diff options
Diffstat (limited to 'platform/www/lib/plugins/authldap')
| -rw-r--r-- | platform/www/lib/plugins/authldap/auth.php | 698 | ||||
| -rw-r--r-- | platform/www/lib/plugins/authldap/conf/default.php | 23 | ||||
| -rw-r--r-- | platform/www/lib/plugins/authldap/conf/metadata.php | 22 | ||||
| -rw-r--r-- | platform/www/lib/plugins/authldap/lang/en/lang.php | 11 | ||||
| -rw-r--r-- | platform/www/lib/plugins/authldap/lang/en/settings.php | 30 | ||||
| -rw-r--r-- | platform/www/lib/plugins/authldap/plugin.info.txt | 7 |
6 files changed, 791 insertions, 0 deletions
diff --git a/platform/www/lib/plugins/authldap/auth.php b/platform/www/lib/plugins/authldap/auth.php new file mode 100644 index 0000000..68d1dad --- /dev/null +++ b/platform/www/lib/plugins/authldap/auth.php @@ -0,0 +1,698 @@ +<?php + +/** + * LDAP authentication backend + * + * @license GPL 2 (http://www.gnu.org/licenses/gpl.html) + * @author Andreas Gohr <andi@splitbrain.org> + * @author Chris Smith <chris@jalakaic.co.uk> + * @author Jan Schumann <js@schumann-it.com> + */ +class auth_plugin_authldap extends DokuWiki_Auth_Plugin +{ + /* @var resource $con holds the LDAP connection */ + protected $con = null; + + /* @var int $bound What type of connection does already exist? */ + protected $bound = 0; // 0: anonymous, 1: user, 2: superuser + + /* @var array $users User data cache */ + protected $users = null; + + /* @var array $pattern User filter pattern */ + protected $pattern = null; + + /** + * Constructor + */ + public function __construct() + { + parent::__construct(); + + // ldap extension is needed + if (!function_exists('ldap_connect')) { + $this->debug("LDAP err: PHP LDAP extension not found.", -1, __LINE__, __FILE__); + $this->success = false; + return; + } + + // Add the capabilities to change the password + $this->cando['modPass'] = $this->getConf('modPass'); + } + + /** + * Check user+password + * + * Checks if the given user exists and the given + * plaintext password is correct by trying to bind + * to the LDAP server + * + * @param string $user + * @param string $pass + * @return bool + * @author Andreas Gohr <andi@splitbrain.org> + */ + public function checkPass($user, $pass) + { + // reject empty password + if (empty($pass)) return false; + if (!$this->openLDAP()) return false; + + // indirect user bind + if ($this->getConf('binddn') && $this->getConf('bindpw')) { + // use superuser credentials + if (!@ldap_bind($this->con, $this->getConf('binddn'), conf_decodeString($this->getConf('bindpw')))) { + $this->debug('LDAP bind as superuser: ' . hsc(ldap_error($this->con)), 0, __LINE__, __FILE__); + return false; + } + $this->bound = 2; + } elseif ($this->getConf('binddn') && + $this->getConf('usertree') && + $this->getConf('userfilter') + ) { + // special bind string + $dn = $this->makeFilter( + $this->getConf('binddn'), + array('user' => $user, 'server' => $this->getConf('server')) + ); + } elseif (strpos($this->getConf('usertree'), '%{user}')) { + // direct user bind + $dn = $this->makeFilter( + $this->getConf('usertree'), + array('user' => $user, 'server' => $this->getConf('server')) + ); + } else { + // Anonymous bind + if (!@ldap_bind($this->con)) { + msg("LDAP: can not bind anonymously", -1); + $this->debug('LDAP anonymous bind: ' . hsc(ldap_error($this->con)), 0, __LINE__, __FILE__); + return false; + } + } + + // Try to bind to with the dn if we have one. + if (!empty($dn)) { + // User/Password bind + if (!@ldap_bind($this->con, $dn, $pass)) { + $this->debug("LDAP: bind with $dn failed", -1, __LINE__, __FILE__); + $this->debug('LDAP user dn bind: ' . hsc(ldap_error($this->con)), 0, __LINE__, __FILE__); + return false; + } + $this->bound = 1; + return true; + } else { + // See if we can find the user + $info = $this->fetchUserData($user, true); + if (empty($info['dn'])) { + return false; + } else { + $dn = $info['dn']; + } + + // Try to bind with the dn provided + if (!@ldap_bind($this->con, $dn, $pass)) { + $this->debug("LDAP: bind with $dn failed", -1, __LINE__, __FILE__); + $this->debug('LDAP user bind: ' . hsc(ldap_error($this->con)), 0, __LINE__, __FILE__); + return false; + } + $this->bound = 1; + return true; + } + } + + /** + * Return user info + * + * Returns info about the given user needs to contain + * at least these fields: + * + * name string full name of the user + * mail string email addres of the user + * grps array list of groups the user is in + * + * This LDAP specific function returns the following + * addional fields: + * + * dn string distinguished name (DN) + * uid string Posix User ID + * inbind bool for internal use - avoid loop in binding + * + * @param string $user + * @param bool $requireGroups (optional) - ignored, groups are always supplied by this plugin + * @return array containing user data or false + * @author <evaldas.auryla@pheur.org> + * @author Stephane Chazelas <stephane.chazelas@emerson.com> + * @author Steffen Schoch <schoch@dsb.net> + * + * @author Andreas Gohr <andi@splitbrain.org> + * @author Trouble + * @author Dan Allen <dan.j.allen@gmail.com> + */ + public function getUserData($user, $requireGroups = true) + { + return $this->fetchUserData($user); + } + + /** + * @param string $user + * @param bool $inbind authldap specific, true if in bind phase + * @return array containing user data or false + */ + protected function fetchUserData($user, $inbind = false) + { + global $conf; + if (!$this->openLDAP()) return array(); + + // force superuser bind if wanted and not bound as superuser yet + if ($this->getConf('binddn') && $this->getConf('bindpw') && $this->bound < 2) { + // use superuser credentials + if (!@ldap_bind($this->con, $this->getConf('binddn'), conf_decodeString($this->getConf('bindpw')))) { + $this->debug('LDAP bind as superuser: ' . hsc(ldap_error($this->con)), 0, __LINE__, __FILE__); + return array(); + } + $this->bound = 2; + } elseif ($this->bound == 0 && !$inbind) { + // in some cases getUserData is called outside the authentication workflow + // eg. for sending email notification on subscribed pages. This data might not + // be accessible anonymously, so we try to rebind the current user here + list($loginuser, $loginsticky, $loginpass) = auth_getCookie(); + if ($loginuser && $loginpass) { + $loginpass = auth_decrypt($loginpass, auth_cookiesalt(!$loginsticky, true)); + $this->checkPass($loginuser, $loginpass); + } + } + + $info = array(); + $info['user'] = $user; + $this->debug('LDAP user to find: ' . hsc($info['user']), 0, __LINE__, __FILE__); + + $info['server'] = $this->getConf('server'); + $this->debug('LDAP Server: ' . hsc($info['server']), 0, __LINE__, __FILE__); + + //get info for given user + $base = $this->makeFilter($this->getConf('usertree'), $info); + if ($this->getConf('userfilter')) { + $filter = $this->makeFilter($this->getConf('userfilter'), $info); + } else { + $filter = "(ObjectClass=*)"; + } + + $this->debug('LDAP Filter: ' . hsc($filter), 0, __LINE__, __FILE__); + + $this->debug('LDAP user search: ' . hsc(ldap_error($this->con)), 0, __LINE__, __FILE__); + $this->debug('LDAP search at: ' . hsc($base . ' ' . $filter), 0, __LINE__, __FILE__); + $sr = $this->ldapSearch($this->con, $base, $filter, $this->getConf('userscope'), $this->getConf('attributes')); + + + $result = @ldap_get_entries($this->con, $sr); + + // if result is not an array + if (!is_array($result)) { + // no objects found + $this->debug('LDAP search returned non-array result: ' . hsc(print($result)), -1, __LINE__, __FILE__); + return array(); + } + + // Don't accept more or less than one response + if ($result['count'] != 1) { + $this->debug( + 'LDAP search returned ' . hsc($result['count']) . ' results while it should return 1!', + -1, + __LINE__, + __FILE__ + ); + //for($i = 0; $i < $result["count"]; $i++) { + //$this->_debug('result: '.hsc(print_r($result[$i])), 0, __LINE__, __FILE__); + //} + return array(); + } + + $this->debug('LDAP search found single result !', 0, __LINE__, __FILE__); + + $user_result = $result[0]; + ldap_free_result($sr); + + // general user info + $info['dn'] = $user_result['dn']; + $info['gid'] = $user_result['gidnumber'][0]; + $info['mail'] = $user_result['mail'][0]; + $info['name'] = $user_result['cn'][0]; + $info['grps'] = array(); + + // overwrite if other attribs are specified. + if (is_array($this->getConf('mapping'))) { + foreach ($this->getConf('mapping') as $localkey => $key) { + if (is_array($key)) { + // use regexp to clean up user_result + // $key = array($key=>$regexp), only handles the first key-value + $regexp = current($key); + $key = key($key); + if ($user_result[$key]) foreach ($user_result[$key] as $grpkey => $grp) { + if ($grpkey !== 'count' && preg_match($regexp, $grp, $match)) { + if ($localkey == 'grps') { + $info[$localkey][] = $match[1]; + } else { + $info[$localkey] = $match[1]; + } + } + } + } else { + $info[$localkey] = $user_result[$key][0]; + } + } + } + $user_result = array_merge($info, $user_result); + + //get groups for given user if grouptree is given + if ($this->getConf('grouptree') || $this->getConf('groupfilter')) { + $base = $this->makeFilter($this->getConf('grouptree'), $user_result); + $filter = $this->makeFilter($this->getConf('groupfilter'), $user_result); + $sr = $this->ldapSearch( + $this->con, + $base, + $filter, + $this->getConf('groupscope'), + array($this->getConf('groupkey')) + ); + $this->debug('LDAP group search: ' . hsc(ldap_error($this->con)), 0, __LINE__, __FILE__); + $this->debug('LDAP search at: ' . hsc($base . ' ' . $filter), 0, __LINE__, __FILE__); + + if (!$sr) { + msg("LDAP: Reading group memberships failed", -1); + return array(); + } + $result = ldap_get_entries($this->con, $sr); + ldap_free_result($sr); + + if (is_array($result)) foreach ($result as $grp) { + if (!empty($grp[$this->getConf('groupkey')])) { + $group = $grp[$this->getConf('groupkey')]; + if (is_array($group)) { + $group = $group[0]; + } else { + $this->debug('groupkey did not return a detailled result', 0, __LINE__, __FILE__); + } + if ($group === '') continue; + + $this->debug('LDAP usergroup: ' . hsc($group), 0, __LINE__, __FILE__); + $info['grps'][] = $group; + } + } + } + + // always add the default group to the list of groups + if (!$info['grps'] or !in_array($conf['defaultgroup'], $info['grps'])) { + $info['grps'][] = $conf['defaultgroup']; + } + return $info; + } + + /** + * Definition of the function modifyUser in order to modify the password + * + * @param string $user nick of the user to be changed + * @param array $changes array of field/value pairs to be changed (password will be clear text) + * @return bool true on success, false on error + */ + public function modifyUser($user, $changes) + { + + // open the connection to the ldap + if (!$this->openLDAP()) { + $this->debug('LDAP cannot connect: ' . hsc(ldap_error($this->con)), 0, __LINE__, __FILE__); + return false; + } + + // find the information about the user, in particular the "dn" + $info = $this->getUserData($user, true); + if (empty($info['dn'])) { + $this->debug('LDAP cannot find your user dn', 0, __LINE__, __FILE__); + return false; + } + $dn = $info['dn']; + + // find the old password of the user + list($loginuser, $loginsticky, $loginpass) = auth_getCookie(); + if ($loginuser !== null) { // the user is currently logged in + $secret = auth_cookiesalt(!$loginsticky, true); + $pass = auth_decrypt($loginpass, $secret); + + // bind with the ldap + if (!@ldap_bind($this->con, $dn, $pass)) { + $this->debug( + 'LDAP user bind failed: ' . hsc($dn) . ': ' . hsc(ldap_error($this->con)), + 0, + __LINE__, + __FILE__ + ); + return false; + } + } elseif ($this->getConf('binddn') && $this->getConf('bindpw')) { + // we are changing the password on behalf of the user (eg: forgotten password) + // bind with the superuser ldap + if (!@ldap_bind($this->con, $this->getConf('binddn'), conf_decodeString($this->getConf('bindpw')))) { + $this->debug('LDAP bind as superuser: ' . hsc(ldap_error($this->con)), 0, __LINE__, __FILE__); + return false; + } + } else { + return false; // no otherway + } + + // Generate the salted hashed password for LDAP + $phash = new \dokuwiki\PassHash(); + $hash = $phash->hash_ssha($changes['pass']); + + // change the password + if (!@ldap_mod_replace($this->con, $dn, array('userpassword' => $hash))) { + $this->debug( + 'LDAP mod replace failed: ' . hsc($dn) . ': ' . hsc(ldap_error($this->con)), + 0, + __LINE__, + __FILE__ + ); + return false; + } + + return true; + } + + /** + * Most values in LDAP are case-insensitive + * + * @return bool + */ + public function isCaseSensitive() + { + return false; + } + + /** + * Bulk retrieval of user data + * + * @param int $start index of first user to be returned + * @param int $limit max number of users to be returned + * @param array $filter array of field/pattern pairs, null for no filter + * @return array of userinfo (refer getUserData for internal userinfo details) + * @author Dominik Eckelmann <dokuwiki@cosmocode.de> + */ + public function retrieveUsers($start = 0, $limit = 0, $filter = array()) + { + if (!$this->openLDAP()) return array(); + + if (is_null($this->users)) { + // Perform the search and grab all their details + if ($this->getConf('userfilter')) { + $all_filter = str_replace('%{user}', '*', $this->getConf('userfilter')); + } else { + $all_filter = "(ObjectClass=*)"; + } + $sr = ldap_search($this->con, $this->getConf('usertree'), $all_filter); + $entries = ldap_get_entries($this->con, $sr); + $users_array = array(); + $userkey = $this->getConf('userkey'); + for ($i = 0; $i < $entries["count"]; $i++) { + array_push($users_array, $entries[$i][$userkey][0]); + } + asort($users_array); + $result = $users_array; + if (!$result) return array(); + $this->users = array_fill_keys($result, false); + } + $i = 0; + $count = 0; + $this->constructPattern($filter); + $result = array(); + + foreach ($this->users as $user => &$info) { + if ($i++ < $start) { + continue; + } + if ($info === false) { + $info = $this->getUserData($user); + } + if ($this->filter($user, $info)) { + $result[$user] = $info; + if (($limit > 0) && (++$count >= $limit)) break; + } + } + return $result; + } + + /** + * Make LDAP filter strings. + * + * Used by auth_getUserData to make the filter + * strings for grouptree and groupfilter + * + * @param string $filter ldap search filter with placeholders + * @param array $placeholders placeholders to fill in + * @return string + * @author Troels Liebe Bentsen <tlb@rapanden.dk> + */ + protected function makeFilter($filter, $placeholders) + { + preg_match_all("/%{([^}]+)/", $filter, $matches, PREG_PATTERN_ORDER); + //replace each match + foreach ($matches[1] as $match) { + //take first element if array + if (is_array($placeholders[$match])) { + $value = $placeholders[$match][0]; + } else { + $value = $placeholders[$match]; + } + $value = $this->filterEscape($value); + $filter = str_replace('%{' . $match . '}', $value, $filter); + } + return $filter; + } + + /** + * return true if $user + $info match $filter criteria, false otherwise + * + * @param string $user the user's login name + * @param array $info the user's userinfo array + * @return bool + * @author Chris Smith <chris@jalakai.co.uk> + * + */ + protected function filter($user, $info) + { + foreach ($this->pattern as $item => $pattern) { + if ($item == 'user') { + if (!preg_match($pattern, $user)) return false; + } elseif ($item == 'grps') { + if (!count(preg_grep($pattern, $info['grps']))) return false; + } else { + if (!preg_match($pattern, $info[$item])) return false; + } + } + return true; + } + + /** + * Set the filter pattern + * + * @param $filter + * @return void + * @author Chris Smith <chris@jalakai.co.uk> + * + */ + protected function constructPattern($filter) + { + $this->pattern = array(); + foreach ($filter as $item => $pattern) { + $this->pattern[$item] = '/' . str_replace('/', '\/', $pattern) . '/i'; // allow regex characters + } + } + + /** + * Escape a string to be used in a LDAP filter + * + * Ported from Perl's Net::LDAP::Util escape_filter_value + * + * @param string $string + * @return string + * @author Andreas Gohr + */ + protected function filterEscape($string) + { + // see https://github.com/adldap/adLDAP/issues/22 + return preg_replace_callback( + '/([\x00-\x1F\*\(\)\\\\])/', + function ($matches) { + return "\\" . join("", unpack("H2", $matches[1])); + }, + $string + ); + } + + /** + * Opens a connection to the configured LDAP server and sets the wanted + * option on the connection + * + * @author Andreas Gohr <andi@splitbrain.org> + */ + protected function openLDAP() + { + if ($this->con) return true; // connection already established + + if ($this->getConf('debug')) { + ldap_set_option(null, LDAP_OPT_DEBUG_LEVEL, 7); + } + + $this->bound = 0; + + $port = $this->getConf('port'); + $bound = false; + $servers = explode(',', $this->getConf('server')); + foreach ($servers as $server) { + $server = trim($server); + $this->con = @ldap_connect($server, $port); + if (!$this->con) { + continue; + } + + /* + * When OpenLDAP 2.x.x is used, ldap_connect() will always return a resource as it does + * not actually connect but just initializes the connecting parameters. The actual + * connect happens with the next calls to ldap_* funcs, usually with ldap_bind(). + * + * So we should try to bind to server in order to check its availability. + */ + + //set protocol version and dependend options + if ($this->getConf('version')) { + if (!@ldap_set_option( + $this->con, + LDAP_OPT_PROTOCOL_VERSION, + $this->getConf('version') + ) + ) { + msg('Setting LDAP Protocol version ' . $this->getConf('version') . ' failed', -1); + $this->debug('LDAP version set: ' . hsc(ldap_error($this->con)), 0, __LINE__, __FILE__); + } else { + //use TLS (needs version 3) + if ($this->getConf('starttls')) { + if (!@ldap_start_tls($this->con)) { + msg('Starting TLS failed', -1); + $this->debug('LDAP TLS set: ' . hsc(ldap_error($this->con)), 0, __LINE__, __FILE__); + } + } + // needs version 3 + if ($this->getConf('referrals') > -1) { + if (!@ldap_set_option( + $this->con, + LDAP_OPT_REFERRALS, + $this->getConf('referrals') + ) + ) { + msg('Setting LDAP referrals failed', -1); + $this->debug('LDAP referal set: ' . hsc(ldap_error($this->con)), 0, __LINE__, __FILE__); + } + } + } + } + + //set deref mode + if ($this->getConf('deref')) { + if (!@ldap_set_option($this->con, LDAP_OPT_DEREF, $this->getConf('deref'))) { + msg('Setting LDAP Deref mode ' . $this->getConf('deref') . ' failed', -1); + $this->debug('LDAP deref set: ' . hsc(ldap_error($this->con)), 0, __LINE__, __FILE__); + } + } + /* As of PHP 5.3.0 we can set timeout to speedup skipping of invalid servers */ + if (defined('LDAP_OPT_NETWORK_TIMEOUT')) { + ldap_set_option($this->con, LDAP_OPT_NETWORK_TIMEOUT, 1); + } + + if ($this->getConf('binddn') && $this->getConf('bindpw')) { + $bound = @ldap_bind($this->con, $this->getConf('binddn'), conf_decodeString($this->getConf('bindpw'))); + $this->bound = 2; + } else { + $bound = @ldap_bind($this->con); + } + if ($bound) { + break; + } + } + + if (!$bound) { + msg("LDAP: couldn't connect to LDAP server", -1); + $this->debug(ldap_error($this->con), 0, __LINE__, __FILE__); + return false; + } + + $this->cando['getUsers'] = true; + return true; + } + + /** + * Wraps around ldap_search, ldap_list or ldap_read depending on $scope + * + * @param resource $link_identifier + * @param string $base_dn + * @param string $filter + * @param string $scope can be 'base', 'one' or 'sub' + * @param null|array $attributes + * @param int $attrsonly + * @param int $sizelimit + * @return resource + * @author Andreas Gohr <andi@splitbrain.org> + */ + protected function ldapSearch( + $link_identifier, + $base_dn, + $filter, + $scope = 'sub', + $attributes = null, + $attrsonly = 0, + $sizelimit = 0 + ) + { + if (is_null($attributes)) $attributes = array(); + + if ($scope == 'base') { + return @ldap_read( + $link_identifier, + $base_dn, + $filter, + $attributes, + $attrsonly, + $sizelimit + ); + } elseif ($scope == 'one') { + return @ldap_list( + $link_identifier, + $base_dn, + $filter, + $attributes, + $attrsonly, + $sizelimit + ); + } else { + return @ldap_search( + $link_identifier, + $base_dn, + $filter, + $attributes, + $attrsonly, + $sizelimit + ); + } + } + + /** + * Wrapper around msg() but outputs only when debug is enabled + * + * @param string $message + * @param int $err + * @param int $line + * @param string $file + * @return void + */ + protected function debug($message, $err, $line, $file) + { + if (!$this->getConf('debug')) return; + msg($message, $err, $line, $file); + } +} diff --git a/platform/www/lib/plugins/authldap/conf/default.php b/platform/www/lib/plugins/authldap/conf/default.php new file mode 100644 index 0000000..52fa1e6 --- /dev/null +++ b/platform/www/lib/plugins/authldap/conf/default.php @@ -0,0 +1,23 @@ +<?php + +$conf['server'] = ''; +$conf['port'] = 389; +$conf['usertree'] = ''; +$conf['grouptree'] = ''; +$conf['userfilter'] = ''; +$conf['groupfilter'] = ''; +$conf['version'] = 2; +$conf['starttls'] = 0; +$conf['referrals'] = -1; +$conf['deref'] = 0; +$conf['binddn'] = ''; +$conf['bindpw'] = ''; +//$conf['mapping']['name'] unsupported in config manager +//$conf['mapping']['grps'] unsupported in config manager +$conf['userscope'] = 'sub'; +$conf['groupscope'] = 'sub'; +$conf['userkey'] = 'uid'; +$conf['groupkey'] = 'cn'; +$conf['debug'] = 0; +$conf['modPass'] = 1; +$conf['attributes'] = array(); diff --git a/platform/www/lib/plugins/authldap/conf/metadata.php b/platform/www/lib/plugins/authldap/conf/metadata.php new file mode 100644 index 0000000..3a58590 --- /dev/null +++ b/platform/www/lib/plugins/authldap/conf/metadata.php @@ -0,0 +1,22 @@ +<?php +$meta['server'] = array('string','_caution' => 'danger'); +$meta['port'] = array('numeric','_caution' => 'danger'); +$meta['usertree'] = array('string','_caution' => 'danger'); +$meta['grouptree'] = array('string','_caution' => 'danger'); +$meta['userfilter'] = array('string','_caution' => 'danger'); +$meta['groupfilter'] = array('string','_caution' => 'danger'); +$meta['version'] = array('numeric','_caution' => 'danger'); +$meta['starttls'] = array('onoff','_caution' => 'danger'); +$meta['referrals'] = array('multichoice','_choices' => array(-1,0,1),'_caution' => 'danger'); +$meta['deref'] = array('multichoice','_choices' => array(0,1,2,3),'_caution' => 'danger'); +$meta['binddn'] = array('string','_caution' => 'danger'); +$meta['bindpw'] = array('password','_caution' => 'danger','_code'=>'base64'); +$meta['attributes'] = array('array'); +//$meta['mapping']['name'] unsupported in config manager +//$meta['mapping']['grps'] unsupported in config manager +$meta['userscope'] = array('multichoice','_choices' => array('sub','one','base'),'_caution' => 'danger'); +$meta['groupscope'] = array('multichoice','_choices' => array('sub','one','base'),'_caution' => 'danger'); +$meta['userkey'] = array('string','_caution' => 'danger'); +$meta['groupkey'] = array('string','_caution' => 'danger'); +$meta['debug'] = array('onoff','_caution' => 'security'); +$meta['modPass'] = array('onoff'); diff --git a/platform/www/lib/plugins/authldap/lang/en/lang.php b/platform/www/lib/plugins/authldap/lang/en/lang.php new file mode 100644 index 0000000..8185a84 --- /dev/null +++ b/platform/www/lib/plugins/authldap/lang/en/lang.php @@ -0,0 +1,11 @@ +<?php +/** + * English language file for authldap plugin + * @license GPL 2 (http://www.gnu.org/licenses/gpl.html) + * + */ + +$lang['connectfail'] = 'LDAP cannot connect: %s'; +$lang['domainfail'] = 'LDAP cannot find your user dn'; + +//Setup VIM: ex: et ts=4 : diff --git a/platform/www/lib/plugins/authldap/lang/en/settings.php b/platform/www/lib/plugins/authldap/lang/en/settings.php new file mode 100644 index 0000000..9988474 --- /dev/null +++ b/platform/www/lib/plugins/authldap/lang/en/settings.php @@ -0,0 +1,30 @@ +<?php +$lang['server'] = 'Your LDAP server. Either hostname (<code>localhost</code>) or full qualified URL (<code>ldap://server.tld:389</code>)'; +$lang['port'] = 'LDAP server port if no full URL was given above'; +$lang['usertree'] = 'Where to find the user accounts. Eg. <code>ou=People, dc=server, dc=tld</code>'; +$lang['grouptree'] = 'Where to find the user groups. Eg. <code>ou=Group, dc=server, dc=tld</code>'; +$lang['userfilter'] = 'LDAP filter to search for user accounts. Eg. <code>(&(uid=%{user})(objectClass=posixAccount))</code>'; +$lang['groupfilter'] = 'LDAP filter to search for groups. Eg. <code>(&(objectClass=posixGroup)(|(gidNumber=%{gid})(memberUID=%{user})))</code>'; +$lang['version'] = 'The protocol version to use. You may need to set this to <code>3</code>'; +$lang['starttls'] = 'Use TLS connections?'; +$lang['referrals'] = 'Shall referrals be followed?'; +$lang['deref'] = 'How to dereference aliases?'; +$lang['binddn'] = 'DN of an optional bind user if anonymous bind is not sufficient. Eg. <code>cn=admin, dc=my, dc=home</code>'; +$lang['bindpw'] = 'Password of above user'; +$lang['attributes'] = 'Attributes to retrieve with the LDAP search.'; +$lang['userscope'] = 'Limit search scope for user search'; +$lang['groupscope'] = 'Limit search scope for group search'; +$lang['userkey'] = 'Attribute denoting the username; must be consistent to userfilter.'; +$lang['groupkey'] = 'Group membership from any user attribute (instead of standard AD groups) e.g. group from department or telephone number'; +$lang['modPass'] = 'Can the LDAP password be changed via dokuwiki?'; +$lang['debug'] = 'Display additional debug information on errors'; + + +$lang['deref_o_0'] = 'LDAP_DEREF_NEVER'; +$lang['deref_o_1'] = 'LDAP_DEREF_SEARCHING'; +$lang['deref_o_2'] = 'LDAP_DEREF_FINDING'; +$lang['deref_o_3'] = 'LDAP_DEREF_ALWAYS'; + +$lang['referrals_o_-1'] = 'use default'; +$lang['referrals_o_0'] = 'don\'t follow referrals'; +$lang['referrals_o_1'] = 'follow referrals';
\ No newline at end of file diff --git a/platform/www/lib/plugins/authldap/plugin.info.txt b/platform/www/lib/plugins/authldap/plugin.info.txt new file mode 100644 index 0000000..e0c6144 --- /dev/null +++ b/platform/www/lib/plugins/authldap/plugin.info.txt @@ -0,0 +1,7 @@ +base authldap +author Andreas Gohr +email andi@splitbrain.org +date 2015-07-13 +name LDAP Auth Plugin +desc Provides user authentication against an LDAP server +url http://www.dokuwiki.org/plugin:authldap |