[Sommaire] [Imprimer]

   1  <?php
   2  /**
   3   * The Auth_krb5 class provides an kerberos implementation of the Horde
   4   * authentication system.
   5   *
   6   * This driver requires the 'krb5' PHP extension to be loaded.
   7   * The module can be downloaded here:
   8   *   http://www.horde.org/download/php/phpkrb5.tar.gz
   9   *
  10   * Required parameters:<pre>
  11   *   None.</pre>
  12   *
  13   * Instead, Kerberos must be correctly configured on your system (e.g.
  14   *   /etc/krb5.conf) for this class to work correctly.
  15   *
  16   *
  17   * $Horde: framework/Auth/Auth/krb5.php,v 1.21.10.8 2006/01/01 21:28:07 jan Exp $
  18   *
  19   * Copyright 2002-2006 Michael Slusarz <slusarz@bigworm.colorado.edu>
  20   *
  21   * See the enclosed file COPYING for license information (LGPL). If you
  22   * did not receive this file, see http://www.fsf.org/copyleft/lgpl.html.
  23   *
  24   * @author  Michael Slusarz <slusarz@bigworm.colorado.edu>
  25   * @since   Horde 2.2
  26   * @package Horde_Auth
  27   */
  28  class Auth_krb5 extends Auth {
  29  
  30      /**
  31       * An array of capabilities, so that the driver can report which
  32       * operations it supports and which it doesn't.
  33       *
  34       * @var array
  35       */
  36      var $capabilities = array('add'           => false,
  37                                'update'        => false,
  38                                'resetpassword' => false,
  39                                'remove'        => false,
  40                                'list'          => false,
  41                                'transparent'   => false);
  42  
  43      /**
  44       * Constructs a new Kerberos authentication object.
  45       *
  46       * @param array $params  A hash containing connection parameters.
  47       */
  48      function Auth_krb5($params = array())
  49      {
  50          if (!Util::extensionExists('krb5')) {
  51              Horde::fatal(_("Auth_krb5: Required krb5 extension not found."), __FILE__, __LINE__);
  52          }
  53  
  54          $this->_params = $params;
  55      }
  56  
  57      /**
  58       * Find out if a set of login credentials are valid.
  59       *
  60       * @access private
  61       *
  62       * @param string $userId      The userId to check.
  63       * @param array $credentials  An array of login credentials.
  64       *                            For kerberos, this must contain a password
  65       *                            entry.
  66       *
  67       * @return boolean  Whether or not the credentials are valid.
  68       */
  69      function _authenticate($userId, $credentials)
  70      {
  71          if (empty($credentials['password'])) {
  72              Horde::fatal(_("No password provided for Kerberos authentication."), __FILE__, __LINE__);
  73          }
  74  
  75          $result = krb5_login($userId, $credentials['password']);
  76  
  77          if ($result === KRB5_OK) {
  78              return true;
  79          } else {
  80              if ($result === KRB5_BAD_PASSWORD) {
  81                  $this->_setAuthError(AUTH_REASON_MESSAGE, _("Bad kerberos password."));
  82              } elseif ($result === KRB5_BAD_USER) {
  83                  $this->_setAuthError(AUTH_REASON_MESSAGE, _("Bad kerberos username."));
  84              } else {
  85                  $this->_setAuthError(AUTH_REASON_MESSAGE, _("Kerberos server rejected authentication."));
  86              }
  87              return false;
  88          }
  89      }
  90  
  91  }