LdapAuthorizationPlugin.php 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135
  1. <?php
  2. /**
  3. * StatusNet, the distributed open-source microblogging tool
  4. *
  5. * Plugin to enable LDAP Authorization
  6. *
  7. * PHP version 5
  8. *
  9. * LICENCE: This program is free software: you can redistribute it and/or modify
  10. * it under the terms of the GNU Affero General Public License as published by
  11. * the Free Software Foundation, either version 3 of the License, or
  12. * (at your option) any later version.
  13. *
  14. * This program is distributed in the hope that it will be useful,
  15. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  17. * GNU Affero General Public License for more details.
  18. *
  19. * You should have received a copy of the GNU Affero General Public License
  20. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  21. *
  22. * @category Plugin
  23. * @package StatusNet
  24. * @author Craig Andrews <candrews@integralblue.com>
  25. * @copyright 2009 Free Software Foundation, Inc http://www.fsf.org
  26. * @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
  27. * @link http://status.net/
  28. */
  29. if (!defined('STATUSNET') && !defined('LACONICA')) {
  30. exit(1);
  31. }
  32. class LdapAuthorizationPlugin extends AuthorizationPlugin
  33. {
  34. const PLUGIN_VERSION = '2.0.0';
  35. public $roles_to_groups = array();
  36. public $login_group = null;
  37. function onInitializePlugin(){
  38. if(!isset($this->provider_name)){
  39. // TRANS: Exception thrown when initialising the LDAP Auth plugin fails because of an incorrect configuration.
  40. throw new Exception(_m('provider_name must be set. Use the provider_name from the LDAP Authentication plugin.'));
  41. }
  42. if(!isset($this->uniqueMember_attribute)){
  43. // TRANS: Exception thrown when initialising the LDAP Auth plugin fails because of an incorrect configuration.
  44. throw new Exception(_m('uniqueMember_attribute must be set.'));
  45. }
  46. $this->ldapCommon = new LdapCommon(get_object_vars($this));
  47. }
  48. function onAutoload($cls)
  49. {
  50. switch ($cls)
  51. {
  52. case 'LdapCommon':
  53. require_once(INSTALLDIR.'/plugins/LdapCommon/LdapCommon.php');
  54. return false;
  55. }
  56. return parent::onAutoload($cls);
  57. }
  58. //---interface implementation---//
  59. function loginAllowed($user) {
  60. $user_username = new User_username();
  61. $user_username->user_id=$user->id;
  62. $user_username->provider_name=$this->provider_name;
  63. if($user_username->find() && $user_username->fetch()){
  64. $entry = $this->ldapCommon->get_user($user_username->username);
  65. if($entry){
  66. if(isset($this->login_group)){
  67. if(is_array($this->login_group)){
  68. foreach($this->login_group as $group){
  69. if($this->ldapCommon->is_dn_member_of_group($entry->dn(),$group)){
  70. return true;
  71. }
  72. }
  73. }else{
  74. if($this->ldapCommon->is_dn_member_of_group($entry->dn(),$this->login_group)){
  75. return true;
  76. }
  77. }
  78. return null;
  79. }else{
  80. //if a user exists, we can assume he's allowed to login
  81. return true;
  82. }
  83. }else{
  84. return null;
  85. }
  86. }else{
  87. return null;
  88. }
  89. }
  90. function hasRole($profile, $name) {
  91. $user_username = new User_username();
  92. $user_username->user_id=$profile->id;
  93. $user_username->provider_name=$this->provider_name;
  94. if($user_username->find() && $user_username->fetch()){
  95. $entry = $this->ldapCommon->get_user($user_username->username);
  96. if($entry){
  97. if(isset($this->roles_to_groups[$name])){
  98. if(is_array($this->roles_to_groups[$name])){
  99. foreach($this->roles_to_groups[$name] as $group){
  100. if($this->ldapCommon->is_dn_member_of_group($entry->dn(),$group)){
  101. return true;
  102. }
  103. }
  104. }else{
  105. if($this->ldapCommon->is_dn_member_of_group($entry->dn(),$this->roles_to_groups[$name])){
  106. return true;
  107. }
  108. }
  109. }
  110. }
  111. }
  112. return false;
  113. }
  114. public function onPluginVersion(array &$versions): bool
  115. {
  116. $versions[] = array('name' => 'LDAP Authorization',
  117. 'version' => self::PLUGIN_VERSION,
  118. 'author' => 'Craig Andrews',
  119. 'homepage' => 'https://git.gnu.io/gnu/gnu-social/tree/master/plugins/LdapAuthorization',
  120. 'rawdescription' =>
  121. // TRANS: Plugin description.
  122. _m('The LDAP Authorization plugin allows for StatusNet to handle authorization through LDAP.'));
  123. return true;
  124. }
  125. }