nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-08-31 18:46:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

IMAP PAM authentication from Oliver Schulze

Browse Source 
Signed-off-by: Andrew McMillan <andrew@morphoss.com>
This commit is contained in:
Andrew McMillan 2010-12-30 12:29:51 +13:00
parent 1efa534286
commit 874b81c1c9
2 changed files with 121 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
config/imap_pam_conf_php.txt Normal file
View File

@ -0,0 +1,11 @@
/**
* Authentication against IMAP using the imap_open function.
*/
$c->authenticate_hook['call'] = 'IMAP_PAM_check';
$c->authenticate_hook['config'] = array(
'imap_url' => '{localhost:993/imap/ssl/novalidate-cert}',
'email_base' => 'example.com'
);
include('drivers_imap_pam.php');

110
inc/drivers_imap_pam.php Normal file
View File

@ -0,0 +1,110 @@
<?php
/**
* Manages PAM repository connection with local imap server help
*
* @package davical
* @category Technical
* @subpackage ldap
* @author Oliver Schulze <oliver@samera.com.py>
* @copyright Based on Eric Seigne script drivers_squid_pam.php
* @license http://gnu.org/copyleft/gpl.html GNU GPL v2
*/
require_once("auth-functions.php");
class imapPamDrivers
{
/**#@+
* @access private
*/
/**#@-*/
/**
* Constructor.
* @param string $imap_url formated for imap_open()
*/
function imapPamDrivers($imap_url){
$this->__construct($imap_url);
}
/**
* The constructor
*
* @param string $imap_url formated for imap_open()
*/
function __construct($imap_url)
{
global $c;
if (empty($imap_url)){
$c->messages[] = sprintf(i18n('drivers_imap_pam : imap_url parameter not configured in /etc/davical/*-conf.php'));
$this->valid=false;
return ;
}
}
}
/**
* Check the username / password against the PAM system
*/
function IMAP_PAM_check($username, $password ){
global $c;
/**
* @todo Think of the children! This is a horribly insecure use of unvalidated user input! Probably it should be done with a popen or something, and it seems remarkably dodgy to expect that naively quoted strings will work in any way reliably.
* Meanwhile, I've quickly hacked something basic in place to improve the situation. No quotes/backslashes in passwords for YOU!
*/
$username_ori = $username;
$username = escapeshellcmd($username);
//$password = escapeshellcmd($password);
//$imap_url = '{localhost:143/imap/notls}';
//$imap_url = '{localhost:993/imap/ssl/novalidate-cert}';
$imap_url = $c->authenticate_hook['config']['imap_url'];
$auth_result = "ERR";
$imap_stream = @imap_open($imap_url, $username, $password, OP_HALFOPEN);
//print_r(imap_errors());
if ( $imap_stream ) {
// disconnect
imap_close($imap_stream);
// login ok
$auth_result = "OK";
}
if ( $auth_result == "OK") {
if ( $usr = getUserByName($username) ) {
return $usr;
}
else {
dbg_error_log( "PAM", "user %s doesn't exist in local DB, we need to create it",$username );
$cmd = "getent passwd '$username'";
$getent_res = exec($cmd);
$getent_arr = explode(":", $getent_res);
$fullname = $getent_arr[4];
if(empty($fullname)) {
$fullname = $username;
}
$usr = (object) array(
'user_no' => 0,
'username' => $username,
'active' => 't',
'email' => $username . "@" . $c->authenticate_hook['config']['email_base'],
'updated' => date(),
'fullname' => $fullname
);
UpdateUserFromExternal( $usr );
return $usr;
}
}
else {
dbg_error_log( "PAM", "User %s is not a valid username (or password was wrong)", $username );
return false;
}
}