diff --git a/Docker/oauth/files/config_db.php b/Docker/oauth/files/config_db.php index 36a5da8..4da57f3 100644 --- a/Docker/oauth/files/config_db.php +++ b/Docker/oauth/files/config_db.php @@ -1,12 +1,12 @@ "; -$host = "<%= @db_host %>"; -$name = "<%= @db_name %>"; -$type = "<%= @db_type %>"; -$username = "<%= @db_user %>"; -$password = "<%= @db_pass %>"; -$dsn = $type . ":dbname=" . $name . ";host=" . $host . ";port=" . $port; +$db_port = "<%= @db_port %>"; +$db_host = "<%= @db_host %>"; +$db_name = "<%= @db_name %>"; +$db_type = "<%= @db_type %>"; +$db_user = "<%= @db_user %>"; +$db_pass = "<%= @db_pass %>"; +$dsn = $type . ":dbname=" . $name . ";host=" . $host . ";port=" . $port; //Set date.timezone to avoid E.Notice raise by strtotime() (in Pdo.php) //If date.timezone is not defined, Mattermost will return a bad token request error diff --git a/Puppet/mattermostldap/templates/config_ldap.php.erb b/Puppet/mattermostldap/templates/config_ldap.php.erb index c08c4db..0bfc8a7 100755 --- a/Puppet/mattermostldap/templates/config_ldap.php.erb +++ b/Puppet/mattermostldap/templates/config_ldap.php.erb @@ -1,17 +1,17 @@ "; -$port = <%= @ldap_port %>; +$ldap_host = "<%= @ldap_uri %>"; +$ldap_port = <%= @ldap_port %>; // Attribute use to identify user on LDAP (used in connexion.php, replace $rdn_suffix) - ex : uid, mail, sAMAccountName -$search_attribute = "<%= @ldap_attribute %>"; +$ldap_search_attribute = "<%= @ldap_attribute %>"; // Base directory name of the LDAP -$base = "<%= @ldap_base %>"; +$ldap_base_dn = "<%= @ldap_base %>"; // An optional filter to search in LDAP - ex : objectClass=person -$filter = "<%= @ldap_filter %>"; +$ldap_filter = "<%= @ldap_filter %>"; // ldap service user to allow search in ldap -$bind_dn = "<%= @ldap_bind_dn %>"; -$bind_pass = "<%= @ldap_bind_pass %>"; \ No newline at end of file +$ldap_bind_dn = "<%= @ldap_bind_dn %>"; +$ldap_bind_pass = "<%= @ldap_bind_pass %>"; \ No newline at end of file diff --git a/README.md b/README.md index 07c0bf5..059f82d 100755 --- a/README.md +++ b/README.md @@ -35,33 +35,35 @@ Obviously, you must have a Mattermost Server installed and be administrator on i Install required packages : * For Centos 7, RHEL 7 and Fedora : -``` +```bash #For PostgreSQL sudo yum -y --nogpgcheck install httpd php postgresql-server postgresql php-ldap php-pdo php-pgsql git #For MySQL sudo yum -y --nogpgcheck install httpd php mariadb-server mariadb php-ldap php-pdo php-mysql git ``` + * For Debian, ubuntu, Mint : -``` +```bash #For PostgreSQL sudo apt-get -y install httpd php postgresql-server postgresql php-ldap php-pdo php-pgsql git #For MySQL sudo apt-get -y install httpd php mariadb-server mariadb php-ldap php-pdo php-mysql git ``` + Setup your SQL server with the following command : -``` +```bash #For PostgreSQL (create a new database cluster) sudo postgresql-setup initdb #For MySQL (optional configuration for a secure MySQL server) sudo mysql_secure_installation ``` -By default, PostgreSQL does not allow client authentication on the server or a database. So we need to enable it by editing pg_hba.conf file (in /var/lib/pgsql). Open this file and replace 'ident' by 'md5' on the first three lines (local, host 127.0.0.1 and host ::1/128). It's recommended to backup the original file before editing it. +By default, PostgreSQL does not allow client authentication on the server or a database. So we need to enable it by editing pg_hba.conf file (in `/var/lib/pgsql`). Open this file and replace `ident` by `md5` on the first three lines (local, host 127.0.0.1 and host ::1/128). It's recommended to backup the original file before editing it. Then, start and enable service for Apache and Database (for all distribution using systemd): -``` +```bash #For PostgreSQL sudo systemctl start httpd sudo systemctl start postgresql @@ -78,10 +80,9 @@ sudo systemctl enable mariadb Your system is ready to install and run Mattermost-LDAP module. - ## Install -Clone (or download and extract) this repository in your /var/www/html (or your httpd root directory) : -``` +Clone (or download and extract) this repository in your `/var/www/html` (or your httpd root directory) : +```bash cd ~ git clone https://github.com/crivaledaz/Mattermost-LDAP.git cd Mattermost-LDAP @@ -89,137 +90,128 @@ cp -r oauth/ /var/www/html/ ``` You need to create a database for the oauth server. For this purpose, you can use the script "init_postgres.sh" or "init_mysql.sh". These scripts try to configure your database automatically, by creating a new user and a new database associated for the oauth server. Scripts also create all tables necessary for the module. If script failed, please report here, and try to configure manually your database by adapting command in scripts. Before running the script you can change the default settings by editing the config_init.sh file and modifying configuration variables. For postgresql, you can copy and paste following lines : -``` +```bash nano config_init.sh ./init_postgres.sh ``` This script will automatically create and add a new client in the oauth server, returning a client id and a client secret. You need to keep these two token to configure Mattermost. Please be sure the client secret remained secret. The redirect url in the script must comply with the hostname of your Mattermost server, else Mattermost could not get data from the Oauth server. - ## Configuration Configuration files are provided with examples and default values. Each config file has an ".example" extension, so you need to copy and to rename them without this extension. You can find a detailed description of each parameters available below. -* Init script configuration : -#### oauth_user -Oauth user in the database. This user must have right on the oauth database to store oauth tokens. By default : oauth -#### oauth_pass -Oauth user password in the database. By default, oauth_secure-pass -#### ip -Hostname or IP address of the database. By default : 127.0.0.1 -#### port -The port to connect to the database. By default : 5432 (postgres) -#### oauth_db_name -Database name for oauth server. By default : oauth_db -#### client_id -The application ID shared with mattermost. This ID should be a random token. You can use openssl to generate this token (openssl rand -hex 32). By default, this variable contain the openssl command, which use the openssl package. The token will be printed at the end of the script. -#### client_secret -The application secret shared with mattermost. This secret should be a random token. You can use openssl to generate this token (openssl rand -hex 32). By default, this variable contain the openssl command, which use the openssl package. The token will be printed at the end of the script. Secret must be different of the client ID. -#### redirect_uri -The callback address where oauth will send tokens to Mattermost. Normally it should be http://mattermost.company.com/signup/gitlab/complete -#### grant_types -The type of authentification use by Mattermost. It should be "authorization_code". -#### scope -The scope of authentification use by Mattermost. It should be "api". -#### user_id -The username of the user who create the Mattermost client in Oauth. This field has no impact, and could be used as a commentary field. By default this field is empty. - -* Mattermost : -Active Gitlab authentication in system console > Gitlab (or config.json on server) and fill application id and secret with the two token got during install section. For the next fields use this : +### Init script parameters + +| Parameter | Description | Default value | +|---------------|-----------------------------------------------------------------------|-------------------------------------------------------| +| oauth_user | Oauth user in the database. | oauth | +| oauth_pass | Oauth user password in the database. | oauth_secure-pass | +| ip | Hostname or IP address of the database. | 127.0.0.1 | +| port | The port to connect to the database. | 5432 (Postgres) | +| oauth_db_name | Database name for oauth server. | oauth_db | +| client_id | The application ID shared with mattermost. | `openssl rand -hex 32` | +| client_secret | The application secret shared with mattermost. | `openssl rand -hex 32` | +| redirect_uri | The callback address where oauth will send tokens to Mattermost. | http://mattermost.company.com/signup/gitlab/complete | +| grant_types | The type of authentification use by Mattermost. | authorization_code | +| scope | The scope of authentification use by Mattermost. | api | +| user_id | The username of the user who create the Mattermost client in Oauth. | | + +Note : The 'oauth_user' must have all privilege on the oauth database to manage oauth tokens. + +The 'client_id' and 'client_secret' should be different and random tokens. You can use openssl to generate these tokens (`openssl rand -hex 32`). By default, these variables contain the `openssl` command, which use the openssl package. Tokens will be generated and printed at the end of the script. + +The var 'user_id' has no impact, and could be used as a commentary field. By default this field is empty. + + +### Mattermost + +Active Gitlab authentication in `System Console > Gitlab` (or `config.json`) and fill application id and secret with the two tokens got during install section. For the next fields use this : ``` User API Endpoint : http://HOSTNAME/oauth/resource.php Auth Endpoint: http://HOSTNAME/oauth/authorize.php Token Endpoint: http://HOSTNAME/oauth/token.php ``` -Change HOSTNAME by hostname or ip of the server where you have installed Mattermost-LDAP module. - -In Mattermost 4.9, these fields are disable in admin panel, so you need to edit directly the configuration file config.json. - -* Database credentials -Edit oauth/config_db.php and adapt, with your settings, to set up database in PHP. - -#### $host -Hostname or IP address of the database. (ex : localhost) -#### $port -The port of your database to connect. (ex : 5432 for postgres) -#### $name -Database name for oauth server. If you use init script make sure to use the same database name. (ex : oauth_db) -#### $type -Database type to adapt PDO to your database server. Should be mysql or pgsql. -#### $username -Oauth user in the database. This user must have right on the oauth database to store oauth tokens. If you use init script make sure to use the same database user. (ex : oauth) -#### $password -Oauth user password in the database. If you use init script make sure to use the same database user. (ex : oauth_secure-pass) - -* LDAP config -Edit oauth/LDAP/config_ldap.php : -1. Provide your ldap address, port and version. -2. Change the base directory name ($base) and the filter ($filter) to comply with your LDAP configuration. -3. Change the user ID attribute ($ldap_attribute) to comply with your LDAP configuration (uid, sAMAccountName, email, cn ..). -4. If necessary, you can provide a LDAP account to allow search in LDAP (only restrictive LDAP). - -#### $hostname -Your LDAP hostname or LDAP IP, to connect to the LDAP server. -#### $port -Your LDAP port, to connect to the LDAP server. By default : 389. -#### $ldap_version -Your LDAP version, or protocol version used by your server. By default : 3. This parameter avoid LDAP blind error with LDAP 3 (issue #14) -#### $search_attribute -The attribute used to identify user on your LDAP. Should be uid, email, cn or sAMAccountName. -#### $base -The base directory name of your LDAP server. (ex : ou=People,o=Company) -#### $filter -Additional filters to search in LDAP (used to get user informations). (ex : objectClass=person) -#### $bind_dn -The LDAP Directory Name of an service account to allow LDAP search. This ption is required if your LDAP is restrictive, else put an empty string (""). (ex : cn=mattermost_ldap,dc=Example,dc=com) -#### $bind_pass -The password associated to the service account to allow LDAP search. This ption is required if your LDAP you provide an bind user, else put an empty string (""). - - - -To try your configuration you can use ldap.php available at the root of this project which use the LDAP library for PHP or you can use ldapsearch command in a shell. +Change `HOSTNAME` by hostname or ip of the server where you have installed Mattermost-LDAP module. + +Since Mattermost 4.9, these fields are disabled in admin panel, so you need to edit directly the configuration file `config.json`. + +### Database credentials +Edit `oauth/config_db.php` and adapt, with your settings, to set up database in PHP. + +| Parameter | Description | Default value | +|------------|----------------------------------------------------------------------|--------------------| +| db_host | Hostname or IP address of the database server | 127.0.0.1 | +| db_port | The port of your database to connect | 5432 | +| db_type | Database type to adapt PDO. Should be pgsql or mysql. | pgsql | +| db_user | User who manages oauth database | oauth | +| db_pass | User's password to manage oauth database | oauth_secure-pass | +| db_name | Database name for oauth server | oauth_db | + +If you use the init script, make sure to use the same values for database parameters : 'oauth_user' = 'db_user', 'oauth_pass' = 'db_pass', 'oauth_db_name' = 'db_name'. + +Note : The 'db_user' must have all privilege on the oauth database to manage oauth tokens. + +### LDAP configuration + +Edit `oauth/LDAP/config_ldap.php` and adapt prameters with your LDAP configuration : + +| Parameter | Description | Default value | +|-----------------------|-----------------------------------------------------------------------|--------------------------| +| ldap_host | URL or IP to connect LDAP server | ldap://ldap.company.com/ | +| ldap_port | Port used to connect LDAP server | 389 | +| ldap_version | LDAP version or protocol version used by LDAP server | 3 | +| ldap_search_attribute | Attribute used to identify a user on the LDAP | uid | +| ldap_filter | Additional filter for LDAP search | objectClass=* | +| ldap_base_dn | The base directory name of your LDAP server | ou=People,o=Company | +| ldap_bind_dn | The LDAP Directory Name of an service account to allow LDAP search | | +| ldap_bind_pass | The password associated to the service account to allow LDAP search | | + +For openLDAP server, the 'ldap_search_attribute' should be `uid`, and for AD server this must be `sAMAccountName`. Nevertheless, 'email' or 'cn' could be used, this depends on your LDAP configuration. + +Parameters 'ldap_bind_dn' and 'ldap_bind_pass' are required if your LDAP is restrictive, else put an empty string (""). + +Note : 'ldap_version' avoid LDAP blind error with LDAP 3 (issue #14) + +To try your configuration you can use `ldap.php` available at the root of this project which use the LDAP library for PHP or you can use `ldapsearch` command in a shell. Configure LDAP is certainly the most difficult step. ## Usage If you have succeeded previous step you only have to go to the login page of your Mattermost server and click on the Gitlab Button. You will be redirected to a form asking for your LDAP credentials. If your credentials are valid, you will be asked to authorize Oauth to give your information to Mattermost. After authorizing you should be redirected on Mattermost connected with your account. -Keep in mind this will create a new account on your Mattermost server with information from LDAP. The process will fail if an existing user already use your LDAP email. To bind a user to the LDAP authentication, sign in mattermost with this user account, go in account settings > security > sign-in method and "switch to using Gitlab SSO". - +Keep in mind this will create a new account on your Mattermost server with information from LDAP. The process will fail if an existing user already use your LDAP email. To bind an existing user to the LDAP authentication, sign in mattermost with this user account, go in `account settings > security > sign-in method and "switch to using Gitlab SSO"`. ## Limitation -This module has been tested on Centos 7, Fedora and Ubuntu with PostgreSQL and Mattermost Community Edition version 4.1, 4.9 and 5.0.1. Mattermost-LDAP is compliant with Mattermost Team Edition 4.x.x and 5.x.x. +This module has been tested on Centos 7, Fedora and Ubuntu with PostgreSQL and Mattermost Community Edition version 4.1, 4.9, 5.0.1 and 5.10. Mattermost-LDAP is compliant with Mattermost Team Edition 4.x.x and 5.x.x. Others operating systems has not been tested yet but should work fine. MySQL has not really been tested so it is possible there is some bugs with. - ## To do list - * Gathering LDAP config + * HTTPS support * Add CSS to make a beautiful interface for Oauth server - * Create an associated Puppet module * Change Gitlab button * Security audit ## Thanks -I wish to thank my company and my colleagues for their help and support. Also, I thank Brent Shaffer for his Oauth-server-php project and its documentation. - +I wish to thank CS SI and my colleagues for their help and support. Also, I thank Brent Shaffer for his Oauth-server-php project and its documentation. ## Known issues + * LDAP authentication failed Try to restart httpd service. If this persists verify your LDAP configuration or your credentials. * PHP date timezone error - Edit php.ini to set up date.timezone option and restart httpd service, or use the date_default_timezone_set() function in config_db.php + Edit `php.ini` to set up date.timezone option and restart httpd service, or use the `date_default_timezone_set()` function in `config_db.php` * Token request failed - Try to add a new rule in your firewall (or use iptables -F on both Mattermost server and Oauth server) + Try to add a new rule in your firewall (or use `iptables -F` on both Mattermost server and Oauth server) * .htaccess does not work - Add following lines to your httpd.conf and restart httpd service. + Add following lines to your `httpd.conf` and restart httpd service. ``` AllowOverride All diff --git a/oauth/LDAP/LDAP.php b/oauth/LDAP/LDAP.php index 3adf148..30ecca8 100755 --- a/oauth/LDAP/LDAP.php +++ b/oauth/LDAP/LDAP.php @@ -16,28 +16,28 @@ class LDAP implements LDAPInterface /** * LDAP Resource * - * @param string @hostname + * @param string @ldap_host * Either a hostname or, with OpenLDAP 2.x.x and later, a full LDAP URI - * @param int @port + * @param int @ldap_port * An optional int to specify ldap server port, by default : 389 * @param int @ldap_version * An optional int to specify ldap version, by default LDAP V3 protocol is used * * Initiate LDAP connection by creating an associated resource */ - public function __construct($hostname, $port = 389, $ldap_version = 3) + public function __construct($ldap_host, $ldap_port = 389, $ldap_version = 3) { - if (!is_string($hostname)) + if (!is_string($ldap_host)) { throw new InvalidArgumentException('First argument to LDAP must be the hostname of a ldap server (string). Ex: ldap//example.com/ '); } - if (!is_int($port)) + if (!is_int($ldap_port)) { throw new InvalidArgumentException('Second argument to LDAP must be the ldap server port (int). Ex : 389'); } - $ldap = ldap_connect($hostname, $port) + $ldap = ldap_connect($ldap_host, $ldap_port) or die("Unable to connect to the ldap server : $ldaphost ! Please check your configuration."); // Support LDAP V3 since many users have encountered difficulties with LDAP V3. @@ -58,22 +58,22 @@ public function __construct($hostname, $port = 389, $ldap_version = 3) * A ldap username or email or sAMAccountName * @param string @password * An optional password linked to the user, if not provided an anonymous bind is attempted - * @param string @search_attribute + * @param string @ldap_search_attribute * The attribute used on your LDAP to identify user (uid, email, cn, sAMAccountName) - * @param string @filter + * @param string @ldap_filter * An optional filter to search in LDAP (ex : objectClass = person). - * @param string @base_dn + * @param string @ldap_base_dn * The LDAP base DN. - * @param string @bind_dn + * @param string @ldap_bind_dn * The directory name of a service user to bind before search. Must be a user with read permission on LDAP. - * @param string @bind_pass + * @param string @ldap_bind_pass * The password associated to the service user to bind before search. * * @return * TRUE if the user is identified and can access to the LDAP server * and FALSE if it isn't */ - public function checkLogin($user, $password = null, $search_attribute, $filter = null, $base_dn,$bind_dn, $bind_pass) { + public function checkLogin($user, $password = null, $ldap_search_attribute, $ldap_filter = null, $ldap_base_dn,$ldap_bind_dn, $ldap_bind_pass) { if (!is_string($user)) { throw new InvalidArgumentException('First argument to LDAP/checkLogin must be the username or email of a ldap user (string). Ex: jdupont or jdupont@company.com'); @@ -82,31 +82,31 @@ public function checkLogin($user, $password = null, $search_attribute, $filter = { throw new InvalidArgumentException('Second argument to LDAP/checkLogin must be the password associated to the relative directory name (string).'); } - if (!is_string($search_attribute)) + if (!is_string($ldap_search_attribute)) { throw new InvalidArgumentException('Third argument to LDAP/checkLogin must be the attribute to identify users (ex : uid, email, sAMAccountName) (string).'); } - if (!is_string($filter) && $filter != null) + if (!is_string($ldap_filter) && $ldap_filter != null) { throw new InvalidArgumentException('Fourth argument to LDAP/checkLogin must be an optional filter to search in LDAP (string).'); } - if (!is_string($base_dn)) + if (!is_string($ldap_base_dn)) { throw new InvalidArgumentException('Fifth argument to LDAP/checkLogin must be the ldap base directory name (string). Ex: o=Company'); } - if (!is_string($bind_dn) && $bind_dn != null) + if (!is_string($ldap_bind_dn) && $ldap_bind_dn != null) { throw new InvalidArgumentException('Sixth argument to LDAP/checkLogin must be an optional service account on restrictive LDAP (string).'); } - if (!is_string($bind_pass) && $bind_pass != null) + if (!is_string($ldap_bind_pass) && $ldap_bind_pass != null) { throw new InvalidArgumentException('Seventh argument to LDAP/checkLogin must be an optional password for the service account on restrictive LDAP (string).'); } // If LDAP service account for search is specified, do an ldap_bind with this account - if ($bind_dn != '' && $bind_dn != null) + if ($ldap_bind_dn != '' && $ldap_bind_dn != null) { - $bind_result=ldap_bind($this->ldap_server,$bind_dn,$bind_pass); + $bind_result=ldap_bind($this->ldap_server,$ldap_bind_dn,$ldap_bind_pass); // If authentification failed, throw an exception if (!$bind_result) @@ -114,17 +114,17 @@ public function checkLogin($user, $password = null, $search_attribute, $filter = throw new Exception('An error has occured during ldap_bind execution. Please check parameter of LDAP/checkLogin, and make sure that user provided have read permission on LDAP.'); } } - if ($filter!="" && $filter != null) + if ($ldap_filter!="" && $ldap_filter != null) { - $search_filter = '(&(' . $search_attribute . '=' . $user . ')(' . $filter .'))'; + $search_filter = '(&(' . $ldap_search_attribute . '=' . $user . ')(' . $ldap_filter .'))'; } else { - $search_filter = $search_attribute . '=' . $user; + $search_filter = $ldap_search_attribute . '=' . $user; } - $result = ldap_search($this->ldap_server, $base_dn, $search_filter, array(), 0, 1, 500); + $result = ldap_search($this->ldap_server, $ldap_base_dn, $search_filter, array(), 0, 1, 500); if (!$result) { @@ -146,15 +146,15 @@ public function checkLogin($user, $password = null, $search_attribute, $filter = } /** - * @param string @base_dn + * @param string @ldap_base_dn * The LDAP base DN. - * @param string @filter + * @param string @ldap_filter * A filter to get relevant data. Often the user id in ldap (uid or sAMAccountName). - * @param string @bind_dn + * @param string @ldap_bind_dn * The directory name of a service user to bind before search. Must be a user with read permission on LDAP. - * @param string @bind_pass + * @param string @ldap_bind_pass * The password associated to the service user to bind before search. - * @param string @search_attribute + * @param string @ldap_search_attribute * The attribute used on your LDAP to identify user (uid, email, cn, sAMAccountName) * @param string @user * A ldap username or email or sAMAccountName @@ -162,27 +162,27 @@ public function checkLogin($user, $password = null, $search_attribute, $filter = * @return * An array with the user's mail, complete name and directory name. */ - public function getDataForMattermost($base_dn, $filter, $bind_dn, $bind_pass, $search_attribute, $user) { + public function getDataForMattermost($ldap_base_dn, $ldap_filter, $ldap_bind_dn, $ldap_bind_pass, $ldap_search_attribute, $user) { $attribute=array("cn","mail"); - if (!is_string($base_dn)) + if (!is_string($ldap_base_dn)) { throw new InvalidArgumentException('First argument to LDAP/getData must be the ldap base directory name (string). Ex: o=Company'); } - if (!is_string($filter)) + if (!is_string($ldap_filter)) { throw new InvalidArgumentException('Second argument to LDAP/getData must be a filter to get relevant data. Often is the user id in ldap (string). Ex : uid=jdupont'); } - if (!is_string($bind_dn) && $bind_dn != null) + if (!is_string($ldap_bind_dn) && $ldap_bind_dn != null) { throw new InvalidArgumentException('Third argument to LDAP/getData must be an optional service account on restrictive LDAP (string).'); } - if (!is_string($bind_pass) && $bind_pass != null) + if (!is_string($ldap_bind_pass) && $ldap_bind_pass != null) { throw new InvalidArgumentException('Fourth argument to LDAP/getData must be an optional password for the service account on restrictive LDAP (string).'); } - if (!is_string($search_attribute)) + if (!is_string($ldap_search_attribute)) { throw new InvalidArgumentException('Fifth argument to LDAP/getData must be the attribute to identify users (ex : uid, email, sAMAccountName) (string).'); } @@ -192,9 +192,9 @@ public function getDataForMattermost($base_dn, $filter, $bind_dn, $bind_pass, $s } // If LDAP service account for search is specified, do an ldap_bind with this account - if ($bind_dn != '' && $bind_dn != null) + if ($ldap_bind_dn != '' && $ldap_bind_dn != null) { - $bind_result=ldap_bind($this->ldap_server,$bind_dn,$bind_pass); + $bind_result=ldap_bind($this->ldap_server,$ldap_bind_dn,$ldap_bind_pass); // If authentification failed, throw an exception if (!$bind_result) @@ -203,16 +203,16 @@ public function getDataForMattermost($base_dn, $filter, $bind_dn, $bind_pass, $s } } - if ($filter!="" && $filter != null) + if ($ldap_filter!="" && $ldap_filter != null) { - $search_filter = '(&(' . $search_attribute . '=' . $user . ')(' . $filter .'))'; + $search_filter = '(&(' . $ldap_search_attribute . '=' . $user . ')(' . $ldap_filter .'))'; } else { - $search_filter = $search_attribute . '=' . $user; + $search_filter = $ldap_search_attribute . '=' . $user; } - $result = ldap_search($this->ldap_server, $base_dn, $search_filter, array(), 0, 1, 500); + $result = ldap_search($this->ldap_server, $ldap_base_dn, $search_filter, array(), 0, 1, 500); if (!$result) { diff --git a/oauth/LDAP/LDAPInterface.php b/oauth/LDAP/LDAPInterface.php index f050989..09e4f25 100755 --- a/oauth/LDAP/LDAPInterface.php +++ b/oauth/LDAP/LDAPInterface.php @@ -12,33 +12,33 @@ interface LDAPInterface * A ldap username or email or sAMAccountName * @param string @password * An optional password linked to the user, if not provided an anonymous bind is attempted - * @param string @search_attribute + * @param string @ldap_search_attribute * The attribute used on your LDAP to identify user (uid, email, cn, sAMAccountName) - * @param string @filter + * @param string @ldap_filter * An optional filter to search in LDAP (ex : objectClass = person). - * @param string @base_dn + * @param string @ldap_base_dn * The LDAP base DN. - * @param string @bind_dn + * @param string @ldap_bind_dn * The directory name of a service user to bind before search. Must be a user with read permission on LDAP. - * @param string @bind_pass + * @param string @ldap_bind_pass * The password associated to the service user to bind before search. * * @return * TRUE if the user is identified and can access to the LDAP server * and FALSE if it isn't */ - public function checkLogin($user,$password = null,$search_attribute,$filter = null,$base_dn,$bind_dn,$bind_pass); + public function checkLogin($user,$password = null,$ldap_search_attribute,$ldap_filter = null,$ldap_base_dn,$ldap_bind_dn,$ldap_bind_pass); /** - * @param string @base_dn + * @param string @ldap_base_dn * The LDAP base DN. - * @param string @filter + * @param string @ldap_filter * A filter to get relevant data. Often the user id in ldap (uid or sAMAccountName). - * @param string @bind_dn + * @param string @ldap_bind_dn * The directory name of a service user to bind before search. Must be a user with read permission on LDAP. - * @param string @bind_pass + * @param string @ldap_bind_pass * The password associated to the service user to bind before search. - * @param string @search_attribute + * @param string @ldap_search_attribute * The attribute used on your LDAP to identify user (uid, email, cn, sAMAccountName) * @param string @user * A ldap username or email or sAMAccountName @@ -46,5 +46,5 @@ public function checkLogin($user,$password = null,$search_attribute,$filter = nu * @return * An array with the user's mail, complete name and directory name. */ - public function getDataForMattermost($base_dn, $filter, $bind_dn, $bind_pass, $search_attribute, $user); + public function getDataForMattermost($ldap_base_dn, $ldap_filter, $ldap_bind_dn, $ldap_bind_pass, $ldap_search_attribute, $user); } diff --git a/oauth/LDAP/config_ldap.php.example b/oauth/LDAP/config_ldap.php.example index 47cd54e..cc35997 100755 --- a/oauth/LDAP/config_ldap.php.example +++ b/oauth/LDAP/config_ldap.php.example @@ -1,16 +1,16 @@ - +
diff --git a/oauth/config_db.php.example b/oauth/config_db.php.example index f161fe3..0132c42 100755 --- a/oauth/config_db.php.example +++ b/oauth/config_db.php.example @@ -1,12 +1,12 @@ checkLogin($user,$password,$search_attribute,$filter,$base,$bind_dn,$bind_pass); + $authenticated = $ldap->checkLogin($user,$password,$ldap_search_attribute,$ldap_filter,$ldap_base_dn,$ldap_bind_dn,$ldap_bind_pass); } catch (Exception $e) { diff --git a/oauth/images/ButtonGreen.png b/oauth/images/ButtonGreen.png new file mode 100644 index 0000000..9a88c41 Binary files /dev/null and b/oauth/images/ButtonGreen.png differ diff --git a/oauth/images/login.png b/oauth/images/login.png new file mode 100644 index 0000000..6034af0 Binary files /dev/null and b/oauth/images/login.png differ diff --git a/oauth/index.php b/oauth/index.php index 67e60e5..11190e7 100644 --- a/oauth/index.php +++ b/oauth/index.php @@ -5,20 +5,68 @@ + LDAP Connection Interface - -
- Connection -

-
- -

-
+
+
 
+ + + + + +
  + -

- + + + +
+
LDAP Authentification
+ + +
+ + + + + + + + + + + + + + + + + + + +
+ +
+ +
+   +
+ Username:  + + +
+ Password:  + + +
 
+
+ +
+ +
+ \ No newline at end of file diff --git a/oauth/resource.php b/oauth/resource.php index 40247cc..59af40e 100755 --- a/oauth/resource.php +++ b/oauth/resource.php @@ -27,12 +27,12 @@ $assoc_id = intval($info_oauth["assoc_id"]); // Open a LDAP connection -$ldap = new LDAP($hostname,$port,$ldap_version); +$ldap = new LDAP($ldap_host,$ldap_port,$ldap_version); // Try to get user data on the LDAP try { - $data = $ldap->getDataForMattermost($base,$filter,$bind_dn,$bind_pass,$search_attribute,$user); + $data = $ldap->getDataForMattermost($ldap_base_dn,$ldap_filter,$ldap_bind_dn,$ldap_bind_pass,$ldap_search_attribute,$user); // Here is the patch for Mattermost 4.4 and older. Gitlab has changed the JSON output of oauth service. Many data are not used by Mattermost, but there is a stack error if we delete them. That's the reason why date and many parameters are null or empty. $resp = array("id" => $assoc_id,"name" => $data['cn'],"username" => $user,"state" => "active","avatar_url" => "","web_url" => "","created_at" => "0000-00-00T00:00:00.000Z","bio" => null,"location" => null,"skype" => "","linkedin" => "","twitter" => "","website_url" => "","organization" => null,"last_sign_in_at" => "0000-00-00T00:00:00.000Z","confirmed_at" => "0000-00-00T00:00:00.000Z","last_activity_on" => null,"email" => $data['mail'],"theme_id" => 1,"color_scheme_id" => 1,"projects_limit" => 100000,"current_sign_in_at" => "0000-00-00T00:00:00.000Z","identities" => array(array("provider" => "ldapmain","extern_uid" => $data['dn'])),"can_create_group" => true,"can_create_project" => true,"two_factor_enabled" => false,"external" => false,"shared_runners_minutes_limit" => null); diff --git a/oauth/server.php b/oauth/server.php index 76be9f8..0aa284f 100644 --- a/oauth/server.php +++ b/oauth/server.php @@ -11,7 +11,7 @@ OAuth2\Autoloader::register(); //$dsn is the Data Source Name for your database, for exmaple "mysql:dbname=my_oauth2_db;host=localhost" -$storage = new OAuth2\Storage\Pdo(array('dsn' => $dsn, 'username' => $username, 'password' => $password)); +$storage = new OAuth2\Storage\Pdo(array('dsn' => $dsn, 'username' => $db_user, 'password' => $db_pass)); // Pass a storage object or array of storage objects to the OAuth2 server class $server = new OAuth2\Server($storage); diff --git a/oauth/style.css b/oauth/style.css new file mode 100644 index 0000000..8b3765c --- /dev/null +++ b/oauth/style.css @@ -0,0 +1,57 @@ +html +{ + height: 100%; + margin: 0; +} + +body { + font-family:"Tahoma","Arial", serif; + font-size:8px; + font-weight: normal; + color: black; + text-decoration:none; + background-color: white; + height: 100%; + margin: 0; +} + + +.LoginTitle { + color: #000000; + font-family : "Tahoma","Arial", serif; + font-size : 18pt; + font-weight: normal; +} + +.LoginUsername { + color: #000000; + font-family : "Tahoma","Arial", serif; + font-size : 14pt; + font-weight: normal; +} + +.LoginComment { + color: #000000; + font-family : "Tahoma","Arial", serif; + font-size : 8pt; + font-weight: normal; +} + +.GreenButton +{ + color: white; + font-family : "Tahoma", "Arial", serif; + font-size : 10pt; + font-weight: normal; + height: 28px; + background: transparent url(images/ButtonGreen.png) repeat-x left top; + border: solid 1px #50B4AE; + font-weight: bold; +} + +.messageLogin { + color: Yellow; + font-family : "Tahoma", "Arial", serif; + font-size : 8pt; + font-weight: bold; +}