class_passwordMethodSasl.inc

Go to the documentation of this file.

<?php
/*
  This code is part of FusionDirectory (http://www.fusiondirectory.org/)

  Copyright (C) 2011-2019  FusionDirectory

  This program is free software; you can redistribute it and/or modify
  it under the terms of the GNU General Public License as published by
  the Free Software Foundation; either version 2 of the License, or
  (at your option) any later version.

  This program is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  GNU General Public License for more details.

  You should have received a copy of the GNU General Public License
  along with this program; if not, write to the Free Software
  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
*/

class passwordMethodSasl extends passwordMethod
{
  // uid, or exop specified field value
  var $uid    = '';
  var $realm  = '';
  var $exop   = '';

  function __construct ($dn = '', $userTab = NULL)
  {
    global $config;
    $this->realm  = trim($config->get_cfg_value('saslRealm', ''));
    $this->exop   = trim($config->get_cfg_value('saslExop', ''));

    if ($dn == '' || $dn == 'new') {
      return;
    }

    $attr = (empty($this->exop) ? 'uid' : $this->exop);

    if (($userTab !== NULL) && isset($userTab->$attr)) {
      $this->uid = $userTab->$attr;
    } else {
      $ldap = $config->get_ldap_link();
      $ldap->cd($config->current['BASE']);
      $ldap->cat($dn, [$attr]);
      if ($ldap->count() == 1) {
        $attrs = $ldap->fetch();
        $this->uid = $attrs[$attr][0];
      } else {
        $error = new FusionDirectoryError(htmlescape(sprintf(_('Cannot change password, unknown user "%s"'), $dn)));
        $error->display();
      }
    }
  }

  public function is_available (): bool
  {
    if (empty($this->realm) && empty($this->exop)) {
      return FALSE;
    }
    return TRUE;
  }

  public function generate_hash (string $pwd, bool $locked = FALSE): string
  {
    if (empty($this->exop)) {
      if (empty($this->realm)) {
        $error = new FusionDirectoryError(htmlescape(_('You need to fill saslRealm or saslExop in the configuration screen in order to use SASL')));
        $error->display();
      }
      return '{SASL}'.($locked ? '!' : '').$this->uid.'@'.$this->realm;
    } else {
      // may not be the uid, see saslExop option
      return '{SASL}'.($locked ? '!' : '').$this->uid;
    }
  }

  function checkPassword ($pwd, $hash): bool
  {
    // We do not store passwords, can’t know if they’re the same
    return FALSE;
  }

  static function get_hash_name ()
  {
    return 'sasl';
  }

  function need_password (): bool
  {
    global $config;
    return ($config->get_cfg_value('forceSaslPasswordAsk', 'FALSE') == 'TRUE');
  }
}