1: <?php
 2: 
 3: /**
 4:  * Perform LDAP Authentication
 5:  *
 6:  * @param  string  $username The username to validate
 7:  * @param  string  $password The password to validate
 8:  * @return boolean
 9:  */
10: protected function _perform_ldap_auth($username = '', $password = NULL)
11: {
12:     if (empty($username)) {
13:         log_message('debug', 'LDAP Auth: failure, empty username');
14: 
15:         return FALSE;
16:     }
17: 
18:     log_message('debug', 'LDAP Auth: Loading Config');
19: 
20:     $this->config->load('ldap.php', TRUE);
21: 
22:     $ldap = array(
23:         'timeout' => $this->config->item('timeout', 'ldap');
24:         'host'    => $this->config->item('server', 'ldap');
25:         'port'    => $this->config->item('port', 'ldap');
26:         'rdn'     => $this->config->item('binduser', 'ldap');
27:         'pass'    => $this->config->item('bindpw', 'ldap');
28:         'basedn'  => $this->config->item('basedn', 'ldap');
29:       );
30: 
31:     log_message('debug', 'LDAP Auth: Connect to ' . $ldaphost);
32: 
33:     $ldapconfig['authrealm'] = $this->config->item('domain', 'ldap');
34: 
35:     // connect to ldap server
36:     $ldapconn = ldap_connect($ldap['host'], $ldap['port']);
37: 
38:     if ($ldapconn) {
39: 
40:         log_message('debug', 'Setting timeout to ' . $ldaptimeout . ' seconds');
41: 
42:         ldap_set_option($ldapconn, LDAP_OPT_NETWORK_TIMEOUT, $ldaptimeout);
43: 
44:         log_message('debug', 'LDAP Auth: Binding to ' . $ldap['host'] . ' with dn ' . $ldap['rdn']);
45: 
46:         // binding to ldap server
47:         $ldapbind = ldap_bind($ldapconn, $ldap['rdn'], $ldap['pass']);
48: 
49:         // verify binding
50:         if ($ldapbind) {
51:             log_message('debug', 'LDAP Auth: bind successful');
52:         } else {
53:             log_message('error', 'LDAP Auth: bind unsuccessful');
54: 
55:             return FALSE;
56:         }
57: 
58:     }
59: 
60:     // search for user
61:     if (($res_id = ldap_search( $ldapconn, $ldapbasedn, "uid=$username")) == FALSE) {
62:         log_message('error', 'LDAP Auth: User ' . $username . ' not found in search');
63: 
64:         return FALSE;
65:     }
66: 
67:     if (ldap_count_entries($ldapconn, $res_id) != 1) {
68:         log_message('error', 'LDAP Auth: failure, username ' . $username . 'found more than once');
69: 
70:         return FALSE;
71:     }
72: 
73:     if (( $entry_id = ldap_first_entry($ldapconn, $res_id))== FALSE) {
74:         log_message('error', 'LDAP Auth: failure, entry of searchresult could not be fetched');
75: 
76:         return FALSE;
77:     }
78: 
79:     if (( $user_dn = ldap_get_dn($ldapconn, $entry_id)) == FALSE) {
80:         log_message('error', 'LDAP Auth: failure, user-dn could not be fetched');
81: 
82:         return FALSE;
83:     }
84: 
85:     // User found, could not authenticate as user
86:     if (($link_id = ldap_bind($ldapconn, $user_dn, $password)) == FALSE) {
87:         log_message('error', 'LDAP Auth: failure, username/password did not match: ' . $user_dn);
88: 
89:         return FALSE;
90:     }
91: 
92:     log_message('debug', 'LDAP Auth: Success ' . $user_dn . ' authenticated successfully');
93: 
94:     $this->_user_ldap_dn = $user_dn;
95:     ldap_close($ldapconn);
96: 
97:     return TRUE;
98: }
99: