95 lines
2.5 KiB
Perl
95 lines
2.5 KiB
Perl
|
#!/usr/bin/perl
|
||
|
|
#
|
||
|
|
|
||
|
|
package LJ::LDAP;
|
||
|
|
|
||
|
|
use strict;
|
||
|
|
use Net::LDAP;
|
||
|
|
use Digest::MD5 qw(md5);
|
||
|
|
use Digest::SHA1 qw(sha1);
|
||
|
|
use MIME::Base64;
|
||
|
|
|
||
|
|
sub load_ldap_user {
|
||
|
|
my ($user) = @_;
|
||
|
|
return undef unless $user =~ /^[\w ]+$/;
|
||
|
|
|
||
|
|
my $ldap = Net::LDAP->new($LJ::LDAP_HOST)
|
||
|
|
or return undef;
|
||
|
|
my $mesg = $ldap->bind; # an anonymous bind
|
||
|
|
|
||
|
|
my $uid = $LJ::LDAP_UID || "uid";
|
||
|
|
|
||
|
|
my $urec = $ldap->search( # perform a search
|
||
|
|
base => $LJ::LDAP_BASE,
|
||
|
|
scope => "sub",
|
||
|
|
filter => "$uid=$user",
|
||
|
|
#filter => "(&(sn=Barr) (o=Texas Instruments))"
|
||
|
|
)->pop_entry
|
||
|
|
or return undef;
|
||
|
|
|
||
|
|
my $up = $urec->get_value('userPassword')
|
||
|
|
or return undef;
|
||
|
|
|
||
|
|
my ($nick, $email) = ($urec->get_value('gecos'), $urec->get_value('mailLocalAddress'));
|
||
|
|
unless ($nick && $email) {
|
||
|
|
$@ = "Necessary information not found in LDAP record: name=$nick; email=$email";
|
||
|
|
return undef;
|
||
|
|
}
|
||
|
|
|
||
|
|
# $res comes out as...?
|
||
|
|
my $res = {
|
||
|
|
name => $user,
|
||
|
|
nick => $nick,
|
||
|
|
email => $email,
|
||
|
|
ldap_pass => $up,
|
||
|
|
};
|
||
|
|
|
||
|
|
return $res;
|
||
|
|
}
|
||
|
|
|
||
|
|
sub is_good_ldap
|
||
|
|
{
|
||
|
|
my ($user, $pass) = @_;
|
||
|
|
my $lrec = load_ldap_user($user)
|
||
|
|
or return undef;
|
||
|
|
|
||
|
|
# get auth type and data, then decode it
|
||
|
|
return undef unless $lrec->{ldap_pass} =~ /^\{(\w+)\}(.+)$/;
|
||
|
|
my ($auth, $data) = ($1, decode_base64($2));
|
||
|
|
|
||
|
|
if ($auth eq 'MD5') {
|
||
|
|
unless ($data eq md5($pass)) {
|
||
|
|
$@ = "Password mismatch (MD5) from LDAP server; is your password correct?";
|
||
|
|
return undef;
|
||
|
|
}
|
||
|
|
} elsif ($auth eq 'SSHA') {
|
||
|
|
my $salt = substr($data, 20);
|
||
|
|
my $orig = substr($data, 0, 20);
|
||
|
|
unless ($orig eq sha1($pass, $salt)) {
|
||
|
|
$@ = "Password mismatch (SSHA) from LDAP server; is your password correct?";
|
||
|
|
return undef;
|
||
|
|
}
|
||
|
|
|
||
|
|
} elsif ($auth eq 'SMD5') {
|
||
|
|
# this didn't work
|
||
|
|
my $salt = substr($data, 16);
|
||
|
|
my $orig = substr($data, 0, 16);
|
||
|
|
unless ($orig eq md5($pass, $salt)) {
|
||
|
|
$@ = "Password mismatch (SMD5) from LDAP server; is your password correct?";
|
||
|
|
return undef;
|
||
|
|
}
|
||
|
|
|
||
|
|
} else {
|
||
|
|
print STDERR "Unsupported LDAP auth method: $auth\n";
|
||
|
|
$@ = "userPassword field from LDAP server not of supported format; type: $auth"
|
||
|
|
;
|
||
|
|
return undef;
|
||
|
|
}
|
||
|
|
|
||
|
|
return $lrec;
|
||
|
|
}
|
||
|
|
|
||
|
|
|
||
|
|
1;
|
||
|
|
|