[Working] LDAP and Gallery 1.5.2

Have disabled the Preferences and Registration buttons by commenting out the following lines of code in .\gallery\albums.php:

if ($gallery->userDB->canModifyUser()) {
	$iconText = getIconText('yast_sysadmin.gif', _("preferences"));
	$iconElements[] = popup_link($iconText, "user_preferences.php", false, true, 500, 500);
}

...

if (!strcmp($gallery->app->selfReg, 'yes')) {
		$iconText = getIconText('yast_sysadmin2.gif', _("register"));
	        $iconElements[] = popup_link($iconText, "register.php", false, true, 500, 500);
}

Note that the gallery user information can still be changed if you login as the administrator and use the admin tools.

Alright, a day and much soda later, further progress.

I've been migrating the registration methods from .\gallery\register.php over into .\gallery\login.php in order to allow all users to automatically be registered when they login to Gallery IFF they have certain LDAP roles (administrator, teacher, etc.). Otherwise, it will not allow them to log in and kick back an error.

This should be completed by tomorrow, at which point I'll polish the formatting and comments then zip up the files with instructions and post them for others to pick at.

Found it-- Didn't have $tempUser->save(); moved over into the new registration module. Moving now and testing.

INSTRUCTIONS (Updated for 1.5.2)

In order to set up this, you will need to edit the PHP files in the .\Gallery\ directory. This was developed on Apache 2.0.54 / PHP 5.0.4 / Windows XP SP1. It has also been tested and verified on IIS 6.0 / PHP 4.4.0 / Windows Server 2003. Your mileage may vary with different operating system / server configurations.

Step 1: Back up the original Gallery Files

Make a copy of the following files: .\Gallery\Albums.php and Login.php. Store these in a safe location outside of the .\Gallery directory.

Step 2: Edit Albums.php using a plain text editor to prevent registration and changing preferences by user.

Please change the following lines of code as directed.

Find and replace (removes the new album button; allows only admin to create new albums on top album page):

/*
if ($gallery->user->canCreateAlbums() && !$gallery->session->offline) {
    $iconText = getIconText('folder_new.gif', gTranslate('core', "new album"));
    $iconElements[] = '<a href="' . doCommand("new-album", array(), "view_album.php") .'">'. $iconText .'</a>';
}
*/

if ($gallery->user->isAdmin() && !$gallery->session->offline) {
    $iconText = getIconText('folder_new.gif', gTranslate('core', "new album"));
    $iconElements[] = '<a href="' . doCommand("new-album", array(), "view_album.php") .'">'. $iconText .'</a>';
}

Find and comment out (removes the user preferences button; admins can still change preferences):

if ($gallery->userDB->canModifyUser()) {
        $iconText = getIconText('yast_sysadmin.gif', gTranslate('core', "preferences"));
        $iconElements[] = popup_link($iconText, "user_preferences.php", false, true, 500, 500);
}

Find and comment out (removes the registration button; this is instead done through the integrated LDAP login):

if (!strcmp($gallery->app->selfReg, 'yes')) {
            $iconText = getIconText('yast_sysadmin2.gif', gTranslate('core', "register"));
            $iconElements[] = popup_link($iconText, "register.php", false, true, 500, 500);
}

Step 3: Edit the contents of Login.php

You will need to change settings where appropriate to connect to your LDAP server. I have typed items that should be changed in ALL CAPS.

Find the following block of code:

if (!empty($username) && !empty($gallerypassword)) {
	$tmpUser = $gallery->userDB->getUserByUsername($username);
	if ($tmpUser && $tmpUser->isCorrectPassword($gallerypassword)) {

		// User is successfully logged in, regenerate a new 
		// session ID to prevent session fixation attacks
		createGallerySession(true);

		// Perform the login
		$tmpUser->log("login");
		$tmpUser->save();
		$gallery->session->username = $username;
		gallery_syslog("Successful login for $username from " . $_SERVER['REMOTE_ADDR']);
		if ($tmpUser->getDefaultLanguage() != "") {
			$gallery->session->language = $tmpUser->getDefaultLanguage();
		}
		if (!$gallery->session->offline) {
			dismissAndReload();
		} else {
		       	echo '<span class="error">'. _("SUCCEEDED") . '</span><p>';
			return;
		}
	} else {
		$error=_("Invalid username or password");
		$gallerypassword = null;
		gallery_syslog("Failed login for $username from " . $_SERVER['REMOTE_ADDR']);
	}
} elseif (!empty($login)) {
	$error=_("Please enter username and password.");
}

Replace this with the following (warning, this is long):

if (!empty($username) && !empty($gallerypassword)) {
//------------------------------------------CODE MODIFIED HERE PK 20060123---------------------------------------------------//
	// We will need to set up the LDAP authentication method here to check if the user exsists in LDAP.
	// First, we always let the gallery administrator login using the normal Gallery interface.

	if($username == 'admin'){
		// This Code Block is the original Gallery 1.5.2 code as supplied by the install-------------------------------
		$tmpUser = $gallery->userDB->getUserByUsername($username);
		if ($tmpUser && $tmpUser->isCorrectPassword($gallerypassword)) {

			// User is successfully logged in, regenerate a new
			// session ID to prevent session fixation attacks
			createGallerySession(true);

			// Perform the login
			$tmpUser->log("login");
			$tmpUser->save();
			$gallery->session->username = $username;
			gallery_syslog("Successful login for $username from " . $_SERVER['REMOTE_ADDR']);
			if ($tmpUser->getDefaultLanguage() != "") {
				$gallery->session->language = $tmpUser->getDefaultLanguage();
			}
			if (!$gallery->session->offline) {
				dismissAndReload();
			} else {
				echo '<span class="error">'. _("SUCCEEDED") . '</span><p>';
				return;
			}
		} else {
			$error=_("Invalid username or password");
			$gallerypassword = null;
			gallery_syslog("Failed login for $username from " . $_SERVER['REMOTE_ADDR']);
		}
		// End Code Block---------------------------------------------------------------------------------------------
	}
	elseif ($ldapConnection=ldap_connect('SERVER', 'PORT')) {
		// echo "<p>LDAP Connection is " . $ldapConnection . "</p>";

		// Before we can bind to the LDAP server, we need to format the username so that it
		// is the proper path for the LDAP server.  This may vary depending on server configuration,
		// but is generally along the following format:
		// uid=[username],ou=People,o=Server
		$bindUserName = "uid=" . $username . ",ou=People,o=SERVER,o=cp";

		// echo "<p>Binding to LDAP server using " . $bindUserName . " ...</p>";

		// Next, we bind with the adjusted username and password
		$ldapBind = @ldap_bind($ldapConnection, $bindUserName, $gallerypassword);
		// echo "<p>LDAP Bind is " . $ldapBind . "</p>";

		if($ldapBind) {
			// If we've bound to LDAP, then the authentication of the user was successful.
			// We then need to see if the user exsists in the Gallery database.
			// echo "<p>+++++LDAP Bind Successful!</p>";
			// echo "<p>Verifying if user is already a Gallery user...";

			$tmpUser = $gallery->userDB->getUserByUsername($username);

			if($tmpUser) {
				// Since we knows the user exsists in Gallery, we log them in as normal.
				// User is successfully logged in, regenerate a new
				// session ID to prevent session fixation attacks
				// echo "<br>User is confirmed as a Gallery user, logging in...</br>";
				createGallerySession(true);

				// Perform the login
				$tmpUser->log("login");
				$tmpUser->save();
				$gallery->session->username = $username;
				gallery_syslog("Successful login for $username from " . $_SERVER['REMOTE_ADDR']);
				if ($tmpUser->getDefaultLanguage() != "") {
					$gallery->session->language = $tmpUser->getDefaultLanguage();
				}
				if (!$gallery->session->offline) {
					dismissAndReload();
				} else {
					echo '<span class="error">'. _("SUCCEEDED") . '</span><p>';
					return;
				}
				// As we've retreived our necessary LDAP info at this point, we close the connection
				ldap_close($ldapconnection);
				// echo "LDAP connection safely closed<p>";
			} elseif(!$tmpUser) {
				// echo "<p>Running test query, searching for (uid=". $username . ")...</p>";

				// Search for the user id
				$ldapSearchName = "uid=" . $username;	// Get the given name, surname, and email address with search
				$ldapSearchInfo = array("givenName", "sn", "mail", "pdsRole");

				$ldapRole = 0;	// This will flag if the user has the correct role to create an LDAP account.
				$ldapFirstName = " ";
				$ldapSurname = " ";
				$ldapEmail = " ";

				if($ldapSearchResult=ldap_search($ldapConnection, "ou=People,o=punahou.edu,o=cp", $ldapSearchName, $ldapSearchInfo )) {
					// echo "+++++Search result is " . $ldapSearchResult . "<br />";
					// echo "Number of entires returned is " . ldap_count_entries($ldapConnection, $ldapSearchResult) . "<br />";
					// echo "Retreiving info from entries...<br />";

					$ldapUserInfo = ldap_get_entries($ldapConnection, $ldapSearchResult);

					// echo "Data for " . $ldapUserInfo["count"] . " items retrieved: <br />";

					// Loop through the results
					for($i=0; $i<$ldapUserInfo["count"]; $i++) {
						// Print out user's DN first.
						// echo $ldapUserInfo[$i]["dn"] . "<br>";

						// Loop through this dn
						for($ii=0; $ii<$ldapUserInfo[$i]["count"]; $ii++) {
							// echo "&nbsp;&nbsp;" . $ldapUserInfo[$i][$ii] . ": "; // Print name of attribute
							$attrib = $ldapUserInfo[$i][$ii];  // Set attribute

							switch ($attrib) {
								case "pdsrole":
									// echo $ldapUserInfo[$i][$attrib]["count"];
									for($iii=0; $iii<$ldapUserInfo[$i][$attrib]["count"]; $iii++)
									{
										if(($ldapUserInfo[$i][$attrib][$iii] == "Employee") || ($ldapUserInfo[$i][$attrib][$iii] == "employee"))  // Must be an employee to make an account
										{
											$ldapRole = 1;
										}
										// echo $ldapUserInfo[$i][$attrib][$iii] . " ";  // Print attribute value
									}
								   break;
								case "givenname":
									$ldapFirstName = $ldapUserInfo[$i][$attrib][0];
								   break;
								case "sn":
									$ldapSurname = $ldapUserInfo[$i][$attrib][0];
								   break;
								case "mail";
									$ldapEmail = $ldapUserInfo[$i][$attrib][0];
								   break;
							}
							// echo $ldapUserInfo[$i][$attrib][0];  // Print attribute value
						}
					}
					// Create the Full Name based off of First and Surname
					$ldapFullName = $ldapFirstName . " " . $ldapSurname;
					// As we've retreived our necessary LDAP info at this point, we close the connection
					ldap_close($ldapconnection);
					// echo "LDAP connection safely closed<p>";

					// echo "<p>Info from LDAP: " . $ldapFullName . ", " . $ldapEmail . ", " . $ldapRole . "</p>";

					if($ldapRole) {
						// If the user has the proper role in LDAP as defined above,
						//echo "<p>From here we create an account!</p>";

						$newUser = new Gallery_User();
						$newUser->setUsername($username);
						$newUser->setPassword($gallerypassword);
						$newUser->setFullname($ldapFullName);
						$newUser->setCanCreateAlbums(($gallery->app->selfRegCreate == 'yes'));
						$newUser->setEmail($ldapEmail);
						$newUser->origEmail=$ldapEmail;
						$newUser->log("self_register");
						$newUser->setDefaultLanguage("en");
						$newUser->save();

						$checkRegistered = $gallery->userDB->getUserByUsername($username);
						if($checkRegistered) {
							//echo "<p>Account successfully created!</p>";
							createGallerySession(true);

							// Perform the login
							$checkRegistered->log("login");
							$checkRegistered->save();
							$gallery->session->username = $username;
							gallery_syslog("Successful login for $username from " . $_SERVER['REMOTE_ADDR']);
							if ($checkRegistered->getDefaultLanguage() != "") {
								$gallery->session->language = $checkRegistered->getDefaultLanguage();
							}
							if (!$gallery->session->offline) {
								dismissAndReload();

							} else {
								echo '<span class="error">'. _("SUCCEEDED") . '</span><p>';
								return;
							}
							parent.close();
						} else {
							// Error in creating the actual account for the user.
							//echo "<p>Account was not created.</p>";
							//echo $checkRegistered;
							$error=_("Error in creating new Gallery account.  Please contact system administrator.");
							$gallerypassword = null;
							gallery_syslog("Failed login for $username from " . $_SERVER['REMOTE_ADDR']);
						}
					} else {
						// Must have the employee role in order to create an account.
						//echo "<p>Sorry, but that user is not an employee!  Throw an error message.</p>";
						$error=_("<center>You do not have access rights to edit this Gallery.  Please contact the Helpdesk if you should not have received this message.</center>");
						$gallerypassword = null;
						gallery_syslog("Failed login for $username from " . $_SERVER['REMOTE_ADDR']);
					}
				} else {
					// Output Error # and message
					//echo "-----LDAP-Errno: " . ldap_errno($ldapConnection) . "<br>\n";
					//echo "-----LDAP-Error: " . ldap_error($ldapConnection) . "<br>\n";
					//die('-----Error in search on LDAP server.');
					$error=_("Invalid username or password");
					$gallerypassword = null;
					gallery_syslog("Failed login for $username from " . $_SERVER['REMOTE_ADDR']);
				}
			}
		} else {
			// Output Error # and message
			//echo "-----LDAP-Errno: " . ldap_errno($ldapConnection) . "<br>\n";
			//echo "-----LDAP-Error: " . ldap_error($ldapConnection) . "<br>\n";
			//echo "-----Cannot Bind to LDAP server.  Please report this error to the system administrator.<br>\n";
			$error=_("Invalid username or password");
			$gallerypassword = null;
			gallery_syslog("Failed login for $username from " . $_SERVER['REMOTE_ADDR']);
		}
	} else {
		// Output Error # and message
		//echo "-----LDAP-Errno: " . ldap_errno($ldapConnection) . "<br>\n";
		//echo "-----LDAP-Error: " . ldap_error($ldapConnection) . "<br>\n";
		//echo "-----Cannot Connect to LDAP server.  Please report this error to the system administrator.";
		$error=_("Unable to connect to LDAP Server, please contact the system administrator.");
		$gallerypassword = null;
		gallery_syslog("Failed LDAP connection for $username from " . $_SERVER['REMOTE_ADDR']);
	}
} elseif (!empty($submitted)) {
	$error=_("Please enter username and password.");
} elseif (!empty($username)) {
	$error=_("Please enter a password.");
} elseif (!empty($gallerypassword)) {
	$error=_("Please enter a username.");
	$gallerypassword = null;
}

//------------------------------------------END CODE MODIFIED PK 20060123----------------------------------------------------//

Below this, find the following block of code, and comment it out:

if (isset($gallery->app->emailOn) && $gallery->app->emailOn == 'yes') {
?>
<div class="popuphead"><?php echo _("Forgotten your password?") ?></div>
<div class="popup" align="center">
<?php
    echo makeFormIntro('login.php', array('name' => 'forgot_form'));

    if (!empty($forgot)) {
    	$tmpUser = $gallery->userDB->getUserByUsername($username);
    	if ($tmpUser) {
    		$wait_time=15;
    		if ($tmpUser->lastAction ==  "new_password_request" &&
    		time() - $tmpUser->lastActionDate < $wait_time * 60) {
    			echo gallery_error(sprintf(_("The last request for a password was less than %d minutes ago.  Please check for previous email, or wait before trying again."), $wait_time));

    		} else if (check_email($tmpUser->getEmail())) {
    			if (gallery_mail( $tmpUser->email,
    			  _("New password request"),
    			  sprintf(_("Someone requested a new password for user %s from Gallery '%s' on %s. You can create a password by visiting the link below. If you didn't request a password, please ignore this mail. "), $username, $gallery->app->galleryTitle, $gallery->app->photoAlbumURL) . "\n\n" .
    			  sprintf(_("Click to reset your password: %s"),
    			  $tmpUser->genRecoverPasswordHash()) . "\n",
    			  sprintf(_("New password request %s"), $username))) {
    				$tmpUser->log("new_password_request");
    				$tmpUser->save();
			       	echo sprintf(_("An email has been sent to the address stored for %s.  Follow the instructions to change your password.  If you do not receive this email, please contact the Gallery administrators."),$username)  ?>
					<br><br>
			       	<form> <input type="button" value="<?php echo _("Dismiss") ?>" onclick='parent.close()'> </form>
				<?php
    			}
    			else {
    				echo gallery_error(sprintf(_("Email could not be sent.  Please contact %s administrators for a new password"),$gallery->app->galleryTitle ));
    			}
    			return;
    		}
    		else {
    			echo gallery_error(sprintf(_("There is no valid email for this account.  Please contact %s administrators for a new password"),$gallery->app->galleryTitle ));
    		}
    	}
    	else {
    		echo gallery_error(_("Not a valid username"));
    	}
    }
?>

<table align="center">
<tr>
	<td><?php echo _("Username") ?></td>
	<td><input type="text" name="username"  class="popupform" value="<?php echo $username ?>"></td>
</tr>
</table>

<p align="center"><input type="submit" name="forgot" value="<?php echo _("Send me my password") ?>"></p>
</form>
</div>

<?php } /* End if-email-on */ /*
if ($gallery->app->selfReg == 'yes') {
?>
<div class="popuphead"><?php echo _("No account at all?") ?></div>
<div class="popup" align="center">
<a href="<?php echo makeGalleryUrl('register.php') ?>"><?php echo _("Register a new account."); ?></a>
</div>
<?php
}
*/

4. Input the appropriate information that pertains to your LDAP server.

What this does is check for a user in LDAP. If that user is authenticated with the password that they login with, it then checks if they're in Gallery. If they're NOT in Gallery, it pulls the appropriate roles from LDAP and checks those. If they have a role in LDAP that should allow them to create an account, it auto-generates the account and logs them in.

5. Dance!

This is by no means perfect; I wrote it in a week after having only first seen the Gallery program on the Friday before. All input is much appreciated!

Additional info-- If you are running this under IIS, you will need to make sure to do the following (from http://us3.php.net/manual/en/ref.ldap.php):

Note to Win32 Users: In order to enable this module on a Windows environment, you must copy several files from the DLL folder of the PHP/Win32 binary package to the SYSTEM folder of your windows machine. (Ex: C:\WINNT\SYSTEM32, or C:\WINDOWS\SYSTEM). For PHP <= 4.2.0 copy libsasl.dll, for PHP >= 4.3.0 copy libeay32.dll and ssleay32.dll to your SYSTEM folder.

Updated the install of Gallery to 1.5.1 and moved LDAP code changes over. Looks good as ever and still works for LDAP authentication. We have been using this for a staff of about 200+ for a few months now, and it runs without hitch.

-Patrick

Thanks for the contribution! Glad to hear that it's working out.

Since I didn't have much experience working with LDAP before making this, I know I probably left some things out. One thing I noticed while scanning your version was the inclusion of a ldap_close(); statement, which I'll work into the code above.

-Patrick

Instructions updated for 1.5.2

-Patrick