ycyxc

public/admin/ldap-test/index.php

@@ -17,6 +17,7 @@ $messages = [];
 $errors = [];
 $form = ['username' => '', 'password' => '', 'new_password' => ''];
 $attempt = null;
+$currentUserDn = null;
 
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $action = (string) ($_POST['action'] ?? '');
@@ -37,10 +38,13 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     }
 
     if ($errors === []) {
+        $currentUserDn = $ldap->userDnForUsername($form['username']);
+
         if ($action === 'test-login') {
             $attempt = [
                 'action' => 'Login-Test',
                 'username' => $form['username'],
+                'user_dn' => $currentUserDn,
             ];
             $result = $ldap->testUserCredentials($form['username'], $form['password']);
 
@@ -53,6 +57,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
             $attempt = [
                 'action' => 'Passwortänderung',
                 'username' => $form['username'],
+                'user_dn' => $currentUserDn,
                 'new_password_length' => (string) strlen($form['new_password']),
             ];
             $loginCheck = $ldap->testUserCredentials($form['username'], $form['password']);
@@ -137,6 +142,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
                     <ul class="login-list">
                         <li>Aktion: <?= htmlspecialchars((string) ($attempt['action'] ?? ''), ENT_QUOTES) ?></li>
                         <li>Benutzername: <?= htmlspecialchars((string) ($attempt['username'] ?? ''), ENT_QUOTES) ?></li>
+                        <li>User-DN: <?= htmlspecialchars((string) ($attempt['user_dn'] ?? ''), ENT_QUOTES) ?></li>
                         <?php if (isset($attempt['new_password_length'])): ?>
                             <li>Länge neues Passwort: <?= htmlspecialchars((string) ($attempt['new_password_length'] ?? ''), ENT_QUOTES) ?></li>
                         <?php endif; ?>

src/App/LdapProvisioner.php

@@ -45,6 +45,17 @@ final class LdapProvisioner
         ];
     }
 
+    public function userDnForUsername(string $username): string
+    {
+        $baseDn = trim((string) ($this->config['ldap']['users_dn'] ?? ''));
+
+        if ($baseDn === '') {
+            throw new RuntimeException('LDAP users_dn ist nicht gesetzt.');
+        }
+
+        return 'uid=' . $username . ',' . $baseDn;
+    }
+
     /**
      * @return array{success: bool, message: string}
      */
@@ -76,11 +87,7 @@ final class LdapProvisioner
             }
 
             $link = $this->connect();
-            $userDn = $this->findUserDnByUid($link, $username);
+            $userDn = $this->userDnForUsername($username);
-
-            if ($userDn === null) {
-                throw new RuntimeException('Benutzer wurde im LDAP nicht gefunden.');
-            }
 
             if (!@ldap_bind($link, $userDn, $password)) {
                 throw new RuntimeException('LDAP-Login fehlgeschlagen: ' . $this->lastError($link));
@@ -106,11 +113,7 @@ final class LdapProvisioner
     {
         try {
             $link = $this->connectAsService();
-            $userDn = $this->findUserDnByUid($link, $username);
+            $userDn = $this->userDnForUsername($username);
-
-            if ($userDn === null) {
-                throw new RuntimeException('Benutzer wurde im LDAP nicht gefunden.');
-            }
 
             $now = time();
             $shadowLastChange = (string) floor($now / 86400);
@@ -339,50 +342,11 @@ final class LdapProvisioner
         return $link;
     }
 
-    /**
-     * @param resource|\LDAP\Connection $link
-     */
-    private function findUserDnByUid($link, string $username): ?string
-    {
-        $baseDn = (string) ($this->config['ldap']['users_dn'] ?? '');
-
-        if ($baseDn === '') {
-            throw new RuntimeException('LDAP users_dn ist nicht gesetzt.');
-        }
-
-        $filter = sprintf('(uid=%s)', $this->ldapEscape($username, '', LDAP_ESCAPE_FILTER));
-        $search = @ldap_search($link, $baseDn, $filter, ['dn']);
-
-        if ($search === false) {
-            throw new RuntimeException('LDAP-Suche fehlgeschlagen: ' . $this->lastError($link));
-        }
-
-        $entries = ldap_get_entries($link, $search);
-
-        if (!is_array($entries) || (int) ($entries['count'] ?? 0) < 1) {
-            return null;
-        }
-
-        return (string) ($entries[0]['dn'] ?? '');
-    }
-
     private function isInactiveShadowExpiry(): bool
     {
         return (string) ($this->config['ldap']['shadow_expire'] ?? 1) !== (string) ($this->config['ldap']['active_shadow_expire'] ?? -1);
     }
 
-    private function ldapEscape(string $value, string $ignore = '', int $flags = 0): string
-    {
-        if (function_exists('ldap_escape')) {
-            return ldap_escape($value, $ignore, $flags);
-        }
-
-        $search = ['\\', '*', '(', ')', "\x00"];
-        $replace = ['\\5c', '\\2a', '\\28', '\\29', '\\00'];
-
-        return str_replace($search, $replace, $value);
-    }
-
     /**
      * @return array<int, string>
      */