aboutsummaryrefslogtreecommitdiffstats
path: root/mayor-orig/www/include/backend/ads/session
diff options
context:
space:
mode:
authorM.Gergo2018-07-06 11:14:41 +0200
committerM.Gergo2018-07-06 11:14:41 +0200
commit43de9af71f7f4ca5731b94a06d688ae8412ba427 (patch)
tree54835de1dfcda504c02da261f0dc26885aed2e89 /mayor-orig/www/include/backend/ads/session
parent50310b0e4513ee3fcce67351ae61e8fff851130e (diff)
downloadmayor-43de9af71f7f4ca5731b94a06d688ae8412ba427.tar.gz
mayor-43de9af71f7f4ca5731b94a06d688ae8412ba427.zip
2018/Feb/28 -i állapot hozzáadva, mint a módosítások kiindulási állapota
Diffstat (limited to 'mayor-orig/www/include/backend/ads/session')
-rw-r--r--mayor-orig/www/include/backend/ads/session/accountInfo.php416
-rw-r--r--mayor-orig/www/include/backend/ads/session/base.php188
-rw-r--r--mayor-orig/www/include/backend/ads/session/createAccount.php157
-rw-r--r--mayor-orig/www/include/backend/ads/session/createGroup.php82
-rw-r--r--mayor-orig/www/include/backend/ads/session/search/searchAccount.php277
5 files changed, 1120 insertions, 0 deletions
diff --git a/mayor-orig/www/include/backend/ads/session/accountInfo.php b/mayor-orig/www/include/backend/ads/session/accountInfo.php
new file mode 100644
index 00000000..eef90fd4
--- /dev/null
+++ b/mayor-orig/www/include/backend/ads/session/accountInfo.php
@@ -0,0 +1,416 @@
+<?php
+/*
+ Module: base/auth-ads
+ Backend: ads
+
+ function getADSInfo($userDn, $attrList=array('cn'), $toPolicy = '')
+ function adsGetAccountInfo($userAccount, $toPolicy = _POLICY)
+ function adsGetUserInfo($userAccount, $toPolicy = _POLICY)
+ function adsChangeAccountInfo($userAccount, $toPolicy = _POLICY)
+ function adsGetGroupInfo($groupCn, $toPolicy = _POLICY)
+
+*/
+
+######################################################
+# getADSInfo - általános ADS lekérdezés
+######################################################
+
+
+ function getADSInfo($userDn, $attrList=array('cn'), $toPolicy = _POLICY) {
+
+ global $AUTH;
+
+ // Kapcsolódás az ADS szerverhez
+ $ds = @ldap_connect($AUTH[$toPolicy]['adsHostname']);
+ if (!$ds) {
+ $_SESSION['alert'][] = 'alert:ldap_connect_failure';
+ return false;
+ }
+
+ // Csatlakozás a szerverhez
+ $r = @ldap_bind($ds, BACKEND_CONNECT_DN,BACKEND_CONNECT_PASSWORD);
+ if (!$r) {
+ $_SESSION['alert'][] = 'message:ldap_bind_failure';
+ ldap_close($ds);
+ return false;
+ }
+
+ // Keresés
+ $filter = '(objectclass=*)';
+ $sr = @ldap_search($ds, $userDn, $filter, $attrList);
+ if (!$sr) {
+ $_SESSION['alert'][] = "message:ldap_search_failure:".$userDn;
+ ldap_close($ds);
+ return false;
+ }
+
+ $info = @ldap_get_entries($ds,$sr);
+ ldap_close($ds);
+
+ return $info;
+
+ }
+
+###########################################################
+# adsGetAccountInfo - felhasználói információk (backend)
+###########################################################
+
+ function adsGetAccountInfo($userAccount, $toPolicy = _POLICY) {
+
+ global $backendAttrs, $backendAttrDef;
+
+ if (!isset($backendAttrs)) list($backendAttrs, $backendAttrDef) = getBackendAttrs('Account', $toPolicy);
+
+ $userDn = ADSuserAccountToDn($userAccount, $toPolicy);
+
+ $result = getADSInfo($userDn, $backendAttrs, $toPolicy);
+ if ($result === false) {
+ return false;
+ } else {
+
+ // ADS schema --> mayor schema konverzió
+ for ($i = 0; $i < $result['count']; $i++) {
+ // Egységes szerkezetre alakítjuk, azaz a dn is indexelt
+ foreach ($backendAttrDef as $attr => $def) {
+ // Egységes szerkezetre alakítjuk, azaz a dn is indexelt
+ if ($attr == 'dn') $return[$i]['dn'] = array('count' => 1, 0 => $result[$i]['dn']);
+ elseif (isset($result[$i][$attr])) $return[$i][$attr] = $result[$i][$attr];
+ else $return[$i][$attr] = array('count' => 0);
+ }
+ }
+ return $return[0];
+
+ }
+
+ }
+
+#############################################################
+# adsGetUserInfo - felhasználói információk (keretrendszer)
+#############################################################
+
+ function adsGetUserInfo($userAccount, $toPolicy = _POLICY) {
+
+ global $accountAttrToADS, $adsAttrDef;
+ $userDn = ADSuserAccountToDn($userAccount, $toPolicy);
+
+ $result = getADSInfo($userDn, array_values($accountAttrToADS), $toPolicy);
+ if ($result === false) {
+ return false;
+ } else {
+
+ $result[0]['dn'] = array('count' => 1, 0 => $result[0]['dn']);
+ // Egységes szerkezetre alakítjuk, azaz a dn is indexelt + ADS --> MaYoR schema
+ foreach ($accountAttrToADS as $attr => $adsAttr) {
+ $adsAttr = kisbetus($adsAttr);
+ if (isset($result[0][$adsAttr])) $return[$attr] = $result[0][$adsAttr];
+ else $return[$attr] = array('count' => 0);
+ }
+ return $return;
+
+ }
+
+ }
+
+###############################################################
+# adsChangeAccountInfo - felhasználói információk módosítása
+###############################################################
+
+ function adsChangeAccountInfo($userAccount, $toPolicy = _POLICY) {
+
+ global $AUTH, $backendAttrs, $backendAttrDef;
+ $userDn = ADSuserAccountToDn($userAccount, $toPolicy);
+
+ // Kapcsolódás az ADS szerverhez
+ $ds = @ldap_connect($AUTH[$toPolicy]['adsHostname']);
+ if (!$ds) {
+ $_SESSION['alert'][] = 'alert:ldap_connect_failure';
+ return false;
+ }
+
+ // Csatlakozás a szerverhez
+ $r = @ldap_bind($ds, BACKEND_CONNECT_DN,BACKEND_CONNECT_PASSWORD);
+ if (!$r) {
+ $_SESSION['alert'][] = 'message:ldap_bind_failure';
+ ldap_close($ds);
+ return false;
+ }
+
+ $emptyAttrs = explode(':',$_POST['emptyAttrs']);
+ $_alert = array();
+
+ // Attribútumonként módosítunk
+ foreach ($backendAttrs as $attr) {
+
+ if ($backendAttrDef[$attr]['rights'] == '') $rigths = _DEFAULT_ADS_RIGHTS;
+ else $rights = $backendAttrDef[$attr]['rights'];
+
+ if ($rights[_ACCESS_AS] == 'w') {
+ $mod_info = $add_info = $del_info = Array();
+ $values = array();
+
+ if ($backendAttrDef[$attr]['type'] == 'image') {
+ $file = $_FILES[$attr]['tmp_name'];
+ if (file_exists($file)) {
+ $fd = fopen($file,'r');
+ $values[0]=fread($fd,filesize($file));
+ fclose($fd);
+ } else {
+ // Sose töröljük!
+ $emptyAttrs[] = $attr;
+ }
+ } elseif ($backendAttrDef[$attr]['type'] == 'timestamp') {
+ if ($_POST[$attr][0] != '' and $_POST[$attr][1] != '' and $_POST[$attr][2] != '') {
+ $values[0] = $_POST[$attr][0].$_POST[$attr][1].$_POST[$attr][2].'010101Z';
+ }
+ } else {
+ if ($backendAttrDef[$attr]['type'] != '' ) $values[0] = $_POST[$attr];
+ }
+
+ if ($backendAttrDef[$attr]['type'] == 'select') {
+ if ($_POST['new-'.$attr][0] != '') $add_info[$attr] = $_POST['new-'.$attr];
+ if ($_POST['del-'.$attr][0] != '') $del_info[$attr] = $_POST['del-'.$attr];
+ } elseif (in_array($attr,$emptyAttrs)) {
+ if ($values[0] != '') $add_info[$attr] = $values;
+ } else {
+ if ($values[0] != '') {
+ $mod_info[$attr] = $values;
+ } else {
+ $del_info[$attr] = Array();
+ }
+ }
+
+ if (count($add_info)!=0) {
+ if (!@ldap_mod_add($ds,$userDn,$add_info)) {
+ $_alert[] = 'message:insufficient_access:add:'.$attr;
+ }
+ }
+ if (count($mod_info)!=0) {
+ if (!@$r = ldap_mod_replace($ds,$userDn,$mod_info)) {
+ $_alert[] = 'message:insufficient_access:mod:'.$attr;
+ }
+ }
+ if (count($del_info)!=0) {
+ if (!@ldap_mod_del($ds,$userDn,$del_info)) {
+ $_alert[] = 'message:insufficient_access:del:'.$attr;
+ }
+ }
+
+ } else {
+// $_alert[] = 'message:insufficient_access:'.$attr;
+ }
+ } // foreach
+
+ ldap_close($ds);
+ if (count($_alert) == 0) $_SESSION['alert'][] = 'info:change_success';
+ else for ($i = 0;$i < count($_alert);$i++) $_SESSION['alert'][] = $_alert[$i];
+
+ }
+
+###########################################################
+# adsGetGroupInfo - csoport információk (backend)
+###########################################################
+
+ function adsGetGroupInfo($groupCn, $toPolicy = _POLICY, $SET = array()) {
+
+ global $backendAttrs, $backendAttrDef;
+
+
+ if (!isset($backendAttrs)) list($backendAttrs, $backendAttrDef) = getBackendAttrs('Group', $toPolicy);
+
+ $groupDn = ADSgroupCnToDn($groupCn, $toPolicy);
+
+ $result = getADSInfo($groupDn, $backendAttrs, $toPolicy);
+ if ($result === false) {
+ return false;
+ } else {
+
+ // Accountok lekérdezése
+ $info = getADSaccounts($toPolicy);
+ for ($i = 0; $i < $info['count']; $i++) {
+ $accountUid[] = array(
+ 'value' => $info[$i]['uid'][0],
+ 'txt' => $info[$i]['displayname'][0]
+ );
+ $accountDn[] = array(
+ 'value' => $info[$i]['dn'],
+ 'txt' => $info[$i]['displayname'][0]
+ );
+ $DN2CN[$info[$i]['dn']] = $info[$i]['displayname'][0];
+ }
+
+ // ADS schema --> mayor schema konverzió
+ for ($i = 0; $i < $result['count']; $i++) {
+ // Egységes szerkezetre alakítjuk, azaz a dn is indexelt
+ foreach ($backendAttrDef as $attr => $def) {
+ // Egységes szerkezetre alakítjuk, azaz a dn is indexelt
+ if ($attr == 'dn') $return[$i]['dn'] = array('count' => 1, 0 => $result[$i]['dn']);
+ elseif($attr == 'member') {
+ $_TMP = array();
+ for ($j=0; $j<$result[$i][$attr]['count']; $j++) {
+ $_dn = $result[$i][$attr][$j];
+ $_TMP[] = array(
+ 'type'=>'member',
+ 'value'=>$_dn,
+ 'txt'=>($DN2CN[$_dn]==''?str_replace(',',' ',$_dn):$DN2CN[$_dn])
+ );
+ }
+ $return[$i][$attr] = $_TMP;
+ }
+
+ elseif (isset($result[$i][$attr])) $return[$i][$attr] = $result[$i][$attr];
+ else $return[$i][$attr] = array('count' => 0);
+ }
+
+ if ($SET['withNewAccounts']===true) {
+ $return[$i]['member']['new'] = $accountDn;
+ $return[$i]['memberuid']['new'] = $accountUid;
+ }
+ }
+
+ return $return[0];
+
+ }
+
+ }
+
+###############################################################
+# adsChangeGroupInfo - csoport információk módosítása
+###############################################################
+
+ function adsChangeGroupInfo($groupCn, $toPolicy = _POLICY) {
+
+// !!!! A memberuid / member szinkronjára nem figyel!!
+
+ global $AUTH, $backendAttrs, $backendAttrDef;
+ $groupDn = ADSgroupCnToDn($groupCn, $toPolicy);
+
+ // Kapcsolódás az ADS szerverhez
+ $ds = @ldap_connect($AUTH[$toPolicy]['adsHostname']);
+ if (!$ds) {
+ $_SESSION['alert'][] = 'alert:ldap_connect_failure';
+ return false;
+ }
+
+ // Csatlakozás a szerverhez
+ $r = @ldap_bind($ds, BACKEND_CONNECT_DN,BACKEND_CONNECT_PASSWORD);
+
+ if (!$r) {
+ $_SESSION['alert'][] = 'message:ldap_bind_failure';
+ ldap_close($ds);
+ return false;
+ }
+
+ $emptyAttrs = explode(':',$_POST['emptyAttrs']);
+ $_alert = array();
+
+ // Attribútumonként módosítunk
+ foreach ($backendAttrs as $attr) {
+
+ if ($backendAttrDef[$attr]['rights'] == '') $rigths = _DEFAULT_ADS_RIGHTS;
+ else $rights = $backendAttrDef[$attr]['rights'];
+
+ if ($rights[_ACCESS_AS] == 'w') {
+
+ $mod_info = $add_info = $del_info = Array();
+ $values = array();
+
+ if ($backendAttrDef[$attr]['type'] == 'image') {
+ $file = $_FILES[$attr]['tmp_name'];
+ if (file_exists($file)) {
+ $fd = fopen($file,'r');
+ $values[0]=fread($fd,filesize($file));
+ fclose($fd);
+ } else {
+ // Sose töröljük!
+ $emptyAttrs[] = $attr;
+ }
+ } elseif ($backendAttrDef[$attr]['type'] == 'timestamp') {
+ if ($_POST[$attr][0] != '' and $_POST[$attr][1] != '' and $_POST[$attr][2] != '') {
+ $values[0] = $_POST[$attr][0].$_POST[$attr][1].$_POST[$attr][2].'010101Z';
+ }
+ } else {
+ if ($backendAttrDef[$attr]['type'] != '')
+ if (isset($_POST[$attr])) $values[0] = $_POST[$attr];
+ else $values[0] = '';
+ }
+
+ if ($backendAttrDef[$attr]['type'] == 'select') {
+ if (isset($_POST['new-'.$attr][0]) && $_POST['new-'.$attr][0] != '') $add_info[$attr] = $_POST['new-'.$attr];
+ if (isset($_POST['del-'.$attr][0]) && $_POST['del-'.$attr][0] != '') $del_info[$attr] = $_POST['del-'.$attr];
+ } elseif (in_array($attr,$emptyAttrs)) {
+ if ($values[0] != '') $add_info[$attr] = $values;
+ } else {
+ if ($values[0] != '') {
+ $mod_info[$attr] = $values;
+ } else {
+ $del_info[$attr] = Array();
+ }
+
+ }
+
+ if (count($add_info)!=0) {
+ if (!@ldap_mod_add($ds,$groupDn,$add_info)) {
+ $_alert[] = 'message:insufficient_access:add:'.$attr;
+ }
+ }
+ if (count($mod_info)!=0) {
+ if (!@ldap_mod_replace($ds,$groupDn,$mod_info)) {
+ $_alert[] = 'message:insufficient_access:mod:'.$attr;
+ }
+ }
+ if (count($del_info)!=0) {
+ if (!@ldap_mod_del($ds,$groupDn,$del_info)) {
+ $_alert[] = 'message:insufficient_access:del:'.$attr;
+ }
+ }
+
+ } else {
+// $_alert[] = 'message:insufficient_access:'.$attr;
+ }
+ } // foreach
+
+ ldap_close($ds);
+ if (count($_alert) == 0) $_SESSION['alert'][] = 'info:change_success';
+ else for ($i=0;$i<count($_alert);$i++) $_SESSION['alert'][] = $_alert[$i];
+
+ }
+
+ function getADSaccounts($toPolicy = _POLICY) {
+
+ global $AUTH;
+
+ // Kapcsolódás az ADS szerverhez
+ $ds = @ldap_connect($AUTH[$toPolicy]['adsHostname']);
+ if (!$ds) {
+ $_SESSION['alert'][] = 'alert:ldap_connect_failure';
+ return false;
+ }
+
+ // Csatlakozás a szerverhez
+ $r = @ldap_bind($ds, BACKEND_CONNECT_DN,BACKEND_CONNECT_PASSWORD);
+ if (!$r) {
+ $_SESSION['alert'][] = 'message:ldap_bind_failure';
+ ldap_close($ds);
+ return false;
+ }
+
+ // Keresés
+ $attrList = array('cn','uid','displayName','samaccountname');
+ $filter = '(&(objectclass=person)(!(objectclass=computer)))';
+ $sr = @ldap_search($ds, $AUTH[$toPolicy]['adsBaseDn'], $filter, $attrList);
+ if (!$sr) {
+ $_SESSION['alert'][] = "message:ldap_search_failure:".$userDn;
+ ldap_close($ds);
+ return false;
+ }
+
+ ldap_sort($ds, $sr, 'displayname');
+ $info = @ldap_get_entries($ds,$sr);
+ ldap_close($ds);
+
+ return $info;
+
+ }
+
+
+?>
diff --git a/mayor-orig/www/include/backend/ads/session/base.php b/mayor-orig/www/include/backend/ads/session/base.php
new file mode 100644
index 00000000..3a727c3b
--- /dev/null
+++ b/mayor-orig/www/include/backend/ads/session/base.php
@@ -0,0 +1,188 @@
+<?php
+/*
+ Module: base/session
+ Backend: ads (for Active Directory)
+
+ function ADSuserAccountToDn($userAccount = _USERACCOUNT, $toPolicy = _POLICY)
+ function adsMemberOf($userAccount, $group, $toPolicy = _POLICY)
+
+*/
+
+ require('include/backend/ads/base/attrs.php');
+
+ ldap_set_option(NULL, LDAP_OPT_PROTOCOL_VERSION, 3);
+ ldap_set_option(NULL, LDAP_OPT_REFERRALS, 0);
+
+ if ($AUTH[_POLICY]['backend'] == 'ads') {
+ /* why not put into session cache */
+ if ($AUTH[_POLICY]['cacheable']=='yes') {
+ $userDn = _queryCache('RDN',_POLICY,'value');
+ }
+ if (!isset($userDn)) $userDn = ADSuserAccountToDn();
+ define('_USERDN', $userDn); // --TODO DEPRECATED
+ define('BACKEND_CONNECT_DN', $AUTH[_POLICY]['adsUser']);
+ define('BACKEND_CONNECT_PASSWORD', $AUTH[_POLICY]['adsPw']);
+ if ($AUTH[_POLICY]['cacheable']=='yes') _registerToCache('RDN',$userDn,_POLICY);
+ unset($userDn);
+ }
+
+######################################################
+# A _USERACCOUNT(uid)-hoz tartozó dn lekérdezése
+######################################################
+
+ function ADSuserAccountToDn($userAccount = _USERACCOUNT, $toPolicy = _POLICY) {
+
+ global $AUTH;
+
+ // Kapcsolódás a szerverhez
+ $ds = @ldap_connect($AUTH[$toPolicy]['adsHostname']);
+ if (!$ds) {
+ $_SESSION['alert'][] = 'alert:ldap_connect_failure';
+ return false;
+ }
+
+ // Csatlakozás a szerverhez
+ $r = @ldap_bind($ds,$AUTH[$toPolicy]['adsUser'],$AUTH[$toPolicy]['adsPw']);
+ if (!$r) {
+ $_SESSION['alert'][] = 'message:ldap_bind_failure';
+ return false;
+ }
+
+ // Van-e adott azonosítójú felhasználó?
+ $filter="(&(sAMAccountName=$userAccount)(objectClass=".$AUTH[$toPolicy]['adsUserObjectClass']."))";
+ $justthese=array('cn','sn','givenName');
+ $sr = ldap_search($ds, $AUTH[$toPolicy]['adsBaseDn'], $filter, $justthese);
+ if (!$sr) {
+ $_SESSION['alert'][] = "message:ldap_search_failure";
+ ldap_close($ds);
+ return false;
+ }
+ $info=ldap_get_entries($ds,$sr);
+ ldap_close($ds);
+
+ if ( $info['count'] === 0 ) {
+ // Nincs ilyen userAccount (uid)
+ $_SESSION['alert'][] = "message:no_account:$userAccount";
+ return false;
+ } elseif ( $info['count'] > 1 ) {
+ // Több ilyen uid is van
+ $_SESSION['alert'][] = "message:multi_uid:$userAccount";
+ return false;
+ }
+
+ if ($info['count']==1) { // Van - egy - ilyen felhasználó
+ return $info[0]['dn'];
+ }
+
+ }
+
+
+######################################################
+# A groupCn(cn)-hez tartozó dn lekérdezése
+######################################################
+
+ function ADSgroupCnToDn($groupCn, $toPolicy = _POLICY) {
+
+ global $AUTH;
+
+ // Kapcsolódás a szerverhez
+ $ds = @ldap_connect($AUTH[$toPolicy]['adsHostname']);
+ if (!$ds) {
+ $_SESSION['alert'][] = 'alert:ldap_connect_failure';
+ return false;
+ }
+
+ // Csatlakozás a szerverhez
+ $r = @ldap_bind($ds,$AUTH[$toPolicy]['adsUser'],$AUTH[$toPolicy]['adsPw']);
+ if (!$r) {
+ $_SESSION['alert'][] = 'message:ldap_bind_failure';
+ return false;
+ }
+
+ // Van-e ilyen csoport?
+ $filter="(&(cn=$groupCn)(objectClass=".$AUTH[$toPolicy]['adsGroupObjectClass']."))";
+ $justthese=array('cn');
+ $sr = ldap_search($ds, $AUTH[$toPolicy]['adsBaseDn'], $filter, $justthese);
+ if (!$sr) {
+ $_SESSION['alert'][] = "message:ldap_search_failure";
+ ldap_close($ds);
+ return false;
+ }
+ $info=ldap_get_entries($ds,$sr);
+ ldap_close($ds);
+
+ if ( $info['count'] === 0 ) {
+ // Nincs ilyen groupCn (cn) - hibaüzenet csak akkor, ha nem kategóriáról van szó...
+ if (!in_array($groupCn, array_map('ekezettelen', $AUTH[$toPolicy]['categories']))) $_SESSION['alert'][] = "message:no_group:$groupCn";
+ return false;
+ } elseif ( $info['count'] > 1 ) {
+ // Több ilyen cn is van
+ $_SESSION['alert'][] = "message:multi_gid:$groupCn";
+ return false;
+ }
+
+ if ($info['count']==1) { // Van - egy - ilyen csoport
+ return $info[0]['dn'];
+ }
+
+ }
+
+######################################################
+# memberOf - csoport tag-e
+######################################################
+
+ function adsMemberOf($userAccount, $group, $toPolicy = _POLICY) {
+
+ global $AUTH;
+ //global $ADS2Mayor;
+
+ $userDn = ADSuserAccountToDn($userAccount, $toPolicy);
+ if (in_array($group, $AUTH[$toPolicy]['categories'])) {
+ if (strpos($userDn, ',ou='.ekezettelen($group).',') !== false) return true;
+# Ha nincs megfelelő ou-ban, akkor nézzük a csoport tagságot - így berakható időszakosan akárki pl a titkárság kategóriába...
+# else return false;
+ }
+
+ if (substr($group,0,3) != 'cn=') {
+ $groupDn = ADSgroupCnToDn(ekezettelen($group));
+ if (!$groupDn) return false; // Ha nincs ilyen csoport az ADS fában
+ } else {
+ $groupDn = $group;
+ }
+
+ // Kapcsolódás az ADS szerverhez
+ $ds = @ldap_connect($AUTH[$toPolicy]['adsHostname']);
+ if (!$ds) {
+ $_SESSION['alert'][] = 'alert:ldap_connect_failure';
+ return false;
+ }
+
+ // Csatlakozás a szerverhez
+ $r = @ldap_bind($ds,$AUTH[$toPolicy]['adsUser'],$AUTH[$toPolicy]['adsPw']);
+ if (!$r) {
+ $_SESSION['alert'][] = 'message:ldap_bind_failure';
+ ldap_close($ds);
+ return false;
+ }
+
+ $justthese = array('cn'); // valamit le kell kérdezni...
+ $filter = "(&(objectClass=".$AUTH[$toPolicy]['adsGroupObjectClass'].")(member=$userDn))";
+ $sr = @ldap_search($ds, $groupDn, $filter, $justthese);
+ if (!$sr) {
+ $_SESSION['alert'][] = "message:ldap_search_failure:".$filter;
+ ldap_close($ds);
+ return false;
+ }
+
+ $info = ldap_get_entries($ds, $sr);
+ ldap_close($ds);
+
+ if ($info['count'] > 0) {
+ return true;
+ } else {
+ return false;
+ }
+
+ }
+
+?>
diff --git a/mayor-orig/www/include/backend/ads/session/createAccount.php b/mayor-orig/www/include/backend/ads/session/createAccount.php
new file mode 100644
index 00000000..02809f07
--- /dev/null
+++ b/mayor-orig/www/include/backend/ads/session/createAccount.php
@@ -0,0 +1,157 @@
+<?php
+/*
+ Modules: base/session
+*/
+
+ require_once('include/backend/ads/password/changePassword.php');
+
+ /*
+ $SET = array(
+ container => a konténer elem - ha nincs, akkor CN=Users alá rakja
+ category => tanár, diák... egy kiemelt fontosságú csoport tagság
+ groups => egyéb csoportok
+ policyAttrs => policy függő attribútumok
+ )
+ */
+ function adsCreateAccount(
+ $userCn, $userAccount, $userPassword, $toPolicy, $SET
+ ) {
+
+ global $AUTH;
+
+ $shadowLastChange = floor(time() / (60*60*24));
+
+ // $toPolicy --> ads backend - ellenőrzés!
+ if ($AUTH[$toPolicy]['backend'] != 'ads') {
+ $_SESSION['alert'][] = 'page:wrong_backend:'.$AUTH[$toPolicy]['backend'];
+ return false;
+ }
+
+ // Kapcsolódás az LDAP szerverhez
+ $ds = @ldap_connect($AUTH[$toPolicy]['adsHostname']);
+ if (!$ds) {
+ $_SESSION['alert'][] = 'alert:ldap_connect_failure';
+ return false;
+ }
+
+ // Csatlakozás a szerverhez
+ $r = @ldap_bind($ds, BACKEND_CONNECT_DN,BACKEND_CONNECT_PASSWORD);
+ if (!$r) {
+ $_SESSION['alert'][] = 'message:ldap_bind_failure';
+ ldap_close($ds);
+ return false;
+ }
+
+ $info = $ginfo = Array();
+
+ // uid ütközés ellenőrzése
+ $filter = "(sAMAccountName=$userAccount)";
+ $justthese = array('sAMAccountName');
+ $sr = ldap_search($ds, $AUTH[$toPolicy]['adsBaseDn'], $filter, $justthese);
+ $uinfo = ldap_get_entries($ds, $sr);
+ $uidCount = $uinfo['count'];
+ ldap_free_result($sr);
+ if ($uidCount > 0) {
+ $_SESSION['alert'][] = 'message:multi_uid:'.$userAccount;
+ return false;
+ }
+
+ // Az következő uidNumber megállapítása
+ $filter = "(&(objectclass=".$AUTH[$toPolicy]['adsUserObjectClass'].")(uidNumber=*))";
+ $justthese = array('uidNumber', 'msSFU30UidNumber');
+ $sr = ldap_search($ds,$AUTH[$toPolicy]['adsBaseDn'], $filter, $justthese);
+ ldap_sort($ds, $sr, 'uidNumber');
+ $uinfo = ldap_get_entries($ds, $sr);
+ ldap_free_result($sr);
+ if (isset($uinfo['count']) && $uinfo['count'] > 0) $info['uidNumber'] = array($uinfo[ $uinfo['count']-1 ]['uidnumber'][0]+1);
+ else $info['uidNumber'] = array(1001);
+
+ // shadow attributumok...
+ // A shadowLastChange a mai nap // if (isset($AUTH[$toPolicy]['shadowlastchange']) && $AUTH[$toPolicy]['shadowlastchange'] != '')
+ $info['shadowLastChange'] = array($shadowLastChange);
+ if (isset($AUTH[$toPolicy]['shadowMin']) && $AUTH[$toPolicy]['shadowMin'] != '') $info['shadowMin'] = array($AUTH[$toPolicy]['shadowMin']);
+ if (isset($AUTH[$toPolicy]['shadowMax']) && $AUTH[$toPolicy]['shadowMax'] != '') $info['shadowMax'] = array($AUTH[$toPolicy]['shadowMax']);
+ if (isset($AUTH[$toPolicy]['shadowWarning']) && $AUTH[$toPolicy]['shadowWarning'] != '') $info['shadowWarning'] = array($AUTH[$toPolicy]['shadowWarning']);
+ if (isset($AUTH[$toPolicy]['shadowInactive']) && $AUTH[$toPolicy]['shadowInactive'] != '') $info['shadowInactive'] = array($AUTH[$toPolicy]['shadowInactive']);
+ if (isset($AUTH[$toPolicy]['shadowExpire']) && $AUTH[$toPolicy]['shadowWxpire'] != '') $info['shadowExpire'] = array($AUTH[$toPolicy]['shadowExpire']);
+
+ // A szokásos attribútumok
+ $Name = explode(' ',$userCn);
+ $Dn = ldap_explode_dn($AUTH[$toPolicy]['adsBaseDn'], 1); unset($Dn['count']);
+ $info['userPrincipalName'] = array( $userAccount.'@'.implode('.', $Dn));
+ $info['msSFU30Name'] = $info['sAMAccountName'] = $info['cn'] = array($userAccount);
+ $info['displayName'] = array($userCn);
+ $info['sn'] = array($Name[0]);
+ $info['givenName'] = array($Name[ count($Name)-1 ]);
+ $info['unixUserPassword'] = array('ABCD!efgh12345$67890');
+ $info['unixHomeDirectory'] = array(ekezettelen("/home/$userAccount"));
+ $info['loginShell'] = array('/bin/bash');
+ $info['objectClass'] = array($AUTH[$toPolicy]['adsUserObjectClass'], 'user');
+
+ $policyAccountAttrs = $SET['policyAttrs'];
+ if (isset($policyAccountAttrs['studyId'])) $info[ $AUTH[$toPolicy]['adsStudyIdAttr'] ] = array($policyAccountAttrs['studyId']);
+ foreach ($policyAccountAttrs as $attr => $value)
+ if ($attr != 'studyId' && isset($accountAttrToADS[$attr]))
+ $info[ $accountAttrToADS[$attr] ] = array($value);
+
+ if (isset($SET['container'])) $dn = "CN=$userAccount,".$SET['container'];
+ else $dn = "CN=$userAccount,CN=Users,".$AUTH[$toPolicy]['adsBaseDn'];
+
+ // user felvétel
+ $_r1 = @ldap_add($ds,$dn,$info);
+ if (!$_r1) {
+ $_SESSION['alert'][] = 'message:ldap_error:Add user:'.ldap_error($ds);
+ //echo $dn.'<pre>'; var_dump($info); echo '</pre>';
+ return false;
+ }
+
+ // Jelszó beállítás
+ if (!changePassword($userAccount, $userPassword, $toPolicy)) $_SESSION['alert'][] = 'message:ldap_error:changePassword failed:'.$userAccount;
+
+ // Engedélyezés
+ $einfo = array('userAccountControl' => array(512)); /* Normal account = 512 */
+ $_r1 = @ldap_mod_replace($ds,$dn,$einfo);
+ if (!$_r1) {
+ $_SESSION['alert'][] = 'message:ldap_error:Enable user:'.ldap_error($ds);
+ //echo $dn.'<pre>'; var_dump($info); echo '</pre>';
+ return false;
+ }
+
+ // Kategória csoportba és egyéb csoportokba rakás
+ if (isset($SET['category'])) {
+ if (is_array($SET['groups'])) array_unshift($SET['groups'], $SET['category']);
+ else $SET['groups'] = array($SET['category']);
+
+ $ginfo['member'] = $dn;
+
+ for ($i = 0; $i < count($SET['groups']); $i++) {
+ $groupDn = ADSgroupCnToDn($SET['groups'][$i], $toPolicy);
+ if ($groupDn !== false) {
+ $_r3 = @ldap_mod_add($ds, $groupDn, $ginfo);
+ if (!$_r3) {
+ $_SESSION['alert'][] = 'message:ldap_error:Add to group '.$SET['groups'][$i].':'.ldap_error($ds);
+ //echo $SET['groups'][$i].'<pre>'; var_dump($ginfo); echo '</pre>';
+ }
+ }
+ }
+ }
+
+ ldap_close($ds);
+
+ if (defined('_DATADIR')
+ && isset($AUTH[$toPolicy]['createAccountScript'])
+ && file_exists(_DATADIR)
+ ) {
+ $sfp = fopen(_DATADIR.'/'.$AUTH[$toPolicy]['createAccountScript'],'a+');
+ if ($sfp) {
+ fwrite($sfp,"\n# $userAccount létrehozása: userAccount uidNumber homeDirectory\n");
+ fwrite($sfp,"createAccount.sh '$userAccount' '".$info['uidNumber'][0]."' '".$info['unixHomeDirectory'][0]."'\n");
+ fclose($sfp);
+ }
+ }
+ $_SESSION['alert'][] = 'info:create_uid_success:'.$dn;
+ return true;
+
+ }
+
+?>
diff --git a/mayor-orig/www/include/backend/ads/session/createGroup.php b/mayor-orig/www/include/backend/ads/session/createGroup.php
new file mode 100644
index 00000000..0a0a8c1d
--- /dev/null
+++ b/mayor-orig/www/include/backend/ads/session/createGroup.php
@@ -0,0 +1,82 @@
+<?php
+/*
+ Modules: base/session
+*/
+
+
+ function adsCreateGroup($groupCn, $groupDesc, $toPolicy = _POLICY, $SET = array()) {
+
+ global $AUTH;
+ $category = ekezettelen($SET['category']);
+
+ // $toPolicy --> ads backend - ellenőrzés!
+ if ($AUTH[$toPolicy]['backend'] != 'ads') {
+ $_SESSION['alert'][] = 'page:wrong_backend:'.$AUTH[$toPolicy]['backend'];
+ return false;
+ }
+
+ // Kapcsolódás az LDAP szerverhez
+ $ds = @ldap_connect($AUTH[$toPolicy]['adsHostname']);
+ if (!$ds) {
+ $_SESSION['alert'][] = 'alert:ldap_connect_failure';
+ return false;
+ }
+
+ // Csatlakozás a szerverhez
+ $r = @ldap_bind($ds, BACKEND_CONNECT_DN,BACKEND_CONNECT_PASSWORD);
+ if (!$r) {
+ $_SESSION['alert'][] = 'message:ldap_bind_failure';
+ ldap_close($ds);
+ return false;
+ }
+
+ $info = $ginfo = Array();
+
+ // cn ütközés ellenőrzése
+ $filter = "(&(objectclass=".$AUTH[$toPolicy]['adsGroupObjectClass'].")(cn=$groupCn))";
+ $justthese = array('cn');
+ $sr = ldap_search($ds, $AUTH[$toPolicy]['adsBaseDn'], $filter, $justthese);
+ $ginfo = ldap_get_entries($ds, $sr);
+ $gCount = $ginfo['count'];
+ ldap_free_result($sr);
+ if ($gCount > 0) {
+ $_SESSION['alert'][] = 'message:multi_uid:'.$groupCn;
+ return false;
+ }
+
+ // Az következő gidNumber megállapítása
+ $filter = "(&(objectclass=".$AUTH[$toPolicy]['adsGroupObjectClass'].")(gidNumber=*))";
+ $justthese = array('gidNumber', 'msSFU30GidNumber');
+ $sr = ldap_search($ds,$AUTH[$toPolicy]['adsBaseDn'], $filter, $justthese);
+ ldap_sort($ds, $sr, 'gidNumber');
+ $ginfo = ldap_get_entries($ds, $sr);
+ ldap_free_result($sr);
+ if (isset($ginfo['count']) && $ginfo['count'] > 0) $info['gidNumber'] = array($ginfo[ $ginfo['count']-1 ]['gidnumber'][0]+1);
+ else $info['gidNumber'] = array(1001);
+
+ // A szokásos attribútumok
+ $info['sAMAccountName'] = $info['cn'] = array($groupCn);
+ $info['description'] = array($groupDesc);
+
+ // A kategória függő attribútumok
+ if (isset($SET['container'])) $dn = "CN=$groupCn,".$SET['container'];
+ else $dn = "CN=$groupCn,OU=$category,".$AUTH[$toPolicy]['adsBaseDn'];
+
+ // objectum osztályok
+ $info['objectClass'] = array($AUTH[$toPolicy]['adsGroupObjectClass']);
+
+ // csoport felvétel
+ $_r1 = ldap_add($ds,$dn,$info);
+ if (!$_r1) {
+ printf("ADS-Error: %s<br>\n", ldap_error($ds));
+ var_dump($info);
+ }
+
+ ldap_close($ds);
+
+ $_SESSION['alert'][] = 'info:create_group_success:'.$dn;
+ return true;
+
+ }
+
+?>
diff --git a/mayor-orig/www/include/backend/ads/session/search/searchAccount.php b/mayor-orig/www/include/backend/ads/session/search/searchAccount.php
new file mode 100644
index 00000000..01298382
--- /dev/null
+++ b/mayor-orig/www/include/backend/ads/session/search/searchAccount.php
@@ -0,0 +1,277 @@
+<?php
+/*
+ Module: base/session
+ Backend: ads
+
+ ! -- Csak publikus mezőkre lehet keresni! -- !
+ function ADSSearch($attr, $pattern, $searchAttrs=array('cn'), $filter='(objectclass=*)')
+ function adsSearchAccount($attr, $pattern, $searchAttrs = array('userCn'))
+ function adsSearchGroup($attr, $pattern, $searchAttrs = array('groupCn, groupDesc'), $toPolicy = '') {
+
+*/
+
+######################################################
+# Általános ADS kereső függvény
+######################################################
+
+ function ADSSearch($attr, $pattern, $searchAttrs=array('cn'), $filter='(objectclass=*)', $toPolicy = _POLICY) {
+
+ global $AUTH;
+
+ if ($pattern == '') {
+ $_SESSION['alert'][] = 'message:empty_field';
+ return false;
+ }
+
+ // Kapcsolódás az ADS szerverhez
+ $ds = @ldap_connect($AUTH[$toPolicy]['adsHostname']);
+ if (!$ds) {
+ $_SESSION['alert'][] = 'alert:ldap_connect_failure';
+ return false;
+ }
+
+ // Csatlakozás a szerverhez
+ $r = @ldap_bind($ds, BACKEND_CONNECT_DN,BACKEND_CONNECT_PASSWORD);
+
+ if (!$r) {
+ $_SESSION['alert'][] = 'message:ldap_bind_failure:ADSSearch';
+ ldap_close($ds);
+ return false;
+ }
+
+ // Keresés
+ if (
+ strpos(kisbetus($attr),'number') !== false
+ && $attr != 'serialNumber'
+ ) $filter = "(&$filter($attr=$pattern))";
+ else $filter = "(&$filter($attr=*$pattern*))";
+
+ $filter = "(&$filter($attr=*$pattern*))";
+ $sr = @ldap_search($ds, $AUTH[$toPolicy]['adsBaseDn'], $filter, $searchAttrs);
+ if (!$sr) {
+ $_SESSION['alert'][] = "message:ldap_search_failure:".$filter;
+ ldap_close($ds);
+ return false;
+ }
+
+ $info = @ldap_get_entries($ds,$sr);
+ ldap_close($ds);
+
+ return $info;
+
+ }
+
+######################################################
+# adsSearchAccount - felhasználó kereső függvény
+######################################################
+
+ function adsSearchAccount($attr, $pattern, $searchAttrs = array('userCn'), $toPolicy = _POLICY) {
+
+ global $accountAttrToADS;
+
+ // A keresendő attribútum konvertálása ADS attribútummá
+ if ($accountAttrToADS[ $attr ] != '') $attrADS = $accountAttrToADS[ $attr ];
+ else $attrADS = $attr;
+ if ($attrADS == 'dn') $attrADS = 'uid'; // dn-re nem megy a keresés!!
+
+ // A lekérendő attribútumok konvertálása ADS attribútummá
+ for ($i = 0; $i < count($searchAttrs); $i++) {
+ if ($accountAttrToADS[ $searchAttrs[$i] ] != '') $searchAttrsADS[$i] = $accountAttrToADS[ $searchAttrs[$i] ];
+ else $searchAttrsADS[$i] = $searchAttrs[$i];
+ }
+ $result = ADSSearch($attrADS, $pattern, $searchAttrsADS, '(&(objectclass=person)(!(objectclass=computer)))', $toPolicy);
+ if ($result === false) {
+ return false;
+ } else {
+
+ // ADS schema --> mayor schema konverzió
+ for ($i = 0; $i < $result['count']; $i++) {
+ // Egységes szerkezetre alakítjuk, azaz a dn is indexelt
+ $result[$i]['dn'] = $return[$i]['userAccount'] = array('count' => 1, 0 => $result[$i]['dn']);
+ for ($j = 0; $j < count($searchAttrs); $j++) {
+ $a = $searchAttrs[$j];
+ if (isset($result[$i][ kisbetus($accountAttrToADS[$a]) ])) {
+ if ($accountAttrToADS[$a] != '') $return[$i][$a] = $result[$i][ kisbetus($accountAttrToADS[$a]) ];
+ else $return[$i][$a] = $result[$i][$a];
+ } else {
+ $return[$i][$a] = array('count' => 0) ;
+ }
+ }
+ $return[$i]['category'] = getAccountCategories($return[$i]['userAccount'][0], $toPolicy);
+ $return[$i]['category']['count'] = count($return[$i]['category']);
+ }
+ $return['count'] = $result['count'];
+
+ return $return;
+
+ }
+
+ }
+
+######################################################
+# adsSearchGroup - csoport kereső függvény
+######################################################
+
+ function adsSearchGroup($attr, $pattern, $searchAttrs = array('groupCn, groupDesc'), $toPolicy = _POLICY) {
+
+ global $groupAttrToADS;
+
+ // A keresendő attribútum konvertálása ADS attribútummá
+ if ($groupAttrToADS[ $attr ] != '') $attrADS = $groupAttrToADS[ $attr ];
+ else $attrADS = $attr;
+ if ($attrADS == 'dn') $attrADS = 'cn'; // dn-re nem megy a keresés!!
+
+ // A lekérendő adtibútumok konvertálása ADS attribútummá
+ for ($i = 0; $i < count($searchAttrs); $i++) {
+ if ($groupAttrToADS[ $searchAttrs[$i] ] != '') $searchAttrsADS[$i] = $groupAttrToADS[ $searchAttrs[$i] ];
+ else $searchAttrsADS[$i] = $searchAttrs[$i];
+ }
+
+ $result = ADSSearch($attrADS, $pattern, $searchAttrsADS, '(objectclass=group)', $toPolicy);
+ if ($result === false) {
+ return false;
+ } else {
+
+ // ADS schema --> mayor schema konverzió
+ for ($i = 0; $i < $result['count']; $i++) {
+ // Egységes szerkezetre alakítjuk, azaz a dn is indexelt
+ $result[$i]['dn'] = $return[$i]['groupCn'] = array('count' => 1, 0 => $result[$i]['dn']);
+ for ($j = 0; $j < count($searchAttrs); $j++) {
+ $a = $searchAttrs[$j];
+ if (!isset($groupAttrToADS[$a]) || $groupAttrToADS[$a] != '') {
+ if (isset($result[$i][ $groupAttrToADS[$a] ])) $return[$i][$a] = $result[$i][ $groupAttrToADS[$a] ];
+ else $return[$i][$a] = '';
+ } else {
+ $return[$i][$a] = $result[$i][$a];
+ }
+ }
+ }
+ $return['count'] = $result['count'];
+
+ return $return;
+
+ }
+
+ }
+
+######################################################
+# adsDeleteAccount - account törlése
+######################################################
+
+ function adsDeleteAccount($userAccount, $toPolicy = _POLICY) {
+
+ global $AUTH;
+
+ // $toPolicy --> ads backend - ellenőrzés
+ if ($AUTH[$toPolicy]['backend'] != 'ads') {
+ $_SESSION['alert'][] = 'page:wrong_backend:ads!='.$AUTH[$toPolicy]['backend'];
+ return false;
+ }
+
+ $userDn = ADSuserAccountToDn($userAccount, $toPolicy);
+ if ($userDn === false) return false;
+
+ // Kapcsolódás az ADS szerverhez
+ $ds = @ldap_connect($AUTH[$toPolicy]['adsHostname']);
+ if (!$ds) {
+ $_SESSION['alert'][] = 'alert:ldap_connect_failure';
+ return false;
+ }
+
+ // Csatlakozás a szerverhez
+ $r = @ldap_bind($ds, BACKEND_CONNECT_DN,BACKEND_CONNECT_PASSWORD);
+ if (!$r) {
+ $_SESSION['alert'][] = 'message:ldap_bind_failure';
+ ldap_close($ds);
+ return false;
+ }
+
+ // Az uidNumber, a unixHomeDirectory lekerdezése
+ $filter = "(&(objectclass=".$AUTH[$toPolicy]['adsUserObjectClass'].")(!(objectclass=computer)))";
+ $justthese = array('uidNumber','unixHomedirectory');
+ $sr = @ldap_search($ds,$userDn,$filter,$justthese);
+ if (!$sr) {
+ $_SESSION['alert'][] = "message:ldap_search_failure:".$userDn;
+ ldap_close($ds);
+ return false;
+ } ;
+
+ $info = @ldap_get_entries($ds,$sr);
+ $uidNumber = $info[0]['uidnumber'][0];
+ $homeDirectory = $info[0]['unixhomedirectory'][0];
+ $uid=$userAccount;
+
+ // user törlése
+ if (!@ldap_delete($ds,$userDn)) {
+ $_SESSION['alert'][] = 'message:ldap_delete_failure:user:'.$userAccount;
+ }
+
+ ldap_close($ds);
+
+ /*
+ Ha van megadva deleteAccountScript paraméter, akkor abba bejegyzi a törölt felhasználó adatait.
+ A meghívott deleteAccount.sh nincs definiálva, testreszabható, megkötés egyedül a paraméter
+ lista: userAccount, uidNumber, homeDirectory
+ */
+ if (defined('_DATADIR')
+ && isset($AUTH[$toPolicy]['deleteAccountScript'])
+ && file_exists(_DATADIR)
+ ) {
+ $sfp = fopen(_DATADIR.'/'.$AUTH[$toPolicy]['deleteAccountScript'],'a+');
+ if ($sfp) {
+ fwrite($sfp,"\n# $userAccount törlése: userAccount uidNumber homeDirectory\n");
+ fwrite($sfp,"deleteAccount.sh '$userAccount' '$uidNumber' '$homeDirectory'\n");
+ fclose($sfp);
+ }
+ }
+
+ $_SESSION['alert'][] = 'info:delete_uid_success:'.$userDn;
+ return true;
+
+ }
+
+######################################################
+# adsDeleteGroup - account törlése
+######################################################
+
+ function adsDeleteGroup($groupCn, $toPolicy = _POLICY) {
+
+ global $AUTH;
+
+ // $toPolicy --> ads backend - ellenőrzés
+ if ($AUTH[$toPolicy]['backend'] != 'ads') {
+ $_SESSION['alert'][] = 'page:wrong_backend:ads!='.$AUTH[$toPolicy]['backend'];
+ return false;
+ }
+
+ $groupDn = ADSgroupCnToDn($groupCn, $toPolicy);
+ if ($groupDn === false) return false;
+
+ // Kapcsolódás az ADS szerverhez
+ $ds = @ldap_connect($AUTH[$toPolicy]['adsHostname']);
+ if (!$ds) {
+ $_SESSION['alert'][] = 'alert:ldap_connect_failure';
+ return false;
+ }
+
+ // Csatlakozás a szerverhez
+ $r = @ldap_bind($ds, BACKEND_CONNECT_DN,BACKEND_CONNECT_PASSWORD);
+ if (!$r) {
+ $_SESSION['alert'][] = 'message:ldap_bind_failure';
+ ldap_close($ds);
+ return false;
+ }
+
+ if (!@ldap_delete($ds, $groupDn)) {
+ $_SESSION['alert'][] = 'message:ldap_delete_failure:group:'.$groupCn;
+ }
+
+ ldap_close($ds);
+
+ $_SESSION['alert'][] = 'info:delete_group_success:'.$groupCn;
+ return true;
+
+ }
+
+
+?>