diff options
Diffstat (limited to 'modules/ldap')
| -rw-r--r-- | modules/ldap/docs/ldap.txt | 12 | ||||
| -rw-r--r-- | modules/ldap/lib/ConfigHelper.php | 7 |
2 files changed, 18 insertions, 1 deletions
diff --git a/modules/ldap/docs/ldap.txt b/modules/ldap/docs/ldap.txt index 4a6e957..151db88 100644 --- a/modules/ldap/docs/ldap.txt +++ b/modules/ldap/docs/ldap.txt @@ -72,6 +72,14 @@ authentication source: 'search.attributes' => array('uid', 'mail'), /* + * Additional filters that must match for the entire LDAP search to be TRUE + * + * This should be a single string conforming to (RFC 1960, 2544) + * The string is appended to the search attributes + */ + 'search.filter' => '(&(objectClass=Person)(|(sn=Doe)(cn=John *)))', + + /* * The username & password where SimpleSAMLphp should bind to before searching. If * this is left NULL, no bind will be performed before searching. */ @@ -103,6 +111,10 @@ options. The `search.base`-option must be the `dn` which should be used as the base/root of the search. The `search.attributes`-option is an array with attributes the username should be matched against. +You can also append the `search.filter` option to further limit your search. +The `search.filter` field is optional and need not be included in your +configuration file. + The `dnpattern` option will not be used if searching is enabled. Some LDAP servers may require authentication before a search can be diff --git a/modules/ldap/lib/ConfigHelper.php b/modules/ldap/lib/ConfigHelper.php index c39d1dd..ec6757c 100644 --- a/modules/ldap/lib/ConfigHelper.php +++ b/modules/ldap/lib/ConfigHelper.php @@ -81,6 +81,10 @@ class sspmod_ldap_ConfigHelper { */ private $searchBase; + /** + * Additional LDAP filter fields for the search + */ + private $searchFilter; /** * The attributes which should match the username. @@ -149,6 +153,7 @@ class sspmod_ldap_ConfigHelper { } $this->searchBase = $config->getArrayizeString('search.base'); + $this->searchFilter = $config->getString('search.filter',NULL); $this->searchAttributes = $config->getArray('search.attributes'); } else { @@ -197,7 +202,7 @@ class sspmod_ldap_ConfigHelper { } } - $dn = $ldap->searchfordn($this->searchBase, $this->searchAttributes, $username, TRUE); + $dn = $ldap->searchfordn($this->searchBase, $this->searchAttributes, $username, TRUE, $this->searchFilter); if ($dn === NULL) { /* User not found with search. */ SimpleSAML_Logger::info($this->location . ': Unable to find users DN. username=\'' . $username . '\''); |