diff --git a/config/example-config.php b/config/example-config.php index d69537e8..0288764b 100644 --- a/config/example-config.php +++ b/config/example-config.php @@ -166,6 +166,10 @@ $c->admin_email ='calendar-admin@example.com'; /********************************/ /*********** LDAP hook **********/ /********************************/ +/* + * For Active Directory go down to the next example. + */ + //$c->authenticate_hook['call'] = 'LDAP_check'; //$c->authenticate_hook['config'] = array( // 'host' => 'www.tennaxia.net', //host name of your LDAP Server @@ -207,6 +211,29 @@ $c->admin_email ='calendar-admin@example.com'; // //include('drivers_ldap.php'); +/* + * Use the following LDAP example if you are using Active Directory + * + * You will need to change host, passDN and DOMAIN in bindDN + * and baseDNUsers. + */ +//$c->authenticate_hook['call'] = 'LDAP_check'; +//$c->authenticate_hook['config'] = array( +// 'host' => 'ldap://ldap.example.net', +// 'bindDN' => 'auth@DOMAIN', +// 'passDN' => 'secret', +// 'baseDNUsers' => 'dc=DOMAIN,dc=local', +// 'protocolVersion' => 3, +// 'optReferrals' => 0, +// 'filterUsers' => '(&(objectcategory=person)(objectclass=user)(givenname=*))', +// 'mapping_field' => array("username" => "uid", +// "fullname" => "cn" , +// "email" => "mail"), +// 'default_value' => array("date_format_type" => "E","locale" => "en_NZ"), +// 'format_updated' => array('Y' => array(0,4),'m' => array(4,2),'d'=> array(6,2),'H' => array(8,2),'M'=>array(10,2),'S' => array(12,2)) +// ); +//include('drivers_ldap.php'); + /** * Authentication against PAM using the Squid helper script. diff --git a/dba/patches/1.2.3.sql b/dba/patches/1.2.3.sql index ea5ef208..2d1a8c69 100644 --- a/dba/patches/1.2.3.sql +++ b/dba/patches/1.2.3.sql @@ -1,13 +1,14 @@ --- Sort out accessing calendar entries. +-- Add some more cascading updates and deletes. +-- For databases created before PostgreSQL 8.0. BEGIN; SELECT check_db_revision(1,2,2); ALTER TABLE role_member DROP CONSTRAINT "$1"; -ALTER TABLE role_member ADD CONSTRAINT "$1" (role_no) REFERENCES roles(role_no) ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE; +ALTER TABLE role_member ADD CONSTRAINT "$1" FOREIGN KEY (role_no) REFERENCES roles(role_no) ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE; ALTER TABLE role_member DROP CONSTRAINT "$2"; -ALTER TABLE role_member ADD CONSTRAINT "$2" (user_no) REFERENCES usr(user_no) ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE; +ALTER TABLE role_member ADD CONSTRAINT "$2" FOREIGN KEY (user_no) REFERENCES usr(user_no) ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE; ALTER TABLE session DROP CONSTRAINT "$1"; ALTER TABLE session ADD CONSTRAINT "$1" FOREIGN KEY (user_no) REFERENCES usr(user_no) ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE; diff --git a/inc/drivers_ldap.php b/inc/drivers_ldap.php index 451fd0d1..3d4f46d1 100644 --- a/inc/drivers_ldap.php +++ b/inc/drivers_ldap.php @@ -50,6 +50,13 @@ class ldapDrivers $this->valid=false; return ; } + + //Set LDAP protocol version + if (isset($config['protocolVersion'])) + ldap_set_option($this->connect, LDAP_OPT_PROTOCOL_VERSION, $config['protocolVersion']); + if (isset($config['optReferrals'])) + ldap_set_option($this->connect, LDAP_OPT_REFERRALS, $config['optReferrals']); + if ($port) $this->connect=ldap_connect($host, $port); else @@ -63,9 +70,6 @@ class ldapDrivers dbg_error_log( "LDAP", "drivers_ldap : Connected to LDAP server %s",$host ); - //Set LDAP protocol version - if (isset($config['protocolVersion'])) ldap_set_option($this->connect,LDAP_OPT_PROTOCOL_VERSION, $config['protocolVersion']); - // Start TLS if desired (requires protocol version 3) if (isset($config['startTLS'])) { if (!ldap_set_option($this->connect, LDAP_OPT_PROTOCOL_VERSION, 3)) { @@ -89,11 +93,11 @@ class ldapDrivers break; case "onelevel": $this->ldap_query_one = ldap_list; - $this->ldap_query_all = ldap_list; + $this->ldap_query_all = ldap_search; break; default: $this->ldap_query_one = ldap_search; - $this->ldap_query_all = ldap_list; + $this->ldap_query_all = ldap_search; break; } @@ -108,10 +112,11 @@ class ldapDrivers } $this->valid = true; //root to start search - $this->baseDNUsers = $config['baseDNUsers']; + $this->baseDNUsers = is_string($config['baseDNUsers']) ? array($this->baseDNUsers) : $config['baseDNUsers']; $this->filterUsers = $config['filterUsers']; $this->baseDNGroups = $config['baseDNGroups']; $this->filterGroups = $config['filterGroups']; + } /** @@ -121,18 +126,21 @@ class ldapDrivers global $c; $query = $this->ldap_query_all; - $entry = $query($this->connect,$this->baseDNUsers,$this->filterUsers,$attributes); - if (!ldap_first_entry($this->connect,$entry)) - $c->messages[] = sprintf(i18n("Error NoUserFound with filter >%s<, attributes >%s< , dn >%s<"),$this->filterUsers,join(', ',$attributes), $this->baseDNUsers); - for($i=ldap_first_entry($this->connect,$entry); - $i&&$arr=ldap_get_attributes($this->connect,$i); - $i=ldap_next_entry($this->connect,$i) - ) - { - for($j=0;$j<$arr['count'];$j++){ + + foreach($this->baseDNUsers as $baseDNUsers) { + $entry = $query($this->connect,$baseDNUsers,$this->filterUsers,$attributes); + + if (!ldap_first_entry($this->connect,$entry)) + $c->messages[] = sprintf(i18n("Error NoUserFound with filter >%s<, attributes >%s< , dn >%s<"),$this->filterUsers,join(', ',$attributes), $baseDNUsers); + + for($i = ldap_first_entry($this->connect,$entry); + $i && $arr = ldap_get_attributes($this->connect,$i); + $i = ldap_next_entry($this->connect,$i) ) { + for ($j=0; $j < $arr['count']; $j++) { $row[$arr[$j]] = $arr[$arr[$j]][0]; + } + $ret[]=$row; } - $ret[]=$row; } return $ret; } @@ -150,7 +158,14 @@ class ldapDrivers $entry=NULL; // We get the DN of the USER $query = $this->ldap_query_one; - $entry = $query($this->connect, $this->baseDNUsers, $filter,$attributes); + + foreach($this->baseDNUsers as $baseDNUsers) { + $entry = $query($this->connect, $baseDNUsers, $filter, $attributes); + + if (ldap_first_entry($this->connect,$entry) ) + break; + } + if ( !ldap_first_entry($this->connect, $entry) ){ dbg_error_log( "ERROR", "drivers_ldap : Unable to find the user with filter %s",$filter ); return false;