PHP Ldap类代码示例

 public function testGetAttributes()
 {
     $ldap = new Ldap($this->container);
     $this->assertCount(3, $ldap->getProfileAttributes());
     $this->assertContains(LDAP_ACCOUNT_FULLNAME, $ldap->getProfileAttributes());
     $this->assertContains(LDAP_ACCOUNT_EMAIL, $ldap->getProfileAttributes());
     $this->assertContains(LDAP_ACCOUNT_MEMBEROF, $ldap->getProfileAttributes());
 }

 /**
  * plugin installation
  *
  * perform here all needed step for the plugin installation
  * such as create default config, add database tables,
  * add fields to existing tables, create local folders...
  */
 function install($plugin_version, &$errors = array())
 {
     global $conf;
     $config = new Ldap();
     if (file_exists(LDAP_LOGIN_PATH . 'data.dat')) {
         $config->load_config();
     } else {
         $config->load_default_config();
     }
     $config->save_config();
     $this->installed = true;
 }

 /**
  * Gather user information
  *
  * @param string $username Find information for 'username'
  * @param string $info Required attribute of the user account object
  * @return null|string User information
  * @throws Exception
  */
 public function getUserInformation($username, $info)
 {
     $toReturn = null;
     $db = new RecordSet($this->dbConnectionInfo, false, true);
     $information = $db->Open("SELECT email FROM users WHERE userName = '" . $username . "' AND password != '';");
     switch ($information) {
         case 1:
             // User found in local database
             $toReturn = $db->Field('email');
             break;
         case 0:
             // User not found in local database
             // Try to find it in LDAP
             if ($this->ldap instanceof Ldap) {
                 try {
                     $information = $this->ldap->getUserInfo($username, array($info));
                     $toReturn = @$information[0][$info][0];
                 } catch (Exception $e) {
                     throw new Exception($e->getMessage());
                 }
             }
             break;
         default:
             throw new Exception('No or more than one email address found for ' . $username);
     }
     return $toReturn;
 }

 public function testFailedSearch()
 {
     if ($this->skipIfNoLdap()) {
         return;
     }
     $mock = $this->getMock('Bart\\PHPLDAP');
     $mock->expects($this->exactly(2))->method('ldap_bind')->will($this->returnValueMap(array(array('conn', 'binduser', 'bindpw', true), array('conn', $this->brayDN, 'jbraynardpwd', false))));
     $this->stubSearchSequence($mock);
     Diesel::registerInstantiator('Bart\\PHPLDAP', function () use($mock) {
         return $mock;
     });
     $ldap = new Ldap($this->config);
     $ldap->connect();
     $this->assertThrows('\\Bart\\LdapException', "LDAP Auth: failure, username/password did not match for {$this->brayDN}", function () use($mock, $ldap) {
         $ldap->auth_user('jbraynard', 'jbraynardpwd');
     });
 }

 public static function getLdapMemberGroups()
 {
     if (Ldap::getConnection()) {
         $query = ldap_search(Ldap::getConnection(), 'CN=groups,' . $GLOBALS['TL_CONFIG']['ldap_base'], "(objectClass=*)", LdapMemberGroup::getAttributes());
         if (!$query) {
             return false;
         }
         $found = ldap_get_entries(Ldap::getConnection(), $query);
         // groups not found
         if (!is_array($found) || count($found) <= 0) {
             return false;
         }
         return $found;
     } else {
         return false;
     }
 }

 public static function findLdapMember($strUsername)
 {
     if (Ldap::getConnection()) {
         $user_name_filter = $GLOBALS['TL_CONFIG']['ldap_uid'] . '=' . $strUsername;
         $filter = '(&(' . $user_name_filter . ')' . $GLOBALS['TL_CONFIG']['ldap_filter_person'] . ')';
         // search by username
         $query = ldap_search(Ldap::getConnection(), $GLOBALS['TL_CONFIG']['ldap_base'], $filter, LdapMember::getAttributes());
         if (!$query) {
             return null;
         }
         $found = ldap_get_entries(Ldap::getConnection(), $query);
         // user not found
         if (!is_array($found) || count($found) <= 0) {
             return null;
         }
         $found = (object) $found[0];
         return $found;
     } else {
         return null;
     }
 }

 public static function authenticateLdapMember($strUsername, $strPassword)
 {
     $objLdapUser = LdapMemberModel::findLdapMember($strUsername);
     if ($objLdapUser) {
         if (!@ldap_bind(Ldap::getConnection(), $objLdapUser->dn, $strPassword)) {
             $errno = ldap_errno(Ldap::getConnection());
             switch ($errno) {
                 case static::LDAP_INVALID_CREDENTIALS:
                     return false;
             }
             return false;
         }
         // ldap account requires an valid email and uid
         if ($objLdapUser->uid['count'] == 0 || $objLdapUser->mail['count'] == 0) {
             \Message::addError($GLOBALS['TL_LANG']['MSC']['ldap']['emailUidMissing']);
             return false;
         }
         return true;
     } else {
         return false;
     }
 }

 /**
  * Buscar al usuario en un grupo.
  *
  * @param string $userLogin con el login del usuario
  * @throws \Exception
  * @return bool
  */
 public static function searchADUserInGroup($userLogin)
 {
     if (Ldap::$_isADS === false) {
         return false;
     }
     $log = new Log(__FUNCTION__);
     $ldapGroup = Config::getValue('ldap_group');
     // El filtro de grupo no está establecido
     if (empty($ldapGroup)) {
         return true;
     }
     // Obtenemos el DN del grupo
     if (!($groupDN = Ldap::searchGroupDN())) {
         return false;
     }
     $filter = '(memberof:1.2.840.113556.1.4.1941:=' . $groupDN . ')';
     $filterAttr = array("sAMAccountName");
     $searchRes = @ldap_search(Ldap::$_ldapConn, Ldap::$_searchBase, $filter, $filterAttr);
     if (!$searchRes) {
         $log->addDescription(_('Error al buscar el grupo de usuarios'));
         $log->addDescription('LDAP ERROR: ' . ldap_error(Ldap::$_ldapConn) . '(' . ldap_errno(Ldap::$_ldapConn) . ')');
         $log->addDescription('LDAP FILTER: ' . $filter);
         $log->writeLog();
         throw new \Exception(_('Error al buscar el grupo de usuarios'));
     }
     if (@ldap_count_entries(Ldap::$_ldapConn, $searchRes) === 0) {
         $log->addDescription(_('No se encontró el grupo con ese nombre'));
         $log->addDescription('LDAP ERROR: ' . ldap_error(Ldap::$_ldapConn) . '(' . ldap_errno(Ldap::$_ldapConn) . ')');
         $log->addDescription('LDAP FILTER: ' . $filter);
         $log->writeLog();
         throw new \Exception(_('No se encontró el grupo con ese nombre'));
     }
     foreach (ldap_get_entries(Ldap::$_ldapConn, $searchRes) as $entry) {
         if ($userLogin === $entry['samaccountname'][0]) {
             return true;
         }
     }
     return false;
 }

 public function __construct(Ldap $link, $result = null)
 {
     $this->result = $result;
     if (is_resource($result)) {
         // Get the status code, matched DN and referrals from the response
         ldap_parse_result($link->resource(), $result, $this->code, $this->matchedDN, $this->message, $this->referrals);
         // Get the string representation of the status code
         $this->message = ldap_err2str($this->code);
         // Extract the data from the resource
         $this->data = ldap_get_entries($link->resource(), $result);
         $this->data = $this->cleanup_result($this->data);
         // Remove the referrals array if there's nothing inside
         count($this->referrals) == 0 && ($this->referrals = null);
         // Try to extract pagination cookie and estimated number of objects to be returned
         // Since there's no way to tell if pagination has been enabled or not, I am suppressing php errors
         @ldap_control_paged_result_response($link->resource(), $result, $this->cookie, $this->estimated);
     } else {
         $this->code = ldap_errno($link->resource());
         $this->message = ldap_error($link->resource());
     }
     // Active Directory conceals some additional error codes in the ErrorMessage of the response
     // that we cannot get to with ldap_errno() in authentication failures - let's try to
     // extract them!
     if ($this->code == 49) {
         $message = null;
         ldap_get_option($link->resource(), Option::ErrorString, $message);
         if (stripos($message, 'AcceptSecurityContext') !== false) {
             $message = explode(', ', $message);
             end($message);
             $message = prev($message);
             $this->code = explode(' ', $message)[1];
             // For compatibility reasons with standard ldap, if the error code
             // is 52e let's replace it with 49 ( their meanings are equal, it's just
             // Microsoft doing it its own way again )
             if ($this->code == '52e') {
                 $this->code = ResponseCode::InvalidCredentials;
             }
         }
     }
 }

 /**
  *      Function called when a Dolibarrr business event is done.
  *      All functions "run_trigger" are triggered if file is inside directory htdocs/includes/triggers
  *      @param      action      Event code (COMPANY_CREATE, PROPAL_VALIDATE, ...)
  *      @param      object      Object action is done on
  *      @param      user        Object user
  *      @param      langs       Object langs
  *      @param      conf        Object conf
  *      @return     int         <0 if KO, 0 if no action are done, >0 if OK
  */
 function run_trigger($action, $object, $user, $langs, $conf)
 {
     if (empty($conf->ldap->enabled)) {
         return 0;
     }
     // Module not active, we do nothing
     if (!function_exists('ldap_connect')) {
         dol_syslog("Warning, module LDAP is enabled but LDAP functions not available in this PHP", LOG_WARNING);
         return 0;
     }
     // Users
     if ($action == 'USER_CREATE') {
         dol_syslog("Trigger '" . $this->name . "' for action '{$action}' launched by " . __FILE__ . ". id=" . $object->id);
         if ($conf->ldap->enabled && $conf->global->LDAP_SYNCHRO_ACTIVE == 'dolibarr2ldap') {
             $ldap = new Ldap();
             $ldap->connect_bind();
             $info = $object->_load_ldap_info();
             $dn = $object->_load_ldap_dn($info);
             $result = $ldap->add($dn, $info, $user);
             if ($result < 0) {
                 $this->error = "ErrorLDAP" . " " . $ldap->error;
             }
             return $result;
         }
     } elseif ($action == 'USER_MODIFY') {
         dol_syslog("Trigger '" . $this->name . "' for action '{$action}' launched by " . __FILE__ . ". id=" . $object->id);
         if ($conf->ldap->enabled && $conf->global->LDAP_SYNCHRO_ACTIVE == 'dolibarr2ldap') {
             $ldap = new Ldap();
             $ldap->connect_bind();
             $oldinfo = $object->oldcopy->_load_ldap_info();
             $olddn = $object->oldcopy->_load_ldap_dn($oldinfo);
             // Verify if entry exist
             $container = $object->oldcopy->_load_ldap_dn($oldinfo, 1);
             $search = "(" . $object->oldcopy->_load_ldap_dn($oldinfo, 2) . ")";
             $records = $ldap->search($container, $search);
             if (sizeof($records) && $records['count'] == 0) {
                 $olddn = '';
             }
             $info = $object->_load_ldap_info();
             $dn = $object->_load_ldap_dn($info);
             $result = $ldap->update($dn, $info, $user, $olddn);
             if ($result < 0) {
                 $this->error = "ErrorLDAP" . " " . $ldap->error;
             }
             return $result;
         }
     } elseif ($action == 'USER_NEW_PASSWORD') {
         dol_syslog("Trigger '" . $this->name . "' for action '{$action}' launched by " . __FILE__ . ". id=" . $object->id);
         if ($conf->ldap->enabled && $conf->global->LDAP_SYNCHRO_ACTIVE == 'dolibarr2ldap') {
             $ldap = new Ldap();
             $ldap->connect_bind();
             $oldinfo = $object->oldcopy->_load_ldap_info();
             $olddn = $object->oldcopy->_load_ldap_dn($oldinfo);
             // Verify if entry exist
             $container = $object->oldcopy->_load_ldap_dn($oldinfo, 1);
             $search = "(" . $object->oldcopy->_load_ldap_dn($oldinfo, 2) . ")";
             $records = $ldap->search($container, $search);
             if (sizeof($records) && $records['count'] == 0) {
                 $olddn = '';
             }
             $info = $object->_load_ldap_info();
             $dn = $object->_load_ldap_dn($info);
             $result = $ldap->update($dn, $info, $user, $olddn);
             if ($result < 0) {
                 $this->error = "ErrorLDAP" . " " . $ldap->error;
             }
             return $result;
         }
     } elseif ($action == 'USER_ENABLEDISABLE') {
         dol_syslog("Trigger '" . $this->name . "' for action '{$action}' launched by " . __FILE__ . ". id=" . $object->id);
     } elseif ($action == 'USER_DELETE') {
         dol_syslog("Trigger '" . $this->name . "' for action '{$action}' launched by " . __FILE__ . ". id=" . $object->id);
         if ($conf->ldap->enabled && $conf->global->LDAP_SYNCHRO_ACTIVE == 'dolibarr2ldap') {
             $ldap = new Ldap();
             $ldap->connect_bind();
             $info = $object->_load_ldap_info();
             $dn = $object->_load_ldap_dn($info);
             $result = $ldap->delete($dn, $info, $user);
             if ($result < 0) {
                 $this->error = "ErrorLDAP" . " " . $ldap->error;
             }
             return $result;
         }
     } elseif ($action == 'GROUP_CREATE') {
         if ($conf->ldap->enabled && $conf->global->LDAP_SYNCHRO_ACTIVE == 'dolibarr2ldap') {
             $ldap = new Ldap();
             $ldap->connect_bind();
             $info = $object->_load_ldap_info();
             $dn = $object->_load_ldap_dn($info);
             // Get a gid number for objectclass PosixGroup
//.........这里部分代码省略.........

if (!empty($conf->global->LDAP_CONTACT_ACTIVE) && $conf->global->LDAP_CONTACT_ACTIVE != 'ldap2dolibarr') {
    print '<a class="butAction" href="' . $_SERVER["PHP_SELF"] . '?id=' . $contact->id . '&amp;action=dolibarr2ldap">' . $langs->trans("ForceSynchronize") . '</a>';
}
print "</div>\n";
if (!empty($conf->global->LDAP_CONTACT_ACTIVE) && $conf->global->LDAP_CONTACT_ACTIVE != 'ldap2dolibarr') {
    print "<br>\n";
}
// Affichage attributs LDAP
print_titre($langs->trans("LDAPInformationsForThisContact"));
print '<table width="100%" class="noborder">';
print '<tr class="liste_titre">';
print '<td>' . $langs->trans("LDAPAttributes") . '</td>';
print '<td>' . $langs->trans("Value") . '</td>';
print '</tr>';
// Lecture LDAP
$ldap = new Ldap();
$result = $ldap->connect_bind();
if ($result > 0) {
    $info = $contact->_load_ldap_info();
    $dn = $contact->_load_ldap_dn($info, 1);
    $search = "(" . $contact->_load_ldap_dn($info, 2) . ")";
    $records = $ldap->getAttribute($dn, $search);
    //var_dump($records);
    // Affichage arbre
    if (count($records) && $records != false && (!isset($records['count']) || $records['count'] > 0)) {
        if (!is_array($records)) {
            print '<tr ' . $bc[false] . '><td colspan="2"><font class="error">' . $langs->trans("ErrorFailedToReadLDAP") . '</font></td></tr>';
        } else {
            $result = show_ldap_content($records, 0, $records['count'], true);
        }
    } else {

    if ($num) {
        while ($i < $num) {
            $obj = $db->fetch_object($resql);
            if ($obj) {
                //print 'Load cache for country '.strtolower($obj->label).' rowid='.$obj->rowid."\n";
                $hashlib2rowid[strtolower($obj->label)] = $obj->rowid;
                $countries[$obj->rowid] = array('rowid' => $obj->rowid, 'label' => $obj->label, 'code' => $obj->code);
            }
            $i++;
        }
    }
} else {
    dol_print_error($db);
    exit(-1);
}
$ldap = new Ldap();
$result = $ldap->connect_bind();
if ($result >= 0) {
    $justthese = array();
    // We disable synchro Dolibarr-LDAP
    $conf->global->LDAP_MEMBER_ACTIVE = 0;
    $ldaprecords = $ldap->getRecords('*', $conf->global->LDAP_MEMBER_DN, $conf->global->LDAP_KEY_MEMBERS, $required_fields, 0);
    if (is_array($ldaprecords)) {
        $db->begin();
        // Warning $ldapuser has a key in lowercase
        foreach ($ldaprecords as $key => $ldapuser) {
            $member = new Adherent($db);
            // Propriete membre
            $member->firstname = $ldapuser[$conf->global->LDAP_FIELD_FIRSTNAME];
            $member->lastname = $ldapuser[$conf->global->LDAP_FIELD_NAME];
            $member->login = $ldapuser[$conf->global->LDAP_FIELD_LOGIN];

    print "<tr>" . '<td align="center" colspan="2"><input class="button" value="' . $langs->trans("CreateUser") . '" type="submit"></td></tr>';
    print "</table>\n";
    print "</form>";
} else {
    /* ************************************************************************** */
    /*                                                                            */
    /* Visu et edition                                                            */
    /*                                                                            */
    /* ************************************************************************** */
    if ($id) {
        $fuser = new User($db);
        $fuser->fetch($id);
        // Connexion ldap
        // pour recuperer passDoNotExpire et userChangePassNextLogon
        if ($conf->ldap->enabled && $fuser->ldap_sid) {
            $ldap = new Ldap();
            $result = $ldap->connect_bind();
            if ($result > 0) {
                $userSearchFilter = '(' . $conf->global->LDAP_FILTER_CONNECTION . '(' . $this->getUserIdentifier() . '=' . $fuser->login . '))';
                $entries = $ldap->fetch($fuser->login, $userSearchFilter);
                if (!$entries) {
                    $message .= $ldap->error;
                }
                $passDoNotExpire = 0;
                $userChangePassNextLogon = 0;
                $userDisabled = 0;
                $statutUACF = '';
                //On verifie les options du compte
                if (count($ldap->uacf) > 0) {
                    foreach ($ldap->uacf as $key => $statut) {
                        if ($key == 65536) {

    $input = trim(fgets(STDIN));
}
/*
if (! $conf->global->LDAP_CONTACT_ACTIVE)
{
	print $langs->trans("LDAPSynchronizationNotSetupInDolibarr");
	exit(-1);
}
*/
$sql = "SELECT rowid";
$sql .= " FROM " . MAIN_DB_PREFIX . "socpeople";
$resql = $db->query($sql);
if ($resql) {
    $num = $db->num_rows($resql);
    $i = 0;
    $ldap = new Ldap();
    $ldap->connect_bind();
    while ($i < $num) {
        $ldap->error = "";
        $obj = $db->fetch_object($resql);
        $contact = new Contact($db);
        $contact->id = $obj->rowid;
        $contact->fetch($contact->id);
        print $langs->trans("UpdateContact") . " rowid=" . $contact->id . " " . $contact->getFullName($langs);
        $oldobject = $contact;
        $oldinfo = $oldobject->_load_ldap_info();
        $olddn = $oldobject->_load_ldap_dn($oldinfo);
        $info = $contact->_load_ldap_info();
        $dn = $contact->_load_ldap_dn($info);
        $result = $ldap->add($dn, $info, $user);
        // Wil fail if already exists

 /**
  * Autentificación de usuarios con LDAP.
  *
  * @param string $userLogin con el login del usuario
  * @param string $userPass  con la clave del usuario
  * @return int|bool Número de error o boolean
  */
 public static function authUserLDAP($userLogin, $userPass)
 {
     if (!Util::ldapIsAvailable() || !Util::ldapIsEnabled() || !Ldap::checkLDAPParams()) {
         return false;
     }
     $ldapGroupAccess = false;
     $message['action'] = __FUNCTION__;
     // Conectamos al servidor realizamos la conexión con el usuario proxy
     try {
         Ldap::ldapConnect();
         Ldap::ldapBind();
         Ldap::getUserDN($userLogin);
     } catch (\Exception $e) {
         return false;
     }
     $userDN = Ldap::$ldapSearchData[0]['dn'];
     // Realizamos la conexión con el usuario real y obtenemos los atributos
     try {
         Ldap::ldapBind($userDN, $userPass);
         $attribs = Ldap::getLDAPAttr();
     } catch (\Exception $e) {
         return ldap_errno(Ldap::getConn());
     }
     // Comprobamos si la cuenta está bloqueada o expirada
     if (isset($attribs['expire']) && $attribs['expire'] > 0) {
         return 701;
     }
     if (Ldap::getLdapGroup() !== '*') {
         // Comprobamos que el usuario está en el grupo indicado buscando en los atributos del usuario
         if (isset($attribs['group'])) {
             if (is_array($attribs['group'])) {
                 foreach ($attribs['group'] as $group) {
                     if (is_int($group)) {
                         continue;
                     }
                     // Comprobamos que el usuario está en el grupo indicado
                     if (self::checkLDAPGroup($group)) {
                         $ldapGroupAccess = true;
                         break;
                     }
                 }
             } else {
                 $ldapGroupAccess = self::checkLDAPGroup($attribs['group']);
             }
             // Comprobamos que el usuario está en el grupo indicado buscando en los atributos del grupo
         } else {
             $ldapGroupAccess = Ldap::searchUserInGroup($userDN) || LdapADS::searchADUserInGroup($userLogin);
         }
     } else {
         $ldapGroupAccess = true;
     }
     if ($ldapGroupAccess === false) {
         $log = new Log(__FUNCTION__);
         $log->addDescription(_('Usuario no pertenece al grupo'));
         $log->addDescription(sprintf('%s : %s', _('Usuario'), $userDN));
         $log->writeLog();
         return 702;
     }
     self::$userName = isset($attribs['name']) ? $attribs['name'] : $userLogin;
     self::$userEmail = isset($attribs['mail']) ? $attribs['mail'] : '';
     return true;
 }