From 42996f1736c1947cf71ae3bd8e28838cfbc344c9 Mon Sep 17 00:00:00 2001
From: Bartolomeus Jankowski <--global>
Date: Wed, 20 Jun 2012 12:35:20 +0200
Subject: [PATCH] fix TICKET 5031

---
 lib/functions/doAuthorize.php |   82 +++++++++++++++++++++++++++++++++++++---
 login.php                     |   11 +++++-
 2 files changed, 85 insertions(+), 8 deletions(-)

diff --git a/lib/functions/doAuthorize.php b/lib/functions/doAuthorize.php
index 0d89d64..ad6b06e 100644
--- a/lib/functions/doAuthorize.php
+++ b/lib/functions/doAuthorize.php
@@ -40,7 +40,7 @@ function doAuthorize(&$db,$login,$pwd,$options=null)
 	$_SESSION['locale'] = TL_DEFAULT_LOCALE; 
 	
 	$my['options'] = array('doSessionExistsCheck' => true); 
-	$my['options'] = array_merge($my['options'], (array)$options);
+	$my['options'] = array_merge($my['options'], (array)$options);
 	if (!is_null($pwd) && !is_null($login))
 	{
 		$user = new tlUser();
@@ -160,11 +160,7 @@ function doSSOClientCertificate(&$dbHandler,$apache_mod_ssl_env,$authCfg=null)
 	return $result;
 }
 
-
-
-
-
-/** 
+/**
  * @return array
  *         obj->status_ok = true/false
  *         obj->msg = message to explain what has happened to a human being.
@@ -187,7 +183,7 @@ function auth_does_password_match(&$userObj,$cleartext_password)
 			
 			$xx = ldap_authenticate($userObj->login, $cleartext_password);
 			$ret->status_ok = $xx->status_ok;
-			$ret->msg = $msg[$xx->status_code];	
+			$ret->msg = $msg[$xx->status_code];
 		break;
 		
 		case 'MD5':
@@ -198,4 +194,76 @@ function auth_does_password_match(&$userObj,$cleartext_password)
 
 	return $ret;
 }
+
+/**
+ * If user present in LDAP but not in DB -> add user to DB, otherwise do nothing.
+ *
+ * @author brtk
+ *
+ * @param resource &$db reference to database handler
+ * @param string $uid user login name
+ * @param string $cleartext_password user clear-text password
+ *
+ * @return nothing
+ *
+ * @todo Would be nice to assign roles, according to LDAP group membership
+ * @todo setPassword() doesn't set any password. Should tlUser.class be modified?
+ * @todo Error checking, what to check for?
+ * @todo Check if certain LDAP attributes exist, eg, 'mail', 'givenname', 'cn'?
+ * @todo tl logging? What? How?
+ */
+function ldap_add_user(&$db, $uid, $cleartext_password)
+{
+  $ldap_auth_res = ldap_authenticate($uid, $cleartext_password);
+  $login_exists_in_ldap = $ldap_auth_res->status_ok;
+
+  if (!$login_exists_in_ldap)
+  {
+    return;
+  }
+
+  $user = new tlUser();
+  $user->login = $uid;
+  //this overwrites the $user.
+  $login_exists_in_db = ($user->readFromDB($db,tlUser::USER_O_SEARCH_BYLOGIN) >= tl::OK);
+
+  // add user to the db
+  if (!$login_exists_in_db && $login_exists_in_ldap)
+  {
+    $authCfg = config_get('authentication');
+
+    //get directory server connection
+    $ds = ldap_connect_bind($authCfg['ldap_bind_dn'], $authCfg['ldap_bind_passwd']);
+    $ds_handle = $ds->handler;
+
+    //get user data from LDAP, filter the right user
+    $ldap_filter = '(&' . $authCfg['ldap_organization'] . '(' . $authCfg['ldap_uid_field'] . "=" . $uid . '))';
+    $s_res = ldap_search($ds_handle, $authCfg['ldap_root_dn'], $ldap_filter);
+    $entries = ldap_get_entries($ds_handle, $s_res);
+
+    //Are these attributes same in AD ? Not tested against AD.
+    $ldap_fname = $entries[0]['givenname'][0];
+    $ldap_sname = $entries[0]['sn'][0];
+    $ldap_mail = $entries[0]['mail'][0];
+
+    ldap_close($ds_handle);
+
+    //construct the user and write to DB
+    $user = new tlUser(); // old $user is overwritten...
+    $user->login = $uid;
+
+    //this doesn't do anything as isPasswordMgtExternal() returns true
+    $user->setPassword($cleartext_password);
+
+    $user->emailAddress = $ldap_mail;
+    $user->firstName = $ldap_fname;
+    $user->lastName = $ldap_sname;
+    $res = $user->writeToDB($db);
+
+    if ($res >= tl::OK)
+    {
+      logAuditEvent(TLS("audit_users_ldap_auto_add",$uid),"CREATE",$user->dbID,"users");
+    }
+  }
+}
 ?>
\ No newline at end of file
diff --git a/login.php b/login.php
index 85324c2..5d40bc9 100644
--- a/login.php
+++ b/login.php
@@ -45,6 +45,16 @@ switch($args->action)
 		 // that we use when doing normal login.
 		 // If we do not proceed this way we will enter an infinite loop
 	 	 $options = array('doSessionExistsCheck' => ($args->action=='doLogin'));
+     $cfg_auth = config_get('authentication');
+
+     //mantis Ticket 5031
+     //When trying to authenticate using LDAP, try to silently add user to database
+     //then proceed as usual.
+     if ($cfg_auth['method']=='LDAP' && $cfg_auth['ldap_auto_add_user'])
+     {
+       ldap_add_user($db, $args->login,$args->pwd);
+     }
+
 	 	 $op = doAuthorize($db,$args->login,$args->pwd,$options);
 		 $doAuthPostProcess = true;
 		 break;
@@ -79,7 +89,6 @@ if( $doRenderLoginScreen )
 }
 
 
-
 /**
  * 
  *
-- 
1.7.5.4