common/auth/LdapFilter.php - dev - v.bolshakov/AIEcosystem-Testing

common/auth/LdapFilter.php
168 строк4 KB
Developer
Initial commit
03 авг 2026, 17:43
03 авг 2026, 17:437433917
<?php

namespace common\auth;

use common\forms\UserForm;
use common\helpers\ArrayHelper;
use common\models\AclRole;
use common\models\Department;
use common\models\LinkUserDepartment;
use Yii;
use yii\helpers\VarDumper;

/**
 * Авторизация через LDAP
 *
 * @author Dmitry E. Semenov <sde.tomsk@gmail.com>
 * @copyright Self (c) 2024
 */
class LdapFilter extends BaseAuthFilter
{
    /**
     * Ldap host
     * @var string
     */
    public $ldap_server = '83.166.225.228';

    /**
     * Ldap port
     * @var int
     */
    public $ldap_port = 50123;

    /**
     * Base DN
     * @var string
     */
    public $baseDn = 'cn=users,dc=janus,dc=local';

    /**
     * Object class
     * @var string
     */
    public $ldapObjectClass = 'person';

    /**
     * Login
     * @var string
     */
    public $loginAttribute = 'sAMAccountName';

    /**
     * @inheritdoc
     */
    public function find($username, $password)
    {
        $user = false;

        $username = strtolower($username);
        $uid = str_replace(['janus', '\\', '/'], ['', '', ''], $username);

        $username = 'janus\\' . $uid;

        $ds = @ldap_connect($this->ldap_server, $this->ldap_port);
        if (!$ds) {
            Yii::debug(VarDumper::dumpAsString([
                'error' => 'Unable to connect to LDAP. Code '
                    . ldap_errno($ds)
                    . '. Message: '
                    . ldap_error($ds)
            ]));

            return false;
        }

        $ldapbind = @ldap_bind($ds, $username, $password);
        if (!$ldapbind) {
            Yii::debug(VarDumper::dumpAsString([
                'username' => $username,
                'password' => $password,
                'error'    => 'Unable to bind LDAP search user. Code '
                    . ldap_errno($ds)
                    . '. Message: '
                    . ldap_error($ds)
            ]));

            return false;
        }

        $result = ldap_search(
            $ds,
            $this->baseDn,
            '(&(objectClass=' . $this->ldapObjectClass . ')(' . $this->loginAttribute . '=' . $uid . '))'
        );

        $entries = ldap_get_entries($ds, $result);
        $count = ArrayHelper::getValue($entries, 'count');
        if ($count > 0) {
            $e = ArrayHelper::getValue($entries, 0);

            $map = [
                'cn'         => null,
                'mail'       => null,
                'department' => null,
                'memberof'   => null
            ];

            foreach ($map as $key => $item) {
                $count = ArrayHelper::getValue($e, $key . '.count');
                if ($count > 0) {
                    $map[$key] = ArrayHelper::getValue($e, $key . '.0');
                }
            }

            // default role
            $role_id = AclRole::LINGUIST;

            $department = $map['department'];
            /** @var Department $d */
            $d = null;
            if ($department) {
                $d = Department::findOrNew([
                    'title' => $department
                ]);

                if ($d->save()) {
                    /** @var AclRole $role */
                    $role = $d
                        ->getRole()
                        ->one();
                    if ($role) {
                        $role_id = $role->id;
                    }
                }
            }

            $form = new UserForm();
            $form->setAttributes([
                'display_name' => $map['cn'],
                'username'     => $uid,
                'email'        => $map['mail'],
                'role_id'      => $role_id,
            ]);

            $form->type = 'ldap';

            if ($form->save()) {
                $user = $form->getModel();
                if ($d and $user) {
                    $lud = LinkUserDepartment::findOrNew([
                        'user_id' => $user->id,
                    ]);
                    $lud->setAttributes([
                        'department_id' => $d->id
                    ]);
                    if (!$lud->save()) {
                        Yii::debug(VarDumper::dumpAsString([
                            'errors' => $lud->errors
                        ]));
                    }
                }
            }
        }

        @ldap_close($ds);

        return $user;
    }
}