The process of authentication starts by establishing an anonymous connection to the LDAP directory and looking up for the user on it. Once this user is found, LDAP authentication is performed on them.
However, some LDAP configurations (specially common in Active Directory setups) restrict anonymous searches.
If your LDAP setup does not allow anonymous searches, or these are restricted in such a way that login names for users cannot be retrieved as a result of them, then you have to specify here a DN//password pair that will be used for these searches.
For security reasons, this pair should belong to an LDAP account with stripped down permissions.
"Test" tries authentication with the saved DN and password and prints the result.
'), '#collapsible' => TRUE, - '#collapsed' => TRUE + '#collapsed' => TRUE, + ); + + if ($edit['binddn'] == 'user') { + $userbind = TRUE; + $binddn = ''; + } + else { + $userbind = FALSE; + $binddn = $edit['binddn']; + } + + $form['advanced']['userbind'] = array( + '#type' => 'checkbox', + '#title' => t('Use credentials of user logging in for non-anonymous search'), + '#default_value' => $userbind, ); + $form['advanced']['binddn'] = array( '#type' => 'textfield', '#title' => t('DN for non-anonymous search'), - '#default_value' => $edit['binddn'], + '#default_value' => $binddn, '#size' => 50, '#maxlength' => 255, ); + if (!$edit['bindpw']) { $form['advanced']['bindpw'] = array( '#type' => 'password', @@ -342,7 +344,7 @@ function ldapauth_admin_form(&$form_stat // Give an option to clear the password. $form['advanced']['bindpw_clear'] = array( '#type' => 'checkbox', - '#title' => t('Clear current password'), + '#title' => t('Clear current password and change DN'), '#default_value' => FALSE, ); } @@ -365,9 +367,11 @@ function ldapauth_admin_form(&$form_stat function ldapauth_admin_form_validate($form, &$form_state) { $values = $form_state['values']; - if (!isset($values['sid'])) { - if (db_fetch_object(db_query("SELECT name FROM {ldapauth} WHERE name = '%s'", $values['name']))) { - form_set_error('name', t('An LDAP config with the name %name already exists.', array('%name' => $values['name']))); + if(!isset($values['sid'])) { + $server = ldapauth_get_server($values['name']); + if($server['sid']) { + form_set_error('name', t('An LDAP config with the name %name already exists.' + , array('%name' => $values['name']))); } } if (!is_numeric($values['port'])) { @@ -381,27 +385,18 @@ function ldapauth_admin_form_validate($f function ldapauth_admin_form_submit($form, &$form_state) { $op = $form_state['clicked_button']['#value']; $values = $form_state['values']; + /* If user credentials will be used to bind, set binddn to 'user' */ + if ($values['userbind']) { + $values['binddn'] = 'user'; + } switch ($op) { case t('Save configuration'): if (!isset($values['sid'])) { - db_query("INSERT INTO {ldapauth} (name, status, server, port, tls, encrypted, basedn, user_attr, mail_attr, binddn, bindpw, login_php, filter_php) VALUES ('%s', %d, '%s', %d, %d, %d, '%s', '%s', '%s', '%s', '%s', '%s', '%s')", $values['name'], 1, $values['server'], $values['port'], $values['tls'], $values['encrypted'], $values['basedn'], trim($values['user_attr']), trim($values['mail_attr']), $values['binddn'], $values['bindpw'], trim($values['login_php']), trim($values['filter_php'])); - drupal_set_message(t('LDAP configuration %name has been added.', array('%name' => $values['name']))); - watchdog('ldapauth', 'LDAP configuration %name has been added.', array('%name' => $values['name'])); + ldapauth_insert_server($values); } else { - if (isset($values['bindpw_clear'])) { - db_query("UPDATE {ldapauth} SET name = '%s', server = '%s', port = %d, tls = %d, encrypted = %d, basedn = '%s', user_attr = '%s', mail_attr = '%s', binddn = '%s', login_php = '%s', filter_php = '%s' WHERE sid = %d", $values['name'], $values['server'], $values['port'], $values['tls'], $values['encrypted'], $values['basedn'], trim($values['user_attr']), trim($values['mail_attr']), $values['binddn'], trim($values['login_php']), trim($values['filter_php']), $values['sid']); - if ($values['bindpw_clear']) { - db_query("UPDATE {ldapauth} SET bindpw = '' WHERE sid = %d", $values['sid']); - } - } - else { - db_query("UPDATE {ldapauth} SET name = '%s', server = '%s', port = %d, tls = %d, encrypted = %d, basedn = '%s', user_attr = '%s', mail_attr = '%s', binddn = '%s', bindpw = '%s', login_php = '%s', filter_php = '%s' WHERE sid = %d", $values['name'], $values['server'], $values['port'], $values['tls'], $values['encrypted'], $values['basedn'], trim($values['user_attr']), trim($values['mail_attr']), $values['binddn'], $values['bindpw'], trim($values['login_php']), trim($values['filter_php']), $values['sid']); - } - drupal_set_message(t('LDAP Configuration %name has been updated.', array('%name' => $values['name']))); - watchdog('ldapauth', 'LDAP Configuration %name has been updated.', array('%name' => $values['name'])); + ldapauth_update_server($values); } - $form_state['redirect'] = 'admin/settings/ldap/ldapauth/list'; break; case t('Test'): @@ -411,10 +406,12 @@ function ldapauth_admin_form_submit($for $dn = $_ldapauth_ldap->getOption('binddn'); $pass = $_ldapauth_ldap->getOption('bindpw'); if (!$_ldapauth_ldap->connect($dn, $pass)) { - drupal_set_message(t('Authentication with the LDAP server for the dn %dn and saved password failed.', array('%dn' => $dn)), 'error'); + drupal_set_message(t('Authentication with the LDAP server for the dn %dn and saved password failed.' + , array('%dn' => $dn)), 'error'); } else { - drupal_set_message(t('Authentication with the LDAP server for the dn %dn and saved password succeeded.', array('%dn' => $dn))); + drupal_set_message(t('Authentication with the LDAP server for the dn %dn and saved password succeeded.' + , array('%dn' => $dn))); } } else { @@ -430,14 +427,10 @@ function ldapauth_admin_form_submit($for * @param $sid * A LDAP server ID. * - * @return */ function ldapauth_admin_deactivate($sid) { - $result = db_query("SELECT name from {ldapauth} WHERE sid = %d", $sid); - if ($row = db_fetch_object($result)) { - db_query("UPDATE {ldapauth} SET status = '0' WHERE sid = %d", $sid); - drupal_set_message(t('LDAP Configuration %name has been de-activated.', array('%name' => $row->name))); - watchdog('ldapauth', 'LDAP server %name was de-activated.', array('%name' => $row->name)); + if (ldapauth_get_server_name($sid)) { + ldapauth_update_server_status($sid, 0); } drupal_goto('admin/settings/ldap/ldapauth/list'); } @@ -448,14 +441,10 @@ function ldapauth_admin_deactivate($sid) * @param $sid * A LDAP server ID. * - * @return */ function ldapauth_admin_activate($sid) { - $result = db_query("SELECT name from {ldapauth} WHERE sid = %d", $sid); - if ($row = db_fetch_object($result)) { - db_query("UPDATE {ldapauth} SET status = '1' WHERE sid = %d", $sid); - drupal_set_message(t('LDAP Configuration %name has been activated.', array('%name' => $row->name))); - watchdog('ldapauth', 'LDAP server %name was activated.', array('%name' => $row->name)); + if (ldapauth_get_server_name($sid)) { + ldapauth_update_server_status($sid, 1); } drupal_goto('admin/settings/ldap/ldapauth/list'); } @@ -472,20 +461,17 @@ function ldapauth_admin_activate($sid) { * The form structure. */ function ldapauth_admin_delete(&$form_state, $sid) { - if ($row = db_fetch_object(db_query("SELECT name FROM {ldapauth} WHERE sid = %d", $sid))) { - $form['sid'] = array( - '#type' => 'hidden', - '#value' => $sid, - ); - $form['name'] = array( - '#type' => 'hidden', - '#value' => $row->name, + if (is_numeric($sid) && ($name = ldapauth_get_server_name($sid))) { + $form = array( + 'sid' => array('#type' => 'hidden', '#value' => $sid), + 'name' => array('#type' => 'hidden', '#value' => $name), ); return confirm_form( $form, - t('Are you sure you want to delete the LDAP server named %name?', array('%name' => $row->name)), + t('Are you sure you want to delete the LDAP server named %name?' + , array('%name' => $name)), 'admin/settings/ldap/ldapauth/list', - t('This action cannot be undone.
'), + t('This action cannot be undone
'), t('Delete'), t('Cancel') ); @@ -499,9 +485,7 @@ function ldapauth_admin_delete(&$form_st function ldapauth_admin_delete_submit($form, &$form_state) { $values = $form_state['values']; if ($values['confirm'] && $values['sid']) { - db_query("DELETE FROM {ldapauth} WHERE sid = %d", $values['sid']); - drupal_set_message(t('LDAP Configuration %name has been deleted.', array('%name' => $values['name']))); - watchdog('ldapauth', 'LDAP Configuration %name has been deleted.', array('%name' => $values['name'])); + ldapauth_delete_server($values['sid']); } } @@ -514,4 +498,3 @@ function ldapauth_admin_delete_submit($f function ldapauth_admin_menu_block_page() { return theme('admin_block_content', system_admin_menu_block(menu_get_item())); } - diff -upN ldap_integration_dev/ldapauth.db.inc ldap_integration/ldapauth.db.inc --- ldap_integration_dev/ldapauth.db.inc 1969-12-31 19:00:00.000000000 -0500 +++ ldap_integration/ldapauth.db.inc 2010-04-23 11:10:39.000000000 -0400 @@ -0,0 +1,435 @@ +ldapgroups_in_attr = ldapauth_unserialize($ret->ldapgroups_in_attr); + $ret->ldapgroups_entries = ldapauth_unserialize($ret->ldapgroups_entries); + $ret->ldapgroups_groups = ldapauth_unserialize($ret->ldapgroups_groups); + $ret->ldapgroups_mappings = ldapauth_unserialize($ret->ldapgroups_mappings); + } + else { + $ret = db_fetch_array($query); + $ret['ldapgroups_in_attr'] = ldapauth_unserialize($ret['ldapgroups_in_attr']); + $ret['ldapgroups_entries'] = ldapauth_unserialize($ret['ldapgroups_entries']); + $ret['ldapgroups_groups'] = ldapauth_unserialize($ret['ldapgroups_groups']); + $ret['ldapgroups_mappings'] = ldapauth_unserialize($ret['ldapgroups_mappings']); + } + + if (!$ret && !object) { + $ret = array( + 'name' => '', + 'server' => '', + 'port' => '389', + 'tls' => 0, + 'encrypted' => 0, + 'basedn' => '', + 'user_attr' => LDAPAUTH_DEFAULT_USER_ATTR, + 'mail_attr' => LDAPAUTH_DEFAULT_MAIL_ATTR, + 'binddn' => '', + 'bindpw' => FALSE, + 'login_php' => '', + 'filter_php' => '', + ); + } + return $ret; +} + +/** + * Insert a new server record + * @param values: server array + */ +function ldapauth_insert_server($values) { + db_query(" + INSERT INTO {ldapauth} ( + name + , status + , server + , port + , tls + , encrypted + , basedn + , user_attr + , mail_attr + , binddn + , bindpw + , login_php + , filter_php) + VALUES ( + '%s' + , %d + , '%s' + , %d + , %d + , %d + , '%s' + , '%s' + , '%s' + , '%s' + , '%s' + , '%s' + , '%s')" + , $values['name'] + , 1 + , $values['server'] + , $values['port'] + , $values['tls'] + , $values['encrypted'] + , $values['basedn'] + , trim($values['user_attr']) + , trim($values['mail_attr']) + , $values['binddn'] + , $values['bindpw'] + , trim($values['login_php']) + , trim($values['filter_php'] + ) + ); + drupal_set_message(t('LDAP configuration %name has been added.', array('%name' => $values['name']))); + watchdog('ldapauth', 'LDAP configuration %name has been added.', array('%name' => $values['name'])); +} + +/** + * Change a server's weight + * @param sid: server ID + * @param weight: new weight + */ +function ldapauth_update_server_weight($sid, $weight) { + db_query("UPDATE {ldapauth} SET weight = %d WHERE sid = %d", $weight, $sid); +} + +/** + * Update a server + * @param values: server array + */ +function ldapauth_update_server($values) { + if (isset($values['bindpw_clear'])) { + db_query(" + UPDATE {ldapauth} + SET name = '%s' + , server = '%s' + , port = %d + , tls = %d + , encrypted = %d + , basedn = '%s' + , user_attr = '%s' + , mail_attr = '%s' + , login_php = '%s' + , filter_php = '%s' + WHERE sid = %d" + , $values['name'] + , $values['server'] + , $values['port'] + , $values['tls'] + , $values['encrypted'] + , $values['basedn'] + , trim($values['user_attr']) + , trim($values['mail_attr']) + , trim($values['login_php']) + , trim($values['filter_php']) + , $values['sid'] + ); + if ($values['bindpw_clear']) { + db_query("UPDATE {ldapauth} SET bindpw = '' WHERE sid = %d", $values['sid']); + } + } + else { + db_query(" + UPDATE {ldapauth} + SET name = '%s' + , server = '%s' + , port = %d + , tls = %d + , encrypted = %d + , basedn = '%s' + , user_attr = '%s' + , mail_attr = '%s' + , binddn = '%s' + , bindpw = '%s' + , login_php = '%s' + , filter_php = '%s' + WHERE sid = %d" + , $values['name'] + , $values['server'] + , $values['port'] + , $values['tls'] + , $values['encrypted'] + , $values['basedn'] + , trim($values['user_attr']) + , trim($values['mail_attr']) + , $values['binddn'] + , $values['bindpw'] + , trim($values['login_php']) + , trim($values['filter_php']) + , $values['sid'] + ); + } + drupal_set_message(t('LDAP Configuration %name has been updated.', array('%name' => $values['name']))); + watchdog('ldapauth', 'LDAP Configuration %name has been updated.', array('%name' => $values['name'])); +} + +/** + * Change a server's status + * @param sid: server ID + * @param status: 0 for inactive, 1 for active + */ +function ldapauth_update_server_status($sid, $status = '0') { + $name = ldapauth_get_server_name($sid); + db_query("UPDATE {ldapauth} SET status = '%s' WHERE sid = %d", $status, $sid); + if ($status) + $msg = 'activated'; + else + $msg = 'de-activated'; + drupal_set_message(t('LDAP Configuration %name has been %status.', array('%name' => $name, '%status' => $msg))); + watchdog('ldapauth', 'LDAP server %name was %status.', array('%name' => $name, '%status' => $msg)); +} + +/** + * Delete a server + * @param sid: server ID + */ +function ldapauth_delete_server($sid) { + $name = ldapauth_get_server_name($sid); + db_query("DELETE FROM {ldapauth} WHERE sid = %d", $sid); + drupal_set_message(t('LDAP Configuration %name has been deleted.', array('%name' => $name))); + watchdog('ldapauth', 'LDAP Configuration %name has been deleted.', array('%name' => $name)); +} + +function ldapauth_unserialize($a) { + return empty($a) ? array() : unserialize($a); +} + +function ldapauth_serialize($s, $delim = '') { + if (is_array($s)) { + $ret = $s; + } + else { + $ret = array(); + foreach ((trim($s) ? explode("\n", trim($s)) : array()) as $line) { + if (trim($line)) { + if ($delim) { + $tmp = explode($delim, trim($line)); + $ret[$tmp[0]] = $tmp[1]; + } + else { + $ret[] = trim($line); + } + } + } + } + return !empty($ret) ? serialize($ret) : ''; +} + +/** + * Update the ldapgroup settins for a server + * @param values: array of settings + */ +function ldapgroups_update_server($values) { + + db_query(" + UPDATE {ldapauth} + SET ldapgroups_in_dn = %d + , ldapgroups_dn_attribute = '%s' + , ldapgroups_in_attr = %d + , ldapgroups_attr = '%s' + , ldapgroups_as_entries = %d + , ldapgroups_entries = '%s' + , ldapgroups_entries_attribute = '%s' + , ldapgroups_mappings = '%s' + , ldapgroups_mappings_filter = %d + , ldapgroups_filter_php = '%s' + , ldapgroups_groups = '%s' + WHERE sid = %d" + , $values['ldapgroups_in_dn'] + , trim($values['ldapgroups_dn_attribute']) + , $values['ldapgroups_in_attr'] + , ldapauth_serialize($values['ldapgroups_attr']) + , $values['ldapgroups_as_entries'] + , ldapauth_serialize($values['ldapgroups_entries']) + , trim($values['ldapgroups_entries_attribute']) + , ldapauth_serialize($values['ldapgroups_mappings'], '|') + , $values['ldapgroups_mappings_filter'] + , trim($values['ldapgroups_filter_php']) + , ldapauth_serialize($values['ldapgroups_groups']) + , $values['sid'] + ); + drupal_set_message(t('LDAP Group Configuration %name has been updated.', array('%name' => $values['name']))); + watchdog('ldapauth', 'LDAP Group Configuration %name has been updated.', array('%name' => $values['name'])); +} + +/** + * Reset the ldapgroups settings for a server + * @param sid: server ID + */ +function ldapgroups_reset($sid) { + db_query(" + UPDATE {ldapauth} + SET ldapgroups_in_dn = 0 + , ldapgroups_dn_attribute = '' + , ldapgroups_in_attr = 0 + , ldapgroups_attr = '' + , ldapgroups_as_entries = 0 + , ldapgroups_entries = '' + , ldapgroups_entries_attribute = '' + , ldapgroups_mappings = '' + , ldapgroups_mappings_filter = '0' + , ldapgroups_filter_php = '' + , ldapgroups_groups = '' + WHERE sid = %d", $sid + ); + drupal_set_message(t('LDAP Group Configuration %name has been reset.', array('%name' => $values['name']))); + watchdog('ldapauth', 'LDAP Group Configuration %name has been reset.', array('%name' => $values['name'])); +} + +/** + * Update the ldapdata settings for a server + * @param values: array of settings + */ +function ldapdata_update_server($values) { + + $ldapdata_attrs = array(); + $attrs = trim($values['attributes']['ldapdata_attrs']); + foreach (($attrs ? explode("\n", $attrs) : array()) as $line) { + $ldapdata_attrs += array(trim(array_shift($data)) => $data); + } + + $ldapdata_mappings['access'] = $values['ldapdata_mapping']; + if ($values['ldapdata_mapping'] >= 4) { + foreach(element_children($values) as $attr) { + if (preg_match("/ldap_amap/", $attr) && $values[$attr]) { + $ldapdata_mappings[$attr] = $values[$attr]; + } + } + } + $ldapdata_mappings = !empty($ldapdata_mappings)? serialize($ldapdata_mappings) : ''; + + $ldapdata_roattrs = isset($values['attributes']['ldapdata_roattrs']) ? + array_values(array_intersect($values['attributes']['ldapdata_roattrs'], array_keys($ldapdata_attrs))) : array(); + $ldapdata_roattrs = !empty($ldapdata_roattrs) ? serialize($ldapdata_roattrs) : ''; + + $ldapdata_rwattrs = isset($values['attributes']['ldapdata_rwattrs']) ? + array_values(array_intersect($values['attributes']['ldapdata_rwattrs'], array_keys($ldapdata_attrs))) : array(); + $ldapdata_rwattrs = !empty($ldapdata_rwattrs) ? serialize($ldapdata_rwattrs) : ''; + + $ldapdata_attrs = !empty($ldapdata_attrs) ? serialize($ldapdata_attrs) : ''; + + $ldapdata_filter_php = trim($values['attributes']['ldapdata_filter_php']); + + $ldapdata_rwattrs = empty($ldapdata_filter_php) ? $ldapdata_rwattrs : ''; + + if (!is_null($values['bindpw_clear'])) { + db_query(" + UPDATE {ldapauth} + SET ldapdata_rwattrs = '%s' + , ldapdata_roattrs = '%s' + , ldapdata_mappings = '%s' + , ldapdata_attrs = '%s' + , ldapdata_filter_php = '%s' + WHERE sid = %d" + , $ldapdata_rwattrs + , $ldapdata_roattrs + , $ldapdata_mappings + , $ldapdata_attrs + , $ldapdata_filter_php + , $sid + ); + if ($bindpw_clear) { + db_query("UPDATE {ldapauth} SET ldapdata_bindpw = '' WHERE sid = %d", $sid); + } + } + else { + db_query(" + UPDATE {ldapauth} + SET ldapdata_binddn = '%s' + , ldapdata_bindpw = '%s' + , ldapdata_rwattrs = '%s' + , ldapdata_roattrs = '%s' + , ldapdata_mappings = '%s' + , ldapdata_attrs = '%s' + , ldapdata_filter_php = '%s' + WHERE sid = %d" + , $values['ldapdata_binddn'] + , $values['ldapdata_bindpw'] + , $ldapdata_rwattrs + , $ldapdata_roattrs + , $ldapdata_mappings + , $ldapdata_attrs + , $ldapdata_filter_php + , $sid + ); + } + drupal_set_message(t('LDAP Data Configuration %name has been updated.', array('%name' => $values['name']))); + watchdog('ldapauth', 'LDAP Data Configuration %name has been updated.', array('%name' => $values['name'])); +} + +/** + * Reset the ldapdata settings for a server + * @param sid: server ID + */ +function ldapdata_reset($sid) { + db_query(" + UPDATE {ldapauth} + SET ldapdata_mappings = '' + , ldapdata_roattrs = '' + , ldapdata_rwattrs = '' + , ldapdata_binddn = '' + , ldapdata_bindpw = '' + , ldapdata_attrs = '' + , ldapdata_filter_php = '' + WHERE sid = %d", $sid + ); + drupal_set_message(t('LDAP Data Configuration %name has been reset.', array('%name' => $values['name']))); + watchdog('ldapauth', 'LDAP Data Configuration %name has been reset.', array('%name' => $values['name'])); +} diff -upN ldap_integration_dev/ldapauth.drush.inc ldap_integration/ldapauth.drush.inc --- ldap_integration_dev/ldapauth.drush.inc 1969-12-31 19:00:00.000000000 -0500 +++ ldap_integration/ldapauth.drush.inc 2010-02-26 14:44:18.000000000 -0500 @@ -0,0 +1,237 @@ + 'ldapauth_drush_add', + 'description' => dt('Add an LDAP server'), + 'arguments' => array( + 'name' => dt('Friendly name for the server'), + 'server' => dt('Address of the server'), + ), + 'options' => array( + 'port' => dt('Port number (default 389)'), + 'tls' => dt('Use Start-TLS? (default off)'), + 'basedn' => dt('Base DN'), + 'username' => dt('Username attribute'), + 'email' => dt('Email attribute'), + 'search_with_user' => dt('Use credentials of user logging in for non-anonymous search?'), + 'search_dn' => dt('DN for non-anonymous search'), + 'search_pw' => dt('Password for non-anonymous search'), + ), + ); + $items['ldap delete'] = array( + 'callback' => 'ldapauth_drush_delete', + 'description' => dt('Delete an LDAP server'), + 'arguments' => array( + 'name' => dt('Friendly name for the server'), + ), + ); + $items['ldap activate'] = array( + 'callback' => 'ldapauth_drush_activate', + 'description' => dt('Activate an LDAP server'), + 'arguments' => array( + 'name' => dt('Friendly name for the server'), + ), + ); + $items['ldap deactivate'] = array( + 'callback' => 'ldapauth_drush_deactivate', + 'description' => dt('De-activate an LDAP server'), + 'arguments' => array( + 'name' => dt('Friendly name for the server'), + ), + ); + $items['ldap mode'] = array( + 'callback' => 'ldapauth_variable_set', + 'callback arguments' => array('ldapauth_login_process'), + 'arguments' => array('mode' => 'mixed or ldaponly'), + 'description' => dt('Change authentication mode'), + ); + $items['ldap conflict'] = array( + 'callback' => 'ldapauth_variable_set', + 'callback arguments' => array('ldapauth_login_conflict'), + 'arguments' => array('mode' => 'disallow or resolve'), + 'description' => dt('Change conflict resolution policy'), + ); + $items['ldap store'] = array( + 'callback' => 'ldapauth_variable_set', + 'callback arguments' => array('ldapauth_forget_passwords'), + 'arguments' => array('mode' => 'on or off'), + 'description' => dt('Change whether to store passwords during sessions or not'), + ); + $items['ldap sync'] = array( + 'callback' => 'ldapauth_variable_set', + 'callback arguments' => array('ldapauth_sync_passwords'), + 'arguments' => array('mode' => 'on or off'), + 'description' => dt('Change whether to sync passwords with Drupal or not'), + ); + $items['ldap removepass'] = array( + 'callback' => 'ldapauth_variable_set', + 'callback arguments' => array('ldapauth_disable_pass_change'), + 'arguments' => array('mode' => 'on or off'), + 'description' => dt('Change whether to remove password change fields or not'), + ); + $items['ldap email'] = array( + 'callback' => 'ldapauth_variable_set', + 'callback arguments' => array('ldapauth_alter_email_field'), + 'arguments' => array('mode' => 'nothing or remove or disable'), + 'description' => dt('Remove or disable email field from user edit form for LDAP users'), + ); + return $items; +} + +/** + * Implementation of hook_drush_help + * @param section: the drush command we're seeking help for + * @return: A string describing the command + */ +function ldapauth_drush_help($section) { + switch($section) { + case 'drush:ldap add': + return dt('Add an LDAP server'); + case 'drush:ldap delete': + return dt('Dlete an LDAP server'); + case 'drush:ldap activate': + return dt('Activate an LDAP server'); + case 'drush:ldap delete': + return dt('De-activate an LDAP server'); + case 'drush:ldap mode': + return dt('Switch between mixed mode or LDAP only mode'); + case 'drush:ldap conflict': + return dt('Switch between disallowing conflicts or resolve conflicts by associating the local account with the LDAP entry'); + case 'drush:ldap store': + return dt('Switch between storing passwords during sessions or not'); + case 'drush:ldap sync': + return dt('Switch between syncing passwords with Drupal or not'); + case 'drush:ldap removepass': + return dt('Switch between removing password change fields or not'); + case 'drush:ldap email': + return dt('Remove or disable email field from user edit form for LDAP users'); + } +} + +/* + * Wrapper for variable set to convert command arguments to db values + * @param variable: the name of the variable in Drupal's variable table + * @param mode: the argument passed to the drush command + */ +function ldapauth_variable_set($variable, $mode) { + switch ($variable) { + case 'ldapauth_login_process': + if ($mode == 'mixed') + $mode=0; + elseif ($mode == 'ldaponly') + $mode=1; + break; + case 'ldapauth_login_conflict': + if ($mode == 'disallow') + $mode=0; + elseif ($mode == 'resolve') + $mode=1; + break; + case 'ldapauth_forget_passwords': + if ($mode == 'on') + $mode=0; + elseif ($mode == 'off') + $mode=1; + break; + case 'ldapauth_sync_passwords': + case 'ldapauth_disable_pass_change': + if ($mode == 'on') + $mode=1; + elseif ($mode == 'off') + $mode=0; + break; + case 'ldapauth_alter_email_field': + if ($mode == 'nothing') + $mode=0; + elseif ($mode == 'remove') + $mode=1; + elseif ($mode == 'disable') + $mode=2; + break; + } + if (!is_numeric($mode)) + drush_set_error('LDAPAUTH_INVALID_VARIABLE', dt('Invalid setting')); + else + variable_set($variable, $mode); +} + +/* + * Helper function to include the file containing the db functions + */ +function ldapauth_drush_include() { + $path = drupal_get_path('module', 'ldapauth'); + include_once($path . "/ldapauth.db.inc"); +} + +/* + * Add a server + * @param name: Friendly server name + * @param server: Address of the server + */ +function ldapauth_drush_add($name, $server) { + if (!$name || !$server) { + drush_set_error('LDAPAUTH_MISSING_DATA', dt('Both name and server must be specified')); + return; + } + ldapauth_drush_include(); + $values['name'] = $name; + $values['server'] = $server; + $values['port' ] = drush_get_option('port'); + if (!is_numeric($values['port'])) $values['port'] = 389; + $values['tls'] = drush_get_option('tls') ? 1 : 0; + $values['basedn'] = drush_get_option('basedn'); + $values['user_attr'] = drush_get_option('username'); + $values['mail_attr'] = drush_get_option('email'); + $values['binddn'] = drush_get_option('search_with_user') ? 'user' : drush_get_option('search_dn'); + $values['bindpw'] = drush_get_option('search_pw'); + $values['login_php'] = NULL; + $values['filter_php'] = NULL; + ldapauth_insert_server($values); +} + +/* + * Delete a server + * @param name: Friendly server name + */ +function ldapauth_drush_delete($name) { + ldapauth_drush_include(); + if (!$name || !($server = ldapauth_get_server($name))) + drush_set_error('LDAPAUTH_INVALID_SERVER', dt('Invalid server name specified')); + else + ldapauth_delete_server($server['sid']); +} + +/* + * Activate a server + * @param name: Friendly server name + */ +function ldapauth_drush_activate($name) { + ldapauth_drush_include(); + if (!$name || !($server = ldapauth_get_server($name))) + drush_set_error('LDAPAUTH_INVALID_SERVER', dt('Invalid server name specified')); + else + ldapauth_update_server_status($server['sid'], 1); +} + +/* + * De-activate a server + * @param name: Friendly server name + */ +function ldapauth_drush_deactivate($name) { + ldapauth_drush_include(); + if (!$name || !($server = ldapauth_get_server($name))) + drush_set_error('LDAPAUTH_INVALID_SERVER', dt('Invalid server name specified')); + else + ldapauth_update_server_status($server['sid']); +} diff -upN ldap_integration_dev/ldapauth.info ldap_integration/ldapauth.info --- ldap_integration_dev/ldapauth.info 2009-05-08 20:13:53.000000000 -0400 +++ ldap_integration/ldapauth.info 2010-04-23 12:17:51.000000000 -0400 @@ -1,4 +1,4 @@ -; $Id: ldapauth.info,v 1.2.4.15 2009/03/24 10:07:59 miglius Exp $ +; $Id: ldapauth.info,v 1.3 2009/02/19 16:56:16 miglius Exp $ name = Authentication description = Implements LDAP authentication. package = LDAP integration @@ -6,9 +6,9 @@ core = 6.x php = 5.0 -; Information added by drupal.org packaging script on 2009-05-09 +; Information added by drupal.org packaging script on 2009-10-27 version = "6.x-1.x-dev" core = "6.x" project = "ldap_integration" -datestamp = "1241828033" +datestamp = "1256654469" diff -upN ldap_integration_dev/ldapauth.install ldap_integration/ldapauth.install --- ldap_integration_dev/ldapauth.install 2009-05-03 17:59:12.000000000 -0400 +++ ldap_integration/ldapauth.install 2010-02-26 14:44:18.000000000 -0500 @@ -1,5 +1,5 @@ 0, ), ), - 'indexes' => array( - 'sid' => array('sid'), - ), - 'primary key' => array('name') + 'primary key' => array('sid'), + 'unique keys' => array('name' => array('name')), ); return $schema; } @@ -143,15 +141,15 @@ function ldapauth_update_6000() { function ldapauth_update_6001() { $ret = array(); - db_add_field($ret, 'ldapauth', 'login_php', array( + db_add_field($ret, 'ldapauth', 'login_php', array( 'type' => 'text', 'not null' => FALSE, )); - db_add_field($ret, 'ldapauth', 'filter_php', array( + db_add_field($ret, 'ldapauth', 'filter_php', array( 'type' => 'text', 'not null' => FALSE, )); - db_add_field($ret, 'ldapauth', 'weight', array( + db_add_field($ret, 'ldapauth', 'weight', array( 'type' => 'int', 'not null' => TRUE, 'default' => 0, @@ -159,3 +157,20 @@ function ldapauth_update_6001() { return $ret; } +function ldapauth_update_6002() { + $ret = array(); + db_change_field($ret, 'ldapauth', 'basedn', 'basedn', array( + 'type' => 'text', + )); + return $ret; +} + +function ldapauth_update_6003() { + $ret = array(); + db_drop_primary_key($ret, 'ldapauth'); + db_change_field($ret, 'ldapauth', 'sid', 'sid', array('type' => 'serial', 'size' => 'tiny', 'not null' => TRUE), array('primary key' => array('sid'))); + db_drop_index($ret, 'ldapauth', 'sid'); + db_add_unique_key($ret, 'ldapauth', 'name', array('name')); + return $ret; +} + diff -upN ldap_integration_dev/ldapauth.module ldap_integration/ldapauth.module --- ldap_integration_dev/ldapauth.module 2009-05-03 20:26:43.000000000 -0400 +++ ldap_integration/ldapauth.module 2010-04-23 12:37:03.000000000 -0400 @@ -1,5 +1,5 @@ 'ldapauth.admin.inc', ), 'admin/settings/ldap/ldapauth/deactivate' => array( - 'title' => 'De-Activate LDAP Source', + 'title' => 'De-activate LDAP Source', 'page callback' => 'ldapauth_admin_deactivate', 'page arguments' => array(5), 'access arguments' => array('administer ldap modules'), @@ -156,7 +157,7 @@ function ldapauth_user($op, &$edit, &$ac break; case 'view': if (user_access('administer users') && isset($account->ldap_authentified) && $account->ldap_dn) { - $row = db_fetch_object(db_query("SELECT * FROM {ldapauth} WHERE sid = %d", $account->ldap_config)); + $row = ldapauth_get_server($account->ldap_config); $account->content[t(LDAPAUTH_PROFILE)] = array( '#type' => 'user_profile_category', '#title' => t(LDAPAUTH_PROFILE), @@ -306,7 +307,7 @@ function ldapauth_authenticate($form_val } // Register this new user. - if ($ldap_user = _ldapauth_user_lookup($name)) { + if ($ldap_user = _ldapauth_user_lookup($name, $pass)) { // Generate a random drupal password. LDAP password will be used anyways. $pass_new = (LDAPAUTH_LOGIN_PROCESS == LDAPAUTH_AUTH_EXCLUSIVED || !LDAPAUTH_SYNC_PASSWORDS) ? user_password(20) : $pass; @@ -377,15 +378,15 @@ function _ldapauth_auth($name, $pass) { return FALSE; // Cycle through LDAP configurations. First one to succeed wins. - $result = db_query("SELECT sid FROM {ldapauth} WHERE status = 1 ORDER BY weight"); - while ($row = db_fetch_object($result)) { + $rows = ldapauth_get_server_list(1); + foreach($rows as $row) { // Initialize LDAP. if (!_ldapauth_init($row->sid)) return FALSE; // Look up the user in LDAP. - if (!($ldap = _ldapauth_user_lookup($name)) || !isset($ldap['dn'])) + if (!($ldap = _ldapauth_user_lookup($name, $pass)) || !isset($ldap['dn'])) continue; // Filter users based on their LDAP data. @@ -410,7 +411,7 @@ function _ldapauth_auth($name, $pass) { * @return * An array with user's LDAP data or NULL if not found. */ -function _ldapauth_user_lookup($name) { +function _ldapauth_user_lookup($name, $pass) { global $_ldapauth_ldap; if (!$_ldapauth_ldap) @@ -420,7 +421,14 @@ function _ldapauth_user_lookup($name) { $login_name = ($code = _ldapauth_ldap_info($_ldapauth_ldap->getOption('sid'), 'login_php')) ? eval($code) : $name; // If there is no bindn and bindpw - the connect will be an anonymous connect. - $_ldapauth_ldap->connect($_ldapauth_ldap->getOption('binddn'), $_ldapauth_ldap->getOption('bindpw')); + // If binddn is set to user, we'll use the user credentials to bind + $binddn = $_ldapauth_ldap->getOption('binddn'); + if ($binddn == 'user') { + $_ldapauth_ldap->connect($name, $pass); + } else { + $_ldapauth_ldap->connect($binddn, $_ldapauth_ldap->getOption('bindpw')); + } + foreach (explode("\r\n", $_ldapauth_ldap->getOption('basedn')) as $base_dn) { if (empty($base_dn)) continue; @@ -483,7 +491,7 @@ function _ldapauth_init($sid) { static $servers = array(); if (!isset($servers[$sid])) - $servers[$sid] = db_fetch_object(db_query("SELECT * FROM {ldapauth} WHERE status = 1 AND sid = %d", $sid)); + $servers[$sid] = ldapauth_get_server($sid, TRUE, 1); if ($servers[$sid]) { $_ldapauth_ldap = new LDAPInterface(); @@ -520,7 +528,7 @@ function _ldapauth_ldap_info($sid, $req) static $servers = array(); if (!isset($servers[$sid])) - $servers[$sid] = db_fetch_object(db_query("SELECT * FROM {ldapauth} WHERE sid = %d", $sid)); + $servers[$sid] = ldapauth_get_server($sid, TRUE); switch ($req) { case 'login_php': diff -upN ldap_integration_dev/ldapauth.theme.inc ldap_integration/ldapauth.theme.inc --- ldap_integration_dev/ldapauth.theme.inc 2009-03-24 06:07:59.000000000 -0400 +++ ldap_integration/ldapauth.theme.inc 2010-04-23 12:35:21.000000000 -0400 @@ -1,5 +1,5 @@ array( $row->name, @@ -106,6 +106,7 @@ function ldapdata_admin_list() { * The form structure. */ function ldapdata_admin_edit(&$form_state, $op, $sid) { + if ($op == "reset" && $sid) { $form['sid'] = array( '#type' => 'value', @@ -121,7 +122,7 @@ function ldapdata_admin_edit(&$form_stat ); } elseif ($op == "edit" && $sid) { - $edit = db_fetch_array(db_query("SELECT * FROM {ldapauth} WHERE sid = %d", $sid)); + $edit = ldapauth_get_server($sid); $ldapdata_mappings = $edit['ldapdata_mappings'] ? unserialize($edit['ldapdata_mappings']) : array(); $ldapdata_roattrs = $edit['ldapdata_roattrs'] ? unserialize($edit['ldapdata_roattrs']) : array(); @@ -241,7 +242,7 @@ function ldapdata_admin_edit(&$form_stat '#title' => t('Advanced configuration'), '#description' => t('When reading/editing attributes, this module logs on to the LDAP directory using the user\'s DN/pass pair. However, many LDAP setups do not allow their users to edit attributes.
If this is your case, but still you want users to edit their LDAP attributes via Drupal, you should set up an special user on your directory, with special access to edit your users\' attributes. Then this module will use it to log on and edit data.
"Test" tries authentication with the saved DN and password and prints the result.
'), '#collapsible' => TRUE, - '#collapsed' => TRUE + '#collapsed' => TRUE, ); $form['advanced']['ldapdata_binddn'] = array( '#type' => 'textfield', @@ -263,7 +264,7 @@ function ldapdata_admin_edit(&$form_stat $form['advanced']['ldapdata_bindpw_clear'] = array( '#type' => 'checkbox', '#default_value' => FALSE, - '#title' => t('Clear current password'), + '#title' => t('Clear current password and change DN'), ); } $form['advanced']['test'] = array( @@ -296,38 +297,14 @@ function ldapdata_admin_edit_validate($f $values = $form_state['values']; switch ($op) { case t('Update'): - $form_state['ldapdata_attrs'] = array(); $ldapdata_attrs = TRUE; foreach ((trim($values['attributes']['ldapdata_attrs']) ? explode("\n", trim($values['attributes']['ldapdata_attrs'])) : array()) as $line) { - if (count($data = explode('|', trim($line))) == 6) - $form_state['ldapdata_attrs'] += array(trim(array_shift($data)) => $data); - else + if (count($data = explode('|', trim($line))) != 6) $ldapdata_attrs = FALSE; } if (!$ldapdata_attrs) form_set_error('attributes][ldapdata_attrs', t('Bad attribute syntax.')); - $form_state['ldapdata_mappings'] = array(); - $form_state['ldapdata_mappings']['access'] = $values['ldapdata_mapping']; - if ($form_state['ldapdata_mappings']['access'] >= 4) { - foreach (element_children($values) as $attr) { - if (preg_match("/ldap_amap/", $attr) && $values[$attr]) - $form_state['ldapdata_mappings'][$attr] = $values[$attr]; - } - } - $form_state['ldapdata_mappings'] = !empty($form_state['ldapdata_mappings']) ? serialize($form_state['ldapdata_mappings']) : ''; - - - $form_state['ldapdata_roattrs'] = isset($values['attributes']['ldapdata_roattrs']) ? array_values(array_intersect($values['attributes']['ldapdata_roattrs'], array_keys($form_state['ldapdata_attrs']))) : array(); - $form_state['ldapdata_roattrs'] = !empty($form_state['ldapdata_roattrs']) ? serialize($form_state['ldapdata_roattrs']) : ''; - - $form_state['ldapdata_rwattrs'] = isset($values['attributes']['ldapdata_rwattrs']) ? array_values(array_intersect($values['attributes']['ldapdata_rwattrs'], array_keys($form_state['ldapdata_attrs']))) : array(); - $form_state['ldapdata_rwattrs'] = !empty($form_state['ldapdata_rwattrs']) ? serialize($form_state['ldapdata_rwattrs']) : ''; - - $form_state['ldapdata_attrs'] = !empty($form_state['ldapdata_attrs']) ? serialize($form_state['ldapdata_attrs']) : ''; - - $form_state['ldapdata_filter_php'] = trim($values['attributes']['ldapdata_filter_php']); - $form_state['ldapdata_rwattrs'] = empty($form_state['ldapdata_filter_php']) ? $form_state['ldapdata_rwattrs'] : ''; break; } } @@ -340,23 +317,14 @@ function ldapdata_admin_edit_submit($for $values = $form_state['values']; switch ($op) { case t('Update'): - if (isset($values['ldapdata_bindpw_clear'])) { - db_query("UPDATE {ldapauth} SET ldapdata_mappings = '%s', ldapdata_roattrs = '%s', ldapdata_rwattrs = '%s', ldapdata_binddn = '%s', ldapdata_attrs = '%s', ldapdata_filter_php = '%s' WHERE sid = %d", $form_state['ldapdata_mappings'], $form_state['ldapdata_roattrs'], $form_state['ldapdata_rwattrs'], $values['ldapdata_binddn'], $form_state['ldapdata_attrs'], $form_state['ldapdata_filter_php'], $values['sid']); - if ($values['ldapdata_bindpw_clear']) { - db_query("UPDATE {ldapauth} SET ldapdata_bindpw = '' WHERE sid = %d", $values['sid']); - } - } - else { - db_query("UPDATE {ldapauth} SET ldapdata_mappings = '%s', ldapdata_roattrs = '%s', ldapdata_rwattrs = '%s', ldapdata_binddn = '%s', ldapdata_bindpw = '%s', ldapdata_attrs = '%s', ldapdata_filter_php = '%s' WHERE sid = %d", $form_state['ldapdata_mappings'], $form_state['ldapdata_roattrs'], $form_state['ldapdata_rwattrs'], $values['ldapdata_binddn'], $values['ldapdata_bindpw'], $form_state['ldapdata_attrs'], $form_state['ldapdata_filter_php'], $values['sid']); - } + ldapdata_update_server($values); drupal_set_message(t('The configuration options have been saved.')); $form_state['redirect'] = 'admin/settings/ldap/ldapdata'; break; case t('Reset'): if ($values['confirm'] == 1) { - // Settings reset. - db_query("UPDATE {ldapauth} SET ldapdata_mappings = '', ldapdata_roattrs = '', ldapdata_rwattrs = '', ldapdata_binddn = '', ldapdata_bindpw = '', ldapdata_attrs = '', ldapdata_filter_php = '' WHERE sid = %d", $values['sid']); + ldapdata_reset($values['sid']); drupal_set_message(t('The configuration options have been reset to their default values.')); } $form_state['redirect'] = 'admin/settings/ldap/ldapdata'; @@ -379,4 +347,3 @@ function ldapdata_admin_edit_submit($for break; } } - diff -upN ldap_integration_dev/ldapdata.drush.inc ldap_integration/ldapdata.drush.inc --- ldap_integration_dev/ldapdata.drush.inc 1969-12-31 19:00:00.000000000 -0500 +++ ldap_integration/ldapdata.drush.inc 2010-04-21 08:22:45.000000000 -0400 @@ -0,0 +1,81 @@ + 'ldapdata_drush_sync', + 'description' => dt('Set the synchronisation mode for LDAP data'), + 'arguments' => array( + 'setting' => dt('One of login, page, or load'), + ), + ); + $items['ldap data mapping'] = array( + 'callback' => 'ldapdata_drush_mapping', + 'description' => dt('Delete an LDAP server'), + 'arguments' => array( + 'name' => dt('Friendly name of LDAP server'), + 'mode' => dt('One of none, rw or ro'), + ), + 'options' => array( + 'mail' => 'The mail attribute', + 'pass' => 'The pass attribute', + 'sig' => 'The signature attribute', + ), + ); + $items['ldap data attr'] = array( + 'callback' => 'ldapdata_drush_attr', + 'description' => dt('Set ldapdata attributes'), + 'arguments' => array( + 'name' => dt('Friendly name of LDAP server'), + 'attributes' => dt('Newline separated list of attributes'), + ), + ); + $items['ldap data bind'] = array( + 'callback' => 'ldapdata_drush_bind', + 'description' => dt('Set bind credentials for LDAP data'), + 'arguments' => array( + 'name' => dt('Friendly name of LDAP server'), + 'user' => dt('Bind username'), + 'pass' => dt('Bind password'), + ), + ); + return $items; +} + +/** + * Implementation of hook_drush_help + * @param section: the drush command we're seeking help for + * @return: A string describing the command + */ +function ldapdata_drush_help($section) { + switch($section) { + case 'drush:ldap data sync': + return dt('Set the synchronisation mode for LDAP data'); + case 'drush:ldap data mapping': + return dt('Set the mapping mode for LDAP data'); + case 'drush:ldap data attr': + return dt('Set attributes for LDAP data'); + case 'drush:ldap data php': + return dt('Set PHP code for filtering LDAP data'); + case 'drush:ldap data bind': + return dt('Set bind credentials for LDAP data'); + } +} + +/* + * Helper function to include the file containing the db functions + */ +function ldapdata_drush_include() { + $path = drupal_get_path('module', 'ldapauth'); + include_once($path . "/ldapauth.db.inc"); +} + diff -upN ldap_integration_dev/ldapdata.info ldap_integration/ldapdata.info --- ldap_integration_dev/ldapdata.info 2009-05-08 20:13:53.000000000 -0400 +++ ldap_integration/ldapdata.info 2010-02-26 14:44:18.000000000 -0500 @@ -1,4 +1,4 @@ -; $Id: ldapdata.info,v 1.2.4.11 2009/03/25 12:23:28 miglius Exp $ +; $Id: ldapdata.info,v 1.3 2009/02/19 16:56:16 miglius Exp $ name = Data description = Implements LDAP data to Drupal profiles synchronization. package = LDAP integration @@ -6,9 +6,9 @@ dependencies[] = ldapauth core = 6.x -; Information added by drupal.org packaging script on 2009-05-09 -version = "6.x-1.x-dev" +; Information added by drupal.org packaging script on 2009-10-27 +version = "6.x-1.0-beta2" core = "6.x" project = "ldap_integration" -datestamp = "1241828033" +datestamp = "1256654469" diff -upN ldap_integration_dev/ldapdata.install ldap_integration/ldapdata.install --- ldap_integration_dev/ldapdata.install 2009-05-03 17:59:12.000000000 -0400 +++ ldap_integration/ldapdata.install 2010-02-26 14:44:18.000000000 -0500 @@ -1,5 +1,5 @@ 'text', + 'not null' => FALSE, + )); + db_add_field($ret, 'ldapauth', 'ldapdata_filter_php', array( + 'type' => 'text', + 'not null' => FALSE, + )); + return $ret; +} + +function ldapdata_update_6002() { + $ret = array(); + db_change_field($ret, 'ldapauth', 'ldapdata_rwattrs', 'ldapdata_rwattrs', array( + 'type' => 'text', + 'not null' => FALSE, + )); + db_change_field($ret, 'ldapauth', 'ldapdata_roattrs', 'ldapdata_roattrs', array( 'type' => 'text', 'not null' => FALSE, )); - db_add_field($ret, 'ldapauth', 'ldapdata_filter_php', array( + db_change_field($ret, 'ldapauth', 'ldapdata_mappings', 'ldapdata_mappings', array( 'type' => 'text', 'not null' => FALSE, )); diff -upN ldap_integration_dev/ldapdata.module ldap_integration/ldapdata.module --- ldap_integration_dev/ldapdata.module 2009-05-03 20:26:43.000000000 -0400 +++ ldap_integration/ldapdata.module 2010-04-23 12:50:45.000000000 -0400 @@ -1,5 +1,5 @@ ldap_config) ? $sid->ldap_config : NULL) : $sid)) return; - $row = db_fetch_object(db_query("SELECT ldapdata_binddn, ldapdata_bindpw FROM {ldapauth} WHERE sid = %d", $sid)); + $row = ldapauth_get_server($sid, TRUE); return array( 'dn' => $row->ldapdata_binddn ? $row->ldapdata_binddn : (isset($_SESSION['ldap_login']['dn']) ? $_SESSION['ldap_login']['dn'] : ''), @@ -583,7 +584,7 @@ function _ldapdata_init($sid) { static $servers = array(); if (!isset($servers[$sid])) - $servers[$sid] = db_fetch_object(db_query("SELECT * FROM {ldapauth} WHERE status = 1 AND sid = %d", $sid)); + $servers[$sid] = ldapauth_get_server($sid, TRUE, 1); if ($servers[$sid]) { // Other modules can invoke user load from hook_init() before ldapdata. @@ -621,7 +622,7 @@ function _ldapdata_ldap_info($sid, $req) static $servers = array(); if (!isset($servers[$sid])) - $servers[$sid] = db_fetch_object(db_query("SELECT * FROM {ldapauth} WHERE sid = %d", $sid)); + $servers[$sid] = ldapauth_get_server($sid, TRUE); switch ($req) { case 'mapping_type': diff -upN ldap_integration_dev/ldapdata.theme.inc ldap_integration/ldapdata.theme.inc --- ldap_integration_dev/ldapdata.theme.inc 2009-03-25 08:23:28.000000000 -0400 +++ ldap_integration/ldapdata.theme.inc 2010-02-26 14:44:18.000000000 -0500 @@ -1,5 +1,5 @@ array( $row->name, @@ -79,7 +79,7 @@ function ldapgroups_admin_edit(&$form_st ); } elseif ($op == 'edit' && $sid) { - $edit = db_fetch_array(db_query("SELECT * FROM {ldapauth} WHERE sid = %d", $sid)); + $edit = ldapauth_get_server($sid); $form['description'] = array( '#value' => t('Configure LDAP groups to Drupal roles mapping settings for the %server.', array('%server' => $edit['name'])), @@ -120,7 +120,7 @@ function ldapgroups_admin_edit(&$form_st $form['group_attr']['ldapgroups_attr'] = array( '#type' => 'textarea', '#title' => t('Attribute names (one per line)'), - '#default_value' => implode("\n", ($edit['ldapgroups_attr'] ? unserialize($edit['ldapgroups_attr']) : array())), + '#default_value' => implode("\n", $edit['ldapgroups_attr']), '#cols' => 50, '#rows' => 6, '#description' => t('If the groups are stored in the user entries, along with the rest of their data, then enter here a list of attributes which may contain them.'), @@ -140,7 +140,7 @@ function ldapgroups_admin_edit(&$form_st $form['group_entry']['ldapgroups_entries'] = array( '#type' => 'textarea', '#title' => t('LDAP DNs containing groups (one per line)'), - '#default_value' => implode("\n", ($edit['ldapgroups_entries'] ? unserialize($edit['ldapgroups_entries']) : array())), + '#default_value' => implode("\n", $edit['ldapgroups_entries']), '#cols' => 50, '#rows' => 6, '#description' => t('Enter here a list of LDAP nodes from where groups should be searched for. The module will look them up recursively from the given nodes.'), @@ -162,7 +162,7 @@ function ldapgroups_admin_edit(&$form_st $form['groups_limit']['ldapgroups_groups'] = array( '#type' => 'textarea', '#title' => t('LDAP groups which allow automatic account creation'), - '#default_value' => implode("\n", ($edit['ldapgroups_groups'] ? unserialize($edit['ldapgroups_groups']) : array())), + '#default_value' => implode("\n", $edit['ldapgroups_groups']), '#cols' => 50, '#rows' => 5, '#description' => t('Leave blank to automatically create accounts for all LDAP authenticated users. Otherwise, enter a one per line list of LDAP groups. If the user is not in any of those groups, the login will be denied.'), @@ -175,7 +175,7 @@ function ldapgroups_admin_edit(&$form_st '#collapsed' => !($edit['ldapgroups_mappings'] || $edit['ldapgroups_filter_php']), ); $mappings = ''; - foreach (($edit['ldapgroups_mappings'] ? unserialize($edit['ldapgroups_mappings']) : array()) as $group => $role) + foreach ($edit['ldapgroups_mappings'] as $group => $role) $mappings .= $group .'|'. $role ."\n"; $form['group_filter']['ldapgroups_mappings'] = array( '#type' => 'textarea', @@ -233,40 +233,6 @@ function ldapgroups_admin_edit_validate( form_set_error('ldapgroups_entries', t('Nodes are missing.')); if ($values['ldapgroups_as_entries'] && !trim($values['ldapgroups_entries_attribute'])) form_set_error('ldapgroups_entries_attribute', t('Attribute is missing.')); - - $form_state['ldapgroups_attr'] = array(); - foreach ((trim($values['ldapgroups_attr']) ? explode("\n", trim($values['ldapgroups_attr'])) : array()) as $line) - if (trim($line)) - $form_state['ldapgroups_attr'][] = trim($line); - $form_state['ldapgroups_attr'] = !empty($form_state['ldapgroups_attr']) ? serialize($form_state['ldapgroups_attr']) : ''; - - $form_state['ldapgroups_entries'] = array(); - foreach ((trim($values['ldapgroups_entries']) ? explode("\n", trim($values['ldapgroups_entries'])) : array()) as $line) - if (trim($line)) - $form_state['ldapgroups_entries'][] = trim($line); - $form_state['ldapgroups_entries'] = !empty($form_state['ldapgroups_entries']) ? serialize($form_state['ldapgroups_entries']) : ''; - - $form_state['ldapgroups_mappings'] = array(); - $ldapgroups_role_mappings = TRUE; - foreach ((trim($values['ldapgroups_mappings']) ? explode("\n", trim($values['ldapgroups_mappings'])) : array()) as $line) { - if (count($mapping = explode('|', trim($line))) == 2) - $form_state['ldapgroups_mappings'] += array(trim($mapping[0]) => trim($mapping[1])); - else - $ldapgroups_role_mappings = FALSE; - } - $form_state['ldapgroups_mappings'] = !empty($form_state['ldapgroups_mappings']) ? serialize($form_state['ldapgroups_mappings']) : ''; - if (!$ldapgroups_role_mappings) - form_set_error('ldapgroups_mappings', t('Bad mapping syntax.')); - - if ($values['ldapgroups_mappings_filter'] && !trim($values['ldapgroups_mappings'])) - form_set_error('ldapgroups_mappings', t('Mappings are missing.')); - - $form_state['ldapgroups_groups'] = array(); - foreach ((trim($values['ldapgroups_groups']) ? explode("\n", trim($values['ldapgroups_groups'])) : array()) as $line) - if (trim($line)) - $form_state['ldapgroups_groups'][] = trim($line); - $form_state['ldapgroups_groups'] = !empty($form_state['ldapgroups_groups']) ? serialize($form_state['ldapgroups_groups']) : ''; - break; } } @@ -278,17 +244,15 @@ function ldapgroups_admin_edit_submit($f $values = $form_state['values']; switch ($op) { case t('Update'): - // Update the ldapgroups configuration. - db_query("UPDATE {ldapauth} SET ldapgroups_in_dn = %d, ldapgroups_dn_attribute = '%s', ldapgroups_in_attr = %d, ldapgroups_attr = '%s', ldapgroups_as_entries = %d, ldapgroups_entries = '%s', ldapgroups_entries_attribute = '%s', ldapgroups_mappings = '%s', ldapgroups_mappings_filter = %d, ldapgroups_filter_php = '%s', ldapgroups_groups = '%s' WHERE sid = %d", $values['ldapgroups_in_dn'], trim($values['ldapgroups_dn_attribute']), $values['ldapgroups_in_attr'], $form_state['ldapgroups_attr'], $values['ldapgroups_as_entries'], $form_state['ldapgroups_entries'], trim($values['ldapgroups_entries_attribute']), $form_state['ldapgroups_mappings'], $values['ldapgroups_mappings_filter'], trim($values['ldapgroups_filter_php']), $form_state['ldapgroups_groups'], $values['sid']); + ldapgroups_update_server($values); drupal_set_message(t('The configuration options have been saved.')); $form_state['redirect'] = 'admin/settings/ldap/ldapgroups'; break; case t('Reset'): if ($values['confirm'] == 1) { - // Settings reset. - db_query("UPDATE {ldapauth} SET ldapgroups_in_dn = 0, ldapgroups_dn_attribute = '', ldapgroups_in_attr = 0, ldapgroups_attr = '', ldapgroups_as_entries = 0, ldapgroups_entries = '', ldapgroups_entries_attribute = '', ldapgroups_mappings = '', ldapgroups_mappings_filter = '0', ldapgroups_filter_php = '', ldapgroups_groups = '' WHERE sid = %d", $values['sid']); + ldapgroups_reset($values['sid']); drupal_set_message(t('The configuration options have been reset to their default values.')); } $form_state['redirect'] = 'admin/settings/ldap/ldapgroups'; diff -upN ldap_integration_dev/ldapgroups.drush.inc ldap_integration/ldapgroups.drush.inc --- ldap_integration_dev/ldapgroups.drush.inc 1969-12-31 19:00:00.000000000 -0500 +++ ldap_integration/ldapgroups.drush.inc 2010-04-23 11:27:23.000000000 -0400 @@ -0,0 +1,249 @@ + 'ldapgroups_drush_set_dn', + 'description' => dt('Add group by DN setting to a server'), + 'arguments' => array( + 'name' => dt('Friendly name for the server'), + 'attribute' => dt('The name of the attribute which contains the group name'), + ), + ); + $items['ldap group attr'] = array( + 'callback' => 'ldapgroups_drush_set_attr', + 'description' => dt('Add group by attribute setting to a server'), + 'arguments' => array( + 'name' => dt('Friendly name for the server'), + 'attributes' => dt('newline separated list of attributes'), + ), + 'options' => array( + 'replace' => dt('replace existing list of attributes instead of adding'), + ), + ); + $items['ldap group entry'] = array( + 'callback' => 'ldapgroups_drush_set_entry', + 'description' => dt('Add group by entry to a server'), + 'arguments' => array( + 'name' => dt('Friendly name for the server'), + 'attribute' => dt('Name of the multivalued attribute which holds the CNs of group members, for example: memberUid'), + 'DNs' => dt('newline separated list of DNs to look for groups under'), + ), + 'options' => array( + 'replace' => dt('replace existing list of DNs instead of adding'), + ), + ); + $items['ldap group allow'] = array( + 'callback' => 'ldapgroups_drush_allow', + 'description' => dt('Allow access from selected LDAP groups'), + 'arguments' => array( + 'name' => dt('Friendly name for the server'), + 'groups' => dt('newline separated list of groups to allow'), + ), + 'options' => array( + 'replace' => dt('replace existing list of groups instead of adding'), + ), + ); + $items['ldap group map'] = array( + 'callback' => 'ldapgroups_drush_map', + 'description' => dt('Map LDAP groups to Drupal roles'), + 'arguments' => array( + 'name' => dt('Friendly name for the server'), + 'mappings' => dt('list of LDAP groups and their Drupal role mappings, one per line with a | delimiter.'), + ), + 'options' => array( + 'replace' => dt('replace existing list of mappings instead of adding'), + ), + ); + $items['ldap group php'] = array( + 'callback' => 'ldapgroups_drush_php', + 'description' => dt('PHP filtering'), + 'arguments' => array( + 'name' => dt('Friendly name for the server'), + 'PHP' => dt('PHP code to filter groups with'), + ), + ); + return $items; +} + +/** + * Implementation of hook_drush_help + * @param section: the drush command we're seeking help for + * @return: A string describing the command + */ +function ldapgroups_drush_help($section) { + switch($section) { + case 'drush:ldap group dn': + return dt('Configure LDAP group support by DN'); + case 'drush:ldap group entry': + return dt('Configure LDAP group support by LDAP entry'); + case 'drush:ldap group attr': + return dt('Configure LDAP group support by user attribute'); + case 'drush:ldap group allow': + return dt('Define LDAP groups to allow in'); + case 'drush:ldap group map': + return dt('Map LDAP groups to Drupal roles'); + case 'drush:ldap group php': + return dt('Define PHP for filtering roles'); + } +} + +/* + * Helper function to include the file containing the db functions + */ +function ldapgroups_drush_include() { + $path = drupal_get_path('module', 'ldapauth'); + include_once($path . "/ldapauth.db.inc"); +} + +/* + * Set group DN attribute + * @param name: Friendly server name + * @param attribute: attribute containing the group + */ +function ldapgroups_drush_set_dn($name, $attribute) { + if (!$name || !$attribute) { + drush_set_error('LDAPGROUPS_MISSING_DATA', dt('Both name and attribute must be specified')); + return; + } + ldapauth_drush_include(); + if (!$server = ldapauth_get_server($name)) { + drush_set_error('LDAPGROUPS_INVALID_SERVER', dt('Invalid server name specified')); + return; + } + + $server['ldapgroups_in_dn'] = 1; + $server['ldapgroups_dn_attribute' ] = $attribute; + ldapgroups_update_server($server); +} + +/* + * Set group by attribute + * @param name: Friendly server name + * @param attributes: list of attributes containing groups + */ +function ldapgroups_drush_set_attr($name, $attributes) { + if (!$name || !$attributes) { + drush_set_error('LDAPGROUPS_MISSING_DATA', dt('Both name and attributes must be specified')); + return; + } + ldapauth_drush_include(); + if (!$server = ldapauth_get_server($name)) { + drush_set_error('LDAPGROUPS_INVALID_SERVER', dt('Invalid server name specified')); + return; + } + + $server['ldapgroups_in_attr'] = 1; + if (drush_get_option('replace')) { + $server['ldapgroups_attr' ] = array(); + } + foreach(explode($attributes, '\n') as $attr) + $server['ldapgroups_attr'][] = $attr; + ldapgroups_update_server($server); +} + +/* + * Set group by entry + * @param name: Friendly server name + * @param attribute: name of attribute containing group + * @param dns : list of DNs containing group attributes + */ +function ldapgroups_drush_set_entry($name, $attribute, $dns) { + if (!$name || !$attribute || !$dns) { + drush_set_error('LDAPGROUPS_MISSING_DATA', dt('Name, attribute and DNs must be specified')); + return; + } + ldapauth_drush_include(); + if (!$server = ldapauth_get_server($name)) { + drush_set_error('LDAPGROUPS_INVALID_SERVER', dt('Invalid server name specified')); + return; + } + + $server['ldapgroups_as_entries'] = 1; + $server['ldapgroups_entries_attribute' ] = $attribute; + if (drush_get_option('replace')) { + $server['ldapgroups_entries' ] = array(); + } + foreach(explode($dns, '\n') as $dn) + $server['ldapgroups_entries'][] = $dn; + ldapgroups_update_server($server); +} + +/* + * Allow access to certain groups + * @param name: Friendly server name + * @param groups : list of groups to allow + */ +function ldapgroups_drush_allow($name, $groups) { + if (!$name || !$groups) { + drush_set_error('LDAPGROUPS_MISSING_DATA', dt('Name and groups must be specified')); + return; + } + ldapauth_drush_include(); + if (!$server = ldapauth_get_server($name)) { + drush_set_error('LDAPGROUPS_INVALID_SERVER', dt('Invalid server name specified')); + return; + } + + if (drush_get_option('replace')) { + $server['ldapgroups_groups' ] = array(); + } + foreach(explode($groups, '\n') as $group) + $server['ldapgroups_groups'][] = $group; + ldapgroups_update_server($server); +} + +/* + * Map LDAP groups to Drupal roles + * @param name: Friendly server name + * @param mappings : list of mappings + */ +function ldapgroups_drush_map($name, $mappings) { + if (!$name || !mappings) { + drush_set_error('LDAPGROUPS_MISSING_DATA', dt('Name and mappings must be specified')); + return; + } + ldapauth_drush_include(); + if (!$server = ldapauth_get_server($name)) { + drush_set_error('LDAPGROUPS_INVALID_SERVER', dt('Invalid server name specified')); + return; + } + + $server['ldapgroups_mappings_filter'] = 1; + if (drush_get_option('replace')) { + $server['ldapgroups_mappings' ] = array(); + } + foreach(explode($mappings, '\n') as $mapping) + $server['ldapgroups_mappings'][] = $mapping; + ldapgroups_update_server($server); +} + +/* + * Define PHP for filtering + * @param name: Friendly server name + * @param php : PHP code + */ +function ldapgroups_drush_php($name, $php) { + if (!$name || !$php) { + drush_set_error('LDAPGROUPS_MISSING_DATA', dt('Name and PHP must be specified')); + return; + } + ldapauth_drush_include(); + if (!$server = ldapauth_get_server($name)) { + drush_set_error('LDAPGROUPS_INVALID_SERVER', dt('Invalid server name specified')); + return; + } + + $server['ldapgroups_filter_php'] = $php; + ldapgroups_update_server($server); +} + diff -upN ldap_integration_dev/ldapgroups.info ldap_integration/ldapgroups.info --- ldap_integration_dev/ldapgroups.info 2009-05-08 20:13:53.000000000 -0400 +++ ldap_integration/ldapgroups.info 2010-02-26 14:44:18.000000000 -0500 @@ -1,4 +1,4 @@ -; $Id: ldapgroups.info,v 1.3.2.11 2009/03/24 10:07:59 miglius Exp $ +; $Id: ldapgroups.info,v 1.4 2009/02/19 16:56:16 miglius Exp $ name = Groups description = Implements LDAP groups to Drupal roles mapping. package = LDAP integration @@ -6,9 +6,9 @@ dependencies[] = ldapauth core = 6.x -; Information added by drupal.org packaging script on 2009-05-09 -version = "6.x-1.x-dev" +; Information added by drupal.org packaging script on 2009-10-27 +version = "6.x-1.0-beta2" core = "6.x" project = "ldap_integration" -datestamp = "1241828033" +datestamp = "1256654469" diff -upN ldap_integration_dev/ldapgroups.install ldap_integration/ldapgroups.install --- ldap_integration_dev/ldapgroups.install 2009-05-03 17:59:12.000000000 -0400 +++ ldap_integration/ldapgroups.install 2010-02-26 14:44:18.000000000 -0500 @@ -1,9 +1,9 @@ connect($dn, $pass)) { - $row2 = db_fetch_object(db_query("SELECT binddn, bindpw FROM {ldapauth} WHERE sid = %d", $_ldapgroups_ldap->getOption('sid'))); + $row2 = ldap_get_server($_ldapgroups_ldap->getOption('sid'), TRUE); $dn = $row2->binddn; $pass = $row2->bindpw; if (!$_ldapgroups_ldap->connect($dn, $pass)) { @@ -266,14 +267,14 @@ function _ldapgroups_filter($account, $g foreach ($groups as $group) { foreach (_ldapgroups_ldap_info($account, 'ldapgroups_mappings') as $group_approved => $role) { if (strcasecmp($group_approved, $group) == 0) - $groups_new[] = $group; + $groups_new[] = $role; } } $groups = $groups_new; } if ($code = _ldapgroups_ldap_info($account, 'ldapgroups_filter_php')) - $groups = eval($code); + $groups = drupal_eval($code); return $groups; } @@ -315,7 +316,7 @@ function _ldapgroups_ldap_init($sid) { static $servers = array(); if (!isset($servers[$sid])) - $servers[$sid] = db_fetch_object(db_query("SELECT * FROM {ldapauth} WHERE status = 1 AND sid = %d", $sid)); + $servers[$sid] = ldapauth_get_server($sid, TRUE, 1); if ($servers[$sid]) { $_ldapgroups_ldap = new LDAPInterface(); @@ -348,7 +349,7 @@ function _ldapgroups_ldap_info($sid, $re static $servers = array(); if (!isset($servers[$sid])) - $servers[$sid] = db_fetch_object(db_query("SELECT * FROM {ldapauth} WHERE sid = %d", $sid)); + $servers[$sid] = ldapauth_get_server($sid, TRUE); switch ($req) { case 'ldapgroups_in_dn': @@ -358,21 +359,21 @@ function _ldapgroups_ldap_info($sid, $re case 'ldapgroups_in_attr': return $servers[$sid]->ldapgroups_in_attr; case 'ldapgroups_attr': - return !empty($servers[$sid]->ldapgroups_attr) ? unserialize($servers[$sid]->ldapgroups_attr) : array(); + return $servers[$sid]->ldapgroups_attr; case 'ldapgroups_as_entries': return $servers[$sid]->ldapgroups_as_entries; case 'ldapgroups_entries': - return !empty($servers[$sid]->ldapgroups_entries) ? unserialize($servers[$sid]->ldapgroups_entries) : array(); + return $servers[$sid]->ldapgroups_entries; case 'ldapgroups_entries_attribute': return !empty($servers[$sid]->ldapgroups_entries_attribute) ? $servers[$sid]->ldapgroups_entries_attribute : LDAPGROUPS_DEFAULT_ENTRIES_ATTRIBUTE; case 'ldapgroups_mappings': - return !empty($servers[$sid]->ldapgroups_mappings) ? unserialize($servers[$sid]->ldapgroups_mappings) : array(); + return $servers[$sid]->ldapgroups_mappings; case 'ldapgroups_mappings_filter': return $servers[$sid]->ldapgroups_mappings_filter; case 'ldapgroups_filter_php': return $servers[$sid]->ldapgroups_filter_php; case 'ldapgroups_groups': - return !empty($servers[$sid]->ldapgroups_groups) ? unserialize($servers[$sid]->ldapgroups_groups) : array(); + return $servers[$sid]->ldapgroups_groups; } } diff -upN ldap_integration_dev/README.txt ldap_integration/README.txt --- ldap_integration_dev/README.txt 2008-08-08 08:42:44.000000000 -0400 +++ ldap_integration/README.txt 2010-02-26 14:44:18.000000000 -0500 @@ -1,4 +1,4 @@ -$Id: README.txt,v 1.6.2.1 2008/08/08 12:42:44 miglius Exp $ +$Id: README.txt,v 1.7 2009/02/19 16:56:16 miglius Exp $ Basic Info ========== Common subdirectories: ldap_integration_dev/translations and ldap_integration/translations