private/desktop
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ycyxc
All checks were successful
Deploy / deploy-staging (push) Successful in 23s
Details
Deploy / deploy-production (push) Has been skipped
Details

Browse Source
This commit is contained in:
Lars Gebhardt-Kusche
2026-06-15 01:26:57 +02:00
parent ecd7f70044
commit e9b86eb7a3
2 changed files with 19 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
public/admin/ldap-test/index.php
View File

@@ -17,6 +17,7 @@ $messages = [];
$errors = [];
$form = ['username' => '', 'password' => '', 'new_password' => ''];
$attempt = null;
$currentUserDn = null;
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$action = (string) ($_POST['action'] ?? '');
@@ -37,10 +38,13 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
}
if ($errors === []) {
$currentUserDn = $ldap->userDnForUsername($form['username']);
if ($action === 'test-login') {
$attempt = [
'action' => 'Login-Test',
'username' => $form['username'],
'user_dn' => $currentUserDn,
];
$result = $ldap->testUserCredentials($form['username'], $form['password']);
@@ -53,6 +57,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$attempt = [
'action' => 'Passwortänderung',
'username' => $form['username'],
'user_dn' => $currentUserDn,
'new_password_length' => (string) strlen($form['new_password']),
];
$loginCheck = $ldap->testUserCredentials($form['username'], $form['password']);
@@ -137,6 +142,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
<ul class="login-list">
<li>Aktion: <?= htmlspecialchars((string) ($attempt['action'] ?? ''), ENT_QUOTES) ?></li>
<li>Benutzername: <?= htmlspecialchars((string) ($attempt['username'] ?? ''), ENT_QUOTES) ?></li>
<li>User-DN: <?= htmlspecialchars((string) ($attempt['user_dn'] ?? ''), ENT_QUOTES) ?></li>
<?php if (isset($attempt['new_password_length'])): ?>
<li>Länge neues Passwort: <?= htmlspecialchars((string) ($attempt['new_password_length'] ?? ''), ENT_QUOTES) ?></li>
<?php endif; ?>

62
src/App/LdapProvisioner.php
View File

@@ -45,6 +45,17 @@ final class LdapProvisioner
];
}
public function userDnForUsername(string $username): string
{
$baseDn = trim((string) ($this->config['ldap']['users_dn'] ?? ''));
if ($baseDn === '') {
throw new RuntimeException('LDAP users_dn ist nicht gesetzt.');
}
return 'uid=' . $username . ',' . $baseDn;
}
/**
* @return array{success: bool, message: string}
*/
@@ -76,11 +87,7 @@ final class LdapProvisioner
}
$link = $this->connect();
$userDn = $this->findUserDnByUid($link, $username);
if ($userDn === null) {
throw new RuntimeException('Benutzer wurde im LDAP nicht gefunden.');
}
$userDn = $this->userDnForUsername($username);
if (!@ldap_bind($link, $userDn, $password)) {
throw new RuntimeException('LDAP-Login fehlgeschlagen: ' . $this->lastError($link));
@@ -106,11 +113,7 @@ final class LdapProvisioner
{
try {
$link = $this->connectAsService();
$userDn = $this->findUserDnByUid($link, $username);
if ($userDn === null) {
throw new RuntimeException('Benutzer wurde im LDAP nicht gefunden.');
}
$userDn = $this->userDnForUsername($username);
$now = time();
$shadowLastChange = (string) floor($now / 86400);
@@ -339,50 +342,11 @@ final class LdapProvisioner
return $link;
}
/**
* @param resource|\LDAP\Connection $link
*/
private function findUserDnByUid($link, string $username): ?string
{
$baseDn = (string) ($this->config['ldap']['users_dn'] ?? '');
if ($baseDn === '') {
throw new RuntimeException('LDAP users_dn ist nicht gesetzt.');
}
$filter = sprintf('(uid=%s)', $this->ldapEscape($username, '', LDAP_ESCAPE_FILTER));
$search = @ldap_search($link, $baseDn, $filter, ['dn']);
if ($search === false) {
throw new RuntimeException('LDAP-Suche fehlgeschlagen: ' . $this->lastError($link));
}
$entries = ldap_get_entries($link, $search);
if (!is_array($entries) || (int) ($entries['count'] ?? 0) < 1) {
return null;
}
return (string) ($entries[0]['dn'] ?? '');
}
private function isInactiveShadowExpiry(): bool
{
return (string) ($this->config['ldap']['shadow_expire'] ?? 1) !== (string) ($this->config['ldap']['active_shadow_expire'] ?? -1);
}
private function ldapEscape(string $value, string $ignore = '', int $flags = 0): string
{
if (function_exists('ldap_escape')) {
return ldap_escape($value, $ignore, $flags);
}
$search = ['\\', '*', '(', ')', "\x00"];
$replace = ['\\5c', '\\2a', '\\28', '\\29', '\\00'];
return str_replace($search, $replace, $value);
}
/**
* @return array<int, string>
*/