Password: Allow to search for user DN (#1486316), allow to bind anonymously (#1486306)

git-svn-id: https://svn.roundcube.net/trunk@3472 208e9e7b-5314-0410-a742-e7e81cd9613c

2 files changed, 151 insertions, 29 deletions

diff --git a/plugins/password/config.inc.php.dist b/plugins/password/config.inc.php.dist
index 304b8904a..d87de0514 100644
--- a/plugins/password/config.inc.php.dist
+++ b/plugins/password/config.inc.php.dist
@@ -127,6 +127,44 @@ $rcmail_config['password_ldap_adminPW'] = null;
 // Exemple: 'uid=%login,ou=people,dc=exemple,dc=com'
 $rcmail_config['password_ldap_userDN_mask'] = 'uid=%login,ou=people,dc=exemple,dc=com';
 
+// LDAP search DN
+// The DN roundcube should bind with to find out user's DN
+// based on his login. Note that you should comment out the default
+// password_ldap_userDN_mask setting for this to take effect.
+// Use this if you cannot specify a general template for user DN with
+// password_ldap_userDN_mask. You need to perform a search based on
+// users login to find his DN instead. A common reason might be that
+// your users are placed under different ou's like engineering or
+// sales which cannot be derived from their login only.
+$rcmail_config['password_ldap_searchDN'] = 'cn=roundcube,ou=services,dc=example,dc=com';
+
+// LDAP search password
+// If password_ldap_searchDN is set, the password to use for
+// binding to search for user's DN. Note that you should comment out the default
+// password_ldap_userDN_mask setting for this to take effect.
+// Warning: Be sure to set approperiate permissions on this file so this password
+// is only accesible to roundcube and don't forget to restrict roundcube's access to
+// your directory as much as possible using ACLs. Should this password be compromised
+// you want to minimize the damage.
+$rcmail_config['password_ldap_searchPW'] = 'secret';
+
+// LDAP search base
+// If password_ldap_searchDN is set, the base to search in using the filter below.
+// Note that you should comment out the default password_ldap_userDN_mask setting
+// for this to take effect.
+$rcmail_config['password_ldap_search_base'] = 'ou=people,dc=example,dc=com';
+
+// LDAP search filter
+// If password_ldap_searchDN is set, the filter to use when
+// searching for user's DN. Note that you should comment out the default
+// password_ldap_userDN_mask setting for this to take effect.
+// '%login' will be replaced by the current roundcube user's login
+// '%name' will be replaced by the current roundcube user's name part
+// '%domain' will be replaced by the current roundcube user's domain part
+// Example: '(uid=%login)'
+// Example: '(&(objectClass=posixAccount)(uid=%login))'
+$rcmail_config['password_ldap_search_filter'] = '(uid=%login)';
+
 // LDAP password hash type
 // Standard LDAP encryption type which must be one of: crypt,
 // ext_des, md5crypt, blowfish, md5, sha, smd5, ssha, or clear.
diff --git a/plugins/password/drivers/ldap.php b/plugins/password/drivers/ldap.php
index e38f13f8c..0557f3e54 100644
--- a/plugins/password/drivers/ldap.php
+++ b/plugins/password/drivers/ldap.php
@@ -6,7 +6,7 @@
  * Driver for passwords stored in LDAP
  * This driver use the PEAR Net_LDAP2 class (http://pear.php.net/package/Net_LDAP2).
  *
- * @version 1.0 (2009-06-24)
+ * @version 1.1 (2010-04-07)
  * @author Edouard MOREAU <edouard.moreau@ensma.fr>
  *
  * function hashPassword based on code from the phpLDAPadmin development team (http://phpldapadmin.sourceforge.net/).
@@ -20,22 +20,27 @@ function password_save($curpass, $passwd)
     require_once ('Net/LDAP2.php');
     
     // Building user DN
-    $userDN = str_replace('%login', $_SESSION['username'], $rcmail->config->get('password_ldap_userDN_mask'));
+    if ($userDN = $rcmail->config->get('password_ldap_userDN_mask')) {
+        $userDN = substitute_vars($userDN);
+    } else {
+        $userDN = search_userdn($rcmail);
+    }
     
-    $parts = explode('@', $_SESSION['username']);
-    if (count($parts) == 2)
-    {
-        $userDN = str_replace('%name', $parts[0], $userDN);
-        $userDN = str_replace('%domain', $parts[1], $userDN);
+    if (empty($userDN)) {
+        return PASSWORD_CONNECT_ERROR;
     }
-
-    if (empty($userDN)) {return PASSWORD_CONNECT_ERROR;}
     
     // Connection Method
     switch($rcmail->config->get('password_ldap_method')) {
-        case 'user': $binddn = $userDN; $bindpw = $curpass; break;
-        case 'admin': $binddn = $rcmail->config->get('password_ldap_adminDN'); $bindpw = $rcmail->config->get('password_ldap_adminPW'); break;
-        default: $binddn = $userDN; $bindpw = $curpass; break; // default is user mode
+        case 'admin':
+            $binddn = $rcmail->config->get('password_ldap_adminDN');
+            $bindpw = $rcmail->config->get('password_ldap_adminPW');
+            break;
+        case 'user':
+        default:
+            $binddn = $userDN;
+            $bindpw = $curpass;
+            break;
     }
     
     // Configuration array
@@ -53,22 +58,93 @@ function password_save($curpass, $passwd)
     $ldap = Net_LDAP2::connect($ldapConfig);
     
     // Checking for connection error
-    if (PEAR::isError($ldap)) {return PASSWORD_CONNECT_ERROR;}
+    if (PEAR::isError($ldap)) {
+        return PASSWORD_CONNECT_ERROR;
+    }
     
     // Crypting new password
     $newCryptedPassword = hashPassword($passwd, $rcmail->config->get('password_ldap_encodage'));
-    if (!$newCryptedPassword) {return PASSWORD_CRYPT_ERROR;}
+    if (!$newCryptedPassword) {
+        return PASSWORD_CRYPT_ERROR;
+    }
     
     // Writing new crypted password to LDAP
     $userEntry = $ldap->getEntry($userDN);
-    if (Net_LDAP2::isError($userEntry)) {return PASSWORD_CONNECT_ERROR;}
-    if (!$userEntry->replace(array($rcmail->config->get('password_ldap_pwattr') => $newCryptedPassword),$rcmail->config->get('password_ldap_force_replace'))) {return PASSWORD_CONNECT_ERROR;}
-    if (Net_LDAP2::isError($userEntry->update())) {return PASSWORD_CONNECT_ERROR;}
+    if (Net_LDAP2::isError($userEntry)) {
+        return PASSWORD_CONNECT_ERROR;
+    }
+    
+    $pwattr = $rcmail->config->get('password_ldap_pwattr');
+    $force = $rcmail->config->get('password_ldap_force_replace');
+
+    if (!$userEntry->replace(array($pwattr => $newCryptedPassword), $force)) {
+        return PASSWORD_CONNECT_ERROR;
+    }
+    if (Net_LDAP2::isError($userEntry->update())) {
+        return PASSWORD_CONNECT_ERROR;
+    }
     
     // All done, no error
     return PASSWORD_SUCCESS;    
 }
 
+/**
+ * Bind with searchDN and searchPW and search for the user's DN.
+ * Use search_base and search_filter defined in config file.
+ * Return the found DN.
+ */
+function search_userdn($rcmail)
+{
+    $ldapConfig = array (
+        'binddn'    => $rcmail->config->get('password_ldap_searchDN'),
+        'bindpw'    => $rcmail->config->get('password_ldap_searchPW'),
+        'basedn'    => $rcmail->config->get('password_ldap_basedn'),
+        'host'      => $rcmail->config->get('password_ldap_host'),
+        'port'      => $rcmail->config->get('password_ldap_port'),
+        'starttls'  => $rcmail->config->get('password_ldap_starttls'),
+        'version'   => $rcmail->config->get('password_ldap_version'),
+    );
+
+    $ldap = Net_LDAP2::connect($ldapConfig);
+
+    if (PEAR::isError($ldap)) {
+        return '';
+    }
+
+    $base = $rcmail->config->get('password_ldap_search_base');
+    $filter = substitute_vars($rcmail->config->get('password_ldap_search_filter'));
+    $options = array (
+            'scope' => 'sub',
+            'attributes' => array(),
+    );
+
+    $result = $ldap->search($base, $filter, $options);
+    $ldap->done();
+    if (PEAR::isError($result) || ($result->count() != 1)) {
+        return '';
+    }
+        
+    return $result->current()->dn();
+}
+
+/**
+ * Substitute %login, %name and %domain in $str.
+ * See plugin config for details.
+ */
+function substitute_vars($str)
+{
+    $str = str_replace('%login', $_SESSION['username'], $str);
+
+    $parts = explode('@', $_SESSION['username']);
+    if (count($parts) == 2)
+    {
+        $str = str_replace('%name', $parts[0], $str);
+        $str = str_replace('%domain', $parts[1], $str);
+    }
+
+    return $str;
+}
+
 
 /**
  * Code originaly from the phpLDAPadmin development team
@@ -93,18 +169,28 @@ function hashPassword( $passwordClear, $encodageType )
             
         case 'ext_des':
             // extended des crypt. see OpenBSD crypt man page.
-            if ( ! defined( 'CRYPT_EXT_DES' ) || CRYPT_EXT_DES == 0 ) {return FALSE;} //Your system crypt library does not support extended DES encryption.
+            if ( ! defined( 'CRYPT_EXT_DES' ) || CRYPT_EXT_DES == 0 ) {
+                // Your system crypt library does not support extended DES encryption.
+                return FALSE;
+            }
             $cryptedPassword = '{CRYPT}' . crypt( $passwordClear, '_' . randomSalt(8) );
             break;
 
         case 'md5crypt':
-            if( ! defined( 'CRYPT_MD5' ) || CRYPT_MD5 == 0 ) {return FALSE;} //Your system crypt library does not support md5crypt encryption.
+            if( ! defined( 'CRYPT_MD5' ) || CRYPT_MD5 == 0 ) {
+                // Your system crypt library does not support md5crypt encryption.
+                return FALSE;
+            }
             $cryptedPassword = '{CRYPT}' . crypt( $passwordClear , '$1$' . randomSalt(9) );
             break;
 
         case 'blowfish':
-            if( ! defined( 'CRYPT_BLOWFISH' ) || CRYPT_BLOWFISH == 0 ) {return FALSE;} //Your system crypt library does not support blowfish encryption.
-            $cryptedPassword = '{CRYPT}' . crypt( $passwordClear , '$2a$12$' . randomSalt(13) ); // hardcoded to second blowfish version and set number of rounds
+            if( ! defined( 'CRYPT_BLOWFISH' ) || CRYPT_BLOWFISH == 0 ) {
+                // Your system crypt library does not support blowfish encryption.
+                return FALSE;
+            }
+            // hardcoded to second blowfish version and set number of rounds
+            $cryptedPassword = '{CRYPT}' . crypt( $passwordClear , '$2a$12$' . randomSalt(13) );
             break;
 
         case 'md5':
@@ -125,8 +211,8 @@ function hashPassword( $passwordClear, $encodageType )
         case 'ssha':
             if( function_exists( 'mhash' ) && function_exists( 'mhash_keygen_s2k' ) ) {
                 mt_srand( (double) microtime() * 1000000 );
-                $salt = mhash_keygen_s2k( MHASH_SHA1, $passwordClear, substr( pack( "h*", md5( mt_rand() ) ), 0, 8 ), 4 );
-                $cryptedPassword = "{SSHA}".base64_encode( mhash( MHASH_SHA1, $passwordClear.$salt ).$salt );
+                $salt = mhash_keygen_s2k( MHASH_SHA1, $passwordClear, substr( pack( 'h*', md5( mt_rand() ) ), 0, 8 ), 4 );
+                $cryptedPassword = '{SSHA}'.base64_encode( mhash( MHASH_SHA1, $passwordClear.$salt ).$salt );
             } else {
                 return FALSE; //Your PHP install does not have the mhash() function. Cannot do SHA hashes.
             }
@@ -135,8 +221,8 @@ function hashPassword( $passwordClear, $encodageType )
         case 'smd5':
             if( function_exists( 'mhash' ) && function_exists( 'mhash_keygen_s2k' ) ) {
                 mt_srand( (double) microtime() * 1000000 );
-                $salt = mhash_keygen_s2k( MHASH_MD5, $passwordClear, substr( pack( "h*", md5( mt_rand() ) ), 0, 8 ), 4 );
-                $cryptedPassword = "{SMD5}".base64_encode( mhash( MHASH_MD5, $passwordClear.$salt ).$salt );
+                $salt = mhash_keygen_s2k( MHASH_MD5, $passwordClear, substr( pack( 'h*', md5( mt_rand() ) ), 0, 8 ), 4 );
+                $cryptedPassword = '{SMD5}'.base64_encode( mhash( MHASH_MD5, $passwordClear.$salt ).$salt );
             } else {
                 return FALSE; //Your PHP install does not have the mhash() function. Cannot do SHA hashes.
             }
@@ -150,8 +236,6 @@ function hashPassword( $passwordClear, $encodageType )
     return $cryptedPassword;
 }
 
-
-
 /**
  * Code originaly from the phpLDAPadmin development team
  * http://phpldapadmin.sourceforge.net/
@@ -174,8 +258,8 @@ function randomSalt( $length )
         'abcdefghijklmnopqrstuvwxyz'.
         'ABCDEFGHIJKLMNOPQRSTUVWXYZ'.
         './';
-    $str = "";
-    mt_srand((double)microtime() * 1000000);
+    $str = '';
+//    mt_srand((double)microtime() * 1000000);
 
     while( strlen( $str ) < $length )
         $str .= substr( $possible, ( rand() % strlen( $possible ) ), 1 );