forked from GNUsocial/gnu-social
Added Authorization plugin
Added LDAPAuthorization plugin
This commit is contained in:
Craig Andrews
129
plugins/LdapAuthorization/LdapAuthorizationPlugin.php
Normal file
129
plugins/LdapAuthorization/LdapAuthorizationPlugin.php
Normal file
@@ -0,0 +1,129 @@
|
||||
<?php
|
||||
/**
|
||||
* StatusNet, the distributed open-source microblogging tool
|
||||
*
|
||||
* Plugin to enable LDAP Authorization
|
||||
*
|
||||
* PHP version 5
|
||||
*
|
||||
* LICENCE: This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Affero General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Affero General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
* @category Plugin
|
||||
* @package StatusNet
|
||||
* @author Craig Andrews <candrews@integralblue.com>
|
||||
* @copyright 2009 Craig Andrews http://candrews.integralblue.com
|
||||
* @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
|
||||
* @link http://status.net/
|
||||
*/
|
||||
|
||||
if (!defined('STATUSNET') && !defined('LACONICA')) {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
require_once INSTALLDIR.'/plugins/Authorization/AuthorizationPlugin.php';
|
||||
require_once 'Net/LDAP2.php';
|
||||
|
||||
class LdapAuthorizationPlugin extends AuthorizationPlugin
|
||||
{
|
||||
public $host=null;
|
||||
public $port=null;
|
||||
public $version=null;
|
||||
public $starttls=null;
|
||||
public $binddn=null;
|
||||
public $bindpw=null;
|
||||
public $basedn=null;
|
||||
public $options=null;
|
||||
public $filter=null;
|
||||
public $scope=null;
|
||||
public $provider_name = null;
|
||||
public $uniqueMember_attribute = null;
|
||||
public $roles_to_groups = null;
|
||||
|
||||
function onInitializePlugin(){
|
||||
parent::onInitializePlugin();
|
||||
if(!isset($this->host)){
|
||||
throw new Exception("must specify a host");
|
||||
}
|
||||
if(!isset($this->basedn)){
|
||||
throw new Exception("must specify a basedn");
|
||||
}
|
||||
if(!isset($this->provider_name)){
|
||||
throw new Exception("provider_name must be set. Use the provider_name from the LDAP Authentication plugin.");
|
||||
}
|
||||
if(!isset($this->uniqueMember_attribute)){
|
||||
throw new Exception("uniqueMember_attribute must be set.");
|
||||
}
|
||||
if(!isset($this->roles_to_groups)){
|
||||
throw new Exception("roles_to_groups must be set.");
|
||||
}
|
||||
}
|
||||
|
||||
//---interface implementation---//
|
||||
function loginAllowed($user) {
|
||||
$user_username = new User_username();
|
||||
$user_username->user_id=$user->id;
|
||||
$user_username->provider_name=$this->provider_name;
|
||||
if($user_username->find() && $user_username->fetch()){
|
||||
$entry = $this->ldap_get_user($user_username->username);
|
||||
if($entry){
|
||||
//if a user exists, we can assume he's allowed to login
|
||||
return true;
|
||||
}else{
|
||||
return null;
|
||||
}
|
||||
}else{
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
function hasRole($profile, $name) {
|
||||
$user_username = new User_username();
|
||||
$user_username->user_id=$profile->id;
|
||||
$user_username->provider_name=$this->provider_name;
|
||||
if($user_username->find() && $user_username->fetch()){
|
||||
$entry = $this->ldap_get_user($user_username->username);
|
||||
if($entry){
|
||||
if(isset($this->roles_to_groups[$name])){
|
||||
if(is_array($this->roles_to_groups[$name])){
|
||||
foreach($this->roles_to_groups[$name] as $group){
|
||||
if($this->isMemberOfGroup($entry->dn(),$group)){
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}else{
|
||||
if($this->isMemberOfGroup($entry->dn(),$this->roles_to_groups[$name])){
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
function isMemberOfGroup($userDn, $groupDn)
|
||||
{
|
||||
$ldap = ldap_get_connection();
|
||||
$link = $ldap->getLink();
|
||||
$r = ldap_compare($link, $groupDn, $this->uniqueMember_attribute, $userDn);
|
||||
if ($r === true){
|
||||
return true;
|
||||
}else if($r === false){
|
||||
return false;
|
||||
}else{
|
||||
common_log(LOG_ERR, ldap_error($r));
|
||||
return false;
|
||||
}
|
||||
}
|
||||
}
|
||||
84
plugins/LdapAuthorization/README
Normal file
84
plugins/LdapAuthorization/README
Normal file
@@ -0,0 +1,84 @@
|
||||
The LDAP Authorization plugin allows for StatusNet to handle authorization
|
||||
through LDAP.
|
||||
|
||||
Installation
|
||||
============
|
||||
add "addPlugin('ldapAuthorization',
|
||||
array('setting'=>'value', 'setting2'=>'value2', ...);"
|
||||
to the bottom of your config.php
|
||||
|
||||
You *cannot* use this plugin without the LDAP Authentication plugin
|
||||
|
||||
Settings
|
||||
========
|
||||
provider_name*: name of the LDAP authentication provider that this plugin works with.
|
||||
authoritative (false): should this plugin be authoritative for
|
||||
authorization?
|
||||
uniqueMember_attribute ('uniqueMember')*: the attribute of a group
|
||||
that lists the DNs of its members
|
||||
roles_to_groups*: array that maps StatusNet roles to LDAP groups
|
||||
some StatusNet roles are: moderator, administrator, sandboxed, silenced
|
||||
|
||||
The below settings must be exact copies of the settings used for the
|
||||
corresponding LDAP Authentication plugin.
|
||||
|
||||
host*: LDAP server name to connect to. You can provide several hosts in an
|
||||
array in which case the hosts are tried from left to right.
|
||||
See http://pear.php.net/manual/en/package.networking.net-ldap2.connecting.php
|
||||
port: Port on the server.
|
||||
See http://pear.php.net/manual/en/package.networking.net-ldap2.connecting.php
|
||||
version: LDAP version.
|
||||
See http://pear.php.net/manual/en/package.networking.net-ldap2.connecting.php
|
||||
starttls: TLS is started after connecting.
|
||||
See http://pear.php.net/manual/en/package.networking.net-ldap2.connecting.php
|
||||
binddn: The distinguished name to bind as (username).
|
||||
See http://pear.php.net/manual/en/package.networking.net-ldap2.connecting.php
|
||||
bindpw: Password for the binddn.
|
||||
See http://pear.php.net/manual/en/package.networking.net-ldap2.connecting.php
|
||||
basedn*: LDAP base name (root directory).
|
||||
See http://pear.php.net/manual/en/package.networking.net-ldap2.connecting.php
|
||||
options: See http://pear.php.net/manual/en/package.networking.net-ldap2.connecting.php
|
||||
filter: Default search filter.
|
||||
See http://pear.php.net/manual/en/package.networking.net-ldap2.connecting.php
|
||||
scope: Default search scope.
|
||||
See http://pear.php.net/manual/en/package.networking.net-ldap2.connecting.php
|
||||
|
||||
* required
|
||||
default values are in (parenthesis)
|
||||
|
||||
Example
|
||||
=======
|
||||
Here's an example of an LDAP plugin configuration that connects to
|
||||
Microsoft Active Directory.
|
||||
|
||||
addPlugin('ldapAuthentication', array(
|
||||
'provider_name'=>'Example',
|
||||
'authoritative'=>true,
|
||||
'autoregistration'=>true,
|
||||
'binddn'=>'username',
|
||||
'bindpw'=>'password',
|
||||
'basedn'=>'OU=Users,OU=StatusNet,OU=US,DC=americas,DC=global,DC=loc',
|
||||
'host'=>array('server1', 'server2'),
|
||||
'password_encoding'=>'ad',
|
||||
'attributes'=>array(
|
||||
'username'=>'sAMAccountName',
|
||||
'nickname'=>'sAMAccountName',
|
||||
'email'=>'mail',
|
||||
'fullname'=>'displayName',
|
||||
'password'=>'unicodePwd')
|
||||
));
|
||||
addPlugin('ldapAuthorization', array(
|
||||
'provider_name'=>'Example',
|
||||
'authoritative'=>false,
|
||||
'uniqueMember_attribute'=>'uniqueMember',
|
||||
'roles_to_groups'=> array(
|
||||
'moderator'=>'CN=SN-Moderators,OU=Users,OU=StatusNet,OU=US,DC=americas,DC=global,DC=loc',
|
||||
'administrator'=> array('CN=System-Adminstrators,OU=Users,OU=StatusNet,OU=US,DC=americas,DC=global,DC=loc',
|
||||
'CN=SN-Administrators,OU=Users,OU=StatusNet,OU=US,DC=americas,DC=global,DC=loc')
|
||||
),
|
||||
'binddn'=>'username',
|
||||
'bindpw'=>'password',
|
||||
'basedn'=>'OU=Users,OU=StatusNet,OU=US,DC=americas,DC=global,DC=loc',
|
||||
'host'=>array('server1', 'server2')
|
||||
));
|
||||
|
||||
Reference in New Issue
Block a user