<?php

/**

 * Zend Framework

 *

 * LICENSE

 *

 * This source file is subject to the new BSD license that is bundled

 * with this package in the file LICENSE.txt.

 * It is also available through the world-wide-web at this URL:

 * http://framework.zend.com/license/new-bsd

 * If you did not receive a copy of the license and are unable to

 * obtain it through the world-wide-web, please send an email

 * to license@zend.com so we can send you a copy immediately.

 *

 * @category   Zend

 * @package    Zend_Ldap

 * @copyright  Copyright (c) 2005-2015 Zend Technologies USA Inc. (http://www.zend.com)

 * @license    http://framework.zend.com/license/new-bsd     New BSD License

 * @version    $Id$

 */

/**

 * @category   Zend

 * @package    Zend_Ldap

 * @copyright  Copyright (c) 2005-2015 Zend Technologies USA Inc. (http://www.zend.com)

 * @license    http://framework.zend.com/license/new-bsd     New BSD License

 */

class Zend_Ldap

{

    const SEARCH_SCOPE_SUB  = 1;

    const SEARCH_SCOPE_ONE  = 2;

    const SEARCH_SCOPE_BASE = 3;

    const ACCTNAME_FORM_DN        = 1;

    const ACCTNAME_FORM_USERNAME  = 2;

    const ACCTNAME_FORM_BACKSLASH = 3;

    const ACCTNAME_FORM_PRINCIPAL = 4;

    /**

     * String used with ldap_connect for error handling purposes.

     *

     * @var string

     */

    private $_connectString;

    /**

     * The options used in connecting, binding, etc.

     *

     * @var array

     */

    protected $_options = null;

    /**

     * The raw LDAP extension resource.

     *

     * @var resource

     */

    protected $_resource = null;

    /**

     * FALSE if no user is bound to the LDAP resource

     * NULL if there has been an anonymous bind

     * username of the currently bound user

     *

     * @var boolean|null|string

     */

    protected $_boundUser = false;

    /**

     * Caches the RootDSE

     *

     * @var Zend_Ldap_Node

     */

    protected $_rootDse = null;

    /**

     * Caches the schema

     *

     * @var Zend_Ldap_Node

     */

    protected $_schema = null;

    /**

     * @deprecated will be removed, use {@see Zend_Ldap_Filter_Abstract::escapeValue()}

     * @param  string $str The string to escape.

     * @return string The escaped string

     */

    public static function filterEscape($str)

    {

        /**

         * @see Zend_Ldap_Filter_Abstract

         */

        require_once 'Zend/Ldap/Filter/Abstract.php';

        return Zend_Ldap_Filter_Abstract::escapeValue($str);

    }

    /**

     * @deprecated will be removed, use {@see Zend_Ldap_Dn::checkDn()}

     * @param  string $dn   The DN to parse

     * @param  array  $keys An optional array to receive DN keys (e.g. CN, OU, DC, ...)

     * @param  array  $vals An optional array to receive DN values

     * @return boolean True if the DN was successfully parsed or false if the string is

     * not a valid DN.

     */

    public static function explodeDn($dn, array &$keys = null, array &$vals = null)

    {

        /**

         * @see Zend_Ldap_Dn

         */

        require_once 'Zend/Ldap/Dn.php';

        return Zend_Ldap_Dn::checkDn($dn, $keys, $vals);

    }

    /**

     * Constructor.

     *

     * @param  array|Zend_Config $options Options used in connecting, binding, etc.

     * @return void

     * @throws Zend_Ldap_Exception if ext/ldap is not installed

     */

    public function __construct($options = array())

    {

        if (!extension_loaded('ldap')) {

            /**

             * @see Zend_Ldap_Exception

             */

            require_once 'Zend/Ldap/Exception.php';

            throw new Zend_Ldap_Exception(null, 'LDAP extension not loaded',

                Zend_Ldap_Exception::LDAP_X_EXTENSION_NOT_LOADED);

        }

        $this->setOptions($options);

    }

    /**

     * Destructor.

     *

     * @return void

     */

    public function __destruct()

    {

        $this->disconnect();

    }

    /**

     * @return resource The raw LDAP extension resource.

     */

    public function getResource()

    {

        if (!is_resource($this->_resource) || $this->_boundUser === false) {

            $this->bind();

        }

        return $this->_resource;

    }

    /**

     * Return the LDAP error number of the last LDAP command

     *

     * @return int

     */

    public function getLastErrorCode()

    {

        $ret = @ldap_get_option($this->_resource, LDAP_OPT_ERROR_NUMBER, $err);

        if ($ret === true) {

            if ($err <= -1 && $err >= -17) {

                /**

                 * @see Zend_Ldap_Exception

                 */

                require_once 'Zend/Ldap/Exception.php';

                /* For some reason draft-ietf-ldapext-ldap-c-api-xx.txt error

                 * codes in OpenLDAP are negative values from -1 to -17.

                 */

                $err = Zend_Ldap_Exception::LDAP_SERVER_DOWN + (-$err - 1);

            }

            return $err;

        }

        return 0;

    }

    /**

     * Return the LDAP error message of the last LDAP command

     *

     * @param  int   $errorCode

     * @param  array $errorMessages

     * @return string

     */

    public function getLastError(&$errorCode = null, array &$errorMessages = null)

    {

        $errorCode = $this->getLastErrorCode();

        $errorMessages = array();

        /* The various error retrieval functions can return

         * different things so we just try to collect what we

         * can and eliminate dupes.

         */

        $estr1 = @ldap_error($this->_resource);

        if ($errorCode !== 0 && $estr1 === 'Success') {

            $estr1 = @ldap_err2str($errorCode);

        }

        if (!empty($estr1)) {

            $errorMessages[] = $estr1;

        }

        @ldap_get_option($this->_resource, LDAP_OPT_ERROR_STRING, $estr2);

        if (!empty($estr2) && !in_array($estr2, $errorMessages)) {

            $errorMessages[] = $estr2;

        }

        $message = '';

        if ($errorCode > 0) {

            $message = '0x' . dechex($errorCode) . ' ';

        } else {

            $message = '';

        }

        if (count($errorMessages) > 0) {

            $message .= '(' . implode('; ', $errorMessages) . ')';

        } else {

            $message .= '(no error message from LDAP)';

        }

        return $message;

    }

    /**

     * Get the currently bound user

     *

     * FALSE if no user is bound to the LDAP resource

     * NULL if there has been an anonymous bind

     * username of the currently bound user

     *

     * @return false|null|string

     */

    public function getBoundUser()

    {

        return $this->_boundUser;

    }

    /**

     * Sets the options used in connecting, binding, etc.

     *

     * Valid option keys:

     *  host

     *  port

     *  useSsl

     *  username

     *  password

     *  bindRequiresDn

     *  baseDn

     *  accountCanonicalForm

     *  accountDomainName

     *  accountDomainNameShort

     *  accountFilterFormat

     *  allowEmptyPassword

     *  useStartTls

     *  optRefferals

     *  tryUsernameSplit

     *

     * @param  array|Zend_Config $options Options used in connecting, binding, etc.

     * @return Zend_Ldap Provides a fluent interface

     * @throws Zend_Ldap_Exception

     */

    public function setOptions($options)

    {

        if ($options instanceof Zend_Config) {

            $options = $options->toArray();

        }

        $permittedOptions = array(

            'host'                   => null,

            'port'                   => 0,

            'useSsl'                 => false,

            'username'               => null,

            'password'               => null,

            'bindRequiresDn'         => false,

            'baseDn'                 => null,

            'accountCanonicalForm'   => null,

            'accountDomainName'      => null,

            'accountDomainNameShort' => null,

            'accountFilterFormat'    => null,

            'allowEmptyPassword'     => false,

            'useStartTls'            => false,

            'optReferrals'           => false,

            'tryUsernameSplit'       => true,

        );

        foreach ($permittedOptions as $key => $val) {

            if (array_key_exists($key, $options)) {

                $val = $options[$key];

                unset($options[$key]);

                /* Enforce typing. This eliminates issues like Zend_Config_Ini

                 * returning '1' as a string (ZF-3163).

                 */

                switch ($key) {

                    case 'port':

                    case 'accountCanonicalForm':

                        $permittedOptions[$key] = (int)$val;

                        break;

                    case 'useSsl':

                    case 'bindRequiresDn':

                    case 'allowEmptyPassword':

                    case 'useStartTls':

                    case 'optReferrals':

                    case 'tryUsernameSplit':

                        $permittedOptions[$key] = ($val === true ||

                                $val === '1' || strcasecmp($val, 'true') == 0);

                        break;

                    default:

                        $permittedOptions[$key] = trim($val);

                        break;

                }

            }

        }

        if (count($options) > 0) {

            $key = key($options);

            /**

             * @see Zend_Ldap_Exception

             */

            require_once 'Zend/Ldap/Exception.php';

            throw new Zend_Ldap_Exception(null, "Unknown Zend_Ldap option: $key");

        }

        $this->_options = $permittedOptions;

        return $this;

    }

    /**

     * @return array The current options.

     */

    public function getOptions()

    {

        return $this->_options;

    }

    /**

     * @return string The hostname of the LDAP server being used to authenticate accounts

     */

    protected function _getHost()

    {

        return $this->_options['host'];

    }

    /**

     * @return int The port of the LDAP server or 0 to indicate that no port value is set

     */

    protected function _getPort()

    {

        return $this->_options['port'];

    }

    /**

     * @return boolean The default SSL / TLS encrypted transport control

     */

    protected function _getUseSsl()

    {

        return $this->_options['useSsl'];

    }

    /**

     * @return string The default acctname for binding

     */

    protected function _getUsername()

    {

        return $this->_options['username'];

    }

    /**

     * @return string The default password for binding

     */

    protected function _getPassword()

    {

        return $this->_options['password'];

    }

    /**

     * @return boolean Bind requires DN

     */

    protected function _getBindRequiresDn()

    {

        return $this->_options['bindRequiresDn'];

    }

    /**

     * Gets the base DN under which objects of interest are located

     *

     * @return string

     */

    public function getBaseDn()

    {

        return $this->_options['baseDn'];

    }

    /**

     * @return integer Either ACCTNAME_FORM_BACKSLASH, ACCTNAME_FORM_PRINCIPAL or

     * ACCTNAME_FORM_USERNAME indicating the form usernames should be canonicalized to.

     */

    protected function _getAccountCanonicalForm()

    {

        /* Account names should always be qualified with a domain. In some scenarios

         * using non-qualified account names can lead to security vulnerabilities. If

         * no account canonical form is specified, we guess based in what domain

         * names have been supplied.

         */

        $accountCanonicalForm = $this->_options['accountCanonicalForm'];

        if (!$accountCanonicalForm) {

            $accountDomainName = $this->_getAccountDomainName();

            $accountDomainNameShort = $this->_getAccountDomainNameShort();

            if ($accountDomainNameShort) {

                $accountCanonicalForm = Zend_Ldap::ACCTNAME_FORM_BACKSLASH;

            } else if ($accountDomainName) {

                $accountCanonicalForm = Zend_Ldap::ACCTNAME_FORM_PRINCIPAL;

            } else {

                $accountCanonicalForm = Zend_Ldap::ACCTNAME_FORM_USERNAME;

            }

        }

        return $accountCanonicalForm;

    }

    /**

     * @return string The account domain name

     */

    protected function _getAccountDomainName()

    {

        return $this->_options['accountDomainName'];

    }

    /**

     * @return string The short account domain name

     */

    protected function _getAccountDomainNameShort()

    {

        return $this->_options['accountDomainNameShort'];

    }

    /**

     * @return string A format string for building an LDAP search filter to match

     * an account

     */

    protected function _getAccountFilterFormat()

    {

        return $this->_options['accountFilterFormat'];

    }

    /**

     * @return boolean Allow empty passwords

     */

    protected function _getAllowEmptyPassword()

    {

        return $this->_options['allowEmptyPassword'];

    }

    /**

     * @return boolean The default SSL / TLS encrypted transport control

     */

    protected function _getUseStartTls()