Project

General

Profile

Download (15 KB) Statistics
| Branch: | Tag: | Revision:
1 b0ed07d1 Scott Ullrich
<?php
2
/* $Id$ */
3
/*
4
    part of pfSense (http://www.pfsense.org/)
5
6
	Copyright (C) 2007 Scott Ullrich <sullrich@gmail.com>
7
	All rights reserved.
8
9
    Copyright (C) 2007 Bill Marquette <bill.marquette@gmail.com>
10
    All rights reserved.
11
12
    Redistribution and use in source and binary forms, with or without
13
    modification, are permitted provided that the following conditions are met:
14
15
    1. Redistributions of source code must retain the above copyright notice,
16
       this list of conditions and the following disclaimer.
17
18
    2. Redistributions in binary form must reproduce the above copyright
19
       notice, this list of conditions and the following disclaimer in the
20
       documentation and/or other materials provided with the distribution.
21
22
    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
23
    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
24
    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25
    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
26
    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27
    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28
    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29
    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30
    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31
    POSSIBILITY OF SUCH DAMAGE.
32
*/
33
34
if($_POST['savetest'])
35
	$save_and_test = true;
36
37
require("guiconfig.inc");
38
39
$pconfig['session_timeout'] = &$config['system']['webgui']['session_timeout'];
40
$pconfig['ldapserver'] = &$config['system']['webgui']['ldapserver'];
41
$pconfig['backend'] = &$config['system']['webgui']['backend'];
42
$pconfig['ldapbindun'] = &$config['system']['webgui']['ldapbindun'];
43
$pconfig['ldapbindpw'] = &$config['system']['webgui']['ldapbindpw'];
44
$pconfig['ldapfilter'] = &$config['system']['webgui']['ldapfilter'];
45
$pconfig['ldapsearchbase'] = &$config['system']['webgui']['ldapsearchbase'];
46
$pconfig['ldapauthcontainers'] = &$config['system']['webgui']['ldapauthcontainers'];
47
$pconfig['ldapgroupattribute'] = &$config['system']['webgui']['ldapgroupattribute'];
48
$pconfig['ldapnameattribute'] = &$config['system']['webgui']['ldapnameattribute'];
49
50
// Page title for main admin
51
$pgtitle = array("System","User manager settings");
52
53
if ($_POST) {
54
	unset($input_errors);
55
56
	do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors);
57
58
	if($_POST['session_timeout']) {
59
		$timeout = intval($_POST['session_timeout']);
60
		if ($timeout != "" && !is_numeric($timeout))
61
			$input_errors[] = gettext("Session timeout must be an integer with value 1 or greater.");
62
63
		if ($timeout < 1)
64
			$input_errors[] = gettext("Session timeout must be an integer with value 1 or greater.");
65
66
		if ($timeout > 999)
67
			$input_errors[] = gettext("Session timeout must be an integer with value 1 or greater.");
68
	}
69
70
	if (!$input_errors) {
71
72
		if($_POST['session_timeout'] && $_POST['session_timeout'] != "0")
73
			$pconfig['session_timeout'] = intval($_POST['session_timeout']);
74
		else
75
			unset($config['system']['webgui']['session_timeout']);
76
77
		if($_POST['ldapserver'])
78
			$pconfig['ldapserver'] = $_POST['ldapserver'];
79
		else
80
			unset($pconfig['ldapserver']);
81
82
		if($_POST['backend'])
83
			$pconfig['backend'] = $_POST['backend'];
84
		else
85
			unset($pconfig['backend']);
86
87
		if($_POST['ldapbindun'])
88
			$pconfig['ldapbindun'] = $_POST['ldapbindun'];
89
		else
90
			unset($pconfig['ldapbindun']);
91
92
		if($_POST['ldapbindpw'])
93
			$pconfig['ldapbindpw'] = $_POST['ldapbindpw'];
94
		else
95
			unset($pconfig['ldapbindpw']);
96
97
		if($_POST['ldapfilter'])
98
			$pconfig['ldapfilter'] = $_POST['ldapfilter'];
99
		else
100
			unset($pconfig['ldapfilter']);
101
102
		if($_POST['ldapsearchbase'])
103
			$pconfig['ldapsearchbase'] = $_POST['ldapsearchbase'];
104
		else
105
			unset($pconfig['ldapsearchbase']);
106
107
		if($_POST['ldapauthcontainers'])
108
			$pconfig['ldapauthcontainers'] = $_POST['ldapauthcontainers'];
109
		else
110
			unset($pconfig['ldapauthcontainers']);
111
112
		if($_POST['ldapgroupattribute'])
113
			$pconfig['ldapgroupattribute'] = $_POST['ldapgroupattribute'];
114
		else
115
			unset($pconfig['ldapgroupattribute']);
116
		if($_POST['ldapnameattribute'])
117
			$pconfig['ldapnameattribute'] = $_POST['ldapnameattribute'];
118
		else
119
			unset($pconfig['ldapgroupattribute']);
120
121
122
		write_config();
123
124
		$retval = system_password_configure();
125
		sync_webgui_passwords();
126
127
	}
128
}
129
130
include("head.inc");
131
?>
132
133
<body link="#000000" vlink="#000000" alink="#000000" onload="<?= $jsevents["body"]["onload"] ?>">
134
<?php include("fbegin.inc");?>
135
<?php if ($input_errors) print_input_errors($input_errors);?>
136
<?php if ($savemsg) print_info_box($savemsg);?>
137
138
<?php
139
	if($save_and_test) {
140
		echo "<script language='javascript'>\n";
141
		echo "myRef = window.open('system_usermanager_settings_test.php','mywin', ";
142
		echo "'left=20,top=20,width=700,height=550,toolbar=1,resizable=0');\n";
143
		echo "</script>\n";
144
	}
145
?>
146
147 6344d71f Scott Ullrich
<script language="javascript">
148
	function show_ldapfilter() {
149
		document.getElementById("filteradv").innerHTML='';
150
		aodiv = document.getElementById('filteradvdiv');
151
		aodiv.style.display = "block";		
152
	}
153
	function show_ldapnaming(){
154
		document.getElementById("namingattribute").innerHTML='';
155
		aodiv = document.getElementById('ldapnamingdiv');
156
		aodiv.style.display = "block";		
157
	}
158
	function show_groupmembership() {
159
		document.getElementById("groupmembership").innerHTML='';
160
		aodiv = document.getElementById('groupmembershipdiv');
161
		aodiv.style.display = "block";		
162
	}
163
	function ldap_typechange() {
164
        switch (document.iform.backend.selectedIndex) {
165
            case 0:
166
            	/* pfSense backend, disable all options */
167
                document.iform.ldapfilter.disabled = 1;
168
                document.iform.ldapnameattribute.disabled = 1;
169
                document.iform.ldapgroupattribute.disabled = 1;
170
                document.iform.ldapsearchbase.disabled = 1;
171
                document.iform.ldapauthcontainers.disabled = 1;
172
				document.iform.ldapserver.disabled = 1;
173
				document.iform.ldapbindun.disabled = 1;
174
				document.iform.ldapbindpw.disabled = 1;
175
				document.iform.ldapfilter.value = "";
176
				document.iform.ldapnameattribute.value = "";	
177
				document.iform.ldapgroupattribute.value = "";
178
				document.iform.ldapauthcontainers.value = "";
179
				break;
180
            case 1:
181
            	/* A/D */
182
                document.iform.ldapfilter.disabled = 0;
183
                document.iform.ldapnameattribute.disabled = 0;
184
                document.iform.ldapgroupattribute.disabled = 0;
185
                document.iform.ldapsearchbase.disabled = 0;
186
                document.iform.ldapauthcontainers.disabled = 0;
187
				document.iform.ldapserver.disabled = 0;
188
				document.iform.ldapbindun.disabled = 0;
189
				document.iform.ldapbindpw.disabled = 0;
190
				document.iform.ldapfilter.value = "(samaccountname=$username)";
191
				document.iform.ldapnameattribute.value = "samaccountname";	
192
				document.iform.ldapgroupattribute.value = "memberOf";
193
				break;							
194
            case 2:
195
            	/* eDir */
196
                document.iform.ldapfilter.disabled = 0;
197
                document.iform.ldapnameattribute.disabled = 0;
198
                document.iform.ldapgroupattribute.disabled = 0;
199
                document.iform.ldapsearchbase.disabled = 0;
200
                document.iform.ldapauthcontainers.disabled = 0;
201
				document.iform.ldapserver.disabled = 0;
202
				document.iform.ldapbindun.disabled = 0;
203
				document.iform.ldapbindpw.disabled = 0;
204
				document.iform.ldapfilter.value = "(cn=$username)";		
205
				document.iform.ldapnameattribute.value = "CN";
206
				document.iform.ldapgroupattribute.value = "groupMembership";
207
				break;				
208
		}
209
	}
210
</script>
211
212 b0ed07d1 Scott Ullrich
  <table width="100%" border="0" cellpadding="0" cellspacing="0">
213
    <tr>
214
      <td class="tabnavtbl">
215
<?php
216
    $tab_array = array();
217
    $tab_array[] = array(gettext("Users"), false, "system_usermanager.php");
218
    $tab_array[] = array(gettext("Group"), false, "system_groupmanager.php");
219
    $tab_array[] = array(gettext("Settings"), true, "system_usermanager_settings.php");
220
    display_top_tabs($tab_array);
221
222
/* Default to pfsense backend type if none is defined */
223
if(!$pconfig['backend'])
224
	$pconfig['backend'] = "pfsense";
225
226
?>
227
      </td>
228
    <tr>
229
       <td>
230
            <div id="mainarea">
231
            <form id="iform" name="iform" action="system_usermanager_settings.php" method="post">
232
              <table class="tabcont" width="100%" border="0" cellspacing="0" cellpadding="6">
233
					<tr>
234
                        <td width="22%" valign="top" class="vncell">Session Timeout</td>
235
                        <td width="78%" class="vtable">
236
							<input name="session_timeout" id="session_timeout" type="text" size="8" value="<?=htmlspecialchars($pconfig['session_timeout']);?>" />
237
                          <br />
238
                          <?=gettext("Time in minutes to expire idle management sessions.");?><br />
239
						</td>
240
                      </tr>
241
					<tr>
242
                        <td width="22%" valign="top" class="vncell">Authentication primary backend</td>
243
                        <td width="78%" class="vtable">
244 6344d71f Scott Ullrich
							<select name='backend' id='backend' onchange='ldap_typechange()'>
245 b0ed07d1 Scott Ullrich
								<option value="pfsense"<?php if ($pconfig['backend'] == "pfsense") echo " SELECTED";?>>pfSense</option>
246
								<option value="ldap"<?php if ($pconfig['backend'] == "ldap") echo " SELECTED";?>>LDAP (Active Directory)</option>
247 4f7c3882 Scott Ullrich
								<option value="ldapother"<?php if ($pconfig['backend'] == "ldapother") echo " SELECTED";?>>LDAP OTHER (eDir, etc)</option>
248 b0ed07d1 Scott Ullrich
							</select>
249
							<br/>NOTE: login failures or server not available issues will fall back to pfSense internal users/group authentication.
250
						</td>
251
					</tr>
252
					<tr>
253
                        <td width="22%" valign="top" class="vncell">LDAP Server:port</td>
254
                        <td width="78%" class="vtable">
255 6344d71f Scott Ullrich
							<input name="ldapserver" id="ldapserver" size="65" value="<?=htmlspecialchars($pconfig['ldapserver']);?>">
256 b0ed07d1 Scott Ullrich
							<br/>Example: ldaps://ldap.example.org:389 or ldap://ldap.example.org:389
257
						</td>
258
					</tr>
259
					<tr>
260
                        <td width="22%" valign="top" class="vncell">LDAP Binding username</td>
261
                        <td width="78%" class="vtable">
262 6344d71f Scott Ullrich
							<input name="ldapbindun" id="ldapbindun" size="65" value="<?=htmlspecialchars($pconfig['ldapbindun']);?>">
263 b0ed07d1 Scott Ullrich
							<br/>This account must have read access to the user objects and be able to retrieve groups.
264
							<br/>Example: For Active Directory you would want to use format DOMAIN\username or username@domain.
265
							<br/>Example: eDirectory you would want to use format cn=username,ou=orgunit,o=org.
266
						</td>
267
					</tr>
268
					<tr>
269
                        <td width="22%" valign="top" class="vncell">LDAP Binding password</td>
270
                        <td width="78%" class="vtable">
271 6344d71f Scott Ullrich
							<input name="ldapbindpw" id="ldapbindpw" type="password" size="65" value="<?=htmlspecialchars($pconfig['ldapbindpw']);?>">
272 b0ed07d1 Scott Ullrich
						</td>
273
					</tr>
274
					<tr>
275
                        <td width="22%" valign="top" class="vncell">LDAP Filter</td>
276
                        <td width="78%" class="vtable">
277 6344d71f Scott Ullrich
							<div id="filteradv" name="filteradv">
278
								<input type="button" onClick="show_ldapfilter();" value="Advanced"> - Show advanced options
279
							</div>
280
							<div id="filteradvdiv" name="filteradvdiv" style="display:none">	
281
								<input name="ldapfilter" id="ldapfilter" size="65" value="<?=htmlspecialchars($pconfig['ldapfilter']);?>">
282
								<br/>Example: For Active Directory you would want to use (samaccountname=$username)
283
								<br/>Example: For eDirectory you would want to use (cn=$username)
284
							</div>
285 b0ed07d1 Scott Ullrich
						</td>
286
					</tr>
287
					<tr>
288
                        <td width="22%" valign="top" class="vncell">LDAP Naming Attribute</td>
289
                        <td width="78%" class="vtable">
290 6344d71f Scott Ullrich
							<div id="namingattribute" name="namingattribute">
291
								<input type="button" onClick="show_ldapnaming();" value="Advanced"> - Show advanced options
292
							</div>
293
							<div id="ldapnamingdiv" name="ldapnamingdiv" style="display:none">	
294
								<input name="ldapnameattribute" id="ldapnameattribute" size="65" value="<?=htmlspecialchars($pconfig['ldapnameattribute']);?>">
295
								<br/>Example: For Active Directory you would want to use samaccountname.
296
								<br/>Example: For eDirectory you would want to use CN.
297
							</div>
298 b0ed07d1 Scott Ullrich
						</td>
299
					</tr>
300
					<tr>
301
                        <td width="22%" valign="top" class="vncell">Group Membership Attribute Name</td>
302
                        <td width="78%" class="vtable">
303 6344d71f Scott Ullrich
							<div id="groupmembership" name="groupmembership">
304
								<input type="button" onClick="show_groupmembership();" value="Advanced"> - Show advanced options
305
							</div>
306
							<div id="groupmembershipdiv" name="groupmembershipdiv" style="display:none">
307
								<input name="ldapgroupattribute" id="ldapgroupattribute" size="65" value="<?=htmlspecialchars($pconfig['ldapgroupattribute']);?>">
308
								<br/>Example: For Active Directory you would want to use memberOf.
309
								<br/>Example: For eDirectory you would want to use groupMembership.
310
							</div>
311 b0ed07d1 Scott Ullrich
						</td>
312
					</tr>
313
314
					<tr>
315
                        <td width="22%" valign="top" class="vncell">LDAP Search base</td>
316
                        <td width="78%" class="vtable">
317
							<input name="ldapsearchbase" size="65" value="<?=htmlspecialchars($pconfig['ldapsearchbase']);?>">
318
							<br/>Example: DC=pfsense,DC=com
319
						</td>
320
					</tr>
321
					<tr>
322
                        <td width="22%" valign="top" class="vncell">LDAP Authentication container</td>
323
                        <td width="78%" class="vtable">
324 6344d71f Scott Ullrich
							<input name="ldapauthcontainers" id="ldapauthcontainers" size="65" value="<?=htmlspecialchars($pconfig['ldapauthcontainers']);?>">
325 2ddf8c6e Scott Ullrich
							<input type="button" onClick="javascript:if(openwindow('system_usermanager_settings_ldapacpicker.php') == false) alert('Popup blocker detected.  Action aborted.');" value="Select"> 
326 b0ed07d1 Scott Ullrich
							<br/>NOTE: Semi-Colon separated.
327
							<br/>EXAMPLE: CN=Users,DC=pfsense,DC=com;CN=OtherUsers,DC=pfsense,DC=com
328
						</td>
329
					</tr>
330
                	<tr>
331
                  		<td width="22%" valign="top">&nbsp;</td>
332
                  		<td width="78%">
333
							<input id="submit" name="Submit" type="submit" class="formbtn" value="<?=gettext("Save");?>" />
334
	     					<input id="savetest" name="savetest" type="submit" class="formbtn" value="<?=gettext("Save and Test");?>" />
335
						</td>
336
                	</tr>
337
              </table>
338
            </form>
339
            </div>
340
      </td>
341
    </tr>
342
  </table>
343
<?php include("fend.inc");?>
344
</body>
345
</html>
346
<script language="javascript">
347 6344d71f Scott Ullrich
	function openwindow(url) {
348
	        var oWin = window.open(url,"pfSensePop","width=620,height=400,top=150,left=150");
349
	        if (oWin==null || typeof(oWin)=="undefined") {
350
	                return false;
351
	        } else {
352
	                return true;
353
	        }
354
	}
355 b0ed07d1 Scott Ullrich
</script>
356