mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add support for LDAP RFC2307 style group membership. Resolves #4923

Browse Source
This commit is contained in:
jim-p 2015-09-14 14:36:16 -04:00
parent d137967b79
commit 149efbeac4
2 changed files with 45 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/etc/inc/auth.inc
View File

@ -1032,7 +1032,11 @@ function ldap_get_groups($username, $authcfg) {
$ldapauthcont = $authcfg['ldap_authcn'];
$ldapnameattribute = strtolower($authcfg['ldap_attr_user']);
$ldapgroupattribute = strtolower($authcfg['ldap_attr_member']);
$ldapfilter = "({$ldapnameattribute}={$username})";
if (isset($authcfg['ldap_rfc2307'])) {
$ldapfilter = "(&(objectClass={$authcfg['ldap_attr_groupobj']})({$ldapgroupattribute}={$username}))";
} else {
$ldapfilter = "({$ldapnameattribute}={$username})";
}
$ldaptype = "";
$ldapver = $authcfg['ldap_protver'];
if (empty($ldapbindun) || empty($ldapbindpw)) {
@ -1048,7 +1052,11 @@ function ldap_get_groups($username, $authcfg) {
return false;
}
$ldapdn = $_SESSION['ldapdn'];
if (isset($authcfg['ldap_rfc2307'])) {
$ldapdn = $ldapbasedn;
} else {
$ldapdn = $_SESSION['ldapdn'];
}
/*Convert attribute to lowercase. php ldap arrays put everything in lowercase */
$ldapgroupattribute = strtolower($ldapgroupattribute);
@ -1102,14 +1110,15 @@ function ldap_get_groups($username, $authcfg) {
$search = @$ldapfunc($ldap, $ldapdn, $ldapfilter, array($ldapgroupattribute));
$info = @ldap_get_entries($ldap, $search);
$countem = $info["count"];
$gresults = isset($authcfg['ldap_rfc2307']) ? $info : $info[0][$ldapgroupattribute];
if (is_array($info[0][$ldapgroupattribute])) {
if(is_array($gresults)) {
/* Iterate through the groups and throw them into an array */
foreach ($info[0][$ldapgroupattribute] as $member) {
if (stristr($member, "CN=") !== false) {
$membersplit = explode(",", $member);
$memberof[] = preg_replace("/CN=/i", "", $membersplit[0]);
foreach ($gresults as $grp) {
if (((isset($authcfg['ldap_rfc2307'])) && (stristr($grp["dn"], "CN=") !== false))
|| ((!isset($authcfg['ldap_rfc2307'])) && (stristr($grp, "CN=") !== false))) {
$grpsplit = isset($authcfg['ldap_rfc2307']) ? explode(",", $grp["dn"]) : explode(",", $grp);
$memberof[] = preg_replace("/CN=/i", "", $grpsplit[0]);
}
}
}

28
src/usr/local/www/system_authservers.php
View File

@ -143,8 +143,10 @@ if ($act == "edit") {
$pconfig['ldap_attr_user'] = $a_server[$id]['ldap_attr_user'];
$pconfig['ldap_attr_group'] = $a_server[$id]['ldap_attr_group'];
$pconfig['ldap_attr_member'] = $a_server[$id]['ldap_attr_member'];
$pconfig['ldap_attr_groupobj'] = $a_server[$id]['ldap_attr_groupobj'];
$pconfig['ldap_utf8'] = isset($a_server[$id]['ldap_utf8']);
$pconfig['ldap_nostrip_at'] = isset($a_server[$id]['ldap_nostrip_at']);
$pconfig['ldap_rfc2307'] = isset($a_server[$id]['ldap_rfc2307']);
if (!$pconfig['ldap_binddn'] || !$pconfig['ldap_bindpw']) {
$pconfig['ldap_anon'] = true;
@ -296,6 +298,9 @@ if ($_POST) {
$server['ldap_attr_user'] = $pconfig['ldap_attr_user'];
$server['ldap_attr_group'] = $pconfig['ldap_attr_group'];
$server['ldap_attr_member'] = $pconfig['ldap_attr_member'];
$server['ldap_attr_groupobj'] = empty($pconfig['ldap_attr_groupobj']) ? "posixGroup" : $pconfig['ldap_attr_groupobj'];
if ($pconfig['ldap_utf8'] == "yes") {
$server['ldap_utf8'] = true;
} else {
@ -306,6 +311,11 @@ if ($_POST) {
} else {
unset($server['ldap_nostrip_at']);
}
if ($pconfig['ldap_rfc2307'] == "yes") {
$server['ldap_rfc2307'] = true;
} else {
unset($server['ldap_rfc2307']);
}
if (!$pconfig['ldap_anon']) {
@ -640,6 +650,24 @@ $section->addInput(new Form_Input(
$pconfig['ldap_attr_member']
));
$section->addInput(new Form_Checkbox(
'ldap_rfc2307',
'RFC 2307 Groups',
'LDAP Server uses RFC 2307 style group membership',
$pconfig['ldap_rfc2307']
))->setHelp('RFC 2307 style group membership has members listed on the group '.
'object rather than using groups listed on user object. Leave unchecked '.
'for Active Directory style group membership (RFC 2307bis).');
$section->addInput(new Form_Input(
'ldap_attr_groupobj',
'Group Object Class',
'text',
$pconfig['ldap_attr_groupobj'],
['placeholder' => 'posixGroup']
))->setHelp('Object class used for groups in RFC2307 mode. '.
'Typically "posixGroup" or "group".');
$section->addInput(new Form_Checkbox(
'ldap_utf8',
'UTF8 Encode',