Commit b0957331 authored by friendica's avatar friendica

SECURITY: cross-post connectors for insecure networks should not be logging in.

parent 297cd3f7
Authenticate a user against an LDAP directory
Useful for Windows Active Directory and other LDAP-based organisations
to maintain a single password across the organisation.
/**
*
* Module: LDAP Authenticate
*
* Authenticate a user against an LDAP directory
* Useful for Windows Active Directory and other LDAP-based organisations
* to maintain a single password across the organisation.
*
* Optionally authenticates only if a member of a given group in the directory.
*
* The person must have registered with Friendica using the normal registration
* procedures in order to have a Friendica user record, contact, and profile.
*
* Note when using with Windows Active Directory and/or LDAP over TLS/SSL: you may
* need to set TLS_CACERT in your site ldap.conf file to the signing cert for your LDAP server.
* This is a fiddly setting which may require some research to set correctly.
* Typically on Linux installations this will be set to /etc/ssl/certs/ca-certificates.crt
* You may need to export the signing certificate from your domain controller
* (which is often self-signed) and append that to this file.
*
* In rare cases you may get around this (with a loss of SSL validation) by setting
* TLS_REQCERT never
* but be aware that this configuration applies to all LDAP usage on the server and this could
* result in weaker security for other LDAP applications.
*
* The required configuration options for this module may be set in the .htconfig.php file
* e.g.:
*
* $a->config['ldapauth']['ldap_server'] = 'host.example.com';
*
* Parameters:
* ldap_server = DNS hostname of LDAP service, or URL e.g. ldaps://example.com
* ldap_binddn = LDAP DN of an account to bind with to search LDAP
* ldap_bindpw = password for LDAP bind DN
* ldap_searchdn = base DN for the search root of the LDAP directory
* ldap_userattr = the name of the attribute containing the username, e.g. SAMAccountName
* ldap_group = (optional) DN of group to check membership
* create_account = (optional) 1 or 0 (default), automatically create RedMatrix accounts based on the LDAP 'mail' attribute
*
*/
Optionally authenticates only if a member of a given group in the directory.
Note when using with Windows Active Directory: you may need to set TLS_CACERT in your site
ldap.conf file to the signing cert for your LDAP server.
The required configuration options for this module may be set in the .htconfig.php file
e.g.:
$a->config['ldapauth']['ldap_server'] = 'host.example.com';
...etc.
......@@ -60,14 +60,14 @@ function ldapauth_hook_authenticate($a,&$b) {
$acct = create_account(array('email' => $mail, 'password' => random_string()));
if($acct['success']) {
logger('ldapauth: Created account for ' . $b['username'] . ' using ' . $mail);
info(t('You were recognized as local LDAP-user and an account was created for you.'));
info(t('An account has been created for you.'));
$b['user_record'] = $acct['account'];
$b['authenticated'] = 1;
}
} elseif(intval(get_config('ldapauth','create_account')) != 1 && (! $results)) {
logger('ldapauth: User '.$b['username'].' authenticated but no db-record and. Rejecting auth.');
notice(t('You were recognized as local LDAP-user but there is no redmatrix-account for you.'));
notice( t('Authentication successful but rejected: account creation is disabled.'));
return;
}
if($results) {
......
#nsabait-enable-label {
float: left;
width: 200px;
width: 350px;
margin-bottom: 25px;
}
......
......@@ -490,9 +490,11 @@ function pumpio_fetchtimeline($a, $uid) {
if ($public AND !strstr($post->generator->displayName, $application_name)) {
require_once('include/html2bbcode.php');
$_SESSION["authenticated"] = true;
$_SESSION["uid"] = $uid;
/* WTF!?!
// $_SESSION["authenticated"] = true;
// $_SESSION["uid"] = $uid;
*/
$_REQUEST["type"] = "wall";
$_REQUEST["api_source"] = true;
$_REQUEST["profile_uid"] = $uid;
......
......@@ -871,8 +871,11 @@ function statusnet_fetchtimeline($a, $uid) {
continue;
if (!strpos($post->source, $application_name)) {
$_SESSION["authenticated"] = true;
$_SESSION["uid"] = $uid;
/* WTF!?!
// $_SESSION["authenticated"] = true;
// $_SESSION["uid"] = $uid;
*/
$_REQUEST["type"] = "wall";
$_REQUEST["api_source"] = true;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment