private/desktop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ldap test
All checks were successful
Deploy / deploy-staging (push) Successful in 23s
Details
Deploy / deploy-production (push) Has been skipped
Details

Browse Source
This commit is contained in:
Lars Gebhardt-Kusche
2026-06-15 01:08:54 +02:00
parent 344dbb9b79
commit c29f05762e
1 changed files with 51 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files

174
public/admin/ldap-test/index.php
View File

@@ -6,95 +6,57 @@ require_once dirname(__DIR__, 3) . '/src/App/bootstrap.php';
use App\ConfigLoader; use App\ConfigLoader;
use App\LdapProvisioner; use App\LdapProvisioner;
use App\RegistrationAccess;
session_start();
$projectRoot = dirname(__DIR__, 3); $projectRoot = dirname(__DIR__, 3);
$config = ConfigLoader::load($projectRoot, 'registration'); $config = ConfigLoader::load($projectRoot, 'registration');
$access = new RegistrationAccess($config);
if (!$access->canManage()) {
http_response_code(403);
echo 'Kein Zugriff auf LDAP-Test.';
exit;
}
$ldap = new LdapProvisioner($config); $ldap = new LdapProvisioner($config);
$csrfToken = (string) ($_SESSION['ldap_test_token'] ?? '');
if ($csrfToken === '') {
$csrfToken = bin2hex(random_bytes(16));
$_SESSION['ldap_test_token'] = $csrfToken;
}
$serviceResult = $ldap->testServiceBind(); $serviceResult = $ldap->testServiceBind();
$messages = []; $messages = [];
$errors = []; $errors = [];
$loginForm = ['username' => '', 'password' => '']; $form = ['username' => '', 'password' => '', 'new_password' => ''];
$passwordForm = ['username' => '', 'current_password' => '', 'new_password' => '', 'new_password_confirm' => ''];
if ($_SERVER['REQUEST_METHOD'] === 'POST') { if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$postedToken = (string) ($_POST['csrf_token'] ?? ''); $action = (string) ($_POST['action'] ?? '');
$form['username'] = trim((string) ($_POST['username'] ?? ''));
$form['password'] = (string) ($_POST['password'] ?? '');
$form['new_password'] = (string) ($_POST['new_password'] ?? '');
if ($postedToken === '' || !hash_equals($csrfToken, $postedToken)) { if ($form['username'] === '') {
$errors[] = 'Die Formularprüfung ist fehlgeschlagen.'; $errors[] = 'Benutzername ist erforderlich.';
} else { }
$action = (string) ($_POST['action'] ?? '');
if ($form['password'] === '') {
$errors[] = 'Passwort ist erforderlich.';
}
if ($action === 'change-password' && strlen($form['new_password']) < 12) {
$errors[] = 'Das neue Passwort muss mindestens 12 Zeichen lang sein.';
}
if ($errors === []) {
if ($action === 'test-login') { if ($action === 'test-login') {
$loginForm['username'] = trim((string) ($_POST['username'] ?? '')); $result = $ldap->testUserCredentials($form['username'], $form['password']);
$loginForm['password'] = (string) ($_POST['password'] ?? '');
if ($loginForm['username'] === '' || $loginForm['password'] === '') { if ($result['success'] ?? false) {
$errors[] = 'Für den Login-Test sind Benutzername und Passwort erforderlich.'; $messages[] = $result['message'] . ' DN: ' . (string) ($result['dn'] ?? '');
} else { } else {
$result = $ldap->testUserCredentials($loginForm['username'], $loginForm['password']); $errors[] = (string) ($result['message'] ?? 'LDAP-Login fehlgeschlagen.');
}
} elseif ($action === 'change-password') {
$loginCheck = $ldap->testUserCredentials($form['username'], $form['password']);
if (!(bool) ($loginCheck['success'] ?? false)) {
$errors[] = 'Der Login mit aktuellem Passwort ist fehlgeschlagen: ' . (string) ($loginCheck['message'] ?? '');
} else {
$result = $ldap->updateUserPassword($form['username'], $form['new_password']);
if ($result['success'] ?? false) { if ($result['success'] ?? false) {
$messages[] = $result['message'] . ' DN: ' . (string) ($result['dn'] ?? ''); $messages[] = $result['message'] . ' DN: ' . (string) ($result['dn'] ?? '');
$form['password'] = '';
$form['new_password'] = '';
} else { } else {
$errors[] = (string) ($result['message'] ?? 'LDAP-Login fehlgeschlagen.'); $errors[] = (string) ($result['message'] ?? 'Passwortänderung fehlgeschlagen.');
}
}
}
if ($action === 'change-password') {
$passwordForm['username'] = trim((string) ($_POST['username'] ?? ''));
$passwordForm['current_password'] = (string) ($_POST['current_password'] ?? '');
$passwordForm['new_password'] = (string) ($_POST['new_password'] ?? '');
$passwordForm['new_password_confirm'] = (string) ($_POST['new_password_confirm'] ?? '');
if ($passwordForm['username'] === '') {
$errors[] = 'Für die Passwortänderung ist ein Benutzername erforderlich.';
}
if ($passwordForm['current_password'] === '') {
$errors[] = 'Bitte das aktuelle Passwort angeben, damit der Login vorab geprüft werden kann.';
}
if (strlen($passwordForm['new_password']) < 12) {
$errors[] = 'Das neue Passwort muss mindestens 12 Zeichen lang sein.';
}
if ($passwordForm['new_password'] !== $passwordForm['new_password_confirm']) {
$errors[] = 'Die neuen Passwörter stimmen nicht überein.';
}
if ($errors === []) {
$loginCheck = $ldap->testUserCredentials($passwordForm['username'], $passwordForm['current_password']);
if (!(bool) ($loginCheck['success'] ?? false)) {
$errors[] = 'Der Vorab-Login mit aktuellem Passwort ist fehlgeschlagen: ' . (string) ($loginCheck['message'] ?? '');
} else {
$result = $ldap->updateUserPassword($passwordForm['username'], $passwordForm['new_password']);
if ($result['success'] ?? false) {
$messages[] = $result['message'] . ' DN: ' . (string) ($result['dn'] ?? '');
$passwordForm = ['username' => '', 'current_password' => '', 'new_password' => '', 'new_password_confirm' => ''];
} else {
$errors[] = (string) ($result['message'] ?? 'Passwortänderung fehlgeschlagen.');
}
} }
} }
} }
@@ -114,7 +76,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
<div class="login-panel-top"> <div class="login-panel-top">
<p class="login-kicker">Kusche.Berlin</p> <p class="login-kicker">Kusche.Berlin</p>
<h1>LDAP-Test</h1> <h1>LDAP-Test</h1>
<p class="login-copy">Hier kannst du direkt den LDAP-Login prüfen und das Passwort inklusive Samba-Feldern aktualisieren.</p> <p class="login-copy">Diese Testseite läuft unabhängig vom eigentlichen Desktop-Login. Hier kannst du nur LDAP-Login und Passwortänderung inklusive Samba-Feldern prüfen.</p>
</div> </div>
<div class="login-notice <?= ($serviceResult['success'] ?? false) ? 'login-notice-success' : 'login-notice-error' ?>"> <div class="login-notice <?= ($serviceResult['success'] ?? false) ? 'login-notice-success' : 'login-notice-error' ?>">
@@ -144,61 +106,27 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
</div> </div>
<?php endif; ?> <?php endif; ?>
<div class="admin-layout"> <form class="login-form" method="post" action="/admin/ldap-test">
<section class="admin-detail"> <label class="login-field">
<h2>Login testen</h2> <span>Benutzername</span>
<form class="login-form" method="post" action="/admin/ldap-test"> <input type="text" name="username" value="<?= htmlspecialchars($form['username'], ENT_QUOTES) ?>" required>
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken, ENT_QUOTES) ?>"> </label>
<input type="hidden" name="action" value="test-login">
<label class="login-field"> <label class="login-field">
<span>Benutzername</span> <span>Passwort</span>
<input type="text" name="username" value="<?= htmlspecialchars($loginForm['username'], ENT_QUOTES) ?>" required> <input type="password" name="password" value="" required>
</label> </label>
<label class="login-field"> <label class="login-field">
<span>Passwort</span> <span>Neues Passwort</span>
<input type="password" name="password" value="" required> <input type="password" name="new_password" value="" placeholder="Nur für Passwortänderung erforderlich">
</label> </label>
<div class="login-actions"> <div class="login-actions">
<button class="login-button login-button-primary" type="submit">LDAP-Login prüfen</button> <button class="login-button login-button-primary" type="submit" name="action" value="test-login">Login-Test</button>
</div> <button class="login-button login-button-secondary" type="submit" name="action" value="change-password">Neues Passwort setzen</button>
</form> </div>
</section> </form>
<section class="admin-detail">
<h2>Passwort ändern</h2>
<form class="login-form" method="post" action="/admin/ldap-test">
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken, ENT_QUOTES) ?>">
<input type="hidden" name="action" value="change-password">
<label class="login-field">
<span>Benutzername</span>
<input type="text" name="username" value="<?= htmlspecialchars($passwordForm['username'], ENT_QUOTES) ?>" required>
</label>
<label class="login-field">
<span>Aktuelles Passwort</span>
<input type="password" name="current_password" value="" required>
</label>
<label class="login-field">
<span>Neues Passwort</span>
<input type="password" name="new_password" value="" required>
</label>
<label class="login-field">
<span>Neues Passwort wiederholen</span>
<input type="password" name="new_password_confirm" value="" required>
</label>
<div class="login-actions">
<button class="login-button login-button-primary" type="submit">Passwort im LDAP und SMB ändern</button>
</div>
</form>
</section>
</div>
</section> </section>
</main> </main>
</body> </body>