Ldap authentication + identity with ldap fields

[jfsenechal]

Hello,

Because ldap plugins are obsolete
Plugin_Repository ? Roundcube Webmail

I have rewrite the plugin ldap_authentication for round 0.5

So I share with you

this is a beta version, be cool with this

Code Select Expand

<?php
//config.inc.php

/* 17/02/2011 -
 Get users/identities from an LDAP directory
 Inspired by plugin ldap_authentication  
*/

$rcmail_config['ldap_hostname'] = 'ldap.domain.be';
$rcmail_config['ldap_bind_username'] = '';
$rcmail_config['ldap_bind_password'] = '';
$rcmail_config['ldap_base_dn'] = 'ou=Users,ou=Group,dc=domain,dc=be';

$rcmail_config['use_tls'] = false;
//does check bind ldap with username and password given by user ?
$rcmail_config['use_authentication'] = false;

// %u is the query for login user (or email!)
$rcmail_config['ldap_filter'] = 'uid=%u';

/*
* field for create user
*/

$rcmail_config['ldap_create_uid'] = 'uid';
#if more one element, merge the 2 fields
$rcmail_config['ldap_create_name'] = array('cn','sn'); #can array(givenName)
$rcmail_config['ldap_create_email'] = 'mail';

?>



[jfsenechal]

Grrrrrrrrrrrrr

Tooo short maximum characters ! :mad:

[jfsenechal]

My class in two thread :mad:

Code Select Expand

<?php

/**
* LDAP Authentication
*
* This plugin replaces the RoundCube login page with authentication requests
* to a LDAP server, which enables logging into RoundCube with identities
* authenticated by the LDAP server
*
* @version 0.1
* @author jf
*
*/
class ldap_authentication extends rcube_plugin {
   /*
    * Connection and bind default variables
    *
    * @var mixed
    * @var mixed
    */

   private $ldap_inited = false;
   private $_conn = false;
   private $_bind = false;
   protected $_use_tls = false;
   protected $_ldap_bind_username = NULL;
   protected $_ldap_bind_password = NULL;
   protected $_use_authentication = false;
   protected $_base_dn = &quot;DC=mydomain,DC=local&quot;;
   protected $_ldap_hostname = &quot;ldap.mydomain.be&quot;;

   /**
    * Initialize plugin
    *
    */
   function init() {

       $ldap_inited = false;

       // load plugin configurations
       $this->load_config();
       
       // add application hooks
       $this->add_hook('authenticate', array($this, 'authenticate'));
       $this->add_hook('user_create', array($this, 'user_create'));
       $this->add_hook('login_failed', array($this, 'login_failed'));
   }

   /**
    * Inject authentication credentials
    *
    * @param array $args arguments from rcmail
    * @return array modified arguments
    */
   function authenticate($args) {

       // retrieve configurations
       $rcmail = rcmail::get_instance();
       $cfg = $rcmail->config->all();

       // initialize ldap client
       $this->ldap_init($cfg);
       
       /*
        * if you want to check ldap user valid
        */
       
       if ($this->_use_authentication) {
           $this->_bind = @ldap_bind($this->_conn, $args['user'], $args['pass']);
           return false;
       }

       return $args;
   }

   /*
    * When a somebody logs in the first time and a local user is created.
    */

   function user_create($args) {

       $rcmail = rcmail::get_instance();
       $attributes = array($rcmail->config->get('ldap_create_uid'), $rcmail->config->get('ldap_create_email'));
       $attributes = array_merge($attributes, $rcmail->config->get('ldap_create_name'));

       if(!$this->_conn) return false;

       $res = ldap_search($this->_conn,
                       $rcmail->config->get('ldap_base_dn'),
                       preg_replace('/%u/', $args['user'], $rcmail->config->get('ldap_filter')), $attributes);

       if (!$res)
           ldapException(&quot;Error in search query &quot; . $this->get_last_error() . $e->getMessage());

       try {
           $rows = ldap_get_entries($this->_conn, $res);

           if ($rows[&quot;count&quot;] == 0 OR !$rows) {
               new ldapException(&quot;user &quot; . $args['user'] . &quot; not found with query &quot; . $rcmail->config->get('ldap_filter') . &quot;And params : &quot; . $this->_conn .
                               &quot;Base  :&quot; . $rcmail->config->get('ldap_base_dn') .
                               preg_replace('/%u/', $args['user'], $rcmail->config->get('ldap_filter')) . &quot; Attributes: &quot;);
               new ldapException($attributes);
           }

           $userName = '';
           foreach ($rcmail->config->get('ldap_create_name') as $val) {
               $userName .= $rows[0][$val][0] . ' ';
           }

           $userName = trim($userName);

           $args['user'] = $rows[0][$rcmail->config->get('ldap_create_uid')][0];
           $args['user_name'] = $userName;
           $args['user_email'] = $rows[0][$rcmail->config->get('ldap_create_email')][0];
       } catch (ldapException $e) {
           ldapException(&quot;Error in search query &quot; . $this->get_last_error());
       }

       return $args;
   }

   /**
    * Intercept login failure
    *
    * @param array $args arguments from rcmail
    * @return array modified arguments
    */
   function login_failed($args) {
       // retrieve rcmail instance
       $rcmail = rcmail::get_instance();

       // compose error page content
       global $__page_content, $__error_title, $__error_text;
       $__error_title = &quot;LDAP LOGIN FAILED&quot;;
       $__error_text = <<<EOF
Could not log into your LDAP service. The service may be interrupted, or you may not be authorized to access the service.<br />
Please contact the administrator.<br />
EOF;
       $__page_content = <<<EOF
<div>
<h3 class=&quot;error-title&quot;>$__error_title</h3>
<p class=&quot;error-text&quot;>$__error_text</p>
</div>
EOF;
       
       // redirect to error page
       $rcmail->output->reset();
       $rcmail->output->send('error');

       // kill current session
       $rcmail->kill_session();

       // end script
       exit;
   }    

   /**
    * Set the domain controllers array
    *
    * @param array $_domain_controllers
    * @return void
    */
   public function set_ldap_hostname(array $_ldap_hostname) {
       $this->_ldap_hostname = $_ldap_hostname;
   }

   /**
    * Get the list of domain controllers
    *
    * @return void
    */
   public function get_ldap_hostname() {
       return $this->_ldap_hostname;
   }

   /**
    * Set the username of an account with higher priviledges
    *
    * @param string $_dn_username
    * @return void
    */
   public function set_ldap_bind_username($_ad_username) {
       $this->_ldap_bind_username = $_ldap_bind_username;
   }

   /**
    * Get the username of the account with higher priviledges
    *
    * This will throw an exception for security reasons
    */
   public function get_ldap_bind_username() {
       throw new ldapException('For security reasons you cannot access the domain administrator account details');
   }

   /**
    * Set the password of an account with higher priviledges
    *
    * @param string $_dn_password
    * @return void
    */
   public function set_ldap_bind_password($_ad_password) {
       $this->_ldap_bind_password = $_ldap_bind_password;
   }

   /**
    * Get the password of the account with higher priviledges
    *
    * This will throw an exception for security reasons
    */
   public function get_ldap_bind_password() {
       throw new ldapException('For security reasons you cannot access the domain administrator account details');
   }

   /**
    * Set whether to use SSL
    *
    * @param bool $_use_ssl
    * @return void
    */
   public function set_use_ssl($_use_ssl) {
       $this->_use_ssl = $_use_ssl;
   }

   /**
    * Get the SSL setting
    *
    * @return bool
    */
   public function get_use_ssl() {
       return $this->_use_ssl;
   }

   /**
    * Set whether to use TLS
    *
    * @param bool $_use_tls
    * @return void
    */
   public function set_use_tls($_use_tls) {
       $this->_use_tls = $_use_tls;
   }

   /**
    * Get the TLS setting
    *
    * @return bool
    */
   public function get_use_tls() {
       return $this->_use_tls;
   }

   /**
    * Set whether to use authentication
    *
    * @param bool $_use_authentication
    * @return void
    */
   public function set_use_authentication($_use_authentication) {
       $this->_use_authentication = $_use_authentication;
   }

   /**
    * Get the use authentication setting
    *
    * @return bool
    */
   public function get_use_authentication() {
       return $this->_use_authentication;
   }

[jfsenechal]

Code Select Expand

<?php
private function ldap_init($cfg) {

       if (!$this->ldap_inited) {
           // retrieve configurations            

           if (array_key_exists(&quot;base_dn&quot;, $cfg)) {
               $this->_base_dn = $cfg[&quot;base_dn&quot;];
           }
           if (array_key_exists(&quot;ldap_hostname&quot;, $cfg)) {
               $this->_ldap_hostname = $cfg[&quot;ldap_hostname&quot;];
           }
           if (array_key_exists(&quot;dn_username&quot;, $cfg)) {
               $this->_dn_username = $cfg[&quot;dn_username&quot;];
           }
           if (array_key_exists(&quot;dn_password&quot;, $cfg)) {
               $this->_dn_password = $cfg[&quot;dn_password&quot;];
           }
           if (array_key_exists(&quot;use_tls&quot;, $cfg)) {
               $this->_use_tls = $cfg[&quot;use_tls&quot;];
           }
           if (array_key_exists(&quot;use_authentication&quot;, $cfg)) {
               $this->_use_authentication = $cfg[&quot;use_authentication&quot;];
           }

           $ldap_inited = true;
       }

       return $this->connect();
   }

   public function connect() {

       $dc = $this->_ldap_hostname;

       if ($this->_use_ssl) {
           $this->_conn = ldap_connect(&quot;ldaps://&quot; . $dc, 636);
       } else {
           $this->_conn = ldap_connect($dc);
       }

       if (is_resource($this->_conn)) {
           // Set some ldap options for talking to AD
           ldap_set_option($this->_conn, LDAP_OPT_PROTOCOL_VERSION, 3);
           ldap_set_option($this->_conn, LDAP_OPT_REFERRALS, 0);

           if ($this->_use_tls) {
               ldap_start_tls($this->_conn);
           }

           // Bind as a domain admin if they've set it up
           if ($this->_ldap_bind_username != NULL && $this->_ldap_bind_password != NULL) {
               $this->_bind = @ldap_bind($this->_conn, $this->_ldap_bind_username, $this->_ldap_bind_password);

               if (!$this->_bind) {
                   if ($this->_use_ssl && !$this->_use_tls) {
                       // If you have problems troubleshooting, remove the @ character from the ldap_bind command above to get the actual error message
                       throw new ldapException('Bind to ldap failed. Either the LDAPs connection failed or the login credentials are incorrect. Said: ' . $this->get_last_error());
                   } else {
                       throw new ldapException('Bind to ldap failed. Check the login credentials and/or server details. Said: ' . $this->get_last_error());
                   }
               }
           }
           return (true);
           //catch error doesn't work !!
       } else {
           $error = &quot;Can't connect to serveur ldap &quot; . $dc . &quot; Error : &quot; . $e->getMessage();
           new ldapException($error);
           return false;
       }
   }

   public function get_last_error() {
       return @ldap_error($this->_conn);
   }

}

class ldapException extends Exception {

   public function ldapException($error) {
       write_log(&quot;ldap_authentication.log&quot;, $error);        
   }

}

?>


[SKaero]

I'd advise creating a zip of the plugin and attaching it to this thread.

[jfsenechal]

I'd advise creating a zip of the plugin and attaching it to this thread.

Ok I don't see this option

[jml]

Hello,
 we're trying to use your plugin in order to do ldap authentication, and we have several questions:
- how to be sure that this plugin is effective BEFORE imap authentication ? log file ? howto ?
- we use an SSL (port 636) only ldap server with certificates, how to configure the plugin in order to do that ?
thank you for help,
Best regards,
JM

[jfsenechal]

- how to be sure that this plugin is effective BEFORE imap authentication ? log file ? howto ?

It's explain in the wiki :

Plugin_Hooks ? Roundcube Webmail

we use an SSL (port 636) only ldap server with certificates, how to configure the plugin in order to do that ?

In config.inc.php

set protected $_use_tls = false  to true

[mattzyzy]

I tried using your codes but still fail / not able to log in using the LDAP uid and password  -after hit the login button (using new uid/username account), after 3-4 seconds return only blank screen .
but , if I used the IMAP login username account that successfully logged in before the ldap_auth plugin setup(registered in mysql users table), it is OK.

If I try some gibberish /unexisted username/uid and wrong password it returns the correct/expected error -which means LDAP server is succesfully connected:" LDAP LOGIN FAILED
Could not log into your LDAP service. The service may be interrupted, or you may not be authorized to access the service.
Please contact the administrator. "

Any help would be welcome.
Thank you.

My setup in main.inc.php using RC 0.5.1
 

$rcmail_config['ldap_hostname'] = '212.33.22.22';
$rcmail_config['ldap_bind_username'] = '';
$rcmail_config['ldap_bind_password'] = '';
$rcmail_config['ldap_base_dn'] = 'ou=People,o=mail.co,o=gov';

$rcmail_config['use_tls'] = false;
$rcmail_config['use_authentication'] = true;

$rcmail_config['ldap_filter'] = 'uid=%u';
$rcmail_config['ldap_create_uid'] = 'uid';
$rcmail_config['ldap_create_name'] = array('cn','sn');
$rcmail_config['ldap_create_email'] = 'mail';