ston1th/kopano-webapp-passwd
1
0
Fork 0
mirror of https://github.com/dducret/kopano-webapp-passwd synced 2026-08-06 15:33:14 +02:00
Code Releases Activity

Samba AD update

Browse source
This commit is contained in:
Matthias Fulz 2021-06-10 15:20:01 +02:00
commit b1322106ee
2 changed files with 366 additions and 303 deletions
Download patch file Download diff file Expand all files Collapse all files

6
config.php
View file

@ -23,4 +23,10 @@ define('PLUGIN_PASSWD_LDAP_BIND_PW', "");
/** Set to true if you login with username@tenantname **/
define('PLUGIN_PASSWD_LOGIN_WITH_TENANT', false);
/** Set to user login attribute **/
define('PLUGIN_PASSWD_LDAP_USER_LOGIN_ATTR', 'sAMAccountName');
/** Ldap filter used to search valid users **/
define('PLUGIN_PASSWD_LDAP_FILTER', "(objectClass=person)");
?>

85
php/class.passwdmodule.php
View file

@ -3,6 +3,7 @@
* Passwd module.
* Module that will be used to change passwords of the user
*/
class PasswdModule extends Module
{
/**
@ -109,12 +110,14 @@ class PasswdModule extends Module
// now bind to the ldap server to search the user dn
ldap_bind($ldapconn, PLUGIN_PASSWD_LDAP_BIND_DN, PLUGIN_PASSWD_LDAP_BIND_PW);
// set ldapfilter
$ldap_filter = "(&(" . PLUGIN_PASSWD_LDAP_USER_LOGIN_ATTR . "=" . $uid . ")" . PLUGIN_PASSWD_LDAP_FILTER . ")";
// search for the user dn that will be used to do login into LDAP
$userdn = ldap_search (
$ldapconn, // connection-identify
PLUGIN_PASSWD_LDAP_BASEDN, // basedn
'uid=' . $uid, // search filter
array('dn', 'objectClass') // needed attributes. we need dn and objectclass
$ldap_filter
);
if ($userdn) {
@ -128,17 +131,12 @@ class PasswdModule extends Module
if(ldap_errno($ldapconn) === 0) {
$passwd = $data['new_password'];
$oldpass = $data['current_password'];
if ($this->checkPasswordStrenth($passwd)) {
$password_hash = $this->sshaEncode($passwd);
$entry = array('userPassword' => $password_hash);
if (in_array('sambaSamAccount', $entries[0]['objectclass'])) {
$nthash = strtoupper(bin2hex(mhash(MHASH_MD4, iconv("UTF-8","UTF-16LE", $passwd))));
$entry['sambaNTPassword'] = $nthash;
$entry['sambaPwdLastSet'] = strval(time());
}
ldap_modify($ldapconn, $userdn, $entry);
if (ldap_errno($ldapconn) === 0) {
$msg = $this->change_password($ldapconn, $userdn, $passwd, $oldpass);
if ($msg === "passwordchanged") {
// password changed successfully
// write new password to session because we don't want user to re-authenticate
@ -164,7 +162,7 @@ class PasswdModule extends Module
)
));
} else {
$errorMessage = dgettext("plugin_passwd", 'Password is not changed.');
$errorMessage = dgettext("plugin_passwd", 'Password is not changed. Error: ' . $msg);
}
} else {
$errorMessage = dgettext("plugin_passwd", 'Password is weak. Password should contain capital, non-capital letters and numbers. Password should have 8 to 20 characters.');
@ -172,7 +170,6 @@ class PasswdModule extends Module
} else {
$errorMessage = dgettext("plugin_passwd", 'Current password does not match.');
}
// release ldap-bind
ldap_unbind($ldapconn);
}
@ -307,5 +304,65 @@ class PasswdModule extends Module
return $hash;
}
function make_ad_password($password) {
$password = "\"" . $password . "\"";
$adpassword = mb_convert_encoding($password, "UTF-16LE", "UTF-8");
return $adpassword;
}
function change_password( $ldap, $dn, $password, $oldpassword ) {
$result = "";
$error_code = "";
$error_msg = "";
$ppolicy_error_code = "";
$time = time();
# Transform password value
$password = $this->make_ad_password($password);
# Set password value
$userdata["unicodePwd"] = $password;
# Commit modification on directory
# The AD password change procedure is modifying the attribute unicodePwd by
# first deleting unicodePwd with the old password and them adding it with the
# the new password
$oldpassword = $this->make_ad_password($oldpassword);
$modifications = array(
array(
"attrib" => "unicodePwd",
"modtype" => LDAP_MODIFY_BATCH_REMOVE,
"values" => array($oldpassword),
),
array(
"attrib" => "unicodePwd",
"modtype" => LDAP_MODIFY_BATCH_ADD,
"values" => array($password),
),
);
$bmod = ldap_modify_batch($ldap, $dn, $modifications);
$error_code = ldap_errno($ldap);
$error_msg = ldap_error($ldap);
if ( !isset($error_code) ) {
$result = "ldaperror";
} elseif ( $error_code > 0 ) {
$result = "passworderror";
error_log("LDAP - Modify password error $error_code ($error_msg)");
if ( $ppolicy_error_code === 5 ) { $result = "badquality"; }
if ( $ppolicy_error_code === 6 ) { $result = "tooshort"; }
if ( $ppolicy_error_code === 7 ) { $result = "tooyoung"; }
if ( $ppolicy_error_code === 8 ) { $result = "inhistory"; }
} else {
$result = "passwordchanged";
}
return $result;
}
}
?>