mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow the authentication scripts to detect configuration changes. Allow multiple OUs to be specified on basedn.

Browse Source
This commit is contained in:
Ermal Lui 2010-03-02 00:12:06 +00:00
parent d427154a51
commit 366d0323a9
3 changed files with 93 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

88
etc/inc/openvpn.auth-ldap.php
View File

@ -32,6 +32,8 @@
pfSense_BUILDER_BINARIES:
pfSense_MODULE: openvpn
*/
require_once("config.inc");
require_once("system.inc");
/* setup syslog logging */
openlog("openvpn", LOG_ODELAY, LOG_AUTH);
@ -48,9 +50,39 @@ if (empty($username) || empty($password)) {
/* Replaced by a sed with propper variables used below(ldap parameters). */
//<template>
$usernamedn = $username;
if (!strstr($username, "@") && !strstr($username, "\\"))
$usernamedn .= $ldapbasedn;
$authcfg = system_get_authserver($authmode);
$basednsplit = explode(",", $authcfg['ldap_basedn']);
$ldapbasedn = "";
foreach ($basednsplit as $basedn) {
$dn = explode("=", $basedn);
if (strtoupper($dn[0]) == "DC") {
if ($first > 0)
$ldapbasedn .= ".";
$first = 1;
$ldapbasedn .= $dn[1];
}
}
$ldapcfgou="{$authcfg['ldap_basedn']}";
$ldapport="{$authcfg['ldap_port']}";
if (strstr($authcfg['ldap_urltype'], "Standard"))
$ldapproto = "ldap";
else
$ldapproto = "ldaps";
$ldaphost="{$ldapproto}://{$authcfg['host']}";
if (!empty($ldapbasedn))
$ldapbasedn="@{$ldapbasedn}";
else
$ldapbasedn="{$ldapbasedn}";
$ldapver="{$authcfg['ldap_protver']}";
$ldapnameattr=strtolower($authcfg['ldap_attr_user']);
$ldapfilter="({$ldapnameattr}={$username})";
if (!$authcfg['ldap_binddn'] || !$authcfg['ldap_bindpw'])
$ldapanon=true;
else {
$ldapanon=false;
$ldapusername="{$authcfg['ldap_binddn']}";
$ldappassword="{$authcfg['ldap_bindpw']}";
}
/* Make sure we can connect to LDAP */
putenv('LDAPTLS_REQCERT=never');
@ -63,13 +95,59 @@ ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, (int)$ldapver);
/* ok, its up. now, lets bind as the bind user so we can search it */
if (!($res = @ldap_bind($ldap, $username, $password)) && !($res = @ldap_bind($ldap, $usernamedn, $password))) {
syslog(LOG_WARNING, "user {$username} could not authenticate\n");
if ($ldapanon == true) {
if (!($res = @ldap_bind($ldap))) {
syslog(LOG_WARNING, "user {$username} could not bind anonymously\n");
ldap_close($ldap);
exit(-3);
}
} else if (!($res = @ldap_bind($ldap, $ldapusername, $ldappassword))) {
syslog(LOG_WARNING, "user {$username} could not authenticate with bind credentials\n");
ldap_close($ldap);
exit(-3);
}
$ldapous = explode(";", $ldapcfgou);
$founddn = false;
foreach ($ldapous as $ldapou) {
if (!($search = ldap_search($ldap, $ldapou, $ldapfilter))) {
syslog(LOG_WARNING, "Could not search the {$ldapou} in directory for user: {$username}");
continue;
}
$userinfo = ldap_get_entries($ldap, $search);
if ($userinfo['count'] < 1) {
syslog(LOG_WARNING, "{$username} does not exist in {$ldapou}.");
continue;
} else if ($userinfo['count'] > 1) {
syslog(LOG_WARNING, "{$username} matches more than one entry in {$ldapou}.");
ldap_unbind($ldap);
exit(-5);
}
$founddn = true;
break;
}
if ($founddn == false) {
syslog(LOG_WARNING, "{$username} could not authenticate.");
ldap_unbind($ldap);
exit(-4);
}
$usernamedn = $username;
if (!strstr($username, "@") && !strstr($username, "\\"))
$usernamedn .= $ldapbasedn;
if (!($res = @ldap_bind($ldap, $username, $password)) &&
!($res = @ldap_bind($ldap, $usernamedn, $password)) &&
!($res = @ldap_bind($ldap, "{$ldapnameattr}={$username},{$ldapou}", $password))) {
syslog(LOG_WARNING, "{$username} could not authenticate in {$ldapou}.");
ldap_unbind($ldap);
exit(-6);
}
syslog(LOG_WARNING, "user {$username} authenticated\n");
ldap_unbind($ldap);
exit(0);

11
etc/inc/openvpn.auth-radius.php
View File

@ -33,6 +33,8 @@
pfSense_MODULE: openvpn
*/
require_once("config.inc");
require_once("system.inc");
require_once("radius.inc");
/* setup syslog logging */
@ -50,19 +52,24 @@ if (empty($username) || empty($password)) {
/* Replaced by a sed with propper variables used below(server parameters). */
//<template>
$authcfg = system_get_authserver($authmode);
$radsrv="{$authcfg['host']}";
$radport="{$authcfg['radius_auth_port']}";
$radsecret="{$authcfg['radius_secret']}";
$rauth = new Auth_RADIUS_PAP($username, $password);
/* Add server to our instance */
$rauth->addServer($radsrv, $radport, $radsecret);
if (!$rauth->start()) {
syslog(LOG_ERROR, "ERROR! . $rauth->getError());
syslog(LOG_ERROR, "ERROR! " . $rauth->getError());
exit(-2);
}
/* Send request */
$result = $rauth->send();
if (PEAR::isError($result)) {
syslog(LOG_WARNING, "Something went wrong trying to authenticate {$username}. " . $result->getMessage() . " \n");
syslog(LOG_WARNING, "Something went wrong trying to authenticate {$username}: " . $result->getMessage() . " \n");
exit(-1);
} else if ($result === true) {
syslog(LOG_WARNING, "user {$username} authenticated\n");

22
etc/inc/openvpn.inc
View File

@ -384,27 +384,7 @@ function openvpn_reconfigure($mode,& $settings) {
else {
$authcfg = system_get_authserver($settings['authmode']);
if ($authcfg) {
switch ($authcfg['type']) {
case 'ldap':
$basednrplc = array("dc=", "DC=");
$ldapbasedn = str_replace($basednrplc, "", $authcfg['ldap_basedn']);
$ldapbasedn = str_replace(",", ".", $ldapbasedn);
$sed = "\$ldapport=\"{$authcfg['ldap_port']}\";";
if (strstr($authcfg['ldap_urltype'], "Standard"))
$ldapproto = "ldap";
else
$ldapproto = "ldaps";
$sed .= "\$ldaphost=\"{$ldapproto}:\/\/{$authcfg['host']}\";";
$sed .= "\$ldapbasedn=\"@{$ldapbasedn}\";";
$sed .= "\$ldapver={$authcfg['ldap_protver']};";
break;
case 'radius':
$sed = "\$radsrv=\"{$authcfg['host']}\";";
$sed .= "\$radport=\"{$authcfg['radius_auth_port']}\";";
$sed .= "\$radsecret=\"{$authcfg['radius_secret']}\";";
break;
}
mwexec("/bin/cat /etc/inc/openvpn.auth-{$authcfg['type']}.php | /usr/bin/sed 's/\/\/<template>/{$sed}/g' > {$g['varetc_path']}/openvpn/{$mode_id}.php");
mwexec("/bin/cat /etc/inc/openvpn.auth-{$authcfg['type']}.php | /usr/bin/sed 's/\/\/<template>/\$authmode=\"{$authcfg['name']}\";/g' > {$g['varetc_path']}/openvpn/{$mode_id}.php");
mwexec("/bin/chmod a+x {$g['varetc_path']}/openvpn/{$mode_id}.php");
$conf .= "auth-user-pass-verify {$g['varetc_path']}/openvpn/{$mode_id}.php via-env\n";
}