diff --git a/.env.example b/.env.example index 00d230bff..d32d96c0d 100644 --- a/.env.example +++ b/.env.example @@ -36,6 +36,14 @@ APP_URL=http://bookstack.dev # External services such as Gravatar DISABLE_EXTERNAL_SERVICES=false +# LDAP Settings +LDAP_SERVER=false +LDAP_BASE_DN=false +LDAP_DN=false +LDAP_PASS=false +LDAP_USER_FILTER=false +LDAP_VERSION=false + # Mail settings MAIL_DRIVER=smtp MAIL_HOST=localhost diff --git a/app/Http/Controllers/Auth/AuthController.php b/app/Http/Controllers/Auth/AuthController.php index 21abfb24c..d601b4985 100644 --- a/app/Http/Controllers/Auth/AuthController.php +++ b/app/Http/Controllers/Auth/AuthController.php @@ -118,17 +118,20 @@ class AuthController extends Controller */ protected function authenticated(Request $request, Authenticatable $user) { - if(!$user->exists && $user->email === null && !$request->has('email')) { + // Explicitly log them out for now if they do no exist. + if (!$user->exists) auth()->logout($user); + + if (!$user->exists && $user->email === null && !$request->has('email')) { $request->flash(); session()->flash('request-email', true); return redirect('/login'); } - if(!$user->exists && $user->email === null && $request->has('email')) { + if (!$user->exists && $user->email === null && $request->has('email')) { $user->email = $request->get('email'); } - if(!$user->exists) { + if (!$user->exists) { $user->save(); $this->userRepo->attachDefaultRole($user); auth()->login($user); diff --git a/app/Http/Middleware/Authenticate.php b/app/Http/Middleware/Authenticate.php index ebd830ffe..ad804d0d8 100644 --- a/app/Http/Middleware/Authenticate.php +++ b/app/Http/Middleware/Authenticate.php @@ -38,6 +38,7 @@ class Authenticate if(auth()->check() && auth()->user()->email_confirmed == false) { return redirect()->guest('/register/confirm/awaiting'); } + if ($this->auth->guest() && !Setting::get('app-public')) { if ($request->ajax()) { return response('Unauthorized.', 401); diff --git a/app/Http/routes.php b/app/Http/routes.php index aedfca9bc..23d4c33ab 100644 --- a/app/Http/routes.php +++ b/app/Http/routes.php @@ -1,11 +1,5 @@ getUserDetails('ksmith')); -}); - // Authenticated routes... Route::group(['middleware' => 'auth'], function () { diff --git a/app/Providers/LdapUserProvider.php b/app/Providers/LdapUserProvider.php index 98cfc8340..30fa739c2 100644 --- a/app/Providers/LdapUserProvider.php +++ b/app/Providers/LdapUserProvider.php @@ -86,8 +86,10 @@ class LdapUserProvider implements UserProvider */ public function updateRememberToken(Authenticatable $user, $token) { - $user->setRememberToken($token); - $user->save(); + if ($user->exists) { + $user->setRememberToken($token); + $user->save(); + } } /** @@ -113,6 +115,7 @@ class LdapUserProvider implements UserProvider $model->name = $userDetails['name']; $model->external_auth_id = $userDetails['uid']; $model->email = $userDetails['email']; + $model->email_confirmed = true; return $model; } diff --git a/app/Services/Ldap.php b/app/Services/Ldap.php new file mode 100644 index 000000000..cfefbb4b6 --- /dev/null +++ b/app/Services/Ldap.php @@ -0,0 +1,86 @@ +search($ldapConnection, $baseDn, $filter, $attributes); + return $this->getEntries($ldapConnection, $search); + } + + /** + * Bind to LDAP directory. + * @param resource $ldapConnection + * @param string $bindRdn + * @param string $bindPassword + * @return bool + */ + public function bind($ldapConnection, $bindRdn = null, $bindPassword = null) + { + return ldap_bind($ldapConnection, $bindRdn, $bindPassword); + } + +} \ No newline at end of file diff --git a/app/Services/LdapService.php b/app/Services/LdapService.php index cd80290e4..d33f8c378 100644 --- a/app/Services/LdapService.php +++ b/app/Services/LdapService.php @@ -4,10 +4,27 @@ use BookStack\Exceptions\LdapException; use Illuminate\Contracts\Auth\Authenticatable; +/** + * Class LdapService + * Handles any app-specific LDAP tasks. + * @package BookStack\Services + */ class LdapService { + protected $ldap; protected $ldapConnection; + protected $config; + + /** + * LdapService constructor. + * @param Ldap $ldap + */ + public function __construct(Ldap $ldap) + { + $this->ldap = $ldap; + $this->config = config('services.ldap'); + } /** * Get the details of a user from LDAP using the given username. @@ -21,17 +38,16 @@ class LdapService $ldapConnection = $this->getConnection(); // Find user - $userFilter = $this->buildFilter(config('services.ldap.user_filter'), ['user' => $userName]); - $baseDn = config('services.ldap.base_dn'); - $ldapSearch = ldap_search($ldapConnection, $baseDn, $userFilter, ['cn', 'uid', 'dn', 'mail']); - $users = ldap_get_entries($ldapConnection, $ldapSearch); + $userFilter = $this->buildFilter($this->config['user_filter'], ['user' => $userName]); + $baseDn = $this->config['base_dn']; + $users = $this->ldap->searchAndGetEntries($ldapConnection, $baseDn, $userFilter, ['cn', 'uid', 'dn', 'mail']); if ($users['count'] === 0) return null; $user = $users[0]; return [ - 'uid' => $user['uid'][0], - 'name' => $user['cn'][0], - 'dn' => $user['dn'], + 'uid' => $user['uid'][0], + 'name' => $user['cn'][0], + 'dn' => $user['dn'], 'email' => (isset($user['mail'])) ? $user['mail'][0] : null ]; } @@ -50,7 +66,12 @@ class LdapService if ($ldapUser['uid'] !== $user->external_auth_id) return false; $ldapConnection = $this->getConnection(); - $ldapBind = @ldap_bind($ldapConnection, $ldapUser['dn'], $password); + try { + $ldapBind = $this->ldap->bind($ldapConnection, $ldapUser['dn'], $password); + } catch (\ErrorException $e) { + $ldapBind = false; + } + return $ldapBind; } @@ -62,14 +83,14 @@ class LdapService */ protected function bindSystemUser($connection) { - $ldapDn = config('services.ldap.dn'); - $ldapPass = config('services.ldap.pass'); + $ldapDn = $this->config['dn']; + $ldapPass = $this->config['pass']; $isAnonymous = ($ldapDn === false || $ldapPass === false); if ($isAnonymous) { - $ldapBind = ldap_bind($connection); + $ldapBind = $this->ldap->bind($connection); } else { - $ldapBind = ldap_bind($connection, $ldapDn, $ldapPass); + $ldapBind = $this->ldap->bind($connection, $ldapDn, $ldapPass); } if (!$ldapBind) throw new LdapException('LDAP access failed using ' . $isAnonymous ? ' anonymous bind.' : ' given dn & pass details'); @@ -86,20 +107,22 @@ class LdapService if ($this->ldapConnection !== null) return $this->ldapConnection; // Check LDAP extension in installed - if (!function_exists('ldap_connect')) { + if (!function_exists('ldap_connect') && config('app.env') !== 'testing') { throw new LdapException('LDAP PHP extension not installed'); } // Get port from server string if specified. - $ldapServer = explode(':', config('services.ldap.server')); - $ldapConnection = ldap_connect($ldapServer[0], count($ldapServer) > 1 ? $ldapServer[1] : 389); + $ldapServer = explode(':', $this->config['server']); + $ldapConnection = $this->ldap->connect($ldapServer[0], count($ldapServer) > 1 ? $ldapServer[1] : 389); if ($ldapConnection === false) { throw new LdapException('Cannot connect to ldap server, Initial connection failed'); } // Set any required options - ldap_set_option($ldapConnection, LDAP_OPT_PROTOCOL_VERSION, 3); // TODO - make configurable + if ($this->config['version']) { + $this->ldap->setOption($ldapConnection, LDAP_OPT_PROTOCOL_VERSION, $this->config['version']); + } $this->ldapConnection = $ldapConnection; return $this->ldapConnection; @@ -107,7 +130,7 @@ class LdapService /** * Build a filter string by injecting common variables. - * @param $filterString + * @param string $filterString * @param array $attrs * @return string */ diff --git a/config/services.php b/config/services.php index 08c2f3217..d71ff4a26 100644 --- a/config/services.php +++ b/config/services.php @@ -54,7 +54,8 @@ return [ 'dn' => env('LDAP_DN', false), 'pass' => env('LDAP_PASS', false), 'base_dn' => env('LDAP_BASE_DN', false), - 'user_filter' => env('LDAP_USER_FILTER', '(&(uid=${user}))') + 'user_filter' => env('LDAP_USER_FILTER', '(&(uid=${user}))'), + 'version' => env('LDAP_VERSION', false) ] ]; diff --git a/resources/views/public.blade.php b/resources/views/public.blade.php index 52c287987..d34c490a7 100644 --- a/resources/views/public.blade.php +++ b/resources/views/public.blade.php @@ -5,19 +5,19 @@ + - - + - + @include('partials/notifications') @@ -37,12 +37,15 @@ @yield('header-buttons') @if(isset($signedIn) && $signedIn) - {{ $currentUser->name }} -