Subversion Repositories ALCASAR

<?php

/*

This class handled of ldap configuration.

WARNING! This class can't says if the configuration is valid or not.

*/

class ldapConfig

{

	protected $_items = Array();

	protected $_tls = array();

	protected $instanceName;

	public function __construct($instanceName=null) {

		if ($instanceName!== null)

			$this->instanceName = $instanceName;

		// LDAP setting

		$this->_items['protocol']					= 'ldap://';

		$this->_items['host']						= 'test';

		$this->_items['server']						= $this->_items['protocol'].$this->_items['host'];

		$this->_items['port']						= '389';//not use yet (689 = ldaps)

		$this->_items['identity']					= '';

		$this->_items['password']					= '';

		$this->_items['basedn']						= 'dc=example,dc=com';

		$this->_items['filter']						= '(uid=%{Stripped-User-Name:-%{User-Name}})';

		$this->_items['base_filter']				= '';

		$this->_items['ldap_connections_number']	= '5';

		$this->_items['timeout']					= '4';

		$this->_items['timelimit']					= '3';

		$this->_items['net_timeout'] 				= '1';

		// TLS setting related items

		$this->_tls['start_tls']					= 'no'; // if no all tls config are comments

		$this->_tls['cacertfile']					= '#';

		$this->_tls['cacertdir']					= '#';

		$this->_tls['certfile']						= '#';

		$this->_tls['keyfile']						= '#';

		$this->_tls['randfile']						= '#';

		$this->_tls['require_cert']					= '#';

		// others ldap setting (optional)

		$this->_items['default_profile']			= '#';

		$this->_items['profile_attribute']			= '#';

		$this->_items['access_attr']				= '#';

		// Mapping of RADIUS dictionary attributes to LDAP

		// directory attributes.

		$this->_items['dictionary_mapping']	= '${confdir}/ldap.attrmap';

		// for ldap like NOVEL

		$this->_items['password_attribute']			= '#';

		$this->_items['edir_account_policy_check']	= 'no';

		//  Group membership checking.  Disabled by default.

		$this->_items['groupname_attribute']		= '#';

		$this->_items['groupmembership_filter']		= '#';

		$this->_items['groupmembership_attribute']	= '#';

		$this->_items['compare_check_items']		= '#';

		$this->_items['do_xlat']					= '#';

		$this->_items['access_attr_used_for_allow']	= '#';

		// auth option

		$this->_items['set_auth_type']				= '#';

		// debug option

		$this->_items['ldap_debug']					= '#';

	}

	public function __get($attr){ // to get an $item

		if ($attr==='tls'){

			return $this->_tls;

		} elseif (array_key_exists($attr, $this->_items)){

			return $this->_items[$attr];

		} elseif (array_key_exists($attr, $this->_tls)){

			return $this->_tls[$attr];

		}

		// nothing else!

	}

	public function __set($attr, $value){// to set an $item

		if (array_key_exists($attr, $this->_items)){

			$this->_items[$attr] = $value;

		} elseif (array_key_exists($attr, $this->_tls)){

			$this->_tls[$attr] = $value;

		}

	}

	public function load($confFile){

		// use here the parsing class

		require_once("configreader.php");

		$r = new configReader($confFile);

		/*

		loading only if the file containt only one ldap instance.

		If more instance are found, we use the default values instead.

		*/

		if (is_object($r->ldap)){

			$this->instanceName = $r->ldap->getInstanceName();

			$items = $r->ldap->getpair();

			foreach ($this->_items as $key => $value){

				if (array_key_exists($key, $items))

					$this->_items[$key] = $items[$key];

			}

			if (is_object($r->ldap->tls)){

				$tls = $r->ldap->tls->getpair();

				foreach ($this->_tls as $key => $value){

					if (array_key_exists($key, $tls))

						$this->_tls[$key] = $tls[$key];

				}

			}

		}

	}

	public function __toString() {

		return $this->save(null, true);

    }

	protected function _noComment($name, $value, $quote = false){

		if ($value !== '#'){

			if ($quote === true){

				return $name." = \"".$value."\"";

			} else {

				return $name." = ".$value;

			}

		}

	}

	public function save($savefile = null, $returnconfig = false){

	// make config file

	$config = "

	# Lightweight Directory Access Protocol (LDAP)

	#

	#  This module definition allows you to use LDAP for

	#  authorization and authentication.

	#

	#  See raddb/sites-available/default for reference to the

	#  ldap module in the authorize and authenticate sections.

	#

	#  However, LDAP can be used for authentication ONLY when the

	#  Access-Request packet contains a clear-text User-Password

	#  attribute.  LDAP authentication will NOT work for any other

	#  authentication method.

	#

	#  This means that LDAP servers don't understand EAP.  If you

	#  force \"Auth-Type = LDAP\", and then send the server a

	#  request containing EAP authentication, then authentication

	#  WILL NOT WORK.

	#

	#  The solution is to use the default configuration, which does

	#  work.

	#

	#  Setting \"Auth-Type = LDAP\" is ALMOST ALWAYS WRONG.  We

	#  really can't emphasize this enough.

	#	

	ldap ".$this->instanceName."{

		#

		#  Note that this needs to match the name in the LDAP

		#  server certificate, if you're using ldaps.

		server = \"".$this->_items['server']."\"

		identity = \"".$this->_items['identity']."\"

		password = ".$this->_items['password']."

		basedn = \"".$this->_items['basedn']."\"

		filter = \"".$this->_items['filter']."\"

		base_filter = \"".$this->_items['base_filter']."\"

		#  How many connections to keep open to the LDAP server.

		#  This saves time over opening a new LDAP socket for

		#  every authentication request.

		ldap_connections_number = ".$this->_items['ldap_connections_number']."

		# seconds to wait for LDAP query to finish. default: 20

		timeout = ".$this->_items['timeout']."

		#  seconds LDAP server has to process the query (server-side

		#  time limit). default: 20

		#

		#  LDAP_OPT_TIMELIMIT is set to this value.

		timelimit = ".$this->_items['timelimit']."

		#

		#  seconds to wait for response of the server. (network

		#   failures) default: 10

		#

		#  LDAP_OPT_NETWORK_TIMEOUT is set to this value.

		net_timeout = ".$this->_items['net_timeout']."

		#

		#  This subsection configures the tls related items

		#  that control how FreeRADIUS connects to an LDAP

		#  server.  It contains all of the \"tls_*\" configuration

		#  entries used in older versions of FreeRADIUS.  Those

		#  configuration entries can still be used, but we recommend

		#  using these.

		#

		tls {

			# Set this to 'yes' to use TLS encrypted connections

			# to the LDAP database by using the StartTLS extended

			# operation.

			#			

			# The StartTLS operation is supposed to be

			# used with normal ldap connections instead of

			# using ldaps (port 689) connections

			start_tls = ".$this->_tls['start_tls']."

			# cacertfile	= /path/to/cacert.pem

			# cacertdir		= /path/to/ca/dir/

			# certfile		= /path/to/radius.crt

			# keyfile		= /path/to/radius.key

			# randfile		= /path/to/rnd

			".$this->_noComment("cacertfile", $this->_tls['cacertfile'])."

			".$this->_noComment("cacertdir", $this->_tls['cacertdir'])."

			".$this->_noComment("certfile", $this->_tls['certfile'])."

			".$this->_noComment("keyfile", $this->_tls['keyfile'])."

			".$this->_noComment("randfile", $this->_tls['randfile'])."

			#  Certificate Verification requirements.  Can be:

			#    \"never\" (don't even bother trying)

			#    \"allow\" (try, but don't fail if the cerificate

			#		can't be verified)

			#    \"demand\" (fail if the certificate doesn't verify.)

			#

			#	The default is \"allow\"

			# require_cert	= \"demand\"

			".$this->_noComment("require_cert", $this->_tls['require_cert'], true)."

		}

		# default_profile = \"cn=radprofile,ou=dialup,o=My Org,c=UA\"

		# profile_attribute = \"radiusProfileDn\"

		# access_attr = \"dialupAccess\"

		".$this->_noComment("default_profile", $this->_items['default_profile'], true)."

		".$this->_noComment("profile_attribute", $this->_items['profile_attribute'], true)."

		".$this->_noComment("access_attr", $this->_items['access_attr'], true)."

		# Mapping of RADIUS dictionary attributes to LDAP

		# directory attributes.

		dictionary_mapping = ".$this->_items['dictionary_mapping']."

		#  Set password_attribute = nspmPassword to get the

		#  user's password from a Novell eDirectory

		#  backend. This will work ONLY IF FreeRADIUS has been

		#  built with the --with-edir configure option.

		#

		#  See also the following links:

		#

		#  http://www.novell.com/coolsolutions/appnote/16745.html

		#  https://secure-support.novell.com/KanisaPlatform/Publishing/558/3009668_f.SAL_Public.html

		#

		#  Novell may require TLS encrypted sessions before returning

		#  the user's password.

		#

		# password_attribute = userPassword

		".$this->_noComment("access_attr", $this->_items['access_attr'])."

		#  Un-comment the following to disable Novell

		#  eDirectory account policy check and intruder

		#  detection. This will work *only if* FreeRADIUS is

		#  configured to build with --with-edir option.

		#

		edir_account_policy_check = no

		".$this->_noComment("access_attr", $this->_items['access_attr'])."

		#

		#  Group membership checking.  Disabled by default.

		#

		# groupname_attribute = cn

		# groupmembership_filter = \"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))\"

		# groupmembership_attribute = radiusGroupName

		".$this->_noComment("groupname_attribute", $this->_items['groupname_attribute'])."

		".$this->_noComment("groupmembership_filter", $this->_items['groupmembership_filter'], true)."

		".$this->_noComment("groupmembership_attribute", $this->_items['groupmembership_attribute'])."

		# compare_check_items = yes

		# do_xlat = yes

		# access_attr_used_for_allow = yes

		".$this->_noComment("compare_check_items", $this->_items['compare_check_items'])."

		".$this->_noComment("do_xlat", $this->_items['do_xlat'])."

		".$this->_noComment("access_attr_used_for_allow", $this->_items['access_attr_used_for_allow'])."

		#

		#  By default, if the packet contains a User-Password,

		#  and no other module is configured to handle the

		#  authentication, the LDAP module sets itself to do

		#  LDAP bind for authentication.

		#

		#  THIS WILL ONLY WORK FOR PAP AUTHENTICATION.

		#

		#  THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP). 

		#

		#  You can disable this behavior by setting the following

		#  configuration entry to \"no\".

		#

		#  allowed values: {no, yes}

		# set_auth_type = yes

		# set_auth_type = no

		".$this->_noComment("set_auth_type", $this->_items['set_auth_type'])."

		#  ldap_debug: debug flag for LDAP SDK

		#  (see OpenLDAP documentation).  Set this to enable

		#  huge amounts of LDAP debugging on the screen.

		#  You should only use this if you are an LDAP expert.

		#

		#	default: 0x0000 (no debugging messages)

		#	Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS)

		#ldap_debug = 0x0028

		".$this->_noComment("ldap_debug", $this->_items['ldap_debug'])."

	}

	";

		if ($savefile !== null){

			// save config file

			if (is_file($savefile)){

				// save the file

				if (!is_writable($savefile))

					return false;

				$updatedFile = fopen( $savefile, 'w' );

				fwrite( $updatedFile, $config );

				fclose( $updatedFile );

			} else {

				// create a new file

				$newFile = fopen($savefile, 'w') or die("can't create file");

				fwrite( $newFile, $config );

				fclose( $newFile );

			}

		}	

		// test $returnconfig

		if (($returnconfig===true)||($returnconfig==="yes")){

			return $config;

		}else{

			return true;

		}

	}

}

?>