0
如何使用LDAP使用sudo用戶和密碼從PHP進行身份驗證？使用僅使用sudo用戶和密碼的PHP對來自PHP的LDAP進行身份驗證？
我發現了簡單的php腳本，它對用戶進行了如下驗證，但我在ldap數據庫中有nosudo用戶和sudo用戶。
此腳本對所有sudo用戶以及nosudo用戶進行身份驗證，我只希望sudo用戶能夠登錄。那麼你可以請建議修改嗎？
PHP腳本
// get username and password from form
$username = $_POST['username'];
$password = $_POST['password'];
/*
* checks the credentials against the LDAP server
* $user - myBYU
* $pass - password
*/
function authenticate($user,$pass){
// prevents guest account access
if($pass == ""){
return false;
}
try{
$Yldap_location = "ldap://ldap.byu.edu";
$ldap_port = 389;
// call the ldap connect function
$Ydatabase = ldap_connect($Yldap_location, $ldap_port);
// bind the connection
$good = @ldap_bind($Ydatabase, "uid=".$user.",ou=People,o=BYU.edu", $pass);
if($good){
// valid credentials
return true;
}
else{
// invalid credentials
return false;
}
}
catch(Exception $e){
return false;
}
}
// call authenticate function
if(authenticate($username,$password)){
// authenticate successful
// set session
$_SESSION['loggedin'] = "true";
// redirect
echo $_SESSION['loggedin'];
$url = "http://orca.byu.edu/iacuc/".$_SESSION['url'];
header("Location: ".$url);
}
else{
// authenticate fails
// redirect to login
header("Location: http://orca.byu.edu/iacuc/Login.php");
}
**Sudo User Ldif is**
dn: uid=rupesh,ou=example,dc=example,dc=com
cn: Rupesh Jeevanrao Shewalkar
gidnumber: 502
homedirectory: /home/rupesh
loginshell: /bin/bash
mail: [email protected]
mobile: 99999999
objectclass: extensibleObject
objectclass: posixAccount
objectclass: top
objectclass: shadowAccount
objectclass: sudoRole
shadowlastchange: 16148
shadowmax: 99999
shadowmin: 0
shadowwarning: 7
sudocommand: ALL
sudohost: ALL
sudooption: logfile=/var/log/sudo.log
sudooption: timestamp_timeout=5
sudooption: ignore_local_sudoers
sudooption: !env_reset
sudooption: log_year
sudooption: log_host
sudooption: insults
sudouser: rupesh
uid: rupesh
uidnumber: 2164
userpassword: welcome123
------------------------------
**Non sudo user LDIF:**
dn: uid=contactus,ou=example,dc=example,dc=com
cn: contactus
gidnumber: 502
homedirectory: /home/contactus
loginshell: /bin/bash
mail: [email protected]
objectclass: extensibleObject
objectclass: posixAccount
objectclass: top
objectclass: shadowAccount
objectclass: sudoRole
shadowlastchange: 15621
shadowmax: 99999
shadowmin: 0
shadowwarning: 7
uid: contactus
uidnumber: 2108
userpassword:[email protected]
如何區分sudo-User和LDAP中的nonsudo-Users？有一個object類「sudoRole」可以使用，但它被分配給兩個用戶，所以它似乎沒用。 – heiglandreas
我會從nonsudo用戶刪除sudorole，但你能幫助我如何在PHP代碼 – Rups