isAnonBindAllowed()) $anon_bind = get_request('anonymous_bind') == 'on' ? true : false; else $anon_bind = false; if (! $anon_bind && ! strlen($pass)) system_message(array( 'title'=>_('Authenticate to server'), 'body'=>_('You left the password blank.'), 'type'=>'warn'), 'cmd.php?cmd=login_form'); $save_auth_type = $ldapserver->auth_type; if ($anon_bind) { if (DEBUG_ENABLED) debug_log('Anonymous Login was posted [%s].',64,$anon_bind); $dn = null; $pass = null; /* Checks if the login_attr option is enabled for this host, which allows users to login with a simple username like 'jdoe' rather than the fully qualified DN, 'uid=jdoe,ou=people,,dc=example,dc=com'. */ } elseif ($ldapserver->isLoginAttrEnabled()) { # Is this a login string (printf-style) if ($ldapserver->isLoginStringEnabled()) { $dn = str_replace('',$uid,$ldapserver->getLoginString()); if (DEBUG_ENABLED) debug_log('LoginStringDN: [%s]',64,$dn); } else { # This is a standard login_attr /* Fake the auth_type of config to do searching. This way, the admin can specify the DN to use when searching for the login_attr user. */ $ldapserver->auth_type = 'config'; if ($ldapserver->login_dn) $ldapserver->connect(); else $ldapserver->connect(true,'anonymous'); if (! empty($ldapserver->login_class)) $filter = sprintf('(&(objectClass=%s)(%s=%s))',$ldapserver->login_class,$ldapserver->login_attr,$uid); else $filter = sprintf('%s=%s',$ldapserver->login_attr,$uid); # Got through each of the BASE DNs and test the login. foreach ($ldapserver->getBaseDN() as $base_dn) { if (DEBUG_ENABLED) debug_log('Searching LDAP with base [%s]',64,$base_dn); $result = $ldapserver->search(null,$base_dn,$filter,array('dn')); $result = array_pop($result); $dn = $result['dn']; if ($dn) { if (DEBUG_ENABLED) debug_log('Got DN [%s] for user ID [%s]',64,$dn,$uid); break; } } # If we got here then we werent able to find a DN for the login filter. if (! $dn) if ($ldapserver->login_fallback_dn) $dn = $uid; else system_message(array( 'title'=>_('Authenticate to server'), 'body'=>_('Bad username or password. Please try again.'), 'type'=>'error'), 'cmd.php?cmd=login_form'); # Restore the original auth_type $ldapserver->auth_type = $save_auth_type; } } # We fake a 'config' server auth_type to omit duplicated code if (DEBUG_ENABLED) debug_log('Setting login type to CONFIG with DN [%s]',64,$dn); $save_auth_type = $ldapserver->auth_type; $ldapserver->auth_type = 'config'; $ldapserver->login_dn = $dn; $ldapserver->login_pass = $pass; # Verify that dn is allowed to login if (! $ldapserver->userIsAllowedLogin($dn)) system_message(array( 'title'=>_('Authenticate to server'), 'body'=>_('Sorry, you are not allowed to use phpLDAPadmin with this LDAP server.'), 'type'=>'error'), 'cmd.php?cmd=login_form'); if (DEBUG_ENABLED) debug_log('User is not prohibited from logging in - now bind with DN [%s]',64,$dn); # Verify that the login is good if (is_null($dn) && is_null($pass)) $ds = $ldapserver->connect(false,'anonymous',true); else $ds = $ldapserver->connect(false,'user',true); if (DEBUG_ENABLED) debug_log('Connection returned [%s]',64,$ds); if (! is_resource($ds)) { if ($anon_bind) system_message(array( 'title'=>_('Authenticate to server'), 'body'=>_('Could not bind anonymously to server.'), 'type'=>'error'), 'cmd.php?cmd=login_form'); else system_message(array( 'title'=>_('Authenticate to server'), 'body'=>_('Bad username or password. Please try again.'), 'type'=>'error'), 'cmd.php?cmd=login_form'); syslog_notice("Authentification FAILED for $dn"); } $ldapserver->auth_type = $save_auth_type; $ldapserver->setLoginDN($dn,$pass,$anon_bind) or pla_error(_('Could not set cookie.')); set_lastactivity($ldapserver); if (! $anon_bind) { syslog_notice("Authentification successful for $dn"); } # Since we were successful, clear the cache so that it will be refreshed with the new creditentials. del_cached_item($ldapserver->server_id,'tree','null'); system_message(array( 'title'=>_('Authenticate to server'), 'body'=>_('Successfully logged into server.').($anon_bind ? sprintf(' (%s)',_('Anonymous Bind')) : ''), 'type'=>'info'), 'index.php'); ?>