Samba AD password driver (#8525)

* SAMBA Active Directory password driver

Co-authored-by: Jonas Holm Bundgaard <root@mail1.jbweb.dk>

1 files changed, 78 insertions, 0 deletions

diff --git a/plugins/password/drivers/ldap_samba_ad.php b/plugins/password/drivers/ldap_samba_ad.php
new file mode 100644
index 000000000..85a0c9907
--- /dev/null
+++ b/plugins/password/drivers/ldap_samba_ad.php
@@ -0,0 +1,78 @@
+<?php
+
+/**
+ * LDAP - Password Modify Extended Operation Driver
+ *
+ * Driver for passwords stored in SAMBA Active Directory
+ * This driver is based on Simple LDAP Password Driver, but uses
+ * ldap_modify method (SAMBA Active Directory support)
+ * PHP >= 7.2 required
+ *
+ * @version 1.0
+ * @author Jonas Holm Bundgaard <jhb@jbweb.dk>
+ * Based on code by Peter Kubica <peter@kubica.ch>
+ *
+ * Copyright (C) The Roundcube Dev Team
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see http://www.gnu.org/licenses/.
+ */
+
+require_once __DIR__ . '/ldap_simple.php';
+
+class rcube_ldap_samba_ad_password extends rcube_ldap_simple_password
+{
+    function save($curpass, $passwd)
+    {
+        if (!function_exists('ldap_mod_replace')) {
+            rcube::raise_error([
+                    'code' => 100, 'type' => 'ldap',
+                    'file' => __FILE__, 'line' => __LINE__,
+                    'message' => "ldap_mod_replace not supported"
+                ],
+                true
+            );
+
+            return PASSWORD_ERROR;
+        }
+
+        // Connect and bind
+        $ret = $this->connect($curpass);
+        if ($ret !== true) {
+            return $ret;
+        }
+
+        $entry["unicodePwd"] = iconv("UTF-8", "UTF-16LE", '"' . $passwd . '"');
+
+        if (!ldap_mod_replace($this->conn, $this->user, $entry)) {
+            $this->_debug("S: ".ldap_error($this->conn));
+
+            $errno = ldap_errno($this->conn);
+
+            ldap_unbind($this->conn);
+
+            if ($errno == 0x13) {
+                return PASSWORD_CONSTRAINT_VIOLATION;
+            }
+
+            return PASSWORD_CONNECT_ERROR;
+        }
+
+        $this->_debug("S: OK");
+
+        // All done, no error
+        ldap_unbind($this->conn);
+
+        return PASSWORD_SUCCESS;
+    }
+}