xref: /dokuwiki/lib/plugins/authad/auth.php (revision 61da323a0e274d5247365787184af0c020a33b54)
1<?php
2use dokuwiki\Utf8\Sort;
3
4use dokuwiki\Logger;
5
6/**
7 * Active Directory authentication backend for DokuWiki
8 *
9 * This makes authentication with a Active Directory server much easier
10 * than when using the normal LDAP backend by utilizing the adLDAP library
11 *
12 * Usage:
13 *   Set DokuWiki's local.protected.php auth setting to read
14 *
15 *   $conf['authtype']       = 'authad';
16 *
17 *   $conf['plugin']['authad']['account_suffix']     = '@my.domain.org';
18 *   $conf['plugin']['authad']['base_dn']            = 'DC=my,DC=domain,DC=org';
19 *   $conf['plugin']['authad']['domain_controllers'] = 'srv1.domain.org,srv2.domain.org';
20 *
21 *   //optional:
22 *   $conf['plugin']['authad']['sso']                = 1;
23 *   $conf['plugin']['authad']['admin_username']     = 'root';
24 *   $conf['plugin']['authad']['admin_password']     = 'pass';
25 *   $conf['plugin']['authad']['real_primarygroup']  = 1;
26 *   $conf['plugin']['authad']['use_ssl']            = 1;
27 *   $conf['plugin']['authad']['use_tls']            = 1;
28 *   $conf['plugin']['authad']['debug']              = 1;
29 *   // warn user about expiring password this many days in advance:
30 *   $conf['plugin']['authad']['expirywarn']         = 5;
31 *
32 *   // get additional information to the userinfo array
33 *   // add a list of comma separated ldap contact fields.
34 *   $conf['plugin']['authad']['additional'] = 'field1,field2';
35 *
36 * @license GPL 2 (http://www.gnu.org/licenses/gpl.html)
37 * @author  James Van Lommel <jamesvl@gmail.com>
38 * @link    http://www.nosq.com/blog/2005/08/ldap-activedirectory-and-dokuwiki/
39 * @author  Andreas Gohr <andi@splitbrain.org>
40 * @author  Jan Schumann <js@schumann-it.com>
41 */
42class auth_plugin_authad extends DokuWiki_Auth_Plugin
43{
44
45    /**
46     * @var array hold connection data for a specific AD domain
47     */
48    protected $opts = array();
49
50    /**
51     * @var array open connections for each AD domain, as adLDAP objects
52     */
53    protected $adldap = array();
54
55    /**
56     * @var bool message state
57     */
58    protected $msgshown = false;
59
60    /**
61     * @var array user listing cache
62     */
63    protected $users = array();
64
65    /**
66     * @var array filter patterns for listing users
67     */
68    protected $pattern = array();
69
70    protected $grpsusers = array();
71
72    /**
73     * Constructor
74     */
75    public function __construct()
76    {
77        global $INPUT;
78        parent::__construct();
79
80        require_once(DOKU_PLUGIN.'authad/adLDAP/adLDAP.php');
81        require_once(DOKU_PLUGIN.'authad/adLDAP/classes/adLDAPUtils.php');
82
83        // we load the config early to modify it a bit here
84        $this->loadConfig();
85
86        // additional information fields
87        if (isset($this->conf['additional'])) {
88            $this->conf['additional'] = str_replace(' ', '', $this->conf['additional']);
89            $this->conf['additional'] = explode(',', $this->conf['additional']);
90        } else $this->conf['additional'] = array();
91
92        // ldap extension is needed
93        if (!function_exists('ldap_connect')) {
94            if ($this->conf['debug'])
95                msg("AD Auth: PHP LDAP extension not found.", -1);
96            $this->success = false;
97            return;
98        }
99
100        // Prepare SSO
101        if (!empty($_SERVER['REMOTE_USER'])) {
102            // make sure the right encoding is used
103            if ($this->getConf('sso_charset')) {
104                $_SERVER['REMOTE_USER'] = iconv($this->getConf('sso_charset'), 'UTF-8', $_SERVER['REMOTE_USER']);
105            } elseif (!\dokuwiki\Utf8\Clean::isUtf8($_SERVER['REMOTE_USER'])) {
106                $_SERVER['REMOTE_USER'] = utf8_encode($_SERVER['REMOTE_USER']);
107            }
108
109            // trust the incoming user
110            if ($this->conf['sso']) {
111                $_SERVER['REMOTE_USER'] = $this->cleanUser($_SERVER['REMOTE_USER']);
112
113                // we need to simulate a login
114                if (empty($_COOKIE[DOKU_COOKIE])) {
115                    $INPUT->set('u', $_SERVER['REMOTE_USER']);
116                    $INPUT->set('p', 'sso_only');
117                }
118            }
119        }
120
121        // other can do's are changed in $this->_loadServerConfig() base on domain setup
122        $this->cando['modName'] = (bool)$this->conf['update_name'];
123        $this->cando['modMail'] = (bool)$this->conf['update_mail'];
124        $this->cando['getUserCount'] = true;
125    }
126
127    /**
128     * Load domain config on capability check
129     *
130     * @param string $cap
131     * @return bool
132     */
133    public function canDo($cap)
134    {
135        //capabilities depend on config, which may change depending on domain
136        $domain = $this->getUserDomain($_SERVER['REMOTE_USER']);
137        $this->loadServerConfig($domain);
138        return parent::canDo($cap);
139    }
140
141    /**
142     * Check user+password [required auth function]
143     *
144     * Checks if the given user exists and the given
145     * plaintext password is correct by trying to bind
146     * to the LDAP server
147     *
148     * @author  James Van Lommel <james@nosq.com>
149     * @param string $user
150     * @param string $pass
151     * @return  bool
152     */
153    public function checkPass($user, $pass)
154    {
155        if ($_SERVER['REMOTE_USER'] &&
156            $_SERVER['REMOTE_USER'] == $user &&
157            $this->conf['sso']
158        ) return true;
159
160        $adldap = $this->initAdLdap($this->getUserDomain($user));
161        if (!$adldap) return false;
162
163        try {
164            return $adldap->authenticate($this->getUserName($user), $pass);
165        } catch (adLDAPException $e) {
166            // shouldn't really happen
167            return false;
168        }
169    }
170
171    /**
172     * Return user info [required auth function]
173     *
174     * Returns info about the given user needs to contain
175     * at least these fields:
176     *
177     * name    string  full name of the user
178     * mail    string  email address of the user
179     * grps    array   list of groups the user is in
180     *
181     * This AD specific function returns the following
182     * addional fields:
183     *
184     * dn         string    distinguished name (DN)
185     * uid        string    samaccountname
186     * lastpwd    int       timestamp of the date when the password was set
187     * expires    true      if the password expires
188     * expiresin  int       seconds until the password expires
189     * any fields specified in the 'additional' config option
190     *
191     * @author  James Van Lommel <james@nosq.com>
192     * @param string $user
193     * @param bool $requireGroups (optional) - ignored, groups are always supplied by this plugin
194     * @return array
195     */
196    public function getUserData($user, $requireGroups = true)
197    {
198        global $conf;
199        global $lang;
200        global $ID;
201        $adldap = $this->initAdLdap($this->getUserDomain($user));
202        if (!$adldap) return array();
203
204        if ($user == '') return array();
205
206        $fields = array('mail', 'displayname', 'samaccountname', 'lastpwd', 'pwdlastset', 'useraccountcontrol');
207
208        // add additional fields to read
209        $fields = array_merge($fields, $this->conf['additional']);
210        $fields = array_unique($fields);
211        $fields = array_filter($fields);
212
213        //get info for given user
214        $result = $adldap->user()->info($this->getUserName($user), $fields);
215        if ($result == false) {
216            return array();
217        }
218
219        //general user info
220        $info = array();
221        $info['name'] = $result[0]['displayname'][0];
222        $info['mail'] = $result[0]['mail'][0];
223        $info['uid']  = $result[0]['samaccountname'][0];
224        $info['dn']   = $result[0]['dn'];
225        //last password set (Windows counts from January 1st 1601)
226        $info['lastpwd'] = $result[0]['pwdlastset'][0] / 10000000 - 11644473600;
227        //will it expire?
228        $info['expires'] = !($result[0]['useraccountcontrol'][0] & 0x10000); //ADS_UF_DONT_EXPIRE_PASSWD
229
230        // additional information
231        foreach ($this->conf['additional'] as $field) {
232            if (isset($result[0][strtolower($field)])) {
233                $info[$field] = $result[0][strtolower($field)][0];
234            }
235        }
236
237        // handle ActiveDirectory memberOf
238        $info['grps'] = $adldap->user()->groups($this->getUserName($user), (bool) $this->opts['recursive_groups']);
239
240        if (is_array($info['grps'])) {
241            foreach ($info['grps'] as $ndx => $group) {
242                $info['grps'][$ndx] = $this->cleanGroup($group);
243            }
244        }
245
246        // always add the default group to the list of groups
247        if (!is_array($info['grps']) || !in_array($conf['defaultgroup'], $info['grps'])) {
248            $info['grps'][] = $conf['defaultgroup'];
249        }
250
251        // add the user's domain to the groups
252        $domain = $this->getUserDomain($user);
253        if ($domain && !in_array("domain-$domain", (array) $info['grps'])) {
254            $info['grps'][] = $this->cleanGroup("domain-$domain");
255        }
256
257        // check expiry time
258        if ($info['expires'] && $this->conf['expirywarn']) {
259            try {
260                $expiry = $adldap->user()->passwordExpiry($user);
261                if (is_array($expiry)) {
262                    $info['expiresat'] = $expiry['expiryts'];
263                    $info['expiresin'] = round(($info['expiresat'] - time())/(24*60*60));
264
265                    // if this is the current user, warn him (once per request only)
266                    if (($_SERVER['REMOTE_USER'] == $user) &&
267                        ($info['expiresin'] <= $this->conf['expirywarn']) &&
268                        !$this->msgshown
269                    ) {
270                        $msg = sprintf($this->getLang('authpwdexpire'), $info['expiresin']);
271                        if ($this->canDo('modPass')) {
272                            $url = wl($ID, array('do'=> 'profile'));
273                            $msg .= ' <a href="'.$url.'">'.$lang['btn_profile'].'</a>';
274                        }
275                        msg($msg);
276                        $this->msgshown = true;
277                    }
278                }
279            } catch (adLDAPException $e) {
280                // ignore. should usually not happen
281            }
282        }
283
284        return $info;
285    }
286
287    /**
288     * Make AD group names usable by DokuWiki.
289     *
290     * Removes backslashes ('\'), pound signs ('#'), and converts spaces to underscores.
291     *
292     * @author  James Van Lommel (jamesvl@gmail.com)
293     * @param string $group
294     * @return string
295     */
296    public function cleanGroup($group)
297    {
298        $group = str_replace('\\', '', $group);
299        $group = str_replace('#', '', $group);
300        $group = preg_replace('[\s]', '_', $group);
301        $group = \dokuwiki\Utf8\PhpString::strtolower(trim($group));
302        return $group;
303    }
304
305    /**
306     * Sanitize user names
307     *
308     * Normalizes domain parts, does not modify the user name itself (unlike cleanGroup)
309     *
310     * @author Andreas Gohr <gohr@cosmocode.de>
311     * @param string $user
312     * @return string
313     */
314    public function cleanUser($user)
315    {
316        $domain = '';
317
318        // get NTLM or Kerberos domain part
319        list($dom, $user) = explode('\\', $user, 2);
320        if (!$user) $user = $dom;
321        if ($dom) $domain = $dom;
322        list($user, $dom) = explode('@', $user, 2);
323        if ($dom) $domain = $dom;
324
325        // clean up both
326        $domain = \dokuwiki\Utf8\PhpString::strtolower(trim($domain));
327        $user   = \dokuwiki\Utf8\PhpString::strtolower(trim($user));
328
329        // is this a known, valid domain or do we work without account suffix? if not discard
330        if (!is_array($this->conf[$domain]) && $this->conf['account_suffix'] !== '') {
331            $domain = '';
332        }
333
334        // reattach domain
335        if ($domain) $user = "$user@$domain";
336        return $user;
337    }
338
339    /**
340     * Most values in LDAP are case-insensitive
341     *
342     * @return bool
343     */
344    public function isCaseSensitive()
345    {
346        return false;
347    }
348
349    /**
350     * Create a Search-String useable by adLDAPUsers::all($includeDescription = false, $search = "*", $sorted = true)
351     *
352     * @param array $filter
353     * @return string
354     */
355    protected function constructSearchString($filter)
356    {
357        if (!$filter) {
358            return '*';
359        }
360        $adldapUtils = new adLDAPUtils($this->initAdLdap(null));
361        $result = '*';
362        if (isset($filter['name'])) {
363            $result .= ')(displayname=*' . $adldapUtils->ldapSlashes($filter['name']) . '*';
364            unset($filter['name']);
365        }
366
367        if (isset($filter['user'])) {
368            $result .= ')(samAccountName=*' . $adldapUtils->ldapSlashes($filter['user']) . '*';
369            unset($filter['user']);
370        }
371
372        if (isset($filter['mail'])) {
373            $result .= ')(mail=*' . $adldapUtils->ldapSlashes($filter['mail']) . '*';
374            unset($filter['mail']);
375        }
376        return $result;
377    }
378
379    /**
380     * Return a count of the number of user which meet $filter criteria
381     *
382     * @param array $filter  $filter array of field/pattern pairs, empty array for no filter
383     * @return int number of users
384     */
385    public function getUserCount($filter = array())
386    {
387        $adldap = $this->initAdLdap(null);
388        if (!$adldap) {
389            Logger::debug("authad/auth.php getUserCount(): _adldap not set.");
390            return -1;
391        }
392        if ($filter == array()) {
393            $result = $adldap->user()->all();
394        } else {
395            $searchString = $this->constructSearchString($filter);
396            $result = $adldap->user()->all(false, $searchString);
397            if (isset($filter['grps'])) {
398                $this->users = array_fill_keys($result, false);
399                /** @var admin_plugin_usermanager $usermanager */
400                $usermanager = plugin_load("admin", "usermanager", false);
401                $usermanager->setLastdisabled(true);
402                if (!isset($this->grpsusers[$this->filterToString($filter)])) {
403                    $this->fillGroupUserArray($filter, $usermanager->getStart() + 3*$usermanager->getPagesize());
404                } elseif (count($this->grpsusers[$this->filterToString($filter)]) <
405                    $usermanager->getStart() + 3*$usermanager->getPagesize()
406                ) {
407                    $this->fillGroupUserArray(
408                        $filter,
409                        $usermanager->getStart() +
410                        3*$usermanager->getPagesize() -
411                        count($this->grpsusers[$this->filterToString($filter)])
412                    );
413                }
414                $result = $this->grpsusers[$this->filterToString($filter)];
415            } else {
416                /** @var admin_plugin_usermanager $usermanager */
417                $usermanager = plugin_load("admin", "usermanager", false);
418                $usermanager->setLastdisabled(false);
419            }
420        }
421
422        if (!$result) {
423            return 0;
424        }
425        return count($result);
426    }
427
428    /**
429     *
430     * create a unique string for each filter used with a group
431     *
432     * @param array $filter
433     * @return string
434     */
435    protected function filterToString($filter)
436    {
437        $result = '';
438        if (isset($filter['user'])) {
439            $result .= 'user-' . $filter['user'];
440        }
441        if (isset($filter['name'])) {
442            $result .= 'name-' . $filter['name'];
443        }
444        if (isset($filter['mail'])) {
445            $result .= 'mail-' . $filter['mail'];
446        }
447        if (isset($filter['grps'])) {
448            $result .= 'grps-' . $filter['grps'];
449        }
450        return $result;
451    }
452
453    /**
454     * Create an array of $numberOfAdds users passing a certain $filter, including belonging
455     * to a certain group and save them to a object-wide array. If the array
456     * already exists try to add $numberOfAdds further users to it.
457     *
458     * @param array $filter
459     * @param int $numberOfAdds additional number of users requested
460     * @return int number of Users actually add to Array
461     */
462    protected function fillGroupUserArray($filter, $numberOfAdds)
463    {
464        if (isset($this->grpsusers[$this->filterToString($filter)])) {
465            $actualstart = count($this->grpsusers[$this->filterToString($filter)]);
466        } else {
467            $this->grpsusers[$this->filterToString($filter)] = [];
468            $actualstart = 0;
469        }
470
471        $i=0;
472        $count = 0;
473        $this->constructPattern($filter);
474        foreach ($this->users as $user => &$info) {
475            if ($i++ < $actualstart) {
476                continue;
477            }
478            if ($info === false) {
479                $info = $this->getUserData($user);
480            }
481            if ($this->filter($user, $info)) {
482                $this->grpsusers[$this->filterToString($filter)][$user] = $info;
483                if (($numberOfAdds > 0) && (++$count >= $numberOfAdds)) break;
484            }
485        }
486        return $count;
487    }
488
489    /**
490     * Bulk retrieval of user data
491     *
492     * @author  Dominik Eckelmann <dokuwiki@cosmocode.de>
493     *
494     * @param   int $start index of first user to be returned
495     * @param   int $limit max number of users to be returned
496     * @param   array $filter array of field/pattern pairs, null for no filter
497     * @return array userinfo (refer getUserData for internal userinfo details)
498     */
499    public function retrieveUsers($start = 0, $limit = 0, $filter = array())
500    {
501        $adldap = $this->initAdLdap(null);
502        if (!$adldap) return array();
503
504        //if (!$this->users) {
505            //get info for given user
506            $result = $adldap->user()->all(false, $this->constructSearchString($filter));
507            if (!$result) return array();
508            $this->users = array_fill_keys($result, false);
509        //}
510
511        $i     = 0;
512        $count = 0;
513        $result = array();
514
515        if (!isset($filter['grps'])) {
516            /** @var admin_plugin_usermanager $usermanager */
517            $usermanager = plugin_load("admin", "usermanager", false);
518            $usermanager->setLastdisabled(false);
519            $this->constructPattern($filter);
520            foreach ($this->users as $user => &$info) {
521                if ($i++ < $start) {
522                    continue;
523                }
524                if ($info === false) {
525                    $info = $this->getUserData($user);
526                }
527                $result[$user] = $info;
528                if (($limit > 0) && (++$count >= $limit)) break;
529            }
530        } else {
531            /** @var admin_plugin_usermanager $usermanager */
532            $usermanager = plugin_load("admin", "usermanager", false);
533            $usermanager->setLastdisabled(true);
534            if (!isset($this->grpsusers[$this->filterToString($filter)]) ||
535                count($this->grpsusers[$this->filterToString($filter)]) < ($start+$limit)
536            ) {
537                if(!isset($this->grpsusers[$this->filterToString($filter)])) {
538                    $this->grpsusers[$this->filterToString($filter)] = [];
539                }
540
541                $this->fillGroupUserArray(
542                    $filter,
543                    $start+$limit - count($this->grpsusers[$this->filterToString($filter)]) +1
544                );
545            }
546            if (!$this->grpsusers[$this->filterToString($filter)]) return array();
547            foreach ($this->grpsusers[$this->filterToString($filter)] as $user => &$info) {
548                if ($i++ < $start) {
549                    continue;
550                }
551                $result[$user] = $info;
552                if (($limit > 0) && (++$count >= $limit)) break;
553            }
554        }
555        return $result;
556    }
557
558    /**
559     * Modify user data
560     *
561     * @param   string $user      nick of the user to be changed
562     * @param   array  $changes   array of field/value pairs to be changed
563     * @return  bool
564     */
565    public function modifyUser($user, $changes)
566    {
567        $return = true;
568        $adldap = $this->initAdLdap($this->getUserDomain($user));
569        if (!$adldap) {
570            msg($this->getLang('connectfail'), -1);
571            return false;
572        }
573
574        // password changing
575        if (isset($changes['pass'])) {
576            try {
577                $return = $adldap->user()->password($this->getUserName($user), $changes['pass']);
578            } catch (adLDAPException $e) {
579                if ($this->conf['debug']) msg('AD Auth: '.$e->getMessage(), -1);
580                $return = false;
581            }
582            if (!$return) msg($this->getLang('passchangefail'), -1);
583        }
584
585        // changing user data
586        $adchanges = array();
587        if (isset($changes['name'])) {
588            // get first and last name
589            $parts                     = explode(' ', $changes['name']);
590            $adchanges['surname']      = array_pop($parts);
591            $adchanges['firstname']    = join(' ', $parts);
592            $adchanges['display_name'] = $changes['name'];
593        }
594        if (isset($changes['mail'])) {
595            $adchanges['email'] = $changes['mail'];
596        }
597        if (count($adchanges)) {
598            try {
599                $return = $return & $adldap->user()->modify($this->getUserName($user), $adchanges);
600            } catch (adLDAPException $e) {
601                if ($this->conf['debug']) msg('AD Auth: '.$e->getMessage(), -1);
602                $return = false;
603            }
604            if (!$return) msg($this->getLang('userchangefail'), -1);
605        }
606
607        return $return;
608    }
609
610    /**
611     * Initialize the AdLDAP library and connect to the server
612     *
613     * When you pass null as domain, it will reuse any existing domain.
614     * Eg. the one of the logged in user. It falls back to the default
615     * domain if no current one is available.
616     *
617     * @param string|null $domain The AD domain to use
618     * @return adLDAP|bool true if a connection was established
619     */
620    protected function initAdLdap($domain)
621    {
622        if (is_null($domain) && is_array($this->opts)) {
623            $domain = $this->opts['domain'];
624        }
625
626        $this->opts = $this->loadServerConfig((string) $domain);
627        if (isset($this->adldap[$domain])) return $this->adldap[$domain];
628
629        // connect
630        try {
631            $this->adldap[$domain] = new adLDAP($this->opts);
632            return $this->adldap[$domain];
633        } catch (Exception $e) {
634            if ($this->conf['debug']) {
635                msg('AD Auth: '.$e->getMessage(), -1);
636            }
637            $this->success         = false;
638            $this->adldap[$domain] = null;
639        }
640        return false;
641    }
642
643    /**
644     * Get the domain part from a user
645     *
646     * @param string $user
647     * @return string
648     */
649    public function getUserDomain($user)
650    {
651        list(, $domain) = explode('@', $user, 2);
652        return $domain;
653    }
654
655    /**
656     * Get the user part from a user
657     *
658     * When an account suffix is set, we strip the domain part from the user
659     *
660     * @param string $user
661     * @return string
662     */
663    public function getUserName($user)
664    {
665        if ($this->conf['account_suffix'] !== '') {
666            list($user) = explode('@', $user, 2);
667        }
668        return $user;
669    }
670
671    /**
672     * Fetch the configuration for the given AD domain
673     *
674     * @param string $domain current AD domain
675     * @return array
676     */
677    protected function loadServerConfig($domain)
678    {
679        // prepare adLDAP standard configuration
680        $opts = $this->conf;
681
682        $opts['domain'] = $domain;
683
684        // add possible domain specific configuration
685        if ($domain && is_array($this->conf[$domain])) foreach ($this->conf[$domain] as $key => $val) {
686            $opts[$key] = $val;
687        }
688
689        // handle multiple AD servers
690        $opts['domain_controllers'] = explode(',', $opts['domain_controllers']);
691        $opts['domain_controllers'] = array_map('trim', $opts['domain_controllers']);
692        $opts['domain_controllers'] = array_filter($opts['domain_controllers']);
693
694        // compatibility with old option name
695        if (empty($opts['admin_username']) && !empty($opts['ad_username'])) {
696            $opts['admin_username'] = $opts['ad_username'];
697        }
698        if (empty($opts['admin_password']) && !empty($opts['ad_password'])) {
699            $opts['admin_password'] = $opts['ad_password'];
700        }
701        $opts['admin_password'] = conf_decodeString($opts['admin_password']); // deobfuscate
702
703        // we can change the password if SSL is set
704        if ($opts['use_ssl'] || $opts['use_tls']) {
705            $this->cando['modPass'] = true;
706        } else {
707            $this->cando['modPass'] = false;
708        }
709
710        // adLDAP expects empty user/pass as NULL, we're less strict FS#2781
711        if (empty($opts['admin_username'])) $opts['admin_username'] = null;
712        if (empty($opts['admin_password'])) $opts['admin_password'] = null;
713
714        // user listing needs admin priviledges
715        if (!empty($opts['admin_username']) && !empty($opts['admin_password'])) {
716            $this->cando['getUsers'] = true;
717        } else {
718            $this->cando['getUsers'] = false;
719        }
720
721        return $opts;
722    }
723
724    /**
725     * Returns a list of configured domains
726     *
727     * The default domain has an empty string as key
728     *
729     * @return array associative array(key => domain)
730     */
731    public function getConfiguredDomains()
732    {
733        $domains = array();
734        if (empty($this->conf['account_suffix'])) return $domains; // not configured yet
735
736        // add default domain, using the name from account suffix
737        $domains[''] = ltrim($this->conf['account_suffix'], '@');
738
739        // find additional domains
740        foreach ($this->conf as $key => $val) {
741            if (is_array($val) && isset($val['account_suffix'])) {
742                $domains[$key] = ltrim($val['account_suffix'], '@');
743            }
744        }
745        Sort::ksort($domains);
746
747        return $domains;
748    }
749
750    /**
751     * Check provided user and userinfo for matching patterns
752     *
753     * The patterns are set up with $this->_constructPattern()
754     *
755     * @author Chris Smith <chris@jalakai.co.uk>
756     *
757     * @param string $user
758     * @param array  $info
759     * @return bool
760     */
761    protected function filter($user, $info)
762    {
763        foreach ($this->pattern as $item => $pattern) {
764            if ($item == 'user') {
765                if (!preg_match($pattern, $user)) return false;
766            } elseif ($item == 'grps') {
767                if (!count(preg_grep($pattern, $info['grps']))) return false;
768            } else {
769                if (!preg_match($pattern, $info[$item])) return false;
770            }
771        }
772        return true;
773    }
774
775    /**
776     * Create a pattern for $this->_filter()
777     *
778     * @author Chris Smith <chris@jalakai.co.uk>
779     *
780     * @param array $filter
781     */
782    protected function constructPattern($filter)
783    {
784        $this->pattern = array();
785        foreach ($filter as $item => $pattern) {
786            $this->pattern[$item] = '/'.str_replace('/', '\/', $pattern).'/i'; // allow regex characters
787        }
788    }
789}
790