ldaü

2026-06-15 01:03:55 +02:00
parent cd5525ff2e
commit 344dbb9b79
9 changed files with 854 additions and 18 deletions
--- a/public/admin/ldap-test/index.php
+++ b/public/admin/ldap-test/index.php
@@ -0,0 +1,205 @@
+<?php
+
+declare(strict_types=1);
+
+require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';
+
+use App\ConfigLoader;
+use App\LdapProvisioner;
+use App\RegistrationAccess;
+
+session_start();
+
+$projectRoot = dirname(__DIR__, 3);
+$config = ConfigLoader::load($projectRoot, 'registration');
+$access = new RegistrationAccess($config);
+
+if (!$access->canManage()) {
+    http_response_code(403);
+    echo 'Kein Zugriff auf LDAP-Test.';
+    exit;
+}
+
+$ldap = new LdapProvisioner($config);
+$csrfToken = (string) ($_SESSION['ldap_test_token'] ?? '');
+
+if ($csrfToken === '') {
+    $csrfToken = bin2hex(random_bytes(16));
+    $_SESSION['ldap_test_token'] = $csrfToken;
+}
+
+$serviceResult = $ldap->testServiceBind();
+$messages = [];
+$errors = [];
+$loginForm = ['username' => '', 'password' => ''];
+$passwordForm = ['username' => '', 'current_password' => '', 'new_password' => '', 'new_password_confirm' => ''];
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $postedToken = (string) ($_POST['csrf_token'] ?? '');
+
+    if ($postedToken === '' || !hash_equals($csrfToken, $postedToken)) {
+        $errors[] = 'Die Formularprüfung ist fehlgeschlagen.';
+    } else {
+        $action = (string) ($_POST['action'] ?? '');
+
+        if ($action === 'test-login') {
+            $loginForm['username'] = trim((string) ($_POST['username'] ?? ''));
+            $loginForm['password'] = (string) ($_POST['password'] ?? '');
+
+            if ($loginForm['username'] === '' || $loginForm['password'] === '') {
+                $errors[] = 'Für den Login-Test sind Benutzername und Passwort erforderlich.';
+            } else {
+                $result = $ldap->testUserCredentials($loginForm['username'], $loginForm['password']);
+
+                if ($result['success'] ?? false) {
+                    $messages[] = $result['message'] . ' DN: ' . (string) ($result['dn'] ?? '');
+                } else {
+                    $errors[] = (string) ($result['message'] ?? 'LDAP-Login fehlgeschlagen.');
+                }
+            }
+        }
+
+        if ($action === 'change-password') {
+            $passwordForm['username'] = trim((string) ($_POST['username'] ?? ''));
+            $passwordForm['current_password'] = (string) ($_POST['current_password'] ?? '');
+            $passwordForm['new_password'] = (string) ($_POST['new_password'] ?? '');
+            $passwordForm['new_password_confirm'] = (string) ($_POST['new_password_confirm'] ?? '');
+
+            if ($passwordForm['username'] === '') {
+                $errors[] = 'Für die Passwortänderung ist ein Benutzername erforderlich.';
+            }
+
+            if ($passwordForm['current_password'] === '') {
+                $errors[] = 'Bitte das aktuelle Passwort angeben, damit der Login vorab geprüft werden kann.';
+            }
+
+            if (strlen($passwordForm['new_password']) < 12) {
+                $errors[] = 'Das neue Passwort muss mindestens 12 Zeichen lang sein.';
+            }
+
+            if ($passwordForm['new_password'] !== $passwordForm['new_password_confirm']) {
+                $errors[] = 'Die neuen Passwörter stimmen nicht überein.';
+            }
+
+            if ($errors === []) {
+                $loginCheck = $ldap->testUserCredentials($passwordForm['username'], $passwordForm['current_password']);
+
+                if (!(bool) ($loginCheck['success'] ?? false)) {
+                    $errors[] = 'Der Vorab-Login mit aktuellem Passwort ist fehlgeschlagen: ' . (string) ($loginCheck['message'] ?? '');
+                } else {
+                    $result = $ldap->updateUserPassword($passwordForm['username'], $passwordForm['new_password']);
+
+                    if ($result['success'] ?? false) {
+                        $messages[] = $result['message'] . ' DN: ' . (string) ($result['dn'] ?? '');
+                        $passwordForm = ['username' => '', 'current_password' => '', 'new_password' => '', 'new_password_confirm' => ''];
+                    } else {
+                        $errors[] = (string) ($result['message'] ?? 'Passwortänderung fehlgeschlagen.');
+                    }
+                }
+            }
+        }
+    }
+}
+?><!DOCTYPE html>
+<html lang="de">
+<head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>LDAP-Test</title>
+    <link rel="stylesheet" href="/assets/auth/login.css">
+</head>
+<body>
+    <main class="login-shell">
+        <section class="login-panel login-panel-wide">
+            <div class="login-panel-top">
+                <p class="login-kicker">Kusche.Berlin</p>
+                <h1>LDAP-Test</h1>
+                <p class="login-copy">Hier kannst du direkt den LDAP-Login prüfen und das Passwort inklusive Samba-Feldern aktualisieren.</p>
+            </div>
+
+            <div class="login-notice <?= ($serviceResult['success'] ?? false) ? 'login-notice-success' : 'login-notice-error' ?>">
+                <strong>Service-Bind</strong>
+                <p><?= htmlspecialchars((string) ($serviceResult['message'] ?? ''), ENT_QUOTES) ?></p>
+            </div>
+
+            <?php if ($messages !== []): ?>
+                <div class="login-notice login-notice-success">
+                    <strong>Ergebnis</strong>
+                    <ul class="login-list">
+                        <?php foreach ($messages as $message): ?>
+                            <li><?= htmlspecialchars($message, ENT_QUOTES) ?></li>
+                        <?php endforeach; ?>
+                    </ul>
+                </div>
+            <?php endif; ?>
+
+            <?php if ($errors !== []): ?>
+                <div class="login-notice login-notice-error">
+                    <strong>Bitte prüfen</strong>
+                    <ul class="login-list">
+                        <?php foreach ($errors as $error): ?>
+                            <li><?= htmlspecialchars($error, ENT_QUOTES) ?></li>
+                        <?php endforeach; ?>
+                    </ul>
+                </div>
+            <?php endif; ?>
+
+            <div class="admin-layout">
+                <section class="admin-detail">
+                    <h2>Login testen</h2>
+                    <form class="login-form" method="post" action="/admin/ldap-test">
+                        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken, ENT_QUOTES) ?>">
+                        <input type="hidden" name="action" value="test-login">
+
+                        <label class="login-field">
+                            <span>Benutzername</span>
+                            <input type="text" name="username" value="<?= htmlspecialchars($loginForm['username'], ENT_QUOTES) ?>" required>
+                        </label>
+
+                        <label class="login-field">
+                            <span>Passwort</span>
+                            <input type="password" name="password" value="" required>
+                        </label>
+
+                        <div class="login-actions">
+                            <button class="login-button login-button-primary" type="submit">LDAP-Login prüfen</button>
+                        </div>
+                    </form>
+                </section>
+
+                <section class="admin-detail">
+                    <h2>Passwort ändern</h2>
+                    <form class="login-form" method="post" action="/admin/ldap-test">
+                        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken, ENT_QUOTES) ?>">
+                        <input type="hidden" name="action" value="change-password">
+
+                        <label class="login-field">
+                            <span>Benutzername</span>
+                            <input type="text" name="username" value="<?= htmlspecialchars($passwordForm['username'], ENT_QUOTES) ?>" required>
+                        </label>
+
+                        <label class="login-field">
+                            <span>Aktuelles Passwort</span>
+                            <input type="password" name="current_password" value="" required>
+                        </label>
+
+                        <label class="login-field">
+                            <span>Neues Passwort</span>
+                            <input type="password" name="new_password" value="" required>
+                        </label>
+
+                        <label class="login-field">
+                            <span>Neues Passwort wiederholen</span>
+                            <input type="password" name="new_password_confirm" value="" required>
+                        </label>
+
+                        <div class="login-actions">
+                            <button class="login-button login-button-primary" type="submit">Passwort im LDAP und SMB ändern</button>
+                        </div>
+                    </form>
+                </section>
+            </div>
+        </section>
+    </main>
+</body>
+</html>
--- a/public/admin/registrations/index.php
+++ b/public/admin/registrations/index.php
@@ -48,7 +48,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
            if (($result['success'] ?? false) !== true) {
                $errors = array_values(array_map('strval', (array) ($result['errors'] ?? [])));
            } else {
-                $notice = 'Registrierung freigegeben. Ein LDIF-Entwurf für den inaktiven Benutzer wurde erzeugt.';
+                $notice = 'Registrierung freigegeben und als inaktiver LDAP-Benutzer angelegt.';
            }
        } elseif ($action === 'reject') {
            $result = $registration->reject($selectedId, (string) ($_POST['reject_reason'] ?? ''), $reviewer);
@@ -79,7 +79,7 @@ $provisioning = is_array($selected['provisioning'] ?? null) ? $selected['provisi
            <div class="login-panel-top">
                <p class="login-kicker">Kusche.Berlin</p>
                <h1>Registrierungsfreigaben</h1>
-                <p class="login-copy">Anfragen werden erst nach Prüfung für LDAP und NAS vorbereitet. Die Freigabe erzeugt aktuell einen LDIF-Entwurf für einen inaktiven Benutzer.</p>
+                <p class="login-copy">Anfragen werden erst nach Prüfung direkt ins LDAP geschrieben. Dabei werden auch Unix- und Samba-Felder gesetzt, der Benutzer bleibt aber zunächst inaktiv.</p>
            </div>

            <?php if ($notice !== null): ?>
@@ -185,8 +185,8 @@ $provisioning = is_array($selected['provisioning'] ?? null) ? $selected['provisi
                                </label>

                                <label class="login-field login-field-span-2">
-                                    <span>memberOf als CSV</span>
-                                    <input type="text" name="member_of_csv" value="<?= htmlspecialchars((string) ($provisioning['member_of_csv'] ?? 'cn=generaluser,cn=groups,dc=nas,dc=kusche,dc=berlin'), ENT_QUOTES) ?>">
+                                    <span>Gruppen-DNs, eine Zeile pro Eintrag</span>
+                                    <textarea name="member_of_list" rows="4"><?= htmlspecialchars((string) ($provisioning['member_of_list'] ?? "cn=generaluser,cn=groups,dc=nas,dc=kusche,dc=berlin"), ENT_QUOTES) ?></textarea>
                                </label>
                            </div>

@@ -196,7 +196,7 @@ $provisioning = is_array($selected['provisioning'] ?? null) ? $selected['provisi
                            </label>

                            <div class="login-actions">
-                                <button class="login-button login-button-primary" type="submit" name="action" value="approve">Freigeben und LDIF erzeugen</button>
+                                <button class="login-button login-button-primary" type="submit" name="action" value="approve">Freigeben und LDAP anlegen</button>
                                <button class="login-button login-button-danger" type="submit" name="action" value="reject">Ablehnen</button>
                            </div>

@@ -206,9 +206,26 @@ $provisioning = is_array($selected['provisioning'] ?? null) ? $selected['provisi
                            </label>
                        </form>

+                        <?php if (((string) ($provisioning['ldap_dn'] ?? '')) !== ''): ?>
+                            <div class="login-notice login-notice-success">
+                                <strong>LDAP-Anlage</strong>
+                                <p>DN: <?= htmlspecialchars((string) ($provisioning['ldap_dn'] ?? ''), ENT_QUOTES) ?></p>
+                                <?php if (is_array($provisioning['group_updates'] ?? null) && $provisioning['group_updates'] !== []): ?>
+                                    <p>Gruppen: <?= htmlspecialchars(implode(', ', array_map('strval', $provisioning['group_updates'])), ENT_QUOTES) ?></p>
+                                <?php endif; ?>
+                            </div>
+                        <?php endif; ?>
+
+                        <?php if (((string) ($provisioning['error'] ?? '')) !== ''): ?>
+                            <div class="login-notice login-notice-error">
+                                <strong>Provisionierungsfehler</strong>
+                                <p><?= htmlspecialchars((string) ($provisioning['error'] ?? ''), ENT_QUOTES) ?></p>
+                            </div>
+                        <?php endif; ?>
+
                        <?php if (((string) ($provisioning['ldif_path'] ?? '')) !== '' && is_file((string) $provisioning['ldif_path'])): ?>
                            <div class="login-notice login-notice-info">
-                                <strong>LDIF-Entwurf</strong>
+                                <strong>LDIF-Fallback</strong>
                                <p><?= htmlspecialchars((string) ($provisioning['ldif_path'] ?? ''), ENT_QUOTES) ?></p>
                                <pre class="login-pre"><?= htmlspecialchars((string) file_get_contents((string) $provisioning['ldif_path']), ENT_QUOTES) ?></pre>
                            </div>