + * @param $filter + * @return void + */ + protected function _constructPattern($filter) { $this->_pattern = array(); - foreach ($filter as $item => $pattern) { - $this->_pattern[$item] = '/'.str_replace('/','\/',$pattern).'/i'; // allow regex characters + foreach($filter as $item => $pattern) { + $this->_pattern[$item] = '/'.str_replace('/', '\/', $pattern).'/i'; // allow regex characters } } @@ -373,11 +383,15 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin { * Ported from Perl's Net::LDAP::Util escape_filter_value * * @author Andreas Gohr + * @param string $string + * @return string */ - function _filterEscape($string){ - return preg_replace('/([\x00-\x1F\*\(\)\\\\])/e', - '"\\\\\".join("",unpack("H2","$1"))', - $string); + protected function _filterEscape($string) { + return preg_replace( + '/([\x00-\x1F\*\(\)\\\\])/e', + '"\\\\\".join("",unpack("H2","$1"))', + $string + ); } /** @@ -386,18 +400,18 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin { * * @author Andreas Gohr */ - function _openLDAP(){ + protected function _openLDAP() { if($this->con) return true; // connection already established $this->bound = 0; - $port = ($this->cnf['port']) ? $this->cnf['port'] : 389; - $bound = false; - $servers = explode(',', $this->cnf['server']); - foreach ($servers as $server) { - $server = trim($server); + $port = $this->getConf('port'); + $bound = false; + $servers = explode(',', $this->getConf('server')); + foreach($servers as $server) { + $server = trim($server); $this->con = @ldap_connect($server, $port); - if (!$this->con) { + if(!$this->con) { continue; } @@ -410,80 +424,111 @@ class auth_plugin_authldap extends DokuWiki_Auth_Plugin { */ //set protocol version and dependend options - if($this->cnf['version']){ - if(!@ldap_set_option($this->con, LDAP_OPT_PROTOCOL_VERSION, - $this->cnf['version'])){ - msg('Setting LDAP Protocol version '.$this->cnf['version'].' failed',-1); - if($this->cnf['debug']) - msg('LDAP version set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); - }else{ + if($this->getConf('version')) { + if(!@ldap_set_option( + $this->con, LDAP_OPT_PROTOCOL_VERSION, + $this->getConf('version') + ) + ) { + msg('Setting LDAP Protocol version '.$this->getConf('version').' failed', -1); + $this->_debug('LDAP version set: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__); + } else { //use TLS (needs version 3) - if($this->cnf['starttls']) { - if (!@ldap_start_tls($this->con)){ - msg('Starting TLS failed',-1); - if($this->cnf['debug']) - msg('LDAP TLS set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + if($this->getConf('starttls')) { + if(!@ldap_start_tls($this->con)) { + msg('Starting TLS failed', -1); + $this->_debug('LDAP TLS set: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__); } } // needs version 3 - if(isset($this->cnf['referrals'])) { - if(!@ldap_set_option($this->con, LDAP_OPT_REFERRALS, - $this->cnf['referrals'])){ - msg('Setting LDAP referrals to off failed',-1); - if($this->cnf['debug']) - msg('LDAP referal set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + if($this->getConf('referrals')) { + if(!@ldap_set_option( + $this->con, LDAP_OPT_REFERRALS, + $this->getConf('referrals') + ) + ) { + msg('Setting LDAP referrals to off failed', -1); + $this->_debug('LDAP referal set: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__); } } } } //set deref mode - if($this->cnf['deref']){ - if(!@ldap_set_option($this->con, LDAP_OPT_DEREF, $this->cnf['deref'])){ - msg('Setting LDAP Deref mode '.$this->cnf['deref'].' failed',-1); - if($this->cnf['debug']) - msg('LDAP deref set: '.htmlspecialchars(ldap_error($this->con)),0,__LINE__,__FILE__); + if($this->getConf('deref')) { + if(!@ldap_set_option($this->con, LDAP_OPT_DEREF, $this->getConf('deref'))) { + msg('Setting LDAP Deref mode '.$this->getConf('deref').' failed', -1); + $this->_debug('LDAP deref set: '.htmlspecialchars(ldap_error($this->con)), 0, __LINE__, __FILE__); } } /* As of PHP 5.3.0 we can set timeout to speedup skipping of invalid servers */ - if (defined('LDAP_OPT_NETWORK_TIMEOUT')) { + if(defined('LDAP_OPT_NETWORK_TIMEOUT')) { ldap_set_option($this->con, LDAP_OPT_NETWORK_TIMEOUT, 1); } $bound = @ldap_bind($this->con); - if ($bound) { + if($bound) { break; } } if(!$bound) { - msg("LDAP: couldn't connect to LDAP server",-1); + msg("LDAP: couldn't connect to LDAP server", -1); return false; } - - $this->canDo['getUsers'] = true; + $this->cando['getUsers'] = true; return true; } /** * Wraps around ldap_search, ldap_list or ldap_read depending on $scope * - * @param $scope string - can be 'base', 'one' or 'sub' * @author Andreas Gohr + * @param resource $link_identifier + * @param string $base_dn + * @param string $filter + * @param string $scope can be 'base', 'one' or 'sub' + * @param null $attributes + * @param int $attrsonly + * @param int $sizelimit + * @param int $timelimit + * @param int $deref + * @return resource */ - function _ldapsearch($link_identifier, $base_dn, $filter, $scope='sub', $attributes=null, - $attrsonly=0, $sizelimit=0, $timelimit=0, $deref=LDAP_DEREF_NEVER){ + protected function _ldapsearch($link_identifier, $base_dn, $filter, $scope = 'sub', $attributes = null, + $attrsonly = 0, $sizelimit = 0, $timelimit = 0, $deref = LDAP_DEREF_NEVER) { if(is_null($attributes)) $attributes = array(); - if($scope == 'base'){ - return @ldap_read($link_identifier, $base_dn, $filter, $attributes, - $attrsonly, $sizelimit, $timelimit, $deref); - }elseif($scope == 'one'){ - return @ldap_list($link_identifier, $base_dn, $filter, $attributes, - $attrsonly, $sizelimit, $timelimit, $deref); - }else{ - return @ldap_search($link_identifier, $base_dn, $filter, $attributes, - $attrsonly, $sizelimit, $timelimit, $deref); + if($scope == 'base') { + return @ldap_read( + $link_identifier, $base_dn, $filter, $attributes, + $attrsonly, $sizelimit, $timelimit, $deref + ); + } elseif($scope == 'one') { + return @ldap_list( + $link_identifier, $base_dn, $filter, $attributes, + $attrsonly, $sizelimit, $timelimit, $deref + ); + } else { + return @ldap_search( + $link_identifier, $base_dn, $filter, $attributes, + $attrsonly, $sizelimit, $timelimit, $deref + ); } } + + /** + * Wrapper around msg() but outputs only when debug is enabled + * + * @param string $message + * @param int $err + * @param int $line + * @param string $file + * @return void + */ + protected function _debug($message, $err, $line, $file) { + if(!$this->getConf('debug')) return; + msg($message, $err, $line, $file); + } + } diff --git a/lib/plugins/authldap/conf/default.php b/lib/plugins/authldap/conf/default.php new file mode 100644 index 000000000..35971d41d --- /dev/null +++ b/lib/plugins/authldap/conf/default.php @@ -0,0 +1,7 @@ + Date: Sat, 2 Feb 2013 13:32:24 +0100 Subject: dded config metadata for authldap plugin --- lib/plugins/authldap/conf/metadata.php | 17 +++++++++++++++++ lib/plugins/authldap/lang/en/settings.php | 15 +++++++++++++++ 2 files changed, 32 insertions(+) create mode 100644 lib/plugins/authldap/conf/metadata.php create mode 100644 lib/plugins/authldap/lang/en/settings.php (limited to 'lib/plugins/authldap') diff --git a/lib/plugins/authldap/conf/metadata.php b/lib/plugins/authldap/conf/metadata.php new file mode 100644 index 000000000..e0815f789 --- /dev/null +++ b/lib/plugins/authldap/conf/metadata.php @@ -0,0 +1,17 @@ + array('sub','one','base')); +$meta['groupscope'] = array('multichoice','_choices' => array('sub','one','base')); +$meta['debug'] = array('onoff'); \ No newline at end of file diff --git a/lib/plugins/authldap/lang/en/settings.php b/lib/plugins/authldap/lang/en/settings.php new file mode 100644 index 000000000..e3f4bab31 --- /dev/null +++ b/lib/plugins/authldap/lang/en/settings.php @@ -0,0 +1,15 @@ +localhost) or full qualified URL (ldap://server.tld:389)'; +$lang['port'] = 'LDAP server port if no full URL was given above'; +$lang['usertree'] = 'Where to finde the user accounts. Eg. ou=People, dc=server, dc=tld'; +$lang['grouptree'] = 'Where to find the user groups. Eg. ou=Group, dc=server, dc=tld'; +$lang['userfilter'] = 'LDAP filter to search for user accounts. Eg. (&(uid=%{user})(objectClass=posixAccount))'; +$lang['groupfilter'] = 'LDAP filter to search for groups. Eg. (&(objectClass=posixGroup)(|(gidNumber=%{gid})(memberUID=%{user})))'; +$lang['version'] = 'The protocol version to use. You may need to set this to 3'; +$lang['starttls'] = 'Use TLS connections?'; +$lang['referrals'] = 'Shall referrals be followed?'; +$lang['binddn'] = 'DN of an ptional bind user if anonymous bind is not sufficient. Eg. cn=admin, dc=my, dc=home'; +$lang['bindpw'] = 'Password of above user'; +$lang['userscope'] = 'Limit search scope for user search'; +$lang['groupscope'] = 'Limit search scope for group search'; +$lang['debug'] = 'Display additional debug information on errors'; \ No newline at end of file -- cgit v1.2.3 From 45970804e69e3d087fe19ad9cefaff0ef44be795 Mon Sep 17 00:00:00 2001 From: Klap-in Date: Sat, 16 Feb 2013 22:53:38 +0100 Subject: Complete metadata and defaults of auth plugin configs --- lib/plugins/authldap/conf/default.php | 20 ++++++++++++++++---- lib/plugins/authldap/conf/metadata.php | 1 + lib/plugins/authldap/lang/en/settings.php | 5 ++++- 3 files changed, 21 insertions(+), 5 deletions(-) (limited to 'lib/plugins/authldap') diff --git a/lib/plugins/authldap/conf/default.php b/lib/plugins/authldap/conf/default.php index 35971d41d..d07f9c82e 100644 --- a/lib/plugins/authldap/conf/default.php +++ b/lib/plugins/authldap/conf/default.php @@ -1,7 +1,19 @@ array('sub','one','base')); $meta['groupscope'] = array('multichoice','_choices' => array('sub','one','base')); +$meta['groupkey'] = array('string'); $meta['debug'] = array('onoff'); \ No newline at end of file diff --git a/lib/plugins/authldap/lang/en/settings.php b/lib/plugins/authldap/lang/en/settings.php index e3f4bab31..f20b7d2a3 100644 --- a/lib/plugins/authldap/lang/en/settings.php +++ b/lib/plugins/authldap/lang/en/settings.php @@ -12,4 +12,7 @@ $lang['binddn'] = 'DN of an ptional bind user if anonymous bind is not suff $lang['bindpw'] = 'Password of above user'; $lang['userscope'] = 'Limit search scope for user search'; $lang['groupscope'] = 'Limit search scope for group search'; -$lang['debug'] = 'Display additional debug information on errors'; \ No newline at end of file +$lang['groupkey'] = 'Group member ship from any user attribute (instead of standard AD groups) e.g. group from department or telephone number'; +$lang['debug'] = 'Display additional debug information on errors'; + + -- cgit v1.2.3 From 4005b0809260fbd36cb8652c7d726a5ee417c6f6 Mon Sep 17 00:00:00 2001 From: Anika Henke Date: Sat, 16 Feb 2013 19:42:38 +0000 Subject: fixed html error in plugin lang file --- lib/plugins/authldap/lang/en/settings.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'lib/plugins/authldap') diff --git a/lib/plugins/authldap/lang/en/settings.php b/lib/plugins/authldap/lang/en/settings.php index e3f4bab31..cc9143169 100644 --- a/lib/plugins/authldap/lang/en/settings.php +++ b/lib/plugins/authldap/lang/en/settings.php @@ -3,8 +3,8 @@ $lang['server'] = 'Your LDAP server. Either hostname (localhost Date: Sat, 16 Feb 2013 23:55:52 +0100 Subject: litte fixes --- lib/plugins/authldap/lang/en/settings.php | 2 -- 1 file changed, 2 deletions(-) (limited to 'lib/plugins/authldap') diff --git a/lib/plugins/authldap/lang/en/settings.php b/lib/plugins/authldap/lang/en/settings.php index bca666e9f..0bb397be5 100644 --- a/lib/plugins/authldap/lang/en/settings.php +++ b/lib/plugins/authldap/lang/en/settings.php @@ -14,5 +14,3 @@ $lang['userscope'] = 'Limit search scope for user search'; $lang['groupscope'] = 'Limit search scope for group search'; $lang['groupkey'] = 'Group member ship from any user attribute (instead of standard AD groups) e.g. group from department or telephone number'; $lang['debug'] = 'Display additional debug information on errors'; - - -- cgit v1.2.3 From d00152be83dd30024aa5dd89b9ad9a70eb25d80f Mon Sep 17 00:00:00 2001 From: Lorenzo Radaelli Date: Sun, 24 Feb 2013 10:36:18 +0100 Subject: Italian language update --- lib/plugins/authldap/lang/it/settings.php | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 lib/plugins/authldap/lang/it/settings.php (limited to 'lib/plugins/authldap') diff --git a/lib/plugins/authldap/lang/it/settings.php b/lib/plugins/authldap/lang/it/settings.php new file mode 100644 index 000000000..10ae72f87 --- /dev/null +++ b/lib/plugins/authldap/lang/it/settings.php @@ -0,0 +1,5 @@ + Date: Sun, 24 Feb 2013 10:37:45 +0100 Subject: Simplified Chinese language update --- lib/plugins/authldap/lang/zh/settings.php | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 lib/plugins/authldap/lang/zh/settings.php (limited to 'lib/plugins/authldap') diff --git a/lib/plugins/authldap/lang/zh/settings.php b/lib/plugins/authldap/lang/zh/settings.php new file mode 100644 index 000000000..e84511b42 --- /dev/null +++ b/lib/plugins/authldap/lang/zh/settings.php @@ -0,0 +1,20 @@ + + */ +$lang['server'] = '您的 LDAP 服务器。填写主机名 (localhost) 或者完整的 URL (ldap://server.tld:389)'; +$lang['port'] = 'LDAP 服务器端口 (如果上面没有给出完整的 URL)'; +$lang['usertree'] = '何处查找用户账户。例如 ou=People, dc=server, dc=tld'; +$lang['grouptree'] = '何处查找用户组。例如 ou=Group, dc=server, dc=tld'; +$lang['userfilter'] = '用于搜索用户账户的 LDAP 筛选器。例如 (&(uid=%{user})(objectClass=posixAccount))'; +$lang['groupfilter'] = '用于搜索组的 LDAP 筛选器。例如 (&(objectClass=posixGroup)(|(gidNumber=%{gid})(memberUID=%{user})))'; +$lang['version'] = '使用的协议版本。您或许需要设置为 3'; +$lang['starttls'] = '使用 TLS 连接？'; +$lang['referrals'] = '是否允许引用 (referrals)？'; +$lang['binddn'] = '一个可选的绑定用户的 DN (如果匿名绑定不满足要求)。例如 Eg. cn=admin, dc=my, dc=home'; +$lang['bindpw'] = '上述用户的密码'; +$lang['userscope'] = '限制用户搜索的范围'; +$lang['groupscope'] = '限制组搜索的范围'; +$lang['debug'] = '有错误时显示额外的调试信息'; -- cgit v1.2.3 From 338ac38c748d94f32ca394dc604dda97ce6762e3 Mon Sep 17 00:00:00 2001 From: Andreas Gohr Date: Sun, 24 Feb 2013 10:39:52 +0100 Subject: fixed typos --- lib/plugins/authldap/lang/en/settings.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'lib/plugins/authldap') diff --git a/lib/plugins/authldap/lang/en/settings.php b/lib/plugins/authldap/lang/en/settings.php index 0bb397be5..ddedf8ae3 100644 --- a/lib/plugins/authldap/lang/en/settings.php +++ b/lib/plugins/authldap/lang/en/settings.php @@ -1,14 +1,14 @@ localhost) or full qualified URL (ldap://server.tld:389)'; $lang['port'] = 'LDAP server port if no full URL was given above'; -$lang['usertree'] = 'Where to finde the user accounts. Eg. ou=People, dc=server, dc=tld'; +$lang['usertree'] = 'Where to find the user accounts. Eg. ou=People, dc=server, dc=tld'; $lang['grouptree'] = 'Where to find the user groups. Eg. ou=Group, dc=server, dc=tld'; $lang['userfilter'] = 'LDAP filter to search for user accounts. Eg. (&(uid=%{user})(objectClass=posixAccount))'; $lang['groupfilter'] = 'LDAP filter to search for groups. Eg. (&(objectClass=posixGroup)(|(gidNumber=%{gid})(memberUID=%{user})))'; $lang['version'] = 'The protocol version to use. You may need to set this to 3'; $lang['starttls'] = 'Use TLS connections?'; $lang['referrals'] = 'Shall referrals be followed?'; -$lang['binddn'] = 'DN of an ptional bind user if anonymous bind is not sufficient. Eg. cn=admin, dc=my, dc=home'; +$lang['binddn'] = 'DN of an optional bind user if anonymous bind is not sufficient. Eg. cn=admin, dc=my, dc=home'; $lang['bindpw'] = 'Password of above user'; $lang['userscope'] = 'Limit search scope for user search'; $lang['groupscope'] = 'Limit search scope for group search'; -- cgit v1.2.3