From f494eee4a3f9b0eb09f6f9d46fb2e6be40a116e6 Mon Sep 17 00:00:00 2001
From: Raphael Michel <mail@raphaelmichel.de>
Date: Sun, 22 Jul 2018 11:50:02 +0200
Subject: LDAP: Allow optional binding/authentication

---
 application/config/config.php                      | 5 ++++-
 application/libraries/Duser/drivers/Duser_ldap.php | 4 ++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/application/config/config.php b/application/config/config.php
index 4f4e868f0..03f3cb74b 100644
--- a/application/config/config.php
+++ b/application/config/config.php
@@ -596,7 +596,10 @@ if (extension_loaded("ldap")) {
 		),
 		// Please note that php-ldap converts attributes to lowercase
 		"userid_field" => "uidnumber", // This has to be a unique integer
-		"username_field" => "uid" // This is the value the user supplies on the login form
+		"username_field" => "uid", // This is the value the user supplies on the login form
+		// Optional parameters
+		// "bind_rdn" => "uid=search-user,cn=users,dc=example,dc=com", // This is the user used to authenticate for searches
+		// "bind_password" => "***", // This is the password for the search user
 	);
 }
 
diff --git a/application/libraries/Duser/drivers/Duser_ldap.php b/application/libraries/Duser/drivers/Duser_ldap.php
index b80385fe0..f30257364 100644
--- a/application/libraries/Duser/drivers/Duser_ldap.php
+++ b/application/libraries/Duser/drivers/Duser_ldap.php
@@ -26,6 +26,10 @@ class Duser_ldap extends Duser_Driver {
 			return false;
 		}
 
+		if (isset($config['bind_rdn']) && isset($config['bind_password'])) {
+			ldap_bind($ds, $config['bind_rdn'], $config['bind_password']);
+		}
+		
 		switch ($config["scope"]) {
 			case "base":
 				$r = ldap_read($ds, $config['basedn'], $config["username_field"].'='.$username);
-- 
cgit v1.2.3-24-g4f1b


From fef3ac527c398d179de57361bf27476c504cc061 Mon Sep 17 00:00:00 2001
From: Raphael Michel <mail@raphaelmichel.de>
Date: Sun, 22 Jul 2018 12:23:49 +0200
Subject: LDAP: Allow optional filtering of allowed users

---
 application/config/config.php                      |  3 +++
 application/libraries/Duser/drivers/Duser_ldap.php | 13 ++++++++++---
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/application/config/config.php b/application/config/config.php
index 03f3cb74b..e120beaf6 100644
--- a/application/config/config.php
+++ b/application/config/config.php
@@ -600,6 +600,9 @@ if (extension_loaded("ldap")) {
 		// Optional parameters
 		// "bind_rdn" => "uid=search-user,cn=users,dc=example,dc=com", // This is the user used to authenticate for searches
 		// "bind_password" => "***", // This is the password for the search user
+		// You can optionally filter the LDAP users who are allowed to log in using any valid LDAP filter. %s will be replaced
+		// by the user name.
+		// "filter" => "(&(uid=%s)(memberOf=cn=FileBinUsers,cn=groups,dc=example,dc=com))",
 	);
 }
 
diff --git a/application/libraries/Duser/drivers/Duser_ldap.php b/application/libraries/Duser/drivers/Duser_ldap.php
index f30257364..9481397d0 100644
--- a/application/libraries/Duser/drivers/Duser_ldap.php
+++ b/application/libraries/Duser/drivers/Duser_ldap.php
@@ -30,15 +30,22 @@ class Duser_ldap extends Duser_Driver {
 			ldap_bind($ds, $config['bind_rdn'], $config['bind_password']);
 		}
 		
+		if (isset($config['filter'])) {
+			$filter = sprintf($config['filter'], $username);
+		} else {
+			$filter = $config["username_field"].'='.$username;
+		}
+
+		
 		switch ($config["scope"]) {
 			case "base":
-				$r = ldap_read($ds, $config['basedn'], $config["username_field"].'='.$username);
+				$r = ldap_read($ds, $config['basedn'], $filter);
 				break;
 			case "one":
-				$r = ldap_list($ds, $config['basedn'], $config["username_field"].'='.$username);
+				$r = ldap_list($ds, $config['basedn'], $filter);
 				break;
 			case "subtree":
-				$r = ldap_search($ds, $config['basedn'], $config["username_field"].'='.$username);
+				$r = ldap_search($ds, $config['basedn'], $filter);
 				break;
 			default:
 				throw new \exceptions\ApiException("libraries/duser/ldap/invalid-ldap-scope", "Invalid LDAP scope");
-- 
cgit v1.2.3-24-g4f1b