deblan/pdnsmanager
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge c27b88b4f1 into c3250e58fc

Browse source
This commit is contained in:
Jens Meißner 2017-11-27 09:32:51 +00:00 committed by GitHub
parent c3250e58fc c27b88b4f1
commit b810a480a6
9 changed files with 100 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
README.LDAP.md Normal file
View file

@ -0,0 +1,25 @@
# LDAP integration
Basic LDAP authentication support can be enabled in the configuration file.
LDAP users can login with their credentials and manage PowerDNS zones.
It is possible to restrict the access to users with certain LDAP attributes.
## Configuration Example
In order to enable LDAP support put the following lines into your config-user.php file and adjust the parameters for your setup.
$config['auth_type'] = 'ldap';
$config['ldap_uri'] = 'ldap://ldap.example.com/';
$config['ldap_bind_dn'] = 'uid=admin,ou=users,dc=example,dc=com';
$config['ldap_bind_pw'] = 'password';
$config['ldap_base_dn'] = 'dc=example,dc=com';
$config['ldap_search'] = '(&(uid=%user%)(memberof=cn=dns,ou=groups,dc=example,dc=com))';
Adjust the ldap_search parameter to control which users are allowed to login and to manage PowerDNS zones.
## Known limitations
* LDAP has to be enabled and configured manually in the configuration file.
* Either database or LDAP can be used for authentication. Internal authentication will be disabled if LDAP is enabled.
* LDAP users have either full rights for all zones or are not allowed to login. Use the ldap_search parameter to adjust which users can login.

4
add-domain.php
View file

@ -35,8 +35,8 @@ limitations under the License.
</div>
<ul class="nav navbar-nav">
<li><a href="domains.php">Domains</a></li>
<?php if($_SESSION['type'] == "admin") echo '<li><a href="users.php">Users</a></li>'; ?>
<li><a href="password.php">Password</a></li>
<?php if($_SESSION['type'] == "admin" and $_SESSION['id'] > 0) echo '<li><a href="users.php">Users</a></li>'; ?>
<?php if($_SESSION['id'] > 0) echo '<li><a href="password.php">Password</a></li>'; ?>
<li><a href="logout.php">Logout</a></li>
</ul>
</div>

4
api/edit-user.php
View file

@ -26,6 +26,10 @@ if(!isset($_SESSION['type']) || $_SESSION['type'] != "admin") {
echo "Permission denied!";
exit();
}
if(!isset($_SESSION['id']) || $_SESSION['id'] == 0) {
echo "Permission denied!";
exit();
}
if(isset($input->action) && $input->action == "addUser") {
$passwordHash = password_hash($input->password, PASSWORD_DEFAULT);
$db->beginTransaction();

63
api/index.php
View file

@ -17,24 +17,51 @@
require_once '../config/config-default.php';
require_once '../lib/database.php';
$input = json_decode(file_get_contents('php://input'));
$stmt = $db->prepare("SELECT id,password,type FROM users WHERE name=:name LIMIT 1");
$stmt->bindValue(':name', $input->user, PDO::PARAM_STR);
$stmt->execute();
$stmt->bindColumn('id', $id);
$stmt->bindColumn('password', $password);
$stmt->bindColumn('type', $type);
$stmt->fetch(PDO::FETCH_BOUND);
if (password_verify($input->password, $password)) {
$retval['status'] = "success";
session_start();
$_SESSION['id'] = $id;
$_SESSION['type'] = $type;
$randomSecret = base64_encode(openssl_random_pseudo_bytes(32));
$_SESSION['secret'] = $randomSecret;
setcookie("authSecret", $randomSecret, 0, "/", "", false, true);
$csrfToken = base64_encode(openssl_random_pseudo_bytes(32));
$_SESSION['csrfToken'] = $csrfToken;
if ($config['auth_type'] == 'db') {
$stmt = $db->prepare('SELECT id,password,type FROM users WHERE name=:name LIMIT 1');
$stmt->bindValue(':name', $input->user, PDO::PARAM_STR);
$stmt->execute();
$stmt->bindColumn('id', $id);
$stmt->bindColumn('password', $password);
$stmt->bindColumn('type', $type);
$stmt->fetch(PDO::FETCH_BOUND);
if (password_verify($input->password, $password)) {
$retval['status'] = 'success';
session_start();
$_SESSION['id'] = $id;
$_SESSION['type'] = $type;
$randomSecret = base64_encode(openssl_random_pseudo_bytes(32));
$_SESSION['secret'] = $randomSecret;
setcookie('authSecret', $randomSecret, 0, '/', '', false, true);
$csrfToken = base64_encode(openssl_random_pseudo_bytes(32));
$_SESSION['csrfToken'] = $csrfToken;
} else {
$retval['status'] = 'fail';
}
} elseif ($config['auth_type'] == 'ldap') {
$ldap = @ldap_connect($config['ldap_uri']);
@ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, $config['ldap_version']);
if ($config['ldap_starttls']) {
@ldap_start_tls($ldap);
}
@ldap_bind($ldap, $config['ldap_bind_dn'], $config['ldap_bind_pw']);
$filter = str_replace('%user%', @ldap_escape($input->user, null, LDAP_ESCAPE_FILTER), $config['ldap_search']);
$result = @ldap_search($ldap, $config['ldap_base_dn'], $filter, array('dn'));
$dn = @ldap_get_dn($ldap, ldap_first_entry($ldap, $result));
if (@ldap_bind($ldap, $dn, $input->password)) {
$retval['status'] = 'success';
session_start();
$_SESSION['id'] = 0;
$_SESSION['type'] = 'admin';
$randomSecret = base64_encode(openssl_random_pseudo_bytes(32));
$_SESSION['secret'] = $randomSecret;
setcookie('authSecret', $randomSecret, 0, '/', '', false, true);
$csrfToken = base64_encode(openssl_random_pseudo_bytes(32));
$_SESSION['csrfToken'] = $csrfToken;
} else {
$retval['status'] = 'fail';
}
} else {
$retval['status'] = "fail";
$retval['status'] = 'fail';
}
echo json_encode($retval);

4
api/password.php
View file

@ -22,6 +22,10 @@ if(!isset($input->csrfToken) || $input->csrfToken !== $_SESSION['csrfToken']) {
echo "Permission denied!";
exit();
}
if(!isset($_SESSION['id']) || $_SESSION['id'] == 0) {
echo "Permission denied!";
exit();
}
if(isset($input->action) && $input->action == "changePassword") {
$passwordHash = password_hash($input->password, PASSWORD_DEFAULT);
$stmt = $db->prepare("UPDATE users SET password=:password WHERE id=:id");

4
api/users.php
View file

@ -26,6 +26,10 @@ if(!isset($_SESSION['type']) || $_SESSION['type'] != "admin") {
echo "Permission denied!";
exit();
}
if(!isset($_SESSION['id']) || $_SESSION['id'] == 0) {
echo "Permission denied!";
exit();
}
if(isset($input->action) && $input->action == "getUsers") {
$sql = "
SELECT id,name,type

12
config/config-default.php
View file

@ -23,6 +23,18 @@ $config['db_password'] = "";
$config['db_port'] = 3306;
$config['db_name'] = "pdnsmanager";
// Authentication source
$config['auth_type'] = 'db';
// LDAP settings
$config['ldap_uri'] = 'ldapi:///';
$config['ldap_version'] = 3;
$config['ldap_starttls'] = false;
$config['ldap_bind_dn'] = '';
$config['ldap_bind_pw'] = '';
$config['ldap_base_dn'] = '';
$config['ldap_search'] = 'uid=%user%';
//Remote update
$config['nonce_lifetime'] = 15;

4
domains.php
View file

@ -38,8 +38,8 @@ limitations under the License.
</div>
<ul class="nav navbar-nav">
<li class="active"><a href="domains.php">Domains</a></li>
<?php if($_SESSION['type'] == "admin") echo '<li><a href="users.php">Users</a></li>'; ?>
<li><a href="password.php">Password</a></li>
<?php if($_SESSION['type'] == "admin" and $_SESSION['id'] > 0) echo '<li><a href="users.php">Users</a></li>'; ?>
<?php if($_SESSION['id'] > 0) echo '<li><a href="password.php">Password</a></li>'; ?>
<li><a href="logout.php">Logout</a></li>
</ul>
</div>

4
edit-master.php
View file

@ -38,8 +38,8 @@ limitations under the License.
</div>
<ul class="nav navbar-nav">
<li><a href="domains.php">Domains</a></li>
<?php if($_SESSION['type'] == "admin") echo '<li><a href="users.php">Users</a></li>'; ?>
<li><a href="password.php">Password</a></li>
<?php if($_SESSION['type'] == "admin" and $_SESSION['id'] > 0) echo '<li><a href="users.php">Users</a></li>'; ?>
<?php if($_SESSION['id'] > 0) echo '<li><a href="password.php">Password</a></li>'; ?>
<li><a href="logout.php">Logout</a></li>
</ul>
</div>