Subversion Repositories wimsdev

# Input variables: authdef=def file.

# Parameters: auth_user, auth_password.

# output : auth_test, auth_user

auth_test=ERROR

auth_real_login=ERROR

ldap_find=!sh which ldapsearch

!if $ldap_find issametext $empty

  auth_test=ERROR no_ldap

  !exit

!endif

ldap_auth=!defof class_ldap_auth in $authdef

!default ldap_auth=!defof ldap_auth in wimshome/log/wims.conf

!if xxxldap: notin xxx$ldap_auth and xxxldaps: notin xxx$ldap_auth

  ldap_auth=ldap://$ldap_auth

!endif

ldap_port=!defof class_ldap_port in $authdef

!default ldap_port=!defof ldap_port in wimshome/log/wims.conf

ldap_version=!defof class_ldap_version in $authdef

!default ldap_version=!defof ldap_version in wimshome/log/wims.conf

ldap_base=!defof class_ldap_base in $authdef

!default ldap_base=!defof ldap_base in wimshome/log/wims.conf

ldap_branch=!defof class_ldap_branch in $authdef

!default ldap_branch=!defof ldap_branch in wimshome/log/wims.conf

ldap_uid=!defof class_ldap_uid in $authdef

!default ldap_uid=!defof ldap_uid in wimshome/log/wims.conf

#ldap_id=!replace internal " by in $ldap_uid=$(wims_read_parm[1]),$ldap_branch,$ldap_base

ldap_id=!replace internal " by in $ldap_uid=$(wims_read_parm[1])

ldap_login=!defof class_ldap_login in $authdef

!default ldap_login=!defof ldap_login in wimshome/log/wims.conf

!if $ldap_login=$empty or $ldap_uid=$empty or $ldap_base=$empty \

       or $ldap_branch=$empty  or $ldap_auth=$empty

  auth_test=ERROR no_ldap_config

  !exit

!endif

!!!FIXME  Be careful : ldap must be configured such that the option -w is accepted. If not, the answer

!!! is the same for a good or wrong password.

!!! should fix the test

ldap_search=!sh ldapsearch -x -H $ldap_auth:$ldap_port -b "$ldap_base" '$ldap_id' -D "$ldap_id , $ldap_base" -w '$(wims_read_parm[2])'

atest=result: 0 Success

btest=# numEntries: 1

firstcond=0

ldap_cnt=!linecnt $ldap_search

!for i=1 to $ldap_cnt

  l=!line $i of $ldap_search

  field=!word 1 of $l

  !if $field iswordof $ldap_login:

    auth_real_login=!word 2 of $l

  !endif

  !if $l issametext $atest

    !increase firstcond

  !endif

  !if $l issametext $btest

    !increase firstcond

  !endif

!next i

!if $firstcond=2

  !!! now the user exists and password is good

  !!! find eventually  wims login

  !if $ldap_login issametext $ldap_uid

    auth_test=!replace internal " by  in $(wims_read_parm[1])

  !else

    !if $auth_real_login!= and $auth_real_login!=ERROR

      auth_test=$auth_real_login

    !else

      !! one looks for the ldap_login in an anonymous way (no password)

      !! quite anonymous search, since $ldap_oneuser is unpriviledged

      ldap_search2=!sh ldapsearch -x -H $ldap_auth:$ldap_port -b "$ldap_base" $ldap_accreditation '$ldap_id' $ldap_login | grep -v "^[d]n:"

      ldap_search2=!replace internal :$ $ by , in $ldap_search2

      ldap_cnt2=!linecnt $ldap_search2

      !for i=1 to $ldap_cnt2

        l=!line $i of $ldap_search2

        field=!item 1 of $l

        !if $field iswordof $ldap_login

          auth_real_login=!item 2 of $l

        !endif

      !next

      !if $auth_real_login!=

        auth_user=$auth_real_login

      !endif

      auth_test=$auth_real_login

    !endif

  !endif

!endif

cnt_=!charcnt $auth_user

!if $cnt_=3

  auth_user=!nospace $auth_user 0

!endif

!if $cnt_<=2

  auth_test=ERROR

  !reset auth_user

!endif

!if $auth_test!=ERROR

  auth_test=OK

!endif

auth_error=$wims_exec_error

!reset wims_exec_error

auth_user_orig=$(wims_read_parm[1])