<?php

class ssl_ldapcheck{
	
	///////////////////////////////////////////////////////////////////////////////////
	//
	//   This class will check the subject of a certificate
	//   also making sure that the subject
	//   has a current entry in the LDAP.  
	//  (The cert issuers security is checked by Apache, in establishing the HTTPS connection
	//
	//  Written 2004/03/01 by Kevin Mitcham, Dartmouth PKI Lab
	//
	//
	///////////////////////////////////////////////////////////////////////////////////


	function check_cert(){
	////////////////////////////////////////////////////////////////////
	//
	//	 configuration variables
	//
	//////////////////////////////////////////////////////////////////////
	// the source for name checking
	  $LDAP = "dnd.dartmouth.edu"; 
	// the base DN for finding users
	  $BASE_DN = "dc=dartmouth,dc=edu";
	// a url or other source for certificates
	  $CERT_SOURCE = "https://collegeca.dartmouth.edu";
	//
	// result messages
	  $VALID = "valid";
	  $GENERIC_ERROR = "Error in pki_dndcheck_class";
	  $NOT_IN_LDAP = " not found in ".$LDAP.".";
	  $LDAP_UNREACHABLE = "Could not reach ".$LDAP." to confirm user identity.";
	  $NO_CERT_INFO = "No certificate information found.  Please try again using HTTPS.  You may need to request a certificate from ".$CERT_SOURCE;
	////////////////////////////////////////////////////////////////////
	//
	//	END configuration variables
	//
	//////////////////////////////////////////////////////////////////////

	  // get the users name
	  $name=$_SERVER["SSL_CLIENT_S_DN_CN"];
	  if ($name==""){
	    return $NO_CERT_INFO;
	  }
  	  // connect to the DND as an LDAP
	  $ds=ldap_connect($LDAP);
		// if the connection worked
		if ($ds) {
			$r=ldap_bind($ds);     // this is an "anonymous" bind, read-only access
			$sr=ldap_search($ds, "dc=dartmouth, dc=edu", "cn=".$name);
			$entries=ldap_count_entries($ds,$sr);
			ldap_close($ds);
			if ($entries > 0 ){
				return ($VALID);
			} else {
				return $name.$NOT_IN_LDAP;
			}// end number of entries check
		} else {
			return $LDAP_UNREACHABLE;
		}// end connection check 
	  return $GENERIC_ERROR;
	} // end check_cert function
} // end class def
?>