MDL-69521 core: Move all comments in code from 4.1 to 3.11
[moodle.git] / auth / ldap / auth.php
CommitLineData
b9ddb2d5 1<?php
a2f10958
PS
2// This file is part of Moodle - http://moodle.org/
3//
4// Moodle is free software: you can redistribute it and/or modify
5// it under the terms of the GNU General Public License as published by
6// the Free Software Foundation, either version 3 of the License, or
7// (at your option) any later version.
8//
9// Moodle is distributed in the hope that it will be useful,
10// but WITHOUT ANY WARRANTY; without even the implied warranty of
11// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12// GNU General Public License for more details.
13//
14// You should have received a copy of the GNU General Public License
15// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
b9ddb2d5 16
17/**
b9ddb2d5 18 * Authentication Plugin: LDAP Authentication
b9ddb2d5 19 * Authentication using LDAP (Lightweight Directory Access Protocol).
20 *
a2f10958
PS
21 * @package auth_ldap
22 * @author Martin Dougiamas
23 * @author Iñaki Arenaza
24 * @license http://www.gnu.org/copyleft/gpl.html GNU Public License
b9ddb2d5 25 */
26
60d7078a 27defined('MOODLE_INTERNAL') || die();
b9ddb2d5 28
81fb221d 29// See http://support.microsoft.com/kb/305144 to interprete these values.
30if (!defined('AUTH_AD_ACCOUNTDISABLE')) {
31 define('AUTH_AD_ACCOUNTDISABLE', 0x0002);
32}
33if (!defined('AUTH_AD_NORMAL_ACCOUNT')) {
34 define('AUTH_AD_NORMAL_ACCOUNT', 0x0200);
35}
355bd271 36if (!defined('AUTH_NTLMTIMEOUT')) { // timewindow for the NTLM SSO process, in secs...
37 define('AUTH_NTLMTIMEOUT', 10);
38}
39
fcf46da1
I
40// UF_DONT_EXPIRE_PASSWD value taken from MSDN directly
41if (!defined('UF_DONT_EXPIRE_PASSWD')) {
42 define ('UF_DONT_EXPIRE_PASSWD', 0x00010000);
43}
44
45// The Posix uid and gid of the 'nobody' account and 'nogroup' group.
46if (!defined('AUTH_UID_NOBODY')) {
47 define('AUTH_UID_NOBODY', -2);
48}
49if (!defined('AUTH_GID_NOGROUP')) {
50 define('AUTH_GID_NOGROUP', -2);
51}
81fb221d 52
34b10e26
IA
53// Regular expressions for a valid NTLM username and domain name.
54if (!defined('AUTH_NTLM_VALID_USERNAME')) {
55 define('AUTH_NTLM_VALID_USERNAME', '[^/\\\\\\\\\[\]:;|=,+*?<>@"]+');
56}
57if (!defined('AUTH_NTLM_VALID_DOMAINNAME')) {
58 define('AUTH_NTLM_VALID_DOMAINNAME', '[^\\\\\\\\\/:*?"<>|]+');
59}
60// Default format for remote users if using NTLM SSO
61if (!defined('AUTH_NTLM_DEFAULT_FORMAT')) {
62 define('AUTH_NTLM_DEFAULT_FORMAT', '%domain%\\%username%');
63}
d962e814
DM
64if (!defined('AUTH_NTLM_FASTPATH_ATTEMPT')) {
65 define('AUTH_NTLM_FASTPATH_ATTEMPT', 0);
66}
67if (!defined('AUTH_NTLM_FASTPATH_YESFORM')) {
68 define('AUTH_NTLM_FASTPATH_YESFORM', 1);
69}
70if (!defined('AUTH_NTLM_FASTPATH_YESATTEMPT')) {
71 define('AUTH_NTLM_FASTPATH_YESATTEMPT', 2);
72}
34b10e26 73
cd37c1da
IA
74// Allows us to retrieve a diagnostic message in case of LDAP operation error
75if (!defined('LDAP_OPT_DIAGNOSTIC_MESSAGE')) {
76 define('LDAP_OPT_DIAGNOSTIC_MESSAGE', 0x0032);
77}
78
6bc1e5d5 79require_once($CFG->libdir.'/authlib.php');
fcf46da1 80require_once($CFG->libdir.'/ldaplib.php');
bb78e249 81require_once($CFG->dirroot.'/user/lib.php');
8fb9a271 82require_once($CFG->dirroot.'/auth/ldap/locallib.php');
6bc1e5d5 83
b9ddb2d5 84/**
85 * LDAP authentication plugin.
86 */
6bc1e5d5 87class auth_plugin_ldap extends auth_plugin_base {
b9ddb2d5 88
89 /**
fcf46da1 90 * Init plugin config from database settings depending on the plugin auth type.
b9ddb2d5 91 */
fcf46da1 92 function init_plugin($authtype) {
037273d8 93 $this->pluginconfig = 'auth_'.$authtype;
fcf46da1 94 $this->config = get_config($this->pluginconfig);
139ebfdb 95 if (empty($this->config->ldapencoding)) {
96 $this->config->ldapencoding = 'utf-8';
97 }
98 if (empty($this->config->user_type)) {
99 $this->config->user_type = 'default';
100 }
101
fcf46da1
I
102 $ldap_usertypes = ldap_supported_usertypes();
103 $this->config->user_type_name = $ldap_usertypes[$this->config->user_type];
104 unset($ldap_usertypes);
105
106 $default = ldap_getdefaults();
139ebfdb 107
fcf46da1 108 // Use defaults if values not given
139ebfdb 109 foreach ($default as $key => $value) {
110 // watch out - 0, false are correct values too
111 if (!isset($this->config->{$key}) or $this->config->{$key} == '') {
112 $this->config->{$key} = $value[$this->config->user_type];
113 }
114 }
cfcb7a17 115
116 // Hack prefix to objectclass
abedeb8c 117 $this->config->objectclass = ldap_normalise_objectclass($this->config->objectclass);
fcf46da1 118 }
d836e3ed 119
fcf46da1
I
120 /**
121 * Constructor with initialisation.
122 */
4a89e83b 123 public function __construct() {
fcf46da1
I
124 $this->authtype = 'ldap';
125 $this->roleauth = 'auth_ldap';
126 $this->errorlogtag = '[AUTH LDAP] ';
127 $this->init_plugin($this->authtype);
b9ddb2d5 128 }
129
4a89e83b
MG
130 /**
131 * Old syntax of class constructor. Deprecated in PHP7.
132 *
133 * @deprecated since Moodle 3.1
134 */
135 public function auth_plugin_ldap() {
136 debugging('Use of class name as constructor is deprecated', DEBUG_DEVELOPER);
137 self::__construct();
138 }
139
b9ddb2d5 140 /**
141 * Returns true if the username and password work and false if they are
142 * wrong or don't exist.
143 *
fcf46da1
I
144 * @param string $username The username (without system magic quotes)
145 * @param string $password The password (without system magic quotes)
139ebfdb 146 *
147 * @return bool Authentication success or failure.
b9ddb2d5 148 */
149 function user_login($username, $password) {
b7b50143 150 if (! function_exists('ldap_bind')) {
fcf46da1 151 print_error('auth_ldapnotinstalled', 'auth_ldap');
b7b50143 152 return false;
153 }
b9ddb2d5 154
b9ddb2d5 155 if (!$username or !$password) { // Don't allow blank usernames or passwords
156 return false;
157 }
139ebfdb 158
2f1e464a
PS
159 $extusername = core_text::convert($username, 'utf-8', $this->config->ldapencoding);
160 $extpassword = core_text::convert($password, 'utf-8', $this->config->ldapencoding);
6221a321 161
decd8016 162 // Before we connect to LDAP, check if this is an AD SSO login
355bd271 163 // if we succeed in this block, we'll return success early.
decd8016 164 //
83cd2dce 165 $key = sesskey();
166 if (!empty($this->config->ntlmsso_enabled) && $key === $password) {
9651175f 167 $sessusername = get_cache_flag($this->pluginconfig.'/ntlmsess', $key);
0cbcc8ef 168 // We only get the cache flag if we retrieve it before
169 // it expires (AUTH_NTLMTIMEOUT seconds).
9651175f 170 if (empty($sessusername)) {
0cbcc8ef 171 return false;
172 }
173
0cbcc8ef 174 if ($username === $sessusername) {
175 unset($sessusername);
0cbcc8ef 176
177 // Check that the user is inside one of the configured LDAP contexts
178 $validuser = false;
179 $ldapconnection = $this->ldap_connect();
fcf46da1
I
180 // if the user is not inside the configured contexts,
181 // ldap_find_userdn returns false.
182 if ($this->ldap_find_userdn($ldapconnection, $extusername)) {
183 $validuser = true;
decd8016 184 }
fcf46da1 185 $this->ldap_close();
0cbcc8ef 186
187 // Shortcut here - SSO confirmed
188 return $validuser;
decd8016 189 }
355bd271 190 } // End SSO processing
83cd2dce 191 unset($key);
decd8016 192
b9ddb2d5 193 $ldapconnection = $this->ldap_connect();
fcf46da1 194 $ldap_user_dn = $this->ldap_find_userdn($ldapconnection, $extusername);
139ebfdb 195
fcf46da1
I
196 // If ldap_user_dn is empty, user does not exist
197 if (!$ldap_user_dn) {
eee34307 198 $this->ldap_close();
fcf46da1 199 return false;
b9ddb2d5 200 }
fcf46da1
I
201
202 // Try to bind with current username and password
203 $ldap_login = @ldap_bind($ldapconnection, $ldap_user_dn, $extpassword);
cd37c1da
IA
204
205 // If login fails and we are using MS Active Directory, retrieve the diagnostic
206 // message to see if this is due to an expired password, or that the user is forced to
207 // change the password on first login. If it is, only proceed if we can change
208 // password from Moodle (otherwise we'll get stuck later in the login process).
209 if (!$ldap_login && ($this->config->user_type == 'ad')
210 && $this->can_change_password()
211 && (!empty($this->config->expiration) and ($this->config->expiration == 1))) {
212
213 // We need to get the diagnostic message right after the call to ldap_bind(),
214 // before any other LDAP operation.
215 ldap_get_option($ldapconnection, LDAP_OPT_DIAGNOSTIC_MESSAGE, $diagmsg);
216
217 if ($this->ldap_ad_pwdexpired_from_diagmsg($diagmsg)) {
218 // If login failed because user must change the password now or the
219 // password has expired, let the user in. We'll catch this later in the
220 // login process when we explicitly check for expired passwords.
221 $ldap_login = true;
222 }
b9ddb2d5 223 }
cd37c1da
IA
224 $this->ldap_close();
225 return $ldap_login;
b9ddb2d5 226 }
227
228 /**
fcf46da1 229 * Reads user information from ldap and returns it in array()
b9ddb2d5 230 *
b9ddb2d5 231 * Function should return all information available. If you are saving
232 * this information to moodle user-table you should honor syncronization flags
233 *
be544ec3 234 * @param string $username username
139ebfdb 235 *
236 * @return mixed array with no magic quotes or false on error
b9ddb2d5 237 */
238 function get_userinfo($username) {
2f1e464a 239 $extusername = core_text::convert($username, 'utf-8', $this->config->ldapencoding);
139ebfdb 240
b9ddb2d5 241 $ldapconnection = $this->ldap_connect();
fcf46da1 242 if(!($user_dn = $this->ldap_find_userdn($ldapconnection, $extusername))) {
c090d7c9 243 $this->ldap_close();
fcf46da1
I
244 return false;
245 }
139ebfdb 246
b9ddb2d5 247 $search_attribs = array();
fcf46da1
I
248 $attrmap = $this->ldap_attributes();
249 foreach ($attrmap as $key => $values) {
b9ddb2d5 250 if (!is_array($values)) {
251 $values = array($values);
252 }
253 foreach ($values as $value) {
254 if (!in_array($value, $search_attribs)) {
255 array_push($search_attribs, $value);
139ebfdb 256 }
b9ddb2d5 257 }
258 }
259
fcf46da1 260 if (!$user_info_result = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs)) {
c090d7c9 261 $this->ldap_close();
139ebfdb 262 return false; // error!
263 }
fcf46da1
I
264
265 $user_entry = ldap_get_entries_moodle($ldapconnection, $user_info_result);
139ebfdb 266 if (empty($user_entry)) {
c090d7c9 267 $this->ldap_close();
139ebfdb 268 return false; // entry not found
269 }
270
fcf46da1
I
271 $result = array();
272 foreach ($attrmap as $key => $values) {
139ebfdb 273 if (!is_array($values)) {
274 $values = array($values);
275 }
276 $ldapval = NULL;
277 foreach ($values as $value) {
67bebb69 278 $entry = $user_entry[0];
fcf46da1 279 if (($value == 'dn') || ($value == 'distinguishedname')) {
a8d58c58 280 $result[$key] = $user_dn;
fcf46da1 281 continue;
a8d58c58 282 }
fcf46da1 283 if (!array_key_exists($value, $entry)) {
139ebfdb 284 continue; // wrong data mapping!
b9ddb2d5 285 }
fcf46da1 286 if (is_array($entry[$value])) {
2f1e464a 287 $newval = core_text::convert($entry[$value][0], $this->config->ldapencoding, 'utf-8');
139ebfdb 288 } else {
2f1e464a 289 $newval = core_text::convert($entry[$value], $this->config->ldapencoding, 'utf-8');
b9ddb2d5 290 }
d836e3ed 291 if (!empty($newval)) { // favour ldap entries that are set
139ebfdb 292 $ldapval = $newval;
b9ddb2d5 293 }
294 }
139ebfdb 295 if (!is_null($ldapval)) {
296 $result[$key] = $ldapval;
297 }
b9ddb2d5 298 }
299
eee34307 300 $this->ldap_close();
b9ddb2d5 301 return $result;
302 }
303
304 /**
fcf46da1 305 * Reads user information from ldap and returns it in an object
b9ddb2d5 306 *
139ebfdb 307 * @param string $username username (with system magic quotes)
308 * @return mixed object or false on error
b9ddb2d5 309 */
310 function get_userinfo_asobj($username) {
139ebfdb 311 $user_array = $this->get_userinfo($username);
312 if ($user_array == false) {
313 return false; //error or not found
314 }
315 $user_array = truncate_userinfo($user_array);
1dffbae2 316 $user = new stdClass();
b9ddb2d5 317 foreach ($user_array as $key=>$value) {
318 $user->{$key} = $value;
319 }
320 return $user;
321 }
322
323 /**
fcf46da1 324 * Returns all usernames from LDAP
b9ddb2d5 325 *
fcf46da1 326 * get_userlist returns all usernames from LDAP
b9ddb2d5 327 *
139ebfdb 328 * @return array
b9ddb2d5 329 */
330 function get_userlist() {
b9ddb2d5 331 return $this->ldap_get_userlist("({$this->config->user_attribute}=*)");
332 }
333
334 /**
fcf46da1 335 * Checks if user exists on LDAP
139ebfdb 336 *
df884cd8 337 * @param string $username
b9ddb2d5 338 */
339 function user_exists($username) {
2f1e464a 340 $extusername = core_text::convert($username, 'utf-8', $this->config->ldapencoding);
139ebfdb 341
fcf46da1
I
342 // Returns true if given username exists on ldap
343 $users = $this->ldap_get_userlist('('.$this->config->user_attribute.'='.ldap_filter_addslashes($extusername).')');
139ebfdb 344 return count($users);
b9ddb2d5 345 }
346
347 /**
fcf46da1 348 * Creates a new user on LDAP.
b9ddb2d5 349 * By using information in userobject
fcf46da1 350 * Use user_exists to prevent duplicate usernames
b9ddb2d5 351 *
df884cd8 352 * @param mixed $userobject Moodle userobject
353 * @param mixed $plainpass Plaintext password
b9ddb2d5 354 */
355 function user_create($userobject, $plainpass) {
2f1e464a
PS
356 $extusername = core_text::convert($userobject->username, 'utf-8', $this->config->ldapencoding);
357 $extpassword = core_text::convert($plainpass, 'utf-8', $this->config->ldapencoding);
139ebfdb 358
344514fc 359 switch ($this->config->passtype) {
360 case 'md5':
361 $extpassword = '{MD5}' . base64_encode(pack('H*', md5($extpassword)));
362 break;
363 case 'sha1':
364 $extpassword = '{SHA}' . base64_encode(pack('H*', sha1($extpassword)));
365 break;
366 case 'plaintext':
367 default:
368 break; // plaintext
369 }
370
b9ddb2d5 371 $ldapconnection = $this->ldap_connect();
372 $attrmap = $this->ldap_attributes();
139ebfdb 373
b9ddb2d5 374 $newuser = array();
139ebfdb 375
b9ddb2d5 376 foreach ($attrmap as $key => $values) {
377 if (!is_array($values)) {
378 $values = array($values);
379 }
380 foreach ($values as $value) {
381 if (!empty($userobject->$key) ) {
2f1e464a 382 $newuser[$value] = core_text::convert($userobject->$key, 'utf-8', $this->config->ldapencoding);
b9ddb2d5 383 }
384 }
385 }
139ebfdb 386
b9ddb2d5 387 //Following sets all mandatory and other forced attribute values
388 //User should be creted as login disabled untill email confirmation is processed
139ebfdb 389 //Feel free to add your user type and send patches to paca@sci.fi to add them
b9ddb2d5 390 //Moodle distribution
391
392 switch ($this->config->user_type) {
393 case 'edir':
fcf46da1 394 $newuser['objectClass'] = array('inetOrgPerson', 'organizationalPerson', 'person', 'top');
139ebfdb 395 $newuser['uniqueId'] = $extusername;
fcf46da1 396 $newuser['logindisabled'] = 'TRUE';
139ebfdb 397 $newuser['userpassword'] = $extpassword;
fcf46da1
I
398 $uadd = ldap_add($ldapconnection, $this->config->user_attribute.'='.ldap_addslashes($extusername).','.$this->config->create_context, $newuser);
399 break;
400 case 'rfc2307':
401 case 'rfc2307bis':
402 // posixAccount object class forces us to specify a uidNumber
403 // and a gidNumber. That is quite complicated to generate from
404 // Moodle without colliding with existing numbers and without
405 // race conditions. As this user is supposed to be only used
406 // with Moodle (otherwise the user would exist beforehand) and
407 // doesn't need to login into a operating system, we assign the
408 // user the uid of user 'nobody' and gid of group 'nogroup'. In
409 // addition to that, we need to specify a home directory. We
410 // use the root directory ('/') as the home directory, as this
411 // is the only one can always be sure exists. Finally, even if
412 // it's not mandatory, we specify '/bin/false' as the login
413 // shell, to prevent the user from login in at the operating
414 // system level (Moodle ignores this).
415
416 $newuser['objectClass'] = array('posixAccount', 'inetOrgPerson', 'organizationalPerson', 'person', 'top');
417 $newuser['cn'] = $extusername;
418 $newuser['uid'] = $extusername;
419 $newuser['uidNumber'] = AUTH_UID_NOBODY;
420 $newuser['gidNumber'] = AUTH_GID_NOGROUP;
421 $newuser['homeDirectory'] = '/';
422 $newuser['loginShell'] = '/bin/false';
423
424 // IMPORTANT:
425 // We have to create the account locked, but posixAccount has
426 // no attribute to achive this reliably. So we are going to
427 // modify the password in a reversable way that we can later
428 // revert in user_activate().
429 //
430 // Beware that this can be defeated by the user if we are not
431 // using MD5 or SHA-1 passwords. After all, the source code of
432 // Moodle is available, and the user can see the kind of
433 // modification we are doing and 'undo' it by hand (but only
434 // if we are using plain text passwords).
435 //
436 // Also bear in mind that you need to use a binding user that
437 // can create accounts and has read/write privileges on the
438 // 'userPassword' attribute for this to work.
439
440 $newuser['userPassword'] = '*'.$extpassword;
441 $uadd = ldap_add($ldapconnection, $this->config->user_attribute.'='.ldap_addslashes($extusername).','.$this->config->create_context, $newuser);
81fb221d 442 break;
443 case 'ad':
444 // User account creation is a two step process with AD. First you
445 // create the user object, then you set the password. If you try
446 // to set the password while creating the user, the operation
447 // fails.
e295df44 448
81fb221d 449 // Passwords in Active Directory must be encoded as Unicode
450 // strings (UCS-2 Little Endian format) and surrounded with
451 // double quotes. See http://support.microsoft.com/?kbid=269190
452 if (!function_exists('mb_convert_encoding')) {
2b06294b 453 print_error('auth_ldap_no_mbstring', 'auth_ldap');
81fb221d 454 }
e295df44 455
fcf46da1
I
456 // Check for invalid sAMAccountName characters.
457 if (preg_match('#[/\\[\]:;|=,+*?<>@"]#', $extusername)) {
458 print_error ('auth_ldap_ad_invalidchars', 'auth_ldap');
459 }
460
81fb221d 461 // First create the user account, and mark it as disabled.
fcf46da1 462 $newuser['objectClass'] = array('top', 'person', 'user', 'organizationalPerson');
81fb221d 463 $newuser['sAMAccountName'] = $extusername;
e295df44 464 $newuser['userAccountControl'] = AUTH_AD_NORMAL_ACCOUNT |
81fb221d 465 AUTH_AD_ACCOUNTDISABLE;
fcf46da1 466 $userdn = 'cn='.ldap_addslashes($extusername).','.$this->config->create_context;
81fb221d 467 if (!ldap_add($ldapconnection, $userdn, $newuser)) {
2b06294b 468 print_error('auth_ldap_ad_create_req', 'auth_ldap');
81fb221d 469 }
e295df44 470
81fb221d 471 // Now set the password
472 unset($newuser);
473 $newuser['unicodePwd'] = mb_convert_encoding('"' . $extpassword . '"',
fcf46da1 474 'UCS-2LE', 'UTF-8');
81fb221d 475 if(!ldap_modify($ldapconnection, $userdn, $newuser)) {
476 // Something went wrong: delete the user account and error out
477 ldap_delete ($ldapconnection, $userdn);
2b06294b 478 print_error('auth_ldap_ad_create_req', 'auth_ldap');
81fb221d 479 }
480 $uadd = true;
b9ddb2d5 481 break;
482 default:
fcf46da1 483 print_error('auth_ldap_unsupportedusertype', 'auth_ldap', '', $this->config->user_type_name);
b9ddb2d5 484 }
eee34307 485 $this->ldap_close();
b9ddb2d5 486 return $uadd;
b9ddb2d5 487 }
488
fcf46da1
I
489 /**
490 * Returns true if plugin allows resetting of password from moodle.
491 *
492 * @return bool
493 */
4225d4ba 494 function can_reset_password() {
495 return !empty($this->config->stdchangepassword);
496 }
497
9b29f686
MN
498 /**
499 * Returns true if plugin can be manually set.
500 *
501 * @return bool
502 */
503 function can_be_manually_set() {
504 return true;
505 }
506
fcf46da1
I
507 /**
508 * Returns true if plugin allows signup and user creation.
509 *
510 * @return bool
511 */
4db13f94 512 function can_signup() {
513 return (!empty($this->config->auth_user_create) and !empty($this->config->create_context));
514 }
515
516 /**
517 * Sign up a new user ready for confirmation.
518 * Password is passed in plaintext.
519 *
5d910388 520 * @param object $user new user object
4db13f94 521 * @param boolean $notify print notice with link and terminate
7b9643b5 522 * @return boolean success
4db13f94 523 */
524 function user_signup($user, $notify=true) {
fcf46da1 525 global $CFG, $DB, $PAGE, $OUTPUT;
f679d730 526
831d450e 527 require_once($CFG->dirroot.'/user/profile/lib.php');
1d658535 528 require_once($CFG->dirroot.'/user/lib.php');
f679d730 529
4db13f94 530 if ($this->user_exists($user->username)) {
2b06294b 531 print_error('auth_ldap_user_exists', 'auth_ldap');
4db13f94 532 }
533
534 $plainslashedpassword = $user->password;
535 unset($user->password);
536
537 if (! $this->user_create($user, $plainslashedpassword)) {
2b06294b 538 print_error('auth_ldap_create_error', 'auth_ldap');
4db13f94 539 }
540
9363073b 541 $user->id = user_create_user($user, false, false);
4db13f94 542
1d658535
PS
543 user_add_password_history($user->id, $plainslashedpassword);
544
fcf46da1 545 // Save any custom profile field information
831d450e 546 profile_save_data($user);
547
4e133e77
MN
548 $userinfo = $this->get_userinfo($user->username);
549 $this->update_user_record($user->username, false, false, $this->is_user_suspended((object) $userinfo));
550
ec2d8ceb
SC
551 // This will also update the stored hash to the latest algorithm
552 // if the existing hash is using an out-of-date algorithm (or the
553 // legacy md5 algorithm).
4db13f94 554 update_internal_user_password($user, $plainslashedpassword);
555
f679d730 556 $user = $DB->get_record('user', array('id'=>$user->id));
2942a5cd 557
9363073b
RT
558 \core\event\user_created::create_from_userid($user->id)->trigger();
559
4db13f94 560 if (! send_confirmation_email($user)) {
c6a074f8 561 print_error('noemail', 'auth_ldap');
4db13f94 562 }
563
564 if ($notify) {
4db13f94 565 $emailconfirm = get_string('emailconfirm');
fcf46da1 566 $PAGE->set_url('/auth/ldap/auth.php');
cfc5b79b 567 $PAGE->navbar->add($emailconfirm);
568 $PAGE->set_title($emailconfirm);
569 $PAGE->set_heading($emailconfirm);
570 echo $OUTPUT->header();
fcf46da1 571 notice(get_string('emailconfirmsent', '', $user->email), "{$CFG->wwwroot}/index.php");
4db13f94 572 } else {
573 return true;
574 }
575 }
576
577 /**
578 * Returns true if plugin allows confirming of new users.
579 *
580 * @return bool
581 */
582 function can_confirm() {
583 return $this->can_signup();
584 }
585
586 /**
587 * Confirm the new user as registered.
588 *
b9a66360 589 * @param string $username
590 * @param string $confirmsecret
4db13f94 591 */
592 function user_confirm($username, $confirmsecret) {
df884cd8 593 global $DB;
594
4db13f94 595 $user = get_complete_user_data('username', $username);
596
597 if (!empty($user)) {
4f8b6d56 598 if ($user->auth != $this->authtype) {
4db13f94 599 return AUTH_CONFIRM_ERROR;
600
4f8b6d56
MG
601 } else if ($user->secret == $confirmsecret && $user->confirmed) {
602 return AUTH_CONFIRM_ALREADY;
603
b9a66360 604 } else if ($user->secret == $confirmsecret) { // They have provided the secret key to get in
4db13f94 605 if (!$this->user_activate($username)) {
606 return AUTH_CONFIRM_FAIL;
607 }
bb78e249 608 $user->confirmed = 1;
bb78e249 609 user_update_user($user, false);
4db13f94 610 return AUTH_CONFIRM_OK;
611 }
612 } else {
613 return AUTH_CONFIRM_ERROR;
614 }
615 }
616
b9ddb2d5 617 /**
fcf46da1 618 * Return number of days to user password expires
b9ddb2d5 619 *
620 * If userpassword does not expire it should return 0. If password is already expired
621 * it should return negative value.
622 *
df884cd8 623 * @param mixed $username username
b9ddb2d5 624 * @return integer
625 */
626 function password_expire($username) {
2cef74f9 627 $result = 0;
139ebfdb 628
2f1e464a 629 $extusername = core_text::convert($username, 'utf-8', $this->config->ldapencoding);
139ebfdb 630
b9ddb2d5 631 $ldapconnection = $this->ldap_connect();
139ebfdb 632 $user_dn = $this->ldap_find_userdn($ldapconnection, $extusername);
b9ddb2d5 633 $search_attribs = array($this->config->expireattr);
cfcb7a17 634 $sr = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs);
b9ddb2d5 635 if ($sr) {
fcf46da1 636 $info = ldap_get_entries_moodle($ldapconnection, $sr);
fa5f5c20 637 if (!empty ($info)) {
67bebb69 638 $info = $info[0];
cd37c1da 639 if (isset($info[$this->config->expireattr][0])) {
fa5f5c20
IA
640 $expiretime = $this->ldap_expirationtime2unix($info[$this->config->expireattr][0], $ldapconnection, $user_dn);
641 if ($expiretime != 0) {
642 $now = time();
643 if ($expiretime > $now) {
644 $result = ceil(($expiretime - $now) / DAYSECS);
645 } else {
646 $result = floor(($expiretime - $now) / DAYSECS);
647 }
2cef74f9 648 }
139ebfdb 649 }
b9ddb2d5 650 }
139ebfdb 651 } else {
fcf46da1 652 error_log($this->errorlogtag.get_string('didtfindexpiretime', 'auth_ldap'));
b9ddb2d5 653 }
654
b9ddb2d5 655 return $result;
656 }
657
658 /**
fcf46da1 659 * Syncronizes user fron external LDAP server to moodle user table
b9ddb2d5 660 *
139ebfdb 661 * Sync is now using username attribute.
662 *
fcf46da1 663 * Syncing users removes or suspends users that dont exists anymore in external LDAP.
139ebfdb 664 * Creates new users and updates coursecreator status of users.
665 *
fcf46da1 666 * @param bool $do_updates will do pull in data updates from LDAP if relevant
b9ddb2d5 667 */
df884cd8 668 function sync_users($do_updates=true) {
669 global $CFG, $DB;
fa96bfaa 670
220ca688
MN
671 require_once($CFG->dirroot . '/user/profile/lib.php');
672
fcf46da1
I
673 print_string('connectingldap', 'auth_ldap');
674 $ldapconnection = $this->ldap_connect();
675
df884cd8 676 $dbman = $DB->get_manager();
139ebfdb 677
df884cd8 678 /// Define table user to be created
679 $table = new xmldb_table('tmp_extuser');
2a88f626 680 $table->add_field('id', XMLDB_TYPE_INTEGER, '10', XMLDB_UNSIGNED, XMLDB_NOTNULL, XMLDB_SEQUENCE, null);
681 $table->add_field('username', XMLDB_TYPE_CHAR, '100', null, XMLDB_NOTNULL, null, null);
fcf46da1 682 $table->add_field('mnethostid', XMLDB_TYPE_INTEGER, '10', XMLDB_UNSIGNED, XMLDB_NOTNULL, null, null);
df884cd8 683 $table->add_key('primary', XMLDB_KEY_PRIMARY, array('id'));
684 $table->add_index('username', XMLDB_INDEX_UNIQUE, array('mnethostid', 'username'));
b9ddb2d5 685
fcf46da1
I
686 print_string('creatingtemptable', 'auth_ldap', 'tmp_extuser');
687 $dbman->create_temp_table($table);
b9ddb2d5 688
689 ////
690 //// get user's list from ldap to sql in a scalable fashion
691 ////
692 // prepare some data we'll need
cfcb7a17 693 $filter = '(&('.$this->config->user_attribute.'=*)'.$this->config->objectclass.')';
988f9bf5 694 $servercontrols = array();
b9ddb2d5 695
fcf46da1 696 $contexts = explode(';', $this->config->contexts);
139ebfdb 697
b9ddb2d5 698 if (!empty($this->config->create_context)) {
c090d7c9 699 array_push($contexts, $this->config->create_context);
b9ddb2d5 700 }
701
8707682e 702 $ldappagedresults = ldap_paged_results_supported($this->config->ldap_version, $ldapconnection);
703 $ldapcookie = '';
b9ddb2d5 704 foreach ($contexts as $context) {
705 $context = trim($context);
706 if (empty($context)) {
707 continue;
708 }
b9ddb2d5 709
c090d7c9 710 do {
8707682e 711 if ($ldappagedresults) {
74ee34fd 712 // TODO: Remove the old branch of code once PHP 7.3.0 becomes required (Moodle 3.11).
988f9bf5
EL
713 if (version_compare(PHP_VERSION, '7.3.0', '<')) {
714 // Before 7.3, use this function that was deprecated in PHP 7.4.
715 ldap_control_paged_result($ldapconnection, $this->config->pagesize, true, $ldapcookie);
716 } else {
717 // PHP 7.3 and up, use server controls.
718 $servercontrols = array(array(
719 'oid' => LDAP_CONTROL_PAGEDRESULTS, 'value' => array(
720 'size' => $this->config->pagesize, 'cookie' => $ldapcookie)));
721 }
c090d7c9
IA
722 }
723 if ($this->config->search_sub) {
724 // Use ldap_search to find first user from subtree.
74ee34fd 725 // TODO: Remove the old branch of code once PHP 7.3.0 becomes required (Moodle 3.11).
988f9bf5
EL
726 if (version_compare(PHP_VERSION, '7.3.0', '<')) {
727 $ldapresult = ldap_search($ldapconnection, $context, $filter, array($this->config->user_attribute));
728 } else {
729 $ldapresult = ldap_search($ldapconnection, $context, $filter, array($this->config->user_attribute),
730 0, -1, -1, LDAP_DEREF_NEVER, $servercontrols);
731 }
c090d7c9
IA
732 } else {
733 // Search only in this context.
74ee34fd 734 // TODO: Remove the old branch of code once PHP 7.3.0 becomes required (Moodle 3.11).
988f9bf5
EL
735 if (version_compare(PHP_VERSION, '7.3.0', '<')) {
736 $ldapresult = ldap_list($ldapconnection, $context, $filter, array($this->config->user_attribute));
737 } else {
738 $ldapresult = ldap_list($ldapconnection, $context, $filter, array($this->config->user_attribute),
739 0, -1, -1, LDAP_DEREF_NEVER, $servercontrols);
740 }
c090d7c9 741 }
8707682e 742 if (!$ldapresult) {
c090d7c9
IA
743 continue;
744 }
8707682e 745 if ($ldappagedresults) {
988f9bf5
EL
746 // Get next server cookie to know if we'll need to continue searching.
747 $ldapcookie = '';
74ee34fd 748 // TODO: Remove the old branch of code once PHP 7.3.0 becomes required (Moodle 3.11).
988f9bf5
EL
749 if (version_compare(PHP_VERSION, '7.3.0', '<')) {
750 // Before 7.3, use this function that was deprecated in PHP 7.4.
751 $pagedresp = ldap_control_paged_result_response($ldapconnection, $ldapresult, $ldapcookie);
752 // Function ldap_control_paged_result_response() does not overwrite $ldapcookie if it fails, by
753 // setting this to null we avoid an infinite loop.
754 if ($pagedresp === false) {
755 $ldapcookie = null;
756 }
757 } else {
758 // Get next cookie from controls.
759 ldap_parse_result($ldapconnection, $ldapresult, $errcode, $matcheddn,
760 $errmsg, $referrals, $controls);
761 if (isset($controls[LDAP_CONTROL_PAGEDRESULTS]['value']['cookie'])) {
762 $ldapcookie = $controls[LDAP_CONTROL_PAGEDRESULTS]['value']['cookie'];
763 }
43dcb956 764 }
c090d7c9 765 }
8707682e 766 if ($entry = @ldap_first_entry($ldapconnection, $ldapresult)) {
c090d7c9
IA
767 do {
768 $value = ldap_get_values_len($ldapconnection, $entry, $this->config->user_attribute);
2f1e464a 769 $value = core_text::convert($value[0], $this->config->ldapencoding, 'utf-8');
77218e4a 770 $value = trim($value);
c090d7c9
IA
771 $this->ldap_bulk_insert($value);
772 } while ($entry = ldap_next_entry($ldapconnection, $entry));
773 }
8707682e 774 unset($ldapresult); // Free mem.
775 } while ($ldappagedresults && $ldapcookie !== null && $ldapcookie != '');
c090d7c9 776 }
fcf46da1 777
ee943e73 778 // If LDAP paged results were used, the current connection must be completely
c090d7c9 779 // closed and a new one created, to work without paged results from here on.
8707682e 780 if ($ldappagedresults) {
c090d7c9
IA
781 $this->ldap_close(true);
782 $ldapconnection = $this->ldap_connect();
b9ddb2d5 783 }
b9ddb2d5 784
785 /// preserve our user database
786 /// if the temp table is empty, it probably means that something went wrong, exit
787 /// so as to avoid mass deletion of users; which is hard to undo
df884cd8 788 $count = $DB->count_records_sql('SELECT COUNT(username) AS count, 1 FROM {tmp_extuser}');
b9ddb2d5 789 if ($count < 1) {
fcf46da1 790 print_string('didntgetusersfromldap', 'auth_ldap');
39ac02f4
JD
791 $dbman->drop_table($table);
792 $this->ldap_close();
793 return false;
fa96bfaa 794 } else {
fcf46da1 795 print_string('gotcountrecordsfromldap', 'auth_ldap', $count);
b9ddb2d5 796 }
797
b9ddb2d5 798
139ebfdb 799/// User removal
fcf46da1 800 // Find users in DB that aren't in ldap -- to be removed!
139ebfdb 801 // this is still not as scalable (but how often do we mass delete?)
d03e4508
PS
802
803 if ($this->config->removeuser == AUTH_REMOVEUSER_FULLDELETE) {
804 $sql = "SELECT u.*
df884cd8 805 FROM {user} u
d03e4508
PS
806 LEFT JOIN {tmp_extuser} e ON (u.username = e.username AND u.mnethostid = e.mnethostid)
807 WHERE u.auth = :auth
fcf46da1 808 AND u.deleted = 0
d03e4508
PS
809 AND e.username IS NULL";
810 $remove_users = $DB->get_records_sql($sql, array('auth'=>$this->authtype));
139ebfdb 811
812 if (!empty($remove_users)) {
fcf46da1 813 print_string('userentriestoremove', 'auth_ldap', count($remove_users));
139ebfdb 814 foreach ($remove_users as $user) {
d03e4508
PS
815 if (delete_user($user)) {
816 echo "\t"; print_string('auth_dbdeleteuser', 'auth_db', array('name'=>$user->username, 'id'=>$user->id)); echo "\n";
817 } else {
818 echo "\t"; print_string('auth_dbdeleteusererror', 'auth_db', $user->username); echo "\n";
139ebfdb 819 }
b9ddb2d5 820 }
139ebfdb 821 } else {
fcf46da1 822 print_string('nouserentriestoremove', 'auth_ldap');
139ebfdb 823 }
d03e4508
PS
824 unset($remove_users); // Free mem!
825
826 } else if ($this->config->removeuser == AUTH_REMOVEUSER_SUSPEND) {
827 $sql = "SELECT u.*
828 FROM {user} u
829 LEFT JOIN {tmp_extuser} e ON (u.username = e.username AND u.mnethostid = e.mnethostid)
830 WHERE u.auth = :auth
831 AND u.deleted = 0
832 AND u.suspended = 0
833 AND e.username IS NULL";
834 $remove_users = $DB->get_records_sql($sql, array('auth'=>$this->authtype));
835
836 if (!empty($remove_users)) {
837 print_string('userentriestoremove', 'auth_ldap', count($remove_users));
838
839 foreach ($remove_users as $user) {
840 $updateuser = new stdClass();
841 $updateuser->id = $user->id;
842 $updateuser->suspended = 1;
bb78e249 843 user_update_user($updateuser, false);
d03e4508 844 echo "\t"; print_string('auth_dbsuspenduser', 'auth_db', array('name'=>$user->username, 'id'=>$user->id)); echo "\n";
d79d5ac2 845 \core\session\manager::kill_user_sessions($user->id);
d03e4508
PS
846 }
847 } else {
848 print_string('nouserentriestoremove', 'auth_ldap');
849 }
850 unset($remove_users); // Free mem!
139ebfdb 851 }
852
853/// Revive suspended users
6f87ef52 854 if (!empty($this->config->removeuser) and $this->config->removeuser == AUTH_REMOVEUSER_SUSPEND) {
139ebfdb 855 $sql = "SELECT u.id, u.username
df884cd8 856 FROM {user} u
fcf46da1 857 JOIN {tmp_extuser} e ON (u.username = e.username AND u.mnethostid = e.mnethostid)
d03e4508
PS
858 WHERE (u.auth = 'nologin' OR (u.auth = ? AND u.suspended = 1)) AND u.deleted = 0";
859 // Note: 'nologin' is there for backwards compatibility.
860 $revive_users = $DB->get_records_sql($sql, array($this->authtype));
139ebfdb 861
862 if (!empty($revive_users)) {
fcf46da1 863 print_string('userentriestorevive', 'auth_ldap', count($revive_users));
139ebfdb 864
139ebfdb 865 foreach ($revive_users as $user) {
1dffbae2 866 $updateuser = new stdClass();
139ebfdb 867 $updateuser->id = $user->id;
fcf46da1 868 $updateuser->auth = $this->authtype;
d03e4508 869 $updateuser->suspended = 0;
bb78e249 870 user_update_user($updateuser, false);
dd88de0e 871 echo "\t"; print_string('auth_dbreviveduser', 'auth_db', array('name'=>$user->username, 'id'=>$user->id)); echo "\n";
b9ddb2d5 872 }
139ebfdb 873 } else {
fcf46da1 874 print_string('nouserentriestorevive', 'auth_ldap');
139ebfdb 875 }
876
877 unset($revive_users);
fa96bfaa 878 }
b9ddb2d5 879
139ebfdb 880
881/// User Updates - time-consuming (optional)
b9ddb2d5 882 if ($do_updates) {
fcf46da1 883 // Narrow down what fields we need to update
725fcf31 884 $updatekeys = $this->get_profile_keys();
139ebfdb 885
fa96bfaa 886 } else {
fcf46da1 887 print_string('noupdatestobedone', 'auth_ldap');
b9ddb2d5 888 }
fcf46da1
I
889 if ($do_updates and !empty($updatekeys)) { // run updates only if relevant
890 $users = $DB->get_records_sql('SELECT u.username, u.id
df884cd8 891 FROM {user} u
fcf46da1
I
892 WHERE u.deleted = 0 AND u.auth = ? AND u.mnethostid = ?',
893 array($this->authtype, $CFG->mnet_localhost_id));
b9ddb2d5 894 if (!empty($users)) {
fcf46da1 895 print_string('userentriestoupdate', 'auth_ldap', count($users));
139ebfdb 896
d5a8d9aa 897 $transaction = $DB->start_delegated_transaction();
139ebfdb 898 $xcount = 0;
899 $maxxcount = 100;
b9ddb2d5 900
139ebfdb 901 foreach ($users as $user) {
2c10db3b 902 echo "\t"; print_string('auth_dbupdatinguser', 'auth_db', array('name'=>$user->username, 'id'=>$user->id));
4e133e77
MN
903 $userinfo = $this->get_userinfo($user->username);
904 if (!$this->update_user_record($user->username, $updatekeys, true,
905 $this->is_user_suspended((object) $userinfo))) {
fcf46da1 906 echo ' - '.get_string('skipped');
139ebfdb 907 }
908 echo "\n";
909 $xcount++;
910
8fb9a271
DB
911 // Update system roles, if needed.
912 $this->sync_roles($user);
b9ddb2d5 913 }
d5a8d9aa 914 $transaction->allow_commit();
139ebfdb 915 unset($users); // free mem
b9ddb2d5 916 }
fa96bfaa 917 } else { // end do updates
fcf46da1 918 print_string('noupdatestobedone', 'auth_ldap');
fa96bfaa 919 }
139ebfdb 920
921/// User Additions
fcf46da1 922 // Find users missing in DB that are in LDAP
b9ddb2d5 923 // and gives me a nifty object I don't want.
139ebfdb 924 // note: we do not care about deleted accounts anymore, this feature was replaced by suspending to nologin auth plugin
fcf46da1
I
925 $sql = 'SELECT e.id, e.username
926 FROM {tmp_extuser} e
927 LEFT JOIN {user} u ON (e.username = u.username AND e.mnethostid = u.mnethostid)
928 WHERE u.id IS NULL';
929 $add_users = $DB->get_records_sql($sql);
139ebfdb 930
b9ddb2d5 931 if (!empty($add_users)) {
fcf46da1 932 print_string('userentriestoadd', 'auth_ldap', count($add_users));
b9ddb2d5 933
d5a8d9aa 934 $transaction = $DB->start_delegated_transaction();
b9ddb2d5 935 foreach ($add_users as $user) {
df884cd8 936 $user = $this->get_userinfo_asobj($user->username);
139ebfdb 937
fcf46da1 938 // Prep a few params
b7b50143 939 $user->modified = time();
940 $user->confirmed = 1;
fcf46da1 941 $user->auth = $this->authtype;
b7b50143 942 $user->mnethostid = $CFG->mnet_localhost_id;
997bcd9e 943 // get_userinfo_asobj() might have replaced $user->username with the value
944 // from the LDAP server (which can be mixed-case). Make sure it's lowercase
2f1e464a 945 $user->username = trim(core_text::strtolower($user->username));
6141dcfe
CB
946 // It isn't possible to just rely on the configured suspension attribute since
947 // things like active directory use bit masks, other things using LDAP might
948 // do different stuff as well.
8ffe9aef
CB
949 //
950 // The cast to int is a workaround for MDL-53959.
951 $user->suspended = (int)$this->is_user_suspended($user);
470f94dc 952
8bf0f207
MN
953 if (empty($user->calendartype)) {
954 $user->calendartype = $CFG->calendartype;
955 }
139ebfdb 956
bb78e249 957 $id = user_create_user($user, false);
a9637e7d 958 echo "\t"; print_string('auth_dbinsertuser', 'auth_db', array('name'=>$user->username, 'id'=>$id)); echo "\n";
2c977ceb 959 $euser = $DB->get_record('user', array('id' => $id));
bb78e249 960
a9637e7d
PS
961 if (!empty($this->config->forcechangepassword)) {
962 set_user_preference('auth_forcepasswordchange', 1, $id);
963 }
3e5f4b87 964
2c977ceb 965 // Save custom profile fields.
725fcf31 966 $this->update_user_record($user->username, $this->get_profile_keys(true), false);
2c977ceb 967
8fb9a271 968 // Add roles if needed.
2c977ceb 969 $this->sync_roles($euser);
139ebfdb 970
b9ddb2d5 971 }
d5a8d9aa 972 $transaction->allow_commit();
b9ddb2d5 973 unset($add_users); // free mem
fa96bfaa 974 } else {
fcf46da1 975 print_string('nouserstobeadded', 'auth_ldap');
b9ddb2d5 976 }
df884cd8 977
a66b2ae4 978 $dbman->drop_table($table);
eee34307 979 $this->ldap_close();
df884cd8 980
b9ddb2d5 981 return true;
982 }
983
139ebfdb 984 /**
985 * Bulk insert in SQL's temp table
139ebfdb 986 */
df884cd8 987 function ldap_bulk_insert($username) {
fcf46da1 988 global $DB, $CFG;
df884cd8 989
2f1e464a 990 $username = core_text::strtolower($username); // usernames are __always__ lowercase.
fcf46da1
I
991 $DB->insert_record_raw('tmp_extuser', array('username'=>$username,
992 'mnethostid'=>$CFG->mnet_localhost_id), false, true);
993 echo '.';
b9ddb2d5 994 }
995
139ebfdb 996 /**
fcf46da1 997 * Activates (enables) user in external LDAP so user can login
b9ddb2d5 998 *
df884cd8 999 * @param mixed $username
fcf46da1 1000 * @return boolean result
b9ddb2d5 1001 */
1002 function user_activate($username) {
2f1e464a 1003 $extusername = core_text::convert($username, 'utf-8', $this->config->ldapencoding);
139ebfdb 1004
b9ddb2d5 1005 $ldapconnection = $this->ldap_connect();
1006
139ebfdb 1007 $userdn = $this->ldap_find_userdn($ldapconnection, $extusername);
b9ddb2d5 1008 switch ($this->config->user_type) {
1009 case 'edir':
fcf46da1
I
1010 $newinfo['loginDisabled'] = 'FALSE';
1011 break;
1012 case 'rfc2307':
1013 case 'rfc2307bis':
1014 // Remember that we add a '*' character in front of the
1015 // external password string to 'disable' the account. We just
1016 // need to remove it.
1017 $sr = ldap_read($ldapconnection, $userdn, '(objectClass=*)',
1018 array('userPassword'));
1019 $info = ldap_get_entries($ldapconnection, $sr);
1020 $info[0] = array_change_key_case($info[0], CASE_LOWER);
1021 $newinfo['userPassword'] = ltrim($info[0]['userpassword'][0], '*');
b9ddb2d5 1022 break;
81fb221d 1023 case 'ad':
1024 // We need to unset the ACCOUNTDISABLE bit in the
1025 // userAccountControl attribute ( see
1026 // http://support.microsoft.com/kb/305144 )
1027 $sr = ldap_read($ldapconnection, $userdn, '(objectClass=*)',
1028 array('userAccountControl'));
1029 $info = ldap_get_entries($ldapconnection, $sr);
fcf46da1
I
1030 $info[0] = array_change_key_case($info[0], CASE_LOWER);
1031 $newinfo['userAccountControl'] = $info[0]['useraccountcontrol'][0]
81fb221d 1032 & (~AUTH_AD_ACCOUNTDISABLE);
1033 break;
b9ddb2d5 1034 default:
fcf46da1 1035 print_error('user_activatenotsupportusertype', 'auth_ldap', '', $this->config->user_type_name);
139ebfdb 1036 }
b9ddb2d5 1037 $result = ldap_modify($ldapconnection, $userdn, $newinfo);
eee34307 1038 $this->ldap_close();
b9ddb2d5 1039 return $result;
1040 }
1041
139ebfdb 1042 /**
b9ddb2d5 1043 * Returns true if user should be coursecreator.
1044 *
6bc1e5d5 1045 * @param mixed $username username (without system magic quotes)
fcf46da1 1046 * @return mixed result null if course creators is not configured, boolean otherwise.
8fb9a271
DB
1047 *
1048 * @deprecated since Moodle 3.4 MDL-30634 - please do not use this function any more.
b9ddb2d5 1049 */
6bc1e5d5 1050 function iscreator($username) {
8fb9a271
DB
1051 debugging('iscreator() is deprecated. Please use auth_plugin_ldap::is_role() instead.', DEBUG_DEVELOPER);
1052
139ebfdb 1053 if (empty($this->config->creators) or empty($this->config->memberattribute)) {
6bc1e5d5 1054 return null;
b9ddb2d5 1055 }
139ebfdb 1056
2f1e464a 1057 $extusername = core_text::convert($username, 'utf-8', $this->config->ldapencoding);
139ebfdb 1058
fcf46da1
I
1059 $ldapconnection = $this->ldap_connect();
1060
1061 if ($this->config->memberattribute_isdn) {
1062 if(!($userid = $this->ldap_find_userdn($ldapconnection, $extusername))) {
1063 return false;
1064 }
1065 } else {
1066 $userid = $extusername;
1067 }
1068
1069 $group_dns = explode(';', $this->config->creators);
1070 $creator = ldap_isgroupmember($ldapconnection, $userid, $group_dns, $this->config->memberattribute);
1071
1072 $this->ldap_close();
1073
1074 return $creator;
b9ddb2d5 1075 }
1076
8fb9a271
DB
1077 /**
1078 * Check if user has LDAP group membership.
1079 *
1080 * Returns true if user should be assigned role.
1081 *
1082 * @param mixed $username username (without system magic quotes).
1083 * @param array $role Array of role's shortname, localname, and settingname for the config value.
1084 * @return mixed result null if role/LDAP context is not configured, boolean otherwise.
1085 */
1086 private function is_role($username, $role) {
1087 if (empty($this->config->{$role['settingname']}) or empty($this->config->memberattribute)) {
1088 return null;
1089 }
1090
1091 $extusername = core_text::convert($username, 'utf-8', $this->config->ldapencoding);
1092
1093 $ldapconnection = $this->ldap_connect();
1094
1095 if ($this->config->memberattribute_isdn) {
1096 if (!($userid = $this->ldap_find_userdn($ldapconnection, $extusername))) {
1097 return false;
1098 }
1099 } else {
1100 $userid = $extusername;
1101 }
1102
1103 $groupdns = explode(';', $this->config->{$role['settingname']});
1104 $isrole = ldap_isgroupmember($ldapconnection, $userid, $groupdns, $this->config->memberattribute);
1105
1106 $this->ldap_close();
1107
1108 return $isrole;
1109 }
1110
139ebfdb 1111 /**
b9ddb2d5 1112 * Called when the user record is updated.
fcf46da1
I
1113 *
1114 * Modifies user in external LDAP server. It takes olduser (before
1115 * changes) and newuser (after changes) compares information and
1116 * saves modified information to external LDAP server.
b9ddb2d5 1117 *
139ebfdb 1118 * @param mixed $olduser Userobject before modifications (without system magic quotes)
1119 * @param mixed $newuser Userobject new modified userobject (without system magic quotes)
b9ddb2d5 1120 * @return boolean result
1121 *
1122 */
1123 function user_update($olduser, $newuser) {
029ec1ed
MN
1124 global $CFG;
1125
1126 require_once($CFG->dirroot . '/user/profile/lib.php');
139ebfdb 1127
1128 if (isset($olduser->username) and isset($newuser->username) and $olduser->username != $newuser->username) {
fcf46da1 1129 error_log($this->errorlogtag.get_string('renamingnotallowed', 'auth_ldap'));
139ebfdb 1130 return false;
1131 }
1132
fcf46da1 1133 if (isset($olduser->auth) and $olduser->auth != $this->authtype) {
139ebfdb 1134 return true; // just change auth and skip update
1135 }
1136
1e3eee5f 1137 $attrmap = $this->ldap_attributes();
fcf46da1 1138 // Before doing anything else, make sure we really need to update anything
1e3eee5f 1139 // in the external LDAP server.
1140 $update_external = false;
1141 foreach ($attrmap as $key => $ldapkeys) {
1142 if (!empty($this->config->{'field_updateremote_'.$key})) {
1143 $update_external = true;
1144 break;
1145 }
1146 }
1147 if (!$update_external) {
1148 return true;
1149 }
1150
2f1e464a 1151 $extoldusername = core_text::convert($olduser->username, 'utf-8', $this->config->ldapencoding);
b9ddb2d5 1152
1153 $ldapconnection = $this->ldap_connect();
139ebfdb 1154
b9ddb2d5 1155 $search_attribs = array();
b9ddb2d5 1156 foreach ($attrmap as $key => $values) {
1157 if (!is_array($values)) {
1158 $values = array($values);
1159 }
1160 foreach ($values as $value) {
1161 if (!in_array($value, $search_attribs)) {
1162 array_push($search_attribs, $value);
1163 }
139ebfdb 1164 }
b9ddb2d5 1165 }
1166
fcf46da1
I
1167 if(!($user_dn = $this->ldap_find_userdn($ldapconnection, $extoldusername))) {
1168 return false;
1169 }
b9ddb2d5 1170
2c977ceb 1171 // Load old custom fields.
e8a1a586 1172 $olduserprofilefields = (array) profile_user_record($olduser->id, false);
2c977ceb
AG
1173
1174 $fields = array();
1175 foreach (profile_get_custom_fields(false) as $field) {
1176 $fields[$field->shortname] = $field;
1177 }
1178
a8451603 1179 $success = true;
fcf46da1 1180 $user_info_result = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs);
b9ddb2d5 1181 if ($user_info_result) {
fcf46da1 1182 $user_entry = ldap_get_entries_moodle($ldapconnection, $user_info_result);
139ebfdb 1183 if (empty($user_entry)) {
fcf46da1
I
1184 $attribs = join (', ', $search_attribs);
1185 error_log($this->errorlogtag.get_string('updateusernotfound', 'auth_ldap',
99f9f85f 1186 array('userdn'=>$user_dn,
fcf46da1 1187 'attribs'=>$attribs)));
139ebfdb 1188 return false; // old user not found!
1189 } else if (count($user_entry) > 1) {
fcf46da1 1190 error_log($this->errorlogtag.get_string('morethanoneuser', 'auth_ldap'));
139ebfdb 1191 return false;
b9ddb2d5 1192 }
b9ddb2d5 1193
67bebb69 1194 $user_entry = $user_entry[0];
b9ddb2d5 1195
139ebfdb 1196 foreach ($attrmap as $key => $ldapkeys) {
2c977ceb
AG
1197 if (preg_match('/^profile_field_(.*)$/', $key, $match)) {
1198 // Custom field.
1199 $fieldname = $match[1];
1200 if (isset($fields[$fieldname])) {
1201 $class = 'profile_field_' . $fields[$fieldname]->datatype;
1202 $formfield = new $class($fields[$fieldname]->id, $olduser->id);
e8a1a586 1203 $oldvalue = isset($olduserprofilefields[$fieldname]) ? $olduserprofilefields[$fieldname] : null;
2c977ceb
AG
1204 } else {
1205 $oldvalue = null;
1206 }
1207 $newvalue = $formfield->edit_save_data_preprocess($newuser->{$formfield->inputname}, new stdClass);
1208 } else {
1209 // Standard field.
1210 $oldvalue = isset($olduser->$key) ? $olduser->$key : null;
1211 $newvalue = isset($newuser->$key) ? $newuser->$key : null;
b88adb55
GPL
1212 }
1213
2c977ceb 1214 if ($newvalue !== null and $newvalue !== $oldvalue and !empty($this->config->{'field_updateremote_' . $key})) {
fcf46da1 1215 // For ldap values that could be in more than one
139ebfdb 1216 // ldap key, we will do our best to match
b9ddb2d5 1217 // where they came from
1218 $ambiguous = true;
1219 $changed = false;
1220 if (!is_array($ldapkeys)) {
1221 $ldapkeys = array($ldapkeys);
1222 }
1223 if (count($ldapkeys) < 2) {
1224 $ambiguous = false;
1225 }
139ebfdb 1226
2c977ceb 1227 $nuvalue = core_text::convert($newvalue, 'utf-8', $this->config->ldapencoding);
15f80fd8 1228 empty($nuvalue) ? $nuvalue = array() : $nuvalue;
2c977ceb 1229 $ouvalue = core_text::convert($oldvalue, 'utf-8', $this->config->ldapencoding);
b9ddb2d5 1230 foreach ($ldapkeys as $ldapkey) {
a282b0f5 1231 // Skip update if $ldapkey does not exist in LDAP.
1232 if (!isset($user_entry[$ldapkey][0])) {
1233 $success = false;
1234 error_log($this->errorlogtag.get_string('updateremfailfield', 'auth_ldap',
1235 array('ldapkey' => $ldapkey,
1236 'key' => $key,
1237 'ouvalue' => $ouvalue,
1238 'nuvalue' => $nuvalue)));
1239 continue;
1240 }
1241
d836e3ed 1242 $ldapvalue = $user_entry[$ldapkey][0];
b9ddb2d5 1243 if (!$ambiguous) {
fcf46da1 1244 // Skip update if the values already match
139ebfdb 1245 if ($nuvalue !== $ldapvalue) {
fcf46da1 1246 // This might fail due to schema validation
139ebfdb 1247 if (@ldap_modify($ldapconnection, $user_dn, array($ldapkey => $nuvalue))) {
a8451603 1248 $changed = true;
139ebfdb 1249 continue;
1250 } else {
a8451603 1251 $success = false;
fcf46da1
I
1252 error_log($this->errorlogtag.get_string ('updateremfail', 'auth_ldap',
1253 array('errno'=>ldap_errno($ldapconnection),
1254 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)),
1255 'key'=>$key,
1256 'ouvalue'=>$ouvalue,
1257 'nuvalue'=>$nuvalue)));
139ebfdb 1258 continue;
1259 }
b9ddb2d5 1260 }
139ebfdb 1261 } else {
fcf46da1
I
1262 // Ambiguous. Value empty before in Moodle (and LDAP) - use
1263 // 1st ldap candidate field, no need to guess
139ebfdb 1264 if ($ouvalue === '') { // value empty before - use 1st ldap candidate
fcf46da1 1265 // This might fail due to schema validation
139ebfdb 1266 if (@ldap_modify($ldapconnection, $user_dn, array($ldapkey => $nuvalue))) {
b9ddb2d5 1267 $changed = true;
139ebfdb 1268 continue;
1269 } else {
a8451603 1270 $success = false;
fcf46da1
I
1271 error_log($this->errorlogtag.get_string ('updateremfail', 'auth_ldap',
1272 array('errno'=>ldap_errno($ldapconnection),
1273 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)),
1274 'key'=>$key,
1275 'ouvalue'=>$ouvalue,
1276 'nuvalue'=>$nuvalue)));
139ebfdb 1277 continue;
b9ddb2d5 1278 }
1279 }
1280
fcf46da1 1281 // We found which ldap key to update!
139ebfdb 1282 if ($ouvalue !== '' and $ouvalue === $ldapvalue ) {
fcf46da1 1283 // This might fail due to schema validation
139ebfdb 1284 if (@ldap_modify($ldapconnection, $user_dn, array($ldapkey => $nuvalue))) {
b9ddb2d5 1285 $changed = true;
139ebfdb 1286 continue;
1287 } else {
a8451603 1288 $success = false;
fcf46da1
I
1289 error_log($this->errorlogtag.get_string ('updateremfail', 'auth_ldap',
1290 array('errno'=>ldap_errno($ldapconnection),
1291 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)),
1292 'key'=>$key,
1293 'ouvalue'=>$ouvalue,
1294 'nuvalue'=>$nuvalue)));
139ebfdb 1295 continue;
b9ddb2d5 1296 }
1297 }
1298 }
1299 }
139ebfdb 1300
b9ddb2d5 1301 if ($ambiguous and !$changed) {
a8451603 1302 $success = false;
fcf46da1
I
1303 error_log($this->errorlogtag.get_string ('updateremfailamb', 'auth_ldap',
1304 array('key'=>$key,
1305 'ouvalue'=>$ouvalue,
1306 'nuvalue'=>$nuvalue)));
b9ddb2d5 1307 }
1308 }
1309 }
139ebfdb 1310 } else {
fcf46da1 1311 error_log($this->errorlogtag.get_string ('usernotfound', 'auth_ldap'));
a8451603 1312 $success = false;
b9ddb2d5 1313 }
1314
eee34307 1315 $this->ldap_close();
a8451603 1316 return $success;
b9ddb2d5 1317
1318 }
1319
fb5c7739 1320 /**
fcf46da1 1321 * Changes userpassword in LDAP
b9ddb2d5 1322 *
fcf46da1
I
1323 * Called when the user password is updated. It assumes it is
1324 * called by an admin or that you've otherwise checked the user's
1325 * credentials
b9ddb2d5 1326 *
ae040d4b 1327 * @param object $user User table object
fcf46da1 1328 * @param string $newpassword Plaintext password (not crypted/md5'ed)
b9ddb2d5 1329 * @return boolean result
1330 *
1331 */
b9ddb2d5 1332 function user_update_password($user, $newpassword) {
139ebfdb 1333 global $USER;
fcf46da1 1334
b9ddb2d5 1335 $result = false;
1336 $username = $user->username;
139ebfdb 1337
2f1e464a
PS
1338 $extusername = core_text::convert($username, 'utf-8', $this->config->ldapencoding);
1339 $extpassword = core_text::convert($newpassword, 'utf-8', $this->config->ldapencoding);
139ebfdb 1340
344514fc 1341 switch ($this->config->passtype) {
1342 case 'md5':
1343 $extpassword = '{MD5}' . base64_encode(pack('H*', md5($extpassword)));
1344 break;
1345 case 'sha1':
1346 $extpassword = '{SHA}' . base64_encode(pack('H*', sha1($extpassword)));
1347 break;
1348 case 'plaintext':
1349 default:
1350 break; // plaintext
1351 }
1352
b9ddb2d5 1353 $ldapconnection = $this->ldap_connect();
1354
139ebfdb 1355 $user_dn = $this->ldap_find_userdn($ldapconnection, $extusername);
1356
b9ddb2d5 1357 if (!$user_dn) {
fcf46da1 1358 error_log($this->errorlogtag.get_string ('nodnforusername', 'auth_ldap', $user->username));
b9ddb2d5 1359 return false;
1360 }
1361
1362 switch ($this->config->user_type) {
1363 case 'edir':
fcf46da1 1364 // Change password
139ebfdb 1365 $result = ldap_modify($ldapconnection, $user_dn, array('userPassword' => $extpassword));
b9ddb2d5 1366 if (!$result) {
fcf46da1
I
1367 error_log($this->errorlogtag.get_string ('updatepasserror', 'auth_ldap',
1368 array('errno'=>ldap_errno($ldapconnection),
1369 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)))));
b9ddb2d5 1370 }
fcf46da1
I
1371 // Update password expiration time, grace logins count
1372 $search_attribs = array($this->config->expireattr, 'passwordExpirationInterval', 'loginGraceLimit');
cfcb7a17 1373 $sr = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs);
fcf46da1
I
1374 if ($sr) {
1375 $entry = ldap_get_entries_moodle($ldapconnection, $sr);
67bebb69 1376 $info = $entry[0];
b9ddb2d5 1377 $newattrs = array();
fcf46da1
I
1378 if (!empty($info[$this->config->expireattr][0])) {
1379 // Set expiration time only if passwordExpirationInterval is defined
1380 if (!empty($info['passwordexpirationinterval'][0])) {
1381 $expirationtime = time() + $info['passwordexpirationinterval'][0];
b9ddb2d5 1382 $ldapexpirationtime = $this->ldap_unix2expirationtime($expirationtime);
1383 $newattrs['passwordExpirationTime'] = $ldapexpirationtime;
139ebfdb 1384 }
b9ddb2d5 1385
fcf46da1
I
1386 // Set gracelogin count
1387 if (!empty($info['logingracelimit'][0])) {
1388 $newattrs['loginGraceRemaining']= $info['logingracelimit'][0];
b9ddb2d5 1389 }
139ebfdb 1390
fcf46da1 1391 // Store attribute changes in LDAP
b9ddb2d5 1392 $result = ldap_modify($ldapconnection, $user_dn, $newattrs);
1393 if (!$result) {
fcf46da1
I
1394 error_log($this->errorlogtag.get_string ('updatepasserrorexpiregrace', 'auth_ldap',
1395 array('errno'=>ldap_errno($ldapconnection),
1396 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)))));
b9ddb2d5 1397 }
1398 }
1399 }
1400 else {
fcf46da1
I
1401 error_log($this->errorlogtag.get_string ('updatepasserrorexpire', 'auth_ldap',
1402 array('errno'=>ldap_errno($ldapconnection),
1403 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)))));
d0e84e1b 1404 }
1405 break;
1406
1407 case 'ad':
1408 // Passwords in Active Directory must be encoded as Unicode
1409 // strings (UCS-2 Little Endian format) and surrounded with
1410 // double quotes. See http://support.microsoft.com/?kbid=269190
1411 if (!function_exists('mb_convert_encoding')) {
fcf46da1 1412 error_log($this->errorlogtag.get_string ('needmbstring', 'auth_ldap'));
d0e84e1b 1413 return false;
1414 }
1415 $extpassword = mb_convert_encoding('"'.$extpassword.'"', "UCS-2LE", $this->config->ldapencoding);
1416 $result = ldap_modify($ldapconnection, $user_dn, array('unicodePwd' => $extpassword));
1417 if (!$result) {
fcf46da1
I
1418 error_log($this->errorlogtag.get_string ('updatepasserror', 'auth_ldap',
1419 array('errno'=>ldap_errno($ldapconnection),
1420 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)))));
139ebfdb 1421 }
b9ddb2d5 1422 break;
139ebfdb 1423
b9ddb2d5 1424 default:
fcf46da1 1425 // Send LDAP the password in cleartext, it will md5 it itself
139ebfdb 1426 $result = ldap_modify($ldapconnection, $user_dn, array('userPassword' => $extpassword));
b9ddb2d5 1427 if (!$result) {
fcf46da1
I
1428 error_log($this->errorlogtag.get_string ('updatepasserror', 'auth_ldap',
1429 array('errno'=>ldap_errno($ldapconnection),
1430 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)))));
b9ddb2d5 1431 }
139ebfdb 1432
b9ddb2d5 1433 }
1434
eee34307 1435 $this->ldap_close();
b9ddb2d5 1436 return $result;
1437 }
1438
b9ddb2d5 1439 /**
fcf46da1 1440 * Take expirationtime and return it as unix timestamp in seconds
b9ddb2d5 1441 *
fcf46da1
I
1442 * Takes expiration timestamp as read from LDAP and returns it as unix timestamp in seconds
1443 * Depends on $this->config->user_type variable
b9ddb2d5 1444 *
fcf46da1
I
1445 * @param mixed time Time stamp read from LDAP as it is.
1446 * @param string $ldapconnection Only needed for Active Directory.
1447 * @param string $user_dn User distinguished name for the user we are checking password expiration (only needed for Active Directory).
b9ddb2d5 1448 * @return timestamp
1449 */
bffe39c6 1450 function ldap_expirationtime2unix ($time, $ldapconnection, $user_dn) {
b9ddb2d5 1451 $result = false;
1452 switch ($this->config->user_type) {
1453 case 'edir':
fcf46da1
I
1454 $yr=substr($time, 0, 4);
1455 $mo=substr($time, 4, 2);
1456 $dt=substr($time, 6, 2);
1457 $hr=substr($time, 8, 2);
1458 $min=substr($time, 10, 2);
1459 $sec=substr($time, 12, 2);
1460 $result = mktime($hr, $min, $sec, $mo, $dt, $yr);
b9ddb2d5 1461 break;
9347082d 1462 case 'rfc2307':
1463 case 'rfc2307bis':
fcf46da1 1464 $result = $time * DAYSECS; // The shadowExpire contains the number of DAYS between 01/01/1970 and the actual expiration date
b9ddb2d5 1465 break;
bffe39c6 1466 case 'ad':
1467 $result = $this->ldap_get_ad_pwdexpire($time, $ldapconnection, $user_dn);
1468 break;
139ebfdb 1469 default:
2b06294b 1470 print_error('auth_ldap_usertypeundefined', 'auth_ldap');
b9ddb2d5 1471 }
1472 return $result;
1473 }
1474
1475 /**
fcf46da1 1476 * Takes unix timestamp and returns it formated for storing in LDAP
b9ddb2d5 1477 *
1478 * @param integer unix time stamp
1479 */
1480 function ldap_unix2expirationtime($time) {
b9ddb2d5 1481 $result = false;
1482 switch ($this->config->user_type) {
1483 case 'edir':
139ebfdb 1484 $result=date('YmdHis', $time).'Z';
b9ddb2d5 1485 break;
9347082d 1486 case 'rfc2307':
1487 case 'rfc2307bis':
fcf46da1 1488 $result = $time ; // Already in correct format
b9ddb2d5 1489 break;
139ebfdb 1490 default:
2b06294b 1491 print_error('auth_ldap_usertypeundefined2', 'auth_ldap');
139ebfdb 1492 }
b9ddb2d5 1493 return $result;
1494
1495 }
1496
139ebfdb 1497 /**
fcf46da1 1498 * Returns user attribute mappings between moodle and LDAP
b9ddb2d5 1499 *
1500 * @return array
1501 */
1502
1503 function ldap_attributes () {
b9ddb2d5 1504 $moodleattributes = array();
d836e3ed
RT
1505 // If we have custom fields then merge them with user fields.
1506 $customfields = $this->get_custom_user_profile_fields();
1507 if (!empty($customfields) && !empty($this->userfields)) {
1508 $userfields = array_merge($this->userfields, $customfields);
1509 } else {
1510 $userfields = $this->userfields;
1511 }
1512
1513 foreach ($userfields as $field) {
b9ddb2d5 1514 if (!empty($this->config->{"field_map_$field"})) {
2f1e464a 1515 $moodleattributes[$field] = core_text::strtolower(trim($this->config->{"field_map_$field"}));
fcf46da1 1516 if (preg_match('/,/', $moodleattributes[$field])) {
b9ddb2d5 1517 $moodleattributes[$field] = explode(',', $moodleattributes[$field]); // split ?
1518 }
1519 }
1520 }
2f1e464a 1521 $moodleattributes['username'] = core_text::strtolower(trim($this->config->user_attribute));
6141dcfe 1522 $moodleattributes['suspended'] = core_text::strtolower(trim($this->config->suspended_attribute));
b9ddb2d5 1523 return $moodleattributes;
1524 }
1525
1526 /**
fcf46da1 1527 * Returns all usernames from LDAP
b9ddb2d5 1528 *
fcf46da1
I
1529 * @param $filter An LDAP search filter to select desired users
1530 * @return array of LDAP user names converted to UTF-8
b9ddb2d5 1531 */
fcf46da1 1532 function ldap_get_userlist($filter='*') {
b9ddb2d5 1533 $fresult = array();
1534
1535 $ldapconnection = $this->ldap_connect();
1536
fcf46da1 1537 if ($filter == '*') {
cfcb7a17 1538 $filter = '(&('.$this->config->user_attribute.'=*)'.$this->config->objectclass.')';
b9ddb2d5 1539 }
988f9bf5 1540 $servercontrols = array();
b9ddb2d5 1541
fcf46da1 1542 $contexts = explode(';', $this->config->contexts);
b9ddb2d5 1543 if (!empty($this->config->create_context)) {
c090d7c9 1544 array_push($contexts, $this->config->create_context);
b9ddb2d5 1545 }
1546
fcf21760 1547 $ldap_cookie = '';
e47863e8 1548 $ldap_pagedresults = ldap_paged_results_supported($this->config->ldap_version, $ldapconnection);
b9ddb2d5 1549 foreach ($contexts as $context) {
b9ddb2d5 1550 $context = trim($context);
1551 if (empty($context)) {
1552 continue;
1553 }
1554
c090d7c9
IA
1555 do {
1556 if ($ldap_pagedresults) {
74ee34fd 1557 // TODO: Remove the old branch of code once PHP 7.3.0 becomes required (Moodle 3.11).
988f9bf5
EL
1558 if (version_compare(PHP_VERSION, '7.3.0', '<')) {
1559 // Before 7.3, use this function that was deprecated in PHP 7.4.
1560 ldap_control_paged_result($ldapconnection, $this->config->pagesize, true, $ldap_cookie);
1561 } else {
1562 // PHP 7.3 and up, use server controls.
1563 $servercontrols = array(array(
1564 'oid' => LDAP_CONTROL_PAGEDRESULTS, 'value' => array(
1565 'size' => $this->config->pagesize, 'cookie' => $ldap_cookie)));
1566 }
c090d7c9
IA
1567 }
1568 if ($this->config->search_sub) {
1569 // Use ldap_search to find first user from subtree.
74ee34fd 1570 // TODO: Remove the old branch of code once PHP 7.3.0 becomes required (Moodle 3.11).
988f9bf5
EL
1571 if (version_compare(PHP_VERSION, '7.3.0', '<')) {
1572 $ldap_result = ldap_search($ldapconnection, $context, $filter, array($this->config->user_attribute));
1573 } else {
1574 $ldap_result = ldap_search($ldapconnection, $context, $filter, array($this->config->user_attribute),
1575 0, -1, -1, LDAP_DEREF_NEVER, $servercontrols);
1576 }
c090d7c9
IA
1577 } else {
1578 // Search only in this context.
74ee34fd 1579 // TODO: Remove the old branch of code once PHP 7.3.0 becomes required (Moodle 3.11).
988f9bf5
EL
1580 if (version_compare(PHP_VERSION, '7.3.0', '<')) {
1581 $ldap_result = ldap_list($ldapconnection, $context, $filter, array($this->config->user_attribute));
1582 } else {
1583 $ldap_result = ldap_list($ldapconnection, $context, $filter, array($this->config->user_attribute),
1584 0, -1, -1, LDAP_DEREF_NEVER, $servercontrols);
1585 }
c090d7c9
IA
1586 }
1587 if(!$ldap_result) {
1588 continue;
1589 }
1590 if ($ldap_pagedresults) {
988f9bf5
EL
1591 // Get next server cookie to know if we'll need to continue searching.
1592 $ldap_cookie = '';
74ee34fd 1593 // TODO: Remove the old branch of code once PHP 7.3.0 becomes required (Moodle 3.11).
988f9bf5
EL
1594 if (version_compare(PHP_VERSION, '7.3.0', '<')) {
1595 // Before 7.3, use this function that was deprecated in PHP 7.4.
1596 ldap_control_paged_result_response($ldapconnection, $ldap_result, $ldap_cookie);
1597 } else {
1598 // Get next cookie from controls.
1599 ldap_parse_result($ldapconnection, $ldap_result, $errcode, $matcheddn,
1600 $errmsg, $referrals, $controls);
1601 if (isset($controls[LDAP_CONTROL_PAGEDRESULTS]['value']['cookie'])) {
1602 $ldap_cookie = $controls[LDAP_CONTROL_PAGEDRESULTS]['value']['cookie'];
1603 }
1604 }
c090d7c9
IA
1605 }
1606 $users = ldap_get_entries_moodle($ldapconnection, $ldap_result);
1607 // Add found users to list.
1608 for ($i = 0; $i < count($users); $i++) {
2f1e464a 1609 $extuser = core_text::convert($users[$i][$this->config->user_attribute][0],
c090d7c9
IA
1610 $this->config->ldapencoding, 'utf-8');
1611 array_push($fresult, $extuser);
1612 }
1613 unset($ldap_result); // Free mem.
1614 } while ($ldap_pagedresults && !empty($ldap_cookie));
b9ddb2d5 1615 }
139ebfdb 1616
c090d7c9
IA
1617 // If paged results were used, make sure the current connection is completely closed
1618 $this->ldap_close($ldap_pagedresults);
b9ddb2d5 1619 return $fresult;
1620 }
1621
1622 /**
fcf46da1 1623 * Indicates if password hashes should be stored in local moodle database.
b9ddb2d5 1624 *
fcf46da1 1625 * @return bool true means flag 'not_cached' stored instead of password hash
b9ddb2d5 1626 */
edb5da83
PS
1627 function prevent_local_passwords() {
1628 return !empty($this->config->preventpassindb);
1629 }
1630
b9ddb2d5 1631 /**
1632 * Returns true if this authentication plugin is 'internal'.
1633 *
139ebfdb 1634 * @return bool
b9ddb2d5 1635 */
1636 function is_internal() {
1637 return false;
1638 }
1639
1640 /**
1641 * Returns true if this authentication plugin can change the user's
1642 * password.
1643 *
139ebfdb 1644 * @return bool
b9ddb2d5 1645 */
1646 function can_change_password() {
430759a5 1647 return !empty($this->config->stdchangepassword) or !empty($this->config->changepasswordurl);
b9ddb2d5 1648 }
139ebfdb 1649
b9ddb2d5 1650 /**
fcf46da1 1651 * Returns the URL for changing the user's password, or empty if the default can
b9ddb2d5 1652 * be used.
1653 *
99f9f85f 1654 * @return moodle_url
b9ddb2d5 1655 */
1656 function change_password_url() {
139ebfdb 1657 if (empty($this->config->stdchangepassword)) {
963cdce4
AA
1658 if (!empty($this->config->changepasswordurl)) {
1659 return new moodle_url($this->config->changepasswordurl);
1660 } else {
1661 return null;
1662 }
139ebfdb 1663 } else {
99f9f85f 1664 return null;
139ebfdb 1665 }
b9ddb2d5 1666 }
139ebfdb 1667
1e8713ea 1668 /**
fcf46da1 1669 * Will get called before the login page is shownr. Ff NTLM SSO
1e8713ea 1670 * is enabled, and the user is in the right network, we'll redirect
1671 * to the magic NTLM page for SSO...
1672 *
1673 */
1674 function loginpage_hook() {
4194d321 1675 global $CFG, $SESSION;
265edb48 1676
1677 // HTTPS is potentially required
17c70aa0 1678 //httpsrequired(); - this must be used before setting the URL, it is already done on the login/index.php
5117d598 1679
4194d321 1680 if (($_SERVER['REQUEST_METHOD'] === 'GET' // Only on initial GET of loginpage
fcf46da1 1681 || ($_SERVER['REQUEST_METHOD'] === 'POST'
dcee0b94 1682 && (get_local_referer() != strip_querystring(qualified_me()))))
fcf46da1
I
1683 // Or when POSTed from another place
1684 // See MDL-14071
1685 && !empty($this->config->ntlmsso_enabled) // SSO enabled
1686 && !empty($this->config->ntlmsso_subnet) // have a subnet to test for
1687 && empty($_GET['authldap_skipntlmsso']) // haven't failed it yet
1688 && (isguestuser() || !isloggedin()) // guestuser or not-logged-in users
b8aa76c1 1689 && address_in_subnet(getremoteaddr(), $this->config->ntlmsso_subnet)) {
4194d321 1690
1691 // First, let's remember where we were trying to get to before we got here
1692 if (empty($SESSION->wantsurl)) {
dcee0b94 1693 $SESSION->wantsurl = null;
25565918 1694 $referer = get_local_referer(false);
dcee0b94
SL
1695 if ($referer &&
1696 $referer != $CFG->wwwroot &&
1697 $referer != $CFG->wwwroot . '/' &&
672f4836
JO
1698 $referer != $CFG->wwwroot . '/login/' &&
1699 $referer != $CFG->wwwroot . '/login/index.php') {
dcee0b94
SL
1700 $SESSION->wantsurl = $referer;
1701 }
4194d321 1702 }
02c7f3d9 1703
4194d321 1704 // Now start the whole NTLM machinery.
d962e814
DM
1705 if($this->config->ntlmsso_ie_fastpath == AUTH_NTLM_FASTPATH_YESATTEMPT ||
1706 $this->config->ntlmsso_ie_fastpath == AUTH_NTLM_FASTPATH_YESFORM) {
378b3eac 1707 if (core_useragent::is_ie()) {
16ceeb64 1708 $sesskey = sesskey();
1709 redirect($CFG->wwwroot.'/auth/ldap/ntlmsso_magic.php?sesskey='.$sesskey);
d962e814 1710 } else if ($this->config->ntlmsso_ie_fastpath == AUTH_NTLM_FASTPATH_YESFORM) {
0c64c64b 1711 redirect($CFG->wwwroot.'/login/index.php?authldap_skipntlmsso=1');
16ceeb64 1712 }
16ceeb64 1713 }
d962e814 1714 redirect($CFG->wwwroot.'/auth/ldap/ntlmsso_attempt.php');
4194d321 1715 }
5117d598 1716
4194d321 1717 // No NTLM SSO, Use the normal login page instead.
1718
1719 // If $SESSION->wantsurl is empty and we have a 'Referer:' header, the login
1720 // page insists on redirecting us to that page after user validation. If
fcf46da1
I
1721 // we clicked on the redirect link at the ntlmsso_finish.php page (instead
1722 // of waiting for the redirection to happen) then we have a 'Referer:' header
4194d321 1723 // we don't want to use at all. As we can't get rid of it, just point
1724 // $SESSION->wantsurl to $CFG->wwwroot (after all, we came from there).
1725 if (empty($SESSION->wantsurl)
672f4836 1726 && (get_local_referer() == $CFG->wwwroot.'/auth/ldap/ntlmsso_finish.php')) {
4194d321 1727
1728 $SESSION->wantsurl = $CFG->wwwroot;
1e8713ea 1729 }
1730 }
1731
1732 /**
1733 * To be called from a page running under NTLM's
5117d598 1734 * "Integrated Windows Authentication".
1e8713ea 1735 *
5117d598 1736 * If successful, it will set a special "cookie" (not an HTTP cookie!)
fcf46da1 1737 * in cache_flags under the $this->pluginconfig/ntlmsess "plugin" and return true.
1e8713ea 1738 * The "cookie" will be picked up by ntlmsso_finish() to complete the
1739 * process.
1740 *
1741 * On failure it will return false for the caller to display an appropriate
decd8016 1742 * error message (probably saying that Integrated Windows Auth isn't enabled!)
1e8713ea 1743 *
5117d598 1744 * NOTE that this code will execute under the OS user credentials,
1e8713ea 1745 * so we MUST avoid dealing with files -- such as session files.
6800d78e 1746 * (The caller should define('NO_MOODLE_COOKIES', true) before including config.php)
1e8713ea 1747 *
1748 */
decd8016 1749 function ntlmsso_magic($sesskey) {
1750 if (isset($_SERVER['REMOTE_USER']) && !empty($_SERVER['REMOTE_USER'])) {
4194d321 1751
1752 // HTTP __headers__ seem to be sent in ISO-8859-1 encoding
1753 // (according to my reading of RFC-1945, RFC-2616 and RFC-2617 and
1754 // my local tests), so we need to convert the REMOTE_USER value
1755 // (i.e., what we got from the HTTP WWW-Authenticate header) into UTF-8
2f1e464a 1756 $username = core_text::convert($_SERVER['REMOTE_USER'], 'iso-8859-1', 'utf-8');
4194d321 1757
fcf46da1
I
1758 switch ($this->config->ntlmsso_type) {
1759 case 'ntlm':
34b10e26
IA
1760 // The format is now configurable, so try to extract the username
1761 $username = $this->get_ntlm_remote_user($username);
1762 if (empty($username)) {
1763 return false;
1764 }
fcf46da1
I
1765 break;
1766 case 'kerberos':
1767 // Format is username@DOMAIN
1768 $username = substr($username, 0, strpos($username, '@'));
1769 break;
1770 default:
1771 error_log($this->errorlogtag.get_string ('ntlmsso_unknowntype', 'auth_ldap'));
1772 return false; // Should never happen!
1773 }
1774
2f1e464a 1775 $username = core_text::strtolower($username); // Compatibility hack
fcf46da1 1776 set_cache_flag($this->pluginconfig.'/ntlmsess', $sesskey, $username, AUTH_NTLMTIMEOUT);
065e2cc0 1777 return true;
decd8016 1778 }
1779 return false;
1e8713ea 1780 }
1781
1782 /**
5117d598 1783 * Find the session set by ntlmsso_magic(), validate it and
decd8016 1784 * call authenticate_user_login() to authenticate the user through
1785 * the auth machinery.
5117d598 1786 *
decd8016 1787 * It is complemented by a similar check in user_login().
5117d598
PS
1788 *
1789 * If it succeeds, it never returns.
decd8016 1790 *
1e8713ea 1791 */
1792 function ntlmsso_finish() {
4025cf80 1793 global $CFG, $USER, $SESSION;
02c7f3d9 1794
065e2cc0 1795 $key = sesskey();
9651175f
JC
1796 $username = get_cache_flag($this->pluginconfig.'/ntlmsess', $key);
1797 if (empty($username)) {
065e2cc0 1798 return false;
1799 }
5991cabf 1800
065e2cc0 1801 // Here we want to trigger the whole authentication machinery
1802 // to make sure no step is bypassed...
6dfe4283
DW
1803 $reason = null;
1804 $user = authenticate_user_login($username, $key, false, $reason, false);
065e2cc0 1805 if ($user) {
b7b64ff2 1806 complete_user_login($user);
065e2cc0 1807
1808 // Cleanup the key to prevent reuse...
1809 // and to allow re-logins with normal credentials
fcf46da1 1810 unset_cache_flag($this->pluginconfig.'/ntlmsess', $key);
065e2cc0 1811
fcf46da1 1812 // Redirection
8df850ad 1813 if (user_not_fully_set_up($USER, true)) {
065e2cc0 1814 $urltogo = $CFG->wwwroot.'/user/edit.php';
1815 // We don't delete $SESSION->wantsurl yet, so we get there later
1816 } else if (isset($SESSION->wantsurl) and (strpos($SESSION->wantsurl, $CFG->wwwroot) === 0)) {
fcf46da1 1817 $urltogo = $SESSION->wantsurl; // Because it's an address in this site
065e2cc0 1818 unset($SESSION->wantsurl);
1819 } else {
fcf46da1 1820 // No wantsurl stored or external - go to homepage
065e2cc0 1821 $urltogo = $CFG->wwwroot.'/';
1822 unset($SESSION->wantsurl);
decd8016 1823 }
5991cabf
MN
1824 // We do not want to redirect if we are in a PHPUnit test.
1825 if (!PHPUNIT_TEST) {
1826 redirect($urltogo);
1827 }
decd8016 1828 }
065e2cc0 1829 // Should never reach here.
decd8016 1830 return false;
5117d598 1831 }
1e8713ea 1832
6bc1e5d5 1833 /**
8fb9a271 1834 * Sync roles for this user.
6bc1e5d5 1835 *
8fb9a271 1836 * @param object $user The user to sync (without system magic quotes).
6bc1e5d5 1837 */
1838 function sync_roles($user) {
8fb9a271 1839 global $DB;
6bc1e5d5 1840
8fb9a271 1841 $roles = get_ldap_assignable_role_names(2); // Admin user.
6bc1e5d5 1842
8fb9a271
DB
1843 foreach ($roles as $role) {
1844 $isrole = $this->is_role($user->username, $role);
1845 if ($isrole === null) {
1846 continue; // Nothing to sync - role/LDAP contexts not configured.
1847 }
1848
1849 // Sync user.
1850 $systemcontext = context_system::instance();
1851 if ($isrole) {
1852 // Following calls will not create duplicates.
1853 role_assign($role['id'], $user->id, $systemcontext->id, $this->roleauth);
6bc1e5d5 1854 } else {
8fb9a271
DB
1855 // Unassign only if previously assigned by this plugin.
1856 role_unassign($role['id'], $user->id, $systemcontext->id, $this->roleauth);
6bc1e5d5 1857 }
1858 }
1859 }
1860
bffe39c6 1861 /**
1862 * Get password expiration time for a given user from Active Directory
1863 *
1864 * @param string $pwdlastset The time last time we changed the password.
1865 * @param resource $lcapconn The open LDAP connection.
1866 * @param string $user_dn The distinguished name of the user we are checking.
1867 *
1868 * @return string $unixtime
1869 */
1870 function ldap_get_ad_pwdexpire($pwdlastset, $ldapconn, $user_dn){
bffe39c6 1871 global $CFG;
1872
1873 if (!function_exists('bcsub')) {
fcf46da1 1874 error_log($this->errorlogtag.get_string ('needbcmath', 'auth_ldap'));
bffe39c6 1875 return 0;
1876 }
1877
1878 // If UF_DONT_EXPIRE_PASSWD flag is set in user's
1879 // userAccountControl attribute, the password doesn't expire.
cfcb7a17 1880 $sr = ldap_read($ldapconn, $user_dn, '(objectClass=*)',
bffe39c6 1881 array('userAccountControl'));
1882 if (!$sr) {
fcf46da1
I
1883 error_log($this->errorlogtag.get_string ('useracctctrlerror', 'auth_ldap', $user_dn));
1884 // Don't expire password, as we are not sure if it has to be
bffe39c6 1885 // expired or not.
1886 return 0;
1887 }
e295df44 1888
fcf46da1 1889 $entry = ldap_get_entries_moodle($ldapconn, $sr);
67bebb69 1890 $info = $entry[0];
fcf46da1 1891 $useraccountcontrol = $info['useraccountcontrol'][0];
bffe39c6 1892 if ($useraccountcontrol & UF_DONT_EXPIRE_PASSWD) {
fcf46da1 1893 // Password doesn't expire.
bffe39c6 1894 return 0;
1895 }
e295df44 1896
bffe39c6 1897 // If pwdLastSet is zero, the user must change his/her password now
1898 // (unless UF_DONT_EXPIRE_PASSWD flag is set, but we already
1899 // tested this above)
1900 if ($pwdlastset === '0') {
fcf46da1 1901 // Password has expired
bffe39c6 1902 return -1;
1903 }
e295df44 1904
bffe39c6 1905 // ----------------------------------------------------------------
1906 // Password expiration time in Active Directory is the composition of
1907 // two values:
1908 //
1909 // - User's pwdLastSet attribute, that stores the last time
1910 // the password was changed.
1911 //
1912 // - Domain's maxPwdAge attribute, that sets how long
1913 // passwords last in this domain.
1914 //
1915 // We already have the first value (passed in as a parameter). We
1916 // need to get the second one. As we don't know the domain DN, we
1917 // have to query rootDSE's defaultNamingContext attribute to get
1918 // it. Then we have to query that DN's maxPwdAge attribute to get
1919 // the real value.
1920 //
1921 // Once we have both values, we just need to combine them. But MS
1922 // chose to use a different base and unit for time measurements.
1923 // So we need to convert the values to Unix timestamps (see
1924 // details below).
1925 // ----------------------------------------------------------------
e295df44 1926
cfcb7a17 1927 $sr = ldap_read($ldapconn, ROOTDSE, '(objectClass=*)',
bffe39c6 1928 array('defaultNamingContext'));
1929 if (!$sr) {
fcf46da1 1930 error_log($this->errorlogtag.get_string ('rootdseerror', 'auth_ldap'));
bffe39c6 1931 return 0;
1932 }
e295df44 1933
fcf46da1 1934 $entry = ldap_get_entries_moodle($ldapconn, $sr);
67bebb69 1935 $info = $entry[0];
fcf46da1 1936 $domaindn = $info['defaultnamingcontext'][0];
e295df44 1937
cfcb7a17 1938 $sr = ldap_read ($ldapconn, $domaindn, '(objectClass=*)',
bffe39c6 1939 array('maxPwdAge'));
fcf46da1 1940 $entry = ldap_get_entries_moodle($ldapconn, $sr);
67bebb69 1941 $info = $entry[0];
fcf46da1 1942 $maxpwdage = $info['maxpwdage'][0];
b4a5d4fa 1943 if ($sr = ldap_read($ldapconn, $user_dn, '(objectClass=*)', array('msDS-ResultantPSO'))) {
c1bc628e 1944 if ($entry = ldap_get_entries_moodle($ldapconn, $sr)) {
67bebb69 1945 $info = $entry[0];
c1bc628e
SL
1946 $userpso = $info['msds-resultantpso'][0];
1947
1948 // If a PSO exists, FGPP is being utilized.
1949 // Grab the new maxpwdage from the msDS-MaximumPasswordAge attribute of the PSO.
1950 if (!empty($userpso)) {
b4a5d4fa 1951 $sr = ldap_read($ldapconn, $userpso, '(objectClass=*)', array('msDS-MaximumPasswordAge'));
c1bc628e 1952 if ($entry = ldap_get_entries_moodle($ldapconn, $sr)) {
67bebb69 1953 $info = $entry[0];
b4a5d4fa 1954 // Default value of msds-maximumpasswordage is 42 and is always set.
c1bc628e
SL
1955 $maxpwdage = $info['msds-maximumpasswordage'][0];
1956 }
1957 }
1958 }
1959 }
bffe39c6 1960 // ----------------------------------------------------------------
1961 // MSDN says that "pwdLastSet contains the number of 100 nanosecond
1962 // intervals since January 1, 1601 (UTC), stored in a 64 bit integer".
1963 //
1964 // According to Perl's Date::Manip, the number of seconds between
1965 // this date and Unix epoch is 11644473600. So we have to
1966 // substract this value to calculate a Unix time, once we have
1967 // scaled pwdLastSet to seconds. This is the script used to
1968 // calculate the value shown above:
1969 //
1970 // #!/usr/bin/perl -w
1971 //
1972 // use Date::Manip;
1973 //
1974 // $date1 = ParseDate ("160101010000 UTC");
1975 // $date2 = ParseDate ("197001010000 UTC");
1976 // $delta = DateCalc($date1, $date2, \$err);
1977 // $secs = Delta_Format($delta, 0, "%st");
1978 // print "$secs \n";
1979 //
1980 // MSDN also says that "maxPwdAge is stored as a large integer that
1981 // represents the number of 100 nanosecond intervals from the time
1982 // the password was set before the password expires." We also need
1983 // to scale this to seconds. Bear in mind that this value is stored
1984 // as a _negative_ quantity (at least in my AD domain).
1985 //
1986 // As a last remark, if the low 32 bits of maxPwdAge are equal to 0,
1987 // the maximum password age in the domain is set to 0, which means
e295df44 1988 // passwords do not expire (see
bffe39c6 1989 // http://msdn2.microsoft.com/en-us/library/ms974598.aspx)
1990 //
1991 // As the quantities involved are too big for PHP integers, we
1992 // need to use BCMath functions to work with arbitrary precision
1993 // numbers.
1994 // ----------------------------------------------------------------
e295df44 1995
bffe39c6 1996 // If the low order 32 bits are 0, then passwords do not expire in
1997 // the domain. Just do '$maxpwdage mod 2^32' and check the result
1998 // (2^32 = 4294967296)
1999 if (bcmod ($maxpwdage, 4294967296) === '0') {
2000 return 0;
2001 }
2002
2003 // Add up pwdLastSet and maxPwdAge to get password expiration
2004 // time, in MS time units. Remember maxPwdAge is stored as a
2005 // _negative_ quantity, so we need to substract it in fact.
2006 $pwdexpire = bcsub ($pwdlastset, $maxpwdage);
e295df44 2007
bffe39c6 2008 // Scale the result to convert it to Unix time units and return
2009 // that value.
2010 return bcsub( bcdiv($pwdexpire, '10000000'), '11644473600');
2011 }
2012
fcf46da1
I
2013 /**
2014 * Connect to the LDAP server, using the plugin configured
2015 * settings. It's actually a wrapper around ldap_connect_moodle()
2016 *
2017 * @return resource A valid LDAP connection (or dies if it can't connect)
2018 */
2019 function ldap_connect() {
2020 // Cache ldap connections. They are expensive to set up
2021 // and can drain the TCP/IP ressources on the server if we
2022 // are syncing a lot of users (as we try to open a new connection
2023 // to get the user details). This is the least invasive way
2024 // to reuse existing connections without greater code surgery.
2025 if(!empty($this->ldapconnection)) {
2026 $this->ldapconns++;
2027 return $this->ldapconnection;
2028 }
2029
2030 if($ldapconnection = ldap_connect_moodle($this->config->host_url, $this->config->ldap_version,
2031 $this->config->user_type, $this->config->bind_dn,
2032 $this->config->bind_pw, $this->config->opt_deref,
326929d5 2033 $debuginfo, $this->config->start_tls)) {
fcf46da1
I
2034 $this->ldapconns = 1;
2035 $this->ldapconnection = $ldapconnection;
2036 return $ldapconnection;
2037 }
b9ddb2d5 2038
fcf46da1
I
2039 print_error('auth_ldap_noconnect_all', 'auth_ldap', '', $debuginfo);
2040 }
2041
2042 /**
2043 * Disconnects from a LDAP server
2044 *
c090d7c9
IA
2045 * @param force boolean Forces closing the real connection to the LDAP server, ignoring any
2046 * cached connections. This is needed when we've used paged results
2047 * and want to use normal results again.
fcf46da1 2048 */
c090d7c9 2049 function ldap_close($force=false) {
fcf46da1 2050 $this->ldapconns--;
c090d7c9
IA
2051 if (($this->ldapconns == 0) || ($force)) {
2052 $this->ldapconns = 0;
fcf46da1
I
2053 @ldap_close($this->ldapconnection);
2054 unset($this->ldapconnection);
2055 }
2056 }
2057
2058 /**
2059 * Search specified contexts for username and return the user dn
2060 * like: cn=username,ou=suborg,o=org. It's actually a wrapper
2061 * around ldap_find_userdn().
2062 *
2063 * @param resource $ldapconnection a valid LDAP connection
2064 * @param string $extusername the username to search (in external LDAP encoding, no db slashes)
2065 * @return mixed the user dn (external LDAP encoding) or false
2066 */
2067 function ldap_find_userdn($ldapconnection, $extusername) {
2068 $ldap_contexts = explode(';', $this->config->contexts);
2069 if (!empty($this->config->create_context)) {
2070 array_push($ldap_contexts, $this->config->create_context);
2071 }
2072
2073 return ldap_find_userdn($ldapconnection, $extusername, $ldap_contexts, $this->config->objectclass,
2074 $this->config->user_attribute, $this->config->search_sub);
2075 }
5117d598 2076
34b10e26
IA
2077 /**
2078 * When using NTLM SSO, the format of the remote username we get in
2079 * $_SERVER['REMOTE_USER'] may vary, depending on where from and how the web
2080 * server gets the data. So we let the admin configure the format using two
2081 * place holders (%domain% and %username%). This function tries to extract
2082 * the username (stripping the domain part and any separators if they are
2083 * present) from the value present in $_SERVER['REMOTE_USER'], using the
2084 * configured format.
2085 *
2086 * @param string $remoteuser The value from $_SERVER['REMOTE_USER'] (converted to UTF-8)
2087 *
2088 * @return string The remote username (without domain part or
2089 * separators). Empty string if we can't extract the username.
2090 */
2091 protected function get_ntlm_remote_user($remoteuser) {
2092 if (empty($this->config->ntlmsso_remoteuserformat)) {
2093 $format = AUTH_NTLM_DEFAULT_FORMAT;
2094 } else {
2095 $format = $this->config->ntlmsso_remoteuserformat;
2096 }
2097
2098 $format = preg_quote($format);
2099 $formatregex = preg_replace(array('#%domain%#', '#%username%#'),
2100 array('('.AUTH_NTLM_VALID_DOMAINNAME.')', '('.AUTH_NTLM_VALID_USERNAME.')'),
2101 $format);
2102 if (preg_match('#^'.$formatregex.'$#', $remoteuser, $matches)) {
2103 $user = end($matches);
2104 return $user;
2105 }
2106
2107 /* We are unable to extract the username with the configured format. Probably
2108 * the format specified is wrong, so log a warning for the admin and return
2109 * an empty username.
2110 */
2111 error_log($this->errorlogtag.get_string ('auth_ntlmsso_maybeinvalidformat', 'auth_ldap'));
2112 return '';
2113 }
2114
cd37c1da
IA
2115 /**
2116 * Check if the diagnostic message for the LDAP login error tells us that the
2117 * login is denied because the user password has expired or the password needs
2118 * to be changed on first login (using interactive SMB/Windows logins, not
2119 * LDAP logins).
2120 *
2121 * @param string the diagnostic message for the LDAP login error
2122 * @return bool true if the password has expired or the password must be changed on first login
2123 */
2124 protected function ldap_ad_pwdexpired_from_diagmsg($diagmsg) {
2125 // The format of the diagnostic message is (actual examples from W2003 and W2008):
2126 // "80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece" (W2003)
2127 // "80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 773, vece" (W2003)
2128 // "80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 52e, v1771" (W2008)
2129 // "80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 773, v1771" (W2008)
2130 // We are interested in the 'data nnn' part.
2131 // if nnn == 773 then user must change password on first login
2132 // if nnn == 532 then user password has expired
2133 $diagmsg = explode(',', $diagmsg);
2134 if (preg_match('/data (773|532)/i', trim($diagmsg[2]))) {
2135 return true;
2136 }
2137 return false;
2138 }
2139
6141dcfe
CB
2140 /**
2141 * Check if a user is suspended. This function is intended to be used after calling
2142 * get_userinfo_asobj. This is needed because LDAP doesn't have a notion of disabled
2143 * users, however things like MS Active Directory support it and expose information
2144 * through a field.
2145 *
2146 * @param object $user the user object returned by get_userinfo_asobj
2147 * @return boolean
2148 */
2149 protected function is_user_suspended($user) {
2150 if (!$this->config->suspended_attribute || !isset($user->suspended)) {
2151 return false;
2152 }
2153 if ($this->config->suspended_attribute == 'useraccountcontrol' && $this->config->user_type == 'ad') {
2154 return (bool)($user->suspended & AUTH_AD_ACCOUNTDISABLE);
2155 }
2156
2157 return (bool)$user->suspended;
2158 }
2159
e45c8637
MF
2160 /**
2161 * Test a DN
2162 *
2163 * @param resource $ldapconn
2164 * @param string $dn The DN to check for existence
2165 * @param string $message The identifier of a string as in get_string()
2166 * @param string|object|array $a An object, string or number that can be used
2167 * within translation strings as in get_string()
2168 * @return true or a message in case of error
2169 */
2170 private function test_dn($ldapconn, $dn, $message, $a = null) {
2171 $ldapresult = @ldap_read($ldapconn, $dn, '(objectClass=*)', array());
2172 if (!$ldapresult) {
2173 if (ldap_errno($ldapconn) == 32) {
2174 // No such object.
2175 return get_string($message, 'auth_ldap', $a);
2176 }
2177
2178 $a = array('code' => ldap_errno($ldapconn), 'subject' => $a, 'message' => ldap_error($ldapconn));
2179 return get_string('diag_genericerror', 'auth_ldap', $a);
2180 }
2181
2182 return true;
2183 }
2184
037273d8
SB
2185 /**
2186 * Test if settings are correct, print info to output.
2187 */
2188 public function test_settings() {
2189 global $OUTPUT;
2190
2191 if (!function_exists('ldap_connect')) { // Is php-ldap really there?
e45c8637 2192 echo $OUTPUT->notification(get_string('auth_ldap_noextension', 'auth_ldap'), \core\output\notification::NOTIFY_ERROR);
037273d8
SB
2193 return;
2194 }
2195
2196 // Check to see if this is actually configured.
e45c8637
MF
2197 if (empty($this->config->host_url)) {
2198 // LDAP is not even configured.
2199 echo $OUTPUT->notification(get_string('ldapnotconfigured', 'auth_ldap'), \core\output\notification::NOTIFY_ERROR);
2200 return;
2201 }
2202
2203 if ($this->config->ldap_version != 3) {
2204 echo $OUTPUT->notification(get_string('diag_toooldversion', 'auth_ldap'), \core\output\notification::NOTIFY_WARNING);
2205 }
2206
2207 try {
2208 $ldapconn = $this->ldap_connect();
2209 } catch (Exception $e) {
2210 echo $OUTPUT->notification($e->getMessage(), \core\output\notification::NOTIFY_ERROR);
2211 return;
2212 }
037273d8 2213
e45c8637
MF
2214 // Display paged file results.
2215 if (!ldap_paged_results_supported($this->config->ldap_version, $ldapconn)) {
2216 echo $OUTPUT->notification(get_string('pagedresultsnotsupp', 'auth_ldap'), \core\output\notification::NOTIFY_INFO);
2217 }
037273d8 2218
e45c8637
MF
2219 // Check contexts.
2220 foreach (explode(';', $this->config->contexts) as $context) {
2221 $context = trim($context);
2222 if (empty($context)) {
2223 echo $OUTPUT->notification(get_string('diag_emptycontext', 'auth_ldap'), \core\output\notification::NOTIFY_WARNING);
2224 continue;
037273d8
SB
2225 }
2226
e45c8637
MF
2227 $message = $this->test_dn($ldapconn, $context, 'diag_contextnotfound', $context);
2228 if ($message !== true) {
2229 echo $OUTPUT->notification($message, \core\output\notification::NOTIFY_WARNING);
037273d8 2230 }
e45c8637 2231 }
037273d8 2232
e45c8637
MF
2233 // Create system role mapping field for each assignable system role.
2234 $roles = get_ldap_assignable_role_names();
2235 foreach ($roles as $role) {
2236 foreach (explode(';', $this->config->{$role['settingname']}) as $groupdn) {
2237 if (empty($groupdn)) {
2238 continue;
2239 }
2240
2241 $role['group'] = $groupdn;
2242 $message = $this->test_dn($ldapconn, $groupdn, 'diag_rolegroupnotfound', $role);
2243 if ($message !== true) {
2244 echo $OUTPUT->notification($message, \core\output\notification::NOTIFY_WARNING);
2245 }
2246 }
037273d8 2247 }
e45c8637
MF
2248
2249 $this->ldap_close(true);
2250 // We were able to connect successfuly.
2251 echo $OUTPUT->notification(get_string('connectingldapsuccess', 'auth_ldap'), \core\output\notification::NOTIFY_SUCCESS);
037273d8 2252 }
725fcf31
AN
2253
2254 /**
2255 * Get the list of profile fields.
2256 *
2257 * @param bool $fetchall Fetch all, not just those for update.
2258 * @return array
2259 */
2260 protected function get_profile_keys($fetchall = false) {
2261 $keys = array_keys(get_object_vars($this->config));
2262 $updatekeys = [];
2263 foreach ($keys as $key) {
2264 if (preg_match('/^field_updatelocal_(.+)$/', $key, $match)) {
2265 // If we have a field to update it from and it must be updated 'onlogin' we update it on cron.
2266 if (!empty($this->config->{'field_map_'.$match[1]})) {
2267 if ($fetchall || $this->config->{$match[0]} === 'onlogin') {
2268 array_push($updatekeys, $match[1]); // the actual key name
2269 }
2270 }
2271 }
2272 }
2273
2274 if ($this->config->suspended_attribute && $this->config->sync_suspended) {
2275 $updatekeys[] = 'suspended';
2276 }
2277
2278 return $updatekeys;
2279 }
2280}