nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-08-24 17:36:39 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update LDAP driver to support SASL binds

Browse Source 
Add a new 'sasl' option to the LDAP driver, which invokes
ldap_sasl_bind() instead of ldap_bind().

This allows authenticating to LDAP using the GSSAPI (kerberos) or
EXTERNAL mechanisms, rather than a bindDN and password.

Note that for GSSAPI binds, PHP needs access to valid kerberos
credentials (for example, by setting the KRB5CCNAME environment variable
for the PHP process).

Tested with OpenLDAP/Heimdal kerberos, but should also work with Active
Directory.
This commit is contained in:
Stonewall Jackson 2024-02-27 11:08:25 -05:00
parent 27ff697d55
commit c8424ae5d5
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
config/example-config.php
View File

@ -691,6 +691,12 @@ $c->admin_email = 'calendar-admin@example.com';
// 'bindDN' => 'cn=calendar-manager,ou=users,dc=example,dc=net',
// 'passDN' => 'xxxxxxxx',
// /* Perform a SASL bind (usually EXTERNAL/GSSAPI) instead of a
// * simple bind. Enalbe this if you would like to authenticate to
// * the LDAP server using Kerberos credentials.
// */
// 'sasl' => 'yes', // perform a sasl bind
// 'protocolVersion' => '3', // version of LDAP protocol to use
// 'optReferrals' => 0, // whether to automatically follow referrals
// // returned by the LDAP server
@ -773,6 +779,7 @@ $c->admin_email = 'calendar-admin@example.com';
// $c->authenticate_hook['config'] = array(
// 'host' => 'ldap://ldap.example.net',
// 'port' => '389', // usually 636 for ldaps
// 'sasl' => 'yes',
// 'bindDN' => 'cn=bind-user,cn=Users,dc=example,dc=net',
// 'passDN' => 'secret',
// 'baseDNUsers' => 'dc=example,dc=net',

3
inc/drivers_ldap.php
View File

@ -118,7 +118,8 @@ class ldapDriver
//ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);
//connect as root
if (!ldap_bind($this->connect, (isset($config['bindDN']) ? $config['bindDN'] : null), (isset($config['passDN']) ? $config['passDN'] : null) ) ){
$bind_func = isset($config['sasl']) ? 'ldap_sasl_bind' : 'ldap_bind';
if (!$bind_func($this->connect, (isset($config['bindDN']) ? $config['bindDN'] : null), (isset($config['passDN']) ? $config['passDN'] : null) ) ){
$bindDN = isset($config['bindDN']) ? $config['bindDN'] : 'anonymous';
$passDN = isset($config['passDN']) ? $config['passDN'] : 'anonymous';