/**
  * @return string[]
  * @throws ValueRetrievalFailureException
  */
 public function parse()
 {
     if (!ldap_parse_reference($this->link, $this->reference, $referrals)) {
         throw new ValueRetrievalFailureException(ldap_error($this->link), ldap_errno($this->link));
     }
     return $referrals;
 }

 public function __construct($message, $handler, $extra_error = null)
 {
     $this->handler = $handler;
     $err_no = ldap_errno($handler);
     $message = sprintf("ERROR %s. LDAP ERROR (%s) -- %s --. %s", $message, $err_no, $this->getErrorStr(), ldap_error($handler), is_null($extra_error) ? '' : $extra_error);
     parent::__construct($message, $err_no);
 }

 /**
  * {@inheritdoc}
  */
 public function remove(Entry $entry)
 {
     $con = $this->connection->getResource();
     if (!@ldap_delete($con, $entry->getDn())) {
         throw new LdapException(sprintf('Could not remove entry "%s": %s', $entry->getDn(), ldap_error($con)));
     }
 }

function check_LDAP_user($username, $password, $ladpserver, $domain1, $domain2)
{
    global $db1, $_POST, $_SESSION;
    //echo "!$ladpserver,$domain1,$domain2!";
    $HDR_ERR = "";
    if (!$password or !$username) {
        $HDR_ERR = "false";
    } else {
        $filter = "(&(objectClass=top)(sAMAccountName=" . $username . "))";
        $basedn = 'dc=$domain1,dc=$domain2';
        $dn = "{$domain1}\\{$username}";
        $ldapconn = ldap_connect("{$ladpserver}");
        ldap_set_option($ldapconn, LDAP_OPT_PROTOCOL_VERSION, 3);
        if (!$ldapconn) {
            $HDR_ERR .= ldap_error($ldapconn);
        } else {
            $bind = @ldap_bind($ldapconn, $dn, $password);
            if ($bind == "1") {
                $HDR_ERR = 'true';
            } else {
                $HDR_ERR = "false";
            }
        }
    }
    return $HDR_ERR;
}

function change_pass($user, $new_pass)
{
    global $config;
    global $ldap_connection;
    get_ldap_connection($config['user'], $config['pass']);
    if ($ldap_connection) {
        $filter = "(sAMAccountName={$user})";
        $result = ldap_search($ldap_connection, $config['domain_dn'], $filter);
        ldap_sort($ldap_connection, $result, "sn");
        $info = ldap_get_entries($ldap_connection, $result);
        $isLocked = $info[0]["lockoutTime"];
        if ($isLocked > 0) {
            return msg('account_locked');
        }
        $userDn = $info[0]["distinguishedname"][0];
        $userdata["unicodePwd"] = iconv("UTF-8", "UTF-16LE", '"' . $new_pass . '"');
        $result = ldap_mod_replace($ldap_connection, $userDn, $userdata);
        if (!$result) {
            return msg(ldap_error($ldap_connection));
        }
    } else {
        return msg("wrong_admin");
    }
    close_ldap_connection();
    return "";
}

 public function rewind()
 {
     $this->current = ldap_first_entry($this->connection, $this->search);
     if (false === $this->current) {
         throw new LdapException(sprintf('Could not rewind entries array: %s', ldap_error($this->connection)));
     }
 }

function authenticate($username, $password)
{
    global $config, $ldap_connection;
    if ($username && $ldap_connection) {
        if ($config['auth_ldap_version']) {
            ldap_set_option($ldap_connection, LDAP_OPT_PROTOCOL_VERSION, $config['auth_ldap_version']);
        }
        if (ldap_bind($ldap_connection, $config['auth_ldap_prefix'] . $username . $config['auth_ldap_suffix'], $password)) {
            if (!$config['auth_ldap_group']) {
                return 1;
            } else {
                $ldap_groups = get_group_list();
                foreach ($ldap_groups as $ldap_group) {
                    $ldap_comparison = ldap_compare($ldap_connection, $ldap_group, $config['auth_ldap_groupmemberattr'], get_membername($username));
                    if ($ldap_comparison === true) {
                        return 1;
                    }
                }
            }
        } else {
            echo ldap_error($ldap_connection);
        }
    } else {
        // FIXME return a warning that LDAP couldn't connect?
    }
    return 0;
}

function ldap_login($username, $password)
{
    $ldapServer = "ldap.iitm.ac.in";
    $ldapPort = 389;
    $ldapDn = "cn=students,ou=bind,dc=ldap,dc=iitm,dc=ac,dc=in";
    $ldapPass = "rE11Bg_oO~iC";
    $ldapConn = ldap_connect($ldapServer, $ldapPort) or die("Could not connect to LDAP server.");
    echo $ldapConn;
    $studentUser = $username;
    $studentPass = $password;
    if ($ldapConn) {
        $ldapBind = @ldap_bind($ldapConn, $ldapDn, $ldapPass);
        if ($ldapBind) {
            $filter = "(&(objectclass=*)(uid=" . $studentUser . "))";
            $ldapDn = "dc=ldap,dc=iitm,dc=ac,dc=in";
            $result = @ldap_search($ldapConn, $ldapDn, $filter) or die("Error in search query: " . ldap_error($ldapConn));
            $entries = @ldap_get_entries($ldapConn, $result);
            foreach ($entries as $values => $values1) {
                $logindn = $values1['dn'];
            }
            $loginbind = @ldap_bind($ldapConn, $logindn, $studentPass);
            if ($loginbind) {
                return 1;
            }
        }
    }
    @ldap_unbind($ldapConn);
    return 0;
}

 private function changeOpenLDAPPwd($objLdapBinding, $strUserDN, $strNewPwd)
 {
     include_once "sambahash.php";
     $entry["sambaNTPassword"] = nt_hash($strNewPwd);
     $this->logwriter->debugwrite('NT Hash:' . $entry["sambaNTPassword"]);
     $entry["sambaLMPassword"] = lm_hash($strNewPwd);
     $this->logwriter->debugwrite('LM Hash:' . $entry["sambaLMPassword"]);
     $date = time();
     $this->logwriter->debugwrite('Last Set:' . $date);
     $entry["sambaPwdLastSet"] = $date;
     $entry["sambaPwdMustChange"] = $date + 90 * 24 * 60 * 60;
     $this->logwriter->debugwrite('Must Change:' . $entry["sambaPwdMustChange"]);
     mt_srand((double) microtime() * 1000000);
     $salt = pack("CCCC", mt_rand(), mt_rand(), mt_rand(), mt_rand());
     $hash = "{SSHA}" . base64_encode(pack("H*", sha1($strNewPwd . $salt)) . $salt);
     $entry["userPassword"] = $hash;
     $entry["shadowLastChange"] = (int) ($date / 86400);
     $this->logwriter->debugwrite('Shadow Last Change:' . $entry["shadowLastChange"]);
     $res = ldap_mod_replace($objLdapBinding, $strUserDN, $entry) or $res = false;
     if ($res) {
         $this->success($strNewPwd);
         return true;
     } else {
         //Failed to change user Password
         $this->failure(8, array($strNewPwd, $newpass, ldap_error($objLdapBinding)));
         return false;
     }
 }

 /**
  * 
  * Verifies a username handle and password.
  * 
  * @return mixed An array of verified user information, or boolean false
  * if verification failed.
  * 
  * 
  */
 protected function _processLogin()
 {
     // connect
     $conn = @ldap_connect($this->_config['uri']);
     // did the connection work?
     if (!$conn) {
         throw $this->_exception('ERR_CONNECTION_FAILED', $this->_config);
     }
     // upgrade to LDAP3 when possible
     @ldap_set_option($conn, LDAP_OPT_PROTOCOL_VERSION, 3);
     // filter the handle to prevent LDAP injection
     $regex = '/[^' . $this->_config['filter'] . ']/';
     $this->_handle = preg_replace($regex, '', $this->_handle);
     // bind to the server
     $rdn = sprintf($this->_config['format'], $this->_handle);
     $bind = @ldap_bind($conn, $rdn, $this->_passwd);
     // did the bind succeed?
     if ($bind) {
         ldap_close($conn);
         return array('handle' => $this->_handle);
     } else {
         $this->_err = @ldap_errno($conn) . " " . @ldap_error($conn);
         ldap_close($conn);
         return false;
     }
 }

 public static function get_connection()
 {
     if (!ADLdap::$conn) {
         //            ldap_set_option(NULL, LDAP_OPT_DEBUG_LEVEL, 7);
         ADLdap::$conn = ldap_connect("ldap://" . getenv('LDAP_HOST'));
         if (!ADLdap::$conn) {
             error_log(ldap_error(ADLdap::$conn));
             return null;
         } else {
             $adUserName = getenv('LDAP_USER');
             $adPassword = getenv('LDAP_PASSWORD');
             $adDomain = getenv('LDAP_DOMAIN');
             ldap_set_option(ADLdap::$conn, LDAP_OPT_PROTOCOL_VERSION, 3);
             ldap_set_option(ADLdap::$conn, LDAP_OPT_NETWORK_TIMEOUT, 10);
             ldap_set_option(ADLdap::$conn, LDAP_OPT_REFERRALS, 0);
             ldap_set_option(ADLdap::$conn, LDAP_OPT_SIZELIMIT, 1000);
             //this is just for speed.
             if (!ldap_bind(ADLdap::$conn, $adUserName . "@" . $adDomain, $adPassword)) {
                 echo ldap_error(ADLdap::$conn);
                 die;
                 return null;
             }
         }
     }
     return new ADLdap();
 }

 public function __construct($message, $ldapLink, $dn = null)
 {
     if ($ldapLink instanceof server) {
         $ldapLink = $ldapLink->getLink();
     }
     parent::__construct(sprintf('LDAP exception (%s): %s (%s)', $dn ? $dn : 'global', $message, @ldap_error($ldapLink), @ldap_errno($ldapLink)));
 }

 public static function updateProfile($numero_membre, $data)
 {
     $handle_ldap = self::initialize();
     if (self::$isDisabled) {
         self::$logger->info("Ldap is disabled, doing nothing.");
         return false;
     }
     $membreExists = @ldap_search($handle_ldap, "cn={$numero_membre}, " . self::$conf['basedn'], "objectclass=*", array("cn", "description", "mail"));
     if ($membreExists) {
         $personnes = ldap_get_entries($handle_ldap, $membreExists);
         $personne = $personnes[0];
         $dn = $personne["dn"];
         //self::$logger->debug(print_r($personne, true));
         $newEmail = self::$conf['defaultEmail'];
         if (isset($data['email']) && $data['email']) {
             $newEmail = $data['email'];
         }
         $hasLdapEmail = @is_array($personne["mail"]);
         $ldapData = ['mail' => [$newEmail]];
         if ($hasLdapEmail) {
             self::$logger->info("Replacing ldap email for #{$numero_membre}: {$newEmail}");
             ldap_mod_replace($handle_ldap, $dn, $ldapData);
         } else {
             self::$logger->info("Adding ldap email for #{$numero_membre}: {$newEmail}");
             ldap_mod_add($handle_ldap, $dn, $ldapData);
         }
         $err = ldap_error($handle_ldap);
         if ($err != "Success") {
             return $err;
         }
     } else {
         return "Membre not found in ldap repo: #{$numero_membre}";
     }
 }

function authenticate($username, $password)
{
    global $config, $ds;
    if ($username && $ds) {
        // bind with sAMAccountName instead of full LDAP DN
        if (ldap_bind($ds, "{$username}@{$config['auth_ad_domain']}", $password)) {
            // group membership in one of the configured groups is required
            if (isset($config['auth_ad_require_groupmembership']) && $config['auth_ad_require_groupmembership'] > 0) {
                $search = ldap_search($ds, $config['auth_ad_base_dn'], "(samaccountname={$username})", array('memberOf'));
                $entries = ldap_get_entries($ds, $search);
                $user_authenticated = 0;
                foreach ($entries[0]['memberof'] as $entry) {
                    $group_cn = get_cn($entry);
                    if (isset($config['auth_ad_groups'][$group_cn]['level'])) {
                        // user is in one of the defined groups
                        $user_authenticated = 1;
                    }
                }
                return $user_authenticated;
            } else {
                // group membership is not required and user is valid
                return 1;
            }
        } else {
            return 0;
        }
    } else {
        echo ldap_error($ds);
    }
    return 0;
}

 /**
  * @see ResultSet::getRecordCount()
  */
 function getRecordCount()
 {
     $rows = @ldap_count_entries($this->result);
     if ($rows === null) {
         throw new SQLException("Error fetching num entries", ldap_error($this->conn->getResource()));
     }
     return (int) $rows;
 }

 /**
  * Returns the first entry in the result set.
  * 
  * @throws \gossi\ldap\LdapException If the read fails.
  * @return \gossi\ldap\LdapEntry The new LdapEntry.
  */
 public function getFirstEntry()
 {
     $this->pointer = ldap_first_entry($this->conn, $this->result);
     if (ldap_errno($this->conn)) {
         throw new LdapException(ldap_error($this->conn), ldap_errno($this->conn));
     }
     return new LdapEntry($this->conn, $this->pointer);
 }

 /**
  * {@inheritdoc}
  */
 public function bind($dn = null, $password = null)
 {
     if (!$this->connection) {
         $this->connect();
     }
     if (false === @ldap_bind($this->connection, $dn, $password)) {
         throw new ConnectionException(ldap_error($this->connection));
     }
 }

 public function Logoff()
 {
     if (ldap_unbind($this->ldap_link)) {
         ZLog::Write(LOGLEVEL_INFO, sprintf("BackendLDAP->Logoff(): Disconnection successfull."));
     } else {
         ZLog::Write(LOGLEVEL_INFO, sprintf("BackendLDAP->Logoff(): Disconnection failed. Error: %s", ldap_error($this->ldap_link)));
     }
     return true;
 }

 public function get_info($val, $key = 'samaccountname')
 {
     $filter = $key . '=' . $val;
     $sr = @ldap_search($this->_conn, $this->_basedn, $filter);
     $info = ldap_get_entries($this->_conn, $sr);
     $error = ldap_error($this->_conn);
     if ($error && $error != 'Success') {
         throw new Exception($error);
     }
     return $info;
 }

 public function connectToLDAP()
 {
     $this->ldap_link = ldap_connect(AUTH_SERVER, AUTH_PORT);
     if (!$this->ldap_link) {
         $this->msg = "Could not connect to the LDAP server (AUTH_SERVER)." . ldap_error($this->ldap_link);
         ldap_close($this->ldap_link);
         return false;
     }
     ldap_set_option($this->ldap_link, LDAP_OPT_PROTOCOL_VERSION, 3);
     return true;
 }