functions/abook_ldap_server.php

   1 <?php
   2 /**
   3  * abook_ldap_server.php
   4  *
   5  * Copyright (c) 1999-2005 The SquirrelMail Project Team
   6  * Licensed under the GNU GPL. For full terms see the file COPYING.
   7  *
   8  * Address book backend for LDAP server
   9  *
  10  * LDAP filtering code by Tim Bell
  11  *   <bhat at users.sourceforge.net> (#539534)
  12  * ADS limit_scope code by Michael Brown
  13  *   <mcb30 at users.sourceforge.net> (#1035454)
  14  *
  15  * @version $Id$
  16  * @package squirrelmail
  17  * @subpackage addressbook
  18  */
  19
  20 /**
  21  * Address book backend for LDAP server
  22  *
  23  * An array with the following elements must be passed to
  24  * the class constructor (elements marked ? are optional):
  25  * <pre>
  26  *    host      => LDAP server hostname/IP-address
  27  *    base      => LDAP server root (base dn). Empty string allowed.
  28  *  ? port      => LDAP server TCP port number (default: 389)
  29  *  ? charset   => LDAP server charset (default: utf-8)
  30  *  ? name      => Name for LDAP server (default "LDAP: hostname")
  31  *                 Used to tag the result data
  32  *  ? maxrows   => Maximum # of rows in search result
  33  *  ? filter    => Filter expression to limit ldap searches
  34  *  ? timeout   => Timeout for LDAP operations (in seconds, default: 30)
  35  *                 Might not work for all LDAP libraries or servers.
  36  *  ? binddn    => LDAP Bind DN.
  37  *  ? bindpw    => LDAP Bind Password.
  38  *  ? protocol  => LDAP Bind protocol.
  39  *  ? limit_scope => Limits scope to base DN.
  40  * </pre>
  41  * NOTE. This class should not be used directly. Use the
  42  *       "AddressBook" class instead.
  43  * @package squirrelmail
  44  * @subpackage addressbook
  45  */
  46 class abook_ldap_server extends addressbook_backend {
  47     /**
  48      * @var string backend type
  49      */
  50     var $btype = 'remote';
  51     /**
  52      * @var string backend name
  53      */
  54     var $bname = 'ldap_server';
  55
  56     /* Parameters changed by class */
  57     /**
  58      * @var string displayed name
  59      */
  60     var $sname   = 'LDAP';       /* Service name */
  61     /**
  62      * @var string LDAP server name or address or url
  63      */
  64     var $server  = '';
  65     /**
  66      * @var integer LDAP server port
  67      */
  68     var $port    = 389;
  69     /**
  70      * @var string LDAP base DN
  71      */
  72     var $basedn  = '';
  73     /**
  74      * @var string charset used for entries in LDAP server
  75      */
  76     var $charset = 'utf-8';
  77     /**
  78      * @var object PHP LDAP link ID
  79      */
  80     var $linkid  = false;
  81     /**
  82      * @var bool True if LDAP server is bound
  83      */
  84     var $bound   = false;
  85     /**
  86      * @var integer max rows in result
  87      */
  88     var $maxrows = 250;
  89     /**
  90      * @var string ldap filter
  91      * @since 1.5.1
  92      */
  93     var $filter = '';
  94     /**
  95      * @var integer timeout of LDAP operations (in seconds)
  96      */
  97     var $timeout = 30;
  98     /**
  99      * @var string DN to bind to (non-anonymous bind)
 100      * @since 1.5.0 and 1.4.3
 101      */
 102     var $binddn = '';
 103     /**
 104      * @var string  password to bind with (non-anonymous bind)
 105      * @since 1.5.0 and 1.4.3
 106      */
 107     var $bindpw = '';
 108     /**
 109      * @var integer protocol used to connect to ldap server
 110      * @since 1.5.0 and 1.4.3
 111      */
 112     var $protocol = '';
 113     /**
 114      * @var boolean limits scope to base dn
 115      * @since 1.5.1
 116      */
 117     var $limit_scope = false;
 118
 119     /**
 120      * Constructor. Connects to database
 121      * @param array connection options
 122      */
 123     function abook_ldap_server($param) {
 124         if(!function_exists('ldap_connect')) {
 125             $this->set_error(_("PHP install does not have LDAP support."));
 126             return;
 127         }
 128         if(is_array($param)) {
 129             $this->server = $param['host'];
 130             $this->basedn = $param['base'];
 131
 132             if(!empty($param['port']))
 133                 $this->port = $param['port'];
 134
 135             if(!empty($param['charset']))
 136                 $this->charset = strtolower($param['charset']);
 137
 138             if(isset($param['maxrows']))
 139                 $this->maxrows = $param['maxrows'];
 140
 141             if(isset($param['timeout']))
 142                 $this->timeout = $param['timeout'];
 143
 144             if(isset($param['binddn']))
 145                 $this->binddn = $param['binddn'];
 146
 147             if(isset($param['bindpw']))
 148                 $this->bindpw = $param['bindpw'];
 149
 150             if(isset($param['protocol']))
 151                 $this->protocol = $param['protocol'];
 152
 153             if(isset($param['filter']))
 154                 $this->filter = trim($param['filter']);
 155
 156             if(isset($param['limit_scope']))
 157                 $this->limit_scope = $param['limit_scope'];
 158
 159             if(empty($param['name'])) {
 160                 $this->sname = 'LDAP: ' . $param['host'];
 161             } else {
 162                 $this->sname = $param['name'];
 163             }
 164
 165             /*
 166              * don't open LDAP server on addressbook_init(),
 167              * open ldap connection only on search. Speeds up
 168              * addressbook_init() call.
 169              */
 170             // $this->open(true);
 171         } else {
 172             $this->set_error('Invalid argument to constructor');
 173         }
 174     }
 175
 176
 177     /**
 178      * Open the LDAP server.
 179      * @param bool $new is it a new connection
 180      * @return bool
 181      */
 182     function open($new = false) {
 183         $this->error = '';
 184
 185         /* Connection is already open */
 186         if($this->linkid != false && !$new) {
 187             return true;
 188         }
 189
 190         $this->linkid = @ldap_connect($this->server, $this->port);
 191         if(!$this->linkid) {
 192             if(function_exists('ldap_error') && is_resource($this->linkid)) {
 193                 return $this->set_error(ldap_error($this->linkid));
 194             } else {
 195                 return $this->set_error('ldap_connect failed');
 196             }
 197         }
 198
 199         if(!empty($this->protocol)) {
 200             if(!@ldap_set_option($this->linkid, LDAP_OPT_PROTOCOL_VERSION, $this->protocol)) {
 201                 if(function_exists('ldap_error')) {
 202                     return $this->set_error(ldap_error($this->linkid));
 203                 } else {
 204                     return $this->set_error('ldap_set_option failed');
 205                 }
 206             }
 207         }
 208
 209         if(!empty($this->limit_scope) && $this->limit_scope) {
 210             if(empty($this->protocol) || intval($this->protocol) < 3) {
 211                 return $this->set_error('limit_scope requires protocol >= 3');
 212             }
 213             // See http://msdn.microsoft.com/library/en-us/ldap/ldap/ldap_server_domain_scope_oid.asp
 214             $ctrl = array ( "oid" => "1.2.840.113556.1.4.1339", "iscritical" => TRUE );
 215             if(!@ldap_set_option($this->linkid, LDAP_OPT_SERVER_CONTROLS, array($ctrl))) {
 216                 if(function_exists('ldap_error')) {
 217                     return $this->set_error(ldap_error($this->linkid));
 218                 } else {
 219                     return $this->set_error('limit domain scope failed');
 220                 }
 221             }
 222         }
 223
 224         if(!empty($this->binddn)) {
 225             if(!@ldap_bind($this->linkid, $this->binddn, $this->bindpw)) {
 226                 if(function_exists('ldap_error')) {
 227                     return $this->set_error(ldap_error($this->linkid));
 228                 } else {
 229                     return $this->set_error('authenticated ldap_bind failed');
 230                 }
 231               }
 232         } else {
 233             if(!@ldap_bind($this->linkid)) {
 234                 if(function_exists('ldap_error')) {
 235                     return $this->set_error(ldap_error($this->linkid));
 236                 } else {
 237                     return $this->set_error('anonymous ldap_bind failed');
 238                 }
 239             }
 240         }
 241
 242         $this->bound = true;
 243
 244         return true;
 245     }
 246
 247     /**
 248      * Encode string to the charset used by this LDAP server
 249      * @param string string that has to be encoded
 250      * @return string encoded string
 251      */
 252     function charset_encode($str) {
 253         global $default_charset;
 254         if($this->charset != $default_charset) {
 255             return charset_convert($default_charset,$str,$this->charset,false);
 256         } else {
 257             return $str;
 258         }
 259     }
 260
 261     /**
 262      * Decode from charset used by this LDAP server to charset used by translation
 263      *
 264      * Uses SquirrelMail charset_decode functions
 265      * @param string string that has to be decoded
 266      * @return string decoded string
 267      */
 268     function charset_decode($str) {
 269         global $default_charset;
 270         if ($this->charset != $default_charset) {
 271             return charset_convert($this->charset,$str,$default_charset,false);
 272         } else {
 273             return $str;
 274         }
 275     }
 276
 277     /**
 278      * Sanitizes ldap search strings.
 279      * See rfc2254
 280      * @link http://www.faqs.org/rfcs/rfc2254.html
 281      * @since 1.5.1 and 1.4.5
 282      * @param string $string
 283      * @return string sanitized string
 284      */
 285     function ldapspecialchars($string) {
 286         $sanitized=array('\\' => '\5c',
 287                          '*' => '\2a',
 288                          '(' => '\28',
 289                          ')' => '\29',
 290                          "\x00" => '\00');
 291
 292         return str_replace(array_keys($sanitized),array_values($sanitized),$string);
 293     }
 294
 295     /* ========================== Public ======================== */
 296
 297     /**
 298      * Search the LDAP server
 299      * @param string $expr search expression
 300      * @return array search results
 301      */
 302     function search($expr) {
 303         /* To be replaced by advanded search expression parsing */
 304         if(is_array($expr)) return false;
 305
 306         /* Encode the expression */
 307         $expr = $this->charset_encode($expr);
 308
 309         /*
 310          * allow use of one asterisk in search.
 311          * Don't allow any ldap special chars if search is different
 312          */
 313         if($expr!='*') {
 314             $expr = '*' . $this->ldapspecialchars($expr) . '*';
 315         }
 316         $expression = "(cn=$expr)";
 317
 318         if ($this->filter!='')
 319             $expression = '(&' . $this->filter . $expression . ')';
 320
 321         /* Make sure connection is there */
 322         if(!$this->open()) {
 323             return false;
 324         }
 325
 326         $sret = @ldap_search($this->linkid, $this->basedn, $expression,
 327             array('dn', 'o', 'ou', 'sn', 'givenname', 'cn', 'mail'),
 328             0, $this->maxrows, $this->timeout);
 329
 330         /* Should get error from server using the ldap_error() function,
 331          * but it only exist in the PHP LDAP documentation. */
 332         if(!$sret) {
 333             if(function_exists('ldap_error')) {
 334                 return $this->set_error(ldap_error($this->linkid));
 335             } else {
 336                 return $this->set_error('ldap_search failed');
 337             }
 338         }
 339
 340         if(@ldap_count_entries($this->linkid, $sret) <= 0) {
 341             return array();
 342         }
 343
 344         /* Get results */
 345         $ret = array();
 346         $returned_rows = 0;
 347         $res = @ldap_get_entries($this->linkid, $sret);
 348         for($i = 0 ; $i < $res['count'] ; $i++) {
 349             $row = $res[$i];
 350
 351             /* Extract data common for all e-mail addresses
 352              * of an object. Use only the first name */
 353             $nickname = $this->charset_decode($row['dn']);
 354             $fullname = $this->charset_decode($row['cn'][0]);
 355
 356             if(!empty($row['ou'][0])) {
 357                 $label = $this->charset_decode($row['ou'][0]);
 358             }
 359             else if(!empty($row['o'][0])) {
 360                 $label = $this->charset_decode($row['o'][0]);
 361             } else {
 362                 $label = '';
 363             }
 364
 365             if(empty($row['givenname'][0])) {
 366                 $firstname = '';
 367             } else {
 368                 $firstname = $this->charset_decode($row['givenname'][0]);
 369             }
 370
 371             if(empty($row['sn'][0])) {
 372                 $surname = '';
 373             } else {
 374                 $surname = $this->charset_decode($row['sn'][0]);
 375             }
 376
 377             /* Add one row to result for each e-mail address */
 378             if(isset($row['mail']['count'])) {
 379                 for($j = 0 ; $j < $row['mail']['count'] ; $j++) {
 380                     array_push($ret, array('nickname'  => $nickname,
 381                    'name'      => $fullname,
 382                    'firstname' => $firstname,
 383                    'lastname'  => $surname,
 384                    'email'     => $row['mail'][$j],
 385                    'label'     => $label,
 386                    'backend'   => $this->bnum,
 387                    'source'    => &$this->sname));
 388
 389                     // Limit number of hits
 390                     $returned_rows++;
 391                     if(($returned_rows >= $this->maxrows) &&
 392                        ($this->maxrows > 0) ) {
 393                         ldap_free_result($sret);
 394                         return $ret;
 395                     }
 396
 397                 } // for($j ...)
 398
 399             } // isset($row['mail']['count'])
 400
 401         }
 402
 403         ldap_free_result($sret);
 404         return $ret;
 405     } /* end search() */
 406
 407
 408     /**
 409      * List all entries present in LDAP server
 410      *
 411      * If you run a tiny LDAP server and you want the "List All" button
 412      * to show EVERYONE, disable first return call and enable the second one.
 413      * Remember that maxrows setting might limit list of returned entries.
 414      *
 415      * Careful with this -- it could get quite large for big sites.
 416      * @return array all entries in ldap server
 417      */
 418      function list_addr() {
 419          return array();
 420          // return $this->search('*');
 421      }
 422 }
 423 ?>