Bind more than one domain via ldap and php - php

Question

Currently I have a project that authenticates via ldap to modify contact attribute, but only in a single domain, I'm trying to add an implementation so I can identify which domain the user wants to authenticate after informing on a form, example:
domain\user.
Here's how my code treats only one domain.
index.php
<?php
set_time_limit(30);
error_reporting(E_ALL);
ini_set('error_reporting', E_ALL);
ini_set('display_errors', 1);
/*
* Function Find user: Procura o usuario no LDAP
*/
$ldap_server = "iphost";
$ldap_binddn = "CN=LDAP Change Info,CN=Users,DC=DOMAIN,DC=com,DC=br";
$ldap_bindpw = "passwordhere";
$ldap_search_dn = "DC=domain,DC=com,DC=br";
function erro($mensagem, $goto_page = "") {
if ($mensagem == "") {
$_SESSION['last_error'] = "";
return;
}else{
$_SESSION['last_error'] = $mensagem;
}
if ($goto_page == "") {
$goto_page = "error.php";
}
include("_include/$goto_page");
die();
}
function modify_user_attribute($userdn, $attributes) {
global $ldap_server;
global $ldap_binddn;
global $ldap_bindpw;
global $ldap_search_dn;
/*
*
* Conexão no servidor LDAP.
*/
#TODO: Fazer conectar em outro servidor caso o primeiro de erro.
$ldap = ldap_connect($ldap_server) or die("LDAP Server connect error.");
ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
$ret = false;
if ($ldap) {
$ldapbind = ldap_bind($ldap, $ldap_binddn, $ldap_bindpw);
if ($ldapbind) {
$ret = ldap_modify($ldap, $userdn, $attributes);
ldap_close($ldap);
}
}
return $ret;
}
function check_value($value, $name) {
if ($value == null) {
erro("Atributo $name não pode ser nulo", "modify.php");
}
if ($value == "") {
erro("Atributo $name não pode ser vazio", "modify.php");
}
if (strlen($value) > 20) {
erro("Atributo $name não pode conter mais do que 20 caracteres.", "modify.php");
}
}
function find_and_auth_user($login, $senha) {
global $ldap_server;
global $ldap_binddn;
global $ldap_bindpw;
global $ldap_search_dn;
$ldap_user_to_find = "";
$ldap_user_pass = "";
$ldap_user_dn = "";
/*
*
* Conexão no servidor LDAP.
*/
#TODO: Fazer conectar em outro servidor caso o primeiro de erro.
$ldap = ldap_connect($ldap_server) or die("LDAP Server connect error.");
ldap_set_option($ldap, LDAP_OPT_REFERRALS, 0);
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
if (!$ldap) {
//Redirecionar o usuário para uma tela de erro de sistema.
}
# Find
$ldapbind = ldap_bind($ldap, $ldap_binddn, $ldap_bindpw);
if ($ldapbind) {
$ldap_search_filter = "(sAMAccountName=$login)";
$result = ldap_search($ldap, $ldap_search_dn, $ldap_search_filter) or erro("Erro de sistema");
$data = ldap_get_entries($ldap, $result);
if ($data["count"] == 1) {
$ldap_user_dn = $data[0]["dn"];
# print "Encontrado usuário: " . $ldap_user_dn . "\n";
$ldapbind2 = ldap_bind($ldap, $ldap_user_dn, $senha);
if ($ldapbind2) {
$result = ldap_search($ldap, $ldap_user_dn, $ldap_search_filter) or erro("Erro de sistema");
$data = ldap_get_entries($ldap, $result);
/*
* Salva na sessão os dados encontrados.
*/
$_SESSION['dn'] = $ldap_user_dn;
$_SESSION['telephonenumber'] = $data[0]["telephonenumber"][0];
$_SESSION['ipphone'] = $data[0]["ipphone"][0];
$_SESSION['last_error'] = "";
return true;
}else{
#Redireciona o usuário para página de erro de login e senha.
erro("Usuário ou senha incorreta.", "login.php");
}
}else{
erro("Usuário ou senha incorreta.", "login.php");
}
}
ldap_close($ldap);
}
#
#
# SINGLE PAGE APP
#
#
#
if (session_id() == "") {
session_start();
//GET = Formulario de LOGIN
if ($_SERVER['REQUEST_METHOD'] == 'GET') {
$_SESSION['last_error'] = "";
include("_include/login.php");
return;
}
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
//POST do formulario de LOGIN
if (isset($_POST['username']) && isset($_POST['password'])) {
if (find_and_auth_user($_POST['username'], $_POST['password'])){
include("_include/modify.php");
}
return;
}
//POST do formulario de CHANGE
if (isset($_GET['change']) && $_GET['change'] == "true") {
$values["telephonenumber"][0] = $_POST['telephonenumber'];
$values["ipphone"][0] = $_POST['ipphone'];
check_value($values["telephonenumber"][0], "Telefone");
check_value($values["ipphone"][0], "Ramal");
if ($_SESSION['dn'] == null) {
erro("Erro de sistema. DN nula.", "login.php");
}
if ($_SESSION['dn'] == "") {
erro("Erro de sistema. DN nula.", "login.php");
}
if (modify_user_attribute($_SESSION['dn'], $values)) {
include("_include/success.php");
return;
}else{
erro("Erro alterando atributos.", "modify.php");
}
}
}
}else{
include("_include/modify.php");
return;
}
?>
Here's how I'm thinking of using it to authenticate to more than one domain:
teste.php
<?php
$username = $_POST['username'];
$arr = explode("\\", $login);
echo "Dominio = " .strtoupper($arr[0]) ."\n";
echo "Login = $arr[1]\n";
$conf = array();
$conf["DOMAIN1"]["LDAP_SERVER"] = "iphost";
$conf["DOMAIN1"]["BIND_DN"] = "CN=LDAP Change Info,CN=Users,DC=domain1,DC=com,DC=br";
$conf["DOMAIN1"]["BIND_PWD"] = "passwordhere";
$conf["DOMAIN1"]["SEARCH_DN"] = "DC=domain1,DC=com,DC=br";
$conf["DOMAIN2"]["LDAP_SERVER"] = "iphost";
$conf["DOMAIN2"]["BIND_DN"] = "CN=LDAP Change Info,CN=Users,DC=domain2,DC=com,DC=br";
$conf["DOMAIN2"]["BIND_PWD"] = "passwordhere";
$conf["DOMAIN2"]["SEARCH_DN"] = "DC=domain2,DC=com,DC=br";
$conf["DOMAIN3"]["LDAP_SERVER"] = "iphost";
$conf["DOMAIN3"]["BIND_DN"] = "CN=LDAP Change Info,CN=Users,DC=domain3,DC=com,DC=br";
$conf["DOMAIN3"]["BIND_PWD"] = "passwordhere";
$conf["DOMAIN3"]["SEARCH_DN"] = "DC=domain3,DC=com,DC=br";
#var_dump($conf);
$dominio = strtoupper($arr[0]);
if ( empty($conf[$dominio]["LDAP_SERVER"])) {
die("Domain $dominio not found\n");
}
//echo "auth domain " .$conf[$dominio]["LDAP_SERVER"] ."\n";
I would like to know how it would be possible to join the raciocio line to be able to log in to other domains.
I want to openly publish this code, it can help a lot of people.