If you use the ldapdata module and want to allow users to modify their LDAP attributes, you have two options:
Physically, these passwords are stored in the Drupal\'s session table in clear text. This is not ideal and is not the recomended configuration.
Unless you need to use the latter configuration, leave this checked.
'), ); $form['security-options']['ldapauth_sync_passwords'] = array( '#type' => 'checkbox', '#title' => t('Sync LDAP password with the Drupal password'), - '#default_value' => LDAPAUTH_SYNC_PASSWORDS, + '#default_value' => $_ldapauth_sync_passwords, '#description' => t('If checked, then LDAP and Drupal passwords will be syncronized. This might be useful if some other modules need to authenticate against the user password hash stored in Drupal and works only in Mixed mode. It might introduce security issues in the Mixed mode since after deletion of the LDAP account user still be able to login to Drupal with his password. If unsure, leave this unchecked.'), ); @@ -78,7 +79,7 @@ function ldapauth_admin_settings() { $form['ldap-ui']['ldapauth_disable_pass_change'] = array( '#type' => 'checkbox', '#title' => t('Remove password change fields from user edit form'), - '#default_value' => LDAPAUTH_DISABLE_PASS_CHANGE, + '#default_value' => $_ldapauth_disable_pass_change, '#description' => t('NOTE: Request new password feature will be disabled for all users even for the user with uid 1.'), ); $options_email_field = array( @@ -90,7 +91,7 @@ function ldapauth_admin_settings() { '#type' => 'radios', '#title' => t('Alter email field on user edit form'), '#description' => t('Remove or disable email field from user edit form for LDAP authenticated users.'), - '#default_value' => LDAPAUTH_ALTER_EMAIL_FIELD, + '#default_value' => $_ldapauth_alter_email_field, '#options' => $options_email_field, '#required' => TRUE, ); @@ -200,7 +201,8 @@ function ldapauth_admin_list_submit($form, &$form_state) { * The form structure. */ function ldapauth_admin_form(&$form_state, $op = NULL, $sid = NULL) { - drupal_add_js(drupal_get_path('module', 'ldapauth') .'/ldapauth.admin.js'); + global $_ldapauth_default_user_attr, $_ldapauth_default_mail_attr; + drupal_add_js(drupal_get_path('module', 'ldapauth') .'/ldapauth.admin.js'); if ($op == "edit" && $sid) { $edit = db_fetch_array(db_query("SELECT * FROM {ldapauth} WHERE sid = %d", $sid)); @@ -217,8 +219,8 @@ function ldapauth_admin_form(&$form_state, $op = NULL, $sid = NULL) { 'tls' => 0, 'encrypted' => 0, 'basedn' => '', - 'user_attr' => LDAPAUTH_DEFAULT_USER_ATTR, - 'mail_attr' => LDAPAUTH_DEFAULT_MAIL_ATTR, + 'user_attr' => $_ldapauth_default_user_attr, + 'mail_attr' => $_ldapauth_default_mail_attr, 'binddn' => '', 'bindpw' => FALSE, 'login_php' => '', diff --git a/ldapauth.module b/ldapauth.module index 0dcd4e2..aa5ab10 100644 --- a/ldapauth.module +++ b/ldapauth.module @@ -18,15 +18,6 @@ define('LDAPAUTH_EMAIL_FIELD_DISABLE', 2); define('LDAPAUTH_PROFILE', 'LDAP authentication'); define('LDAPAUTH_PROFILE_WEIGHT', 4); -define('LDAPAUTH_LOGIN_PROCESS', variable_get('ldapauth_login_process', LDAPAUTH_AUTH_MIXED)); -define('LDAPAUTH_LOGIN_CONFLICT', variable_get('ldapauth_login_conflict', LDAPAUTH_CONFLICT_LOG)); -define('LDAPAUTH_FORGET_PASSWORDS', variable_get('ldapauth_forget_passwords', TRUE)); -define('LDAPAUTH_SYNC_PASSWORDS', variable_get('ldapauth_sync_passwords', FALSE)); -define('LDAPAUTH_DISABLE_PASS_CHANGE', variable_get('ldapauth_disable_pass_change', FALSE)); -define('LDAPAUTH_ALTER_EMAIL_FIELD', variable_get('ldapauth_alter_email_field', LDAPAUTH_EMAIL_FIELD_NO)); -define('LDAPAUTH_DEFAULT_USER_ATTR', variable_get('ldapauth_default_user_attr', 'uid')); -define('LDAPAUTH_DEFAULT_MAIL_ATTR', variable_get('ldapauth_default_mail_attr', 'mail')); - ////////////////////////////////////////////////////////////////////////////// // Core API hooks @@ -35,6 +26,24 @@ define('LDAPAUTH_DEFAULT_MAIL_ATTR', variable_get('ldapauth_default_mail_attr' */ function ldapauth_init() { require_once(drupal_get_path('module', 'ldapauth') .'/includes/LDAPInterface.inc'); + + global $_ldapauth_login_process; + global $_ldapauth_login_conflict; + global $_ldapauth_forget_passwords; + global $_ldapauth_sync_passwords; + global $_ldapauth_disable_pass_change; + global $_ldapauth_alter_email_field; + global $_ldapauth_default_user_attr; + global $_ldapauth_default_mail_attr; + + $_ldapauth_login_process = variable_get('ldapauth_login_process', LDAPAUTH_AUTH_MIXED); + $_ldapauth_login_conflict = variable_get('ldapauth_login_conflict', LDAPAUTH_CONFLICT_LOG); + $_ldapauth_forget_passwords = variable_get('ldapauth_forget_passwords', TRUE); + $_ldapauth_sync_passwords = variable_get('ldapauth_sync_passwords', FALSE); + $_ldapauth_disable_pass_change = variable_get('ldapauth_disable_pass_change', FALSE); + $_ldapauth_alter_email_field = variable_get('ldapauth_alter_email_field', LDAPAUTH_EMAIL_FIELD_NO); + $_ldapauth_default_user_attr = variable_get('ldapauth_default_user_attr', 'uid'); + $_ldapauth_default_mail_attr = variable_get('ldapauth_default_mail_attr', 'mail'); } /** @@ -148,18 +157,19 @@ function ldapauth_theme() { * Implements hook_user(). */ function ldapauth_user($op, &$edit, &$account, $category = NULL) { - switch ($op) { + global $_ldapauth_login_process, $_ldapauth_sync_passwords, $_ldapauth_alter_email_field; + switch ($op) { case 'update': if ($category == 'account') { // If authentication is being done in "LDAP only" mode, passwords // should not be written to the database, or users would be able // to log in even after removing their LDAP entry. - if (isset($account->ldap_authentified) && (LDAPAUTH_LOGIN_PROCESS == LDAPAUTH_AUTH_EXCLUSIVED || !LDAPAUTH_SYNC_PASSWORDS)) + if (isset($account->ldap_authentified) && ($_ldapauth_login_process == LDAPAUTH_AUTH_EXCLUSIVED || !$_ldapauth_sync_passwords)) $edit['pass'] = NULL; } - if (LDAPAUTH_ALTER_EMAIL_FIELD == LDAPAUTH_EMAIL_FIELD_REMOVE) + if ($_ldapauth_alter_email_field == LDAPAUTH_EMAIL_FIELD_REMOVE) unset($edit['mail']); break; case 'view': @@ -197,7 +207,7 @@ function ldapauth_perm() { * Implements hook_form_alter(). */ function ldapauth_form_alter(&$form, $form_state, $form_id) { - global $user; + global $user, $_ldapauth_disable_pass_change, $_ldapauth_alter_email_field; // Replace the drupal authenticate function is it's used as validation. if (isset($form['#validate']) && is_array($form['#validate']) && ($key = array_search('user_login_authenticate_validate', $form['#validate']))) @@ -205,16 +215,16 @@ function ldapauth_form_alter(&$form, $form_state, $form_id) { switch ($form_id) { case 'user_login_block': - if (LDAPAUTH_DISABLE_PASS_CHANGE) + if ($_ldapauth_disable_pass_change) unset($form['links']); break; case 'user_profile_form': $account = $form["_account"]["#value"]; if ($user->uid != 1 && isset($account->ldap_authentified)) { - if (LDAPAUTH_DISABLE_PASS_CHANGE) + if ($_ldapauth_disable_pass_change) unset($form['account']['pass']); - switch (LDAPAUTH_ALTER_EMAIL_FIELD) { + switch ($_ldapauth_alter_email_field) { case LDAPAUTH_EMAIL_FIELD_REMOVE : $form['account']['mail']['#type'] = 'hidden'; $form['account']['mail']['#attributes']['READONLY'] = 'READONLY'; @@ -245,9 +255,10 @@ function ldapauth_cron() { * Implements hook_exit(). */ function ldapauth_exit() { - // We delete the login info here, instead of just not storing it at + global $_ldapauth_forget_passwords; + // We delete the login info here, instead of just not storing it at // _ldapauth_auth(), so at least ldapgroups can use it at login time. - if (LDAPAUTH_FORGET_PASSWORDS && isset($_SESSION['ldap_login'])) { + if ($_ldapauth_forget_passwords && isset($_SESSION['ldap_login'])) { unset($_SESSION['ldap_login']); } } @@ -270,7 +281,7 @@ function ldapauth_login_authenticate_validate($form, &$form_state) { * If successful, sets the global $user object. */ function ldapauth_authenticate($form_values = array()) { - global $user, $_ldapauth_ldap; + global $user, $_ldapauth_ldap, $_ldapauth_login_process, $_ldapauth_login_conflict, $_ldapauth_sync_passwords, $_ldapauth_default_mail_attr; $name = $form_values['name']; $pass = trim($form_values['pass']); @@ -289,7 +300,7 @@ function ldapauth_authenticate($form_values = array()) { return; } - if (LDAPAUTH_LOGIN_PROCESS == LDAPAUTH_AUTH_MIXED) { + if ($_ldapauth_login_process == LDAPAUTH_AUTH_MIXED) { // Authenticate local users first. $result = db_query("SELECT name, data FROM {users} WHERE name='%s'", $name); if ($row = db_fetch_array($result)) { @@ -322,7 +333,7 @@ function ldapauth_authenticate($form_values = array()) { // Register this new user. if ($ldap_user = _ldapauth_user_lookup($name)) { // If mail attribute is missing, set the name as mail. - $init = $mail = key_exists(($_ldapauth_ldap->getOption('mail_attr') ? $_ldapauth_ldap->getOption('mail_attr') : LDAPAUTH_DEFAULT_MAIL_ATTR), $ldap_user) ? $ldap_user[$_ldapauth_ldap->getOption('mail_attr')][0] : $name; + $init = $mail = key_exists(($_ldapauth_ldap->getOption('mail_attr') ? $_ldapauth_ldap->getOption('mail_attr') : $_ldapauth_default_mail_attr), $ldap_user) ? $ldap_user[$_ldapauth_ldap->getOption('mail_attr')][0] : $name; // Check if the e-mail is not denied. if (drupal_is_denied('mail', $mail)) { @@ -331,7 +342,7 @@ function ldapauth_authenticate($form_values = array()) { } // Generate a random drupal password. LDAP password will be used anyways. - $pass_new = (LDAPAUTH_LOGIN_PROCESS == LDAPAUTH_AUTH_EXCLUSIVED || !LDAPAUTH_SYNC_PASSWORDS) ? user_password(20) : $pass; + $pass_new = ($_ldapauth_login_process == LDAPAUTH_AUTH_EXCLUSIVED || !$_ldapauth_sync_passwords) ? user_password(20) : $pass; $userinfo = array('name' => $name, 'pass' => $pass_new, 'mail' => $mail, 'init' => $init, 'status' => 1, 'authname_ldapauth' => $name, 'ldap_authentified' => TRUE, 'ldap_dn' => $ldap_user['dn'], 'ldap_config' => $_ldapauth_ldap->getOption('sid')); $user = user_save('', $userinfo); @@ -347,7 +358,7 @@ function ldapauth_authenticate($form_values = array()) { if (!isset($account->ldap_authentified)) { // LDAP and local user conflict. - if (LDAPAUTH_LOGIN_CONFLICT == LDAPAUTH_CONFLICT_LOG) { + if ($_ldapauth_login_conflict == LDAPAUTH_CONFLICT_LOG) { watchdog('ldapauth', 'LDAP user with DN %dn has a naming conflict with a local drupal user %name', array('%dn' => $dn, '%name' => $account->name), WATCHDOG_ERROR); drupal_set_message(t('Another user already exists in the system with the same login name. You should contact the system administrator in order to solve this conflict.'), 'error'); return; @@ -360,7 +371,7 @@ function ldapauth_authenticate($form_values = array()) { // Successfull login. // Save the new login data. - if (LDAPAUTH_LOGIN_PROCESS == LDAPAUTH_AUTH_MIXED && LDAPAUTH_SYNC_PASSWORDS) + if ($_ldapauth_login_process == LDAPAUTH_AUTH_MIXED && $_ldapauth_sync_passwords) $data['pass'] = $pass; $user = user_save($account, $data); } @@ -427,7 +438,7 @@ function _ldapauth_auth($name, $pass) { * An array with user's LDAP data or NULL if not found. */ function _ldapauth_user_lookup($name) { - global $_ldapauth_ldap; + global $_ldapauth_ldap, $_ldapauth_default_user_attr; if (!$_ldapauth_ldap) return; @@ -441,7 +452,7 @@ function _ldapauth_user_lookup($name) { if (empty($base_dn)) continue; - $name_attr = $_ldapauth_ldap->getOption('user_attr') ? $_ldapauth_ldap->getOption('user_attr') : LDAPAUTH_DEFAULT_USER_ATTR; + $name_attr = $_ldapauth_ldap->getOption('user_attr') ? $_ldapauth_ldap->getOption('user_attr') : $_ldapauth_default_user_attr; $filter = $name_attr .'='. $login_name; $result = $_ldapauth_ldap->search($base_dn, $filter); if (!$result) diff --git a/ldapgroups.inc b/ldapgroups.inc index 0af887b..529b625 100644 --- a/ldapgroups.inc +++ b/ldapgroups.inc @@ -76,7 +76,7 @@ function ldapgroups_user_login(&$account) { * An array of user groups. */ function _ldapgroups_detect_groups($user) { - global $_ldapgroups_ldap; + global $_ldapgroups_ldap, $_ldapauth_forget_passwords; // Nothing to do if the user is not LDAP authentified // or there are no groups configured. @@ -91,7 +91,7 @@ function _ldapgroups_detect_groups($user) { // If I try to connect using a blank dn and pass, I dont get an error until ldap_read, // so I just check to see if they would be blank, based on ldap_forget_passwords, and // make it read from the database. - if (LDAPAUTH_FORGET_PASSWORDS || !$_ldapgroups_ldap->connect($dn, $pass)) { + if ($_ldapauth_forget_passwords || !$_ldapgroups_ldap->connect($dn, $pass)) { $row2 = db_fetch_object(db_query("SELECT binddn, bindpw FROM {ldapauth} WHERE sid = %d", $_ldapgroups_ldap->getOption('sid'))); $dn = $row2->binddn; $pass = $row2->bindpw;