dolibarr  21.0.0-alpha
functions_ldap.php
Go to the documentation of this file.
1 <?php
2 /* Copyright (C) 2007-2011 Laurent Destailleur <eldy@users.sourceforge.net>
3  * Copyright (C) 2008-2021 Regis Houssin <regis.houssin@inodbox.com>
4  * Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 3 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program. If not, see <https://www.gnu.org/licenses/>.
18  *
19  */
20 
37 function check_user_password_ldap($usertotest, $passwordtotest, $entitytotest)
38 {
39  global $db, $conf, $langs;
40  global $dolibarr_main_auth_ldap_host, $dolibarr_main_auth_ldap_port;
41  global $dolibarr_main_auth_ldap_version, $dolibarr_main_auth_ldap_servertype;
42  global $dolibarr_main_auth_ldap_login_attribute, $dolibarr_main_auth_ldap_dn;
43  global $dolibarr_main_auth_ldap_admin_login, $dolibarr_main_auth_ldap_admin_pass;
44  global $dolibarr_main_auth_ldap_filter;
45  global $dolibarr_main_auth_ldap_debug;
46 
47  // Force master entity in transversal mode
48  $entity = $entitytotest;
49  if (isModEnabled('multicompany') && getDolGlobalString('MULTICOMPANY_TRANSVERSE_MODE')) {
50  $entity = 1;
51  }
52 
53  $login = '';
54  $resultFetchUser = '';
55 
56  if (!function_exists("ldap_connect")) {
57  dol_syslog("functions_ldap::check_user_password_ldap Authentication KO failed to connect to LDAP. LDAP functions are disabled on this PHP", LOG_ERR);
58  sleep(1);
59 
60  // Load translation files required by the page
61  $langs->loadLangs(array('main', 'other'));
62 
63  $_SESSION["dol_loginmesg"] = $langs->transnoentitiesnoconv("ErrorLDAPFunctionsAreDisabledOnThisPHP").' '.$langs->transnoentitiesnoconv("TryAnotherConnectionMode");
64  return '';
65  }
66 
67  if ($usertotest) {
68  dol_syslog("functions_ldap::check_user_password_ldap usertotest=".$usertotest." passwordtotest=".preg_replace('/./', '*', $passwordtotest)." entitytotest=".$entitytotest);
69 
70  // If test username/password asked, we define $test=false and $login var if ok, set $_SESSION["dol_loginmesg"] if ko
71  $ldaphost = $dolibarr_main_auth_ldap_host;
72  $ldapport = $dolibarr_main_auth_ldap_port;
73  $ldapversion = $dolibarr_main_auth_ldap_version;
74  $ldapservertype = (empty($dolibarr_main_auth_ldap_servertype) ? 'openldap' : $dolibarr_main_auth_ldap_servertype);
75 
76  $ldapuserattr = $dolibarr_main_auth_ldap_login_attribute;
77  $ldapdn = $dolibarr_main_auth_ldap_dn;
78  $ldapadminlogin = $dolibarr_main_auth_ldap_admin_login;
79  $ldapadminpass = $dolibarr_main_auth_ldap_admin_pass;
80  $ldapdebug = ((empty($dolibarr_main_auth_ldap_debug) || $dolibarr_main_auth_ldap_debug == "false") ? false : true);
81 
82  if ($ldapdebug) {
83  print "DEBUG: Logging LDAP steps<br>\n";
84  }
85 
86  require_once DOL_DOCUMENT_ROOT.'/core/class/ldap.class.php';
87  $ldap = new Ldap();
88  $ldap->server = explode(',', $ldaphost);
89  $ldap->serverPort = $ldapport;
90  $ldap->ldapProtocolVersion = $ldapversion;
91  $ldap->serverType = $ldapservertype;
92  $ldap->searchUser = $ldapadminlogin;
93  $ldap->searchPassword = $ldapadminpass;
94 
95  if ($ldapdebug) {
96  dol_syslog("functions_ldap::check_user_password_ldap Server:".implode(',', $ldap->server).", Port:".$ldap->serverPort.", Protocol:".$ldap->ldapProtocolVersion.", Type:".$ldap->serverType);
97  dol_syslog("functions_ldap::check_user_password_ldap uid/samaccountname=".$ldapuserattr.", dn=".$ldapdn.", Admin:".$ldap->searchUser.", Pass:".dol_trunc($ldap->searchPassword, 3));
98  print "DEBUG: Server:".implode(',', $ldap->server).", Port:".$ldap->serverPort.", Protocol:".$ldap->ldapProtocolVersion.", Type:".$ldap->serverType."<br>\n";
99  print "DEBUG: uid/samaccountname=".$ldapuserattr.", dn=".$ldapdn.", Admin:".$ldap->searchUser.", Pass:".dol_trunc($ldap->searchPassword, 3)."<br>\n";
100  }
101 
102  $resultFetchLdapUser = 0;
103 
104  // Define $userSearchFilter
105  $userSearchFilter = "";
106  if (empty($dolibarr_main_auth_ldap_filter)) {
107  $userSearchFilter = "(".$ldapuserattr."=".$usertotest.")";
108  } else {
109  // @phan-suppress-next-line PhanPluginSuspiciousParamOrderInternal
110  $userSearchFilter = str_replace('%1%', $usertotest, $dolibarr_main_auth_ldap_filter);
111  }
112 
113  // If admin login or ldap auth filter provided
114  // Code to get user in LDAP from an admin connection (may differ from user connection, done later)
115  if ($ldapadminlogin || $dolibarr_main_auth_ldap_filter) {
116  $result = $ldap->connectBind();
117  if ($result > 0) {
118  $resultFetchLdapUser = $ldap->fetch($usertotest, $userSearchFilter);
119  //dol_syslog('functions_ldap::check_user_password_ldap resultFetchLdapUser='.$resultFetchLdapUser);
120  if ($resultFetchLdapUser > 0 && $ldap->pwdlastset == 0) { // If ok but password need to be reset
121  dol_syslog('functions_ldap::check_user_password_ldap '.$usertotest.' must change password next logon');
122  if ($ldapdebug) {
123  print "DEBUG: User ".$usertotest." must change password<br>\n";
124  }
125  $ldap->unbind();
126  sleep(1); // Anti brut force protection. Must be same delay when user and password are not valid.
127  $langs->load('ldap');
128  $_SESSION["dol_loginmesg"] = $langs->transnoentitiesnoconv("YouMustChangePassNextLogon", $usertotest, $ldap->domainFQDN);
129  return '';
130  }
131  } else {
132  if ($ldapdebug) {
133  print "DEBUG: ".$ldap->error."<br>\n";
134  }
135  }
136  $ldap->unbind();
137  }
138 
139  // Forge LDAP user and password to test with them
140  // If LDAP need a dn with login like "uid=jbloggs,ou=People,dc=foo,dc=com", default dn may work even if previous code with
141  // admin login no executed.
142  $ldap->searchUser = $ldapuserattr."=".$usertotest.",".$ldapdn; // Default dn (will work if LDAP accept a dn with login value inside)
143  // But if LDAP need a dn with name like "cn=Jhon Bloggs,ou=People,dc=foo,dc=com", previous part must have been executed to have
144  // dn detected into ldapUserDN.
145  if ($resultFetchLdapUser && !empty($ldap->ldapUserDN)) {
146  $ldap->searchUser = $ldap->ldapUserDN;
147  }
148  $ldap->searchPassword = $passwordtotest;
149 
150  // Test with this->seachUser and this->searchPassword
151  //print $resultFetchLdapUser."-".$ldap->ldapUserDN."-".$ldap->searchUser.'-'.$ldap->searchPassword;exit;
152  $result = $ldap->connectBind();
153  if ($result > 0) {
154  if ($result == 2) { // Connection is ok for user/pass into LDAP
155  $login = $usertotest;
156  dol_syslog("functions_ldap::check_user_password_ldap $login authentication ok");
157  // For the case, we search the user id using a search key without the login (but using other fields like id),
158  // we need to get the real login to use in the ldap answer.
159  if (getDolGlobalString('LDAP_FIELD_LOGIN') && !empty($ldap->login)) {
160  $login = $ldap->login;
161  dol_syslog("functions_ldap::check_user_password_ldap login is now $login (LDAP_FIELD_LOGIN=".getDolGlobalString('LDAP_FIELD_LOGIN').")");
162  }
163 
164  require_once DOL_DOCUMENT_ROOT.'/core/lib/date.lib.php';
165 
166  // Note: Test on date validity is done later natively with isNotIntoValidityDateRange() by core after calling checkLoginPassEntity() that call this method
167 
168  // ldap2dolibarr synchronisation
169  if ($login && !empty($conf->ldap->enabled) && getDolGlobalInt('LDAP_SYNCHRO_ACTIVE') == Ldap::SYNCHRO_LDAP_TO_DOLIBARR) { // ldap2dolibarr synchronization
170  dol_syslog("functions_ldap::check_user_password_ldap Sync ldap2dolibarr");
171 
172  // On charge les attributes du user ldap
173  if ($ldapdebug) {
174  print "DEBUG: login ldap = ".$login."<br>\n";
175  }
176  $resultFetchLdapUser = $ldap->fetch($login, $userSearchFilter);
177 
178  if ($ldapdebug) {
179  print "DEBUG: UACF = ".implode(',', $ldap->uacf)."<br>\n";
180  }
181  if ($ldapdebug) {
182  print "DEBUG: pwdLastSet = ".dol_print_date($ldap->pwdlastset, 'day')."<br>\n";
183  }
184  if ($ldapdebug) {
185  print "DEBUG: badPasswordTime = ".dol_print_date($ldap->badpwdtime, 'day')."<br>\n";
186  }
187 
188  // On recherche le user dolibarr en fonction de son SID ldap (only for Active Directory)
189  $sid = null;
190  if (getDolGlobalString('LDAP_SERVER_TYPE') == "activedirectory") {
191  $sid = $ldap->getObjectSid($login);
192  if ($ldapdebug) {
193  print "DEBUG: sid = ".$sid."<br>\n";
194  }
195  }
196 
197  $usertmp = new User($db);
198  $resultFetchUser = $usertmp->fetch('', $login, $sid, 1, ($entitytotest > 0 ? $entitytotest : -1));
199  if ($resultFetchUser > 0) {
200  dol_syslog("functions_ldap::check_user_password_ldap Sync user found user id=".$usertmp->id);
201  // Verify if the login changed and update the Dolibarr attributes
202 
203  if ($usertmp->login != $ldap->login && $ldap->login) {
204  $usertmp->login = $ldap->login;
205  $usertmp->update($usertmp);
206  // TODO What to do if the update fails because the login already exists for another account.
207  }
208 
209  //$resultUpdate = $usertmp->update_ldap2dolibarr($ldap);
210  }
211 
212  unset($usertmp);
213  }
214 
215  if (isModEnabled('multicompany')) { // We must check entity (even if sync is not active)
216  global $mc;
217 
218  $usertmp = new User($db);
219  $usertmp->fetch('', $login);
220  if (is_object($mc)) {
221  $ret = $mc->checkRight($usertmp->id, $entitytotest);
222  if ($ret < 0) {
223  dol_syslog("functions_ldap::check_user_password_ldap Authentication KO entity '".$entitytotest."' not allowed for user id '".$usertmp->id."'", LOG_NOTICE);
224  $login = ''; // force authentication failure
225  }
226  unset($usertmp);
227  }
228  }
229  }
230  if ($result == 1) {
231  dol_syslog("functions_ldap::check_user_password_ldap Authentication KO bad user/password for '".$usertotest."'", LOG_NOTICE);
232  sleep(1); // Anti brut force protection. Must be same delay when user and password are not valid.
233 
234  // Load translation files required by the page
235  $langs->loadLangs(array('main', 'other'));
236 
237  $_SESSION["dol_loginmesg"] = $langs->transnoentitiesnoconv("ErrorBadLoginPassword");
238  }
239  } else {
240  /* Login failed. Return false, together with the error code and text from
241  ** the LDAP server. The common error codes and reasons are listed below :
242  ** (for iPlanet, other servers may differ)
243  ** 19 - Account locked out (too many invalid login attempts)
244  ** 32 - User does not exist
245  ** 49 - Wrong password
246  ** 53 - Account inactive (manually locked out by administrator)
247  */
248  dol_syslog("functions_ldap::check_user_password_ldap Authentication KO failed to connect to LDAP for '".$usertotest."'", LOG_NOTICE);
249  if (is_resource($ldap->connection) || is_object($ldap->connection)) { // If connection ok but bind ko
250  // @phan-suppress-next-line PhanTypeMismatchArgumentInternal Expects LDAP\Connection, not 'resource'
251  $ldap->ldapErrorCode = ldap_errno($ldap->connection);
252  // @phan-suppress-next-line PhanTypeMismatchArgumentInternal Expects LDAP\Connection, not 'resource'
253  $ldap->ldapErrorText = ldap_error($ldap->connection);
254  dol_syslog("functions_ldap::check_user_password_ldap ".$ldap->ldapErrorCode." ".$ldap->ldapErrorText);
255  }
256  sleep(1); // Anti brut force protection. Must be same delay when user and password are not valid.
257 
258  // Load translation files required by the page
259  $langs->loadLangs(array('main', 'other', 'errors'));
260  $_SESSION["dol_loginmesg"] = ($ldap->error ? $ldap->error : $langs->transnoentitiesnoconv("ErrorBadLoginPassword"));
261  }
262 
263  $ldap->unbind();
264  }
265 
266  return $login;
267 }
Class to manage LDAP features.
Definition: ldap.class.php:37
Class to manage Dolibarr users.
Definition: user.class.php:50
getDolGlobalInt($key, $default=0)
Return a Dolibarr global constant int value.
dol_trunc($string, $size=40, $trunc='right', $stringencoding='UTF-8', $nodot=0, $display=0)
Truncate a string to a particular length adding '…' if string larger than length.
getDolGlobalString($key, $default='')
Return dolibarr global constant string value.
isModEnabled($module)
Is Dolibarr module enabled.
dol_syslog($message, $level=LOG_INFO, $ident=0, $suffixinfilename='', $restricttologhandler='', $logcontext=null)
Write log message into outputs.
check_user_password_ldap($usertotest, $passwordtotest, $entitytotest)
Check validity of user/password/entity If test is ko, reason must be filled into $_SESSION["dol_login...