0009816: LDAP Authentication Patch

Notes
(0026148) michiel (administrator) 23-04-07 16:50	Interesting, thanks Instead of patching phplist_auth.inc wouldn't it be easier to write a new ldap_auth.inc and then set the config file to use that one? That way the developments can go their own way. That was initially the idea when creating the phplist_auth.inc file.

(0026168) bpeabody (reporter) 23-04-07 23:37	Yes, you're right. It definitely seems better to put this in a separate file (I missed that line in the config, sorry). The only thing is that the LDAP code can fall back on the regular auth for specific users that you define (for example, you may want to keep the "admin" account local - not authenticating via LDAP, so in the event that your LDAP server is down, or there is some other connection issue, you can still get in;). This feature is currently implemented by renaming your existing validateLogin function to localValidateLogin and just calling in when needed. Perhaps this could be resolved by implementing a new class called "ldap_admin_auth" which extends from "admin_auth" and lives in a separate "ldap_admin_auth.inc" file? But then I'm not sure how the rest of PHPList would know to use an instance of "ldap_admin_auth" instead of "admin_auth" - just including the file wouldn't quite do it. Or I could just copy the existing admin_auth.inc to ldap_admin_auth.inc and make the mods to it. But that's a little less resilient to change, since ldap_admin_auth.inc would have to track with and carry over any relavent changes from admin_auth.inc as it evolves, instead of letting the language do that for us via inheritance. Your call - whichever you think is best.

(0026188) michiel (administrator) 24-04-07 13:34	yes, good point, I'll have a think. I'm not sure how soon, I'll be able to merge it into the main code, but in the meantime we can leave it as a patch

(0030653) amichel (reporter) 16-08-07 22:36	I made some small changes to this patch to account for anonymous binding. Our ldap server allows anonymous binds for searching. I recreated the entire patch with my changes, so this isn't an incremental patch, it's the full contents of the original patch plus my minor contribution, all rolled into one. I'm new to generating patch files and whatnot, so if this is wrong, do what you must.

(0050757) goverd (reporter) 20-10-09 16:51	I recommend using strtolower when checking the login as the uid attribute is sometimes derived from the entry's name when created in the tree and would honor the case. (e.g jdoe in phplist should match with JDoe from ldap tree) --- phplist_auth.inc 2009-10-20 12:50:13.000000000 -0400 +++ phplist_auth.inc.orig 2009-10-20 12:49:45.000000000 -0400 @@ -110,7 +110,7 @@ ); // check to see if it worked - if (strval(strtolower($myResult[0])) == $login) { + if (strval($myResult[0]) == $login) { @@ -154,7 +154,7 @@ ); // check to see if it worked this time - if (strval(strtolower($myResult[0])) == $login) { + if (strval($myResult[0]) == $login) {