*** /kolab/var/kolab/www/admin/user/user.php.orig	2008-08-20 10:15:19.000000000 -0400
--- /kolab/var/kolab/www/admin/user/user.php	2008-08-20 13:48:58.000000000 -0400
***************
*** 12,17 ****
--- 12,18 ----
  require_once('admin/include/authenticate.php');
  require_once('admin/include/form.class.php');
  require_once('admin/include/passwd.php');
+ require_once('admin/include/samba.php');
  
  /**** Functions ***/
  function comment( $s ) {
***************
*** 213,218 ****
--- 214,283 ----
    }
  }
  
+ function create_smb_password($password) {
+   global $sambaObject;
+   $exe = $sambaObject['mkntpwd'] . " " . escapeshellarg($password) . " 2>&1";
+   $smbstring = exec($exe, $retarray, $retval);
+   if ($retval == "0" && preg_match("/^[0-9A-Z]+:[0-9A-Z]+$/", $smbstring)) {
+ 	return explode(":", $smbstring, 2);
+   }
+   return array("XXX_NO_PASSWORD", "XXX_NO_PASSWORD");
+ }
+ 
+ function init_posix_samba_user(&$ldobj, $password) {
+   // note: this function contains several fixed values which you should adjust according
+   //       to your needs - please read this function carefully!
+   global $ldap;
+   global $sambaObject;
+ 
+   // add basic posixAccount, shadowAccount and sambaSamAccount data to the passed object
+   $ldobj['objectClass'][] = "posixAccount";
+   $ldobj['objectClass'][] = "shadowAccount";
+   $ldobj['objectClass'][] = "sambaSamAccount";
+ 
+   // find the largest existing uidNumber (ask LDAP...)
+   $newUid = $sambaObject['baseUID'];
+   if (($result = $ldap->search($_SESSION['base_dn'], '(objectClass=posixAccount)',
+ 			       array('uidNumber'))) &&
+ 	  (ldap_count_entries($ldap->connection, $result) > 0)) {
+ 	$uids = ldap_get_entries($ldap->connection, $result);
+ 	foreach ($uids as $thisUid) {
+ 	  if ($thisUid['uidnumber'][0]) {
+ 		$thisIntUid = (int)($thisUid['uidnumber'][0]);
+ 		// remeber a new "old largest", but ignore nobody and friends
+ 		if ($thisIntUid < 65530 && $thisIntUid >= $newUid) {
+ 		  $newUid = $thisIntUid + 1;
+ 		}
+ 	  }
+       }
+   }  
+ 
+   // posixAccount attributes
+   $ldobj['uidNumber'] = $newUid;
+   $ldobj['gidNumber'] = $sambaObject['sambaPrimaryGroupID'];
+   $ldobj['homeDirectory'] = "/home/" . $ldobj['uid'];
+   $ldobj['loginShell'] = "/bin/bash";
+   // the gecos field may not contain national chars...
+   $ldobj['gecos'] = preg_replace('/[^a-z0-9 ]/i', '?', $ldobj['cn']) . " (Samba, Linux)";
+ 
+   // sambaSamAccount attributes
+   $ldobj['sambaSID'] = $sambaObject['sambaBaseSID'] . "-" . ($newUid*2+1000);
+   $smbpass = create_smb_password($password);
+   $ldobj['sambaLMPassword'] = $smbpass[0];
+   $ldobj['sambaNTPassword'] = $smbpass[1];
+   $ldobj['sambaLogonTime'] = "0";
+   $ldobj['sambaLogoffTime'] = "0";
+   $ldobj['sambaKickoffTime'] = "0";
+   $ldobj['sambaPwdCanChange'] = "0";
+   $ldobj['sambaPwdMustChange'] = "0";;
+   $ldobj['sambaAcctFlags'] = "[UX]";
+   $ldobj['sambaHomePath'] = "\\\\" . $sambaObject['sambaPDC'] . "\\" . $ldobj['uid'];
+   $ldobj['sambaHomeDrive'] = $sambaObject['sambaHomeDrive'];
+   $ldobj['sambaLogonScript'] = $sambaObject['sambaLogonScript'];
+   $ldobj['sambaProfilePath'] = "\\\\" . $sambaObject['sambaPDC'] . "\\profiles\\" . $ldobj['uid'];
+   $ldobj['sambaPrimaryGroupSID'] = $sambaObject['sambaBaseSID'] . "-" . $sambaObject['sambaPrimaryGroupID'];
+ }
+ 
  function fill_form_for_modify( &$form, $dn, &$ldap_object ) {
    global $auth;
    if (is_array($ldap_object['sn'])) $sn = $ldap_object['sn'][0];
***************
*** 474,479 ****
--- 539,555 ----
    unset($oc['count']);
  }
  
+ // validate the password by asking craklib if the entry shall be changed
+ if ($action != "firstsave" && !empty($_POST['password_0'])) {
+   // FIXME - better use the PHP object
+   $exe = "echo \"" . $_POST['password_0'] . "\" | " . $sambaObject['cracklib_exec'] . " 2>&1";
+   unset($retarray);
+   exec($exe, $retarray, $retval);
+   if (!preg_match("/: OK$/", $retarray[0])) {
+ 	array_push($errors, sprintf(_("Bad password %s"), $retarray[1]));
+   }
+ }
+ 
  if( $auth->group() == 'user' ) {
    apply_attributeaccess( $entries );
  }
***************
*** 497,502 ****
--- 573,584 ----
  	   $ldap_object['givenName'] = trim($_POST['givenname']);
         if( !empty( $_POST['password_0'] ) ) {
  	         $ldap_object['userPassword'] = ssha( $_POST['password_0'], gensalt());
+ 			 if ($_POST['accttype'] == 0) {
+ 			   // update Samba passwords
+ 			   $smbpass = create_smb_password($_POST['password_0']);
+ 			   $ldap_object['sambaLMPassword'] = $smbpass[0];
+ 			   $ldap_object['sambaNTPassword'] = $smbpass[1];
+ 			 }
  		 if( $action == 'save' && $auth->dn() == $dn ) {
  		   // We are editing our own password, let's update the session!
  		   $auth->setPassword($_POST['password_0']);
***************
*** 679,684 ****
--- 761,770 ----
  		 $content = $form->outputForm();
         } else {
  		 // firstsave
+ 		 if ($_POST['accttype'] == 0) {
+ 		   // new real user: add the posix and samba account types
+ 		   init_posix_samba_user($ldap_object);
+ 		 }
  		 if (!$errors) {
  		   $dn = "cn=".$ldap->dn_escape($ldap_object['cn']).$dn_add.",".$domain_dn;
  		   foreach( $ldap_object as $k => $v ) {
