class_configInLdap.inc 21.3 KB
Newer Older
1
2
3
<?php
/*
  This code is part of FusionDirectory (http://www.fusiondirectory.org/)
4
  Copyright (C) 2012-2016 FusionDirectory
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

  This program is free software; you can redistribute it and/or modify
  it under the terms of the GNU General Public License as published by
  the Free Software Foundation; either version 2 of the License, or
  (at your option) any later version.

  This program is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  GNU General Public License for more details.

  You should have received a copy of the GNU General Public License
  along with this program; if not, write to the Free Software
  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
*/

21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
/* Debug level is an OR combination of several values */
class DebugLevelAttribute extends SetAttribute
{
  protected function loadAttrValue ($attrs)
  {
    if (isset($attrs[$this->getLdapName()])) {
      $value = $attrs[$this->getLdapName()][0];
      $this->value = array();
      foreach ($this->attribute->getChoices() as $choice) {
        if ($value & $choice) {
          $this->value[] = $choice;
        }
      }
    } else {
      $this->resetToDefault();
    }
  }

  function computeLdapValue()
  {
    $value = 0;
    foreach ($this->value as $v) {
      $value |= $v;
    }
    return $value;
  }
}
48
49
50
51
52
53
54
55

class configInLdap extends simplePlugin
{
  var $objectclasses  = array("fusionDirectoryConf");

  static function plInfo()
  {
    return array(
56
      'plShortName'     => _('Configuration'),
57
58
      'plTitle'         => _('FusionDirectory configuration'),
      'plDescription'   => _('Configuration screen of FusionDirectory'),
59
60
61
      'plIcon'          => 'geticon.php?context=categories&icon=settings&size=48',
      'plObjectType'    => array(
        'configuration' => array(
62
63
          'name'      => _('FusionDirectory configuration'),
          'filter'    => 'objectClass=fusionDirectoryConf',
64
          'tabClass'  => 'tabs_configInLdap',
65
66
67
          'icon'      => 'geticon.php?context=categories&icon=settings&size=16',
          'mainAttr'  => FALSE,
          'ou'        => preg_replace('/^[^,]+,/', '', CONFIGRDN)
68
69
        )
      ),
70
      'plSection'       => array('conf' => array('name' => _('Configuration'), 'priority' => 20)),
71
      'plManages'       => array('configuration'),
72
      'plPriority'      => 0,
73

74
      'plProvidedAcls'  => parent::generatePlProvidedAcls(static::getAttributesInfo())
75
76
77
78
79
    );
  }

  static function getAttributesInfo ()
  {
80
    global $config;
81
82
83
84
    $plugins = array();
    if (session::global_is_set('plist')) {
      $plugins = array_keys(session::global_get('plist')->info);
    }
85
    sort($plugins);
86
    return array(
87
      'look_n_feel' => array(
88
        'name'  => _('Look and feel'),
89
90
        'attrs' => array(
          new SelectAttribute (
91
            _('Language'), _('Language of the application. If \'automatic\' or not available, the one asked by the browser will be used. This setting can be overriden per user.'),
92
            'fdLanguage', FALSE,
93
            array('')
94
95
96
97
          ),
          new SelectAttribute (
            _('Theme'), _('Theme to be used'),
            'fdTheme', TRUE,
98
            static::get_themes(),
99
            'breezy'
100
101
102
103
104
105
          ),
          new SelectAttribute (
            _('Timezone'), _('Timezone to be used'),
            'fdTimezone', TRUE,
            array('America/New_York')
          ),
106
          new HiddenAttribute ('fusionConfigMd5'),
107
108
        )
      ),
109
110
111
112
      'schema_setup' => array(
        'name'  => _('Schema setup'),
        'attrs' => array(
          new BooleanAttribute (
113
            _('Schema validation'),
114
115
            _('Enables schema checking during login.'),
            'fdSchemaCheck', FALSE,
116
            TRUE
117
118
119
          ),
        )
      ),
120
      'password' => array(
121
        'name'  => _('Password settings'),
122
123
        'attrs' => array(
          new SelectAttribute (
124
125
            _('Password default hash'), _('Default hash to be used'),
            'fdPasswordDefaultHash', TRUE,
126
            array('ssha')
127
          ),
128
129
130
131
          new BooleanAttribute (
            _('Force default hash'), _('Force the use of the default password hash'),
            'fdForcePasswordDefaultHash'
          ),
132
          new IntAttribute (
133
134
            _('Password minimum length'), _('Minimum length of user passwords'),
            'fdPasswordMinLength', FALSE,
135
136
137
            0 /*min*/, FALSE /*no max*/
          ),
          new IntAttribute (
138
139
            _('Password minimum differs'), _('Minimum number of different characters from last password'),
            'fdPasswordMinDiffer', FALSE,
140
141
142
            0 /*min*/, FALSE /*no max*/
          ),
          new BooleanAttribute (
143
            _('Use account expiration'),
144
            _('Enables shadow attribute tests during the login to FusionDirectory and forces password renewal or account locking'),
145
            'fdHandleExpiredAccounts'
146
147
          ),
          new StringAttribute (
148
149
            _('SASL Realm'), _('SASL Realm'),
            'fdSaslRealm'
150
151
          ),
          new StringAttribute (
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
            _('SASL Exop'), _('Attribute to be stored in the userPassword attribute'),
            'fdSaslExop'
          ),
        )
      ),
      'core_settings' => array(
        'name'  => _('Core settings'),
        'attrs' => array(
          new BooleanAttribute (
            _('Display summary in listings'),
            _('Determines whether a status bar will be shown on the bottom of lists, displaying a short summary of type and number of elements in the list.'),
            'fdListSummary', FALSE,
            TRUE
          ),
          new SelectAttribute (
            _('Edit locking'),
            _('Check if a entry currently being edited has been modified outside of FusionDirectory in the meantime.'),
            'fdModificationDetectionAttribute', FALSE,
170
            array('', 'entryCSN', 'contextCSN'), 'entryCSN'
171
172
173
174
175
176
          ),
          new BooleanAttribute (
            _('Enable logging'),
            _('Event logging on FusionDirectory side.'),
            'fdLogging', FALSE,
            TRUE
177
          ),
178
179
180
181
182
          new IntAttribute (
            _('LDAP size limit'), _('Defines the number of entries to get from LDAP by default.'),
            'fdLdapSizeLimit', FALSE,
            0 /*min*/, FALSE /*no max*/, 200
          ),
183
184
        )
      ),
185
186
187
188
189
190
191
192
193
194
195
      'login' => array(
        'name'  => _('Login and session'),
        'attrs' => array(
          new SelectAttribute (
            _('Login attribute'),
            _('Which LDAP attribute should be used as the login name during login.'),
            'fdLoginAttribute', TRUE,
            array('uid', 'mail', 'uid,mail'), 'uid',
            array('uid', 'mail', 'both')
          ),
          new BooleanAttribute (
196
            _('Enforce encrypted connections'),
197
198
199
200
201
202
203
204
205
206
            _('Enables PHP security checks to force encrypted access (https) to the web interface.'),
            'fdForceSSL'
          ),
          new BooleanAttribute (
            _('Warn if session is not encrypted'),
            _('will display a warning to the user when http is used instead of https.'),
            'fdWarnSSL', FALSE,
            TRUE
          ),
          new IntAttribute (
207
            _('Session lifetime'), _('Defines when a session will expire in seconds (0 to disable).'),
208
209
210
            'fdSessionLifeTime', TRUE,
            0 /*min*/, FALSE /*no max*/, 1800
          ),
211
          new BooleanAttribute (
212
            _('HTTP Basic authentication'), _('Use HTTP Basic authentication protocol instead of the login form.'),
213
214
215
            'fdHttpAuthActivated', FALSE,
            FALSE
          ),
216
217
218
219
220
221
222
223
224
225
          new BooleanAttribute (
            _('HTTP Header authentication'), _('Use HTTP Header authentication instead of the login form.'),
            'fdHttpHeaderAuthActivated', FALSE,
            FALSE
          ),
          new StringAttribute (
            _('Header name'), _('Name of the header containing user identifier.'),
            'fdHttpHeaderAuthHeaderName', FALSE,
            'AUTH_USER'
          ),
226
227
        )
      ),
228
      'snapshots' => array(
229
        'name'  => _('Snapshots'),
230
231
232
        'attrs' => array(
          new BooleanAttribute (
            _('Enable snapshots'), _('This enables you to save certain states of entries and restore them later on.'),
233
234
            'fdEnableSnapshots', FALSE,
            TRUE
235
236
237
          ),
          new StringAttribute (
            _('Snapshot base'), _('The base where snapshots should be stored inside of the LDAP.'),
238
239
            'fdSnapshotBase', FALSE,
            'ou=snapshots,'.$config->current['BASE']
240
241
242
          ),
        )
      ),
243
244
245
246
247
248
249
250
251
252
253
254
255
256
      'ssl' => array(
        'name'  => _('SSL'),
        'attrs' => array(
          new StringAttribute (
            _('Key path'), _('Path to FusionDirectory private key. Unused for now.'),
            'fdSslKeyPath', FALSE,
            '/etc/ssl/private/fd.key'
          ),
          new StringAttribute (
            _('Certificate path'), _('Path to FusionDirectory certificate. Unused for now.'),
            'fdSslCertPath', FALSE,
            '/etc/ssl/certs/fd.cert'
          ),
          new StringAttribute (
257
            _('CA certificate path'), _('Path to the CA certificate. Used for validating Argonaut Server host.'),
258
259
260
261
262
            'fdSslCaCertPath', FALSE,
            '/etc/ssl/certs/ca.cert'
          ),
        )
      ),
263
264
265
266
267
268
269
270
271
      'cas' => array(
        'name'  => _('CAS'),
        'attrs' => array(
          new BooleanAttribute (
            _('Enable CAS'), _('CAS login will be used instead of LDAP bind'),
            'fdCasActivated', FALSE,
            FALSE
          ),
          new StringAttribute (
272
            _('CA certificate path'), _('Path to the CA certificate of the CAS server'),
273
274
275
276
            'fdCasServerCaCertPath', FALSE,
            '/etc/ssl/certs/ca.cert'
          ),
          new StringAttribute (
277
            _('Host'), _('Host of the CAS server'),
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
            'fdCasHost', FALSE,
            'localhost'
          ),
          new IntAttribute (
            _('Port'), _('Port the CAS server is listening on'),
            'fdCasPort', FALSE,
            0 /*min*/, FALSE /*no max*/, 443
          ),
          new StringAttribute (
            _('CAS context'), _('CAS context to be used'),
            'fdCasContext', FALSE,
            '/cas'
          ),
        )
      ),
293
294
295
296
297
298
299
300
301
302
      'people_and_group' => array(
        'name'  => _('People and group storage'),
        'class' => array('critical'),
        'attrs' => array(
          new SelectAttribute (
            _('People DN attribute'), _('Attribute to use at the beginning of users dn'),
            'fdAccountPrimaryAttribute', TRUE,
            array('uid', 'cn')
          ),
          new StringAttribute (
303
304
305
            _('CN pattern'), _('The pattern to use to build the common name field'),
            'fdCnPattern', TRUE,
            '%givenName% %sn%'
306
307
308
          ),
          new BooleanAttribute (
            _('Strict naming policy'),
309
            _('Enables strict checking of user and group names'),
310
311
312
313
            'fdStrictNamingRules', FALSE,
            TRUE
          ),
          new IntAttribute (
314
315
            _('Group/user min id'),
            _('The minimum assignable user or group id to avoid security leaks with id 0 accounts.'),
316
            'fdMinId', FALSE,
317
            0, FALSE, 100
318
          ),
319
          new StringAttribute (
320
            _('Next id hook'), _('A script to be called for finding the next free id number for users or groups.'),
321
322
            'fdNextIdHook', FALSE
          ),
323
          new IntAttribute (
324
325
            _('Base number for user id'),
            _('Where to start looking for a new free user id.'),
326
327
328
329
            'fdUidNumberBase', FALSE,
            0, FALSE, 1100
          ),
          new IntAttribute (
330
331
            _('Base number for group id'),
            _('Where to start looking for a new free group id.'),
332
333
334
335
            'fdGidNumberBase', FALSE,
            0, FALSE, 1100
          ),
          new StringAttribute (
336
            _('Users RDN'), _('The branch where users are stored.'),
337
338
339
340
341
342
343
344
            'fdUserRDN', TRUE,
            'ou=people'
          ),
          new StringAttribute (
            _('Groups RDN'), _('The branch where groups are stored.'),
            'fdGroupRDN', TRUE,
            'ou=groups'
          ),
345
346
347
348
349
          new StringAttribute (
            _('ACL role RDN'), _('The branch where ACL roles are stored.'),
            'fdAclRoleRDN', TRUE,
            'ou=aclroles'
          ),
350
          new SelectAttribute (
351
            _('Id allocation method'), _('Method to allocate user/group ids'),
352
353
354
355
356
            'fdIdAllocationMethod', TRUE,
            array('traditional', 'pool'), 'traditional',
            array(_('Traditional'), _('Samba unix id pool'))
          ),
          new IntAttribute (
357
            _('Pool user id min'), _('Minimum value for user id when using pool method'),
358
359
360
361
            'fdUidNumberPoolMin', FALSE,
            0, FALSE, 10000
          ),
          new IntAttribute (
362
            _('Pool user id max'), _('Maximum value for user id when using pool method'),
363
364
365
366
            'fdUidNumberPoolMax', FALSE,
            0, FALSE, 40000
          ),
          new IntAttribute (
367
            _('Pool group id min'), _('Minimum value for group id when using pool method'),
368
369
370
371
            'fdGidNumberPoolMin', FALSE,
            0, FALSE, 10000
          ),
          new IntAttribute (
372
            _('Pool group id max'), _('Maximum value for group id when using pool method'),
373
374
375
            'fdGidNumberPoolMax', FALSE,
            0, FALSE, 40000
          ),
376
377
378
379
          new BooleanAttribute (
            _('Restrict role members'), _('When enabled only users from the same branch or members of groups from the same branch can be added to a role.'),
            'fdRestrictRoleMembers'
          ),
380
381
382
383
384
385
386
387
          new BooleanAttribute (
            _('Separate address fields'), _('Expose street, postOfficeBox and postalCode fields instead of postalAddress.'),
            'fdSplitPostalAddress'
          ),
          new PostalAddressAttribute (
            _('Postal address pattern'), _('When using separate address fields, you can use a pattern to fill postalAddress field.'),
            'fdPostalAddressPattern'
          ),
388
389
        )
      ),
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
      'debug' => array(
        'name'  => _('Debugging'),
        'attrs' => array(
          new BooleanAttribute (
            _('Display errors'),
            _('Shows PHP errors in the upper part of the screen. This should be disabled in productive deployments, because there might be some passwords in it.'),
            'fdDisplayErrors'
          ),
          new IntAttribute (
            _('Maximum LDAP query time'), _('Stop LDAP actions if there is no answer within the specified number of seconds.'),
            'fdLdapMaxQueryTime', FALSE,
            0 /*min*/, FALSE /*no max*/
          ),
          new BooleanAttribute (
            _('Log LDAP statistics'),
            _('Track LDAP timing statistics to the syslog. This may help to find indexing problems or bad search filters.'),
            'fdLdapStats'
          ),
408
409
410
411
412
          new DebugLevelAttribute (
            new SelectAttribute (
              _('Debug level'),
              _('Display certain information on each page load.'),
              'fdDebugLevel', FALSE,
413
              array(DEBUG_TRACE,  DEBUG_LDAP, DEBUG_DB,   DEBUG_SHELL,  DEBUG_POST,
414
415
416
417
418
                    DEBUG_SESSION,  DEBUG_ACL,  DEBUG_SI, DEBUG_MAIL),
                    DEBUG_TRACE,
              array('Trace',      'LDAP',     'Database', 'Shell',      'POST',
                    'SESSION',      'ACL',      'SI',     'Mail')
            )
419
420
421
          ),
        )
      ),
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
      'miscellaneous' => array(
        'name'  => _('Miscellaneous'),
        'class' => array('fullwidth'),
        'attrs' => array(
          new OrderedArrayAttribute (
            new CompositeAttribute (
              _('Hooks that are called when specific actions happens'),
              'fdTabHook',
              array(
                new SelectAttribute(
                  _('tab'), _('The tab that this hook concerns'),
                  'hookTab', TRUE,
                  $plugins
                ),
                new SelectAttribute(
                  _('mode'), _('When to call this command'),
                  'hookMode', TRUE,
                  array('postcreate', 'postremove', 'postmodify',
440
                        'precreate', 'preremove', 'premodify', 'check',
441
                        'prelock', 'postlock', 'preunlock', 'postunlock')
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
                ),
                new StringAttribute(
                  _('cmd'), _('The command that will be called'),
                  'hookCmd', TRUE
                )
              ),
              '/^([^\\|]+)\\|([^\\|]+)\\|(.*)$/',
              '%s|%s|%s',
              '', // acl
              _('Hooks')
            ),
            FALSE, // non-ordered
            array(),
            TRUE // edition
          ),
          new BooleanAttribute (
            _('Display hook output'),
            _('When enabled successful hook execution output is displayed to the user using a dialog.'),
            'fdDisplayHookOutput'
          ),
          new SetAttribute(
            new StringAttribute (
              _('Available shells'), _('Available POSIX shells for FD users.'),
              'fdShells', FALSE
            ),
            array('/bin/ash','/bin/bash','/bin/csh','/bin/sh','/bin/ksh',
468
                  '/bin/tcsh','/bin/dash','/bin/zsh','/sbin/nologin', '/bin/false', '/usr/bin/git-shell')
469
          ),
470
471
472
473
          new SelectAttribute (
            _('Default shell'), _('Shell used by default when activating Unix tab.'),
            'fdDefaultShell', TRUE
          ),
474
475
476
477
478
          new BooleanAttribute (
            _('Show ACL tab on all objects'),
            _('For very specific ACL rights setting where you might need to give right on a single object.'),
            'fdAclTabOnObjects'
          ),
479
480
481
482
483
484
485
          new SetAttribute(
            new StringAttribute (
              _('Available department categories'), _('Available categories in the departments dropdown'),
              'fdDepartmentCategories', FALSE
            ),
            array()
          ),
486
487
        )
      ),
488
489
490
    );
  }

491
  function __construct ($dn = NULL, $object = NULL, $parent = NULL, $mainTab = FALSE, $attributesInfo = NULL)
492
  {
493
    $attributesInfo = static::getAttributesInfo();
494
    /* Languages */
495
496
497
    $languages = get_languages(TRUE);
    asort($languages);
    $languages = array_merge(array("" => _("Automatic")), $languages);
498
499
500
501
    $attributesInfo['look_n_feel']['attrs'][0]->setChoices(array_keys($languages), array_values($languages));
    /* Timezones */
    $attributesInfo['look_n_feel']['attrs'][2]->setChoices(timezone::_get_tz_zones());
    /* Password methods */
502
503
    $methods = passwordMethod::get_available_methods();
    $methods = $methods['name'];
504
505
    $attributesInfo['password']['attrs'][0]->setChoices($methods);

506
507
508
509
510
511
    try {
      parent::__construct($dn, $object, $parent, $mainTab, $attributesInfo);
    } catch (NonExistingLdapNodeException $e) {
      parent::__construct('new', $object, $parent, $mainTab, $attributesInfo);
      $this->dn = $dn;
    }
512
513
514

    $this->fusionConfigMd5 = md5_file(CACHE_DIR."/".CLASS_CACHE);

515
516
    $this->attributesAccess['fdDefaultShell']->setChoices($this->fdShells);

517
518
519
520
521
522
523
524
525
    $this->attributesAccess['fdHttpAuthActivated']->setManagedAttributes(
      array(
        'erase' => array (
          TRUE => array (
            'fdCasActivated',
          )
        )
      )
    );
526
    $this->attributesAccess['fdEnableSnapshots']->setManagedAttributes(
527
528
529
      array(
        'disable' => array (
          FALSE => array (
530
            'fdSnapshotBase',
531
532
533
534
          )
        )
      )
    );
535
    $this->attributesAccess['fdForceSSL']->setManagedAttributes(
536
537
538
      array(
        'disable' => array (
          TRUE => array (
539
            'fdWarnSSL',
540
541
542
543
          )
        )
      )
    );
544
545
546
547
548
549
550
551
552
553
    $this->attributesAccess['fdIdAllocationMethod']->setManagedAttributes(
      array(
        'erase' => array (
          'traditional' => array (
            'fdUidNumberPoolMin','fdUidNumberPoolMax',
            'fdGidNumberPoolMin','fdGidNumberPoolMax',
          )
        )
      )
    );
554
555
556
557
558
559
560
561
562
563
564
565
    $this->attributesAccess['fdCasActivated']->setManagedAttributes(
      array(
        'disable' => array (
          FALSE => array (
            'fdCasServerCaCertPath',
            'fdCasHost',
            'fdCasPort',
            'fdCasContext',
          )
        )
      )
    );
566
567
568
569
570
571
572
573
574
    $this->attributesAccess['fdHttpHeaderAuthActivated']->setManagedAttributes(
      array(
        'disable' => array (
          FALSE => array (
            'fdHttpHeaderAuthHeaderName',
          )
        )
      )
    );
575
576
577
578
579
580
581
582
583
    $this->attributesAccess['fdSplitPostalAddress']->setManagedAttributes(
      array(
        'disable' => array (
          FALSE => array (
            'fdPostalAddressPattern',
          )
        )
      )
    );
584
585
  }

586
587
588
589
590
  function compute_dn()
  {
    return $this->dn;
  }

591
592
593
594
595
596
  function save_object()
  {
    parent::save_object();
    $this->attributesAccess['fdDefaultShell']->setChoices($this->fdShells);
  }

597
598
599
  static function get_themes()
  {
    $themesdir  = '../ihtml/themes/';
600
    $themes     = array_keys(session::global_get(IconTheme::$session_var));
601
602
603
604
605
606
607
    if ($dir = opendir("$themesdir")) {
      while (($file = readdir($dir)) !== FALSE) {
        if (is_dir("$themesdir/$file") && !preg_match("/^\./", $file)) {
          $themes[] = $file;
        }
      }
    }
608
    return array_unique($themes);
609
610
611
  }
}
?>