ycyxc

src/App/LdapProvisioner.php

@@ -45,6 +45,17 @@ final class LdapProvisioner
         ];
     }
 
+    public function userDnForUsername(string $username): string
+    {
+        $baseDn = trim((string) ($this->config['ldap']['users_dn'] ?? ''));
+
+        if ($baseDn === '') {
+            throw new RuntimeException('LDAP users_dn ist nicht gesetzt.');
+        }
+
+        return 'uid=' . $username . ',' . $baseDn;
+    }
+
     /**
      * @return array{success: bool, message: string}
      */
@@ -76,11 +87,7 @@ final class LdapProvisioner
             }
 
             $link = $this->connect();
-            $userDn = $this->findUserDnByUid($link, $username);
-
-            if ($userDn === null) {
-                throw new RuntimeException('Benutzer wurde im LDAP nicht gefunden.');
-            }
+            $userDn = $this->userDnForUsername($username);
 
             if (!@ldap_bind($link, $userDn, $password)) {
                 throw new RuntimeException('LDAP-Login fehlgeschlagen: ' . $this->lastError($link));
@@ -106,11 +113,7 @@ final class LdapProvisioner
     {
         try {
             $link = $this->connectAsService();
-            $userDn = $this->findUserDnByUid($link, $username);
-
-            if ($userDn === null) {
-                throw new RuntimeException('Benutzer wurde im LDAP nicht gefunden.');
-            }
+            $userDn = $this->userDnForUsername($username);
 
             $now = time();
             $shadowLastChange = (string) floor($now / 86400);
@@ -339,50 +342,11 @@ final class LdapProvisioner
         return $link;
     }
 
-    /**
-     * @param resource|\LDAP\Connection $link
-     */
-    private function findUserDnByUid($link, string $username): ?string
-    {
-        $baseDn = (string) ($this->config['ldap']['users_dn'] ?? '');
-
-        if ($baseDn === '') {
-            throw new RuntimeException('LDAP users_dn ist nicht gesetzt.');
-        }
-
-        $filter = sprintf('(uid=%s)', $this->ldapEscape($username, '', LDAP_ESCAPE_FILTER));
-        $search = @ldap_search($link, $baseDn, $filter, ['dn']);
-
-        if ($search === false) {
-            throw new RuntimeException('LDAP-Suche fehlgeschlagen: ' . $this->lastError($link));
-        }
-
-        $entries = ldap_get_entries($link, $search);
-
-        if (!is_array($entries) || (int) ($entries['count'] ?? 0) < 1) {
-            return null;
-        }
-
-        return (string) ($entries[0]['dn'] ?? '');
-    }
-
     private function isInactiveShadowExpiry(): bool
     {
         return (string) ($this->config['ldap']['shadow_expire'] ?? 1) !== (string) ($this->config['ldap']['active_shadow_expire'] ?? -1);
     }
 
-    private function ldapEscape(string $value, string $ignore = '', int $flags = 0): string
-    {
-        if (function_exists('ldap_escape')) {
-            return ldap_escape($value, $ignore, $flags);
-        }
-
-        $search = ['\\', '*', '(', ')', "\x00"];
-        $replace = ['\\5c', '\\2a', '\\28', '\\29', '\\00'];
-
-        return str_replace($search, $replace, $value);
-    }
-
     /**
      * @return array<int, string>
      */