From 3b8e94ce66f029fc7933250ff59665ee1fa50c32 Mon Sep 17 00:00:00 2001 From: Brian Lycett Date: Thu, 24 Dec 2020 18:24:41 +0000 Subject: [PATCH] Christmas jingles (#55) * Add account requests, email user on password update, RFC2307BIS autodetection and various bug fixes. * Remove test.php --- Dockerfile | 19 +- README.md | 137 ++++++++------- entrypoint | 2 +- www/account_manager/index.php | 9 +- www/account_manager/module_functions.inc.php | 2 +- www/account_manager/new_user.php | 34 +++- www/account_manager/show_group.php | 30 ++-- www/account_manager/show_user.php | 148 +++++++++++----- www/account_manager/test.php | 26 +++ www/includes/config.inc.php | 35 ++-- www/includes/ldap_functions.inc.php | 114 +++++++++++- www/includes/mail_functions.inc.php | 2 +- www/includes/modules.inc.php | 6 +- www/includes/web_functions.inc.php | 83 ++++++--- www/index.php | 17 -- www/log_in/index.php | 54 ++++-- www/request_account/fonts/font_01.ttf | Bin 0 -> 76804 bytes www/request_account/fonts/font_02.ttf | Bin 0 -> 11024 bytes www/request_account/fonts/font_03.ttf | Bin 0 -> 26592 bytes www/request_account/fonts/font_04.ttf | Bin 0 -> 40376 bytes www/request_account/human.php | 76 ++++++++ www/request_account/index.php | 176 +++++++++++++++++++ www/setup/run_checks.php | 56 +++++- 23 files changed, 800 insertions(+), 226 deletions(-) create mode 100644 www/account_manager/test.php create mode 100644 www/request_account/fonts/font_01.ttf create mode 100644 www/request_account/fonts/font_02.ttf create mode 100644 www/request_account/fonts/font_03.ttf create mode 100644 www/request_account/fonts/font_04.ttf create mode 100644 www/request_account/human.php create mode 100644 www/request_account/index.php diff --git a/Dockerfile b/Dockerfile index 0326936..69f6bbc 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,8 +1,21 @@ FROM php:7.0-apache -RUN apt-get update && apt-get install -y --no-install-recommends libldb-dev libldap2-dev && rm -rf /var/lib/apt/lists/* && ln -s /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/libldap.so \ -&& ln -s /usr/lib/x86_64-linux-gnu/liblber.so /usr/lib/liblber.so -RUN docker-php-source extract && docker-php-ext-install -j$(nproc) ldap && docker-php-source delete +RUN apt-get update && \ + apt-get install -y --no-install-recommends \ + libldb-dev libldap2-dev \ + libfreetype6-dev \ + libjpeg-dev \ + libpng-dev && \ + rm -rf /var/lib/apt/lists/* && \ + ln -s /usr/lib/x86_64-linux-gnu/libldap.so /usr/lib/libldap.so && \ + ln -s /usr/lib/x86_64-linux-gnu/liblber.so /usr/lib/liblber.so + +RUN docker-php-ext-configure gd \ + --enable-gd-native-ttf \ + --with-freetype-dir=/usr/include/freetype2 \ + --with-png-dir=/usr/include \ + --with-jpeg-dir=/usr/include && \ + docker-php-ext-install -j$(nproc) ldap gd ADD https://github.com/PHPMailer/PHPMailer/archive/v6.2.0.tar.gz /tmp diff --git a/README.md b/README.md index fe03e4b..13b8b29 100644 --- a/README.md +++ b/README.md @@ -4,18 +4,17 @@ LDAP User Manager This is a PHP LDAP account manager; a web-based GUI interface which allows you to quickly populate a new LDAP directory and easily manage user accounts and groups. It also has a self-service password change module. It's designed to work with OpenLDAP and to be run as a container. It complements OpenLDAP containers such as [*osixia/openldap*](https://hub.docker.com/r/osixia/openldap/). - - Features --- * Setup wizard: this will create the necessary structure to allow you to add users and groups and will set up an initial admin user that can log into the user manager. * Group creation and management. * User account creation and management. - * Optionally send an email to the new user with their account credentials. + * Optionally send an email to the user with their new or updated account credentials. * Secure password auto-generator: click the button to generate a secure password. * Password strength indicator. * Self-service password change: non-admin users can log in to change their password. + * An optional form for people to request accounts (request emails are sent to an administrator). Screenshots --- @@ -36,26 +35,6 @@ Screenshots ![self_service_password_change](https://user-images.githubusercontent.com/17613683/59344258-9ffcab80-8d05-11e9-9dc2-27dfd373fcc8.png) -A note on your LDAP schema - please read this! ---- - -By default this application will expect the LDAP server to be using the **RFC2307BIS** schema. OpenLDAP (including the **osixia/openldap** image) uses the older NIS schema as its default schema. - -> :warning: If you haven't explicitly set up the **RFC2307BIS** schema on your LDAP server then you need to set `LDAP_USES_NIS_SCHEMA` to `TRUE` as shown in the Quick start example below. - -**Why should I use RFC2307BIS?** - -The user manager will work with either NIS or BIS, but BIS is recommended as it allows you to use **memberOf** searches. You can enable BIS in **osixia/openldap** by setting `LDAP_RFC2307BIS_SCHEMA` to `true` during the initial setup. - -**Why not make NIS the default?** - -The original versions of this application were set to expect BIS by default. This was before we used specific release versions, so we're expecting the BIS schemas as the default to keep backwards-compatibility for anyone using the `latest` tag. - -**I'm unable to use the BIS schema!** - -If you can't or prefer not to use RFC2307BIS then set `LDAP_USES_NIS_SCHEMA` to `TRUE`. This will create groups solely as the **posixGroup** objectclass, and the default for `LDAP_GROUP_MEMBERSHIP_USES_UID` will `TRUE`. - - Quick start --- @@ -72,11 +51,11 @@ docker run \ -e "LDAP_ADMINS_GROUP=admins" \ -e "LDAP_ADMIN_BIND_DN=cn=admin,dc=example,dc=com" \ -e "LDAP_ADMIN_BIND_PWD=secret"\ - -e "LDAP_USES_NIS_SCHEMA=true" \ - -e "EMAIL_DOMAIN=ldapusermanager.org"\ - wheelybird/ldap-user-manager:v1.4 + -e "LDAP_IGNORE_CERT_ERRORS=true" \ + -e "EMAIL_DOMAIN=ldapusermanager.org" \ + wheelybird/ldap-user-manager:v1.5 ``` -Change the variable values to suit your environment. You might need to change `LDAP_USES_NIS_SCHEMA` if you're using the BIS schema. Now go to https://lum.example.com/setup. +Change the variable values to suit your environment. Now go to https://lum.example.com/setup. Configuration @@ -84,8 +63,8 @@ Configuration Configuration is via environmental variables. Please bear the following in mind: - * This tool needs to bind to LDAP as a user with permissions to modify everything under the base DN. - * This interface is designed to work with a fresh LDAP server and should be against populated LDAP directories with caution and at your own risk. + * This tool needs to bind to LDAP as a user that has the permissions to modify everything under the base DN. + * This interface is designed to work with a fresh LDAP server and should only be against existing, populated LDAP directories with caution and at your own risk. Mandatory: ---- @@ -116,17 +95,24 @@ Optional: * `LDAP_USER_OU` (default: *people*): The name of the OU used to store user accounts (without the base DN appended). -* `LDAP_USES_NIS_SCHEMA` (default: *FALSE*): If you use the NIS schema instead of the (preferable) RFC2307BIS schema, set this to `TRUE`. See [A note on your LDAP schema](#a-note-on-your-ldap-schema) for more information. - * `LDAP_GROUP_OU` (default: *groups*): The name of the OU used to store groups (without the base DN appended). -* `LDAP_GROUP_MEMBERSHIP_ATTRIBUTE` (default: *memberUID* or *uniqueMember*): The attribute used when adding a user to a group. If `LDAP_USES_NIS_SCHEMA` is `TRUE` the default is `memberUID`, otherwise it's `uniqueMember`. Explicitly setting this variable will override the default. -* `LDAP_GROUP_MEMBERSHIP_USES_UID` (default: *TRUE* or *FALSE*): If *TRUE* then the entry for a member of a group will be just the username. Otherwise it's the member's full DN. If `LDAP_USES_NIS_SCHEMA` is `TRUE` the default is `TRUE`, otherwise it's `FALSE`. Explicitly setting this variable will override the default. * `LDAP_REQUIRE_STARTTLS` (default: *TRUE*): If *TRUE* then a TLS connection is required for this interface to work. If set to *FALSE* then the interface will work without STARTTLS, but a warning will be displayed on the page. * `LDAP_IGNORE_CERT_ERRORS` (default: *FALSE*): If *TRUE* then problems with the certificate presented by the LDAP server will be ignored (for example FQDN mismatches). Use this if your LDAP server is using a self-signed certificate and you don't have a CA certificate for it or you're connecting to a pool of different servers via round-robin DNS. -* `LDAP_TLS_CACERT` (no default): If you need to use a specific CA certificate for TLS connections to the LDAP server (when `LDAP_REQUIRE_STARTTLS` is set) then assign the contents of the CA certificate to this variable. e.g. `-e LDAP_TLS_CACERT=$(/etc/apache2/sites-enabled/lum.conf diff --git a/www/account_manager/index.php b/www/account_manager/index.php index e989755..097ee7c 100644 --- a/www/account_manager/index.php +++ b/www/account_manager/index.php @@ -48,9 +48,8 @@ } } - +#' $people = ldap_get_user_list($ldap_connection); -ldap_close($ldap_connection); ?>
@@ -64,15 +63,20 @@ First name Last name Email + Member of $attribs){ + + $group_membership = ldap_user_group_membership($ldap_connection,$username); + print " \n $username\n"; print " " . $people[$username]['givenname'] . "\n"; print " " . $people[$username]['sn'] . "\n"; print " " . $people[$username]['mail'] . "\n"; + print " " . implode(", ", $group_membership) . "\n"; print " \n"; } ?> @@ -81,5 +85,6 @@
diff --git a/www/account_manager/module_functions.inc.php b/www/account_manager/module_functions.inc.php index b5f0726..8bda566 100644 --- a/www/account_manager/module_functions.inc.php +++ b/www/account_manager/module_functions.inc.php @@ -25,7 +25,7 @@ function render_submenu() { print '
  • '; } print "" . ucwords($submodule) . "
    • \n"; - + } ?> diff --git a/www/account_manager/new_user.php b/www/account_manager/new_user.php index 8b40a07..7603094 100644 --- a/www/account_manager/new_user.php +++ b/www/account_manager/new_user.php @@ -33,9 +33,26 @@ $invalid_username = FALSE; $weak_password = FALSE; $invalid_email = FALSE; +$disabled_email_tickbox = TRUE; -if ($SMTP['host'] != "") { $can_send_email = TRUE; } else { $can_send_email = FALSE; } +if (isset($_GET['account_request'])) { + $first_name=filter_var($_GET['first_name'], FILTER_SANITIZE_STRING); + $last_name=filter_var($_GET['last_name'], FILTER_SANITIZE_STRING); + $email=filter_var($_GET['email'], FILTER_SANITIZE_EMAIL); + $username = generate_username($first_name,$last_name); + + if ($email == "") { + if (isset($EMAIL_DOMAIN)) { + $email = $username . "@" . $EMAIL_DOMAIN; + $disabled_email_tickbox = FALSE; + } + } + else { + $disabled_email_tickbox = FALSE; + } + +} if (isset($_POST['create_account'])) { @@ -53,7 +70,7 @@ if (preg_match("/\"|'/",$password)) { $invalid_password = TRUE; } if ($_POST['password'] != $_POST['password_match']) { $mismatched_passwords = TRUE; } if (!preg_match("/$USERNAME_REGEX/",$username)) { $invalid_username = TRUE; } - if (isset($_POST['send_email']) and isset($email) and $can_send_email == TRUE) { $send_user_email = TRUE; } + if (isset($_POST['send_email']) and isset($email) and $EMAIL_SENDING_ENABLED == TRUE) { $send_user_email = TRUE; } if ( isset($first_name) @@ -84,8 +101,7 @@ Username: $username Password: $password -You should change your password as soon as possible. Log into the account manager at ${SITE_PROTOCOL}${SERVER_HOSTNAME}/log_in using your credentials. -Once logged in you can change your password at ${SITE_PROTOCOL}${SERVER_HOSTNAME}/change_password/ +You should change your password as soon as possible. Go to ${SITE_PROTOCOL}${SERVER_HOSTNAME}/change_password and log in using your new credentials. This will take you to a page where you can change your password. EoT; include_once "mail_functions.inc.php"; @@ -216,15 +232,15 @@ function back_to_hidden(passwordField,confirmField) { function check_email_validity(email) { - var check_regex = /^(([^<>()[\]\\.,;:\s@\"]+(\.[^<>()[\]\\.,;:\s@\"]+)*)|(\".+\"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/; + var check_regex = if (! check_regex.test(email) ) { document.getElementById("email_div").classList.add("has-error"); - document.getElementById("send_email_checkbox").disabled = true; + document.getElementById("send_email_checkbox").disabled = true; } else { document.getElementById("email_div").classList.remove("has-error"); - document.getElementById("send_email_checkbox").disabled = false; + document.getElementById("send_email_checkbox").disabled = false; } } @@ -289,11 +305,11 @@ function check_email_validity(email) { - +
    - Email these credentials to the user? + > Email these credentials to the user?
    diff --git a/www/account_manager/show_group.php b/www/account_manager/show_group.php index fd800e1..ad89cf8 100644 --- a/www/account_manager/show_group.php +++ b/www/account_manager/show_group.php @@ -79,7 +79,7 @@ $non_members = array_diff($all_people,$updated_membership); $group_members = $updated_membership; - + ?> -