Rely on attributes map for last authentication attribute (#321)

* Rely on attributes map for last authentication attribute

* Change documentation for lastauth attribute and add upgrade note

Author: coudot

conf/config.inc.php

@@ -38,7 +38,6 @@
 $ldap_ppolicy_name_attribute = "cn";
 $ldap_size_limit = 100;
 #$ldap_default_ppolicy = "cn=default,ou=ppolicy,dc=example,dc=com";
-$ldap_lastauth_attribute = "authTimestamp";
 #$ldap_network_timeout = 10;
 $ldap_page_size = 0;
 

docs/ldap-parameters.rst

@@ -137,13 +137,20 @@ You can override some policies, like lockout duration or password maximal age:
 Last authentication attribute
 -----------------------------
 
-The last authentication date can be stored in different attributes depending on your OpenLDAP version or configuration.
+The last authentication date can be stored in different attributes depending on your LDAP directory version or configuration.
+
+For example, for OpenLDAP, to use ``pwdLastSuccess`` instead of ``authTimestamp``:
 
 .. code-block:: php
 
-    $ldap_lastauth_attribute = "pwdLastSuccess";
+    $openldap_attributes_map['authtimestamp']['attribute'] = "pwdlastsuccess";
+
+
+For Active Directory, to use ``lastlogontimestamp`` (replicated againts all DC) instead of ``lastlogon`` (updated only on the targeted DC):
+
+.. code-block:: php
 
-.. tip:: This attribute is automatically configured for Active Directory.
+    $activedirectory_attributes_map['authtimestamp']['attribute'] = "lastlogontimestamp";
 
 Samba 3
 -------

docs/upgrade.rst

@@ -17,6 +17,16 @@ If you want to use this feature, be sure to configure what is needed to read gro
 
 * :doc:`Group membership<groupmembership>`
 
+Last authentication time attribute
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Configuration parameter ``$ldap_lastauth_attribute`` has been removed.
+
+If you configured a specific value for it, which was possible for OpenLDAP to use ``pwdLastSuccess`` instead of ``authTimestamp``, then you must change your settings:
+
+.. code-block:: php
+
+    $openldap_attributes_map['authtimestamp']['attribute'] = "pwdlastsuccess";
 
 From 0.7 to 0.8
 ---------------

htdocs/api/search-api.php

@@ -53,6 +53,7 @@
         date_sub( $dateIdle, new DateInterval('P'.$idledays.'D') );
         $dateIdleLdap = $directory->getLdapDate($dateIdle);
         # Search filter
+        $ldap_lastauth_attribute = $attributes_map['authtimestamp']['attribute'];
         $ldap_filter = "(&".$ldap_user_filter."(|(!(".$ldap_lastauth_attribute."=*))(".$ldap_lastauth_attribute."<=".$dateIdleLdap.")))";
         $ldap_search_filter = $ldap_filter;
         break;

htdocs/index.php

@@ -95,14 +95,12 @@
 # Load specific directory settings
 switch($ldap_type) {
   case "openldap":
-    $openldap_attributes_map['authtimestamp']['attribute'] = strtolower($ldap_lastauth_attribute);
     $attributes_map = array_merge($attributes_map, $openldap_attributes_map);
     $directory = new \Ltb\Directory\OpenLDAP();
   break;
   case "activedirectory":
     $attributes_map = array_merge($attributes_map, $activedirectory_attributes_map);
     $directory = new \Ltb\Directory\ActiveDirectory();
-    $ldap_lastauth_attribute = "lastLogon";
   break;
 }