'
+ );
$options_login_process = array(
LDAP_FIRST_DRUPAL => t('Drupal\'s own database. If it fails, will look on the LDAP directory'),
@@ -237,10 +275,6 @@
'#title' => t('System type and user mapping'),
);
- $form['ldap_system_type_pre_div'] = array(
- '#value' => '
'
- );
-
$form['ldap_system_type_1']['ldap_system_type'] = array(
'#type' => 'radio',
'#name' => 'edit[ldap_system_type]',
@@ -390,6 +424,13 @@
LDAP_GROUP_IN_ATTR => array('choice' => t('Groups are specified by LDAP attributes'), 'extended' => $option_grouproles_2),
LDAP_GROUP_AS_ENTRIES => array('choice' => t('Groups exist as LDAP entries where a multivalued attribute contains the members\' CNs'), 'extended' => $option_grouproles_3));
+ $form['ldap_only_match_groups'] = array(
+ '#type' => 'checkbox',
+ '#title' => t('Only map roles that match groups in configuration file'),
+ '#return_value' => true,
+ '#default_value' => variable_get('ldap_only_match_groups', true),
+ '#description' => 'When this checkbox is checked, only the ldap_integraton/conf.php file will be checked and group mappings will be assigned as roles. Not all LDAP roles will be added, just matching roles.',
+ );
$form['ldap_map_group_signoffs'] = array(
'#type' => 'checkbox',
'#title' => t('Recreate group mappings upon login'),
@@ -623,7 +664,7 @@
$groups_in_dn = variable_get('ldap_groups_in_dn', false);
$groups_in_attr = variable_get('ldap_groups_in_attr', false);
$groups_as_entries = variable_get('ldap_groups_as_entries', false);
- $dn_groups = array();
+ $dn_groups = array();
if ($groups_in_dn && $dn_groups_regexp = variable_get('ldap_group_dn_pattern', '')) {
preg_match($dn_groups_regexp, $user->ldap_dn, $matches);
$dn_groups = array_slice($matches, 1);
@@ -661,11 +702,13 @@
foreach ($groups as $group) {
if ($role = $ldap_group_role_mappings[$group]) {
// Just that
+ _ldap_integration_create_role($role);
+ _ldap_integration_give_role_to_user($user, $role);
} else if (preg_match('/^[^=]*=([^,]*),.*$/', $group, $matches)) {
$role = $matches[1];
}
- if ($role) {
+ if ($role && !(variable_get('ldap_only_match_groups',true))) {
_ldap_integration_create_role($role);
_ldap_integration_give_role_to_user($user, $role);
}
@@ -755,7 +798,7 @@
drupal_set_message('Lost passwords recovery has been disabled for LDAP users. Please contact your system administrator in order to get a new password.');
// Nulling out this field should suffice for Drupal not to try
// to regenerate the password, but it doesn't, so I add a drupal_goto()
- $edit['pass'] = null;
+ $edit['pass'] = null;
drupal_goto('user/login');
}
else if ($user->ldap_authentified && $account_updated_in_ldap) {
@@ -960,7 +1003,7 @@
// but maybe that's not appropriate.
//
// $result = db_query('SHOW COLUMNS FROM {users}');
-//
+//
// $fields = array();
// while ($row = db_fetch_object($result)) {
// $fields[] = $row->Field;
@@ -1006,28 +1049,68 @@
global $user;
if (isset($form_values['name'])) {
- if (user_is_blocked($form_values['name'])) {
+ $login_string = $form_values['name'];
+ $name = $login_string;
+ //check if we will be checking for an @domain.tld string.
+ if (variable_get('ldap_use_default_domain','')) {
+ if ($server = strchr($login_string, '@')) {
+ $server = strtolower(substr($server, 1));
+ //check if we will be checking for only a particular domain.tld string.
+ if (variable_get('ldap_only_default_domain','')) {
+ //check for only a particular domain.tld string.
+ if ($server == strtolower(variable_get('ldap_domain_name',''))) {
+ $name = substr($login_string, 0, strlen($login_string) - (strlen($server)+1));
+ $at = '';
+ $server = '';
+ }
+ else {
+ //Not the particular @domain.tld string.
+ $name ='';
+ form_set_error('login', t('Invalid domain name %server in login string.', array('%server' => theme('placeholder', $server))));
+ }
+ }
+ else {
+ //Not checking for only the particular @domain.tld string, but if it is here remove it.
+ //This allows external drupal authentication to work, and also the removing of domain info from login string.
+ if ($server == strtolower(variable_get('ldap_domain_name',''))) {
+ $name = substr($login_string, 0, strlen($login_string) - (strlen($server)+1));
+ $at = '';
+ $server = '';
+ }
+ }
+ }
+ }
+ //check to see if we will strip off NTLM\ or NTLM/ from front of $login_string.
+ if (variable_get('ldap_remove_ntlm_domain','')) {
+ if ($back = strpos($login_string,'\\')) {
+ $name = substr($login_string, $back+1);
+ }
+ if ($slash = strpos($login_string,'/')) {
+ $name = substr($login_string, $slash+1);
+ }
+ }
+ if (user_is_blocked($name)) {
// blocked in user administration
- form_set_error('login', t('The username %name has been blocked.', array('%name' => theme('placeholder', $form_values['name']))));
+ form_set_error('login', t('The username %name has been blocked.', array('%name' => theme('placeholder', $name))));
}
- else if (drupal_is_denied('user', $form_values['name'])) {
+ else if (drupal_is_denied('user', $name)) {
// denied by access controls
- form_set_error('login', t('The name %name is a reserved username.', array('%name' => theme('placeholder', $form_values['name']))));
+ form_set_error('login', t('The name %name is a reserved username.', array('%name' => theme('placeholder', $name))));
}
else if ($form_values['pass']) {
// === HACK STARTS ===
// --- New code starts
- $user = _ldap_integration_code_changed_login_validate($form_values['name'], trim($form_values['pass']));
+ $user = _ldap_integration_code_changed_login_validate($name, trim($form_values['pass']));
// --- New code ends
// --- Drupal's original code starts
- // $user = user_authenticate($form_values['name'], trim($form_values['pass']));
+ // $user = user_authenticate($name, trim($form_values['pass']));
// --- Drupal's original code ends
// === HACK ENDS ===
if (!$user->uid) {
form_set_error('login', t('Sorry. Unrecognized username or password.') .' '. l(t('Have you forgotten your password?'), 'user/password'));
- watchdog('user', t('Login attempt failed for %user: %error.', array('%user' => theme('placeholder', $form_values['name']), '%error' => theme('placeholder', $error))));
+ watchdog('user', t('Login attempt failed for %user: %error.', array('%user' => theme('placeholder', $name), '%error' => theme('placeholder', $error))));
}
}
}
@@ -1071,8 +1154,8 @@
}
if (ldap_integration_auth($name, $pass, $server)) {
- $user = user_load(array('name' => "$name$at$server"));
- $tmp_user->name = "$name$at$server";
+ $user = user_load(array('name' => $login_string));
+ $tmp_user->name = $login_string;
if (!$user->uid) { // Register this new user.
// Changes to this user_save():
// 1. 'pass' => $pass . Obviously. What I wonder is how it could
@@ -1081,18 +1164,17 @@
// 3. 'init' => same. BTW: what's the use of this field?
// 4. 'ldap_authentified' => TRUE . There is a need to mark
// people as externally authentified.
- $dn = _ldap_integration_login2dn("$name$at$server");
+ $dn = _ldap_integration_login2dn($login_string);
$map = _ldap_integration_reverse_mappings();
if (isset($map['mail'])) {
$mail = $ldap->retrieveAttribute($dn, $map['mail']);
}
else {
- $mail = "$name$at$server";
+ $mail = $login_string;
}
-
- $user = user_save('', array('name' => "$name$at$server", 'pass' => $pass, 'mail' => $mail, 'init' => $mail, 'status' => 1, 'authname_ldap_integration' => "$name$at$server", 'roles' => array(DRUPAL_AUTHENTICATED_RID), 'ldap_authentified' => TRUE, 'ldap_dn' => $dn));
- watchdog('user', t('New external user: %user using module %module.', array('%user' => theme('placeholder', $name .'@'. $server), '%module' => theme('placeholder', $module))), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $user->uid .'/edit'));
+ $user = user_save('', array('name' => $login_string, 'pass' => $pass, 'mail' => $mail, 'init' => $mail, 'status' => 1, 'authname_ldap_integration' => $login_string, 'roles' => array(DRUPAL_AUTHENTICATED_RID), 'ldap_authentified' => TRUE, 'ldap_dn' => $dn));
+ watchdog('user', t('New external user: %user using module %module.', array('%user' => theme('placeholder', $login_string), '%module' => theme('placeholder', $module))), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $user->uid .'/edit'));
}
}
@@ -1115,4 +1197,4 @@
msg($output);
}
-?>
\ No newline at end of file
+?>