PHP adLDAP类代码示例

 public static function checkLdapCredentials($username, $password)
 {
     $options = sfConfig::get('app_sf_guard_plugin_ldap_settings', array());
     $ldap = new adLDAP($options);
     $authenticated = $ldap->authenticate($username, $password);
     return $authenticated ? true : false;
 }

 public function executeSignin($request)
 {
     $this->form = new sfGuardFormSignin();
     if ($request->isMethod('post')) {
         $data = $request->getParameter('signin');
         $adldap = new adLDAP(array('account_suffix' => '@sch.bme.hu', 'domain_controllers' => array('152.66.208.42'), 'ad_username' => $data['username'], 'ad_password' => $data['password']));
         try {
             $authUser = $adldap->authenticate($data['username'], $data['password']);
             if ($authUser === true) {
                 $userData = $adldap->user_info($data['username']);
                 $user = Doctrine::getTable('sfGuardUser')->findOneBy('username', $data['username']);
                 $save = false;
                 if ($user) {
                     if ($user->Profile->full_name != $userData[0]["displayname"][0] || $user->Profile->email != $userData[0]["mail"][0]) {
                         $save = true;
                     }
                 } else {
                     $user = new sfGuardUser();
                     $save = true;
                 }
                 if ($save) {
                     $user->username = $data['username'];
                     $user->password = $data['password'];
                     $user->Profile->full_name = $userData[0]["displayname"][0];
                     $user->Profile->email = $userData[0]["mail"][0];
                     $user->save();
                 }
             }
         } catch (Exception $e) {
             echo $e;
         }
     }
     parent::executeSignin($request);
 }

function GetDomainUsersList()
{
    global $SAMSConf;
    global $USERConf;
    if ($USERConf->ToWebInterfaceAccess("UC") != 1) {
        exit;
    }
    $DB = new SAMSDB();
    if ($SAMSConf->AUTH == "ntlm") {
        $value = ExecuteShellScript("getwbinfousers", "{$SAMSConf->WBINFOPATH}/");
        $a = explode(" ", $value);
        sort($a);
        $acount = count($a);
    } else {
        require_once "adldap.php";
        //create the LDAP connection
        $pdc = array("{$SAMSConf->LDAPSERVER}");
        $options = array(account_suffix => "@{$SAMSConf->LDAPDOMAIN}", base_dn => "{$SAMSConf->LDAPBASEDN}", domain_controllers => $pdc, ad_username => "{$SAMSConf->LDAPUSER}", ad_password => "{$SAMSConf->LDAPUSERPASSWD}", "", "", "");
        $ldap = new adLDAP($options);
        $a = $ldap->all_users($include_desc = false, $search = "*", $sorted = true);
        sort($a);
        $acount = count($a);
    }
    print "<SELECT NAME=\"usernick\" ID=\"usernick\" SIZE=1 >\n";
    for ($i = 0; $i < $acount; $i++) {
        if ($SAMSConf->NTLMDOMAIN == "Y") {
            if (strstr($a[$i], "+") != NULL) {
                $domain = trim(strtok($a[$i], "+"));
                $user = trim(strtok("+"));
                $domainlen = strlen($domain);
                $userlen = strlen($user);
            } else {
                $domain = trim(strtok($a[$i], "\\"));
                $user = trim(strtok("\\"));
                $domainlen = strlen($domain);
                $userlen = strlen($user);
            }
            if (strlen($domain) == 0 || strlen($user) == 0) {
                $user = $domain;
                $domain = $SAMSConf->DEFAULTDOMAIN;
            }
        } else {
            $domain = "{$SAMSConf->DEFAULTDOMAIN}";
            $user = trim($a[$i]);
            //$user=strtolower($user);
        }
        $result = $DB->samsdb_query("SELECT * FROM squidusers WHERE domain=\"{$domain}\"&&nick=\"{$user}\" ");
        $row = $DB->samsdb_fetch_array($result);
        if (strcmp($row['name'], $user) != 0 && strcmp($row['domain'], $domain) != 0) {
            if ($SAMSConf->NTLMDOMAIN == "Y") {
                print "<OPTION VALUE=\"{$domain}+{$user}\"> {$user}/{$domain} ";
            } else {
                print "<OPTION VALUE=\"{$user}\"> {$user} ";
            }
        }
    }
    print "</SELECT>\n";
}

function ADLDtest()
{
    global $SAMSConf;
    global $USERConf;
    if ($USERConf->ToWebInterfaceAccess("C") != 1) {
        exit;
    }
    $info = array();
    $lang = "./lang/lang.{$SAMSConf->LANG}";
    require $lang;
    print "<H1>Test AD connection</H1>";
    require_once "src/adldap.php";
    //create the LDAP connection
    $adldserver = GetAuthParameter("adld", "adldserver");
    $basedn = GetAuthParameter("adld", "basedn");
    $adadmin = GetAuthParameter("adld", "adadmin");
    $adadminpasswd = GetAuthParameter("adld", "adadminpasswd");
    $usergroup = GetAuthParameter("adld", "usergroup");
    $LDAPBASEDN2 = strtok($basedn, ".");
    $LDAPBASEDN = "DC={$LDAPBASEDN2}";
    while (strlen($LDAPBASEDN2) > 0) {
        $LDAPBASEDN2 = strtok(".");
        if (strlen($LDAPBASEDN2) > 0) {
            $LDAPBASEDN = "{$LDAPBASEDN},DC={$LDAPBASEDN2}";
        }
    }
    $pdc = array("{$adldserver}");
    $options = array(account_suffix => "@{$basedn}", base_dn => "{$LDAPBASEDN}", domain_controllers => $pdc, ad_username => "{$adadmin}", ad_password => "{$adadminpasswd}", "", "", "");
    $ldap = new adLDAP($options);
    $charset = explode(",", $_SERVER['HTTP_ACCEPT_CHARSET']);
    $groups = $ldap->all_groups($include_desc = false, $search = "*", $sorted = true);
    $gcount = count($groups);
    print "<TABLE CLASS=samstable>";
    print "<TH width=5%>No";
    print "<TH >{$adldtest_1_authldaptray} {$basedn}";
    for ($i = 0, $j = 1; $i < $gcount; $i++, $j++) {
        $groupname = UTF8ToSAMSLang($groups[$i]);
        echo "<TR><TD>{$j}:<TD>{$groupname} <BR>";
    }
    echo "</TABLE><P>";
    $users = $ldap->all_users($include_desc = false, $search = "*", $sorted = true);
    $count = count($users);
    print "<TABLE CLASS=samstable>";
    print "<TH width=5%>No";
    print "<TH >{$adldtest_2_authldaptray} {$basedn}";
    print "<TH > ";
    $i = 0;
    foreach ($users as $user) {
        $i++;
        $samaccountname = UTF8ToSAMSLang($user["samaccountname"]);
        $displayname = UTF8ToSAMSLang($user["displayname"]);
        echo "<TR><TD>{$i}: <TD> {$samaccountname} <TD> {$displayname}";
    }
    echo "</TABLE>";
}

 public function authAD()
 {
     $adldap = new adLDAP();
     if ($adldap->authenticate($this->login, $this->password)) {
         $user_info = $adldap->user()->info($this->login);
         $this->display_name = $user_info[0]['displayname'][0];
         $this->logged = true;
         $this->is_admin = $this->isAdmin($user_info);
     } else {
         $this->logged = false;
     }
 }

function TestPDC()
{
    global $SAMSConf;
    $info = array();
    $lang = "./lang/lang.{$SAMSConf->LANG}";
    require $lang;
    if (isset($_GET["auth"])) {
        $auth = $_GET["auth"];
    }
    print "<H1>TEST PDC</H1>";
    $value = ExecuteShellScript("getwbinfousers", "{$SAMSConf->WBINFOPATH}");
    $a = explode(" ", $value);
    sort($a);
    $acount = count($a);
    if ($auth == "ntlm") {
        for ($i = 0; $i < $acount; $i++) {
            print "{$a[$i]}<BR>\n";
        }
    }
    if ($auth == "adld") {
        require_once "adldap.php";
        //create the LDAP connection
        $pdc = array("{$SAMSConf->LDAPSERVER}");
        $options = array(account_suffix => "@{$SAMSConf->LDAPDOMAIN}", base_dn => "{$SAMSConf->LDAPBASEDN}", domain_controllers => $pdc, ad_username => "{$SAMSConf->LDAPUSER}", ad_password => "{$SAMSConf->LDAPUSERPASSWD}", "", "", "");
        $ldap = new adLDAP($options);
        $groups = $ldap->all_groups($include_desc = false, $search = "*", $sorted = true);
        $gcount = count($groups);
        print "<TABLE CLASS=samstable>";
        print "<TH width=5%>No";
        print "<TH >{$SAMSConf->LDAPDOMAIN} groups";
        for ($i = 0; $i < $gcount; $i++) {
            echo "<TR><TD>{$i}:<TD>{$groups[$i]}<BR>";
        }
        echo "</TABLE><P>";
        $users = $ldap->all_users($include_desc = false, $search = "*", $sorted = true);
        $count = count($users);
        print "<TABLE CLASS=samstable>";
        print "<TH width=5%>No";
        print "<TH >{$SAMSConf->LDAPDOMAIN} users";
        for ($i = 0; $i < $count; $i++) {
            $userinfo = $ldap->user_info($users[$i], $fields = NULL);
            //$mcount=count($userinfo);
            echo "<TR><TD>{$i}:<TD> {$users[$i]} ";
            $aaa = $userinfo[0]["displayname"][0];
            //$aaa2 = $userinfo[0]["givenname"][0];
            //$aaa3 = $userinfo[0]["sn"][0];
            echo "<TD>{$aaa} ";
        }
        echo "</TABLE>";
    }
}

 function loginUser()
 {
     $ldapOptions = array('account_suffix' => '@solitude.guc.usg.edu', 'base_dn' => 'ou=GGCNet,dc=solitude,dc=guc,dc=usg,dc=edu', 'domain_controllers' => array('llyr.solitude.guc.usg.edu'));
     $ldapOptions = array('account_suffix' => '@ggc.edu', 'base_dn' => 'ou=GGCNet,dc=ggc,dc=edu', 'domain_controllers' => array('ldap.ggc.edu'));
     $ldap = new adLDAP($ldapOptions);
     if ($ldap->authenticate($_POST['login_user'], self::decryptRSA($_POST['login_pass']))) {
         $_SESSION['loggedInParking'] = strtolower($_POST['login_user']);
         // allow commenting
         $_SESSION['allowComments'] = true;
     } else {
         //print_r($_POST);
         //die("Invalid password / username combination.");
         header("location: index.php?error=1");
         die;
     }
 }

 function selectUserFromLdap($username, $password)
 {
     try {
         $adldap = new adLDAP();
         $adldap->set_account_suffix('@vejleidraetsefterskole.local');
         $adldap->set_domain_controllers(array('mail.vih.dk'));
     } catch (adLDAPException $e) {
         echo $e;
         exit;
     }
     $authUser = $adldap->authenticate($username, $password);
     if ($authUser === true) {
         return new k_AuthenticatedUser($username);
     } else {
         throw new Exception('User authentication unsuccessful. ' . $adldap->get_last_error());
     }
 }

 /**
  *
  * @param string $username
  * @param string $password
  * @param string $method
  * @return Users 
  */
 public function getCredentials($username, $password, $method = 'internal')
 {
     if ($method == "ldap") {
         require_once ROOT_PATH . 'lib/common/ldap/adLDAP.php';
         $ldap = new adLDAP();
         // Authenticate using adLDAP configuratoin
         $authLdap = $ldap->authenticate($username, $password);
         if ($authLdap) {
             // Get the internally created user account (ESS/Admin accounts listed under users)
             $query = Doctrine_Query::create()->from('SystemUser')->where('user_name = ?', $username)->andWhere('deleted = 0');
         } else {
             // Return an empty result set if authentication is false
             $query = Doctrine_Query::create()->from('SystemUser')->where('1 = 2');
         }
     } else {
         $query = Doctrine_Query::create()->from('SystemUser')->where('user_name = ?', $username)->andWhere('user_password = ?', $password)->andWhere('deleted = 0');
     }
     return $query->fetchOne();
 }

 /**
  * Get the last logon time of any user as a Unix timestamp
  * 
  * @param string $username
  * @return long $unixTimestamp
  */
 public function getLastLogon($username)
 {
     if (!$this->adldap->getLdapBind()) {
         return false;
     }
     if ($username === null) {
         return "Missing compulsory field [username]";
     }
     $userInfo = $this->info($username, array("lastLogonTimestamp"));
     $lastLogon = adLDAPUtils::convertWindowsTimeToUnixTime($userInfo[0]['lastLogonTimestamp'][0]);
     return $lastLogon;
 }

 function login($username, $password)
 {
     if ($password == 'vih') {
         $this->logged_in = true;
         return true;
     }
     if ($username != NULL && $password != NULL) {
         //include the class and create a connection
         require_once dirname(__FILE__) . '/adLdap.php';
         try {
             $adldap = new adLDAP();
         } catch (adLDAPException $e) {
             echo $e;
             exit;
         }
         //authenticate the user
         if ($adldap->authenticate($username, $password)) {
             $this->logged_in = true;
             return true;
         }
     }
     return false;
 }

 /**
  * Coping with AD not returning the primary group
  * http://support.microsoft.com/?kbid=321360 
  * 
  * For some reason it's not possible to search on primarygrouptoken=XXX
  * If someone can show otherwise, I'd like to know about it :)
  * this way is resource intensive and generally a pain in the @#%^
  * 
  * @deprecated deprecated since version 3.1, see get get_primary_group
  * @param string $gid Group ID
  * @return string
  */
 public function cn($gid)
 {
     if ($gid === NULL) {
         return false;
     }
     $r = false;
     $filter = "(&(objectCategory=group)(samaccounttype=" . adLDAP::ADLDAP_SECURITY_GLOBAL_GROUP . "))";
     $fields = array("primarygrouptoken", "samaccountname", "distinguishedname");
     $sr = ldap_search($this->adldap->getLdapConnection(), $this->adldap->getBaseDn(), $filter, $fields);
     $entries = ldap_get_entries($this->adldap->getLdapConnection(), $sr);
     for ($i = 0; $i < $entries["count"]; $i++) {
         if ($entries[$i]["primarygrouptoken"][0] == $gid) {
             $r = $entries[$i]["distinguishedname"][0];
             $i = $entries["count"];
         }
     }
     return $r;
 }

function checkcreds_ADGroups_ToServer($groups, $hostname, $username, $password, $account_suffix)
{
    if (strlen($groups) == 0) {
        if ($GLOBALS["HOTSPOT_DEBUG"]) {
            ToSyslog("{$hostname}: checkcreds_ADGroups_ToServer no defined group in line:" . __LINE__);
        }
        return true;
    }
    $YGroups = array();
    $zGroups = explode("\n", $groups);
    while (list($num, $ligne) = each($zGroups)) {
        $ligne = trim(strtolower($ligne));
        if ($ligne == null) {
            continue;
        }
        $YGroups[$ligne] = $ligne;
        if ($GLOBALS["HOTSPOT_DEBUG"]) {
            ToSyslog("{$hostname}: checkcreds_ADGroups_ToServer checks group {$ligne} in line:" . __LINE__);
        }
    }
    if ($GLOBALS["HOTSPOT_DEBUG"]) {
        ToSyslog("{$hostname}: checkcreds_ADGroups_ToServer " . count($YGroups) . " in line:" . __LINE__);
    }
    if (count($YGroups) == 0) {
        if ($GLOBALS["HOTSPOT_DEBUG"]) {
            ToSyslog("{$hostname}: checkcreds_ADGroups_ToServer no group defined, return true in line:" . __LINE__);
        }
        return true;
    }
    if ($GLOBALS["HOTSPOT_DEBUG"]) {
        ToSyslog("{$hostname}: checkcreds_ADGroups_ToServer checks {$username} groups in line:" . __LINE__);
    }
    $account_suffixZ = explode(".", $account_suffix);
    while (list($num, $a) = each($account_suffixZ)) {
        $zsuffix[] = "DC={$a}";
    }
    $suffix = @implode(",", $zsuffix);
    $options = array('base_dn' => $suffix, 'ad_username' => $username, 'ad_password' => $password, 'recursive_groups' => true, 'domain_controllers' => array($hostname), 'account_suffix' => "@{$account_suffix}");
    $adldap = new adLDAP($options);
    $adldap->authenticate("{$username}", $password);
    $result = $adldap->user()->groups($username);
    if ($GLOBALS["HOTSPOT_DEBUG"]) {
        ToSyslog_array($GLOBALS["CLASS_ACTV"]);
    }
    if ($GLOBALS["HOTSPOT_DEBUG"]) {
        ToSyslog("{$hostname}: checkcreds_ADGroups_ToServer {$username} in:" . count($result) . " groups in line:" . __LINE__);
    }
    while (list($num, $group) = each($result)) {
        $group = trim(strtolower($group));
        if ($GLOBALS["HOTSPOT_DEBUG"]) {
            ToSyslog("{$hostname}: checkcreds_AD checks {$group} group in line:" . __LINE__);
        }
        if (isset($YGroups[$group])) {
            if ($GLOBALS["HOTSPOT_DEBUG"]) {
                ToSyslog("{$hostname}: checkcreds_AD checks {$group} is OK in line:" . __LINE__);
            }
            return true;
        }
    }
    return false;
}

 /**
  * Move a user account to a different OU
  *
  * @param string $username The username to move (please be careful here!)
  * @param array $container The container or containers to move the user to (please be careful here!).
  * accepts containers in 1. parent 2. child order
  * @return array
  */
 public function move($username, $container)
 {
     if (!$this->adldap->getLdapBind()) {
         return false;
     }
     if ($username === null) {
         return "Missing compulsory field [username]";
     }
     if ($container === null) {
         return "Missing compulsory field [container]";
     }
     if (!is_array($container)) {
         return "Container must be an array";
     }
     $userInfo = $this->info($username, array("*"));
     $dn = $userInfo[0]['distinguishedname'][0];
     $newRDn = "cn=" . $username;
     $container = array_reverse($container);
     $newContainer = "ou=" . implode(",ou=", $container);
     $newBaseDn = strtolower($newContainer) . "," . $this->adldap->getBaseDn();
     $result = @ldap_rename($this->adldap->getLdapConnection(), $dn, $newRDn, $newBaseDn, true);
     if ($result !== true) {
         return false;
     }
     return true;
 }

 /**
  * Create an organizational unit
  *
  * @param array $attributes Default attributes of the ou
  * @return bool
  */
 public function create($attributes)
 {
     if (!is_array($attributes)) {
         return "Attributes must be an array";
     }
     if (!is_array($attributes["container"])) {
         return "Container attribute must be an array.";
     }
     if (!array_key_exists("ou_name", $attributes)) {
         return "Missing compulsory field [ou_name]";
     }
     if (!array_key_exists("container", $attributes)) {
         return "Missing compulsory field [container]";
     }
     $attributes["container"] = array_reverse($attributes["container"]);
     $add = array();
     $add["objectClass"] = "organizationalUnit";
     $add["OU"] = $attributes['ou_name'];
     $containers = "";
     if (count($attributes['container']) > 0) {
         $containers = "OU=" . implode(",OU=", $attributes["container"]) . ",";
     }
     $containers = "OU=" . implode(",OU=", $attributes["container"]);
     $result = ldap_add($this->adldap->getLdapConnection(), "OU=" . $add["OU"] . ", " . $containers . $this->adldap->getBaseDn(), $add);
     if ($result != true) {
         return false;
     }
     return true;
 }