Changeset 1603 for trunk

Timestamp:

01/07/16 15:55:13 (9 years ago)

Author:

nanardon

Message:

Upgrade entry user to sambaAccount to store NT encrypted password

Having password stored in NT windows forms will allow to use them for mschap(v2)
authentication

Location:

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases

Files:

• Ldap.pm (modified) (1 diff)
• Ldap/User.pm (modified) (7 diffs)
• Ldap/objects.pm (modified) (1 diff)

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Ldap.pm

@@ -91 +91 @@
 }
 
+sub sambaSID {
+    my ($self, $id) = @_;
+
+    my $ssid = $self->config('sambaSID') || 'S-2016-01-07';
+    if (defined($id)) {
+        $ssid .= '-' . $id;
+    }
+    return $ssid;
+}
+
 sub load {
     my ($self) = @_;

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Ldap/User.pm

@@ -15 +15 @@
 use LATMOS::Accounts::Bases::Ldap::Group;
 use LATMOS::Accounts::Utils;
+use Crypt::SmbHash;
 
 our $VERSION = (q$Rev: 649 $ =~ /^Rev: (\d+) /)[0];
@@ -49 +50 @@
     posixAccount
     shadowAccount
+    sambaSamAccount
 ) }
+
+sub _computeSSID {
+    my ($value) = @_;
+    $value * 2 + 1000
+}
 
 sub _get_attr_schema {
@@ -70 +77 @@
         },
         facsimileTelephoneNumber => { },
-        uidNumber => { uniq => 1, },
+        uidNumber => {
+            uniq => 1,
+            post => sub {
+                my ($self, $value) = @_;
+                if (!grep { $_ eq 'sambaSamAccount' }  $self->object->_get_attributes('objectClass')) {
+                    $self->_update_class(
+                        sambaSID => $self->base->sambaSID(_computeSSID($value))
+                    );
+                } else {
+                    $self->object->set_fields(sambaSID => $self->object->base->sambaSID(_computeSSID($value)));
+                }
+            },
+        },
         gidNumber => {
             reference => 'group',
@@ -121 +140 @@
         pwdChangedTime => { ro => 1 },
         labeledURI => {},
-        userPassword => { readable => 0, },
+        userPassword    => { readable => 0, },
+        sambaLMPassword => { readable => 0, },
+        sambaNTPassword => { readable => 0, },
+        sambaSid => { ro => 1 },
     }
     );
@@ -143 +165 @@
     $data{sn} ||= $id; # sn is mandatory
     $data{uid} ||= $id; # uid is mandatory
+    $data{sambaSID} = $base->sambaSID(_computeSSID($data{uidNumber}));
     $data{homeDirectory} ||= '/dev/null'; # homeDirectory is mandatory
     $data{$class->_key_attribute($base)} = $id;
@@ -230 +253 @@
             return 1;
         };
-        /^userPassword$/ and do {
-            # openldap use prefix to identify encryption passwd
-            # {CRYPT} is system dependant, eg use crypt from system
-            # As we run openldap on UNIX, this should not be a problem
-            # as we use perl crypt() which does the same
-            # This code will have to be changed if we use openldap on other UNIX
-            $val = '{CRYPT}' . ($val || 'xxx');
-            next;
-        };
         /^manager$/ && $val and do {
             my $user = $base->get_object('user', $val) or do {
@@ -255 +269 @@
 }
 
+sub _set_password {
+    my ($self, $clear_pass) = @_;
+
+    my @salt_char = (('a' .. 'z'), ('A' .. 'Z'), (0 .. 9), '/', '.');
+    my $salt = join('', map { $salt_char[rand(scalar(@salt_char))] } (1 .. 8));
+    # openldap use prefix to identify encryption passwd
+    # {CRYPT} is system dependant, eg use crypt from system
+    # As we run openldap on UNIX, this should not be a problem
+    # as we use perl crypt() which does the same
+    # This code will have to be changed if we use openldap on other UNIX
+    my $md5 = '{CRYPT}' . crypt($clear_pass, '$1$' . $salt);
+
+    my ($lm, $nt) = ntlmgen $clear_pass;
+
+    if (!grep { $_ eq 'sambaSamAccount' }  $self->get_attributes('objectClass')) {
+        $self->_update_class(
+            sambaSID => $self->base->sambaSID($self->_get_attributes('uidNumber') * 2 + 1000)
+        );
+    }
+
+    my $res = $self->set_fields(
+        userPassword    => $md5,
+        sambaLMPassword => $lm,
+        sambaNTPassword => $nt,
+    );
+    $self->base->log(LA_NOTICE, 'Mot de passe changé pour %s', $self->id)
+    if($res);
+    return $res;
+}
+
 1;
 

trunk/LATMOS-Accounts/lib/LATMOS/Accounts/Bases/Ldap/objects.pm

@@ -225 +225 @@
 }
 
+sub _update_class {
+    my ($self, %attr) = @_;
+
+    $self->base->log(
+        LA_NOTICE,
+        "Updating ObjectClass for %s/%s: %s",
+        $self->type, $self->id, join(', ', $self->_my_ldap_classes)
+    );
+    $self->{entry}->replace(
+        'objectClass' => [ $self->_my_ldap_classes ],
+        %attr,
+    );
+}
+
 1;