/auth/ldap/auth.php

<?php



/**

 * @author Martin Dougiamas

 * @license http://www.gnu.org/copyleft/gpl.html GNU Public License

 * @package moodle multiauth

 *

 * Authentication Plugin: LDAP Authentication

 *

 * Authentication using LDAP (Lightweight Directory Access Protocol).

 *

 * 2006-08-28  File created.

 */



if (!defined('MOODLE_INTERNAL')) {

    die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page

}



// See http://support.microsoft.com/kb/305144 to interprete these values.

if (!defined('AUTH_AD_ACCOUNTDISABLE')) {

    define('AUTH_AD_ACCOUNTDISABLE', 0x0002);

}

if (!defined('AUTH_AD_NORMAL_ACCOUNT')) {

    define('AUTH_AD_NORMAL_ACCOUNT', 0x0200);

}

if (!defined('AUTH_NTLMTIMEOUT')) {  // timewindow for the NTLM SSO process, in secs...

    define('AUTH_NTLMTIMEOUT', 10);

}





require_once($CFG->libdir.'/authlib.php');



/**

 * LDAP authentication plugin.

 */

class auth_plugin_ldap extends auth_plugin_base {



    /**

     * Constructor with initialisation.

     */

    function auth_plugin_ldap() {

        $this->authtype = 'ldap';

        $this->config = get_config('auth/ldap');

        if (empty($this->config->ldapencoding)) {

            $this->config->ldapencoding = 'utf-8';

        }

        if (empty($this->config->user_type)) {

            $this->config->user_type = 'default';

        }



        $default = $this->ldap_getdefaults();



        //use defaults if values not given

        foreach ($default as $key => $value) {

            // watch out - 0, false are correct values too

            if (!isset($this->config->{$key}) or $this->config->{$key} == '') {

                $this->config->{$key} = $value[$this->config->user_type];

            }

        }



        // Hack prefix to objectclass

        if (empty($this->config->objectclass)) {

            // Can't send empty filter

            $this->config->objectclass='(objectClass=*)';

        } else if (stripos($this->config->objectclass, 'objectClass=') === 0) {

            // Value is 'objectClass=some-string-here', so just add ()

            // around the value (filter _must_ have them).

            $this->config->objectclass = '('.$this->config->objectclass.')';

        } else if (stripos($this->config->objectclass, '(') !== 0) {

            // Value is 'some-string-not-starting-with-left-parentheses',

            // which is assumed to be the objectClass matching value.

            // So build a valid filter with it.

            $this->config->objectclass = '(objectClass='.$this->config->objectclass.')';

        } else {

            // There is an additional possible value

            // '(some-string-here)', that can be used to specify any

            // valid filter string, to select subsets of users based

            // on any criteria. For example, we could select the users

            // whose objectClass is 'user' and have the

            // 'enabledMoodleUser' attribute, with something like:

            //

            //   (&(objectClass=user)(enabledMoodleUser=1))

            //

            // This is only used in the functions that deal with the

            // whole potential set of users (currently sync_users()

            // and get_user_list() only).

            //

            // In this particular case we don't need to do anything,

            // so leave $this->config->objectclass as is.

        }



    }



    /**

     * Returns true if the username and password work and false if they are

     * wrong or don't exist.

     *

     * @param string $username The username (with system magic quotes)

     * @param string $password The password (with system magic quotes)

     *

     * @return bool Authentication success or failure.

     */

    function user_login($username, $password) {

        if (! function_exists('ldap_bind')) {

            print_error('auth_ldapnotinstalled','auth');

            return false;

        }



        if (!$username or !$password) {    // Don't allow blank usernames or passwords

            return false;

        }



        $textlib = textlib_get_instance();

        $extusername = $textlib->convert(stripslashes($username), 'utf-8', $this->config->ldapencoding);

        $extpassword = $textlib->convert(stripslashes($password), 'utf-8', $this->config->ldapencoding);



        //

        // Before we connect to LDAP, check if this is an AD SSO login

        // if we succeed in this block, we'll return success early.

        //

        $key = sesskey();

        if (!empty($this->config->ntlmsso_enabled) && $key === $password) {

            $cf = get_cache_flags('auth/ldap/ntlmsess');

            // We only get the cache flag if we retrieve it before

            // it expires (AUTH_NTLMTIMEOUT seconds).

            if (!isset($cf[$key]) || $cf[$key] === '') {

                return false;

            }



            $sessusername = $cf[$key];

            if ($username === $sessusername) {

                unset($sessusername);

                unset($cf);



                // Check that the user is inside one of the configured LDAP contexts

                $validuser = false;

                $ldapconnection = $this->ldap_connect();

                if ($ldapconnection) {

                    // if the user is not inside the configured contexts,

                    // ldap_find_userdn returns false.

                    if ($this->ldap_find_userdn($ldapconnection, $extusername)) {

                        $validuser = true;

                    }

                    $this->ldap_close();

                }



                // Shortcut here - SSO confirmed

                return $validuser;

            }

        } // End SSO processing

        unset($key);



        $ldapconnection = $this->ldap_connect();

        if ($ldapconnection) {

            $ldap_user_dn = $this->ldap_find_userdn($ldapconnection, $extusername);



            //if ldap_user_dn is empty, user does not exist

            if (!$ldap_user_dn) {

                $this->ldap_close();

                return false;

            }



            // Try to bind with current username and password

            $ldap_login = @ldap_bind($ldapconnection, $ldap_user_dn, $extpassword);

            $this->ldap_close();

            if ($ldap_login) {

                return true;

            }

        }

        else {

            $this->ldap_close();

            print_error('auth_ldap_noconnect','auth','',$this->config->host_url);

        }

        return false;

    }



    /**

     * reads userinformation from ldap and return it in array()

     *

     * Read user information from external database and returns it as array().

     * Function should return all information available. If you are saving

     * this information to moodle user-table you should honor syncronization flags

     *

     * @param string $username username (with system magic quotes)

     *

     * @return mixed array with no magic quotes or false on error

     */

    function get_userinfo($username) {

        $textlib = textlib_get_instance();

        $extusername = $textlib->convert(stripslashes($username), 'utf-8', $this->config->ldapencoding);



        $ldapconnection = $this->ldap_connect();

        $attrmap = $this->ldap_attributes();



        $result = array();

        $search_attribs = array();



        foreach ($attrmap as $key=>$values) {

            if (!is_array($values)) {

                $values = array($values);

            }

            foreach ($values as $value) {

                if (!in_array($value, $search_attribs)) {

                    array_push($search_attribs, $value);

                }

            }

        }



        $user_dn = $this->ldap_find_userdn($ldapconnection, $extusername);



        if (!$user_info_result = ldap_read($ldapconnection, $user_dn, $this->config->objectclass, $search_attribs)) {

            return false; // error!

        }

        $user_entry = $this->ldap_get_entries($ldapconnection, $user_info_result);

        if (empty($user_entry)) {

            return false; // entry not found

        }



        foreach ($attrmap as $key=>$values) {

            if (!is_array($values)) {

                $values = array($values);

            }

            $ldapval = NULL;

            foreach ($values as $value) {

                if ((moodle_strtolower($value) == 'dn') || (moodle_strtolower($value) == 'distinguishedname')) {

                    $result[$key] = $user_dn;

                }

                if (!array_key_exists($value, $user_entry[0])) {

                    continue; // wrong data mapping!

                }

                if (is_array($user_entry[0][$value])) {

                    $newval = $textlib->convert($user_entry[0][$value][0], $this->config->ldapencoding, 'utf-8');

                } else {

                    $newval = $textlib->convert($user_entry[0][$value], $this->config->ldapencoding, 'utf-8');

                }

                if (!empty($newval)) { // favour ldap entries that are set

                    $ldapval = $newval;

                }

            }

            if (!is_null($ldapval)) {

                $result[$key] = $ldapval;

            }

        }



        $this->ldap_close();

        return $result;

    }



    /**

     * reads userinformation from ldap and return it in an object

     *

     * @param string $username username (with system magic quotes)

     * @return mixed object or false on error

     */

    function get_userinfo_asobj($username) {

        $user_array = $this->get_userinfo($username);

        if ($user_array == false) {

            return false; //error or not found

        }

        $user_array = truncate_userinfo($user_array);

        $user = new object();

        foreach ($user_array as $key=>$value) {

            $user->{$key} = $value;

        }

        return $user;

    }



    /**

     * returns all usernames from external database

     *

     * get_userlist returns all usernames from external database

     *

     * @return array

     */

    function get_userlist() {

        return $this->ldap_get_userlist("({$this->config->user_attribute}=*)");

    }



    /**

     * checks if user exists on external db

     *

     * @param string $username (with system magic quotes)

     */

    function user_exists($username) {



        $textlib = textlib_get_instance();

        $extusername = $textlib->convert(stripslashes($username), 'utf-8', $this->config->ldapencoding);



        //returns true if given username exist on ldap

        $users = $this->ldap_get_userlist("({$this->config->user_attribute}=".$this->filter_addslashes($extusername).")");

        return count($users);

    }



    /**

     * Creates a new user on external database.

     * By using information in userobject

     * Use user_exists to prevent dublicate usernames

     *

     * @param mixed $userobject  Moodle userobject  (with system magic quotes)

     * @param mixed $plainpass   Plaintext password (with system magic quotes)

     */

    function user_create($userobject, $plainpass) {

        $textlib = textlib_get_instance();

        $extusername = $textlib->convert(stripslashes($userobject->username), 'utf-8', $this->config->ldapencoding);

        $extpassword = $textlib->convert(stripslashes($plainpass), 'utf-8', $this->config->ldapencoding);



        switch ($this->config->passtype) {

            case 'md5':

                $extpassword = '{MD5}' . base64_encode(pack('H*', md5($extpassword)));

                break;

            case 'sha1':

                $extpassword = '{SHA}' . base64_encode(pack('H*', sha1($extpassword)));

                break;

            case 'plaintext':

            default:

                break; // plaintext

        }



        $ldapconnection = $this->ldap_connect();

        $attrmap = $this->ldap_attributes();



        $newuser = array();



        foreach ($attrmap as $key => $values) {

            if (!is_array($values)) {

                $values = array($values);

            }

            foreach ($values as $value) {

                if (!empty($userobject->$key) ) {

                    $newuser[$value] = $textlib->convert(stripslashes($userobject->$key), 'utf-8', $this->config->ldapencoding);

                }

            }

        }



        //Following sets all mandatory and other forced attribute values

        //User should be creted as login disabled untill email confirmation is processed

        //Feel free to add your user type and send patches to paca@sci.fi to add them

        //Moodle distribution



        switch ($this->config->user_type)  {

            case 'edir':

                $newuser['objectClass']   = array("inetOrgPerson","organizationalPerson","person","top");

                $newuser['uniqueId']      = $extusername;

                $newuser['logindisabled'] = "TRUE";

                $newuser['userpassword']  = $extpassword;

                $uadd = ldap_add($ldapconnection, $this->config->user_attribute.'="'.$this->ldap_addslashes($userobject->username).','.$this->config->create_context.'"', $newuser);

                break;

            case 'ad':

                // User account creation is a two step process with AD. First you

                // create the user object, then you set the password. If you try

                // to set the password while creating the user, the operation

                // fails.



                // Passwords in Active Directory must be encoded as Unicode

                // strings (UCS-2 Little Endian format) and surrounded with

                // double quotes. See http://support.microsoft.com/?kbid=269190

                if (!function_exists('mb_convert_encoding')) {

                    print_error ('auth_ldap_no_mbstring', 'auth');

                }



                // First create the user account, and mark it as disabled.

                $newuser['objectClass'] = array('top','person','user','organizationalPerson');

                $newuser['sAMAccountName'] = $extusername;

                $newuser['userAccountControl'] = AUTH_AD_NORMAL_ACCOUNT |

                                                 AUTH_AD_ACCOUNTDISABLE;

                $userdn = 'cn=' .  $this->ldap_addslashes($extusername) .

                          ',' . $this->config->create_context;

                if (!ldap_add($ldapconnection, $userdn, $newuser)) {

                    print_error ('auth_ldap_ad_create_req', 'auth');

                }



                // Now set the password

                unset($newuser);

                $newuser['unicodePwd'] = mb_convert_encoding('"' . $extpassword . '"',

                                                             "UCS-2LE", "UTF-8");

                if(!ldap_modify($ldapconnection, $userdn, $newuser)) {

                    // Something went wrong: delete the user account and error out

                    ldap_delete ($ldapconnection, $userdn);

                    print_error ('auth_ldap_ad_create_req', 'auth');

                }

                $uadd = true;

                break;

            default:

               print_error('auth_ldap_unsupportedusertype','auth','',$this->config->user_type);

        }

        $this->ldap_close();

        return $uadd;



    }



    function can_reset_password() {

        return !empty($this->config->stdchangepassword);

    }



    function can_signup() {

        return (!empty($this->config->auth_user_create) and !empty($this->config->create_context));

    }



    /**

     * Sign up a new user ready for confirmation.

     * Password is passed in plaintext.

     *

     * @param object $user new user object (with system magic quotes)

     * @param boolean $notify print notice with link and terminate

     */

    function user_signup($user, $notify=true) {

        global $CFG;

        require_once($CFG->dirroot.'/user/profile/lib.php');

        

        if ($this->user_exists($user->username)) {

            print_error('auth_ldap_user_exists', 'auth');

        }



        $plainslashedpassword = $user->password;

        unset($user->password);



        if (! $this->user_create($user, $plainslashedpassword)) {

            print_error('auth_ldap_create_error', 'auth');

        }



        if (! ($user->id = insert_record('user', $user)) ) {

            print_error('auth_emailnoinsert', 'auth');

        }



        /// Save any custom profile field information

        profile_save_data($user);



        $this->update_user_record($user->username);

        update_internal_user_password($user, $plainslashedpassword);



        $user = get_record('user', 'id', $user->id);

        events_trigger('user_created', $user);



        if (! send_confirmation_email($user)) {

            print_error('auth_emailnoemail', 'auth');

        }



        if ($notify) {

            global $CFG;

            $emailconfirm = get_string('emailconfirm');

            $navlinks = array();

            $navlinks[] = array('name' => $emailconfirm, 'link' => null, 'type' => 'misc');

            $navigation = build_navigation($navlinks);



            print_header($emailconfirm, $emailconfirm, $navigation);

            notice(get_string('emailconfirmsent', '', $user->email), "$CFG->wwwroot/index.php");

        } else {

            return true;

        }

    }



    /**

     * Returns true if plugin allows confirming of new users.

     *

     * @return bool

     */

    function can_confirm() {

        return $this->can_signup();

    }



    /**

     * Confirm the new user as registered.

     *

     * @param string $username (with system magic quotes)

     * @param string $confirmsecret (with system magic quotes)

     */

    function user_confirm($username, $confirmsecret) {

        $user = get_complete_user_data('username', $username);



        if (!empty($user)) {

            if ($user->confirmed) {

                return AUTH_CONFIRM_ALREADY;



            } else if ($user->auth != 'ldap') {

                return AUTH_CONFIRM_ERROR;



            } else if ($user->secret == stripslashes($confirmsecret)) {   // They have provided the secret key to get in

                if (!$this->user_activate($username)) {

                    return AUTH_CONFIRM_FAIL;

                }

                if (!set_field("user", "confirmed", 1, "id", $user->id)) {

                    return AUTH_CONFIRM_FAIL;

                }

                if (!set_field("user", "firstaccess", time(), "id", $user->id)) {

                    return AUTH_CONFIRM_FAIL;

                }

                return AUTH_CONFIRM_OK;

            }

        } else {

            return AUTH_CONFIRM_ERROR;

        }

    }



    /**

     * return number of days to user password expires

     *

     * If userpassword does not expire it should return 0. If password is already expired

     * it should return negative value.

     *

     * @param mixed $username username (with system magic quotes)

     * @return integer

     */

    function password_expire($username) {

        $result = 0;



        $textlib = textlib_get_instance();

        $extusername = $textlib->convert(stripslashes($username), 'utf-8', $this->config->ldapencoding);



        $ldapconnection = $this->ldap_connect();

        $user_dn = $this->ldap_find_userdn($ldapconnection, $extusername);

        $search_attribs = array($this->config->expireattr);

        $sr = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs);

        if ($sr)  {

            $info = $this->ldap_get_entries($ldapconnection, $sr);

            if (!empty ($info) and !empty($info[0][$this->config->expireattr][0])) {

                $expiretime = $this->ldap_expirationtime2unix($info[0][$this->config->expireattr][0], $ldapconnection, $user_dn);

                if ($expiretime != 0) {

                    $now = time();

                    if ($expiretime > $now) {

                        $result = ceil(($expiretime - $now) / DAYSECS);

                    }

                    else {

                        $result = floor(($expiretime - $now) / DAYSECS);

                    }

                }

            }

        } else {

            error_log("ldap: password_expire did't find expiration time.");

        }



        //error_log("ldap: password_expire user $user_dn expires in $result days!");

        return $result;

    }



    /**

     * syncronizes user fron external db to moodle user table

     *

     * Sync is now using username attribute.

     *

     * Syncing users removes or suspends users that dont exists anymore in external db.

     * Creates new users and updates coursecreator status of users.

     *

     * @param int $bulk_insert_records will insert $bulkinsert_records per insert statement

     *                         valid only with $unsafe. increase to a couple thousand for

     *                         blinding fast inserts -- but test it: you may hit mysqld's

     *                         max_allowed_packet limit.

     * @param bool $do_updates will do pull in data updates from ldap if relevant

     */

    function sync_users ($bulk_insert_records = 1000, $do_updates = true) {



        global $CFG;



        $textlib = textlib_get_instance();



        $droptablesql = array(); /// sql commands to drop the table (because session scope could be a problem for

                                 /// some persistent drivers like ODBTP (mssql) or if this function is invoked

                                 /// from within a PHP application using persistent connections

        $temptable = $CFG->prefix . 'extuser';

        $createtemptablesql = '';



        // configure a temp table

        print "Configuring temp table\n";

        switch (strtolower($CFG->dbfamily)) {

            case 'mysql':

                $droptablesql[] = 'DROP TEMPORARY TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)

                $createtemptablesql = 'CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) ENGINE=MyISAM';

                break;

            case 'postgres':

                $droptablesql[] = 'DROP TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)

                $bulk_insert_records = 1; // no support for multiple sets of values

                $createtemptablesql = 'CREATE TEMPORARY TABLE '. $temptable . ' (username VARCHAR(64), PRIMARY KEY (username))';

                break;

            case 'mssql':

                $temptable = '#'. $temptable; /// MSSQL temp tables begin with #

                $droptablesql[] = 'DROP TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)

                $bulk_insert_records = 1; // no support for multiple sets of values

                $createtemptablesql = 'CREATE TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username))';

                break;

            case 'oracle':

                $droptablesql[] = 'TRUNCATE TABLE ' . $temptable; // oracle requires truncate before being able to drop a temp table

                $droptablesql[] = 'DROP TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)

                $bulk_insert_records = 1; // no support for multiple sets of values

                $createtemptablesql = 'CREATE GLOBAL TEMPORARY TABLE '.$temptable.' (username VARCHAR(64), PRIMARY KEY (username)) ON COMMIT PRESERVE ROWS';

                break;

        }





        execute_sql_arr($droptablesql, true, false); /// Drop temp table to avoid persistence problems later

        echo "Creating temp table $temptable\n";

        if(! execute_sql($createtemptablesql, false) ){

            print  "Failed to create temporary users table - aborting\n";

            exit;

        }



        print "Connecting to ldap...\n";

        $ldapconnection = $this->ldap_connect();



        if (!$ldapconnection) {

            $this->ldap_close();

            print get_string('auth_ldap_noconnect','auth',$this->config->host_url);

            exit;

        }



        ////

        //// get user's list from ldap to sql in a scalable fashion

        ////

        // prepare some data we'll need

        $filter = '(&('.$this->config->user_attribute.'=*)'.$this->config->objectclass.')';



        $contexts = explode(";",$this->config->contexts);



        if (!empty($this->config->create_context)) {

              array_push($contexts, $this->config->create_context);

        }



        $fresult = array();

        foreach ($contexts as $context) {

            $context = trim($context);

            if (empty($context)) {

                continue;

            }

            begin_sql();

            if ($this->config->search_sub) {

                //use ldap_search to find first user from subtree

                $ldap_result = ldap_search($ldapconnection, $context,

                                           $filter,

                                           array($this->config->user_attribute));

            } else {

                //search only in this context

                $ldap_result = ldap_list($ldapconnection, $context,

                                         $filter,

                                         array($this->config->user_attribute));

            }



            if ($entry = ldap_first_entry($ldapconnection, $ldap_result)) {

                do {

                    $value = ldap_get_values_len($ldapconnection, $entry, $this->config->user_attribute);

                    $value = $textlib->convert($value[0], $this->config->ldapencoding, 'utf-8');

                    // usernames are __always__ lowercase.

                    array_push($fresult, moodle_strtolower($value));

                    if (count($fresult) >= $bulk_insert_records) {

                        $this->ldap_bulk_insert($fresult, $temptable);

                        $fresult = array();

                    }

                } while ($entry = ldap_next_entry($ldapconnection, $entry));

            }

            unset($ldap_result); // free mem



            // insert any remaining users and release mem

            if (count($fresult)) {

                $this->ldap_bulk_insert($fresult, $temptable);

                $fresult = array();

            }

            commit_sql();

        }



        /// preserve our user database

        /// if the temp table is empty, it probably means that something went wrong, exit

        /// so as to avoid mass deletion of users; which is hard to undo

        $count = get_record_sql('SELECT COUNT(username) AS count, 1 FROM ' . $temptable);

        $count = $count->{'count'};

        if ($count < 1) {

            print "Did not get any users from LDAP -- error? -- exiting\n";

            exit;

        } else {

            print "Got $count records from LDAP\n\n";

        }





/// User removal

        // find users in DB that aren't in ldap -- to be removed!

        // this is still not as scalable (but how often do we mass delete?)

        if (!empty($this->config->removeuser)) {

            $sql = "SELECT u.id, u.username, u.email, u.auth 

                    FROM {$CFG->prefix}user u

                        LEFT JOIN $temptable e ON u.username = e.username

                    WHERE u.auth='ldap'

                        AND u.deleted=0

                        AND e.username IS NULL";

            $remove_users = get_records_sql($sql);



            if (!empty($remove_users)) {

                print "User entries to remove: ". count($remove_users) . "\n";



                foreach ($remove_users as $user) {

                    if ($this->config->removeuser == 2) {

                        if (delete_user($user)) {

                            echo "\t"; print_string('auth_dbdeleteuser', 'auth', array($user->username, $user->id)); echo "\n";

                        } else {

                            echo "\t"; print_string('auth_dbdeleteusererror', 'auth', $user->username); echo "\n";

                        }

                    } else if ($this->config->removeuser == 1) {

                        $updateuser = new object();

                        $updateuser->id = $user->id;

                        $updateuser->auth = 'nologin';

                        if (update_record('user', $updateuser)) {

                            echo "\t"; print_string('auth_dbsuspenduser', 'auth', array($user->username, $user->id)); echo "\n";

                        } else {

                            echo "\t"; print_string('auth_dbsuspendusererror', 'auth', $user->username); echo "\n";

                        }

                    }

                }

            } else {

                print "No user entries to be removed\n";

            }

            unset($remove_users); // free mem!

        }



/// Revive suspended users

        if (!empty($this->config->removeuser) and $this->config->removeuser == 1) {

            $sql = "SELECT u.id, u.username

                    FROM $temptable e, {$CFG->prefix}user u

                    WHERE e.username=u.username

                        AND u.auth='nologin'";

            $revive_users = get_records_sql($sql);



            if (!empty($revive_users)) {

                print "User entries to be revived: ". count($revive_users) . "\n";



                begin_sql();

                foreach ($revive_users as $user) {

                    $updateuser = new object();

                    $updateuser->id = $user->id;

                    $updateuser->auth = 'ldap';

                    if (update_record('user', $updateuser)) {

                        echo "\t"; print_string('auth_dbreviveduser', 'auth', array($user->username, $user->id)); echo "\n";

                    } else {

                        echo "\t"; print_string('auth_dbrevivedusererror', 'auth', $user->username); echo "\n";

                    }

                }

                commit_sql();

            } else {

                print "No user entries to be revived\n";

            }



            unset($revive_users);

        }





/// User Updates - time-consuming (optional)

        if ($do_updates) {

            // narrow down what fields we need to update

            $all_keys = array_keys(get_object_vars($this->config));

            $updatekeys = array();

            foreach ($all_keys as $key) {

                if (preg_match('/^field_updatelocal_(.+)$/',$key, $match)) {

                    // if we have a field to update it from

                    // and it must be updated 'onlogin' we

                    // update it on cron

                    if ( !empty($this->config->{'field_map_'.$match[1]})

                         and $this->config->{$match[0]} === 'onlogin') {

                        array_push($updatekeys, $match[1]); // the actual key name

                    }

                }

            }

            // print_r($all_keys); print_r($updatekeys);

            unset($all_keys); unset($key);



        } else {

            print "No updates to be done\n";

        }

        if ( $do_updates and !empty($updatekeys) ) { // run updates only if relevant

            $users = get_records_sql("SELECT u.username, u.id

                                      FROM {$CFG->prefix}user u

                                      WHERE u.deleted=0 AND u.auth='ldap'");

            if (!empty($users)) {

                print "User entries to update: ". count($users). "\n";



                $sitecontext = get_context_instance(CONTEXT_SYSTEM);

                if (!empty($this->config->creators) and !empty($this->config->memberattribute)

                  and $roles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) {

                    $creatorrole = array_shift($roles);      // We can only use one, let's use the first one

                } else {

                    $creatorrole = false;

                }



                begin_sql();

                $xcount = 0;

                $maxxcount = 100;



                foreach ($users as $user) {

                    echo "\t"; print_string('auth_dbupdatinguser', 'auth', array($user->username, $user->id));

                    if (!$this->update_user_record(addslashes($user->username), $updatekeys)) {

                        echo " - ".get_string('skipped');

                    }

                    echo "\n";

                    $xcount++;



                    // update course creators if needed

                    if ($creatorrole !== false) {

                        if ($this->iscreator($user->username)) {

                            role_assign($creatorrole->id, $user->id, 0, $sitecontext->id, 0, 0, 0, 'ldap');

                        } else {

                            role_unassign($creatorrole->id, $user->id, 0, $sitecontext->id, 'ldap');

                        }

                    }



                    if ($xcount++ > $maxxcount) {

                        commit_sql();

                        begin_sql();

                        $xcount = 0;

                    }

                }

                commit_sql();

                unset($users); // free mem

            }

        } else { // end do updates

            print "No updates to be done\n";

        }



/// User Additions

        // find users missing in DB that are in LDAP

        // note that get_records_sql wants at least 2 fields returned,

        // and gives me a nifty object I don't want.

        // note: we do not care about deleted accounts anymore, this feature was replaced by suspending to nologin auth plugin

        $sql = "SELECT e.username, e.username

                FROM $temptable e LEFT JOIN {$CFG->prefix}user u ON e.username = u.username

                WHERE u.id IS NULL";

        $add_users = get_records_sql($sql); // get rid of the fat



        if (!empty($add_users)) {

            print "User entries to add: ". count($add_users). "\n";



            $sitecontext = get_context_instance(CONTEXT_SYSTEM);

            if (!empty($this->config->creators) and !empty($this->config->memberattribute)

              and $roles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) {

                $creatorrole = array_shift($roles);      // We can only use one, let's use the first one

            } else {

                $creatorrole = false;

            }



            begin_sql();

            foreach ($add_users as $user) {

                $user = $this->get_userinfo_asobj(addslashes($user->username));



                // prep a few params

                $user->modified   = time();

                $user->confirmed  = 1;

                $user->auth       = 'ldap';

                $user->mnethostid = $CFG->mnet_localhost_id;

                // get_userinfo_asobj() might have replaced $user->username with the value

                // from the LDAP server (which can be mixed-case). Make sure it's lowercase

                $user->username = trim(moodle_strtolower($user->username));

                if (empty($user->lang)) {

                    $user->lang = $CFG->lang;

                }



                $user = addslashes_recursive($user);



                if ($id = insert_record('user',$user)) {

                    echo "\t"; print_string('auth_dbinsertuser', 'auth', array(stripslashes($user->username), $id)); echo "\n";

                    $userobj = $this->update_user_record($user->username);

                    if (!empty($this->config->forcechangepassword)) {

                        set_user_preference('auth_forcepasswordchange', 1, $userobj->id);

                    }



                    // add course creators if needed

                    if ($creatorrole !== false and $this->iscreator(stripslashes($user->username))) {

                        role_assign($creatorrole->id, $id, 0, $sitecontext->id, 0, 0, 0, 'ldap');

                    }

                } else {

                    echo "\t"; print_string('auth_dbinsertusererror', 'auth', $user->username); echo "\n";

                }



            }

            commit_sql();

            unset($add_users); // free mem

        } else {

            print "No users to be added\n";

        }

        $this->ldap_close();

        return true;

    }



    /**

     * Update a local user record from an external source.

     * This is a lighter version of the one in moodlelib -- won't do

     * expensive ops such as enrolment.

     *

     * If you don't pass $updatekeys, there is a performance hit and

     * values removed from LDAP won't be removed from moodle.

     *

     * @param string $username username (with system magic quotes)

     */

    function update_user_record($username, $updatekeys = false) {

        global $CFG;



        //just in case check text case

        $username = trim(moodle_strtolower($username));



        // get the current user record

        $user = get_record('user', 'username', $username, 'mnethostid', $CFG->mnet_localhost_id);

        if (empty($user)) { // trouble

            error_log("Cannot update non-existent user: ".stripslashes($username));

            print_error('auth_dbusernotexist','auth','',$username);

            die;

        }



        // Protect the userid from being overwritten

        $userid = $user->id;



        if ($newinfo = $this->get_userinfo($username)) {

            $newinfo = truncate_userinfo($newinfo);



            if (empty($updatekeys)) { // all keys? this does not support removing values

                $updatekeys = array_keys($newinfo);

            }



            foreach ($updatekeys as $key) {

                if (isset($newinfo[$key])) {

                    $value = $newinfo[$key];

                } else {

                    $value = '';

                }



                if (!empty($this->config->{'field_updatelocal_' . $key})) {

                    if ($user->{$key} != $value) { // only update if it's changed

                        set_field('user', $key, addslashes($value), 'id', $userid);

                    }

                }

            }

        } else {

            return false;

        }

        return get_record_select('user', "id = $userid AND deleted = 0");

    }



    /**

     * Bulk insert in SQL's temp table

     * @param array $users is an array of usernames

     */

    function ldap_bulk_insert($users, $temptable) {



        // bulk insert -- superfast with $bulk_insert_records

        $sql = 'INSERT INTO ' . $temptable . ' (username) VALUES ';

        // make those values safe

        $users = addslashes_recursive($users);

        // join and quote the whole lot

        $sql = $sql . "('" . implode("'),('", $users) . "')";

        print "\t+ " . count($users) . " users\n";

        execute_sql($sql, false);

    }





    /**

     * Activates (enables) user in external db so user can login to external db

     *

     * @param mixed $username    username (with system magic quotes)

     * @return boolen result

     */

    function user_activate($username) {

        $textlib = textlib_get_instance();

        $extusername = $textlib->convert(stripslashes($username), 'utf-8', $this->config->ldapencoding);



        $ldapconnection = $this->ldap_connect();



        $userdn = $this->ldap_find_userdn($ldapconnection, $extusername);

        switch ($this->config->user_type)  {

            case 'edir':

                $newinfo['loginDisabled']="FALSE";

                break;

            case 'ad':

                // We need to unset the ACCOUNTDISABLE bit in the

                // userAccountControl attribute ( see

                // http://support.microsoft.com/kb/305144 )

                $sr = ldap_read($ldapconnection, $userdn, '(objectClass=*)',

                                array('userAccountControl'));

                $info = ldap_get_entries($ldapconnection, $sr);

                $newinfo['userAccountControl'] = $info[0]['userAccountControl'][0]

                                                 & (~AUTH_AD_ACCOUNTDISABLE);

                break;

            default:

                error ('auth: ldap user_activate() does not support selected usertype:"'.$this->config->user_type.'" (..yet)');

        }

        $result = ldap_modify($ldapconnection, $userdn, $newinfo);

        $this->ldap_close();

        return $result;

    }



    /**

     * Disables user in external db so user can't login to external db

     *

     * @param mixed $username    username

     * @return boolean result

     */

/*    function user_disable($username) {

        $textlib = textlib_get_instance();

        $extusername = $textlib->convert(stripslashes($username), 'utf-8', $this->config->ldapencoding);



        $ldapconnection = $this->ldap_connect();



        $userdn = $this->ldap_find_userdn($ldapconnection, $extusername);

        switch ($this->config->user_type)  {

            case 'edir':

                $newinfo['loginDisabled']="TRUE";

                break;

            case 'ad':

                // We need to set the ACCOUNTDISABLE bit in the

                // userAccountControl attribute ( see

                // http://support.microsoft.com/kb/305144 )

                $sr = ldap_read($ldapconnection, $userdn, '(objectClass=*)',

                                array('userAccountControl'));

                $info = auth_ldap_get_entries($ldapconnection, $sr);

                $newinfo['userAccountControl'] = $info[0]['userAccountControl'][0]

                                                 | AUTH_AD_ACCOUNTDISABLE;

                break;

            default:

                error ('auth: ldap user_disable() does not support selected usertype (..yet)');

        }

        $result = ldap_modify($ldapconnection, $userdn, $newinfo);

        $this->ldap_close();

        return $result;

    }*/



    /**

     * Returns true if user should be coursecreator.

     *

     * @param mixed $username    username (without system magic quotes)

     * @return boolean result

     */

    function iscreator($username) {

        if (empty($this->config->creators) or empty($this->config->memberattribute)) {

            return null;

        }



        $textlib = textlib_get_instance();

        $extusername = $textlib->convert($username, 'utf-8', $this->config->ldapencoding);



        return (boolean)$this->ldap_isgroupmember($extusername, $this->config->creators);

    }



    /**

     * Called when the user record is updated.

     * Modifies user in external database. It takes olduser (before changes) and newuser (after changes)

     * conpares information saved modified information to external db.

     *

     * @param mixed $olduser     Userobject before modifications    (without system magic quotes)

     * @param mixed $newuser     Userobject new modified userobject (without system magic quotes)

     * @return boolean result

     *

     */

    function user_update($olduser, $newuser) {



        global $USER;



        if (isset($olduser->username) and isset($newuser->username) and $olduser->username != $newuser->username) {

            error_log("ERROR:User renaming not allowed in LDAP");

            return false;

        }



        if (isset($olduser->auth) and $olduser->auth != 'ldap') {

            return true; // just change auth and skip update

        }



        $attrmap = $this->ldap_attributes();



        // Before doing anything else, make sure really need to update anything

        // in the external LDAP server.

        $update_external = false;

        foreach ($attrmap as $key => $ldapkeys) {

            if (!empty($this->config->{'field_updateremote_'.$key})) {

                $update_external = true;

                break;

            }

        }

        if (!$update_external) {

            return true;

        }



        $textlib = textlib_get_instance();

        $extoldusername = $textlib->convert($olduser->username, 'utf-8', $this->config->ldapencoding);



        $ldapconnection = $this->ldap_connect();



        $search_attribs = array();



        foreach ($attrmap as $key => $values) {

            if (!is_array($values)) {

                $values = array($values);

            }

            foreach ($values as $value) {

                if (!in_array($value, $search_attribs)) {

                    array_push($search_attribs, $value);

                }

            }

        }



        $user_dn = $this->ldap_find_userdn($ldapconnection, $extoldusername);



        $user_info_result = ldap_read($ldapconnection, $user_dn,

                                $this->config->objectclass, $search_attribs);



        if ($user_info_result) {



            $user_entry = $this->ldap_get_entries($ldapconnection, $user_info_result);

            if (empty($user_entry)) {

                $error = 'ldap: Could not find user while updating externally. '.

                         'Details follow: search base: \''.$user_dn.'\'; search filter: \''.

                         $this->config->objectclass.'\'; search attributes: ';

                foreach ($search_attribs as $attrib) {

                    $error .= $attrib.' ';

                }

                error_log($error);

                return false; // old user not found!

            } else if (count($user_entry) > 1) {

                error_log('ldap: Strange! More than one user record found in ldap. Only using the first one.');

                return false;

            }

            $user_entry = $user_entry[0];



            //error_log(var_export($user_entry) . 'fpp' );



            foreach ($attrmap as $key => $ldapkeys) {

                // only process if the moodle field ($key) has changed and we

                // are set to update LDAP with it

                if (isset($olduser->$key) and isset($newuser->$key)

                  and $olduser->$key !== $newuser->$key

                  and !empty($this->config->{'field_updateremote_'. $key})) {

                    // for ldap values that could be in more than one

                    // ldap key, we will do our best to match

                    // where they came from

                    $ambiguous = true;

                    $changed   = false;

                    if (!is_array($ldapkeys)) {

                        $ldapkeys = array($ldapkeys);

                    }

                    if (count($ldapkeys) < 2) {

                        $ambiguous = false;

                    }



                    $nuvalue = $textlib->convert($newuser->$key, 'utf-8', $this->config->ldapencoding);

                    empty($nuvalue) ? $nuvalue = array() : $nuvalue;

                    $ouvalue = $textlib->convert($olduser->$key, 'utf-8', $this->config->ldapencoding);



                    foreach ($ldapkeys as $ldapkey) {

                        $ldapkey   = $ldapkey;

                        $ldapvalue = $user_entry[$ldapkey][0];

                        if (!$ambiguous) {

                            // skip update if the values already match

                            if ($nuvalue !== $ldapvalue) {

                                //this might fail due to schema validation

                                if (@ldap_modify($ldapconnection, $user_dn, array($ldapkey => $nuvalue))) {

                                    continue;

                                } else {

                                    error_log('Error updating LDAP record. Error code: '

                                      . ldap_errno($ldapconnection) . '; Error string : '

                                      . ldap_err2str(ldap_errno($ldapconnection))

                                      . "\nKey ($key) - old moodle value: '$ouvalue' new value: '$nuvalue'");

                                    continue;

                                }

                            }

                        } else {

                            // ambiguous

                            // value empty before in Moodle (and LDAP) - use 1st ldap candidate field

                            // no need to guess

                            if ($ouvalue === '') { // value empty before - use 1st ldap candidate

                                //this might fail due to schema validation

                                if (@ldap_modify($ldapconnection, $user_dn, array($ldapkey => $nuvalue))) {

                                    $changed = true;

                                    continue;

                                } else {

                                    error_log('Error updating LDAP record. Error code: '

                                      . ldap_errno($ldapconnection) . '; Error string : '

                                      . ldap_err2str(ldap_errno($ldapconnection))

                                      . "\nKey ($key) - old moodle value: '$ouvalue' new value: '$nuvalue'");

                                    continue;

                                }

                            }



                            // we found which ldap key to update!

                            if ($ouvalue !== '' and $ouvalue === $ldapvalue ) {

                                //this might fail due to schema validation

                                if (@ldap_modify($ldapconnection, $user_dn, array($ldapkey => $nuvalue))) {

                                    $changed = true;

                                    continue;

                                } else {

                                    error_log('Error updating LDAP record. Error code: '

                                      . ldap_errno($ldapconnection) . '; Error string : '

                                      . ldap_err2str(ldap_errno($ldapconnection))

                                      . "\nKey ($key) - old moodle value: '$ouvalue' new value: '$nuvalue'");

                                    continue;

                                }

                            }

                        }

                    }



                    if ($ambiguous and !$changed) {

                        error_log("Failed to update LDAP with ambiguous field $key".

                                  "  old moodle value: '" . $ouvalue .

                                  "' new value '" . $nuvalue );

                    }

                }

            }

        } else {

            error_log("ERROR:No user found in LDAP");

            $this->ldap_close();

            return false;

        }



        $this->ldap_close();



        return true;



    }



    /**

     * changes userpassword in external db

     *

     * called when the user password is updated.

     * changes userpassword in external db

     *

     * @param  object  $user        User table object  (with system magic quotes)

     * @param  string  $newpassword Plaintext password (with system magic quotes)

     * @return boolean result

     *

     */

    function user_update_password($user, $newpassword) {

    /// called when the user password is updated -- it assumes it is called by an admin

    /// or that you've otherwise checked the user's credentials

    /// IMPORTANT: $newpassword must be cleartext, not crypted/md5'ed



        global $USER;

        $result = false;

        $username = $user->username;



        $textlib = textlib_get_instance();

        $extusername = $textlib->convert(stripslashes($username), 'utf-8', $this->config->ldapencoding);

        $extpassword = $textlib->convert(stripslashes($newpassword), 'utf-8', $this->config->ldapencoding);



        switch ($this->config->passtype) {

            case 'md5':

                $extpassword = '{MD5}' . base64_encode(pack('H*', md5($extpassword)));

                break;

            case 'sha1':

                $extpassword = '{SHA}' . base64_encode(pack('H*', sha1($extpassword)));

                break;

            case 'plaintext':

            default:

                break; // plaintext

        }



        $ldapconnection = $this->ldap_connect();



        $user_dn = $this->ldap_find_userdn($ldapconnection, $extusername);



        if (!$user_dn) {

            error_log('LDAP Error in user_update_password(). No DN for: ' . stripslashes($user->username));

            return false;

        }



        switch ($this->config->user_type) {

            case 'edir':

                //Change password

                $result = ldap_modify($ldapconnection, $user_dn, array('userPassword' => $extpassword));

                if (!$result) {

                    error_log('LDAP Error in user_update_password(). Error code: '

                              . ldap_errno($ldapconnection) . '; Error string : '

                              . ldap_err2str(ldap_errno($ldapconnection)));

                }

                //Update password expiration time, grace logins count

                $search_attribs = array($this->config->expireattr, 'passwordExpirationInterval','loginGraceLimit' );

                $sr = ldap_read($ldapconnection, $user_dn, '(objectClass=*)', $search_attribs);

                if ($sr)  {

                    $info=$this->ldap_get_entries($ldapconnection, $sr);

                    $newattrs = array();

                    if (!empty($info[0][$this->config->expireattr][0])) {

                        //Set expiration time only if passwordExpirationInterval is defined

                        if (!empty($info[0]['passwordExpirationInterval'][0])) {

                           $expirationtime = time() + $info[0]['passwordExpirationInterval'][0];

                           $ldapexpirationtime = $this->ldap_unix2expirationtime($expirationtime);

                           $newattrs['passwordExpirationTime'] = $ldapexpirationtime;

                        }



                        //set gracelogin count

                        if (!empty($info[0]['loginGraceLimit'][0])) {

                           $newattrs['loginGraceRemaining']= $info[0]['loginGraceLimit'][0];

                        }



                        //Store attribute changes to ldap

                        $result = ldap_modify($ldapconnection, $user_dn, $newattrs);

                        if (!$result) {

                           error_log('LDAP Error in user_update_password() when modifying expirationtime and/or gracelogins. Error code: '

                                     . ldap_errno($ldapconnection) . '; Error string : '

                                     . ldap_err2str(ldap_errno($ldapconnection)));

                        }

                    }

                }

                else {

                    error_log('LDAP Error in user_update_password() when reading password expiration time. Error code: '

                              . ldap_errno($ldapconnection) . '; Error string : '

                              . ldap_err2str(ldap_errno($ldapconnection)));

                }

                break;



            case 'ad':

                // Passwords in Active Directory must be encoded as Unicode

                // strings (UCS-2 Little Endian format) and surrounded with

                // double quotes. See http://support.microsoft.com/?kbid=269190

                if (!function_exists('mb_convert_encoding')) {

                    error_log ('You need the mbstring extension to change passwords in Active Directory');

                    return false;

                }

                $extpassword = mb_convert_encoding('"'.$extpassword.'"', "UCS-2LE", $this->config->ldapencoding);

                $result = ldap_modify($ldapconnection, $user_dn, array('unicodePwd' => $extpassword));

                if (!$result) {

                    error_log('LDAP Error in user_update_password(). Error code: '

                              . ldap_errno($ldapconnection) . '; Error string : '

                              . ldap_err2str(ldap_errno($ldapconnection)));

                }

                break;



            default:

                $usedconnection = &$ldapconnection;

                // send ldap the password in cleartext, it will md5 it itself

                $result = ldap_modify($ldapconnection, $user_dn, array('userPassword' => $extpassword));

                if (!$result) {

                    error_log('LDAP Error in user_update_password(). Error code: '

                        . ldap_errno($ldapconnection) . '; Error string : '

                        . ldap_err2str(ldap_errno($ldapconnection)));

                }



        }



        $this->ldap_close();

        return $result;

    }



    //PRIVATE FUNCTIONS starts

    //private functions are named as ldap_*



    /**

     * returns predefined usertypes

     *

     * @return array of predefined usertypes

     */

    function ldap_suppported_usertypes() {

        $types = array();

        $types['edir']='Novell Edirectory';

        $types['rfc2307']='posixAccount (rfc2307)';

        $types['rfc2307bis']='posixAccount (rfc2307bis)';

        $types['samba']='sambaSamAccount (v.3.0.7)';

        $types['ad']='MS ActiveDirectory';

        $types['default']=get_string('default');

        return $types;

    }





    /**

     * Initializes needed variables for ldap-module

     *

     * Uses names defined in ldap_supported_usertypes.

     * $default is first defined as:

     * $default['pseudoname'] = array(

     *                      'typename1' => 'value',

     *                      'typename2' => 'value'

     *                      ....

     *                      );

     *

     * @return array of default values

     */

    function ldap_getdefaults() {

        $default['objectclass'] = array(

                            'edir' => 'User',

                            'rfc2307' => 'posixAccount',

                            'rfc2307bis' => 'posixAccount',

                            'samba' => 'sambaSamAccount',

                            'ad' => 'user',

                            'default' => '*'

                            );

        $default['user_attribute'] = array(

                            'edir' => 'cn',

                            'rfc2307' => 'uid',

                            'rfc2307bis' => 'uid',

                            'samba' => 'uid',

                            'ad' => 'cn',

                            'default' => 'cn'

                            );

        $default['memberattribute'] = array(

                            'edir' => 'member',

                            'rfc2307' => 'member',

                            'rfc2307bis' => 'member',

                            'samba' => 'member',

                            'ad' => 'member',

                            'default' => 'member'

                            );

        $default['memberattribute_isdn'] = array(

                            'edir' => '1',

                            'rfc2307' => '0',

                            'rfc2307bis' => '1',

                            'samba' => '0', //is this right?

                            'ad' => '1',

                            'default' => '0'

                            );

        $default['expireattr'] = array (

                            'edir' => 'passwordExpirationTime',

                            'rfc2307' => 'shadowExpire',

                            'rfc2307bis' => 'shadowExpire',

                            'samba' => '', //No support yet

                            'ad' => 'pwdLastSet',

                            'default' => ''

                            );

        return $default;

    }



    /**

     * return binaryfields of selected usertype

     *

     *

     * @return array

     */

    function ldap_getbinaryfields () {

        $binaryfields = array (

                            'edir' => array('guid'),

                            'rfc2307' => array(),

                            'rfc2307bis' => array(),

                            'samba' => array(),

                            'ad' => array(),

                            'default' => array()

                            );

        if (!empty($this->config->user_type)) {

            return $binaryfields[$this->config->user_type];

        }

        else {

            return $binaryfields['default'];

        }

    }



    function ldap_isbinary ($field) {

        if (empty($field)) {

            return false;

        }

        return array_search($field, $this->ldap_getbinaryfields());

    }



    /**

     * take expirationtime and return it as unixseconds

     *

     * takes expriration timestamp as readed from ldap

     * returns it as unix seconds

     * depends on $this->config->user_type variable

     *

     * @param mixed time   Time stamp readed from ldap as it is.

     * @param string $ldapconnection Just needed for Active Directory.

     * @param string $user_dn User distinguished name for the user we are checking password expiration (just needed for Active Directory).

     * @return timestamp

     */

    function ldap_expirationtime2unix ($time, $ldapconnection, $user_dn) {

        $result = false;

        switch ($this->config->user_type) {

            case 'edir':

                $yr=substr($time,0,4);

                $mo=substr($time,4,2);

                $dt=substr($time,6,2);

                $hr=substr($time,8,2);

                $min=substr($time,10,2);

                $sec=substr($time,12,2);

                $result = mktime($hr,$min,$sec,$mo,$dt,$yr);

                break;

            case 'rfc2307':

            case 'rfc2307bis':

                $result = $time * DAYSECS; //The shadowExpire contains the number of DAYS between 01/01/1970 and the actual expiration date

                break;

            case 'ad':

                $result = $this->ldap_get_ad_pwdexpire($time, $ldapconnection, $user_dn);

                break;

            default:

                print_error('auth_ldap_usertypeundefined', 'auth');

        }

        return $result;

    }



    /**

     * takes unixtime and return it formated for storing in ldap

     *

     * @param integer unix time stamp

     */

    function ldap_unix2expirationtime($time) {

        $result = false;

        switch ($this->config->user_type) {

            case 'edir':

                $result=date('YmdHis', $time).'Z';

                break;

            case 'rfc2307':

            case 'rfc2307bis':

                $result = $time ; //Already in correct format

                break;

            default:

                print_error('auth_ldap_usertypeundefined2', 'auth');

        }

        return $result;



    }



    /**

     * checks if user belong to specific group(s)

     * or is in a subtree.

     *

     * Returns true if user belongs group in grupdns string OR

     * if the DN of the user is in a subtree pf the DN provided

     * as "group"

     *

     * @param mixed $username    username

     * @param mixed $groupdns    string of group dn separated by ;

     *

     */

    function ldap_isgroupmember($extusername='', $groupdns='') {

    // Takes username and groupdn(s) , separated by ;

    // Returns true if user is member of any given groups



        $ldapconnection = $this->ldap_connect();



        if (empty($extusername) or empty($groupdns)) {

            return false;

            }



        if ($this->config->memberattribute_isdn) {

            $memberuser = $this->ldap_find_userdn($ldapconnection, $extusername);

        } else {

            $memberuser = $extusername;

        }



        if (empty($memberuser)) {

            return false;

        }



        $groups = explode(";",$groupdns);



        $result = false;

        foreach ($groups as $group) {

            $group = trim($group);

            if (empty($group)) {

                continue;

            }



            // check cheaply if the user's DN sits in a subtree

            // of the "group" DN provided. Granted, this isn't

            // a proper LDAP group, but it's a popular usage.

            if (strpos(strrev(strtolower($memberuser)), strrev(strtolower($group)))===0) {

                $result = true;

                break;

            }



            //echo "Checking group $group for member $username\n";

            $search = ldap_read($ldapconnection, $group,  '('.$this->config->memberattribute.'='.$this->filter_addslashes($memberuser).')', array($this->config->memberattribute));

            if (!empty($search) and ldap_count_entries($ldapconnection, $search)) {

                $info = $this->ldap_get_entries($ldapconnection, $search);



                if (count($info) > 0 ) {

                    // user is member of group

                    $result = true;

                    break;

                }

          }

        }



        return $result;



    }



    /**

     * connects to ldap server

     *

     * Tries connect to specified ldap servers.

     * Returns connection result or error.

     *

     * @return connection result

     */

    function ldap_connect($binddn='',$bindpwd='') {

        // Cache ldap connections (they are expensive to set up

        // and can drain the TCP/IP ressources on the server if we 

        // are syncing a lot of users (as we try to open a new connection

        // to get the user details). This is the least invasive way

        // to reuse existing connections without greater code surgery.

        if(!empty($this->ldapconnection)) {

            $this->ldapconns++;

            return $this->ldapconnection;

        }



        //Select bind password, With empty values use

        //ldap_bind_* variables or anonymous bind if ldap_bind_* are empty

        if ($binddn == '' and $bindpwd == '') {

            if (!empty($this->config->bind_dn)) {

               $binddn = $this->config->bind_dn;

            }

            if (!empty($this->config->bind_pw)) {

               $bindpwd = $this->config->bind_pw;

            }

        }



        $urls = explode(";",$this->config->host_url);



        foreach ($urls as $server) {

            $server = trim($server);

            if (empty($server)) {

                continue;

            }



            $connresult = ldap_connect($server);

            //ldap_connect returns ALWAYS true



            if (!empty($this->config->version)) {

                ldap_set_option($connresult, LDAP_OPT_PROTOCOL_VERSION, $this->config->version);

            }



            // Fix MDL-10921

            if ($this->config->user_type == 'ad') {

                 ldap_set_option($connresult, LDAP_OPT_REFERRALS, 0);

            }



            if (!empty($binddn)) {

                //bind with search-user

                //$debuginfo .= 'Using bind user'.$binddn.'and password:'.$bindpwd;

                $bindresult=ldap_bind($connresult, $binddn,$bindpwd);

            }

            else {

                //bind anonymously

                $bindresult=@ldap_bind($connresult);

            }



            if (!empty($this->config->opt_deref)) {

                ldap_set_option($connresult, LDAP_OPT_DEREF, $this->config->opt_deref);

            }



            if ($bindresult) {

		// Set the connection counter so we can call PHP's ldap_close()

		// when we call $this->ldap_close() for the last 'open' connection.

                $this->ldapconns = 1;  

                $this->ldapconnection = $connresult;

                return $connresult;

            }



            $debuginfo .= "<br/>Server: '$server' <br/> Connection: '$connresult'<br/> Bind result: '$bindresult'</br>";

        }



        //If any of servers are alive we have already returned connection

        print_error('auth_ldap_noconnect_all','auth','', $debuginfo);

        return false;

    }



    /**

     * disconnects from a ldap server

     *

     */

    function ldap_close() {

        $this->ldapconns--;

        if($this->ldapconns == 0) {

            @ldap_close($this->ldapconnection);

            unset($this->ldapconnection);

        }

    }



    /**

     * retuns dn of username

     *

     * Search specified contexts for username and return user dn

     * like: cn=username,ou=suborg,o=org

     *

     * @param mixed $ldapconnection  $ldapconnection result

     * @param mixed $username username (external encoding no slashes)

     *

     */



    function ldap_find_userdn ($ldapconnection, $extusername) {



        //default return value

        $ldap_user_dn = FALSE;



        //get all contexts and look for first matching user

        $ldap_contexts = explode(";",$this->config->contexts);



        if (!empty($this->config->create_context)) {

          array_push($ldap_contexts, $this->config->create_context);

        }



        foreach ($ldap_contexts as $context) {



            $context = trim($context);

            if (empty($context)) {

                continue;

            }



            if ($this->config->search_sub) {

                //use ldap_search to find first user from subtree

                $ldap_result = ldap_search($ldapconnection, $context, "(".$this->config->user_attribute."=".$this->filter_addslashes($extusername).")",array($this->config->user_attribute));



            }

            else {

                //search only in this context

                $ldap_result = ldap_list($ldapconnection, $context, "(".$this->config->user_attribute."=".$this->filter_addslashes($extusername).")",array($this->config->user_attribute));

            }



            $entry = ldap_first_entry($ldapconnection,$ldap_result);



            if ($entry) {

                $ldap_user_dn = ldap_get_dn($ldapconnection, $entry);

                break ;

            }

        }



        return $ldap_user_dn;

    }



    /**

     * retuns user attribute mappings between moodle and ldap

     *

     * @return array

     */



    function ldap_attributes () {

        $moodleattributes = array();

        foreach ($this->userfields as $field) {

            if (!empty($this->config->{"field_map_$field"})) {

                $moodleattributes[$field] = $this->config->{"field_map_$field"};

                if (preg_match('/,/',$moodleattributes[$field])) {

                    $moodleattributes[$field] = explode(',', $moodleattributes[$field]); // split ?

                }

            }

        }

        $moodleattributes['username'] = $this->config->user_attribute;

        return $moodleattributes;

    }



    /**

     * return all usernames from ldap

     *

     * @return array

     */



    function ldap_get_userlist($filter="*") {

    /// returns all users from ldap servers

        $fresult = array();



        $ldapconnection = $this->ldap_connect();



        if ($filter=="*") {

           $filter = '(&('.$this->config->user_attribute.'=*)'.$this->config->objectclass.')';

        }



        $contexts = explode(";",$this->config->contexts);



        if (!empty($this->config->create_context)) {

              array_push($contexts, $this->config->create_context);

        }



        foreach ($contexts as $context) {



            $context = trim($context);

            if (empty($context)) {

                continue;

            }



            if ($this->config->search_sub) {

                //use ldap_search to find first user from subtree

                $ldap_result = ldap_search($ldapconnection, $context,$filter,array($this->config->user_attribute));

            }

            else {

                //search only in this context

                $ldap_result = ldap_list($ldapconnection, $context,

                                         $filter,

                                         array($this->config->user_attribute));

            }



            $users = $this->ldap_get_entries($ldapconnection, $ldap_result);



            //add found users to list

            for ($i=0;$i<count($users);$i++) {

                array_push($fresult, ($users[$i][$this->config->user_attribute][0]) );

            }

        }



        return $fresult;

    }



    /**

     * return entries from ldap

     *

     * Returns values like ldap_get_entries but is

     * binary compatible and return all attributes as array

     *

     * @return array ldap-entries

     */



    function ldap_get_entries($conn, $searchresult) {

    //Returns values like ldap_get_entries but is

    //binary compatible

        $i=0;

        $fresult=array();

        $entry = ldap_first_entry($conn, $searchresult);

        do {

            $attributes = @ldap_get_attributes($conn, $entry);

            for ($j=0; $j<$attributes['count']; $j++) {

                $values = ldap_get_values_len($conn, $entry,$attributes[$j]);

                if (is_array($values)) {

                $fresult[$i][$attributes[$j]] = $values;

                }

                else {

                    $fresult[$i][$attributes[$j]] = array($values);

                }

            }

            $i++;

        }

        while ($entry = @ldap_next_entry($conn, $entry));

        //were done

        return ($fresult);

    }



    function prevent_local_passwords() {

        return !empty($this->config->preventpassindb);

    }



    /**

     * Returns true if this authentication plugin is 'internal'.

     *

     * @return bool

     */

    function is_internal() {

        return false;

    }



    /**

     * Returns true if this authentication plugin can change the user's

     * password.

     *

     * @return bool

     */

    function can_change_password() {

        return !empty($this->config->stdchangepassword) or !empty($this->config->changepasswordurl);

    }



    /**

     * Returns the URL for changing the user's pw, or empty if the default can

     * be used.

     *

     * @return string url

     */

    function change_password_url() {

        if (empty($this->config->stdchangepassword)) {

            return $this->config->changepasswordurl;

        } else {

            return '';

        }

    }



    /**

     * Will get called before the login page is shown, if NTLM SSO

     * is enabled, and the user is in the right network, we'll redirect

     * to the magic NTLM page for SSO...

     *

     */

    function loginpage_hook() {

        global $CFG, $SESSION;



        // HTTPS is potentially required

        httpsrequired();

 

        if (($_SERVER['REQUEST_METHOD'] === 'GET'         // Only on initial GET of loginpage

                || ($_SERVER['REQUEST_METHOD'] === 'POST'

                   && (get_referer() != strip_querystring(qualified_me()))))

                                                           // Or when POSTed from another place

                                                           // See MDL-14071

           && !empty($this->config->ntlmsso_enabled)     // SSO enabled

           && !empty($this->config->ntlmsso_subnet)      // have a subnet to test for

           && empty($_GET['authldap_skipntlmsso'])       // haven't failed it yet

           && (isguestuser() || !isloggedin())           // guestuser or not-logged-in users

            && address_in_subnet(getremoteaddr(), $this->config->ntlmsso_subnet)) {



            // First, let's remember where we were trying to get to before we got here

            if (empty($SESSION->wantsurl)) {

                $SESSION->wantsurl = (array_key_exists('HTTP_REFERER', $_SERVER) &&

                                      $_SERVER['HTTP_REFERER'] != $CFG->wwwroot &&

                                      $_SERVER['HTTP_REFERER'] != $CFG->wwwroot.'/' &&

                                      $_SERVER['HTTP_REFERER'] != $CFG->httpswwwroot.'/login/' &&

                                      $_SERVER['HTTP_REFERER'] != $CFG->httpswwwroot.'/login/index.php')

                    ? $_SERVER['HTTP_REFERER'] : NULL;

            }



            // Now start the whole NTLM machinery.

            if(!empty($this->config->ntlmsso_ie_fastpath)) {

                // Shortcut for IE browsers: skip the attempt page at all

                if(check_browser_version('MSIE')) {

                    $sesskey = sesskey();

                    redirect($CFG->wwwroot.'/auth/ldap/ntlmsso_magic.php?sesskey='.$sesskey);

                } else {

                    redirect($CFG->httpswwwroot.'/login/index.php?authldap_skipntlmsso=1');

                }

            } else {

                redirect($CFG->wwwroot.'/auth/ldap/ntlmsso_attempt.php');

            }

        }

 

        // No NTLM SSO, Use the normal login page instead.



        // If $SESSION->wantsurl is empty and we have a 'Referer:' header, the login

        // page insists on redirecting us to that page after user validation. If

        // we clicked on the redirect link at the ntlmsso_finish.php page instead

        // of waiting for the redirection to happen, then we have a 'Referer:' header

        // we don't want to use at all. As we can't get rid of it, just point

        // $SESSION->wantsurl to $CFG->wwwroot (after all, we came from there).

        if (empty($SESSION->wantsurl)

            && (get_referer() == $CFG->httpswwwroot.'/auth/ldap/ntlmsso_finish.php')) {



            $SESSION->wantsurl = $CFG->wwwroot;

        }

    }



    /**

     * To be called from a page running under NTLM's

     * "Integrated Windows Authentication". 

     *

     * If successful, it will set a special "cookie" (not an HTTP cookie!) 

     * in cache_flags under the "auth/ldap/ntlmsess" "plugin" and return true.

     * The "cookie" will be picked up by ntlmsso_finish() to complete the

     * process.

     *

     * On failure it will return false for the caller to display an appropriate

     * error message (probably saying that Integrated Windows Auth isn't enabled!)

     *

     * NOTE that this code will execute under the OS user credentials, 

     * so we MUST avoid dealing with files -- such as session files.

     * (The caller should set $nomoodlecookie before including config.php)

     *

     */

    function ntlmsso_magic($sesskey) {

        if (isset($_SERVER['REMOTE_USER']) && !empty($_SERVER['REMOTE_USER'])) {



            // HTTP __headers__ seem to be sent in ISO-8859-1 encoding

            // (according to my reading of RFC-1945, RFC-2616 and RFC-2617 and

            // my local tests), so we need to convert the REMOTE_USER value

            // (i.e., what we got from the HTTP WWW-Authenticate header) into UTF-8

            $textlib = textlib_get_instance();

            $username = $textlib->convert($_SERVER['REMOTE_USER'], 'iso-8859-1', 'utf-8');



            $username = substr(strrchr($username, '\\'), 1); //strip domain info

            $username = moodle_strtolower($username); //compatibility hack

            set_cache_flag('auth/ldap/ntlmsess', $sesskey, $username, AUTH_NTLMTIMEOUT);

            return true;

        }

        return false;

    }



    /**

     * Find the session set by ntlmsso_magic(), validate it and 

     * call authenticate_user_login() to authenticate the user through

     * the auth machinery.

     * 

     * It is complemented by a similar check in user_login().

     * 

     * If it succeeds, it never returns. 

     *

     */

    function ntlmsso_finish() {

        global $CFG, $USER, $SESSION;



        $key = sesskey();

        $cf = get_cache_flags('auth/ldap/ntlmsess');

        if (!isset($cf[$key]) || $cf[$key] === '') {

            return false;

        }

        $username   = $cf[$key];

        // Here we want to trigger the whole authentication machinery

        // to make sure no step is bypassed...

        $user = authenticate_user_login($username, $key);

        if ($user) {

            add_to_log(SITEID, 'user', 'login', "view.php?id=$USER->id&course=".SITEID,

                       $user->id, 0, $user->id);

            $USER = complete_user_login($user);



            // Cleanup the key to prevent reuse...

            // and to allow re-logins with normal credentials

            unset_cache_flag('auth/ldap/ntlmsess', $key);



            /// Redirection

            if (user_not_fully_set_up($USER)) {

                $urltogo = $CFG->wwwroot.'/user/edit.php';

                // We don't delete $SESSION->wantsurl yet, so we get there later

            } else if (isset($SESSION->wantsurl) and (strpos($SESSION->wantsurl, $CFG->wwwroot) === 0)) {

                $urltogo = $SESSION->wantsurl;    /// Because it's an address in this site

                unset($SESSION->wantsurl);

            } else {

                // no wantsurl stored or external - go to homepage

                $urltogo = $CFG->wwwroot.'/';

                unset($SESSION->wantsurl);

            }

            redirect($urltogo);

        }

        // Should never reach here.

        return false;

    }    



    /**

     * Sync roles for this user

     *

     * @param $user object user object (without system magic quotes)

     */

    function sync_roles($user) {

        $iscreator = $this->iscreator($user->username);

        if ($iscreator === null) {

            return; //nothing to sync - creators not configured

        }



        if ($roles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) {

            $creatorrole = array_shift($roles);      // We can only use one, let's use the first one

            $systemcontext = get_context_instance(CONTEXT_SYSTEM);



            if ($iscreator) { // Following calls will not create duplicates

                role_assign($creatorrole->id, $user->id, 0, $systemcontext->id, 0, 0, 0, 'ldap');

            } else {

                //unassign only if previously assigned by this plugin!

                role_unassign($creatorrole->id, $user->id, 0, $systemcontext->id, 'ldap');

            }

        }

    }



    /**

     * Prints a form for configuring this authentication plugin.

     *

     * This function is called from admin/auth.php, and outputs a full page with

     * a form for configuring this plugin.

     *

     * @param array $page An object containing all the data for this page.

     */

    function config_form($config, $err, $user_fields) {

        include 'config.html';

    }



    /**

     * Processes and stores configuration data for this authentication plugin.

     */

    function process_config($config) {

        // set to defaults if undefined

        if (!isset($config->host_url))

            { $config->host_url = ''; }

        if (empty($config->ldapencoding))

            { $config->ldapencoding = 'utf-8'; }

        if (!isset($config->contexts))

            { $config->contexts = ''; }

        if (!isset($config->user_type))

            { $config->user_type = 'default'; }

        if (!isset($config->user_attribute))

            { $config->user_attribute = ''; }

        if (!isset($config->search_sub))

            { $config->search_sub = ''; }

        if (!isset($config->opt_deref))

            { $config->opt_deref = ''; }

        if (!isset($config->preventpassindb))

            { $config->preventpassindb = 0; }

        if (!isset($config->bind_dn))

            {$config->bind_dn = ''; }

        if (!isset($config->bind_pw))

            {$config->bind_pw = ''; }

        if (!isset($config->version))

            {$config->version = '2'; }

        if (!isset($config->objectclass))

            {$config->objectclass = ''; }

        if (!isset($config->memberattribute))

            {$config->memberattribute = ''; }

        if (!isset($config->memberattribute_isdn))

            {$config->memberattribute_isdn = ''; }

        if (!isset($config->creators))

            {$config->creators = ''; }

        if (!isset($config->create_context))

            {$config->create_context = ''; }

        if (!isset($config->expiration))

            {$config->expiration = ''; }

        if (!isset($config->expiration_warning))

            {$config->expiration_warning = '10'; }

        if (!isset($config->expireattr))

            {$config->expireattr = ''; }

        if (!isset($config->gracelogins))

            {$config->gracelogins = ''; }

        if (!isset($config->graceattr))

            {$config->graceattr = ''; }

        if (!isset($config->auth_user_create))

            {$config->auth_user_create = ''; }

        if (!isset($config->forcechangepassword))

            {$config->forcechangepassword = 0; }

        if (!isset($config->stdchangepassword))

            {$config->stdchangepassword = 0; }

        if (!isset($config->passtype))

            {$config->passtype = 'plaintext'; }

        if (!isset($config->changepasswordurl))

            {$config->changepasswordurl = ''; }

        if (!isset($config->removeuser))

            {$config->removeuser = 0; }

        if (!isset($config->ntlmsso_enabled))

            {$config->ntlmsso_enabled = 0; }

        if (!isset($config->ntlmsso_subnet))

            {$config->ntlmsso_subnet = ''; }

        if (!isset($config->ntlmsso_ie_fastpath))

            {$config->ntlmsso_ie_fastpath = 0; }



        // save settings

        set_config('host_url', $config->host_url, 'auth/ldap');

        set_config('ldapencoding', $config->ldapencoding, 'auth/ldap');

        set_config('host_url', $config->host_url, 'auth/ldap');

        set_config('contexts', $config->contexts, 'auth/ldap');

        set_config('user_type', $config->user_type, 'auth/ldap');

        set_config('user_attribute', $config->user_attribute, 'auth/ldap');

        set_config('search_sub', $config->search_sub, 'auth/ldap');

        set_config('opt_deref', $config->opt_deref, 'auth/ldap');

        set_config('preventpassindb', $config->preventpassindb, 'auth/ldap');

        set_config('bind_dn', $config->bind_dn, 'auth/ldap');

        set_config('bind_pw', $config->bind_pw, 'auth/ldap');

        set_config('version', $config->version, 'auth/ldap');

        set_config('objectclass', trim($config->objectclass), 'auth/ldap');

        set_config('memberattribute', $config->memberattribute, 'auth/ldap');

        set_config('memberattribute_isdn', $config->memberattribute_isdn, 'auth/ldap');

        set_config('creators', $config->creators, 'auth/ldap');

        set_config('create_context', $config->create_context, 'auth/ldap');

        set_config('expiration', $config->expiration, 'auth/ldap');

        set_config('expiration_warning', $config->expiration_warning, 'auth/ldap');

        set_config('expireattr', $config->expireattr, 'auth/ldap');

        set_config('gracelogins', $config->gracelogins, 'auth/ldap');

        set_config('graceattr', $config->graceattr, 'auth/ldap');

        set_config('auth_user_create', $config->auth_user_create, 'auth/ldap');

        set_config('forcechangepassword', $config->forcechangepassword, 'auth/ldap');

        set_config('stdchangepassword', $config->stdchangepassword, 'auth/ldap');

        set_config('passtype', $config->passtype, 'auth/ldap');

        set_config('changepasswordurl', $config->changepasswordurl, 'auth/ldap');

        set_config('removeuser', $config->removeuser, 'auth/ldap');

        set_config('ntlmsso_enabled', (int)$config->ntlmsso_enabled, 'auth/ldap');

        set_config('ntlmsso_subnet', $config->ntlmsso_subnet, 'auth/ldap');

        set_config('ntlmsso_ie_fastpath', (int)$config->ntlmsso_ie_fastpath, 'auth/ldap');



        return true;

    }



    /**

     * Quote control characters in texts used in ldap filters - see RFC 4515/2254

     *

     * @param string

     */

    function filter_addslashes($text) {

        $text = str_replace('\\', '\\5c', $text);

        $text = str_replace(array('*',    '(',    ')',    "\0"),

                            array('\\2a', '\\28', '\\29', '\\00'), $text);

        return $text;

    }



    /**

     * The order of the special characters in these arrays _IS IMPORTANT_.

     * Make sure '\\5C' (and '\\') are the first elements of the arrays.

     * Otherwise we'll double replace '\' with '\5C' which is Bad(tm)

     */ 

    var $LDAP_DN_QUOTED_SPECIAL_CHARS = array('\\5c','\\20','\\22','\\23','\\2b','\\2c','\\3b','\\3c','\\3d','\\3e','\\00');

    var $LDAP_DN_SPECIAL_CHARS        = array('\\',  ' ',   '"',   '#',   '+',   ',',   ';',   '<',   '=',   '>',   "\0");



    /**

     * Quote control characters in distinguished names used in ldap - See RFC 4514/2253

     *

     * @param string

     * @return string

     */

    function ldap_addslashes($text) {

        $text = str_replace ($this->LDAP_DN_SPECIAL_CHARS,

                             $this->LDAP_DN_QUOTED_SPECIAL_CHARS,

                             $text);

        return $text;

    }



    /**

     * Get password expiration time for a given user from Active Directory

     *

     * @param string $pwdlastset The time last time we changed the password.

     * @param resource $lcapconn The open LDAP connection.

     * @param string $user_dn The distinguished name of the user we are checking.

     *

     * @return string $unixtime

     */

    function ldap_get_ad_pwdexpire($pwdlastset, $ldapconn, $user_dn){

        define ('ROOTDSE', '');

        // UF_DONT_EXPIRE_PASSWD value taken from MSDN directly

        define ('UF_DONT_EXPIRE_PASSWD', 0x00010000);



        global $CFG;



        if (!function_exists('bcsub')) {

            error_log ('You need the BCMath extension to use grace logins with Active Directory');

            return 0;

        }



        // If UF_DONT_EXPIRE_PASSWD flag is set in user's

        // userAccountControl attribute, the password doesn't expire.

        $sr = ldap_read($ldapconn, $user_dn, '(objectClass=*)',

                        array('userAccountControl'));

        if (!$sr) {

            error_log("ldap: error getting userAccountControl for $user_dn");

            // don't expire password, as we are not sure it has to be

            // expired or not.

            return 0;

        }



        $info = $this->ldap_get_entries($ldapconn, $sr);

        $useraccountcontrol = $info[0]['userAccountControl'][0];

        if ($useraccountcontrol & UF_DONT_EXPIRE_PASSWD) {

            // password doesn't expire.

            return 0;

        }



        // If pwdLastSet is zero, the user must change his/her password now

        // (unless UF_DONT_EXPIRE_PASSWD flag is set, but we already

        // tested this above)

        if ($pwdlastset === '0') {

            // password has expired

            return -1;

        }



        // ----------------------------------------------------------------

        // Password expiration time in Active Directory is the composition of

        // two values:

        //

        //   - User's pwdLastSet attribute, that stores the last time

        //     the password was changed.

        //

        //   - Domain's maxPwdAge attribute, that sets how long

        //     passwords last in this domain.

        //

        // We already have the first value (passed in as a parameter). We

        // need to get the second one. As we don't know the domain DN, we

        // have to query rootDSE's defaultNamingContext attribute to get

        // it. Then we have to query that DN's maxPwdAge attribute to get

        // the real value.

        //

        // Once we have both values, we just need to combine them. But MS

        // chose to use a different base and unit for time measurements.

        // So we need to convert the values to Unix timestamps (see

        // details below).

        // ----------------------------------------------------------------



        $sr = ldap_read($ldapconn, ROOTDSE, '(objectClass=*)',

                        array('defaultNamingContext'));

        if (!$sr) {

            error_log("ldap: error querying rootDSE for Active Directory");

            return 0;

        }



        $info = $this->ldap_get_entries($ldapconn, $sr);

        $domaindn = $info[0]['defaultNamingContext'][0];



        $sr = ldap_read ($ldapconn, $domaindn, '(objectClass=*)',

                         array('maxPwdAge'));

        $info = $this->ldap_get_entries($ldapconn, $sr);

        $maxpwdage = $info[0]['maxPwdAge'][0];



        // ----------------------------------------------------------------

        // MSDN says that "pwdLastSet contains the number of 100 nanosecond

        // intervals since January 1, 1601 (UTC), stored in a 64 bit integer".

        //

        // According to Perl's Date::Manip, the number of seconds between

        // this date and Unix epoch is 11644473600. So we have to

        // substract this value to calculate a Unix time, once we have

        // scaled pwdLastSet to seconds. This is the script used to

        // calculate the value shown above:

        //

        //    #!/usr/bin/perl -w

        //

        //    use Date::Manip;

        //

        //    $date1 = ParseDate ("160101010000 UTC");

        //    $date2 = ParseDate ("197001010000 UTC");

        //    $delta = DateCalc($date1, $date2, \$err);

        //    $secs = Delta_Format($delta, 0, "%st");

        //    print "$secs \n";

        //

        // MSDN also says that "maxPwdAge is stored as a large integer that

        // represents the number of 100 nanosecond intervals from the time

        // the password was set before the password expires." We also need

        // to scale this to seconds. Bear in mind that this value is stored

        // as a _negative_ quantity (at least in my AD domain).

        //

        // As a last remark, if the low 32 bits of maxPwdAge are equal to 0,

        // the maximum password age in the domain is set to 0, which means

        // passwords do not expire (see

        // http://msdn2.microsoft.com/en-us/library/ms974598.aspx)

        //

        // As the quantities involved are too big for PHP integers, we

        // need to use BCMath functions to work with arbitrary precision

        // numbers.

        // ----------------------------------------------------------------





        // If the low order 32 bits are 0, then passwords do not expire in

        // the domain. Just do '$maxpwdage mod 2^32' and check the result

        // (2^32 = 4294967296)

        if (bcmod ($maxpwdage, 4294967296) === '0') {

            return 0;

        }



        // Add up pwdLastSet and maxPwdAge to get password expiration

        // time, in MS time units. Remember maxPwdAge is stored as a

        // _negative_ quantity, so we need to substract it in fact.

        $pwdexpire = bcsub ($pwdlastset, $maxpwdage);



        // Scale the result to convert it to Unix time units and return

        // that value.

        return bcsub( bcdiv($pwdexpire, '10000000'), '11644473600');

    }



}



?>