2 // This file is part of Moodle - http://moodle.org/
4 // Moodle is free software: you can redistribute it and/or modify
5 // it under the terms of the GNU General Public License as published by
6 // the Free Software Foundation, either version 3 of the License, or
7 // (at your option) any later version.
9 // Moodle is distributed in the hope that it will be useful,
10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 // GNU General Public License for more details.
14 // You should have received a copy of the GNU General Public License
15 // along with Moodle. If not, see <http://www.gnu.org/licenses/>.
18 * Authentication Plugin: LDAP Authentication
19 * Authentication using LDAP (Lightweight Directory Access Protocol).
22 * @author Martin Dougiamas
23 * @author IƱaki Arenaza
24 * @license http://www.gnu.org/copyleft/gpl.html GNU Public License
27 defined('MOODLE_INTERNAL') ||
die();
29 // See http://support.microsoft.com/kb/305144 to interprete these values.
30 if (!defined('AUTH_AD_ACCOUNTDISABLE')) {
31 define('AUTH_AD_ACCOUNTDISABLE', 0x0002);
33 if (!defined('AUTH_AD_NORMAL_ACCOUNT')) {
34 define('AUTH_AD_NORMAL_ACCOUNT', 0x0200);
36 if (!defined('AUTH_NTLMTIMEOUT')) { // timewindow for the NTLM SSO process, in secs...
37 define('AUTH_NTLMTIMEOUT', 10);
40 // UF_DONT_EXPIRE_PASSWD value taken from MSDN directly
41 if (!defined('UF_DONT_EXPIRE_PASSWD')) {
42 define ('UF_DONT_EXPIRE_PASSWD', 0x00010000);
45 // The Posix uid and gid of the 'nobody' account and 'nogroup' group.
46 if (!defined('AUTH_UID_NOBODY')) {
47 define('AUTH_UID_NOBODY', -2);
49 if (!defined('AUTH_GID_NOGROUP')) {
50 define('AUTH_GID_NOGROUP', -2);
53 // Regular expressions for a valid NTLM username and domain name.
54 if (!defined('AUTH_NTLM_VALID_USERNAME')) {
55 define('AUTH_NTLM_VALID_USERNAME', '[^/\\\\\\\\\[\]:;|=,+*?<>@"]+');
57 if (!defined('AUTH_NTLM_VALID_DOMAINNAME')) {
58 define('AUTH_NTLM_VALID_DOMAINNAME', '[^\\\\\\\\\/:*?"<>|]+');
60 // Default format for remote users if using NTLM SSO
61 if (!defined('AUTH_NTLM_DEFAULT_FORMAT')) {
62 define('AUTH_NTLM_DEFAULT_FORMAT', '%domain%\\%username%');
64 if (!defined('AUTH_NTLM_FASTPATH_ATTEMPT')) {
65 define('AUTH_NTLM_FASTPATH_ATTEMPT', 0);
67 if (!defined('AUTH_NTLM_FASTPATH_YESFORM')) {
68 define('AUTH_NTLM_FASTPATH_YESFORM', 1);
70 if (!defined('AUTH_NTLM_FASTPATH_YESATTEMPT')) {
71 define('AUTH_NTLM_FASTPATH_YESATTEMPT', 2);
74 // Allows us to retrieve a diagnostic message in case of LDAP operation error
75 if (!defined('LDAP_OPT_DIAGNOSTIC_MESSAGE')) {
76 define('LDAP_OPT_DIAGNOSTIC_MESSAGE', 0x0032);
79 require_once($CFG->libdir
.'/authlib.php');
80 require_once($CFG->libdir
.'/ldaplib.php');
81 require_once($CFG->dirroot
.'/user/lib.php');
82 require_once($CFG->dirroot
.'/auth/ldap/locallib.php');
85 * LDAP authentication plugin.
87 class auth_plugin_ldap
extends auth_plugin_base
{
90 * Init plugin config from database settings depending on the plugin auth type.
92 function init_plugin($authtype) {
93 $this->pluginconfig
= 'auth_'.$authtype;
94 $this->config
= get_config($this->pluginconfig
);
95 if (empty($this->config
->ldapencoding
)) {
96 $this->config
->ldapencoding
= 'utf-8';
98 if (empty($this->config
->user_type
)) {
99 $this->config
->user_type
= 'default';
102 $ldap_usertypes = ldap_supported_usertypes();
103 $this->config
->user_type_name
= $ldap_usertypes[$this->config
->user_type
];
104 unset($ldap_usertypes);
106 $default = ldap_getdefaults();
108 // Use defaults if values not given
109 foreach ($default as $key => $value) {
110 // watch out - 0, false are correct values too
111 if (!isset($this->config
->{$key}) or $this->config
->{$key} == '') {
112 $this->config
->{$key} = $value[$this->config
->user_type
];
116 // Hack prefix to objectclass
117 $this->config
->objectclass
= ldap_normalise_objectclass($this->config
->objectclass
);
121 * Constructor with initialisation.
123 public function __construct() {
124 $this->authtype
= 'ldap';
125 $this->roleauth
= 'auth_ldap';
126 $this->errorlogtag
= '[AUTH LDAP] ';
127 $this->init_plugin($this->authtype
);
131 * Old syntax of class constructor. Deprecated in PHP7.
133 * @deprecated since Moodle 3.1
135 public function auth_plugin_ldap() {
136 debugging('Use of class name as constructor is deprecated', DEBUG_DEVELOPER
);
141 * Returns true if the username and password work and false if they are
142 * wrong or don't exist.
144 * @param string $username The username (without system magic quotes)
145 * @param string $password The password (without system magic quotes)
147 * @return bool Authentication success or failure.
149 function user_login($username, $password) {
150 if (! function_exists('ldap_bind')) {
151 throw new \
moodle_exception('auth_ldapnotinstalled', 'auth_ldap');
155 if (!$username or !$password) { // Don't allow blank usernames or passwords
159 $extusername = core_text
::convert($username, 'utf-8', $this->config
->ldapencoding
);
160 $extpassword = core_text
::convert($password, 'utf-8', $this->config
->ldapencoding
);
162 // Before we connect to LDAP, check if this is an AD SSO login
163 // if we succeed in this block, we'll return success early.
166 if (!empty($this->config
->ntlmsso_enabled
) && $key === $password) {
167 $sessusername = get_cache_flag($this->pluginconfig
.'/ntlmsess', $key);
168 // We only get the cache flag if we retrieve it before
169 // it expires (AUTH_NTLMTIMEOUT seconds).
170 if (empty($sessusername)) {
174 if ($username === $sessusername) {
175 unset($sessusername);
177 // Check that the user is inside one of the configured LDAP contexts
179 $ldapconnection = $this->ldap_connect();
180 // if the user is not inside the configured contexts,
181 // ldap_find_userdn returns false.
182 if ($this->ldap_find_userdn($ldapconnection, $extusername)) {
187 // Shortcut here - SSO confirmed
190 } // End SSO processing
193 $ldapconnection = $this->ldap_connect();
194 $ldap_user_dn = $this->ldap_find_userdn($ldapconnection, $extusername);
196 // If ldap_user_dn is empty, user does not exist
197 if (!$ldap_user_dn) {
202 // Try to bind with current username and password
203 $ldap_login = @ldap_bind
($ldapconnection, $ldap_user_dn, $extpassword);
205 // If login fails and we are using MS Active Directory, retrieve the diagnostic
206 // message to see if this is due to an expired password, or that the user is forced to
207 // change the password on first login. If it is, only proceed if we can change
208 // password from Moodle (otherwise we'll get stuck later in the login process).
209 if (!$ldap_login && ($this->config
->user_type
== 'ad')
210 && $this->can_change_password()
211 && (!empty($this->config
->expiration
) and ($this->config
->expiration
== 1))) {
213 // We need to get the diagnostic message right after the call to ldap_bind(),
214 // before any other LDAP operation.
215 ldap_get_option($ldapconnection, LDAP_OPT_DIAGNOSTIC_MESSAGE
, $diagmsg);
217 if ($this->ldap_ad_pwdexpired_from_diagmsg($diagmsg)) {
218 // If login failed because user must change the password now or the
219 // password has expired, let the user in. We'll catch this later in the
220 // login process when we explicitly check for expired passwords.
229 * Reads user information from ldap and returns it in array()
231 * Function should return all information available. If you are saving
232 * this information to moodle user-table you should honor syncronization flags
234 * @param string $username username
236 * @return mixed array with no magic quotes or false on error
238 function get_userinfo($username) {
239 $extusername = core_text
::convert($username, 'utf-8', $this->config
->ldapencoding
);
241 $ldapconnection = $this->ldap_connect();
242 if(!($user_dn = $this->ldap_find_userdn($ldapconnection, $extusername))) {
247 $search_attribs = array();
248 $attrmap = $this->ldap_attributes();
249 foreach ($attrmap as $key => $values) {
250 if (!is_array($values)) {
251 $values = array($values);
253 foreach ($values as $value) {
254 if (!in_array($value, $search_attribs)) {
255 array_push($search_attribs, $value);
260 if (!$user_info_result = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs)) {
262 return false; // error!
265 $user_entry = ldap_get_entries_moodle($ldapconnection, $user_info_result);
266 if (empty($user_entry)) {
268 return false; // entry not found
272 foreach ($attrmap as $key => $values) {
273 if (!is_array($values)) {
274 $values = array($values);
277 foreach ($values as $value) {
278 $entry = $user_entry[0];
279 if (($value == 'dn') ||
($value == 'distinguishedname')) {
280 $result[$key] = $user_dn;
283 if (!array_key_exists($value, $entry)) {
284 continue; // wrong data mapping!
286 if (is_array($entry[$value])) {
287 $newval = core_text
::convert($entry[$value][0], $this->config
->ldapencoding
, 'utf-8');
289 $newval = core_text
::convert($entry[$value], $this->config
->ldapencoding
, 'utf-8');
291 if (!empty($newval)) { // favour ldap entries that are set
295 if (!is_null($ldapval)) {
296 $result[$key] = $ldapval;
305 * Reads user information from ldap and returns it in an object
307 * @param string $username username (with system magic quotes)
308 * @return mixed object or false on error
310 function get_userinfo_asobj($username) {
311 $user_array = $this->get_userinfo($username);
312 if ($user_array == false) {
313 return false; //error or not found
315 $user_array = truncate_userinfo($user_array);
316 $user = new stdClass();
317 foreach ($user_array as $key=>$value) {
318 $user->{$key} = $value;
324 * Returns all usernames from LDAP
326 * get_userlist returns all usernames from LDAP
330 function get_userlist() {
331 return $this->ldap_get_userlist("({$this->config->user_attribute}=*)");
335 * Checks if user exists on LDAP
337 * @param string $username
339 function user_exists($username) {
340 $extusername = core_text
::convert($username, 'utf-8', $this->config
->ldapencoding
);
342 // Returns true if given username exists on ldap
343 $users = $this->ldap_get_userlist('('.$this->config
->user_attribute
.'='.ldap_filter_addslashes($extusername).')');
344 return count($users);
348 * Creates a new user on LDAP.
349 * By using information in userobject
350 * Use user_exists to prevent duplicate usernames
352 * @param mixed $userobject Moodle userobject
353 * @param mixed $plainpass Plaintext password
355 function user_create($userobject, $plainpass) {
356 $extusername = core_text
::convert($userobject->username
, 'utf-8', $this->config
->ldapencoding
);
357 $extpassword = core_text
::convert($plainpass, 'utf-8', $this->config
->ldapencoding
);
359 switch ($this->config
->passtype
) {
361 $extpassword = '{MD5}' . base64_encode(pack('H*', md5($extpassword)));
364 $extpassword = '{SHA}' . base64_encode(pack('H*', sha1($extpassword)));
371 $ldapconnection = $this->ldap_connect();
372 $attrmap = $this->ldap_attributes();
376 foreach ($attrmap as $key => $values) {
377 if (!is_array($values)) {
378 $values = array($values);
380 foreach ($values as $value) {
381 if (!empty($userobject->$key) ) {
382 $newuser[$value] = core_text
::convert($userobject->$key, 'utf-8', $this->config
->ldapencoding
);
387 //Following sets all mandatory and other forced attribute values
388 //User should be creted as login disabled untill email confirmation is processed
389 //Feel free to add your user type and send patches to paca@sci.fi to add them
390 //Moodle distribution
392 switch ($this->config
->user_type
) {
394 $newuser['objectClass'] = array('inetOrgPerson', 'organizationalPerson', 'person', 'top');
395 $newuser['uniqueId'] = $extusername;
396 $newuser['logindisabled'] = 'TRUE';
397 $newuser['userpassword'] = $extpassword;
398 $uadd = ldap_add($ldapconnection, $this->config
->user_attribute
.'='.ldap_addslashes($extusername).','.$this->config
->create_context
, $newuser);
402 // posixAccount object class forces us to specify a uidNumber
403 // and a gidNumber. That is quite complicated to generate from
404 // Moodle without colliding with existing numbers and without
405 // race conditions. As this user is supposed to be only used
406 // with Moodle (otherwise the user would exist beforehand) and
407 // doesn't need to login into a operating system, we assign the
408 // user the uid of user 'nobody' and gid of group 'nogroup'. In
409 // addition to that, we need to specify a home directory. We
410 // use the root directory ('/') as the home directory, as this
411 // is the only one can always be sure exists. Finally, even if
412 // it's not mandatory, we specify '/bin/false' as the login
413 // shell, to prevent the user from login in at the operating
414 // system level (Moodle ignores this).
416 $newuser['objectClass'] = array('posixAccount', 'inetOrgPerson', 'organizationalPerson', 'person', 'top');
417 $newuser['cn'] = $extusername;
418 $newuser['uid'] = $extusername;
419 $newuser['uidNumber'] = AUTH_UID_NOBODY
;
420 $newuser['gidNumber'] = AUTH_GID_NOGROUP
;
421 $newuser['homeDirectory'] = '/';
422 $newuser['loginShell'] = '/bin/false';
425 // We have to create the account locked, but posixAccount has
426 // no attribute to achive this reliably. So we are going to
427 // modify the password in a reversable way that we can later
428 // revert in user_activate().
430 // Beware that this can be defeated by the user if we are not
431 // using MD5 or SHA-1 passwords. After all, the source code of
432 // Moodle is available, and the user can see the kind of
433 // modification we are doing and 'undo' it by hand (but only
434 // if we are using plain text passwords).
436 // Also bear in mind that you need to use a binding user that
437 // can create accounts and has read/write privileges on the
438 // 'userPassword' attribute for this to work.
440 $newuser['userPassword'] = '*'.$extpassword;
441 $uadd = ldap_add($ldapconnection, $this->config
->user_attribute
.'='.ldap_addslashes($extusername).','.$this->config
->create_context
, $newuser);
444 // User account creation is a two step process with AD. First you
445 // create the user object, then you set the password. If you try
446 // to set the password while creating the user, the operation
449 // Passwords in Active Directory must be encoded as Unicode
450 // strings (UCS-2 Little Endian format) and surrounded with
451 // double quotes. See http://support.microsoft.com/?kbid=269190
452 if (!function_exists('mb_convert_encoding')) {
453 throw new \
moodle_exception('auth_ldap_no_mbstring', 'auth_ldap');
456 // Check for invalid sAMAccountName characters.
457 if (preg_match('#[/\\[\]:;|=,+*?<>@"]#', $extusername)) {
458 throw new \
moodle_exception ('auth_ldap_ad_invalidchars', 'auth_ldap');
461 // First create the user account, and mark it as disabled.
462 $newuser['objectClass'] = array('top', 'person', 'user', 'organizationalPerson');
463 $newuser['sAMAccountName'] = $extusername;
464 $newuser['userAccountControl'] = AUTH_AD_NORMAL_ACCOUNT |
465 AUTH_AD_ACCOUNTDISABLE
;
466 $userdn = 'cn='.ldap_addslashes($extusername).','.$this->config
->create_context
;
467 if (!ldap_add($ldapconnection, $userdn, $newuser)) {
468 throw new \
moodle_exception('auth_ldap_ad_create_req', 'auth_ldap');
471 // Now set the password
473 $newuser['unicodePwd'] = mb_convert_encoding('"' . $extpassword . '"',
475 if(!ldap_modify($ldapconnection, $userdn, $newuser)) {
476 // Something went wrong: delete the user account and error out
477 ldap_delete ($ldapconnection, $userdn);
478 throw new \
moodle_exception('auth_ldap_ad_create_req', 'auth_ldap');
483 throw new \
moodle_exception('auth_ldap_unsupportedusertype', 'auth_ldap', '', $this->config
->user_type_name
);
490 * Returns true if plugin allows resetting of password from moodle.
494 function can_reset_password() {
495 return !empty($this->config
->stdchangepassword
);
499 * Returns true if plugin can be manually set.
503 function can_be_manually_set() {
508 * Returns true if plugin allows signup and user creation.
512 function can_signup() {
513 return (!empty($this->config
->auth_user_create
) and !empty($this->config
->create_context
));
517 * Sign up a new user ready for confirmation.
518 * Password is passed in plaintext.
520 * @param object $user new user object
521 * @param boolean $notify print notice with link and terminate
522 * @return boolean success
524 function user_signup($user, $notify=true) {
525 global $CFG, $DB, $PAGE, $OUTPUT;
527 require_once($CFG->dirroot
.'/user/profile/lib.php');
528 require_once($CFG->dirroot
.'/user/lib.php');
530 if ($this->user_exists($user->username
)) {
531 throw new \
moodle_exception('auth_ldap_user_exists', 'auth_ldap');
534 $plainslashedpassword = $user->password
;
535 unset($user->password
);
537 if (! $this->user_create($user, $plainslashedpassword)) {
538 throw new \
moodle_exception('auth_ldap_create_error', 'auth_ldap');
541 $user->id
= user_create_user($user, false, false);
543 user_add_password_history($user->id
, $plainslashedpassword);
545 // Save any custom profile field information
546 profile_save_data($user);
548 $userinfo = $this->get_userinfo($user->username
);
549 $this->update_user_record($user->username
, false, false, $this->is_user_suspended((object) $userinfo));
551 // This will also update the stored hash to the latest algorithm
552 // if the existing hash is using an out-of-date algorithm (or the
553 // legacy md5 algorithm).
554 update_internal_user_password($user, $plainslashedpassword);
556 $user = $DB->get_record('user', array('id'=>$user->id
));
558 \core\event\user_created
::create_from_userid($user->id
)->trigger();
560 if (! send_confirmation_email($user)) {
561 throw new \
moodle_exception('noemail', 'auth_ldap');
565 $emailconfirm = get_string('emailconfirm');
566 $PAGE->set_url('/auth/ldap/auth.php');
567 $PAGE->navbar
->add($emailconfirm);
568 $PAGE->set_title($emailconfirm);
569 $PAGE->set_heading($emailconfirm);
570 echo $OUTPUT->header();
571 notice(get_string('emailconfirmsent', '', $user->email
), "{$CFG->wwwroot}/index.php");
578 * Returns true if plugin allows confirming of new users.
582 function can_confirm() {
583 return $this->can_signup();
587 * Confirm the new user as registered.
589 * @param string $username
590 * @param string $confirmsecret
592 function user_confirm($username, $confirmsecret) {
595 $user = get_complete_user_data('username', $username);
598 if ($user->auth
!= $this->authtype
) {
599 return AUTH_CONFIRM_ERROR
;
601 } else if ($user->secret
=== $confirmsecret && $user->confirmed
) {
602 return AUTH_CONFIRM_ALREADY
;
604 } else if ($user->secret
=== $confirmsecret) { // They have provided the secret key to get in
605 if (!$this->user_activate($username)) {
606 return AUTH_CONFIRM_FAIL
;
608 $user->confirmed
= 1;
609 user_update_user($user, false);
610 return AUTH_CONFIRM_OK
;
613 return AUTH_CONFIRM_ERROR
;
618 * Return number of days to user password expires
620 * If userpassword does not expire it should return 0. If password is already expired
621 * it should return negative value.
623 * @param mixed $username username
626 function password_expire($username) {
629 $extusername = core_text
::convert($username, 'utf-8', $this->config
->ldapencoding
);
631 $ldapconnection = $this->ldap_connect();
632 $user_dn = $this->ldap_find_userdn($ldapconnection, $extusername);
633 $search_attribs = array($this->config
->expireattr
);
634 $sr = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs);
636 $info = ldap_get_entries_moodle($ldapconnection, $sr);
637 if (!empty ($info)) {
639 if (isset($info[$this->config
->expireattr
][0])) {
640 $expiretime = $this->ldap_expirationtime2unix($info[$this->config
->expireattr
][0], $ldapconnection, $user_dn);
641 if ($expiretime != 0) {
643 if ($expiretime > $now) {
644 $result = ceil(($expiretime - $now) / DAYSECS
);
646 $result = floor(($expiretime - $now) / DAYSECS
);
652 error_log($this->errorlogtag
.get_string('didtfindexpiretime', 'auth_ldap'));
659 * Syncronizes user fron external LDAP server to moodle user table
661 * Sync is now using username attribute.
663 * Syncing users removes or suspends users that dont exists anymore in external LDAP.
664 * Creates new users and updates coursecreator status of users.
666 * @param bool $do_updates will do pull in data updates from LDAP if relevant
668 function sync_users($do_updates=true) {
671 require_once($CFG->dirroot
. '/user/profile/lib.php');
673 print_string('connectingldap', 'auth_ldap');
674 $ldapconnection = $this->ldap_connect();
676 $dbman = $DB->get_manager();
678 /// Define table user to be created
679 $table = new xmldb_table('tmp_extuser');
680 $table->add_field('id', XMLDB_TYPE_INTEGER
, '10', XMLDB_UNSIGNED
, XMLDB_NOTNULL
, XMLDB_SEQUENCE
, null);
681 $table->add_field('username', XMLDB_TYPE_CHAR
, '100', null, XMLDB_NOTNULL
, null, null);
682 $table->add_field('mnethostid', XMLDB_TYPE_INTEGER
, '10', XMLDB_UNSIGNED
, XMLDB_NOTNULL
, null, null);
683 $table->add_key('primary', XMLDB_KEY_PRIMARY
, array('id'));
684 $table->add_index('username', XMLDB_INDEX_UNIQUE
, array('mnethostid', 'username'));
686 print_string('creatingtemptable', 'auth_ldap', 'tmp_extuser');
687 $dbman->create_temp_table($table);
690 //// get user's list from ldap to sql in a scalable fashion
692 // prepare some data we'll need
693 $filter = '(&('.$this->config
->user_attribute
.'=*)'.$this->config
->objectclass
.')';
694 $servercontrols = array();
696 $contexts = explode(';', $this->config
->contexts
);
698 if (!empty($this->config
->create_context
)) {
699 array_push($contexts, $this->config
->create_context
);
702 $ldappagedresults = ldap_paged_results_supported($this->config
->ldap_version
, $ldapconnection);
704 foreach ($contexts as $context) {
705 $context = trim($context);
706 if (empty($context)) {
711 if ($ldappagedresults) {
712 $servercontrols = array(array(
713 'oid' => LDAP_CONTROL_PAGEDRESULTS
, 'value' => array(
714 'size' => $this->config
->pagesize
, 'cookie' => $ldapcookie)));
716 if ($this->config
->search_sub
) {
717 // Use ldap_search to find first user from subtree.
718 $ldapresult = ldap_search($ldapconnection, $context, $filter, array($this->config
->user_attribute
),
719 0, -1, -1, LDAP_DEREF_NEVER
, $servercontrols);
721 // Search only in this context.
722 $ldapresult = ldap_list($ldapconnection, $context, $filter, array($this->config
->user_attribute
),
723 0, -1, -1, LDAP_DEREF_NEVER
, $servercontrols);
728 if ($ldappagedresults) {
729 // Get next server cookie to know if we'll need to continue searching.
731 // Get next cookie from controls.
732 ldap_parse_result($ldapconnection, $ldapresult, $errcode, $matcheddn,
733 $errmsg, $referrals, $controls);
734 if (isset($controls[LDAP_CONTROL_PAGEDRESULTS
]['value']['cookie'])) {
735 $ldapcookie = $controls[LDAP_CONTROL_PAGEDRESULTS
]['value']['cookie'];
738 if ($entry = @ldap_first_entry
($ldapconnection, $ldapresult)) {
740 $value = ldap_get_values_len($ldapconnection, $entry, $this->config
->user_attribute
);
741 $value = core_text
::convert($value[0], $this->config
->ldapencoding
, 'utf-8');
742 $value = trim($value);
743 $this->ldap_bulk_insert($value);
744 } while ($entry = ldap_next_entry($ldapconnection, $entry));
746 unset($ldapresult); // Free mem.
747 } while ($ldappagedresults && $ldapcookie !== null && $ldapcookie != '');
750 // If LDAP paged results were used, the current connection must be completely
751 // closed and a new one created, to work without paged results from here on.
752 if ($ldappagedresults) {
753 $this->ldap_close(true);
754 $ldapconnection = $this->ldap_connect();
757 /// preserve our user database
758 /// if the temp table is empty, it probably means that something went wrong, exit
759 /// so as to avoid mass deletion of users; which is hard to undo
760 $count = $DB->count_records_sql('SELECT COUNT(username) AS count, 1 FROM {tmp_extuser}');
762 print_string('didntgetusersfromldap', 'auth_ldap');
763 $dbman->drop_table($table);
767 print_string('gotcountrecordsfromldap', 'auth_ldap', $count);
772 // Find users in DB that aren't in ldap -- to be removed!
773 // this is still not as scalable (but how often do we mass delete?)
775 if ($this->config
->removeuser
== AUTH_REMOVEUSER_FULLDELETE
) {
778 LEFT JOIN {tmp_extuser} e ON (u.username = e.username AND u.mnethostid = e.mnethostid)
781 AND e.username IS NULL";
782 $remove_users = $DB->get_records_sql($sql, array('auth'=>$this->authtype
));
784 if (!empty($remove_users)) {
785 print_string('userentriestoremove', 'auth_ldap', count($remove_users));
786 foreach ($remove_users as $user) {
787 if (delete_user($user)) {
788 echo "\t"; print_string('auth_dbdeleteuser', 'auth_db', array('name'=>$user->username
, 'id'=>$user->id
)); echo "\n";
790 echo "\t"; print_string('auth_dbdeleteusererror', 'auth_db', $user->username
); echo "\n";
794 print_string('nouserentriestoremove', 'auth_ldap');
796 unset($remove_users); // Free mem!
798 } else if ($this->config
->removeuser
== AUTH_REMOVEUSER_SUSPEND
) {
801 LEFT JOIN {tmp_extuser} e ON (u.username = e.username AND u.mnethostid = e.mnethostid)
805 AND e.username IS NULL";
806 $remove_users = $DB->get_records_sql($sql, array('auth'=>$this->authtype
));
808 if (!empty($remove_users)) {
809 print_string('userentriestoremove', 'auth_ldap', count($remove_users));
811 foreach ($remove_users as $user) {
812 $updateuser = new stdClass();
813 $updateuser->id
= $user->id
;
814 $updateuser->suspended
= 1;
815 user_update_user($updateuser, false);
816 echo "\t"; print_string('auth_dbsuspenduser', 'auth_db', array('name'=>$user->username
, 'id'=>$user->id
)); echo "\n";
817 \core\session\manager
::kill_user_sessions($user->id
);
820 print_string('nouserentriestoremove', 'auth_ldap');
822 unset($remove_users); // Free mem!
825 /// Revive suspended users
826 if (!empty($this->config
->removeuser
) and $this->config
->removeuser
== AUTH_REMOVEUSER_SUSPEND
) {
827 $sql = "SELECT u.id, u.username
829 JOIN {tmp_extuser} e ON (u.username = e.username AND u.mnethostid = e.mnethostid)
830 WHERE (u.auth = 'nologin' OR (u.auth = ? AND u.suspended = 1)) AND u.deleted = 0";
831 // Note: 'nologin' is there for backwards compatibility.
832 $revive_users = $DB->get_records_sql($sql, array($this->authtype
));
834 if (!empty($revive_users)) {
835 print_string('userentriestorevive', 'auth_ldap', count($revive_users));
837 foreach ($revive_users as $user) {
838 $updateuser = new stdClass();
839 $updateuser->id
= $user->id
;
840 $updateuser->auth
= $this->authtype
;
841 $updateuser->suspended
= 0;
842 user_update_user($updateuser, false);
843 echo "\t"; print_string('auth_dbreviveduser', 'auth_db', array('name'=>$user->username
, 'id'=>$user->id
)); echo "\n";
846 print_string('nouserentriestorevive', 'auth_ldap');
849 unset($revive_users);
853 /// User Updates - time-consuming (optional)
855 // Narrow down what fields we need to update
856 $updatekeys = $this->get_profile_keys();
859 print_string('noupdatestobedone', 'auth_ldap');
861 if ($do_updates and !empty($updatekeys)) { // run updates only if relevant
862 $users = $DB->get_records_sql('SELECT u.username, u.id
864 WHERE u.deleted = 0 AND u.auth = ? AND u.mnethostid = ?',
865 array($this->authtype
, $CFG->mnet_localhost_id
));
866 if (!empty($users)) {
867 print_string('userentriestoupdate', 'auth_ldap', count($users));
869 foreach ($users as $user) {
870 $transaction = $DB->start_delegated_transaction();
871 echo "\t"; print_string('auth_dbupdatinguser', 'auth_db', array('name'=>$user->username
, 'id'=>$user->id
));
872 $userinfo = $this->get_userinfo($user->username
);
873 if (!$this->update_user_record($user->username
, $updatekeys, true,
874 $this->is_user_suspended((object) $userinfo))) {
875 echo ' - '.get_string('skipped');
879 // Update system roles, if needed.
880 $this->sync_roles($user);
881 $transaction->allow_commit();
883 unset($users); // free mem
885 } else { // end do updates
886 print_string('noupdatestobedone', 'auth_ldap');
890 // Find users missing in DB that are in LDAP
891 // and gives me a nifty object I don't want.
892 // note: we do not care about deleted accounts anymore, this feature was replaced by suspending to nologin auth plugin
893 $sql = 'SELECT e.id, e.username
895 LEFT JOIN {user} u ON (e.username = u.username AND e.mnethostid = u.mnethostid)
897 $add_users = $DB->get_records_sql($sql);
899 if (!empty($add_users)) {
900 print_string('userentriestoadd', 'auth_ldap', count($add_users));
903 foreach ($add_users as $user) {
904 $transaction = $DB->start_delegated_transaction();
905 $user = $this->get_userinfo_asobj($user->username
);
908 $user->modified
= time();
909 $user->confirmed
= 1;
910 $user->auth
= $this->authtype
;
911 $user->mnethostid
= $CFG->mnet_localhost_id
;
912 // get_userinfo_asobj() might have replaced $user->username with the value
913 // from the LDAP server (which can be mixed-case). Make sure it's lowercase
914 $user->username
= trim(core_text
::strtolower($user->username
));
915 // It isn't possible to just rely on the configured suspension attribute since
916 // things like active directory use bit masks, other things using LDAP might
917 // do different stuff as well.
919 // The cast to int is a workaround for MDL-53959.
920 $user->suspended
= (int)$this->is_user_suspended($user);
922 if (empty($user->calendartype
)) {
923 $user->calendartype
= $CFG->calendartype
;
926 // $id = user_create_user($user, false);
928 $id = user_create_user($user, false);
929 } catch (Exception
$e) {
930 print_string('invaliduserexception', 'auth_ldap', print_r($user, true) . $e->getMessage());
934 echo "\t"; print_string('auth_dbinsertuser', 'auth_db', array('name'=>$user->username
, 'id'=>$id)); echo "\n";
935 $euser = $DB->get_record('user', array('id' => $id));
937 if (!empty($this->config
->forcechangepassword
)) {
938 set_user_preference('auth_forcepasswordchange', 1, $id);
941 // Save custom profile fields.
942 $this->update_user_record($user->username
, $this->get_profile_keys(true), false);
944 // Add roles if needed.
945 $this->sync_roles($euser);
946 $transaction->allow_commit();
949 // Display number of user creation errors, if any.
951 print_string('invalidusererrors', 'auth_ldap', $errors);
954 unset($add_users); // free mem
956 print_string('nouserstobeadded', 'auth_ldap');
959 $dbman->drop_table($table);
966 * Bulk insert in SQL's temp table
968 function ldap_bulk_insert($username) {
971 $username = core_text
::strtolower($username); // usernames are __always__ lowercase.
972 $DB->insert_record_raw('tmp_extuser', array('username'=>$username,
973 'mnethostid'=>$CFG->mnet_localhost_id
), false, true);
978 * Activates (enables) user in external LDAP so user can login
980 * @param mixed $username
981 * @return boolean result
983 function user_activate($username) {
984 $extusername = core_text
::convert($username, 'utf-8', $this->config
->ldapencoding
);
986 $ldapconnection = $this->ldap_connect();
988 $userdn = $this->ldap_find_userdn($ldapconnection, $extusername);
989 switch ($this->config
->user_type
) {
991 $newinfo['loginDisabled'] = 'FALSE';
995 // Remember that we add a '*' character in front of the
996 // external password string to 'disable' the account. We just
997 // need to remove it.
998 $sr = ldap_read($ldapconnection, $userdn, '(objectClass=*)',
999 array('userPassword'));
1000 $info = ldap_get_entries($ldapconnection, $sr);
1001 $info[0] = array_change_key_case($info[0], CASE_LOWER
);
1002 $newinfo['userPassword'] = ltrim($info[0]['userpassword'][0], '*');
1005 // We need to unset the ACCOUNTDISABLE bit in the
1006 // userAccountControl attribute ( see
1007 // http://support.microsoft.com/kb/305144 )
1008 $sr = ldap_read($ldapconnection, $userdn, '(objectClass=*)',
1009 array('userAccountControl'));
1010 $info = ldap_get_entries($ldapconnection, $sr);
1011 $info[0] = array_change_key_case($info[0], CASE_LOWER
);
1012 $newinfo['userAccountControl'] = $info[0]['useraccountcontrol'][0]
1013 & (~AUTH_AD_ACCOUNTDISABLE
);
1016 throw new \
moodle_exception('user_activatenotsupportusertype', 'auth_ldap', '', $this->config
->user_type_name
);
1018 $result = ldap_modify($ldapconnection, $userdn, $newinfo);
1019 $this->ldap_close();
1024 * Returns true if user should be coursecreator.
1026 * @param mixed $username username (without system magic quotes)
1027 * @return mixed result null if course creators is not configured, boolean otherwise.
1029 * @deprecated since Moodle 3.4 MDL-30634 - please do not use this function any more.
1031 function iscreator($username) {
1032 debugging('iscreator() is deprecated. Please use auth_plugin_ldap::is_role() instead.', DEBUG_DEVELOPER
);
1034 if (empty($this->config
->creators
) or empty($this->config
->memberattribute
)) {
1038 $extusername = core_text
::convert($username, 'utf-8', $this->config
->ldapencoding
);
1040 $ldapconnection = $this->ldap_connect();
1042 if ($this->config
->memberattribute_isdn
) {
1043 if(!($userid = $this->ldap_find_userdn($ldapconnection, $extusername))) {
1047 $userid = $extusername;
1050 $group_dns = explode(';', $this->config
->creators
);
1051 $creator = ldap_isgroupmember($ldapconnection, $userid, $group_dns, $this->config
->memberattribute
);
1053 $this->ldap_close();
1059 * Check if user has LDAP group membership.
1061 * Returns true if user should be assigned role.
1063 * @param mixed $username username (without system magic quotes).
1064 * @param array $role Array of role's shortname, localname, and settingname for the config value.
1065 * @return mixed result null if role/LDAP context is not configured, boolean otherwise.
1067 private function is_role($username, $role) {
1068 if (empty($this->config
->{$role['settingname']}) or empty($this->config
->memberattribute
)) {
1072 $extusername = core_text
::convert($username, 'utf-8', $this->config
->ldapencoding
);
1074 $ldapconnection = $this->ldap_connect();
1076 if ($this->config
->memberattribute_isdn
) {
1077 if (!($userid = $this->ldap_find_userdn($ldapconnection, $extusername))) {
1081 $userid = $extusername;
1084 $groupdns = explode(';', $this->config
->{$role['settingname']});
1085 $isrole = ldap_isgroupmember($ldapconnection, $userid, $groupdns, $this->config
->memberattribute
);
1087 $this->ldap_close();
1093 * Called when the user record is updated.
1095 * Modifies user in external LDAP server. It takes olduser (before
1096 * changes) and newuser (after changes) compares information and
1097 * saves modified information to external LDAP server.
1099 * @param mixed $olduser Userobject before modifications (without system magic quotes)
1100 * @param mixed $newuser Userobject new modified userobject (without system magic quotes)
1101 * @return boolean result
1104 function user_update($olduser, $newuser) {
1107 require_once($CFG->dirroot
. '/user/profile/lib.php');
1109 if (isset($olduser->username
) and isset($newuser->username
) and $olduser->username
!= $newuser->username
) {
1110 error_log($this->errorlogtag
.get_string('renamingnotallowed', 'auth_ldap'));
1114 if (isset($olduser->auth
) and $olduser->auth
!= $this->authtype
) {
1115 return true; // just change auth and skip update
1118 $attrmap = $this->ldap_attributes();
1119 // Before doing anything else, make sure we really need to update anything
1120 // in the external LDAP server.
1121 $update_external = false;
1122 foreach ($attrmap as $key => $ldapkeys) {
1123 if (!empty($this->config
->{'field_updateremote_'.$key})) {
1124 $update_external = true;
1128 if (!$update_external) {
1132 $extoldusername = core_text
::convert($olduser->username
, 'utf-8', $this->config
->ldapencoding
);
1134 $ldapconnection = $this->ldap_connect();
1136 $search_attribs = array();
1137 foreach ($attrmap as $key => $values) {
1138 if (!is_array($values)) {
1139 $values = array($values);
1141 foreach ($values as $value) {
1142 if (!in_array($value, $search_attribs)) {
1143 array_push($search_attribs, $value);
1148 if(!($user_dn = $this->ldap_find_userdn($ldapconnection, $extoldusername))) {
1152 // Load old custom fields.
1153 $olduserprofilefields = (array) profile_user_record($olduser->id
, false);
1156 foreach (profile_get_custom_fields(false) as $field) {
1157 $fields[$field->shortname
] = $field;
1161 $user_info_result = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs);
1162 if ($user_info_result) {
1163 $user_entry = ldap_get_entries_moodle($ldapconnection, $user_info_result);
1164 if (empty($user_entry)) {
1165 $attribs = join (', ', $search_attribs);
1166 error_log($this->errorlogtag
.get_string('updateusernotfound', 'auth_ldap',
1167 array('userdn'=>$user_dn,
1168 'attribs'=>$attribs)));
1169 return false; // old user not found!
1170 } else if (count($user_entry) > 1) {
1171 error_log($this->errorlogtag
.get_string('morethanoneuser', 'auth_ldap'));
1175 $user_entry = $user_entry[0];
1177 foreach ($attrmap as $key => $ldapkeys) {
1178 if (preg_match('/^profile_field_(.*)$/', $key, $match)) {
1180 $fieldname = $match[1];
1181 if (isset($fields[$fieldname])) {
1182 $class = 'profile_field_' . $fields[$fieldname]->datatype
;
1183 $formfield = new $class($fields[$fieldname]->id
, $olduser->id
);
1184 $oldvalue = isset($olduserprofilefields[$fieldname]) ?
$olduserprofilefields[$fieldname] : null;
1188 $newvalue = $formfield->edit_save_data_preprocess($newuser->{$formfield->inputname
}, new stdClass
);
1191 $oldvalue = isset($olduser->$key) ?
$olduser->$key : null;
1192 $newvalue = isset($newuser->$key) ?
$newuser->$key : null;
1195 if ($newvalue !== null and $newvalue !== $oldvalue and !empty($this->config
->{'field_updateremote_' . $key})) {
1196 // For ldap values that could be in more than one
1197 // ldap key, we will do our best to match
1198 // where they came from
1201 if (!is_array($ldapkeys)) {
1202 $ldapkeys = array($ldapkeys);
1204 if (count($ldapkeys) < 2) {
1208 $nuvalue = core_text
::convert($newvalue, 'utf-8', $this->config
->ldapencoding
);
1209 empty($nuvalue) ?
$nuvalue = array() : $nuvalue;
1210 $ouvalue = core_text
::convert($oldvalue, 'utf-8', $this->config
->ldapencoding
);
1211 foreach ($ldapkeys as $ldapkey) {
1212 // If the field is empty in LDAP there are two options:
1213 // 1. We get the LDAP field using ldap_first_attribute.
1214 // 2. LDAP don't send the field using ldap_first_attribute.
1215 // So, for option 1 we check the if the field is retrieve it.
1216 // And get the original value of field in LDAP if the field.
1217 // Otherwise, let value in blank and delegate the check in ldap_modify.
1218 if (isset($user_entry[$ldapkey][0])) {
1219 $ldapvalue = $user_entry[$ldapkey][0];
1225 // Skip update if the values already match
1226 if ($nuvalue !== $ldapvalue) {
1227 // This might fail due to schema validation
1228 if (@ldap_modify
($ldapconnection, $user_dn, array($ldapkey => $nuvalue))) {
1233 error_log($this->errorlogtag
.get_string ('updateremfail', 'auth_ldap',
1234 array('errno'=>ldap_errno($ldapconnection),
1235 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)),
1237 'ouvalue'=>$ouvalue,
1238 'nuvalue'=>$nuvalue)));
1243 // Ambiguous. Value empty before in Moodle (and LDAP) - use
1244 // 1st ldap candidate field, no need to guess
1245 if ($ouvalue === '') { // value empty before - use 1st ldap candidate
1246 // This might fail due to schema validation
1247 if (@ldap_modify
($ldapconnection, $user_dn, array($ldapkey => $nuvalue))) {
1252 error_log($this->errorlogtag
.get_string ('updateremfail', 'auth_ldap',
1253 array('errno'=>ldap_errno($ldapconnection),
1254 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)),
1256 'ouvalue'=>$ouvalue,
1257 'nuvalue'=>$nuvalue)));
1262 // We found which ldap key to update!
1263 if ($ouvalue !== '' and $ouvalue === $ldapvalue ) {
1264 // This might fail due to schema validation
1265 if (@ldap_modify
($ldapconnection, $user_dn, array($ldapkey => $nuvalue))) {
1270 error_log($this->errorlogtag
.get_string ('updateremfail', 'auth_ldap',
1271 array('errno'=>ldap_errno($ldapconnection),
1272 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)),
1274 'ouvalue'=>$ouvalue,
1275 'nuvalue'=>$nuvalue)));
1282 if ($ambiguous and !$changed) {
1284 error_log($this->errorlogtag
.get_string ('updateremfailamb', 'auth_ldap',
1286 'ouvalue'=>$ouvalue,
1287 'nuvalue'=>$nuvalue)));
1292 error_log($this->errorlogtag
.get_string ('usernotfound', 'auth_ldap'));
1296 $this->ldap_close();
1302 * Changes userpassword in LDAP
1304 * Called when the user password is updated. It assumes it is
1305 * called by an admin or that you've otherwise checked the user's
1308 * @param object $user User table object
1309 * @param string $newpassword Plaintext password (not crypted/md5'ed)
1310 * @return boolean result
1313 function user_update_password($user, $newpassword) {
1317 $username = $user->username
;
1319 $extusername = core_text
::convert($username, 'utf-8', $this->config
->ldapencoding
);
1320 $extpassword = core_text
::convert($newpassword, 'utf-8', $this->config
->ldapencoding
);
1322 switch ($this->config
->passtype
) {
1324 $extpassword = '{MD5}' . base64_encode(pack('H*', md5($extpassword)));
1327 $extpassword = '{SHA}' . base64_encode(pack('H*', sha1($extpassword)));
1334 $ldapconnection = $this->ldap_connect();
1336 $user_dn = $this->ldap_find_userdn($ldapconnection, $extusername);
1339 error_log($this->errorlogtag
.get_string ('nodnforusername', 'auth_ldap', $user->username
));
1343 switch ($this->config
->user_type
) {
1346 $result = ldap_modify($ldapconnection, $user_dn, array('userPassword' => $extpassword));
1348 error_log($this->errorlogtag
.get_string ('updatepasserror', 'auth_ldap',
1349 array('errno'=>ldap_errno($ldapconnection),
1350 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)))));
1352 // Update password expiration time, grace logins count
1353 $search_attribs = array($this->config
->expireattr
, 'passwordExpirationInterval', 'loginGraceLimit');
1354 $sr = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs);
1356 $entry = ldap_get_entries_moodle($ldapconnection, $sr);
1358 $newattrs = array();
1359 if (!empty($info[$this->config
->expireattr
][0])) {
1360 // Set expiration time only if passwordExpirationInterval is defined
1361 if (!empty($info['passwordexpirationinterval'][0])) {
1362 $expirationtime = time() +
$info['passwordexpirationinterval'][0];
1363 $ldapexpirationtime = $this->ldap_unix2expirationtime($expirationtime);
1364 $newattrs['passwordExpirationTime'] = $ldapexpirationtime;
1367 // Set gracelogin count
1368 if (!empty($info['logingracelimit'][0])) {
1369 $newattrs['loginGraceRemaining']= $info['logingracelimit'][0];
1372 // Store attribute changes in LDAP
1373 $result = ldap_modify($ldapconnection, $user_dn, $newattrs);
1375 error_log($this->errorlogtag
.get_string ('updatepasserrorexpiregrace', 'auth_ldap',
1376 array('errno'=>ldap_errno($ldapconnection),
1377 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)))));
1382 error_log($this->errorlogtag
.get_string ('updatepasserrorexpire', 'auth_ldap',
1383 array('errno'=>ldap_errno($ldapconnection),
1384 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)))));
1389 // Passwords in Active Directory must be encoded as Unicode
1390 // strings (UCS-2 Little Endian format) and surrounded with
1391 // double quotes. See http://support.microsoft.com/?kbid=269190
1392 if (!function_exists('mb_convert_encoding')) {
1393 error_log($this->errorlogtag
.get_string ('needmbstring', 'auth_ldap'));
1396 $extpassword = mb_convert_encoding('"'.$extpassword.'"', "UCS-2LE", $this->config
->ldapencoding
);
1397 $result = ldap_modify($ldapconnection, $user_dn, array('unicodePwd' => $extpassword));
1399 error_log($this->errorlogtag
.get_string ('updatepasserror', 'auth_ldap',
1400 array('errno'=>ldap_errno($ldapconnection),
1401 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)))));
1406 // Send LDAP the password in cleartext, it will md5 it itself
1407 $result = ldap_modify($ldapconnection, $user_dn, array('userPassword' => $extpassword));
1409 error_log($this->errorlogtag
.get_string ('updatepasserror', 'auth_ldap',
1410 array('errno'=>ldap_errno($ldapconnection),
1411 'errstring'=>ldap_err2str(ldap_errno($ldapconnection)))));
1416 $this->ldap_close();
1421 * Take expirationtime and return it as unix timestamp in seconds
1423 * Takes expiration timestamp as read from LDAP and returns it as unix timestamp in seconds
1424 * Depends on $this->config->user_type variable
1426 * @param mixed time Time stamp read from LDAP as it is.
1427 * @param string $ldapconnection Only needed for Active Directory.
1428 * @param string $user_dn User distinguished name for the user we are checking password expiration (only needed for Active Directory).
1431 function ldap_expirationtime2unix ($time, $ldapconnection, $user_dn) {
1433 switch ($this->config
->user_type
) {
1435 $yr=substr($time, 0, 4);
1436 $mo=substr($time, 4, 2);
1437 $dt=substr($time, 6, 2);
1438 $hr=substr($time, 8, 2);
1439 $min=substr($time, 10, 2);
1440 $sec=substr($time, 12, 2);
1441 $result = mktime($hr, $min, $sec, $mo, $dt, $yr);
1445 $result = $time * DAYSECS
; // The shadowExpire contains the number of DAYS between 01/01/1970 and the actual expiration date
1448 $result = $this->ldap_get_ad_pwdexpire($time, $ldapconnection, $user_dn);
1451 throw new \
moodle_exception('auth_ldap_usertypeundefined', 'auth_ldap');
1457 * Takes unix timestamp and returns it formated for storing in LDAP
1459 * @param integer unix time stamp
1461 function ldap_unix2expirationtime($time) {
1463 switch ($this->config
->user_type
) {
1465 $result=date('YmdHis', $time).'Z';
1469 $result = $time ; // Already in correct format
1472 throw new \
moodle_exception('auth_ldap_usertypeundefined2', 'auth_ldap');
1479 * Returns user attribute mappings between moodle and LDAP
1484 function ldap_attributes () {
1485 $moodleattributes = array();
1486 // If we have custom fields then merge them with user fields.
1487 $customfields = $this->get_custom_user_profile_fields();
1488 if (!empty($customfields) && !empty($this->userfields
)) {
1489 $userfields = array_merge($this->userfields
, $customfields);
1491 $userfields = $this->userfields
;
1494 foreach ($userfields as $field) {
1495 if (!empty($this->config
->{"field_map_$field"})) {
1496 $moodleattributes[$field] = core_text
::strtolower(trim($this->config
->{"field_map_$field"}));
1497 if (preg_match('/,/', $moodleattributes[$field])) {
1498 $moodleattributes[$field] = explode(',', $moodleattributes[$field]); // split ?
1502 $moodleattributes['username'] = core_text
::strtolower(trim($this->config
->user_attribute
));
1503 $moodleattributes['suspended'] = core_text
::strtolower(trim($this->config
->suspended_attribute
));
1504 return $moodleattributes;
1508 * Returns all usernames from LDAP
1510 * @param $filter An LDAP search filter to select desired users
1511 * @return array of LDAP user names converted to UTF-8
1513 function ldap_get_userlist($filter='*') {
1516 $ldapconnection = $this->ldap_connect();
1518 if ($filter == '*') {
1519 $filter = '(&('.$this->config
->user_attribute
.'=*)'.$this->config
->objectclass
.')';
1521 $servercontrols = array();
1523 $contexts = explode(';', $this->config
->contexts
);
1524 if (!empty($this->config
->create_context
)) {
1525 array_push($contexts, $this->config
->create_context
);
1529 $ldap_pagedresults = ldap_paged_results_supported($this->config
->ldap_version
, $ldapconnection);
1530 foreach ($contexts as $context) {
1531 $context = trim($context);
1532 if (empty($context)) {
1537 if ($ldap_pagedresults) {
1538 $servercontrols = array(array(
1539 'oid' => LDAP_CONTROL_PAGEDRESULTS
, 'value' => array(
1540 'size' => $this->config
->pagesize
, 'cookie' => $ldap_cookie)));
1542 if ($this->config
->search_sub
) {
1543 // Use ldap_search to find first user from subtree.
1544 $ldap_result = ldap_search($ldapconnection, $context, $filter, array($this->config
->user_attribute
),
1545 0, -1, -1, LDAP_DEREF_NEVER
, $servercontrols);
1547 // Search only in this context.
1548 $ldap_result = ldap_list($ldapconnection, $context, $filter, array($this->config
->user_attribute
),
1549 0, -1, -1, LDAP_DEREF_NEVER
, $servercontrols);
1554 if ($ldap_pagedresults) {
1555 // Get next server cookie to know if we'll need to continue searching.
1557 // Get next cookie from controls.
1558 ldap_parse_result($ldapconnection, $ldap_result, $errcode, $matcheddn,
1559 $errmsg, $referrals, $controls);
1560 if (isset($controls[LDAP_CONTROL_PAGEDRESULTS
]['value']['cookie'])) {
1561 $ldap_cookie = $controls[LDAP_CONTROL_PAGEDRESULTS
]['value']['cookie'];
1564 $users = ldap_get_entries_moodle($ldapconnection, $ldap_result);
1565 // Add found users to list.
1566 for ($i = 0; $i < count($users); $i++
) {
1567 $extuser = core_text
::convert($users[$i][$this->config
->user_attribute
][0],
1568 $this->config
->ldapencoding
, 'utf-8');
1569 array_push($fresult, $extuser);
1571 unset($ldap_result); // Free mem.
1572 } while ($ldap_pagedresults && !empty($ldap_cookie));
1575 // If paged results were used, make sure the current connection is completely closed
1576 $this->ldap_close($ldap_pagedresults);
1581 * Indicates if password hashes should be stored in local moodle database.
1583 * @return bool true means flag 'not_cached' stored instead of password hash
1585 function prevent_local_passwords() {
1586 return !empty($this->config
->preventpassindb
);
1590 * Returns true if this authentication plugin is 'internal'.
1594 function is_internal() {
1599 * Returns true if this authentication plugin can change the user's
1604 function can_change_password() {
1605 return !empty($this->config
->stdchangepassword
) or !empty($this->config
->changepasswordurl
);
1609 * Returns the URL for changing the user's password, or empty if the default can
1612 * @return moodle_url
1614 function change_password_url() {
1615 if (empty($this->config
->stdchangepassword
)) {
1616 if (!empty($this->config
->changepasswordurl
)) {
1617 return new moodle_url($this->config
->changepasswordurl
);
1627 * Will get called before the login page is shownr. Ff NTLM SSO
1628 * is enabled, and the user is in the right network, we'll redirect
1629 * to the magic NTLM page for SSO...
1632 function loginpage_hook() {
1633 global $CFG, $SESSION;
1635 // HTTPS is potentially required
1636 //httpsrequired(); - this must be used before setting the URL, it is already done on the login/index.php
1638 if (($_SERVER['REQUEST_METHOD'] === 'GET' // Only on initial GET of loginpage
1639 ||
($_SERVER['REQUEST_METHOD'] === 'POST'
1640 && (get_local_referer() != strip_querystring(qualified_me()))))
1641 // Or when POSTed from another place
1643 && !empty($this->config
->ntlmsso_enabled
) // SSO enabled
1644 && !empty($this->config
->ntlmsso_subnet
) // have a subnet to test for
1645 && empty($_GET['authldap_skipntlmsso']) // haven't failed it yet
1646 && (isguestuser() ||
!isloggedin()) // guestuser or not-logged-in users
1647 && address_in_subnet(getremoteaddr(), $this->config
->ntlmsso_subnet
)) {
1649 // First, let's remember where we were trying to get to before we got here
1650 if (empty($SESSION->wantsurl
)) {
1651 $SESSION->wantsurl
= null;
1652 $referer = get_local_referer(false);
1654 $referer != $CFG->wwwroot
&&
1655 $referer != $CFG->wwwroot
. '/' &&
1656 $referer != $CFG->wwwroot
. '/login/' &&
1657 $referer != $CFG->wwwroot
. '/login/index.php') {
1658 $SESSION->wantsurl
= $referer;
1662 // Now start the whole NTLM machinery.
1663 if($this->config
->ntlmsso_ie_fastpath
== AUTH_NTLM_FASTPATH_YESATTEMPT ||
1664 $this->config
->ntlmsso_ie_fastpath
== AUTH_NTLM_FASTPATH_YESFORM
) {
1665 if (core_useragent
::is_ie()) {
1666 $sesskey = sesskey();
1667 redirect($CFG->wwwroot
.'/auth/ldap/ntlmsso_magic.php?sesskey='.$sesskey);
1668 } else if ($this->config
->ntlmsso_ie_fastpath
== AUTH_NTLM_FASTPATH_YESFORM
) {
1669 redirect($CFG->wwwroot
.'/login/index.php?authldap_skipntlmsso=1');
1672 redirect($CFG->wwwroot
.'/auth/ldap/ntlmsso_attempt.php');
1675 // No NTLM SSO, Use the normal login page instead.
1677 // If $SESSION->wantsurl is empty and we have a 'Referer:' header, the login
1678 // page insists on redirecting us to that page after user validation. If
1679 // we clicked on the redirect link at the ntlmsso_finish.php page (instead
1680 // of waiting for the redirection to happen) then we have a 'Referer:' header
1681 // we don't want to use at all. As we can't get rid of it, just point
1682 // $SESSION->wantsurl to $CFG->wwwroot (after all, we came from there).
1683 if (empty($SESSION->wantsurl
)
1684 && (get_local_referer() == $CFG->wwwroot
.'/auth/ldap/ntlmsso_finish.php')) {
1686 $SESSION->wantsurl
= $CFG->wwwroot
;
1691 * To be called from a page running under NTLM's
1692 * "Integrated Windows Authentication".
1694 * If successful, it will set a special "cookie" (not an HTTP cookie!)
1695 * in cache_flags under the $this->pluginconfig/ntlmsess "plugin" and return true.
1696 * The "cookie" will be picked up by ntlmsso_finish() to complete the
1699 * On failure it will return false for the caller to display an appropriate
1700 * error message (probably saying that Integrated Windows Auth isn't enabled!)
1702 * NOTE that this code will execute under the OS user credentials,
1703 * so we MUST avoid dealing with files -- such as session files.
1704 * (The caller should define('NO_MOODLE_COOKIES', true) before including config.php)
1707 function ntlmsso_magic($sesskey) {
1708 if (isset($_SERVER['REMOTE_USER']) && !empty($_SERVER['REMOTE_USER'])) {
1710 // HTTP __headers__ seem to be sent in ISO-8859-1 encoding
1711 // (according to my reading of RFC-1945, RFC-2616 and RFC-2617 and
1712 // my local tests), so we need to convert the REMOTE_USER value
1713 // (i.e., what we got from the HTTP WWW-Authenticate header) into UTF-8
1714 $username = core_text
::convert($_SERVER['REMOTE_USER'], 'iso-8859-1', 'utf-8');
1716 switch ($this->config
->ntlmsso_type
) {
1718 // The format is now configurable, so try to extract the username
1719 $username = $this->get_ntlm_remote_user($username);
1720 if (empty($username)) {
1725 // Format is username@DOMAIN
1726 $username = substr($username, 0, strpos($username, '@'));
1729 error_log($this->errorlogtag
.get_string ('ntlmsso_unknowntype', 'auth_ldap'));
1730 return false; // Should never happen!
1733 $username = core_text
::strtolower($username); // Compatibility hack
1734 set_cache_flag($this->pluginconfig
.'/ntlmsess', $sesskey, $username, AUTH_NTLMTIMEOUT
);
1741 * Find the session set by ntlmsso_magic(), validate it and
1742 * call authenticate_user_login() to authenticate the user through
1743 * the auth machinery.
1745 * It is complemented by a similar check in user_login().
1747 * If it succeeds, it never returns.
1750 function ntlmsso_finish() {
1751 global $CFG, $USER, $SESSION;
1754 $username = get_cache_flag($this->pluginconfig
.'/ntlmsess', $key);
1755 if (empty($username)) {
1759 // Here we want to trigger the whole authentication machinery
1760 // to make sure no step is bypassed...
1762 $user = authenticate_user_login($username, $key, false, $reason, false);
1764 complete_user_login($user);
1766 // Cleanup the key to prevent reuse...
1767 // and to allow re-logins with normal credentials
1768 unset_cache_flag($this->pluginconfig
.'/ntlmsess', $key);
1771 if (user_not_fully_set_up($USER, true)) {
1772 $urltogo = $CFG->wwwroot
.'/user/edit.php';
1773 // We don't delete $SESSION->wantsurl yet, so we get there later
1774 } else if (isset($SESSION->wantsurl
) and (strpos($SESSION->wantsurl
, $CFG->wwwroot
) === 0)) {
1775 $urltogo = $SESSION->wantsurl
; // Because it's an address in this site
1776 unset($SESSION->wantsurl
);
1778 // No wantsurl stored or external - go to homepage
1779 $urltogo = $CFG->wwwroot
.'/';
1780 unset($SESSION->wantsurl
);
1782 // We do not want to redirect if we are in a PHPUnit test.
1783 if (!PHPUNIT_TEST
) {
1787 // Should never reach here.
1792 * Sync roles for this user.
1794 * @param object $user The user to sync (without system magic quotes).
1796 function sync_roles($user) {
1799 $roles = get_ldap_assignable_role_names(2); // Admin user.
1801 foreach ($roles as $role) {
1802 $isrole = $this->is_role($user->username
, $role);
1803 if ($isrole === null) {
1804 continue; // Nothing to sync - role/LDAP contexts not configured.
1808 $systemcontext = context_system
::instance();
1810 // Following calls will not create duplicates.
1811 role_assign($role['id'], $user->id
, $systemcontext->id
, $this->roleauth
);
1813 // Unassign only if previously assigned by this plugin.
1814 role_unassign($role['id'], $user->id
, $systemcontext->id
, $this->roleauth
);
1820 * Get password expiration time for a given user from Active Directory
1822 * @param string $pwdlastset The time last time we changed the password.
1823 * @param resource $lcapconn The open LDAP connection.
1824 * @param string $user_dn The distinguished name of the user we are checking.
1826 * @return string $unixtime
1828 function ldap_get_ad_pwdexpire($pwdlastset, $ldapconn, $user_dn){
1831 if (!function_exists('bcsub')) {
1832 error_log($this->errorlogtag
.get_string ('needbcmath', 'auth_ldap'));
1836 // If UF_DONT_EXPIRE_PASSWD flag is set in user's
1837 // userAccountControl attribute, the password doesn't expire.
1838 $sr = ldap_read($ldapconn, $user_dn, '(objectClass=*)',
1839 array('userAccountControl'));
1841 error_log($this->errorlogtag
.get_string ('useracctctrlerror', 'auth_ldap', $user_dn));
1842 // Don't expire password, as we are not sure if it has to be
1847 $entry = ldap_get_entries_moodle($ldapconn, $sr);
1849 $useraccountcontrol = $info['useraccountcontrol'][0];
1850 if ($useraccountcontrol & UF_DONT_EXPIRE_PASSWD
) {
1851 // Password doesn't expire.
1855 // If pwdLastSet is zero, the user must change his/her password now
1856 // (unless UF_DONT_EXPIRE_PASSWD flag is set, but we already
1857 // tested this above)
1858 if ($pwdlastset === '0') {
1859 // Password has expired
1863 // ----------------------------------------------------------------
1864 // Password expiration time in Active Directory is the composition of
1867 // - User's pwdLastSet attribute, that stores the last time
1868 // the password was changed.
1870 // - Domain's maxPwdAge attribute, that sets how long
1871 // passwords last in this domain.
1873 // We already have the first value (passed in as a parameter). We
1874 // need to get the second one. As we don't know the domain DN, we
1875 // have to query rootDSE's defaultNamingContext attribute to get
1876 // it. Then we have to query that DN's maxPwdAge attribute to get
1879 // Once we have both values, we just need to combine them. But MS
1880 // chose to use a different base and unit for time measurements.
1881 // So we need to convert the values to Unix timestamps (see
1883 // ----------------------------------------------------------------
1885 $sr = ldap_read($ldapconn, ROOTDSE
, '(objectClass=*)',
1886 array('defaultNamingContext'));
1888 error_log($this->errorlogtag
.get_string ('rootdseerror', 'auth_ldap'));
1892 $entry = ldap_get_entries_moodle($ldapconn, $sr);
1894 $domaindn = $info['defaultnamingcontext'][0];
1896 $sr = ldap_read ($ldapconn, $domaindn, '(objectClass=*)',
1897 array('maxPwdAge'));
1898 $entry = ldap_get_entries_moodle($ldapconn, $sr);
1900 $maxpwdage = $info['maxpwdage'][0];
1901 if ($sr = ldap_read($ldapconn, $user_dn, '(objectClass=*)', array('msDS-ResultantPSO'))) {
1902 if ($entry = ldap_get_entries_moodle($ldapconn, $sr)) {
1904 $userpso = $info['msds-resultantpso'][0];
1906 // If a PSO exists, FGPP is being utilized.
1907 // Grab the new maxpwdage from the msDS-MaximumPasswordAge attribute of the PSO.
1908 if (!empty($userpso)) {
1909 $sr = ldap_read($ldapconn, $userpso, '(objectClass=*)', array('msDS-MaximumPasswordAge'));
1910 if ($entry = ldap_get_entries_moodle($ldapconn, $sr)) {
1912 // Default value of msds-maximumpasswordage is 42 and is always set.
1913 $maxpwdage = $info['msds-maximumpasswordage'][0];
1918 // ----------------------------------------------------------------
1919 // MSDN says that "pwdLastSet contains the number of 100 nanosecond
1920 // intervals since January 1, 1601 (UTC), stored in a 64 bit integer".
1922 // According to Perl's Date::Manip, the number of seconds between
1923 // this date and Unix epoch is 11644473600. So we have to
1924 // substract this value to calculate a Unix time, once we have
1925 // scaled pwdLastSet to seconds. This is the script used to
1926 // calculate the value shown above:
1928 // #!/usr/bin/perl -w
1932 // $date1 = ParseDate ("160101010000 UTC");
1933 // $date2 = ParseDate ("197001010000 UTC");
1934 // $delta = DateCalc($date1, $date2, \$err);
1935 // $secs = Delta_Format($delta, 0, "%st");
1936 // print "$secs \n";
1938 // MSDN also says that "maxPwdAge is stored as a large integer that
1939 // represents the number of 100 nanosecond intervals from the time
1940 // the password was set before the password expires." We also need
1941 // to scale this to seconds. Bear in mind that this value is stored
1942 // as a _negative_ quantity (at least in my AD domain).
1944 // As a last remark, if the low 32 bits of maxPwdAge are equal to 0,
1945 // the maximum password age in the domain is set to 0, which means
1946 // passwords do not expire (see
1947 // http://msdn2.microsoft.com/en-us/library/ms974598.aspx)
1949 // As the quantities involved are too big for PHP integers, we
1950 // need to use BCMath functions to work with arbitrary precision
1952 // ----------------------------------------------------------------
1954 // If the low order 32 bits are 0, then passwords do not expire in
1955 // the domain. Just do '$maxpwdage mod 2^32' and check the result
1956 // (2^32 = 4294967296)
1957 if (bcmod ($maxpwdage, 4294967296) === '0') {
1961 // Add up pwdLastSet and maxPwdAge to get password expiration
1962 // time, in MS time units. Remember maxPwdAge is stored as a
1963 // _negative_ quantity, so we need to substract it in fact.
1964 $pwdexpire = bcsub ($pwdlastset, $maxpwdage);
1966 // Scale the result to convert it to Unix time units and return
1968 return bcsub( bcdiv($pwdexpire, '10000000'), '11644473600');
1972 * Connect to the LDAP server, using the plugin configured
1973 * settings. It's actually a wrapper around ldap_connect_moodle()
1975 * @return resource A valid LDAP connection (or dies if it can't connect)
1977 function ldap_connect() {
1978 // Cache ldap connections. They are expensive to set up
1979 // and can drain the TCP/IP ressources on the server if we
1980 // are syncing a lot of users (as we try to open a new connection
1981 // to get the user details). This is the least invasive way
1982 // to reuse existing connections without greater code surgery.
1983 if(!empty($this->ldapconnection
)) {
1985 return $this->ldapconnection
;
1988 if($ldapconnection = ldap_connect_moodle($this->config
->host_url
, $this->config
->ldap_version
,
1989 $this->config
->user_type
, $this->config
->bind_dn
,
1990 $this->config
->bind_pw
, $this->config
->opt_deref
,
1991 $debuginfo, $this->config
->start_tls
)) {
1992 $this->ldapconns
= 1;
1993 $this->ldapconnection
= $ldapconnection;
1994 return $ldapconnection;
1997 throw new \
moodle_exception('auth_ldap_noconnect_all', 'auth_ldap', '', $debuginfo);
2001 * Disconnects from a LDAP server
2003 * @param force boolean Forces closing the real connection to the LDAP server, ignoring any
2004 * cached connections. This is needed when we've used paged results
2005 * and want to use normal results again.
2007 function ldap_close($force=false) {
2009 if (($this->ldapconns
== 0) ||
($force)) {
2010 $this->ldapconns
= 0;
2011 @ldap_close
($this->ldapconnection
);
2012 unset($this->ldapconnection
);
2017 * Search specified contexts for username and return the user dn
2018 * like: cn=username,ou=suborg,o=org. It's actually a wrapper
2019 * around ldap_find_userdn().
2021 * @param resource $ldapconnection a valid LDAP connection
2022 * @param string $extusername the username to search (in external LDAP encoding, no db slashes)
2023 * @return mixed the user dn (external LDAP encoding) or false
2025 function ldap_find_userdn($ldapconnection, $extusername) {
2026 $ldap_contexts = explode(';', $this->config
->contexts
);
2027 if (!empty($this->config
->create_context
)) {
2028 array_push($ldap_contexts, $this->config
->create_context
);
2031 return ldap_find_userdn($ldapconnection, $extusername, $ldap_contexts, $this->config
->objectclass
,
2032 $this->config
->user_attribute
, $this->config
->search_sub
);
2036 * When using NTLM SSO, the format of the remote username we get in
2037 * $_SERVER['REMOTE_USER'] may vary, depending on where from and how the web
2038 * server gets the data. So we let the admin configure the format using two
2039 * place holders (%domain% and %username%). This function tries to extract
2040 * the username (stripping the domain part and any separators if they are
2041 * present) from the value present in $_SERVER['REMOTE_USER'], using the
2042 * configured format.
2044 * @param string $remoteuser The value from $_SERVER['REMOTE_USER'] (converted to UTF-8)
2046 * @return string The remote username (without domain part or
2047 * separators). Empty string if we can't extract the username.
2049 protected function get_ntlm_remote_user($remoteuser) {
2050 if (empty($this->config
->ntlmsso_remoteuserformat
)) {
2051 $format = AUTH_NTLM_DEFAULT_FORMAT
;
2053 $format = $this->config
->ntlmsso_remoteuserformat
;
2056 $format = preg_quote($format);
2057 $formatregex = preg_replace(array('#%domain%#', '#%username%#'),
2058 array('('.AUTH_NTLM_VALID_DOMAINNAME
.')', '('.AUTH_NTLM_VALID_USERNAME
.')'),
2060 if (preg_match('#^'.$formatregex.'$#', $remoteuser, $matches)) {
2061 $user = end($matches);
2065 /* We are unable to extract the username with the configured format. Probably
2066 * the format specified is wrong, so log a warning for the admin and return
2067 * an empty username.
2069 error_log($this->errorlogtag
.get_string ('auth_ntlmsso_maybeinvalidformat', 'auth_ldap'));
2074 * Check if the diagnostic message for the LDAP login error tells us that the
2075 * login is denied because the user password has expired or the password needs
2076 * to be changed on first login (using interactive SMB/Windows logins, not
2079 * @param string the diagnostic message for the LDAP login error
2080 * @return bool true if the password has expired or the password must be changed on first login
2082 protected function ldap_ad_pwdexpired_from_diagmsg($diagmsg) {
2083 // The format of the diagnostic message is (actual examples from W2003 and W2008):
2084 // "80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece" (W2003)
2085 // "80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 773, vece" (W2003)
2086 // "80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 52e, v1771" (W2008)
2087 // "80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 773, v1771" (W2008)
2088 // We are interested in the 'data nnn' part.
2089 // if nnn == 773 then user must change password on first login
2090 // if nnn == 532 then user password has expired
2091 $diagmsg = explode(',', $diagmsg);
2092 if (preg_match('/data (773|532)/i', trim($diagmsg[2]))) {
2099 * Check if a user is suspended. This function is intended to be used after calling
2100 * get_userinfo_asobj. This is needed because LDAP doesn't have a notion of disabled
2101 * users, however things like MS Active Directory support it and expose information
2104 * @param object $user the user object returned by get_userinfo_asobj
2107 protected function is_user_suspended($user) {
2108 if (!$this->config
->suspended_attribute ||
!isset($user->suspended
)) {
2111 if ($this->config
->suspended_attribute
== 'useraccountcontrol' && $this->config
->user_type
== 'ad') {
2112 return (bool)($user->suspended
& AUTH_AD_ACCOUNTDISABLE
);
2115 return (bool)$user->suspended
;
2121 * @param resource $ldapconn
2122 * @param string $dn The DN to check for existence
2123 * @param string $message The identifier of a string as in get_string()
2124 * @param string|object|array $a An object, string or number that can be used
2125 * within translation strings as in get_string()
2126 * @return true or a message in case of error
2128 private function test_dn($ldapconn, $dn, $message, $a = null) {
2129 $ldapresult = @ldap_read
($ldapconn, $dn, '(objectClass=*)', array());
2131 if (ldap_errno($ldapconn) == 32) {
2133 return get_string($message, 'auth_ldap', $a);
2136 $a = array('code' => ldap_errno($ldapconn), 'subject' => $a, 'message' => ldap_error($ldapconn));
2137 return get_string('diag_genericerror', 'auth_ldap', $a);
2144 * Test if settings are correct, print info to output.
2146 public function test_settings() {
2149 if (!function_exists('ldap_connect')) { // Is php-ldap really there?
2150 echo $OUTPUT->notification(get_string('auth_ldap_noextension', 'auth_ldap'), \core\output\notification
::NOTIFY_ERROR
);
2154 // Check to see if this is actually configured.
2155 if (empty($this->config
->host_url
)) {
2156 // LDAP is not even configured.
2157 echo $OUTPUT->notification(get_string('ldapnotconfigured', 'auth_ldap'), \core\output\notification
::NOTIFY_ERROR
);
2161 if ($this->config
->ldap_version
!= 3) {
2162 echo $OUTPUT->notification(get_string('diag_toooldversion', 'auth_ldap'), \core\output\notification
::NOTIFY_WARNING
);
2166 $ldapconn = $this->ldap_connect();
2167 } catch (Exception
$e) {
2168 echo $OUTPUT->notification($e->getMessage(), \core\output\notification
::NOTIFY_ERROR
);
2172 // Display paged file results.
2173 if (!ldap_paged_results_supported($this->config
->ldap_version
, $ldapconn)) {
2174 echo $OUTPUT->notification(get_string('pagedresultsnotsupp', 'auth_ldap'), \core\output\notification
::NOTIFY_INFO
);
2178 foreach (explode(';', $this->config
->contexts
) as $context) {
2179 $context = trim($context);
2180 if (empty($context)) {
2181 echo $OUTPUT->notification(get_string('diag_emptycontext', 'auth_ldap'), \core\output\notification
::NOTIFY_WARNING
);
2185 $message = $this->test_dn($ldapconn, $context, 'diag_contextnotfound', $context);
2186 if ($message !== true) {
2187 echo $OUTPUT->notification($message, \core\output\notification
::NOTIFY_WARNING
);
2191 // Create system role mapping field for each assignable system role.
2192 $roles = get_ldap_assignable_role_names();
2193 foreach ($roles as $role) {
2194 foreach (explode(';', $this->config
->{$role['settingname']}) as $groupdn) {
2195 if (empty($groupdn)) {
2199 $role['group'] = $groupdn;
2200 $message = $this->test_dn($ldapconn, $groupdn, 'diag_rolegroupnotfound', $role);
2201 if ($message !== true) {
2202 echo $OUTPUT->notification($message, \core\output\notification
::NOTIFY_WARNING
);
2207 $this->ldap_close(true);
2208 // We were able to connect successfuly.
2209 echo $OUTPUT->notification(get_string('connectingldapsuccess', 'auth_ldap'), \core\output\notification
::NOTIFY_SUCCESS
);
2213 * Get the list of profile fields.
2215 * @param bool $fetchall Fetch all, not just those for update.
2218 protected function get_profile_keys($fetchall = false) {
2219 $keys = array_keys(get_object_vars($this->config
));
2221 foreach ($keys as $key) {
2222 if (preg_match('/^field_updatelocal_(.+)$/', $key, $match)) {
2223 // If we have a field to update it from and it must be updated 'onlogin' we update it on cron.
2224 if (!empty($this->config
->{'field_map_'.$match[1]})) {
2225 if ($fetchall ||
$this->config
->{$match[0]} === 'onlogin') {
2226 array_push($updatekeys, $match[1]); // the actual key name
2232 if ($this->config
->suspended_attribute
&& $this->config
->sync_suspended
) {
2233 $updatekeys[] = 'suspended';