SWAT/auth/SLdapAuthModule.php5

<?php

// TODO: - have conditional support for mobile, homePhone
//       - have configurable ad_dn/host
class SLdapAuthModule extends SAuthModule {
    private $ad_server;
    private $ad_port;
    private $ad_dn = null;
    private $ad_user = "anonymous";
    private $ad_pass = "anonymous";
    private $ad_errorCode;
    private $ad_errorText;
    private $ad_connect = null;
    private $ad_bind = null;

    private $userInfoCache = array();       // uid => array(<user info field>)
    private $userNames = array();           // username => uid
    private $groupInfoCache = array();      // gid => array('groupName' => <groupname>, 'users' => <users(uids) in group>)
    private $groupNames = array();          // groupname => gid

    private $currentUid = null;
    private $currentGroups = null;

    private $fullUserLookup = false;
    private $fullGroupLookup = false;


    public function clearUserCache() {
        $this->userInfoCache = array();
    }

    public function clearGroupCache() {
        $this->groupInfoCache = array();
    }

    public function clearAllCaches() {
        $this->clearUserCache();
        $this->clearGroupCache();
    }

    public function getUserInfo($uid) {
        if(ctype_digit((string) $uid)) {
            if(!isset($this->userInfoCache[$uid]))
                if($this->lookupUsers() /*$uid)*/ === false)
                    return null;    // error doing ldap
        }
        else if(is_string($uid) && $uid != "") {
            if(!isset($this->userNames[$uid]))
                if($this->lookupUsers() === false)
                    return null;    // error doing ldap
            if(!isset($this->userNames[$uid]))
                return null;        // user doesn't exist
            $uid = $this->userNames[$uid];
            if(!isset($this->userInfoCache[$uid]))
                if($this->lookupUsers() === false)
                    return null;
        }
        else
            return null;

        if(isset($this->userInfoCache[$uid]))
            return $this->userInfoCache[$uid];
        else
            return null;
    }

    public function getUidFromUserName($username) {
        $username = strtolower($username);
        if(isset($this->userNames[$username]))
            return $this->userNames[$username];
        $this->lookupUsers();
        if(isset($this->userNames[$username]))
            return $this->userNames[$username];
        else
            return false;
    }

    public function getUidFromRealName($firstName = "", $lastName = "") {
        $this->lookupUsers();
        $firstName = strtolower($firstName);
        $lastName = strtolower($lastName);
        $matches = array();
        foreach($this->userInfoCache as $uid => $uinfo) {
            if($firstName != "" && strtolower($uinfo['firstName']) == $firstName) {
                if($lastName != "" && strtolower($uinfo['lastName']) == $lastName) {
                    array_push($matches, $uid);
                }
                continue;
            }
            if($lastName != "" && strtolower($uinfo['lastName']) == $lastName)
                array_push($matches, $uid);
        }
        return $matches;
    }

    public function getGroupInfo($gid) {
        if(ctype_digit((string) $gid)) {
            if(!isset($this->groupInfoCache[$gid]))
                if($this->lookupGroups($gid) === false)
                    return null;    // error doing ldap
        }
        else if($gid != "") {
            if(!isset($this->groupNames[$gid]))
                if($this->lookupGroups() === false)
                    return null;    // error doing ldap
            if(!isset($this->groupNames[$gid]))
                return null;        // group doesn't exist
            $gid = $this->groupNames[$gid];
        }
        else
            return null;

        return $this->groupInfoCache[$gid];//['groupname'];
    }

    public function getUserFromUid($uid) {
        if(isset($this->userInfoCache[$uid]))
            return $this->userInfoCache[$uid];
        $this->lookupUsers();
        if(isset($this->userInfoCache[$uid]))
            return $this->userInfoCache[$uid];
        return null;
    }

    public function getGroupFromGid($gid) {
        if(isset($this->groupInfoCache[$gid]))
            return $this->groupInfoCache[$gid]['groupname'];
        $this->lookupGroups($gid);
        if(isset($this->groupInfoCache[$gid]))
            return $this->groupInfoCache[$gid]['groupname'];
        return null;
    }

    public function listGroups($uid = "") {
        if($uid != "") {
            $this->lookupUsers();
            if(!isset($this->userInfoCache[$uid]))
                return null;
            $res = array();
            $this->lookupGroups();
            foreach($this->userInfoCache[$uid]['groups'] as $gid) {
                $res[$gid] = $this->groupInfoCache[$gid]['groupname'];
            }
            return $res;
        }
        $this->lookupGroups();
        return $this->groupInfoCache;
    }

    public function listUsers() {
        $this->lookupUsers();
        return $this->userInfoCache;
    }

    public function __construct() {
        parent::__construct();

        $this->ad_server = SConfig::getDefault('ldap.host');
        $this->ad_port = SConfig::getDefault('ldap.port');
        $this->ad_dn = SConfig::getDefault('ldap.domain');
    }

    public function authenticate($username, $password) {
        $username = strtolower($username);
        if(!$this->connect($this->ad_server, $this->ad_port, $this->ad_dn, $username, $password))
            return false;
        $this->fillLoggedInUserInfo();
        $this->lookupGroups();
        $staffGid = $this->groupNames['staff'];
        $internGid = $this->groupNames['interns'];
        if(isset($this->groupNames['apprentice']))
            $apprenticeGid = $this->groupNames['apprentice'];
        else
            $apprenticeGid = -1;
        if(in_array($staffGid, $this->userInfoCache[$this->currentUid]['groups']))
            $this->role = "staff";
        else if(in_array($internGid, $this->userInfoCache[$this->currentUid]['groups']))
            $this->role = "intern";
        else if(in_array($apprenticeGid, $this->userInfoCache[$this->currentUid]['groups']))
            $this->role = "apprentice";
        else
            $this->role = "";
        return true;
    }

    public function getPassword() {
        return $this->ad_pass;
    }

    public function getUserName() {
        return $this->ad_user;
    }

    public function getUID() {
        return $this->currentUid;
    }

    public function getFirstName($uid = '') {
        if($uid == '')
            $uid = $this->currentUid;
        if(!isset($this->userInfoCache[$uid]))
            $this->fillLoggedInUserInfo($uid);
        return $this->userInfoCache[$uid]['firstName'];
    }

    public function getLastName($uid = '') {
        if($uid == '')
            $uid = $this->currentUid;
        if(!isset($this->userInfoCache[$uid]))
            $this->fillLoggedInUserInfo($uid);
        return $this->userInfoCache[$uid]['lastName'];
    }

    public function getEmail($uid = '') {
        if($uid == '')
            $uid = $this->currentUid;
        if(!isset($this->userInfoCache[$uid]))
            $this->fillLoggedInUserInfo($uid);
        if(isset($this->userInfoCache[$uid]['email'][0]))
            return $this->userInfoCache[$uid]['email'][0];
        else
            return false;
    }

    public function getPhone($uid = '') {
        if($uid == '')
            $uid = $this->currentUid;
        if(!isset($this->userInfoCache[$uid]))
            $this->fillLoggedInUserInfo($uid);
        if(isset($this->userInfoCache[$uid]['telephoneNumber'][0]))
            return $this->userInfoCache[$uid]['telephoneNumber'][0];
        else
            return false;
    }

    public function getMobile($uid = '') {
        if($uid == '')
            $uid = $this->currentUid;
        if(!isset($this->userInfoCache[$uid]))
            $this->fillLoggedInUserInfo($uid);
        if(isset($this->userInfoCache[$uid]['mobile'][0]))
            return $this->userInfoCache[$uid]['mobile'][0];
        else
            return false;
    }

    public function getHomePhone($uid = '') {
        if($uid == '')
            $uid = $this->currentUid;
        if(!isset($this->userInfoCache[$uid]))
            $this->fillLoggedInUserInfo($uid);
        if(isset($this->userInfoCache[$uid]['homePhone'][0]))
            return $this->userInfoCache[$uid]['homePhone'][0];
        else
            return false;
    }

    public function getRole() {
        return $this->role;
    }

    public function getPermissions() {
        return false;
    }

    private function connect($server, $port, $dn, $user = "anonymous", $pass = "anonymous") {
        if($this->ad_connect != null)
            return false;
        $user = strtolower($user);
        $this->ad_server = $server;
        $this->ad_port = $port;
        $this->ad_dn = $dn;
        $this->ad_user = $user;
        $this->ad_pass = $pass;

        $this->ad_connect = ldap_connect($this->ad_server, (int)$this->ad_port);
        ldap_set_option($this->ad_connect, LDAP_OPT_PROTOCOL_VERSION, 3);

        if($user == "" || $pass == "")
            return false;

        register_shutdown_function(array($this, 'disconnect'));
        $this->ad_bind = ldap_bind($this->ad_connect, "uid=$user,ou=People,dc=".$this->ad_dn[0].",dc=".$this->ad_dn[1],
                                    $this->ad_pass);
        if(!$this->ad_bind)
            return false;
        else
            return true;
    }

    public function disconnect() {
        if($this->ad_connect != null) {
            $ret = ldap_close($this->ad_connect);
        }
        $this->ad_connect = null;
    }

    private function checkConnect() {
        if($this->ad_connect == null) {
            if(!$this->connect($this->ad_server, $this->ad_port, $this->ad_dn, $this->ad_user, $this->ad_pass))
                return false;
        }

        return true;
    }

    private function fillLoggedInUserInfo($uid = '') {
        if(!$this->checkConnect()) return false;
        if($uid != '') {
            $this->lookupUsers();
            return true;
        }
        else {
            if($this->lookupUsers($this->ad_user) == false)
                return false;
            $this->currentUid = $this->userNames[$this->ad_user];
            $this->currentGroups = $this->userInfoCache[$this->currentUid]['groups'];
            return true;
        }
    }

    private function lookupUsers($username = "") {
        if(!$this->checkConnect()) return false;

        $username = strtolower($username);

        if(count($this->userInfoCache) > 0) {
            if(($username == "" && $this->fullUserLookup)
                || ($username != "" && isset($this->userNames[$username]))) {
                return true;
            }
        }

        if($username != "")
            $filter = "(|(memberUid=$username)(uid=$username))";
        else
            $filter = "(|(objectClass=posixGroup)(objectClass=inetOrgPerson))";
        $attribute = array('uid', 'uidNumber', 'cn', 'sn', 'givenName', 'mail', 'gidNumber', 'objectClass', 'memberUid',
                            'telephoneNumber', 'mobile', 'homePhone');

        $result = @ldap_search($this->ad_connect, "dc=".$this->ad_dn[0].",dc=".$this->ad_dn[1], $filter, $attribute);
        if($result === false) {
            $this->setError("Could not get LDAP information about users");
            return false;
        }
        ldap_sort($this->ad_connect, $result, 'cn');
        ldap_sort($this->ad_connect, $result, 'sn');
        ldap_sort($this->ad_connect, $result, 'objectClass');
        $entries = @ldap_get_entries($this->ad_connect, $result);

        $users = array();
        $groups = array();
        for($i = 0; $i < $entries['count']; $i++) {
            if(in_array('posixAccount', $entries[$i]['objectclass']))
                array_push($users, $entries[$i]);
            else if(in_array('posixGroup', $entries[$i]['objectclass']))
                array_push($groups, $entries[$i]);
        }

        // do users first
        for($i = 0; $i < count($users); $i++) {
            $mails = array();
            if(isset($users[$i]['mail']) && $users[$i]['mail']['count'] > 0) {
                foreach($users[$i]['mail'] as $k => $m) {
                    if(ctype_digit((string) $k))
                        $mails[] = $m;
                }
            }
            $tnums = array();
            if(isset($users[$i]['telephonenumber']) && $users[$i]['telephonenumber']['count'] > 0) {
                foreach($users[$i]['telephonenumber'] as $k => $m) {
                    if(ctype_digit((string) $k))
                        $tnums[] = $m;
                }
            }
            $mobiles = array();
            if(isset($users[$i]['mobile']) && $users[$i]['mobile']['count'] > 0) {
                foreach($users[$i]['mobile'] as $k => $m) {
                    if(ctype_digit((string) $k))
                        $mobiles[] = $m;
                }
            }
            $homes = array();
            if(isset($users[$i]['homephone']) && $users[$i]['homephone']['count'] > 0) {
                foreach($users[$i]['homephone'] as $k => $m) {
                    if(ctype_digit((string) $k))
                        $homes[] = $m;
                }
            }
            $this->userInfoCache[$users[$i]['uidnumber'][0]] = array(
                'userName' => $users[$i]['uid'][0],
                'firstName' => isset($users[$i]['givenname'][0]) ? $users[$i]['givenname'][0] : '',
                'lastName' => isset($users[$i]['sn'][0]) ? $users[$i]['sn'][0] : '',
                'email' => $mails,
                'telephoneNumber' => $tnums,
                'mobile' => $mobiles,
                'homePhone' => $homes,
                'groups' => array()
            );
            $this->userNames[$users[$i]['uid'][0]] = $users[$i]['uidnumber'][0];
        }

        // ...and then groups!
        for($i = 0; $i < count($groups); $i++) {
            if(!isset($groups[$i]['memberuid']))
                continue;
            if($username != "")
                array_push($this->userInfoCache[$this->userNames[$username]]['groups'], $groups[$i]['gidnumber'][0]);
            else {
                foreach($groups[$i]['memberuid'] as $muid) {
                    if(isset($this->userNames[$muid]))
                        array_push($this->userInfoCache[$this->userNames[$muid]]['groups'], $groups[$i]['gidnumber'][0]);
                }
            }
        }

        if($username == "")
            $this->fullUserLookup = true;

        $GLOBALS['SWAT']->syncSession();

        return true;
    }

    private function lookupGroups($gid = "") {
        if(!$this->checkConnect()) return false;
        if(count($this->groupInfoCache) > 0) {
            if(($gid == "" && $this->fullGroupLookup)
                || ($gid != "" && isset($this->groupCacheInfo[$gid]))) {
                return true;
            }
        }

        if($gid != "")
            $filter = "(&(objectClass=posixGroup)(gidNumber=$gid))";
        else
            $filter = "(objectClass=posixGroup)";
        $attribute = array('cn', 'gidNumber', 'memberUid');

        $result = @ldap_search($this->ad_connect, "ou=Group,dc=".$this->ad_dn[0].",dc=".$this->ad_dn[1], $filter, $attribute);
        if($result === false) {
            $this->setError("Could not get LDAP information about groups");
            return false;
        }
        ldap_sort($this->ad_connect, $result, "cn");
        $entries = @ldap_get_entries($this->ad_connect, $result);
        for($i = 0; $i < $entries['count']; $i++) {
            $this->groupInfoCache[$entries[$i]['gidnumber'][0]] = array('groupname' => $entries[$i]['cn'][0], 'users' => array());
            $this->groupNames[$entries[$i]['cn'][0]] = $entries[$i]['gidnumber'][0];
            if(isset($entries[$i]['memberuid'])) {
                for($j = 0; $j < $entries[$i]['memberuid']['count']; $j++) {
                    array_push($this->groupInfoCache[$entries[$i]['gidnumber'][0]]['users'],$entries[$i]['memberuid'][$j]);
                }
            }
        }

        if($gid == "")
            $this->fullGroupLookup = true;

        $GLOBALS['SWAT']->syncSession();

        return true;
    }

    public function __sleep() {
        $this->disconnect();
        return array_keys(get_object_vars($this));
    }

    public function __wakeup() {
        $this->checkConnect();
        return array_keys(get_object_vars($this));
    }
}

?>

---