1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
| <?php
define('LDAP_HOST', '192.168.100.4');
define('MANAGER_DN', 'cn=manager,dc=developpez,dc=com');
define('MANAGER_PWD', 'secret');
define('GRP_PROFS_DN', 'cn=LdapUsers,ou=Groupes,dc=developpez,dc=com');
define('UTIL_BASE_DN', 'ou=Utilisateurs,dc=developpez,dc=com');
function check_password($crypted_pwd, $plain_pwd)
{
if (preg_match('/{([^}]+)}(.*)/', $crypted_pwd, $cypher)) {
$crypted_pwd = $cypher[2];
$cypher = strtolower($cypher[1]);
} else {
$cypher = NULL;
}
switch ($cypher) {
case 'crypt':
if (preg_match("/^\\$2+/", $crypted_pwd)) {
if (!defined('CRYPT_BLOWFISH') || CRYPT_BLOWFISH == 0) {
die('Your system crypt library does not support blowfish encryption.');
}
list(, $version, $rounds, $salt_hash) = explode('$', $crypted_pwd);
return (crypt($plain_pwd, '$'. $version . '$' . $rounds . '$' .$salt_hash) == $crypted_pwd);
} elseif (strstr($crypted_pwd, '$1$')) {
if (!defined('CRYPT_MD5') || CRYPT_MD5 == 0) {
die('Your system crypt library does not support md5crypt encryption.');
}
list(, $type, $salt, $hash) = explode('$', $crypted_pwd);
return (crypt($plain_pwd, '$1$' .$salt) == $crypted_pwd);
} elseif (strstr($crypted_pwd, '_')) {
if (!defined('CRYPT_EXT_DES') || CRYPT_EXT_DES == 0) {
die('Your system crypt library does not support extended DES encryption.');
}
return (crypt($plain_pwd, $crypted_pwd) == $crypted_pwd);
} else {
return (crypt($plain_pwd, $crypted_pwd ) == $crypted_pwd);
}
break;
default:
die("Algorithme non implémenté");
break;
}
}
function member_of($ldapc, $groupe, $uid)
{
$sr = ldap_read($ldapc, $groupe, sprintf('(memberuid=%s)', $uid))/* or die($php_errormsg)*/;
if (!$sr) {
return FALSE;
}
$count = ldap_count_entries($ldapc, $sr);
ldap_free_result($sr);
return $count === 1;
}
function find_user_by_uid($ldapc, $base, $uid)
{
$sr = ldap_list($ldapc, $base, sprintf('(uid=%s)', $uid), array('dn', 'userpassword'))/* or die($php_errormsg)*/;
if (!$sr) {
return FALSE;
}
if (ldap_count_entries($ldapc, $sr) > 1) {
ldap_free_result($sr);
return FALSE;
}
$r = ldap_get_entries($ldapc, $sr);
ldap_free_result($sr);
return array('dn' => $r[0]['dn'], 'userpassword' => $r[0]['userpassword'][0]);
}
echo '<center><form method="POST">
Login :<input type="text" name="uidd"><br/>
Password :<input type="password" name="pass"><br/>
<input type="submit" value="Valider"></form></center><br/><br/><br/>';
if (!empty($_POST['uidd']) && isset($_POST['pass']))
{
$uid = $_POST['uidd'];
$ds = ldap_connect(LDAP_HOST) or die($php_errormsg);
ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
ldap_bind($ds, MANAGER_DN, MANAGER_PWD) or die($php_errormsg);
if (member_of($ds, GRP_PROFS_DN, $uid)) {
$util = find_user_by_uid($ds, UTIL_BASE_DN, $uid);
if ($util) {
if (check_password($util['userpassword'], $_POST['pass'])) {
echo 'OK';
} else {
echo "Mot de passe incorrect";
}
} else {
echo "Cet utilisateur n'existe pas ou plus";
}
} else {
echo "Ne fait pas partie des profs";
}
ldap_close($ds) or die($php_errormsg);
}
?> |
[LDAP] php et ldap : ldap_compare
Répondre avec citation
Envoyé par julp
(on en revient probablement aux ACL)
Partager