holm/egroupware
1
1
Fork 0
forked from extern/egroupware
Code Issues Pull Requests Packages Projects Releases Wiki Activity

reworked auth classes, to allow them to use each other and a new auth class using a primary backend (ldap) and a fallback (sql)

Browse Source
This commit is contained in:
Ralf Becker 2010-01-28 04:22:37 +00:00
parent 30e13c4acf
commit 61d26df913
12 changed files with 610 additions and 405 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

75
phpgwapi/inc/class.auth.inc.php
View File

@ -3,6 +3,7 @@
* eGroupWare API - Authentication baseclass
*
* @link http://www.egroupware.org
* @author Ralf Becker <ralfbecker@outdoor-training.de>
* @author Miles Lott <milos@groupwhere.org>
* @copyright 2004 by Miles Lott <milos@groupwhere.org>
* @license http://opensource.org/licenses/lgpl-license.php LGPL - GNU Lesser General Public License
@ -22,7 +23,6 @@ if(empty($GLOBALS['egw_info']['server']['auth_type']))
$GLOBALS['egw_info']['server']['auth_type'] = 'sql';
}
//error_log('using auth_type='.$GLOBALS['egw_info']['server']['auth_type'].', currentapp='.$GLOBALS['egw_info']['flags']['currentapp']);
include(EGW_API_INC.'/class.auth_'.$GLOBALS['egw_info']['server']['auth_type'].'.inc.php');
/**
* eGroupWare API - Authentication baseclass, password auth and crypt functions
@ -32,10 +32,55 @@ include(EGW_API_INC.'/class.auth_'.$GLOBALS['egw_info']['server']['auth_type'].'
*
* Other functions from class.common.inc.php originally from phpGroupWare
*/
class auth extends auth_
class auth
{
static $error;
/**
* Holds instance of backend
*
* @var auth_backend
*/
private $backend;
function __construct()
{
$backend_class = 'auth_'.$GLOBALS['egw_info']['server']['auth_type'];
$this->backend = new $backend_class;
if (!is_a($this->backend,'auth_backend'))
{
throw new egw_exception_assertion_failed("Auth backend class $backend_class is NO auth_backend!");
}
}
/**
* password authentication against password stored in sql datababse
*
* @param string $username username of account to authenticate
* @param string $passwd corresponding password
* @param string $passwd_type='text' 'text' for cleartext passwords (default)
* @return boolean true if successful authenticated, false otherwise
*/
function authenticate($username, $passwd, $passwd_type='text')
{
return $this->backend->authenticate($username, $passwd, $passwd_type);
}
/**
* changes password in sql datababse
*
* @param string $old_passwd must be cleartext
* @param string $new_passwd must be cleartext
* @param int $account_id account id of user whose passwd should be changed
* @return boolean true if password successful changed, false otherwise
*/
function change_password($old_passwd, $new_passwd, $account_id=0)
{
return $this->backend->change_password($old_passwd, $new_passwd, $account_id);
}
/**
* return a random string of size $size
*
@ -471,3 +516,29 @@ class auth extends auth_
return strcmp($md5_hmac,$db_val) == 0;
}
}
/**
* Interface for authentication backend
*/
interface auth_backend
{
/**
* password authentication against password stored in sql datababse
*
* @param string $username username of account to authenticate
* @param string $passwd corresponding password
* @param string $passwd_type='text' 'text' for cleartext passwords (default)
* @return boolean true if successful authenticated, false otherwise
*/
function authenticate($username, $passwd, $passwd_type='text');
/**
* changes password in sql datababse
*
* @param string $old_passwd must be cleartext
* @param string $new_passwd must be cleartext
* @param int $account_id account id of user whose passwd should be changed
* @return boolean true if password successful changed, false otherwise
*/
function change_password($old_passwd, $new_passwd, $account_id=0);
}

63
phpgwapi/inc/class.auth_ads.inc.php
View File

@ -1,35 +1,35 @@
<?php
/**************************************************************************\
* eGroupWare API - Auth from LDAP *
* This file written by Lars Kneschke <lkneschke@linux-at-work.de> *
* and Joseph Engo <jengo@phpgroupware.org> *
* Authentication based on LDAP Server *
* Copyright (C) 2000, 2001 Joseph Engo *
* Copyright (C) 2002, 2003 Lars Kneschke *
* ------------------------------------------------------------------------ *
* This library is part of the eGroupWare API *
* http://www.egroupware.org/api *
* ------------------------------------------------------------------------ *
* This library is free software; you can redistribute it and/or modify it *
* under the terms of the GNU Lesser General Public License as published by *
* the Free Software Foundation; either version 2.1 of the License, *
* or any later version. *
* This library is distributed in the hope that it will be useful, but *
* WITHOUT ANY WARRANTY; without even the implied warranty of *
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. *
* See the GNU Lesser General Public License for more details. *
* You should have received a copy of the GNU Lesser General Public License *
* along with this library; if not, write to the Free Software Foundation, *
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
\**************************************************************************/
/**
* eGroupWare API - ADS Authentication
*
* @link http://www.egroupware.org
* @author Ralf Becker <ralfbecker@outdoor-training.de> based on auth_ldap from:
* @author Lars Kneschke <lkneschke@linux-at-work.de>
* @author Joseph Engo <jengo@phpgroupware.org>
* Copyright (C) 2000, 2001 Joseph Engo
* Copyright (C) 2002, 2003 Lars Kneschke
* @license http://opensource.org/licenses/lgpl-license.php LGPL - GNU Lesser General Public License
* @package api
* @subpackage authentication
* @version $Id$
*/
/* $Id$ */
class auth_
{
/**
* Authentication agains a ADS Server
*/
class auth_ads implements auth_backend
{
var $previous_login = -1;
function authenticate($username, $passwd)
/**
* password authentication
*
* @param string $username username of account to authenticate
* @param string $passwd corresponding password
* @param string $passwd_type='text' 'text' for cleartext passwords (default)
* @return boolean true if successful authenticated, false otherwise
*/
function authenticate($username, $passwd, $passwd_type='text')
{
if (preg_match('/[()|&=*,<>!~]/',$username))
{
@ -95,7 +95,7 @@
) as $ldap_name => $acct_name)
{
$GLOBALS['auto_create_acct'][$acct_name] =
$GLOBALS['egw']->translation->convert($allValues[0][$ldap_name][0],'utf-8');
translation::convert($allValues[0][$ldap_name][0],'utf-8');
}
return True;
}
@ -104,9 +104,8 @@
return False;
}
function change_password($old_passwd, $new_passwd, $_account_id='')
function change_password($old_passwd, $new_passwd, $_account_id=0)
{
return false; // Cant change passwd in ADS
}
}
?>
}

7
phpgwapi/inc/class.auth_cas.inc.php
View File

@ -12,7 +12,7 @@
/**
* eGroupWare API - Authentication based on CAS (Central Authetication Service)
*/
class auth_
class auth_cas implements auth_backend
{
var $previous_login = -1;
@ -21,9 +21,10 @@ class auth_
*
* @param string $username username of account to authenticate
* @param string $passwd corresponding password
* @param string $passwd_type='text' 'text' for cleartext passwords (default)
* @return boolean true if successful authenticated, false otherwise
*/
function authenticate($username, $passwd)
function authenticate($username, $passwd, $passwd_type='text')
{
/* if program goes here, authenticate is, normaly, already verified by CAS */
if ($GLOBALS['egw_info']['server']['account_repository'] != 'ldap' &&
@ -56,7 +57,7 @@ class auth_
*
* @param string $old_passwd must be cleartext or empty to not to be checked
* @param string $new_passwd must be cleartext
* @param int $account_id account id of user whose passwd should be changed
* @param int $account_id=0 account id of user whose passwd should be changed
* @return boolean true if password successful changed, false otherwise
*/
function change_password($old_passwd, $new_passwd, $account_id=0)

85
phpgwapi/inc/class.auth_fallback.inc.php Normal file
View File

@ -0,0 +1,85 @@
<?php
/**
* eGroupWare API - LDAP Authentication with fallback to SQL
*
* @link http://www.egroupware.org
* @author Ralf Becker <ralfbecker@outdoor-training.de>
* @license http://opensource.org/licenses/lgpl-license.php LGPL - GNU Lesser General Public License
* @package api
* @subpackage authentication
* @version $Id$
*/
/**
* Authentication agains a LDAP Server with fallback to SQL
*
* For other fallback types, simply change auth backends in constructor call
*/
class auth_fallback implements auth_backend
{
/**
* Primary auth backend
*
* @var auth_backend
*/
private $primary_backend;
/**
* Fallback auth backend
*
* @var auth_backend
*/
private $fallback_backend;
/**
* Constructor
*/
function __construct($primary='auth_ldap',$fallback='auth_sql')
{
$this->primary_backend = new $primary;
$this->fallback_backend = new $fallback;
}
/**
* authentication against LDAP with fallback to SQL
*
* @param string $username username of account to authenticate
* @param string $passwd corresponding password
* @return boolean true if successful authenticated, false otherwise
*/
function authenticate($username, $passwd, $passwd_type='text')
{
if ($this->primary_backend->authenticate($username, $passwd, $passwd_type))
{
egw_cache::setSession(__CLASS__,'backend_used','primary');
return true;
}
if ($this->fallback_backend->authenticate($username,$passwd, $passwd_type))
{
egw_cache::setSession(__CLASS__,'backend_used','fallback');
return true;
}
return false;
}
/**
* changes password in LDAP
*
* If $old_passwd is given, the password change is done binded as user and NOT with the
* "root" dn given in the configurations.
*
* @param string $old_passwd must be cleartext or empty to not to be checked
* @param string $new_passwd must be cleartext
* @param int $account_id account id of user whose passwd should be changed
* @return boolean true if password successful changed, false otherwise
*/
function change_password($old_passwd, $new_passwd, $account_id=0)
{
if (egw_cache::getSession(__CLASS__,'backend_used') == 'primary')
{
return $this->primary_backend->change_password($old_passwd, $new_passwd, $account_id);
}
return $this->fallback_backend->change_password($old_passwd, $new_passwd, $account_id);
}
}

65
phpgwapi/inc/class.auth_http.inc.php
View File

@ -1,34 +1,33 @@
<?php
/**************************************************************************\
* eGroupWare API - Auth from HTTP *
* This file written by Dan Kuykendall <seek3r@phpgroupware.org> *
* and Joseph Engo <jengo@phpgroupware.org> *
* Authentication based on HTTP auth *
* Copyright (C) 2000, 2001 Dan Kuykendall *
* ------------------------------------------------------------------------ *
* This library is part of the eGroupWare API *
* http://www.egroupware.org/api *
* ------------------------------------------------------------------------ *
* This library is free software; you can redistribute it and/or modify it *
* under the terms of the GNU Lesser General Public License as published by *
* the Free Software Foundation; either version 2.1 of the License, *
* or any later version. *
* This library is distributed in the hope that it will be useful, but *
* WITHOUT ANY WARRANTY; without even the implied warranty of *
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. *
* See the GNU Lesser General Public License for more details. *
* You should have received a copy of the GNU Lesser General Public License *
* along with this library; if not, write to the Free Software Foundation, *
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
\**************************************************************************/
/**
* eGroupWare API - Authentication based on HTTP auth
*
* @link http://www.egroupware.org
* @author Dan Kuykendall <seek3r@phpgroupware.org>
* @author Joseph Engo <jengo@phpgroupware.org>
* Copyright (C) 2000, 2001 Dan Kuykendall
* @license http://opensource.org/licenses/lgpl-license.php LGPL - GNU Lesser General Public License
* @package api
* @subpackage authentication
* @version $Id$
*/
/* $Id$ */
class auth_
{
/**
* Authentication based on HTTP auth
*/
class auth_http implements auth_backend
{
var $previous_login = -1;
function authenticate($username, $passwd)
/**
* password authentication
*
* @param string $username username of account to authenticate
* @param string $passwd corresponding password
* @param string $passwd_type='text' 'text' for cleartext passwords (default)
* @return boolean true if successful authenticated, false otherwise
*/
function authenticate($username, $passwd, $passwd_type='text')
{
if (isset($_SERVER['PHP_AUTH_USER']))
{
@ -40,8 +39,16 @@
}
}
function change_password($old_passwd, $new_passwd)
/**
* changes password
*
* @param string $old_passwd must be cleartext or empty to not to be checked
* @param string $new_passwd must be cleartext
* @param int $account_id account id of user whose passwd should be changed
* @return boolean true if password successful changed, false otherwise
*/
function change_password($old_passwd, $new_passwd, $account_id=0)
{
return False;
}
}
}

21
phpgwapi/inc/class.auth_ldap.inc.php
View File

@ -3,6 +3,7 @@
* eGroupWare API - LDAP Authentication
*
* @link http://www.egroupware.org
* @author Ralf Becker <ralfbecker@outdoor-training.de>
* @author Lars Kneschke <lkneschke@linux-at-work.de>
* @author Joseph Engo <jengo@phpgroupware.org>
* Copyright (C) 2000, 2001 Joseph Engo
@ -16,7 +17,7 @@
/**
* Authentication agains a LDAP Server
*/
class auth_
class auth_ldap implements auth_backend
{
var $previous_login = -1;
@ -27,13 +28,13 @@ class auth_
* @param string $passwd corresponding password
* @return boolean true if successful authenticated, false otherwise
*/
function authenticate($username, $passwd)
function authenticate($username, $passwd, $passwd_type='text')
{
// allow non-ascii in username & password
$username = $GLOBALS['egw']->translation->convert($username,$GLOBALS['egw']->translation->charset(),'utf-8');
$passwd = $GLOBALS['egw']->translation->convert($passwd,$GLOBALS['egw']->translation->charset(),'utf-8');
$username = translation::convert($username,translation::charset(),'utf-8');
$passwd = translation::convert($passwd,translation::charset(),'utf-8');
if(!$ldap = $GLOBALS['egw']->common->ldapConnect())
if(!$ldap = common::ldapConnect())
{
$GLOBALS['egw']->log->message('F-Abort, Failed connecting to LDAP server for authenication, execution stopped');
$GLOBALS['egw']->log->commit();
@ -90,7 +91,7 @@ class auth_
) as $ldap_name => $acct_name)
{
$GLOBALS['auto_create_acct'][$acct_name] =
$GLOBALS['egw']->translation->convert($allValues[0][$ldap_name][0],'utf-8');
translation::convert($allValues[0][$ldap_name][0],'utf-8');
}
return True;
}
@ -123,15 +124,15 @@ class auth_
}
else
{
$username = $GLOBALS['egw']->translation->convert($GLOBALS['egw']->accounts->id2name($account_id),
$GLOBALS['egw']->translation->charset(),'utf-8');
$username = translation::convert($GLOBALS['egw']->accounts->id2name($account_id),
translation::charset(),'utf-8');
}
//echo "<p>auth_ldap::change_password('$old_password','$new_passwd',$account_id) username='$username'</p>\n";
$filter = $GLOBALS['egw_info']['server']['ldap_search_filter'] ? $GLOBALS['egw_info']['server']['ldap_search_filter'] : '(uid=%user)';
$filter = str_replace(array('%user','%domain'),array($username,$GLOBALS['egw_info']['user']['domain']),$filter);
$ds = $GLOBALS['egw']->common->ldapConnect();
$ds = common::ldapConnect();
$sri = ldap_search($ds, $GLOBALS['egw_info']['server']['ldap_context'], $filter);
$allValues = ldap_get_entries($ds, $sri);
@ -142,7 +143,7 @@ class auth_
if($old_passwd) // if old password given (not called by admin) --> bind as that user to change the pw
{
$ds = $GLOBALS['egw']->common->ldapConnect('',$dn,$old_passwd);
$ds = common::ldapConnect('',$dn,$old_passwd);
}
if (!@ldap_modify($ds, $dn, $entry))
{

63
phpgwapi/inc/class.auth_mail.inc.php
View File

@ -1,33 +1,32 @@
<?php
/**************************************************************************\
* eGroupWare API - Auth from Mail server *
* This file written by Dan Kuykendall <seek3r@phpgroupware.org> *
* Authentication based on mail server *
* Copyright (C) 2000, 2001 Dan Kuykendall *
* ------------------------------------------------------------------------ *
* This library is part of the eGroupWare API *
* http://www.egroupware.org/api *
* ------------------------------------------------------------------------ *
* This library is free software; you can redistribute it and/or modify it *
* under the terms of the GNU Lesser General Public License as published by *
* the Free Software Foundation; either version 2.1 of the License, *
* or any later version. *
* This library is distributed in the hope that it will be useful, but *
* WITHOUT ANY WARRANTY; without even the implied warranty of *
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. *
* See the GNU Lesser General Public License for more details. *
* You should have received a copy of the GNU Lesser General Public License *
* along with this library; if not, write to the Free Software Foundation, *
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
\**************************************************************************/
/**
* eGroupWare API - Authentication agains mail server
*
* @link http://www.egroupware.org
* @author Dan Kuykendall <seek3r@phpgroupware.org>
* Copyright (C) 2000, 2001 Dan Kuykendall
* @license http://opensource.org/licenses/lgpl-license.php LGPL - GNU Lesser General Public License
* @package api
* @subpackage authentication
* @version $Id$
*/
/* $Id$ */
class auth_
{
/**
* Authentication agains mail server
*/
class auth_mail implements auth_backend
{
var $previous_login = -1;
function authenticate($username, $passwd)
/**
* password authentication
*
* @param string $username username of account to authenticate
* @param string $passwd corresponding password
* @param string $passwd_type='text' 'text' for cleartext passwords (default)
* @return boolean true if successful authenticated, false otherwise
*/
function authenticate($username, $passwd, $passwd_type='text')
{
$notls = '/notls';
if ($GLOBALS['egw_info']['server']['mail_login_type'] == 'vmailmgr')
@ -85,8 +84,16 @@
return True;
}
function change_password($old_passwd, $new_passwd)
/**
* changes password
*
* @param string $old_passwd must be cleartext or empty to not to be checked
* @param string $new_passwd must be cleartext
* @param int $account_id=0 account id of user whose passwd should be changed
* @return boolean true if password successful changed, false otherwise
*/
function change_password($old_passwd, $new_passwd, $account_id=0)
{
return False;
}
}
}

63
phpgwapi/inc/class.auth_nis.inc.php
View File

@ -1,31 +1,30 @@
<?php
/**************************************************************************\
* eGroupWare API - Auth from NIS *
* Authentication based on NIS maps *
* by Dylan Adams <dadams@jhu.edu> *
* Copyright (C) 2001 Dylan Adams *
* ------------------------------------------------------------------------ *
* This library is part of the eGroupWare API *
* http://www.egroupware.org/api *
* ------------------------------------------------------------------------ *
* This library is free software; you can redistribute it and/or modify it *
* under the terms of the GNU Lesser General Public License as published by *
* the Free Software Foundation; either version 2.1 of the License, *
* or any later version. *
* This library is distributed in the hope that it will be useful, but *
* WITHOUT ANY WARRANTY; without even the implied warranty of *
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. *
* See the GNU Lesser General Public License for more details. *
* You should have received a copy of the GNU Lesser General Public License *
* along with this library; if not, write to the Free Software Foundation, *
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
\**************************************************************************/
/**
* eGroupWare API - Auth from NIS
*
* @link http://www.egroupware.org
* @author * by Dylan Adams <dadams@jhu.edu>
* Copyright (C) 2001 Dylan Adams
* @license http://opensource.org/licenses/lgpl-license.php LGPL - GNU Lesser General Public License
* @package api
* @subpackage authentication
* @version $Id$
*/
/* $Id$ */
class auth_
{
function authenticate($username, $passwd)
/**
* Auth from NIS
*/
class auth_nis implements auth_backend
{
/**
* password authentication
*
* @param string $username username of account to authenticate
* @param string $passwd corresponding password
* @param string $passwd_type='text' 'text' for cleartext passwords (default)
* @return boolean true if successful authenticated, false otherwise
*/
function authenticate($username, $passwd, $passwd_type='text')
{
$domain = yp_get_default_domain();
if(!empty($GLOBALS['egw_info']['server']['nis_domain']))
@ -52,9 +51,17 @@
return($encrypted_passwd == $stored_passwd);
}
function change_password($old_passwd, $new_passwd, $account_id='')
/**
* changes password
*
* @param string $old_passwd must be cleartext or empty to not to be checked
* @param string $new_passwd must be cleartext
* @param int $account_id=0 account id of user whose passwd should be changed
* @return boolean true if password successful changed, false otherwise
*/
function change_password($old_passwd, $new_passwd, $account_id=0)
{
// can't change passwords unless server runs as root (bad idea)
return( False );
}
}
}

60
phpgwapi/inc/class.auth_pam.inc.php
View File

@ -1,28 +1,30 @@
<?php
/**************************************************************************\
* eGroupWare API - Auth from PAM *
* ------------------------------------------------------------------------ *
* This library is part of the eGroupWare API *
* http://www.egroupware.org/api *
* ------------------------------------------------------------------------ *
* This library is free software; you can redistribute it and/or modify it *
* under the terms of the GNU Lesser General Public License as published by *
* the Free Software Foundation; either version 2.1 of the License, *
* or any later version. *
* This library is distributed in the hope that it will be useful, but *
* WITHOUT ANY WARRANTY; without even the implied warranty of *
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. *
* See the GNU Lesser General Public License for more details. *
* You should have received a copy of the GNU Lesser General Public License *
* along with this library; if not, write to the Free Software Foundation, *
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
\**************************************************************************/
/**
* eGroupWare API - Auth from PAM
*
* @link http://www.egroupware.org
* @license http://opensource.org/licenses/lgpl-license.php LGPL - GNU Lesser General Public License
* @package api
* @subpackage authentication
* @version $Id$
*/
/* $Id$ */
class auth_
{
function authenticate($username, $passwd)
/**
* Auth from PAM
*
* Requires php_pam extension!
*/
class auth_pam implements auth_backend
{
/**
* password authentication
*
* @param string $username username of account to authenticate
* @param string $passwd corresponding password
* @param string $passwd_type='text' 'text' for cleartext passwords (default)
* @return boolean true if successful authenticated, false otherwise
*/
function authenticate($username, $passwd, $passwd_type='text')
{
if (pam_auth($username, get_magic_quotes_gpc() ? stripslashes($passwd) : $passwd, &$error))
{
@ -31,9 +33,17 @@
return False;
}
function change_password($old_passwd, $new_passwd, $account_id='')
/**
* changes password
*
* @param string $old_passwd must be cleartext or empty to not to be checked
* @param string $new_passwd must be cleartext
* @param int $account_id=0 account id of user whose passwd should be changed
* @return boolean true if password successful changed, false otherwise
*/
function change_password($old_passwd, $new_passwd, $account_id=0)
{
// deny password changes.
return False;
}
}
}

7
phpgwapi/inc/class.auth_sql.inc.php
View File

@ -3,6 +3,7 @@
* eGroupWare API - Authentication from SQL
*
* @link http://www.egroupware.org
* @author Ralf Becker <ralfbecker@outdoor-training.de>
* @author Dan Kuykendall <seek3r@phpgroupware.org>
* @author Joseph Engo <jengo@phpgroupware.org>
* Copyright (C) 2000, 2001 Dan Kuykendall
@ -20,7 +21,7 @@
*
* Massive code cleanup and added password migration by Cornelius Weiss <egw@von-und-zu-weiss.de
*/
class auth_
class auth_sql implements auth_backend
{
/**
* Reference to the global db object
@ -31,7 +32,7 @@ class auth_
var $table = 'egw_accounts';
var $previous_login = -1;
function auth_()
function __construct()
{
$this->db = $GLOBALS['egw']->db;
@ -141,7 +142,7 @@ class auth_
}
// old password ok, or admin called the function from the admin application (no old passwd available).
return $this->_update_passwd($this->encrypt_sql($new_passwd),$new_passwd,$account_id,$admin);
return $this->_update_passwd(auth::encrypt_sql($new_passwd),$new_passwd,$account_id,$admin);
}
/**

83
phpgwapi/inc/class.auth_sqlssl.inc.php
View File

@ -1,41 +1,46 @@
<?php
/**************************************************************************\
* eGroupWare API - Auth from SQL, with optional SSL authentication *
* This file written by Andreas 'Count' Kotes <count@flatline.de> *
* Authentication based on SQL table and X.509 certificates *
* Copyright (C) 2000, 2001 Dan Kuykendall *
* ------------------------------------------------------------------------ *
* This library is part of the eGroupWare API *
* http://www.egroupware.org/api *
* ------------------------------------------------------------------------ *
* This library is free software; you can redistribute it and/or modify it *
* under the terms of the GNU Lesser General Public License as published by *
* the Free Software Foundation; either version 2.1 of the License, *
* or any later version. *
* This library is distributed in the hope that it will be useful, but *
* WITHOUT ANY WARRANTY; without even the implied warranty of *
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. *
* See the GNU Lesser General Public License for more details. *
* You should have received a copy of the GNU Lesser General Public License *
* along with this library; if not, write to the Free Software Foundation, *
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
\**************************************************************************/
/**
* eGroupWare API - Authentication based on SQL table and X.509 certificates
*
* @link http://www.egroupware.org
* @author Andreas 'Count' Kotes <count@flatline.de>
* @license http://opensource.org/licenses/lgpl-license.php LGPL - GNU Lesser General Public License
* @package api
* @subpackage authentication
* @version $Id$
*/
/* $Id$ */
class auth_
{
var $db = '';
/**
* Authentication based on SQL table and X.509 certificates
*
* @todo rewrite using auth_sql backend class
*/
class auth_sqlssl implements auth_backend
{
/**
* @var egw_db
*/
var $db;
var $table = 'egw_accounts';
var $previous_login = -1;
function auth_()
/**
* Constructor
*/
function __construct()
{
$this->db = clone($GLOBALS['egw']->db);
$this->db->set_app('phpgwapi');
$this->table = 'egw_accounts';
$this->db = $GLOBALS['egw']->db;
}
function authenticate($username, $passwd)
/**
* password authentication
*
* @param string $username username of account to authenticate
* @param string $passwd corresponding password
* @param string $passwd_type='text' 'text' for cleartext passwords (default)
* @return boolean true if successful authenticated, false otherwise
*/
function authenticate($username, $passwd, $passwd_type='text')
{
$local_debug = False;
@ -60,19 +65,27 @@
if(!isset($_SERVER['SSL_CLIENT_S_DN']))
{
# if we're not doing SSL authentication, behave like auth_sql
return $this->compare_password($passwd,$this->db->f('account_pwd'),$this->type,strtolower($username));
return auth::compare_password($passwd,$this->db->f('account_pwd'),$this->type,strtolower($username));
}
return True;
}
function change_password($old_passwd, $new_passwd, $account_id = '')
/**
* changes password
*
* @param string $old_passwd must be cleartext or empty to not to be checked
* @param string $new_passwd must be cleartext
* @param int $account_id=0 account id of user whose passwd should be changed
* @return boolean true if password successful changed, false otherwise
*/
function change_password($old_passwd, $new_passwd, $account_id = 0)
{
if(!$account_id)
{
$account_id = $GLOBALS['egw_info']['user']['account_id'];
}
$encrypted_passwd = $this->encrypt_sql($new_passwd);
$encrypted_passwd = auth::encrypt_sql($new_passwd);
$GLOBALS['egw']->db->update($this->table,array(
'account_pwd' => $encrypted_passwd,
@ -85,4 +98,4 @@
return $encrypted_passwd;
}
}
}

3
setup/templates/default/config.tpl
View File

@ -218,6 +218,7 @@
<option value="nis"{selected_auth_type_nis}>NIS</option>
<option value="pam"{selected_auth_type_pam}>PAM</option>
<option value="cas"{selected_auth_type_cas}>CAS</option>
<option value="fallback"{selected_auth_type_fallback}>Fallback LDAP -> SQL</option>
</select>
</td>
</tr>
@ -235,6 +236,7 @@
<option value="http"{selected_auth_type_syncml_http}>HTTP</option>
<option value="nis"{selected_auth_type_syncml_nis}>NIS</option>
<option value="pam"{selected_auth_type_syncml_pam}>PAM</option>
<option value="fallback"{selected_auth_type_fallback}>Fallback LDAP -> SQL</option>
</select>
</td>
</tr>
@ -252,6 +254,7 @@
<option value="http"{selected_auth_type_groupdav_http}>HTTP</option>
<option value="nis"{selected_auth_type_groupdav_nis}>NIS</option>
<option value="pam"{selected_auth_type_groupdav_pam}>PAM</option>
<option value="fallback"{selected_auth_type_fallback}>Fallback LDAP -> SQL</option>
</select>
</td>
</tr>