Add option 'modPassPlain' to send plaintext password updates to LDAP …

…server
dokuwiki · Jun 28, 2022 · ceac443 · ceac443
1 parent 40bf970
commit ceac443
Show file tree

Hide file tree

Showing 4 changed files with 9 additions and 2 deletions.
diff --git a/lib/plugins/authldap/auth.php b/lib/plugins/authldap/auth.php
@@ -360,8 +360,12 @@ public function modifyUser($user, $changes)
         }
 
         // Generate the salted hashed password for LDAP
-        $phash = new \dokuwiki\PassHash();
-        $hash = $phash->hash_ssha($changes['pass']);
+        if ($this->getConf('modPassPlain')) {
+          $hash = $changes['pass'];
+        } else {
+          $phash = new \dokuwiki\PassHash();
+          $hash = $phash->hash_ssha($changes['pass']);
+        }
 
         // change the password
         if (!@ldap_mod_replace($this->con, $dn, array('userpassword' => $hash))) {

diff --git a/lib/plugins/authldap/conf/default.php b/lib/plugins/authldap/conf/default.php
@@ -20,4 +20,5 @@
 $conf['groupkey']   = 'cn';
 $conf['debug']      = 0;
 $conf['modPass']    = 1;
+$conf['modPassPlain'] = 0;
 $conf['attributes'] = array();
diff --git a/lib/plugins/authldap/conf/metadata.php b/lib/plugins/authldap/conf/metadata.php
@@ -20,3 +20,4 @@
 $meta['groupkey']    = array('string','_caution' => 'danger');
 $meta['debug']       = array('onoff','_caution' => 'security');
 $meta['modPass']     = array('onoff');
+$meta['modPassPlain']= array('onoff','_caution' => 'security');
diff --git a/lib/plugins/authldap/lang/en/settings.php b/lib/plugins/authldap/lang/en/settings.php
@@ -17,6 +17,7 @@
 $lang['userkey']     = 'Attribute denoting the username; must be consistent to userfilter.';
 $lang['groupkey']    = 'Group membership from any user attribute (instead of standard AD groups) e.g. group from department or telephone number';
 $lang['modPass']     = 'Can the LDAP password be changed via dokuwiki?';
+$lang['modPassPlain']= 'Send password updates in plain text to the LDAP server (rather than salt and hash them with the configured algorithm before transmission)?';
 $lang['debug']       = 'Display additional debug information on errors';