friendica/friendica-addons
7
2
Fork 14
Code Issues 3 Pull requests 3 Releases 16 Wiki Activity

[ldapauth] Only call ldap_createaccount once #1132

Merged
MrPetovan merged 1 commit from bug/10378-ldapauth-wrong-parameters into 2021.06-rc 2021-06-08 06:41:41 +02:00
Conversation 0 Commits 1 Files changed 1 +14 -24
1 changed files with 14 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
ldapauth/ldapauth.php
View file

@ -134,41 +134,31 @@ function ldapauth_authenticate($username, $password)
return false; return false;
} }
$emailarray = []; if (strlen($ldap_group) && @ldap_compare($connect, $ldap_group, 'member', $dn) !== true) {
$namearray = [];
if ($ldap_autocreateaccount == "true") {
if (!strlen($ldap_autocreateaccount_emailattribute)) {
$ldap_autocreateaccount_emailattribute = "mail";
}
if (!strlen($ldap_autocreateaccount_nameattribute)) {
$ldap_autocreateaccount_nameattribute = "givenName";
}
$emailarray = @ldap_get_values($connect, $id, $ldap_autocreateaccount_emailattribute);
$namearray = @ldap_get_values($connect, $id, $ldap_autocreateaccount_nameattribute);
}
if (!strlen($ldap_group)) {
ldap_createaccount($ldap_autocreateaccount, $username, $password, $emailarray[0], $namearray[0]);
return true;
}
$r = @ldap_compare($connect, $ldap_group, 'member', $dn);
if ($r !== true) {
$errno = @ldap_errno($connect); $errno = @ldap_errno($connect);
if ($errno === 32) { if ($errno === 32) {
Logger::notice('LDAP Access Control Group does not exist', ['errno' => $errno, 'error' => ldap_error($connect)]); Logger::notice('LDAP Access Control Group does not exist', ['errno' => $errno, 'error' => ldap_error($connect)]);
} elseif ($errno === 16) { } elseif ($errno === 16) {
Logger::notice('LDAP membership attribute does not exist in access control group', ['errno' => $errno, 'error' => ldap_error($connect)]); Logger::notice('LDAP membership attribute does not exist in access control group', ['errno' => $errno, 'error' => ldap_error($connect)]);
} else { } else {
Logger::notice('Unexpected LDAP error', ['errno' => $errno, 'error' => ldap_error($connect)]); Logger::notice('LDAP user isn\'t part of the authorized group', ['dn' => $dn]);
} }
@ldap_close($connect); @ldap_close($connect);
return false; return false;
} }
if ($ldap_autocreateaccount == "true" && !DBA::exists('user', ['nickname' => $username])) { if ($ldap_autocreateaccount == 'true' && !DBA::exists('user', ['nickname' => $username])) {
return ldap_createaccount($username, $password, $emailarray[0], $namearray[0]); if (!strlen($ldap_autocreateaccount_emailattribute)) {
$ldap_autocreateaccount_emailattribute = 'mail';
}
if (!strlen($ldap_autocreateaccount_nameattribute)) {
$ldap_autocreateaccount_nameattribute = 'givenName';
}
$email_values = @ldap_get_values($connect, $id, $ldap_autocreateaccount_emailattribute);
$name_values = @ldap_get_values($connect, $id, $ldap_autocreateaccount_nameattribute);
return ldap_createaccount($username, $password, $email_values[0] ?? '', $name_values[0] ?? '');
} }
try { try {