ldap_group_support_agains_1.0e.patch
View Options

	*** LdapAuthentication.php.bck Wed Nov 29 12:49:38 2006
	--- LdapAuthentication.php Thu Nov 30 08:47:58 2006
	***************
	* 44,50 **
	require_once( 'AuthPlugin.php' );

	class LdapAuthenticationPlugin extends AuthPlugin {
	! var $email, $lang, $realname, $nickname, $SearchType;
	/**
	* Check whether there exists a user account with the given name.
	* The name will be normalized to MediaWiki's requirements, so
	--- 44,50 ----
	require_once( 'AuthPlugin.php' );

	class LdapAuthenticationPlugin extends AuthPlugin {
	! var $email, $lang, $realname, $nickname, $SearchType, $groups, $allLdapGroups;
	/**
	* Check whether there exists a user account with the given name.
	* The name will be normalized to MediaWiki's requirements, so
	***************
	* 155,161 **
	--- 155,165 ----
	global $wgLDAPProxyAgent;
	global $wgLDAPGroupDN;
	global $wgLDAPRequireAuthAttribute, $wgLDAPAuthAttribute;
	+ global $wgLDAPGrpBase;

	+ $this->groups=Array();
	+ $this->allLdapGroups=Array();
	+
	if ( '' == $password ) {
	return false;
	}
	***************
	* 183,189 **
	if ($info["count"] < 1) { return false; }
	}
	if ($wgLDAPGroupDN) {
	! return $this->isMemberOfLdapGroup($ldapconn, $userdn, $wgLDAPGroupDN);
	}
	if ($wgLDAPRetrievePrefs) {
	$entry = @ldap_read($ldapconn, $userdn, "objectclass=*");
	--- 187,194 ----
	if ($info["count"] < 1) { return false; }
	}
	if ($wgLDAPGroupDN) {
	! if (! $this->isMemberOfLdapGroup($ldapconn, $userdn, $wgLDAPGroupDN))
	! return false;
	}
	if ($wgLDAPRetrievePrefs) {
	$entry = @ldap_read($ldapconn, $userdn, "objectclass=*");
	***************
	* 193,198 **
	--- 198,225 ----
	$this->nickname = $info[0]["displayname"][0];
	$this->realname = $info[0]["cn"][0];
	}
	+
	+ // get information on ldap groups and this user group memberships
	+ $grpRes = ldap_search($ldapconn, $wgLDAPGrpBase[$_SESSION[wsDomain]], "memberUid=".strtolower($username)."",Array("cn"));
	+ for ($entryID=ldap_first_entry($ldapconn,$grpRes);
	+ $entryID!=false;
	+ $entryID=ldap_next_entry($ldapconn,$entryID))
	+ {
	+ $cGroup = ldap_get_values($ldapconn,$entryID,'cn');
	+ $cGroup=$cGroup[0];
	+ $this->groups[] = $cGroup;
	+ }
	+
	+ $grpRes = ldap_search($ldapconn, $wgLDAPGrpBase[$_SESSION[wsDomain]], "objectClass=posixGroup",Array("cn"));
	+ for ($entryID=ldap_first_entry($ldapconn,$grpRes);
	+ $entryID!=false;
	+ $entryID=ldap_next_entry($ldapconn,$entryID))
	+ {
	+ $cGroup = ldap_get_values($ldapconn,$entryID,'cn');
	+ $cGroup=$cGroup[0];
	+ $this->allLdapGroups[] = $cGroup;
	+ }
	+
	// Lets clean up.
	@ldap_unbind();
	} else {
	***************
	* 450,458 **
	--- 477,521 ----
	if ('' != $this->email) {
	$user->setEmail($this->email);
	}
	+ # add groups permissions
	+ $localAvailGrps = $user->getAllGroups();
	+ $localUserGrps = $user->getEffectiveGroups();
	+ # note: $localUserGrps does not need to be updated with $cGroup added,
	+ # as $localAvailGrps contains $cGroup only once.
	+ foreach ($localAvailGrps as $cGroup) {
	+ # did we once add the user to the group?
	+ if (in_array($cGroup,$localUserGrps)) {
	+ if ((!$this->hasLDAPGroup($cGroup)) && ($this->isLDAPGroup($cGroup))) {
	+ # the ldap group overrides the local group
	+ # so as the user is currently not a member of the ldap group, he shall be removed from the local group
	+ $user->removeGroup($cGroup);
	+ }
	+ } else { # no, but maybe the user has recently been added to the ldap group?
	+ if ($this->hasLDAPGroup($cGroup)) {
	+ # so use the addGroup function
	+ $user->addGroup($cGroup);
	+ # completedfor $cGroup.
	+ }
	+ }
	+ }
	}

	/**
	+ * returns true if the last authenticated user is member of this group, else false
	+ * will always return false if the last user did not authenticate successfully with ldap
	+ */
	+ function hasLDAPGroup($group) {
	+ return in_array($group, $this->groups);
	+ }
	+
	+ /**
	+ * returns true if a ldap group with this name exists, else false
	+ * will always return false if the last user did not authenticate successfully with ldap
	+ */
	+ function isLDAPGroup($group) {
	+ return in_array($group, $this->allLdapGroups);
	+ }
	+ /**
	* Return true to prevent logins that don't authenticate here from being
	* checked against the local database's password fields.
	*
	***************
	* 553,559 **
	}
	}
	//we need to do a subbase search for the entry
	! $filter = "(member=".$userDN.")";
	$info=ldap_get_entries($ldapconn,@ldap_search($ldapconn, $groupDN, $filter));
	return ($info["count"]>=1);
	}
	--- 616,622 ----
	}
	}
	//we need to do a subbase search for the entry
	! $filter = "(memberUid=".$userDN.")";
	$info=ldap_get_entries($ldapconn,@ldap_search($ldapconn, $groupDN, $filter));
	return ($info["count"]>=1);
	}

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1276
Default Alt Text: ldap_group_support_agains_1.0e.patch (5 KB)

ldap_group_support_agains_1.0e.patch
Public
Actions

ldap_group_support_agains_1.0e.patch
View Options

File Metadata

Event Timeline

	• bzimport
	Nov 21 2014, 7:04 PM

ldap_group_support_agains_1.0e.patchPublicActions

ldap_group_support_agains_1.0e.patchView Options

File Metadata

Event Timeline

ldap_group_support_agains_1.0e.patch
Public
Actions

ldap_group_support_agains_1.0e.patch
View Options