mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix OpenVPN Wizard LDAP handling of ATTR fields. Fixes #8605

Browse Source 
While here, also add missing LDAP fields and fix a PHP 7.2 error.
This commit is contained in:
jim-p 2018-06-27 12:42:55 -04:00
parent 64fa420718
commit f031765bb0
2 changed files with 112 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/usr/local/www/wizards/openvpn_wizard.inc
View File

@ -93,9 +93,9 @@ function step3_submitphpaction() {
/* Default LDAP port is 389 for TCP and 636 for SSL */
if (empty($_POST['port'])) {
if ($_POST['transport'] == "tcp")
if (($_POST['transport'] == "TCP - Standard") || ($_POST['transport'] == "TCP - STARTTLS"))
$config['ovpnserver']['step2']['port'] = 389;
elseif ($_POST['transport'] == "ssl")
elseif ($_POST['transport'] == "SSL - Encrypted")
$config['ovpnserver']['step2']['port'] = 636;
} elseif (!is_port($_POST['port'])) {
$stepid--;
@ -106,7 +106,7 @@ function step3_submitphpaction() {
empty($_POST['scope']) || empty($_POST['basedn']) || empty($_POST['authscope']) || empty($_POST['nameattr'])) {
$stepid--;
$savemsg = "Please enter all information for authentication server.";
} else if (count(($authcfg = auth_get_authserver($_POST['name']))) > 0) {
} else if (!empty(auth_get_authserver($_POST['name']))) {
$stepid--;
$savemsg = "Please choose a different name because an authentication server with this name already exists.";
} elseif (!is_fqdn($_POST['ip']) && !is_ipaddr($_POST['ip'])) {
@ -163,7 +163,7 @@ function step5_submitphpaction() {
if (empty($_POST['name']) || empty($_POST['ip']) || empty($_POST['secret'])) {
$stepid--;
$savemsg = "Please enter all information for authentication server.";
} else if (count(($authcfg = auth_get_authserver($_POST['name']))) > 0) {
} else if (!empty(auth_get_authserver($_POST['name']))) {
$stepid--;
$savemsg = "Please choose a different name because an authentication server with this name already exists.";
} elseif (!is_fqdn($_POST['ip']) && !is_ipaddr($_POST['ip'])) {
@ -477,15 +477,24 @@ function step12_submitphpaction() {
$auth['ldap_urltype'] = 'TCP - Standard';
else
$auth['ldap_urltype'] = 'SSL - Encrypted';
$auth['ldap_protver'] = 3;
$auth['ldap_caref'] = $pconfig['step2']['ldap_caref'];
$auth['ldap_protver'] = $pconfig['step2']['ldap_protver'];
$auth['ldap_timeout'] = $pconfig['step2']['ldap_timeout'];
$auth['ldap_scope'] = $pconfig['step2']['scope'];
$auth['ldap_basedn'] = $pconfig['step2']['basedn'];
$auth['ldap_authcn'] = $pconfig['step2']['authscope'];
$auth['ldap_extended_enabled'] = isset($pconfig['step2']['ldap_extended_enabled']);
$auth['ldap_extended_query'] = $pconfig['step2']['ldap_extended_query'];
$auth['ldap_binddn'] = $pconfig['step2']['userdn'];
$auth['ldap_bindpw'] = $pconfig['step2']['passdn'];
$auth['ldap_attr_user'] = $pconfig['step1']['nameattr'];
$auth['ldap_attr_member'] = $pconfig['step1']['memberattr'];
$auth['ldap_attr_group'] = $pconfig['step1']['groupattr'];
$auth['ldap_attr_user'] = $pconfig['step2']['nameattr'];
$auth['ldap_attr_member'] = $pconfig['step2']['memberattr'];
$auth['ldap_attr_group'] = $pconfig['step2']['groupattr'];
$auth['ldap_rfc2307'] = isset($pconfig['step2']['ldap_rfc2307']);
$auth['ldap_attr_groupobj'] = $pconfig['step2']['ldap_attr_groupobj'];
$auth['ldap_utf8'] = isset($pconfig['step2']['ldap_utf8']);
$auth['ldap_nostrip_at'] = isset($pconfig['step2']['ldap_nostrip_at']);
} else if ($auth['type'] == "radius") {
$auth['host'] = $pconfig['step2']['ip'];
$auth['radius_auth_port'] = $pconfig['step2']['port'];

104
src/usr/local/www/wizards/openvpn_wizard.xml
View File

@ -121,7 +121,7 @@
<displayname>Hostname or IP address</displayname>
<type>input</type>
<bindstofield>ovpnserver->step2->ip</bindstofield>
<description>Address of the LDAP server.</description>
<description>Address of the LDAP server. When using SSL or STARTTLS, this hostname must match the LDAP server certificate.</description>
</field>
<field>
<name>port</name>
@ -129,7 +129,7 @@
<type>input</type>
<size>8</size>
<bindstofield>ovpnserver->step2->port</bindstofield>
<description>LDAP Server port, leave blank for the default (389 for TCP, 636 for SSL).</description>
<description>LDAP Server port, leave blank for the default (389 for TCP or STARTTLS, 636 for SSL).</description>
</field>
<field>
<name>transport</name>
@ -139,28 +139,64 @@
<options>
<option>
<name>TCP - Standard</name>
<value>tcp</value>
<value>TCP - Standard</value>
</option>
<option>
<name>TCP - STARTTLS</name>
<value>TCP - STARTTLS</value>
</option>
<option>
<name>SSL - Encrypted</name>
<value>ssl</value>
<value>SSL - Encrypted</value>
</option>
</options>
<description>&lt;br/&gt;The protocol used by the LDAP server. It can either be standard TCP or SSL encrypted.</description>
<description>&lt;br/&gt;The transport used by the LDAP server. It can either be standard TCP or SSL encrypted.</description>
</field>
<field>
<type>certca_selection</type>
<name>ldap_caref</name>
<displayname>Peer Certificate Authority</displayname>
<bindstofield>ovpnserver->step2->ldap_caref</bindstofield>
<description>&lt;br/&gt;The Certificate Authority for the LDAP server certificate. Used for SSL and STARTTLS.</description>
<add_to_certca_selection>global</add_to_certca_selection>
</field>
<field>
<name>ldap_protver</name>
<displayname>Protocol Version</displayname>
<type>select</type>
<options>
<option>
<name>3</name>
<value>3</value>
</option>
<option>
<name>2</name>
<value>2</value>
</option>
</options>
<bindstofield>ovpnserver->step2->ldap_protver</bindstofield>
</field>
<field>
<name>ldap_timeout</name>
<displayname>Server Timeout</displayname>
<type>input</type>
<size>40</size>
<value>25</value>
<bindstofield>ovpnserver->step2->ldap_timeout</bindstofield>
</field>
<field>
<name>scope</name>
<displayname>Search Scope Level</displayname>
<type>select</type>
<options>
<option>
<name>One Level</name>
<value>one</value>
</option>
<option>
<name>Entire Subtree</name>
<value>subtree</value>
</option>
<option>
<name>One Level</name>
<value>one</value>
</option>
</options>
<bindstofield>ovpnserver->step2->scope</bindstofield>
</field>
@ -179,6 +215,21 @@
<bindstofield>ovpnserver->step2->authscope</bindstofield>
<description>Semi-Colon separated. This will be prepended to the search base dn above or full container path can be specified.&lt;br/&gt;EXAMPLE: CN=Users;DC=example&lt;br/&gt;EXAMPLE: CN=Users,DC=example,DC=com;OU=OtherUsers,DC=example,DC=com </description>
</field>
<field>
<name>ldap_extended_enabled</name>
<displayname>Enable Extended Query</displayname>
<type>checkbox</type>
<typehint>Enable extended query.</typehint>
<bindstofield>ovpnserver->step2->ldap_extended_enabled</bindstofield>
</field>
<field>
<name>ldap_extended_query</name>
<displayname>Extended Query</displayname>
<type>input</type>
<size>40</size>
<description>Example: memberOf=CN=Groupname,OU=MyGroups,DC=example,DC=com</description>
<bindstofield>ovpnserver->step2->ldap_extended_query</bindstofield>
</field>
<field>
<name>userdn</name>
<displayname>LDAP Bind User DN</displayname>
@ -200,6 +251,7 @@
<displayname>User Naming Attribute</displayname>
<type>input</type>
<bindstofield>ovpnserver->step2->nameattr</bindstofield>
<value>cn</value>
<description>Typically "cn" (OpenLDAP, Novell eDirectory), "samAccountName" (Microsoft AD)</description>
</field>
<field>
@ -207,6 +259,7 @@
<displayname>Group Naming Attribute</displayname>
<type>input</type>
<bindstofield>ovpnserver->step2->groupattr</bindstofield>
<value>cn</value>
<description>Typically "cn" (OpenLDAP, Microsoft AD, and Novell eDirectory)</description>
</field>
<field>
@ -214,8 +267,41 @@
<displayname>Member Naming Attribute</displayname>
<type>input</type>
<bindstofield>ovpnserver->step2->memberattr</bindstofield>
<value>member</value>
<description>Typically "member" (OpenLDAP), "memberOf" (Microsoft AD), "uniqueMember" (Novell eDirectory)</description>
</field>
<field>
<name>ldap_rfc2307</name>
<displayname>RFC 2307 Groups</displayname>
<type>checkbox</type>
<typehint>LDAP Server uses RFC 2307 style group membership.</typehint>
<description>RFC 2307 style group membership has members listed on the group object rather than using groups listed on user object. Leave unchecked for Active Directory style group membership (RFC 2307bis).</description>
<bindstofield>ovpnserver->step2->ldap_rfc2307</bindstofield>
</field>
<field>
<name>ldap_attr_groupobj</name>
<displayname>Group Object Class</displayname>
<type>input</type>
<value>posixGroup</value>
<bindstofield>ovpnserver->step2->ldap_attr_groupobj</bindstofield>
<description>Object class used for groups in RFC2307 mode. Typically "posixGroup" or "group".</description>
</field>
<field>
<name>ldap_utf8</name>
<displayname>UTF8 Encode</displayname>
<type>checkbox</type>
<typehint>UTF8 encode LDAP parameters before sending them to the server.</typehint>
<description>Required to support international characters, but may not be supported by every LDAP server.</description>
<bindstofield>ovpnserver->step2->ldap_utf8</bindstofield>
</field>
<field>
<name>ldap_nostrip_at</name>
<displayname>Username Alterations</displayname>
<type>checkbox</type>
<typehint>Do not strip away parts of the username after the @ symbol.</typehint>
<description>e.g. user@host becomes user when unchecked.</description>
<bindstofield>ovpnserver->step2->ldap_nostrip_at</bindstofield>
</field>
<field>
<type>submit</type>
<name>Add new Server</name>