/**
  * Factory method to create the RootDSE.
  *
  * @param  Zend_Ldap $ldap
  * @return Zend_Ldap_Node_RootDse
  * @throws Zend_Ldap_Exception
  */
 public static function create(Zend_Ldap $ldap)
 {
     $dn = Zend_Ldap_Dn::fromString('');
     $data = $ldap->getEntry($dn, array('*', '+'), true);
     if (isset($data['domainfunctionality'])) {
         /**
          * @see Zend_Ldap_Node_RootDse_ActiveDirectory
          */
         require_once 'Zend/Ldap/Node/RootDse/ActiveDirectory.php';
         return new Zend_Ldap_Node_RootDse_ActiveDirectory($dn, $data);
     } else {
         if (isset($data['dsaname'])) {
             /**
              * @see Zend_Ldap_Node_RootDse_ActiveDirectory
              */
             require_once 'Zend/Ldap/Node/RootDse/eDirectory.php';
             return new Zend_Ldap_Node_RootDse_eDirectory($dn, $data);
         } else {
             if (isset($data['structuralobjectclass']) && $data['structuralobjectclass'][0] === 'OpenLDAProotDSE') {
                 /**
                  * @see Zend_Ldap_Node_RootDse_OpenLdap
                  */
                 require_once 'Zend/Ldap/Node/RootDse/OpenLdap.php';
                 return new Zend_Ldap_Node_RootDse_OpenLdap($dn, $data);
             } else {
                 return new self($dn, $data);
             }
         }
     }
 }

 public function checkDomain($params)
 {
     foreach ($params as $param) {
         $data[$param['name']] = $param['value'];
     }
     if (empty($data['toCheck'])) {
         throw new Exception('Podaj login zgłaszającego!');
     }
     $logic = new Logic_Validate_LdapLogin();
     $config = Zend_Registry::get('config');
     $servers = $config['ldap'];
     foreach ($servers as $server) {
         $ldap = new Zend_Ldap($server);
         $ldap->bind($data['login'], $data['password']);
         $ldapEntry = $ldap->searchEntries(Zend_Ldap_Filter::equals('samaccountname', $data['toCheck']));
         if (!empty($ldapEntry)) {
             break;
         }
     }
     if (!empty($ldapEntry)) {
         $ret['pm_name'] = $ldapEntry[0]['displayname'][0];
         $ret['pm_email'] = $ldapEntry[0]['userprincipalname'][0];
         return $ret;
     } else {
         throw new Exception('Nie znaleziono użytkownika w domenie!');
     }
 }

 public function isValid($value)
 {
     $request = Zend_Controller_Front::getInstance()->getRequest();
     $fields = $request->getParams();
     $config = Zend_Registry::get('config');
     $servers = $config['ldap'];
     $valid = false;
     foreach ($servers as $server) {
         try {
             $ldap = new Zend_Ldap($server);
             $ldap->bind($fields['ldapUser'], $fields['ldapPassword']);
             $ldapEntry = $ldap->searchEntries(Zend_Ldap_Filter::equals('samaccountname', $value));
             if (!empty($ldapEntry)) {
                 $valid |= true;
             }
         } catch (Exception $e) {
             $valid |= false;
         }
     }
     if (!$valid) {
         $this->_error(self::NOT_EXISTS);
         return false;
     }
     return true;
 }

 /**
  * @return void
  */
 public function testInvalidOptionResultsInException()
 {
     $optionName = 'invalid';
     try {
         $this->_ldap->setOptions(array($optionName => 'irrelevant'));
         $this->fail('Expected Zend_Ldap_Exception not thrown');
     } catch (Zend_Ldap_Exception $e) {
         $this->assertEquals("Unknown Zend_Ldap option: $optionName", $e->getMessage());
     }
 }

 /**
  * returns the class that actually does the LDAP querying
  * 
  * @return Zend_Ldap
  */
 public function getLdap()
 {
     // get the connection if not set
     if (!$this->connection && $this->Host) {
         $options = array('host' => $this->Host, 'username' => $this->BindUser, 'password' => $this->BindPass, 'bindRequiresDn' => true, 'baseDn' => $this->BaseDN);
         $this->connection = new Zend_Ldap($options);
         $this->connection->connect();
     }
     return $this->connection;
 }

 /**
  * @return void
  */
 public function testExplodeDnOperation()
 {
     $inputs = array('CN=Alice Baker,CN=Users,DC=example,DC=com' => true, 'CN=Baker\\, Alice,CN=Users,DC=example,DC=com' => true, 'OU=Sales,DC=local' => true, 'OU=Sales;DC=local' => true, 'OU=Sales ,DC=local' => true, 'OU=Sales, dC=local' => true, 'ou=Sales , DC=local' => true, 'OU=Sales ; dc=local' => true, 'DC=local' => true, ' DC=local' => true, 'DC= local  ' => true, 'username' => false, '[email protected]' => false, 'EXAMPLE\\username' => false, 'CN=,Alice Baker,CN=Users,DC=example,DC=com' => false, 'CN=Users,DC==example,DC=com' => false, 'O=ACME' => true, '' => false, '   ' => false);
     foreach ($inputs as $dn => $expected) {
         $ret = Zend_Ldap::explodeDn($dn);
         $this->assertTrue($ret === $expected);
     }
 }

 /**
  * Rewind the Iterator to the first result item
  * Implements Iterator
  *
  * @throws Zend_Ldap_Exception
  */
 public function rewind()
 {
     if (is_resource($this->_resultId)) {
         $this->_current = @ldap_first_entry($this->_ldap->getResource(), $this->_resultId);
         /** @see Zend_Ldap_Exception */
         if ($this->_current === false && $this->_ldap->getLastErrorCode() > Zend_Ldap_Exception::LDAP_SUCCESS) {
             throw new Zend_Ldap_Exception($this->_ldap, 'getting first entry');
         }
     }
 }

 /**
  * Stores the current DN
  *
  * @return void
  * @throws Zend_Ldap_Exception
  */
 protected function _storeCurrentDn()
 {
     if (is_resource($this->_current)) {
         $this->_currentDn = @ldap_get_dn($this->_ldap->getResource(), $this->_current);
         if ($this->_currentDn === false) {
             throw new Zend_Ldap_Exception($this->_ldap, 'getting dn');
         }
     } else {
         $this->_currentDn = null;
     }
 }

 /**
  * Factory method to create the Schema node.
  *
  * @param  Zend_Ldap $ldap
  * @return Zend_Ldap_Node_Schema
  * @throws Zend_Ldap_Exception
  */
 public static function create(Zend_Ldap $ldap)
 {
     $dn = $ldap->getRootDse()->getSchemaDn();
     $data = $ldap->getEntry($dn, array('*', '+'), true);
     switch ($ldap->getRootDse()->getServerType()) {
         case Zend_Ldap_Node_RootDse::SERVER_TYPE_ACTIVEDIRECTORY:
             /**
              * @see Zend_Ldap_Node_Schema_ActiveDirectory
              */
             return new Zend_Ldap_Node_Schema_ActiveDirectory($dn, $data, $ldap);
         case Zend_Ldap_Node_RootDse::SERVER_TYPE_OPENLDAP:
             /**
              * @see Zend_Ldap_Node_RootDse_ActiveDirectory
              */
             return new Zend_Ldap_Node_Schema_OpenLdap($dn, $data, $ldap);
         case Zend_Ldap_Node_RootDse::SERVER_TYPE_EDIRECTORY:
         default:
             return new self($dn, $data, $ldap);
     }
 }

 public function setup()
 {
     $path = '';
     if ($this->_authType->getAuthType() == 'Ldap') {
         $path = $this->_authType->getAuthInfo('homedirectory');
     }
     if (!$path) {
         $ldapOpts = $this->_config->ldap->params;
         if ($ldapOpts == null) {
             throw new Exception('LDAP options not configured.', 102);
         }
         $ldapOpts = $ldapOpts->toArray();
         $ldapOpts['bindRequiresDn'] = true;
         $ldap = new Zend_Ldap($ldapOpts);
         $entry = $ldap->search('uid=' . $this->_authType->getUsername())->getFirst();
         if (!$entry) {
             throw new Exception('User ' . $this->_authType->getUsername() . ' LDAP entry not found to create ' . 'their home directory.');
         }
         $path = $entry['homedirectory'];
         if (!$path) {
             throw new Exception('User ' . $this->_authType->getUsername() . ' home directory location ' . 'not found.');
         }
     }
     if (is_array($path)) {
         $path = $path[0];
     }
     /* Only create the home directory if the path doesn't exist. */
     if (is_dir($path)) {
         return;
     }
     /* Run the home directory creation script. */
     $script = $this->_config->session->homedirectory->script;
     if (!$script) {
         throw new Exception('Home directory creation script not configured.', 108);
     }
     if (!is_executable($script)) {
         throw new Exception('Home directory creation script does not exist or is not executable.', 108);
     }
     $args = escapeshellarg($this->_authType->getUsername()) . ' ' . escapeshellarg($path);
     exec("sudo {$script} {$args}");
 }

 public function isValid($value)
 {
     $config = Zend_Registry::get('config');
     $servers = $config['ldap'];
     $identity = Zend_Auth::getInstance()->getIdentity();
     foreach ($servers as $server) {
         try {
             $ldap = new Zend_Ldap($server);
             $bind = $ldap->bind($identity->login, $value);
             if (!empty($bind)) {
                 return true;
             }
         } catch (Exception $e) {
             $valid = false;
         }
     }
     if (!$valid) {
         $this->_error(self::NOT_VALID);
         return false;
     }
 }

 /**
  * Extend constructor
  *
  * @param array $_options
  * @return @see Zend_Ldap
  */
 public function __construct(array $_options)
 {
     if (Tinebase_Config::getInstance()->get(Tinebase_Config::LDAP_DISABLE_TLSREQCERT)) {
         if (Tinebase_Core::isLogLevel(Zend_Log::INFO)) {
             Tinebase_Core::getLogger()->info(__METHOD__ . '::' . __LINE__ . ' Disable TLS certificate check');
         }
         putenv('LDAPTLS_REQCERT=never');
     }
     // strip non Zend_Ldap options
     $options = array_intersect_key($_options, array('host' => null, 'port' => null, 'useSsl' => null, 'username' => null, 'password' => null, 'bindRequiresDn' => null, 'baseDn' => null, 'accountCanonicalForm' => null, 'accountDomainName' => null, 'accountDomainNameShort' => null, 'accountFilterFormat' => null, 'allowEmptyPassword' => null, 'useStartTls' => null, 'optReferrals' => null, 'tryUsernameSplit' => null));
     if (Tinebase_Core::isLogLevel(Zend_Log::TRACE)) {
         Tinebase_Core::getLogger()->trace(__METHOD__ . '::' . __LINE__ . ' LDAP options: ' . print_r($options, true));
     }
     $returnValue = parent::__construct($options);
     return $returnValue;
 }

 /**
  * read ldap / get users and groups from tine an create mapping
  * 
  * @return array
  */
 protected function _getGroupMapping()
 {
     $this->_logger->info(__METHOD__ . '::' . __LINE__ . ' Fetching user mapping ...');
     $filter = Zend_Ldap_Filter::andFilter(Zend_Ldap_Filter::string($this->_groupBaseFilter));
     $mapping = array();
     $groupNameMapping = $this->_config->groupNameMapping ? $this->_config->groupNameMapping->toArray() : array();
     $this->_logger->debug(__METHOD__ . '::' . __LINE__ . ' Group name mapping: ' . print_r($groupNameMapping, TRUE));
     $ldapGroups = $this->_ldap->search($filter, $this->_config->ldap->baseDn, $this->_groupSearchScope, array('*', '+'));
     foreach ($ldapGroups as $group) {
         $groupname = isset($groupNameMapping[$group['cn'][0]]) ? $groupNameMapping[$group['cn'][0]] : $group['cn'][0];
         $ldapUuid = $group['entryuuid'][0];
         try {
             $tineGroup = $this->_tineGroupBackend->getGroupByName($groupname);
             $this->_logger->debug(__METHOD__ . '::' . __LINE__ . ' Group ' . $groupname . ' (' . $group['cn'][0] . '): ' . $tineGroup->getId() . ' -> ' . $ldapUuid);
             $mapping[$tineGroup->getId()] = $ldapUuid;
         } catch (Tinebase_Exception_Record_NotDefined $tenf) {
             // @todo should be: Tinebase_Exception_NotFound
             $this->_logger->debug(__METHOD__ . '::' . __LINE__ . ' Group ' . $groupname . ' (' . $group['cn'][0] . '): ' . $tenf->getMessage());
         }
     }
     $this->_logger->info(__METHOD__ . '::' . __LINE__ . ' Found ' . count($mapping) . ' groups for the mapping.');
     $this->_logger->debug(__METHOD__ . '::' . __LINE__ . ' ' . print_r($mapping, TRUE));
     return $mapping;
 }

 /**
  * @group ZF-8274
  */
 public function testConnectWithUri()
 {
     $host = TESTS_ZEND_LDAP_HOST;
     $port = 0;
     if (defined('TESTS_ZEND_LDAP_PORT') && TESTS_ZEND_LDAP_PORT != 389) {
         $port = TESTS_ZEND_LDAP_PORT;
     }
     $useSsl = false;
     if (defined('TESTS_ZEND_LDAP_USE_SSL')) {
         $useSsl = TESTS_ZEND_LDAP_USE_SSL;
     }
     if ($useSsl) {
         $host = 'ldaps://' . $host;
     } else {
         $host = 'ldap://' . $host;
     }
     if ($port) {
         $host = $host . ':' . $port;
     }
     $ldap = new Zend_Ldap();
     try {
         $ldap->connect($host)->bind('CN=ignored,DC=example,DC=com', 'ignored');
         $this->fail('Expected exception for invalid username');
     } catch (Zend_Ldap_Exception $zle) {
         $this->assertContains('Invalid credentials', $zle->getMessage());
     }
 }

 /**
  * Checks the group membership of the bound user
  *
  * @param  Zend_Ldap $ldap
  * @param  string    $canonicalName
  * @param  string    $dn
  * @param  array     $adapterOptions
  * @return string|true
  */
 protected function _checkGroupMembership(Zend_Ldap $ldap, $canonicalName, $dn, array $adapterOptions)
 {
     if ($adapterOptions['group'] === null) {
         return true;
     }
     if ($adapterOptions['memberIsDn'] === false) {
         $user = $canonicalName;
     } else {
         $user = $dn;
     }
     /**
      * @see Zend_Ldap_Filter
      */
     require_once 'Zend/Ldap/Filter.php';
     $groupName = Zend_Ldap_Filter::equals($adapterOptions['groupAttr'], $adapterOptions['group']);
     $membership = Zend_Ldap_Filter::equals($adapterOptions['memberAttr'], $user);
     $group = Zend_Ldap_Filter::andFilter($groupName, $membership);
     $groupFilter = $adapterOptions['groupFilter'];
     if (!empty($groupFilter)) {
         $group = $group->addAnd($groupFilter);
     }
     $result = $ldap->count($group, $adapterOptions['groupDn'], $adapterOptions['groupScope']);
     if ($result === 1) {
         return true;
     } else {
         return 'Failed to verify group membership with ' . $group->toString();
     }
 }

 /**
  * @deprecated not necessary any more - will be removed
  * @param Zend_Ldap $ldap A Zend_Ldap object
  * @return int The current error code for the resource
  */
 public static function getLdapCode(Zend_Ldap $ldap = null)
 {
     if ($ldap !== null) {
         return $ldap->getLastErrorCode();
     }
     return 0;
 }

 public function testMismatchDomainBind()
 {
     $ldap = new Zend_Ldap($this->_options);
     try {
         $ldap->bind('BOGUS\\doesntmatter', 'doesntmatter');
     } catch (Zend_Ldap_Exception $zle) {
         $this->assertTrue($zle->getCode() == Zend_Ldap_Exception::LDAP_X_DOMAIN_MISMATCH);
     }
 }

 /**
  * @return string The LDAP search filter for matching directory accounts
  */
 protected function _getAccountFilter($acctname)
 {
     $this->_splitName($acctname, $dname, $aname);
     $accountFilterFormat = $this->_getAccountFilterFormat();
     $aname = Zend_Ldap::filterEscape($aname);
     if ($accountFilterFormat)
         return sprintf($accountFilterFormat, $aname);
     if (!$this->_bindRequiresDn) {
         // is there a better way to detect this?
         return "(&(objectClass=user)(sAMAccountName=$aname))";
     }
     return "(&(objectClass=posixAccount)(uid=$aname))";
 }

 public function testRequiresDnWithoutDnBind()
 {
     $options = $this->_options;
     /* Fixup filter since bindRequiresDn is used to determine default accountFilterFormat
      */
     if (!isset($options['accountFilterFormat']) && !$this->_bindRequiresDn) {
         $options['accountFilterFormat'] = '(&(objectClass=user)(sAMAccountName=%s))';
     }
     $options['bindRequiresDn'] = true;
     unset($options['username']);
     $ldap = new Zend_Ldap($options);
     try {
         $ldap->bind($this->_principalName);
     } catch (Zend_Ldap_Exception $zle) {
         /* Note that if your server actually allows anonymous binds this test will fail.
          */
         $this->assertContains('Failed to retrieve DN', $zle->getMessage());
     }
 }

 public function testDisconnect()
 {
     $ldap = new Zend_Ldap($this->_options);
     for ($i = 0; $i < 3; $i++) {
         $ldap->disconnect();
         try {
             $ldap->connect()->bind('CN=ignored,DC=example,DC=com', 'ignored');
             $this->fail('Expected exception for unknown username');
         } catch (Zend_Ldap_Exception $zle) {
             $this->assertContains('Invalid credentials', $zle->getMessage());
         }
     }
 }