| | |
| | | // or |
| | | 'hosts' => array('directory.verisign.com'), |
| | | 'port' => 389, |
| | | 'use_tls' => true|false, |
| | | 'use_tls' => true|false, |
| | | 'ldap_version' => 3, // using LDAPv3 |
| | | 'auth_method' => '', // SASL authentication method (for proxy auth), e.g. DIGEST-MD5 |
| | | 'attributes' => array('dn'), // List of attributes to read from the server |
| | |
| | | /** |
| | | * Object constructor |
| | | * |
| | | * @param array $p LDAP connection properties |
| | | * @param boolean $debug Enables debug mode |
| | | * @param array $p LDAP connection properties |
| | | */ |
| | | function __construct($p, $debug = false) |
| | | function __construct($p) |
| | | { |
| | | $this->config = $p; |
| | | |
| | |
| | | |
| | | if (!is_array($p['hosts']) && !empty($p['host'])) |
| | | $this->config['hosts'] = array($p['host']); |
| | | |
| | | $this->debug = $debug; |
| | | } |
| | | |
| | | /** |
| | |
| | | $this->list_page = $page; |
| | | $this->page_size = $size; |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Establish a connection to the LDAP server |
| | |
| | | return true; |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Bind connection with (SASL-) user and password |
| | | * |
| | |
| | | return false; |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Bind connection with DN and password |
| | | * |
| | |
| | | return false; |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Close connection to LDAP server |
| | | */ |
| | |
| | | } |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Return the last result set |
| | | * |
| | |
| | | { |
| | | return $this->result; |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Get a specific LDAP entry, identified by its DN |
| | |
| | | return $rec; |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Execute the LDAP search based on the stored credentials |
| | | * |
| | |
| | | */ |
| | | public function search($base_dn, $filter = '', $scope = 'sub', $attrs = array('dn'), $prop = array(), $count_only = false) |
| | | { |
| | | if ($this->conn) { |
| | | if (empty($filter)) |
| | | $filter = $filter = '(objectclass=*)'; |
| | | if (!$this->conn) { |
| | | return false; |
| | | } |
| | | |
| | | $this->_debug("C: Search $base_dn for $filter"); |
| | | if (empty($filter)) { |
| | | $filter = '(objectclass=*)'; |
| | | } |
| | | |
| | | $function = self::scope2func($scope, $ns_function); |
| | | $this->_debug("C: Search $base_dn for $filter"); |
| | | |
| | | // find available VLV index for this query |
| | | if (!$count_only && ($vlv_sort = $this->_find_vlv($base_dn, $filter, $scope, $prop['sort']))) { |
| | | // when using VLV, we get the total count by... |
| | | // ...either reading numSubOrdinates attribute |
| | | if ($this->config['numsub_filter'] && ($result_count = @$ns_function($this->conn, $base_dn, $this->config['numsub_filter'], array('numSubOrdinates'), 0, 0, 0))) { |
| | | $counts = ldap_get_entries($this->conn, $result_count); |
| | | for ($vlv_count = $j = 0; $j < $counts['count']; $j++) |
| | | $vlv_count += $counts[$j]['numsubordinates'][0]; |
| | | $this->_debug("D: total numsubordinates = " . $vlv_count); |
| | | } |
| | | // ...or by fetching all records dn and count them |
| | | else if (!function_exists('ldap_parse_virtuallist_control')) { |
| | | $vlv_count = $this->search($base_dn, $filter, $scope, array('dn'), $prop, true); |
| | | } |
| | | $function = self::scope2func($scope, $ns_function); |
| | | |
| | | $this->vlv_active = $this->_vlv_set_controls($vlv_sort, $this->list_page, $this->page_size, $prop['search']); |
| | | } |
| | | else { |
| | | $this->vlv_active = false; |
| | | } |
| | | |
| | | // only fetch dn for count (should keep the payload low) |
| | | if ($ldap_result = @$function($this->conn, $base_dn, $filter, |
| | | $attrs, 0, (int)$this->config['sizelimit'], (int)$this->config['timelimit']) |
| | | // find available VLV index for this query |
| | | if (!$count_only && ($vlv_sort = $this->_find_vlv($base_dn, $filter, $scope, $prop['sort']))) { |
| | | // when using VLV, we get the total count by... |
| | | // ...either reading numSubOrdinates attribute |
| | | if (($sub_filter = $this->config['numsub_filter']) && |
| | | ($result_count = @$ns_function($this->conn, $base_dn, $sub_filter, array('numSubOrdinates'), 0, 0, 0)) |
| | | ) { |
| | | // when running on a patched PHP we can use the extended functions to retrieve the total count from the LDAP search result |
| | | if ($this->vlv_active && function_exists('ldap_parse_virtuallist_control')) { |
| | | if (ldap_parse_result($this->conn, $ldap_result, $errcode, $matcheddn, $errmsg, $referrals, $serverctrls)) { |
| | | ldap_parse_virtuallist_control($this->conn, $serverctrls, $last_offset, $vlv_count, $vresult); |
| | | $this->_debug("S: VLV result: last_offset=$last_offset; content_count=$vlv_count"); |
| | | } |
| | | else { |
| | | $this->_debug("S: ".($errmsg ? $errmsg : ldap_error($this->conn))); |
| | | } |
| | | } |
| | | else if ($this->debug) { |
| | | $this->_debug("S: ".ldap_count_entries($this->conn, $ldap_result)." record(s) found"); |
| | | } |
| | | |
| | | $this->result = new rcube_ldap_result($this->conn, $ldap_result, $base_dn, $filter, $vlv_count); |
| | | |
| | | return $count_only ? $this->result->count() : $this->result; |
| | | $counts = ldap_get_entries($this->conn, $result_count); |
| | | for ($vlv_count = $j = 0; $j < $counts['count']; $j++) |
| | | $vlv_count += $counts[$j]['numsubordinates'][0]; |
| | | $this->_debug("D: total numsubordinates = " . $vlv_count); |
| | | } |
| | | else { |
| | | $this->_debug("S: ".ldap_error($this->conn)); |
| | | // ...or by fetching all records dn and count them |
| | | else if (!function_exists('ldap_parse_virtuallist_control')) { |
| | | $vlv_count = $this->search($base_dn, $filter, $scope, array('dn'), $prop, true); |
| | | } |
| | | |
| | | $this->vlv_active = $this->_vlv_set_controls($vlv_sort, $this->list_page, $this->page_size, $prop['search']); |
| | | } |
| | | else { |
| | | $this->vlv_active = false; |
| | | } |
| | | |
| | | // only fetch dn for count (should keep the payload low) |
| | | if ($ldap_result = @$function($this->conn, $base_dn, $filter, |
| | | $attrs, 0, (int)$this->config['sizelimit'], (int)$this->config['timelimit']) |
| | | ) { |
| | | // when running on a patched PHP we can use the extended functions |
| | | // to retrieve the total count from the LDAP search result |
| | | if ($this->vlv_active && function_exists('ldap_parse_virtuallist_control')) { |
| | | if (ldap_parse_result($this->conn, $ldap_result, $errcode, $matcheddn, $errmsg, $referrals, $serverctrls)) { |
| | | ldap_parse_virtuallist_control($this->conn, $serverctrls, $last_offset, $vlv_count, $vresult); |
| | | $this->_debug("S: VLV result: last_offset=$last_offset; content_count=$vlv_count"); |
| | | } |
| | | else { |
| | | $this->_debug("S: ".($errmsg ? $errmsg : ldap_error($this->conn))); |
| | | } |
| | | } |
| | | else if ($this->debug) { |
| | | $this->_debug("S: ".ldap_count_entries($this->conn, $ldap_result)." record(s) found"); |
| | | } |
| | | |
| | | $this->result = new rcube_ldap_result($this->conn, $ldap_result, $base_dn, $filter, $vlv_count); |
| | | |
| | | return $count_only ? $this->result->count() : $this->result; |
| | | } |
| | | else { |
| | | $this->_debug("S: ".ldap_error($this->conn)); |
| | | } |
| | | |
| | | return false; |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Modify an LDAP entry on the server |
| | |
| | | return false; |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Choose the right PHP function according to scope property |
| | | * |
| | |
| | | |
| | | return $entries; |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Turn an LDAP entry into a regular PHP array with attributes as keys. |
| | | * |
| | |
| | | return true; |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Returns unified attribute name (resolving aliases) |
| | | */ |
| | |
| | | |
| | | return (isset($aliases[$name]) ? $aliases[$name] : $name) . $suffix; |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Quotes attribute value string |
| | |
| | | |
| | | return strtr($str, $replace); |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Prints debug info to the log |
| | |
| | | return false; |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Return VLV indexes and searches including necessary configuration |
| | | * details. |
| | |
| | | return $this->vlv_config; |
| | | } |
| | | |
| | | |
| | | /** |
| | | * Generate BER encoded string for Virtual List View option |
| | | * |
| | | * @param integer List offset (first record) |
| | | * @param integer Records per page |
| | | * |
| | | * @return string BER encoded option value |
| | | */ |
| | | private static function _vlv_ber_encode($offset, $rpp, $search = '') |
| | | { |
| | | # this string is ber-encoded, php will prefix this value with: |
| | | # 04 (octet string) and 10 (length of 16 bytes) |
| | | # the code behind this string is broken down as follows: |
| | | # 30 = ber sequence with a length of 0e (14) bytes following |
| | | # 02 = type integer (in two's complement form) with 2 bytes following (beforeCount): 01 00 (ie 0) |
| | | # 02 = type integer (in two's complement form) with 2 bytes following (afterCount): 01 18 (ie 25-1=24) |
| | | # a0 = type context-specific/constructed with a length of 06 (6) bytes following |
| | | # 02 = type integer with 2 bytes following (offset): 01 01 (ie 1) |
| | | # 02 = type integer with 2 bytes following (contentCount): 01 00 |
| | | |
| | | # whith a search string present: |
| | | # 81 = type context-specific/constructed with a length of 04 (4) bytes following (the length will change here) |
| | | # 81 indicates a user string is present where as a a0 indicates just a offset search |
| | | # 81 = type context-specific/constructed with a length of 06 (6) bytes following |
| | | |
| | | # the following info was taken from the ISO/IEC 8825-1:2003 x.690 standard re: the |
| | | # encoding of integer values (note: these values are in |
| | | # two-complement form so since offset will never be negative bit 8 of the |
| | | # leftmost octet should never by set to 1): |
| | | # 8.3.2: If the contents octets of an integer value encoding consist |
| | | # of more than one octet, then the bits of the first octet (rightmost) and bit 8 |
| | | # of the second (to the left of first octet) octet: |
| | | # a) shall not all be ones; and |
| | | # b) shall not all be zero |
| | | |
| | | if ($search) |
| | | { |
| | | /* |
| | | this string is ber-encoded, php will prefix this value with: |
| | | 04 (octet string) and 10 (length of 16 bytes) |
| | | the code behind this string is broken down as follows: |
| | | 30 = ber sequence with a length of 0e (14) bytes following |
| | | 02 = type integer (in two's complement form) with 2 bytes following (beforeCount): 01 00 (ie 0) |
| | | 02 = type integer (in two's complement form) with 2 bytes following (afterCount): 01 18 (ie 25-1=24) |
| | | a0 = type context-specific/constructed with a length of 06 (6) bytes following |
| | | 02 = type integer with 2 bytes following (offset): 01 01 (ie 1) |
| | | 02 = type integer with 2 bytes following (contentCount): 01 00 |
| | | |
| | | with a search string present: |
| | | 81 = type context-specific/constructed with a length of 04 (4) bytes following (the length will change here) |
| | | 81 indicates a user string is present where as a a0 indicates just a offset search |
| | | 81 = type context-specific/constructed with a length of 06 (6) bytes following |
| | | |
| | | The following info was taken from the ISO/IEC 8825-1:2003 x.690 standard re: the |
| | | encoding of integer values (note: these values are in |
| | | two-complement form so since offset will never be negative bit 8 of the |
| | | leftmost octet should never by set to 1): |
| | | 8.3.2: If the contents octets of an integer value encoding consist |
| | | of more than one octet, then the bits of the first octet (rightmost) |
| | | and bit 8 of the second (to the left of first octet) octet: |
| | | a) shall not all be ones; and |
| | | b) shall not all be zero |
| | | */ |
| | | |
| | | if ($search) { |
| | | $search = preg_replace('/[^-[:alpha:] ,.()0-9]+/', '', $search); |
| | | $ber_val = self::_string2hex($search); |
| | | $str = self::_ber_addseq($ber_val, '81'); |
| | | } |
| | | else |
| | | { |
| | | # construct the string from right to left |
| | | else { |
| | | // construct the string from right to left |
| | | $str = "020100"; # contentCount |
| | | |
| | | $ber_val = self::_ber_encode_int($offset); // returns encoded integer value in hex format |
| | |
| | | // now compute length over $str |
| | | $str = self::_ber_addseq($str, 'a0'); |
| | | } |
| | | |
| | | |
| | | // now tack on records per page |
| | | $str = "020100" . self::_ber_addseq(self::_ber_encode_int($rpp-1), '02') . $str; |
| | | |
| | |
| | | |
| | | return pack('H'.strlen($str), $str); |
| | | } |
| | | |
| | | |
| | | /** |
| | | * create ber encoding for sort control |
| | |
| | | foreach (array_reverse((array)$sortcols) as $col) { |
| | | $ber_val = self::_string2hex($col); |
| | | |
| | | # 30 = ber sequence with a length of octet value |
| | | # 04 = octet string with a length of the ascii value |
| | | // 30 = ber sequence with a length of octet value |
| | | // 04 = octet string with a length of the ascii value |
| | | $oct = self::_ber_addseq($ber_val, '04'); |
| | | $str = self::_ber_addseq($oct, '30') . $str; |
| | | } |
| | |
| | | private static function _string2hex($str) |
| | | { |
| | | $hex = ''; |
| | | for ($i=0; $i < strlen($str); $i++) |
| | | for ($i=0; $i < strlen($str); $i++) { |
| | | $hex .= dechex(ord($str[$i])); |
| | | } |
| | | return $hex; |
| | | } |
| | | |