LotusGuild/tinker_tickets
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge development into main: LDAP avatar lookups now use LDAPS (#95)

Browse Source 
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117oBw2jN4kALYeS8HPq4zV
This commit is contained in:
jared
2026-09-12 00:59:21 -04:00
co-authored by Claude Sonnet 5
parent b73a4c792c 863f84f37e
commit cdccaa66c6
3 changed files with 24 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+7 -3
View File
@@ -74,10 +74,14 @@ TRUSTED_PROXIES=
; Timezone (default: America/New_York) ; Timezone (default: America/New_York)
TIMEZONE=America/New_York TIMEZONE=America/New_York
; LDAP / lldap (for user avatar lookups) ; LDAP / lldap (for user avatar lookups). Connects over LDAPS — 6360 is
; lldap's default LDAPS port, NOT its plaintext port (3890), since
; LDAP_BIND_PW below would otherwise go over the wire unencrypted.
; LDAP_HOST must be a hostname matching the LDAPS cert (TLS hostname
; verification is not skipped), not a bare IP.
LDAP_ENABLED=true LDAP_ENABLED=true
LDAP_HOST=10.10.10.39 LDAP_HOST=ldap.lotusguild.org
LDAP_PORT=3890 LDAP_PORT=6360
LDAP_BIND_DN="uid=tinker-tickets,ou=people,dc=example,dc=com" LDAP_BIND_DN="uid=tinker-tickets,ou=people,dc=example,dc=com"
LDAP_BIND_PW= LDAP_BIND_PW=
LDAP_BASE_DN="dc=example,dc=com" LDAP_BASE_DN="dc=example,dc=com"
api/user_avatar.php
+4 -1
View File
@@ -113,7 +113,10 @@ $avatarData = null;
$ldapQueryOk = false; // true only if the LDAP lookup completed without error $ldapQueryOk = false; // true only if the LDAP lookup completed without error
try { try {
$ldap = @ldap_connect("ldap://$ldapHost:$ldapPort"); // LDAPS, not plain ldap:// — LDAP_BIND_PW is sent during ldap_bind() below,
// and lldap's plaintext port (3890) would put it on the wire unencrypted.
// lldap's LDAPS listener defaults to port 6360 (see config.php).
$ldap = @ldap_connect("ldaps://$ldapHost:$ldapPort");
if (!$ldap) { if (!$ldap) {
throw new RuntimeException("ldap_connect failed"); throw new RuntimeException("ldap_connect failed");
} }
config/config.php
+13 -3
View File
@@ -154,9 +154,19 @@ $GLOBALS['config'] = [
'TIMEZONE' => $envVars['TIMEZONE'] ?? 'America/New_York', 'TIMEZONE' => $envVars['TIMEZONE'] ?? 'America/New_York',
'TIMEZONE_OFFSET' => null, // Will be calculated below 'TIMEZONE_OFFSET' => null, // Will be calculated below
// LDAP / lldap settings (for user avatar lookups) // LDAP / lldap settings (for user avatar lookups). Connects over LDAPS
'LDAP_HOST' => $envVars['LDAP_HOST'] ?? '10.10.10.39', // (see api/user_avatar.php) — lldap's default LDAPS port is 6360, not
'LDAP_PORT' => (int)($envVars['LDAP_PORT'] ?? 3890), // its plaintext port 3890. The bind password must never go over the
// wire unencrypted, so this is not configurable back to a plaintext
// ldap:// connection.
//
// LDAP_HOST must be a hostname matching the LDAPS cert's *.lotusguild.org
// CN/SAN, not a bare IP — PHP's ldap extension verifies the cert's
// hostname by default and a mismatch fails the connection. Pi-hole has a
// split-horizon override so ldap.lotusguild.org resolves internally to
// the real LDAP server IP (its public DNS record points elsewhere).
'LDAP_HOST' => $envVars['LDAP_HOST'] ?? 'ldap.lotusguild.org',
'LDAP_PORT' => (int)($envVars['LDAP_PORT'] ?? 6360),
'LDAP_BIND_DN' => $envVars['LDAP_BIND_DN'] ?? 'uid=tinker-tickets,ou=people,dc=example,dc=com', 'LDAP_BIND_DN' => $envVars['LDAP_BIND_DN'] ?? 'uid=tinker-tickets,ou=people,dc=example,dc=com',
'LDAP_BIND_PW' => $envVars['LDAP_BIND_PW'] ?? '', 'LDAP_BIND_PW' => $envVars['LDAP_BIND_PW'] ?? '',
'LDAP_BASE_DN' => $envVars['LDAP_BASE_DN'] ?? 'dc=example,dc=com', 'LDAP_BASE_DN' => $envVars['LDAP_BASE_DN'] ?? 'dc=example,dc=com',