mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-16 16:45:07 +00:00
ignacionelson
6e47d76ba6
Client file sharing, rebuilt from the ground up: a private area per client, resumable uploads, folders, groups and categories, sharing with expiry dates and download limits, comments, file versions, an activity log, a REST API, and sixteen languages. This repository begins here. ProjectSend 2 was developed privately, and that development history is not published — the previous generation remains available, with its own history, at projectsend/legacy. Free software under the GNU General Public License v2, or (at your option) any later version.
69 lines
2.7 KiB
PHP
69 lines
2.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Modules\Identity\Ldap;
|
|
|
|
use LdapRecord\Connection;
|
|
|
|
/**
|
|
* Builds the LdapRecord connection from the stored settings.
|
|
*
|
|
* `configFor()` is a pure function on purpose. v1's worst LDAP bug was a
|
|
* `use_tls` setting with no `ldap_start_tls()` call anywhere behind it —
|
|
* every installation that believed it was encrypted was shipping its bind
|
|
* password in clear, and nothing could have caught that except reading the
|
|
* code. Keeping the mapping as a function of its input means a test can
|
|
* assert "encryption = tls produces use_tls" directly, forever.
|
|
*/
|
|
class LdapConnectionFactory
|
|
{
|
|
/**
|
|
* @return array<string, mixed>
|
|
*/
|
|
public static function configFor(LdapSettings $settings): array
|
|
{
|
|
// Built statement by statement rather than as one literal. The
|
|
// options are keyed by PHP's LDAP_OPT_* integer constants, and both
|
|
// clever ways of assembling them quietly lose entries: array_filter()
|
|
// with no callback drops LDAP_OPT_REFERRALS because its value is 0,
|
|
// and the spread operator renumbers integer keys outright. Either
|
|
// one leaves referrals enabled, which is the Active Directory
|
|
// misbehaviour the option exists to prevent.
|
|
$options = [
|
|
LDAP_OPT_PROTOCOL_VERSION => 3,
|
|
LDAP_OPT_NETWORK_TIMEOUT => 5,
|
|
LDAP_OPT_REFERRALS => 0,
|
|
];
|
|
|
|
if ($settings->ca_cert_path !== null && $settings->ca_cert_path !== '') {
|
|
$options[LDAP_OPT_X_TLS_CACERTFILE] = $settings->ca_cert_path;
|
|
}
|
|
|
|
return [
|
|
'hosts' => [$settings->host],
|
|
'port' => $settings->port,
|
|
'base_dn' => $settings->base_dn,
|
|
// Empty means an anonymous bind, which some directories allow
|
|
// for the search step.
|
|
'username' => $settings->bind_dn !== '' ? $settings->bind_dn : null,
|
|
'password' => $settings->bind_password !== '' ? $settings->bind_password : null,
|
|
'use_ssl' => $settings->encryption === LdapEncryption::Ssl,
|
|
'use_tls' => $settings->encryption === LdapEncryption::Tls,
|
|
// A directory that stops answering must not hold a PHP-FPM
|
|
// worker for LDAP's 30-second default; see LdapAuthenticator's
|
|
// circuit breaker for the other half of that.
|
|
'timeout' => 5,
|
|
'options' => $options,
|
|
];
|
|
}
|
|
|
|
public static function make(LdapSettings $settings): Connection
|
|
{
|
|
// LDAP_OPT_X_TLS_REQUIRE_CERT is deliberately never set, leaving the
|
|
// system default of `demand`. There is no code path here that
|
|
// weakens certificate verification.
|
|
return new Connection(self::configFor($settings));
|
|
}
|
|
}
|