PHP ldap_get_dn函数代码示例

 private static function readFromLdapEntry($ldapconn, $entry)
 {
     $newUser = new User();
     $newUser->dn = ldap_get_dn($ldapconn, $entry);
     // Load attributes
     $att = ldap_get_attributes($ldapconn, $entry);
     if (isset($att['cn']) && $att['cn']['count'] == 1) {
         $newUser->cn = $att['cn'][0];
     }
     if (isset($att['mail']) && $att['mail']['count'] == 1) {
         $newUser->mail = $att['mail'][0];
     }
     if (isset($att['displayName']) && $att['displayName']['count'] == 1) {
         $newUser->displayName = $att['displayName'][0];
     }
     if (isset($att['sn']) && $att['sn']['count'] == 1) {
         $newUser->sn = $att['sn'][0];
     }
     if (isset($att['givenName']) && $att['givenName']['count'] == 1) {
         $newUser->givenName = $att['givenName'][0];
     }
     $groups = [];
     if (isset($att['memberOf'])) {
         for ($i = 0; $i < $att['memberOf']['count']; $i++) {
             $groups[] = $att['memberOf'][$i];
         }
     }
     $newUser->group_dns = $groups;
     $newUser->ldapconn = $ldapconn;
     return $newUser;
 }

 public function add_login($ad, $grupo, $user, $bdn, $ous)
 {
     try {
         $ous = "CN=" . $grupo . "," . $ous;
         if (self::login($ad, "rsanchez@aicollection.local", "Ac9a7533#Ed")) {
             ldap_set_option($ad, LDAP_OPT_PROTOCOL_VERSION, 3);
             ldap_set_option($ad, LDAP_OPT_REFERRALS, 0);
             $results = ldap_search($ad, $bdn, "(sAMAccountName={$user})", array("sn", "cn"), 0, 1);
             $entry = ldap_get_entries($ad, $results);
             $first = ldap_first_entry($ad, $results);
             $dn = ldap_get_dn($ad, $first);
             $data = $entry[0]['cn'][0];
             //$dn = str_replace($data, $user, $dn);
             //echo $dn;
             $user_array['member'] = $dn;
             //echo $ous;
             if (ldap_mod_add($ad, $ous, $user_array)) {
                 return 1;
             } else {
                 return 0;
             }
             //end if*/
         } else {
             return 0;
         }
         //end if
     } catch (Exception $e) {
         return 0;
     }
     //end try
 }

 /**
  * @return mixed resource
  */
 public function fetchEntry()
 {
     if (!$this->result_resource) {
         return null;
     }
     if (null === $this->entry_resource) {
         $this->entry_resource = ldap_first_entry($this->resource, $this->result_resource);
     } else {
         $this->entry_resource = ldap_next_entry($this->resource, $this->entry_resource);
     }
     if (!$this->entry_resource) {
         return null;
     }
     $dn = ldap_get_dn($this->resource, $this->entry_resource);
     $rawAttributes = ldap_get_attributes($this->resource, $this->entry_resource);
     $count = $rawAttributes['count'];
     $attributes = array();
     for ($i = 0; $i < $count; $i++) {
         $attribute = $rawAttributes[$i];
         $values = array();
         $subCount = $rawAttributes[$attribute]['count'];
         for ($j = 0; $j < $subCount; $j++) {
             $values[] = $rawAttributes[$attribute][$j];
         }
         $attributes[$attribute] = $values;
     }
     $object = new Object($dn, $attributes);
     return $object;
 }

 function getUserDn($username)
 {
     if ($this->send_utf8_credentials) {
         $username = studip_utf8encode($username);
         $reader_password = studip_utf8encode($this->reader_password);
     }
     $user_dn = "";
     if (!($r = @ldap_bind($this->conn, $this->reader_dn, $this->reader_password))) {
         $this->error_msg = sprintf(_("Anmeldung von %s fehlgeschlagen."), $this->reader_dn) . $this->getLdapError();
         return false;
     }
     if (!($result = @ldap_search($this->conn, $this->base_dn, $this->getLdapFilter($username), array('dn')))) {
         $this->error_msg = _("Durchsuchen des LDAP Baumes fehlgeschlagen.") . $this->getLdapError();
         return false;
     }
     if (!ldap_count_entries($this->conn, $result)) {
         $this->error_msg = sprintf(_("%s wurde nicht unterhalb von %s gefunden."), $username, $this->base_dn);
         return false;
     }
     if (!($entry = @ldap_first_entry($this->conn, $result))) {
         $this->error_msg = $this->getLdapError();
         return false;
     }
     if (!($user_dn = @ldap_get_dn($this->conn, $entry))) {
         $this->error_msg = $this->getLdapError();
         return false;
     }
     return $user_dn;
 }

 /**
  * Authenticates a user to LDAP
  *
  * @param $username
  * @param $password
  * @param bool|false $returnUser
  * @return bool true    if the username and/or password provided are valid
  *              false   if the username and/or password provided are invalid
  *         array of ldap_attributes if $returnUser is true
  */
 function ldap($username, $password, $returnUser = false)
 {
     $ldaphost = Setting::getSettings()->ldap_server;
     $ldaprdn = Setting::getSettings()->ldap_uname;
     $ldappass = Crypt::decrypt(Setting::getSettings()->ldap_pword);
     $baseDn = Setting::getSettings()->ldap_basedn;
     $filterQuery = Setting::getSettings()->ldap_auth_filter_query . $username;
     $ldapversion = Setting::getSettings()->ldap_version;
     // Connecting to LDAP
     $connection = ldap_connect($ldaphost) or die("Could not connect to {$ldaphost}");
     // Needed for AD
     ldap_set_option($connection, LDAP_OPT_REFERRALS, 0);
     ldap_set_option($connection, LDAP_OPT_PROTOCOL_VERSION, $ldapversion);
     try {
         if ($connection) {
             // binding to ldap server
             $ldapbind = ldap_bind($connection, $ldaprdn, $ldappass);
             if (($results = @ldap_search($connection, $baseDn, $filterQuery)) != false) {
                 $entry = ldap_first_entry($connection, $results);
                 if (($userDn = @ldap_get_dn($connection, $entry)) !== false) {
                     if (($isBound = ldap_bind($connection, $userDn, $password)) == "true") {
                         return $returnUser ? array_change_key_case(ldap_get_attributes($connection, $entry), CASE_LOWER) : true;
                     }
                 }
             }
         }
     } catch (Exception $e) {
         LOG::error($e->getMessage());
     }
     ldap_close($connection);
     return false;
 }

 /**
  * Authenticates a user to LDAP
  *
  * @return  true    if the username and/or password provided are valid
  *          false   if the username and/or password provided are invalid
  *
  */
 function ldap($username, $password)
 {
     $ldaphost = Config::get('ldap.url');
     $ldaprdn = Config::get('ldap.username');
     $ldappass = Config::get('ldap.password');
     $baseDn = Config::get('ldap.basedn');
     $filterQuery = Config::get('ldap.authentication.filter.query') . $username;
     // Connecting to LDAP
     $connection = ldap_connect($ldaphost) or die("Could not connect to {$ldaphost}");
     // Needed for AD
     ldap_set_option($connection, LDAP_OPT_REFERRALS, 0);
     try {
         if ($connection) {
             // binding to ldap server
             $ldapbind = ldap_bind($connection, $ldaprdn, $ldappass);
             if (($results = @ldap_search($connection, $baseDn, $filterQuery)) !== false) {
                 $entry = ldap_first_entry($connection, $results);
                 if (($userDn = @ldap_get_dn($connection, $entry)) !== false) {
                     if (($isBound = ldap_bind($connection, $userDn, $password)) == "true") {
                         return true;
                     }
                 }
             }
         }
     } catch (Exception $e) {
         LOG::error($e->getMessage());
     }
     ldap_close($connection);
     return false;
 }

function checkldapuser($username, $password)
{
    require 'config.php';
    $username = strtolower($username);
    $connect = ldap_connect($ldapServer);
    if ($connect != false) {
        ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);
        ldap_set_option($connect, LDAP_OPT_REFERRALS, 0);
        // enlace a la conexión
        $bind = ldap_bind($connect, $usrLDAP, $pwdLDAP);
        if ($bind == false) {
            $mensajeError = "Falla la conexión con el servidor LDAP con el usuario \n{$usrLDAP}";
            return $mensajeError;
        }
        // active directory - pch
        $bind = @ldap_bind($connect, "{$campoBusqLDAP}=" . $username . ",{$cadenaBusqLDAP}", $password);
        if ($bind == false) {
            $mensajeError = "Usuario o contraseña incorrecta";
            return $mensajeError;
        }
        // busca el usuario - pch
        if (($res_id = ldap_search($connect, $cadenaBusqLDAP, "{$campoBusqLDAP}=" . $username)) == false) {
            $mensajeError = "No encontrado el usuario en el LDAP";
            return $mensajeError;
        }
        $cant = ldap_count_entries($connect, $res_id);
        if ($cant == 0) {
            $mensajeError = "El usuario {$username} NO se encuentra en el A.D. {$bind} HLPHLP";
            return $mensajeError;
        }
        if ($cant > 1) {
            $mensajeError = "El usuario {$username} se encuentra {$cant} veces en el A.D.";
            return $mensajeError;
        }
        $entry_id = ldap_first_entry($connect, $res_id);
        if ($entry_id == false) {
            $mensajeError = "No se obtuvieron resultados";
            return $mensajeError;
        }
        if (($user_dn = ldap_get_dn($connect, $entry_id)) == false) {
            $mensajeError = "No se puede obtener el dn del usuario";
            return $mensajeError;
        }
        error_reporting(0);
        /* Autentica el usuario */
        if (($link_id = ldap_bind($connect, "{$user_dn}", $password)) == false) {
            error_reporting(0);
            $mensajeError = "USUARIO O CONTRASEÑA INCORRECTOS";
            return $mensajeError;
        }
        return '';
        @ldap_close($connect);
    } else {
        $mensajeError = "no hay conexión a '{$ldap_server}'";
        return $mensajeError;
    }
    @ldap_close($connect);
    return false;
}

 private function setEntry($entry)
 {
     if ($entry) {
         $this->_current_entry = $entry;
         $row = ldap_get_attributes($this->_link, $entry);
         $row["dn"] = ldap_get_dn($this->_link, $entry);
         return $row;
     }
 }

 function login($uid, $pwd, $ip = 0)
 {
     // connect to ldap-server
     // echo ("Host: ".$this->host." Port: ".$this->port." BaseDN: ".$this->basedn." UID: $uid, PWD: $pwd \n<br>\n");
     if ($connect = @ldap_connect($this->host)) {
         // if connected to ldap server, check for protocol version
         if (!@ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3)) {
             // echo "version 2<br>\n";
             $this->ldapver = 2;
         }
         // echo "verification on '$this->host': ";
         // bind to ldap connection
         if (($bind = @ldap_bind($connect)) == false) {
             // print "bind:__FAILED__<br>\n";
             return false;
         }
         // check whether we have an email address or an actual user id
         if (strpos($uid, '@') > 0) {
             $filter = "mail=" . $uid;
         } else {
             $filter = "uid=" . $uid;
         }
         // search for user
         if (($res_id = @ldap_search($connect, $this->basedn, $filter)) == false) {
             // print "failure: search in LDAP-tree failed<br>";
             return false;
         }
         if (@ldap_count_entries($connect, $res_id) != 1) {
             // print "failure: error looking up user $username<br>\n";
             return false;
         }
         if (($entry_id = @ldap_first_entry($connect, $res_id)) == false) {
             // print "failure: entry of searchresult couln't be fetched<br>\n";
             return false;
         }
         if (($user_dn = @ldap_get_dn($connect, $entry_id)) == false) {
             // print "failure: user-dn coulnd't be fetched<br>\n";
             return false;
         }
         // authenticate user
         if (($link_id = @ldap_bind($connect, $user_dn, $pwd)) == false) {
             // print "failure: username, password didn't match: $user_dn<br>\n";
             return false;
         }
         // login went fine, user login is ok
         @ldap_close($connect);
         $this->uid = $uid;
         return true;
     } else {
         // no conection to ldap server
         echo "no connection to '{$ldap_server}'<br>\n";
     }
     // echo "failed: ".ldap_error($connect)."<BR>\n";
     // something went wrong, cleanup and return false
     @ldap_close($connect);
     return false;
 }

function ldapauth_authenticate($username, $password)
{
    $ldap_server = get_config('ldapauth', 'ldap_server');
    $ldap_binddn = get_config('ldapauth', 'ldap_binddn');
    $ldap_bindpw = get_config('ldapauth', 'ldap_bindpw');
    $ldap_searchdn = get_config('ldapauth', 'ldap_searchdn');
    $ldap_userattr = get_config('ldapauth', 'ldap_userattr');
    $ldap_group = get_config('ldapauth', 'ldap_group');
    if (!(strlen($password) && function_exists('ldap_connect') && strlen($ldap_server))) {
        return false;
    }
    $connect = @ldap_connect($ldap_server);
    if (!$connect) {
        return false;
    }
    @ldap_set_option($connect, LDAP_OPT_PROTOCOL_VERSION, 3);
    @ldap_set_option($connect, LDAP_OPT_REFERRALS, 0);
    if (@ldap_bind($connect, $ldap_binddn, $ldap_bindpw) === false) {
        return false;
    }
    $res = @ldap_search($connect, $ldap_searchdn, $ldap_userattr . '=' . $username);
    if (!$res) {
        return false;
    }
    $id = @ldap_first_entry($connect, $res);
    if (!$id) {
        return false;
    }
    $dn = @ldap_get_dn($connect, $id);
    if (!@ldap_bind($connect, $dn, $password)) {
        return false;
    }
    if (!strlen($ldap_group)) {
        return true;
    }
    $r = @ldap_compare($connect, $ldap_group, 'member', $dn);
    if ($r === -1) {
        $err = @ldap_error($connect);
        $eno = @ldap_errno($connect);
        @ldap_close($connect);
        if ($eno === 32) {
            logger("ldapauth: access control group Does Not Exist");
            return false;
        } elseif ($eno === 16) {
            logger('ldapauth: membership attribute does not exist in access control group');
            return false;
        } else {
            logger('ldapauth: error: ' . $err);
            return false;
        }
    } elseif ($r === false) {
        @ldap_close($connect);
        return false;
    }
    return true;
}

 /**
  * Fetches the current entry.
  *
  * @return Entry
  */
 public function current()
 {
     $attributes = ldap_get_attributes($this->connection, $this->current);
     if (false === $attributes) {
         throw new LdapException(sprintf('Could not fetch attributes: %s', ldap_error($this->connection)));
     }
     $dn = ldap_get_dn($this->connection, $this->current);
     if (false === $dn) {
         throw new LdapException(sprintf('Could not fetch DN: %s', ldap_error($this->connection)));
     }
     return new Entry($dn, $attributes);
 }

 /**
  *	Realiza la autentificacion utilizando un servidor LDAP
  *	@return $value	Retorna TRUE o FALSE de acuerdo al estado de la autentifiacion
  */
 function autenticar($id_usuario, $clave, $datos_iniciales = null)
 {
     if (!extension_loaded('ldap')) {
         throw new toba_error("[Autenticación LDAP] no se encuentra habilitada la extensión LDAP");
     }
     $conexion = @ldap_connect($this->server);
     ldap_set_option($conexion, LDAP_OPT_PROTOCOL_VERSION, 3);
     if (!$conexion) {
         toba::logger()->error('[Autenticación LDAP] No es posible conectarse con el servidor: ' . ldap_error($conexion));
         return false;
     }
     //$bind = @ldap_bind($conexion);
     $bind = @ldap_bind($conexion, $this->bind_dn, $this->bind_pass);
     if (!$bind) {
         toba::logger()->error('[Autenticación LDAP] No es posible conectarse con el servidor: ' . ldap_error($conexion));
         return false;
     }
     $res_id = @ldap_search($conexion, $this->dn, sprintf($this->filter, $id_usuario));
     if (!$res_id) {
         toba::logger()->error('[Autenticación LDAP] Fallo búsqueda en el árbol: ' . ldap_error($conexion));
         return false;
     }
     $cantidad = ldap_count_entries($conexion, $res_id);
     if ($cantidad == 0) {
         toba::logger()->error("[Autenticación LDAP] El usuario {$id_usuario} no tiene una entrada en el árbol");
         return false;
     }
     if ($cantidad > 1) {
         toba::logger()->error("[Autenticación LDAP] El usuario {$id_usuario} tiene más de una entrada en el árbol");
         return false;
     }
     $entrada_id = ldap_first_entry($conexion, $res_id);
     if ($entrada_id == false) {
         toba::logger()->error("[Autenticación LDAP] No puede obtenerse el resultado de la búsqueda" . ldap_error($conexion));
         return false;
     }
     $usuario_dn = ldap_get_dn($conexion, $entrada_id);
     if ($usuario_dn == false) {
         toba::logger()->error("[Autenticación LDAP] No pude obtenerse el DN del usuario: " . ldap_error($conexion));
         return false;
     }
     $link_id = @ldap_bind($conexion, $usuario_dn, $clave);
     if ($link_id == false) {
         toba::logger()->error("[Autenticación LDAP] Usuario/Contraseña incorrecta: " . ldap_error($conexion));
         return false;
     }
     ldap_close($conexion);
     $usuario = $this->recuperar_usuario_toba($id_usuario);
     toba::logger()->debug("[Autenticación LDAP] OK");
     return true;
 }

 /**
  * LDAPEngine constructor to initialize object
  * @param string $uid user id
  * @param string $password password associated with uid
  */
 function LDAPEngine($uid, $password)
 {
     global $conf;
     $this->connected = false;
     if (strlen($uid) == 0 || strlen($password) == 0) {
         return;
     }
     $this->host = $conf['ldap']['host'];
     $this->port = $conf['ldap']['port'];
     $this->basedn = $conf['ldap']['basedn'];
     $this->AD_lookupid = $conf['ldap']['lookupid'];
     $this->AD_lookuppwd = $conf['ldap']['lookuppwd'];
     $this->ldap = ldap_connect($this->host, $this->port) or die("Could not connect to LDAP server.");
     $this->uid = $uid;
     if ($this->ldap) {
         $bind = $this->AD_lookupid ? @ldap_bind($this->ldap, $this->AD_lookupid, $this->AD_lookuppwd) : @ldap_bind($this->ldap);
         if ($bind) {
             // System authentication was a success, lookup user's dn via uid= filter
             $result = ldap_search($this->ldap, $this->basedn, "uid" . "=" . $this->uid);
             if (ldap_count_entries($this->ldap, $result) <= 0) {
                 print "<p>LDAPEngine: Search in LDAP failed. uid={$this->uid}<p>";
                 ldap_close($this->ldap);
                 return;
             } else {
                 $this->binddn = ldap_get_dn($this->ldap, ldap_first_entry($this->ldap, $result));
                 //print "<p>LDAPEngine: User binding as dn=".$this->binddn."<p>";
                 $bind2 = @ldap_bind($this->ldap, $this->binddn, $password);
                 if ($bind2) {
                     //print "<p>LDAPEngine: bind using user credentials successful.</p>";
                 } else {
                     //print "<p>LDAPEngine: bind using user credentials failed.</p>";
                     ldap_close($this->ldap);
                     return;
                 }
             }
             // ------------------------------------
             if ($this->loadUserData()) {
                 $this->connected = true;
                 $this->password = $password;
             } else {
                 ldap_close($this->ldap);
             }
         } else {
             die("LDAPEngine: Attempt to bind to:" . $this->host . " using systemid:" . $this->lookupid . " failed.");
             ldap_close($this->ldap);
         }
     }
 }

 /**
  * Auxiliar directo de ldapAccess::iterarEntradas
  * Configura el valor de cada atributos en $atributos de $entrada
  * @param array $atributos
  * @param ldap result entry $entrada
  * @return type
  */
 private function mapa(array $atributos, $entrada)
 {
     $objeto = array('dn' => ldap_get_dn($this->conexionLdap, $entrada));
     foreach ($atributos as $attr) {
         if ($valor = @ldap_get_values($this->conexionLdap, $entrada, $attr)) {
             // Elimino el índice count
             array_pop($valor);
             // $valor es un array.
             // En caso de ser valor único, tomamos el indíce cero, caso contrario
             // metemos todo el array
             $objeto[$attr] = count($valor) == 1 ? $valor[0] : $valor;
         }
         // TODO: ¿Un else para configurar un valor por defecto
     }
     return $objeto;
 }

function bh_authenticate($username, $password)
{
    global $bhconfig;
    // first, verify that the user is allowed to use this application
    // look for the user in the user table
    $authrows = select_bhdb("users", array('username' => $username), 1);
    if (empty($authrows)) {
        return 0;
    } elseif ($authrows[0]['disabled'] == 1) {
        return -1;
    }
    // now check against LDAP
    $port = $bhconfig['ldapport'] ? $bhconfig['ldapport'] : 389;
    // Connect to LDAP server
    $ds = @ldap_connect($bhconfig['ldapsrv'], $port);
    if ($ds) {
        // Bind as anonymous
        $r = @ldap_bind($ds);
        // find user entry in the tree
        $sr = @ldap_search($ds, $bhconfig['ldapbase'], $bhconfig['ldapattr'] . "={$username}");
        // Must find one entry, no more no less
        if (@ldap_count_entries($ds, $sr) != 1) {
            // user unknown
            @ldap_close($ds);
            return false;
        }
        // find entry in the result set
        if (($entry = @ldap_first_entry($ds, $sr)) == false) {
            // user unknown
            @ldap_close($ds);
            return 0;
        }
        // bind as the user to verify pasword
        $dn = ldap_get_dn($ds, $entry);
        $r = @ldap_bind($ds, $dn, $password);
        // Link no longer needed
        @ldap_close($ds);
        if ($r) {
            return true;
        } else {
            return false;
        }
    } else {
        return false;
    }
}