Waldova stránka

// ============================================================================================
// Trida pro autorizaci proti AD 
// ============================================================================================

class ad_auth {

  // implicitni nastaveni 
  var $ldap_server = "192.168.1.10";
  var $error_messages = array();
  var $domain = "mojedomena.cz";
  var $ldap_user_jmeno = "";
  var $ldap_user_dn = "";
  var $ldap_user_username = "";
  var $ldap_user_ingroups = array();
  var $ldap_search_root = "DC=mojedomena,DC=cz";
  
  
  // ------------------------------------------------------------------------------------------
  // metoda na provedeni autorizace proti LDAP serveru
  // ------------------------------------------------------------------------------------------
  function auth($username, $password, $agroups=none) {

    // uprava uzivatelskeho jmena a hesla
    $username = preg_replace("/.*\\\/", "", $username);
    $username = preg_replace("/@.*/", "", $username);
    $username = $this->mrpropper($username);
    $password = $this->mrpropper($password);

    // vytvoreni spojeni k LDAP serveru
    $ldap_connection = ldap_connect($this->ldap_server);
    if(!$ldap_connection) {
      array_push($this->error_messages, "Připojení k $this->ldap_server je nedostupné");
      return false;
    } 

    // nastaveni parametru pro komunikaci s MSAD
    @ldap_set_option($ldap_connection, LDAP_OPT_PROTOCOL_VERSION, 3);  // AD podporuje LDAPv3
    @ldap_set_option($ldap_connection, LDAP_OPT_REFERRALS, 0);         // pro AD vyp referrals

    // autentizace
    $res = @ldap_bind($ldap_connection, "$username@$this->domain", $password);
    if( ($res === false) || (strlen($username)<1) ) {
      array_push($this->error_messages, "chybné uživatelské jméno nebo heslo");
      @ldap_close($ldap_connection); 
      return false; 
    } 
    
    // vyhledani uzivatele v LDAP, vystup do pole entries
    $rec = ldap_search($ldap_connection, $this->ldap_search_root, "samaccountname=$username"); 
    $entries = ldap_get_entries($ldap_connection, $rec);
    
    // zjisteni jmena uzivatele
    $this->ldap_user_jmeno = iconv('utf8', 'cp1250' . '//IGNORE', $entries[0][displayname][0]);
    
    // zjisteni DN
    $this->ldap_user_dn = iconv('utf8','cp1250'.'//IGNORE', $entries[0][distinguishedname][0]);
    
    // zjisteni skupin do kterych uzivatel patri
    $amemberof = $entries[0][memberof];
    if( is_array($amemberof) ) {
      unset($amemberof[count]);
      foreach ($amemberof as $skupina) {
        $skupina = iconv('utf8', 'cp1250' . '//IGNORE', $skupina);
        $skupina = eregi_replace ( ",.*" , "" , $skupina);
        $skupina = eregi_replace ( ".*=" , "" , $skupina );
        array_push($this->ldap_user_ingroups, $skupina);
      }   
    }
    
    // overovani clenstvi ve skupine (skupinach)
    $retval = true;
    if( is_array($agroups) ) {
      foreach ($agroups as $skupina) {
        if( !in_array($skupina, $this->ldap_user_ingroups) ) {
          array_push($this->error_messages, "uživatel není členem $skupina");
          $retval = false;
        } 
      }
    }
    
    // odpojeni od LDAP serveru
    @ldap_close($ldap_connection);
    $this->ldap_user_username = $username; 
    return($retval);
  
  }
  // ------------------------------------------------------------------------------------------



  // ------------------------------------------------------------------------------------------
  // metoda na odstraneni nepeknych znaku z pripadneho formulare
  // ------------------------------------------------------------------------------------------
  function mrpropper($data) {
    $string = strip_tags($data);
    $string = stripslashes($string);
    $string = str_replace("'", "\'", $string);
    $string = str_replace('"', '\"', $string);
    return($string);  
  }
  // ------------------------------------------------------------------------------------------
  
  
}
PHP a autentizace proti Active Directory
