Compare commits

..

14 Commits

Author SHA1 Message Date
9550a4fd2f Update 'plugin.php' 2023-04-12 12:00:04 +02:00
bda3ae89e8 fix logout bug 2023-04-12 11:51:00 +02:00
df71c15e63 remove unused parameter 2023-03-16 18:25:35 +01:00
fd049a8928 Some syntax adjustments to make ldap_bind work 2023-03-16 18:25:13 +01:00
Matt Visnovsky
5d85267e0f YOURLS version 1.8.1
Updated so this plugin functions with latest YOURLS version
2021-05-24 15:23:26 -06:00
K3A
d60ea0e6aa
Merge pull request #26 from markkrj/add-ldap-filter
Allow users to define advanced LDAP search filters.
2021-04-28 21:22:56 +00:00
Marcos de Oliveira
c7a35f3ea9 Allow users to define advanced LDAP search filters. 2021-04-22 16:54:26 -03:00
Mario Hros
412c079b03 fix php warning
yourls_get_option default value is false unless other default is specified
2020-08-05 13:49:26 +02:00
K3A
c4ad990ab2
Fix ldapauth_authorized_admins logic
ldapauth_is_valid_user must return boolean type. Thanks @pjaydev
2019-10-29 17:56:16 +00:00
K3A
2a3cb0334b
Merge pull request #21 from paje/patch-2
Empty to Not defined for constant LDAPAUTH_USERCACHE_TYPE
2018-06-22 22:57:02 +02:00
Patrice Eber
2f6aa596fe
Empty to Not defined for constants 2018-06-18 15:52:48 +02:00
K3A
f562a093f8
Update plugin.php
null check fix
2018-02-01 20:51:27 +01:00
K3A
692cffa9af
Merge pull request #18 from k3a/patch-1
Fix unsupported driect $ydb access for config
2018-01-29 21:29:56 +01:00
K3A
9809addc2e
Merge pull request #16 from hedrickbt/master
Added Active Directory LDAP hostname lookup
2018-01-29 21:08:36 +01:00
2 changed files with 78 additions and 101 deletions

View File

@ -23,32 +23,40 @@ yourls-ldap-plugin by default will now implement a simple cache of LDAP users. A
Configuration
-------------
* define( 'LDAPAUTH_HOST', 'ldaps://ldap.domain.com' ); // LDAP host name, IP or URL. You can use ldaps://host for LDAP with TLS
* define( 'LDAPAUTH_PORT', '636' ); // LDAP server port - often 389 or 636 for TLS (LDAPS)
* define( 'LDAPAUTH_HOST', 'ldaps://ldap.domain.com:636' ); // LDAP host name, IP or URL. You can use ldaps://host for LDAP with TLS
* define( 'LDAPAUTH_BASE', 'dc=domain,dc=com' ); // Base DN (location of users)
* define( 'LDAPAUTH_USERNAME_FIELD', 'uid'); // (optional) LDAP field name in which username is store
To use a privileged account for the user search:
### To use a privileged account for the user search:
* define( 'LDAPAUTH_SEARCH_USER', 'cn=your-user,dc=domain,dc=com' ); // (optional) Privileged user to search with
* define( 'LDAPAUTH_SEARCH_PASS', 'the-pass'); // (optional) (only if LDAPAUTH_SEARCH_USER set) Privileged user pass
To define a template to bind using the current user for the search: Use %s as the place holder for the current user name
### To define a template to bind using the current user for the search: Use %s as the place holder for the current user name
* define( 'LDAPAUTH_BIND_WITH_USER_TEMPLATE', '%s@myad.domain' ); // (optional) Use %s as the place holder for the current user name
To check group membership before authenticating:
### To use a custom LDAP search filter:
* define( 'LDAPAUTH_SEARCH_FILTER', '(&(samaccountname=%s)(memberof=YOURLS-ADMINS,OU=Groups,DC=example,DC=com))' ); // Use %s as the place holder for the current user name
If this option is not set, filter is based only on LDAPAUTH_USERNAME_FIELD (default).
This is useful if more advanced filter is needed. Like when using AD nested groups.
For searching based on AD Nested group `LDAP_MATCHING_RULE_IN_CHAIN` OID (1.2.840.113556.1.4.1941) must be specified for user's memberof attribute.
Example of filter based on AD nested group:
`define( 'LDAPAUTH_SEARCH_FILTER', '(&(samaccountname=%s)(memberof:1.2.840.113556.1.4.1941:=YOURLS-ADMINS,OU=Groups,DC=example,DC=com))' );`
### To check group membership before authenticating:
* define( 'LDAPAUTH_GROUP_ATTR', 'memberof' ); // (optional) LDAP groups attr
* define( 'LDAPAUTH_GROUP_REQ', 'the-group;another-admin-group'); // (only if LDAPAUTH_GROUP_REQ set) Group/s user must be in. Allows multiple, semicolon delimited
To define the scope of group req search:
### To define the scope of group req search:
* define( 'LDAPAUTH_GROUP_SCOP', 'sub' ); // if not defined the default is 'sub', and will check for the user in all the subtree. The other option is 'base', that will search only members of the exactly req
To define the type of user cache used:
### To define the type of user cache used:
* define( 'LDAPAUTH_USERCACHE_TYPE', 0); // (optional) Defaults to 1, which caches users in the options table. 0 turns off cacheing. Other values are currently undefined, but may be one day
To automatically add LDAP users to config.php:
### To automatically add LDAP users to config.php:
* define( 'LDAPAUTH_ADD_NEW', true ); // (optional) Add LDAP users to config.php
To use Active Directory Sites and Services DNS entry for LDAP server name lookup
### To use Active Directory Sites and Services DNS entry for LDAP server name lookup
* define( 'LDAPAUTH_DNS_SITES_AND_SERVICES', '_ldap._tcp.corporate._sites.yourdomain.com' ); // If using Active Directory, with multiple Domain Controllers, the safe way to use DNS to look up your active LDAP server names. If set, it will be used to override the hostname portion of LDAPAUTH_HOST.
* define( 'LDAPAUTH_HOST', 'ldap://'); // LDAP protocol without hostname. You can use 'ldaps://' for LDAP with TLS.

View File

@ -4,20 +4,18 @@ Plugin Name: Simple LDAP Auth
Plugin URI:
Description: This plugin enables use of LDAP provider for authentication
Version: 1.1
Author: k3a
Author URI: http://k3a.me
Author: vmario
Author URI: https://gitea.fablabchemnitz.de/vmario/yourls-ldap-auth
*/
// Thanks to nicwaller (https://github.com/nicwaller) for cas plugin I used as a reference!
// No direct call
if( !defined( 'YOURLS_ABSPATH' ) ) die();
// returns true if the environment is set up right
function ldapauth_environment_check() {
$required_params = array(
'LDAPAUTH_HOST', // ldap host
//'LDAPAUTH_PORT', // ldap port
'LDAPAUTH_BASE', // base ldap path
//'LDAPAUTH_USERNAME_FIELD', // field to check the username against
);
@ -30,9 +28,6 @@ function ldapauth_environment_check() {
}
}
if ( !defined( 'LDAPAUTH_PORT' ) )
define( 'LDAPAUTH_PORT', 389 );
if ( !defined( 'LDAPAUTH_USERNAME_FIELD' ) )
define( 'LDAPAUTH_USERNAME_FIELD', 'uid' );
@ -44,7 +39,6 @@ function ldapauth_environment_check() {
if ( !defined( 'LDAPAUTH_USERCACHE_TYPE' ) )
define( 'LDAPAUTH_USERCACHE_TYPE', 1 );
global $ldapauth_authorized_admins;
if ( !isset( $ldapauth_authorized_admins ) ) {
@ -57,68 +51,25 @@ function ldapauth_environment_check() {
return true;
}
# Reroute login to yourls filter
# (see https://github.com/YOURLS/YOURLS/wiki/Advanced-Hook-Syntax)
yourls_add_filter( 'is_valid_user', 'ldapauth_is_valid_user' );
function ldapauth_shuffle_assoc($list) {
if (!is_array($list)) return $list;
if (!is_array($list)) return $list;
$keys = array_keys($list);
shuffle($keys);
$random = array();
foreach ($keys as $key) {
$random[$key] = $list[$key];
}
return $random;
}
// return list of Active Directory Ldap servers that are associated with a site and service
// example for $site = = '_ldap._tcp.corporate._sites.company.com'
function ldapauth_get_ad_servers_for_site() {
$results = [];
$ad_servers = dns_get_record(LDAPAUTH_DNS_SITES_AND_SERVICES, DNS_SRV, $authns, $addtl);
foreach ($ad_servers as $ad_server) {
array_push($results, $ad_server['target']);
}
$results = ldapauth_shuffle_assoc($results); #randomize the order
return $results;
}
// returns ldap connection
function ldapauth_get_ldap_connection() {
if (defined('LDAPAUTH_DNS_SITES_AND_SERVICES')) {
$connection = NULL;
$ldap_servers = ldapauth_get_ad_servers_for_site();
foreach ($ldap_servers as $ldap_server) {
$ldap_address = LDAPAUTH_HOST . $ldap_server;
try {
$temp_conn = ldap_connect($ldap_address, LDAPAUTH_PORT); # ldap_connect doesn't actually connect it just checks for plausiable parameters. Only ldap_bind connects
if ($temp_conn) {
$connection = $temp_conn;
break;
} else {
error_log('Warning, unable to connect to: ' . $ldap_address . ' on port ' . LDAPAUTH_PORT . '. ' . ldap_error($temp_conn));
}
} catch (Exception $e) {
error_log('Warning, unable to connect to: ' . $ldap_address . ' on port ' . LDAPAUTH_PORT . '. ' . __FILE__, __FUNCTION__,$e->getMessage());
}
}
if ($connection) {
return $connection;
} else {
die("Cannot connect to LDAP for site and service " . LDAPAUTH_DNS_SITES_AND_SERVICES);
}
} else {
return ldap_connect(LDAPAUTH_HOST, LDAPAUTH_PORT);
}
$keys = array_keys($list);
shuffle($keys);
$random = array();
foreach ($keys as $key) {
$random[$key] = $list[$key];
}
return $random;
}
// returns true/false
function ldapauth_is_valid_user( $value ) {
global $yourls_user_passwords;
// Always check & set early
if ( !ldapauth_environment_check() ) {
die( 'Invalid configuration for YOURLS LDAP plugin. Check PHP error log.' );
@ -135,32 +86,34 @@ function ldapauth_is_valid_user( $value ) {
}
// session is only needed if we don't use usercache
if (empty(LDAPAUTH_USERCACHE_TYPE)) {
if (!defined(LDAPAUTH_USERCACHE_TYPE)) {
@session_start();
}
if ( empty(LDAPAUTH_USERCACHE_TYPE) && isset( $_SESSION['LDAPAUTH_AUTH_USER'] ) ) {
if (!defined(LDAPAUTH_USERCACHE_TYPE) && isset( $_SESSION['LDAPAUTH_AUTH_USER'] ) ) {
// already authenticated...
$username = $_SESSION['LDAPAUTH_AUTH_USER'];
// why is this checked here, but not before the cookie is set?
if ( ldapauth_is_authorized_user( $username ) ) {
if( !isset($yourls_user_passwords[$username]) ) {
// set a dummy password to work around the "Stealing cookies" problem
// we prepend with 'phpass:' to avoid YOURLS trying to auto-encrypt it and
// write it to user/config.php
ldapauth_debug('Setting dummy entry in $yourls_user_passwords for user ' . $username);
$yourls_user_passwords[$username]='phpass:ThereIsNoPasswordButHey,WhoCares?';
}
if( !isset($yourls_user_passwords[$username]) ) {
// set a dummy password to work around the "Stealing cookies" problem
// we prepend with 'phpass:' to avoid YOURLS trying to auto-encrypt it and
// write it to user/config.php
ldapauth_debug('Setting dummy entry in $yourls_user_passwords for user ' . $username);
$yourls_user_passwords[$username]='phpass:ThereIsNoPasswordButHey,WhoCares?';
}
yourls_set_user( $_SESSION['LDAPAUTH_AUTH_USER'] );
return true;
return true;
} else {
return $username.' is not admin user.';
ldapauth_debug($username . ' is not admin user.');
return $value;
}
} else if ( isset( $_REQUEST['username'] ) && isset( $_REQUEST['password'] )
&& !empty( $_REQUEST['username'] ) && !empty( $_REQUEST['password'] ) ) {
// try to authenticate
$ldapConnection = ldapauth_get_ldap_connection();
$ldapConnection = ldap_connect(LDAPAUTH_HOST);
if (!$ldapConnection) die("Cannot connect to LDAP " . LDAPAUTH_HOST);
ldap_set_option($ldapConnection, LDAP_OPT_PROTOCOL_VERSION, 3);
//ldap_set_option($ldapConnection, LDAP_OPT_REFERRALS, 0);
@ -173,7 +126,6 @@ function ldapauth_is_valid_user( $value ) {
return $value;
}
}
// Check if using a privileged user account to search - only if not already bound with current user
if (defined('LDAPAUTH_SEARCH_USER') && defined('LDAPAUTH_SEARCH_PASS') && empty($ldapSuccess)) {
if (!@ldap_bind($ldapConnection, LDAPAUTH_SEARCH_USER, LDAPAUTH_SEARCH_PASS)) {
@ -181,21 +133,28 @@ function ldapauth_is_valid_user( $value ) {
}
}
// Check if using LDAP Filter, otherwise, filter by LDAPAUTH_USERNAME_FIELD only.
if ( !defined('LDAPAUTH_SEARCH_FILTER') ){
$ldapFilter = LDAPAUTH_USERNAME_FIELD . "=" . $_REQUEST['username'];
} else {
$ldapFilter = sprintf(LDAPAUTH_SEARCH_FILTER, $_REQUEST['username']);
}
// Limit the attrs to the ones we need
$attrs = array('dn', LDAPAUTH_USERNAME_FIELD);
if (defined('LDAPAUTH_GROUP_ATTR'))
array_push($attrs, LDAPAUTH_GROUP_ATTR);
$searchDn = ldap_search($ldapConnection, LDAPAUTH_BASE, LDAPAUTH_USERNAME_FIELD . "=" . $_REQUEST['username'], $attrs );
$searchDn = ldap_search($ldapConnection, LDAPAUTH_BASE, $ldapFilter, $attrs );
if (!$searchDn) return $value;
$searchResult = ldap_get_entries($ldapConnection, $searchDn);
if (!$searchResult) return $value;
$userDn = $searchResult[0]['dn'];
if (!$userDn && !$ldapSuccess) return $value;
if (empty($ldapSuccess)) { // we don't need to do this if we already bound using username and LDAPAUTH_BIND_WITH_USER_TEMPLATE
$ldapSuccess = @ldap_bind($ldapConnection, $userDn, $_REQUEST['password']);
$ldapSuccess = @ldap_bind($ldapConnection, $userDn, $_REQUEST['password']);
}
// success?
if ($ldapSuccess)
{
@ -207,7 +166,7 @@ function ldapauth_is_valid_user( $value ) {
$groups_to_check = explode(";", strtolower(LDAPAUTH_GROUP_REQ)); // This is now an array
foreach($searchResult[0][LDAPAUTH_GROUP_ATTR] as $grps) {
if (in_array(strtolower($grps), $groups_to_check)) { $in_group = true; break; }
if (in_array(strtolower($grps), $groups_to_check)) { $in_group = true; break; }
}
if (!$in_group) die('Not in admin group');
@ -220,7 +179,6 @@ function ldapauth_is_valid_user( $value ) {
if (LDAPAUTH_ADD_NEW && !array_key_exists($username, $yourls_user_passwords)) {
ldapauth_create_user( $username, $_REQUEST['password'] );
}
if (LDAPAUTH_USERCACHE_TYPE == 1) {
// store the current user credentials in our cache. This cuts down calls to the LDAP
// server, and allows API keys to work with LDAP users
@ -229,10 +187,11 @@ function ldapauth_is_valid_user( $value ) {
}
$yourls_user_passwords[$username] = ldapauth_hash_password($_REQUEST['password']);
if (empty(LDAPAUTH_USERCACHE_TYPE)) {
if (!defined(LDAPAUTH_USERCACHE_TYPE)) {
$_SESSION['LDAPAUTH_AUTH_USER'] = $username;
}
return true;
ldapauth_debug("User $username was successfully authenticated");
} else {
error_log("No LDAP success");
}
@ -252,8 +211,8 @@ function ldapauth_is_authorized_user( $username ) {
global $ldapauth_authorized_admins;
if ( in_array( $username, $ldapauth_authorized_admins ) ) {
return true;
}
}
// not an admin user
return false;
}
@ -261,9 +220,9 @@ function ldapauth_is_authorized_user( $username ) {
yourls_add_action( 'logout', 'ldapauth_logout_hook' );
function ldapauth_logout_hook( $args ) {
if (empty(LDAPAUTH_USERCACHE_TYPE)) {
unset($_SESSION['LDAPAUTH_AUTH_USER']);
setcookie('PHPSESSID', '', 0, '/');
if (!defined(LDAPAUTH_USERCACHE_TYPE)) {
unset($_SESSION['LDAPAUTH_AUTH_USER']);
setcookie('PHPSESSID', '', 0, '/');
}
}
@ -274,15 +233,18 @@ function ldapauth_logout_hook( $args ) {
* their LDAP passwords
*/
yourls_add_action ('plugins_loaded', 'ldapauth_merge_users');
yourls_add_action('plugins_loaded', 'ldapauth_merge_users');
function ldapauth_merge_users() {
global $yourls_user_passwords;
if ( !ldapauth_environment_check() ) {
die( 'Invalid configuration for YOURLS LDAP plugin. Check PHP error log.' );
}
if(LDAPAUTH_USERCACHE_TYPE==1 && isset(yourls_get_option('ldapauth_usercache'))) {
if(LDAPAUTH_USERCACHE_TYPE==1 && false !== yourls_get_option('ldapauth_usercache')) {
ldapauth_debug("Merging text file users and cached LDAP users");
//print_r($yourls_user_passwords) . "<br>";
$yourls_user_passwords = array_merge($yourls_user_passwords, yourls_get_option('ldapauth_usercache'));
//print_r($yourls_user_passwords) . "<br>";
//die('Paused');
}
}
/**
@ -290,7 +252,7 @@ function ldapauth_merge_users() {
* Code reused from yourls_hash_passwords_now()
*/
function ldapauth_create_user( $user, $new_password ) {
$configdata = file_get_contents( YOURLS_CONFIGFILE );
$configdata = htmlspecialchars(file_get_contents( YOURLS_CONFIGFILE ));
if ( $configdata == FALSE ) {
die('Couldn\'t read the config file');
}
@ -299,10 +261,17 @@ function ldapauth_create_user( $user, $new_password ) {
die('Can\'t write to config file');
$pass_hash = ldapauth_hash_password($new_password);
$user_line = "\t'$user' => 'phpass:$pass_hash' /* Password encrypted by YOURLS */,";
$user_line = "\t'$user' => 'phpass:$pass_hash' /* LDAP user added by plugin */,";
// Add the user on a new line after the start of the passwords array
$new_contents = preg_replace('/(yourls_user_passwords\s=\sarray\()/', '$0 ' . PHP_EOL . $user_line, $configdata, -1, $count);
$new_contents = preg_replace('/\$yourls_user_passwords\s=\s\[/', '$0 ' . PHP_EOL . $user_line, $configdata, -1, $count);
//echo YOURLS_CONFIGFILE . "<br>";
//echo $configdata . "<br>";
//echo $user_line . "<br>";
//echo $user . "<br>";
//echo htmlspecialchars_decode($new_contents) . "<br>";
//echo $count . "<br>";
//die('Paused');
if ($count === 0) {
die('Couldn\'t add user, plugin may not be compatible with YourLS version');
@ -310,7 +279,7 @@ function ldapauth_create_user( $user, $new_password ) {
die('Added user more than once. Check config file.');
}
$success = file_put_contents( YOURLS_CONFIGFILE, $new_contents );
$success = file_put_contents( YOURLS_CONFIGFILE, htmlspecialchars_decode($new_contents) );
if ( $success === false ) {
die('Unable to save config file');
}