perf: 完善LDAP

2026-03-07 09:57:37 +00:00 · 2023-02-09 09:56:45 +08:00 · 2023-02-09 09:56:45 +08:00 · 63bb145224
commit 63bb145224
parent b60b572494
10 changed files with 416 additions and 82 deletions
--- a/app/Http/Controllers/Api/SystemController.php
+++ b/app/Http/Controllers/Api/SystemController.php
@ -326,7 +326,7 @@ class SystemController extends AbstractController
     *
     * @apiParam {String} type
     * - get: 获取（默认）
-     * - save: 保存设置（参数：['ldap_open', 'ldap_host', 'ldap_port', 'ldap_password', 'ldap_cn', 'ldap_dn']）
+     * - save: 保存设置（参数：['ldap_open', 'ldap_host', 'ldap_port', 'ldap_password', 'ldap_user_dn', 'ldap_base_dn', 'ldap_sync_local']）
     * - testldap: 测试ldap连接
     * @apiSuccess {Number} ret     返回状态码（1正确、0错误）
     * @apiSuccess {String} msg     返回信息（错误描述）
@ -345,10 +345,10 @@ class SystemController extends AbstractController
                    "hosts" => [$all['ldap_host']],
                    "port" => intval($all['ldap_port']),
                    "password" => $all['ldap_password'],
-                    "username" => $all['ldap_cn'],
-                    "base_dn" => $all['ldap_dn'],
+                    "username" => $all['ldap_user_dn'],
+                    "base_dn" => $all['ldap_base_dn'],
                ]);
-                if ($connection->auth()->attempt($all['ldap_cn'], $all['ldap_password'])) {
+                if ($connection->auth()->attempt($all['ldap_user_dn'], $all['ldap_password'])) {
                    return Base::retSuccess('验证通过');
                } else {
                    return Base::retError('验证失败');
@ -367,8 +367,9 @@ class SystemController extends AbstractController
                    'ldap_host',
                    'ldap_port',
                    'ldap_password',
-                    'ldap_cn',
-                    'ldap_dn'
+                    'ldap_user_dn',
+                    'ldap_base_dn',
+                    'ldap_sync_local'
                ])) {
                    unset($all[$key]);
                }
@ -381,6 +382,7 @@ class SystemController extends AbstractController
        //
        $setting['ldap_open'] = $setting['ldap_open'] ?: 'close';
        $setting['ldap_port'] = intval($setting['ldap_port']) ?: 389;
+        $setting['ldap_sync_local'] = $setting['ldap_sync_local'] ?: 'close';
        //
        return Base::retSuccess('success', $setting ?: json_decode('{}'));
    }
--- a/app/Http/Controllers/Api/UsersController.php
+++ b/app/Http/Controllers/Api/UsersController.php
@ -50,8 +50,6 @@ class UsersController extends AbstractController
     * @apiSuccess {Number} ret     返回状态码（1正确、0错误）
     * @apiSuccess {String} msg     返回信息（错误描述）
     * @apiSuccess {Object} data    返回数据（同"获取我的信息"接口）
-     *
-     * @throws \LdapRecord\Configuration\ConfigurationException
     */
    public function login()
    {
@ -94,20 +92,23 @@ class UsersController extends AbstractController
            };
            //
            $user = User::whereEmail($email)->first();
-            $checkPassword = true;
-            if (LdapUser::isOpen() && (empty($user) || in_array('ldap', $user->identity))) {
-                $user = LdapUser::userLogin($email, $password, $user);
-                if ($user) {
-                    $identity = array_merge(array_diff($user->identity, ['ldap']), ['ldap']);
-                    $user->identity = "," . implode(",", $identity) . ",";
-                    $user->save();
+            $isLdap = true;
+            if (LdapUser::isOpen()) {
+                if (empty($user) || $user->isLdap()) {
+                    $user = LdapUser::userLogin($email, $password, $user);
+                    if ($user) {
+                        $user->identity = Base::arrayImplode(array_merge(array_diff($user->identity, ['ldap']), ['ldap']));
+                        $user->save();
+                    }
+                    $isLdap = false;
                }
-                $checkPassword = false;
            }
            if (empty($user)) {
                return $retError('帐号或密码错误');
            }
-            if ($checkPassword && $user->password != Base::md52($password, $user->encrypt)) {
+            if ($isLdap) {
+                LdapUser::userSync($user, $password);
+            } elseif ($user->password != Base::md52($password, $user->encrypt)) {
                return $retError('帐号或密码错误');
            }
            //
@ -276,12 +277,17 @@ class UsersController extends AbstractController
        $user = User::auth();
        $data = Request::all();
        $user->checkSystem(1);
+        $upLdap = [];
        // 头像
        if (Arr::exists($data, 'userimg')) {
            $userimg = Request::input('userimg');
-            $user->userimg = $userimg ? Base::unFillUrl(is_array($userimg) ? $userimg[0]['path'] : $userimg) : '';
-            if (str_contains($user->userimg, 'avatar/')) {
-                $user->userimg = '';
+            $userimg = $userimg ? Base::unFillUrl(is_array($userimg) ? $userimg[0]['path'] : $userimg) : '';
+            if (str_contains($userimg, 'avatar/')) {
+                $userimg = '';
+            }
+            $user->userimg = $userimg;
+            if (file_exists(public_path($userimg))) {
+                $upLdap['jpegPhoto'] = file_get_contents(public_path($userimg));
            }
        }
        // 电话
@ -294,6 +300,7 @@ class UsersController extends AbstractController
                return Base::retError('联系电话已存在');
            }
            $user->tel = $tel;
+            $upLdap['mobile'] = $tel;
        }
        // 昵称
        if (Arr::exists($data, 'nickname')) {
@ -306,6 +313,7 @@ class UsersController extends AbstractController
                $user->nickname = $nickname;
                $user->az = Base::getFirstCharter($nickname);
                $user->pinyin = Base::cn2pinyin($nickname);
+                $upLdap['displayName'] = $nickname;
            }
        }
        // 职位/职称
@ -317,15 +325,14 @@ class UsersController extends AbstractController
                return Base::retError('职位/职称最多只能设置20个字');
            } else {
                $user->profession = $profession;
+                $upLdap['employeeType'] = $profession;
            }
        }
        //
        $user->save();
        User::token($user);
+        LdapUser::userUpdate($user->email, $upLdap);
        //
-        if (empty($user->userimg)) {
-            $user->userimg = $user->getUserimgAttribute(null);
-        }
        return Base::retSuccess('修改成功', $user);
    }

@ -366,6 +373,7 @@ class UsersController extends AbstractController
        $user->changepass = 0;
        $user->save();
        User::token($user);
+        LdapUser::userUpdate($user->email, ['userPassword' => $newpass]);
        return Base::retSuccess('修改成功', $user);
    }

@ -675,6 +683,7 @@ class UsersController extends AbstractController
        $userInfo->checkSystem(1);
        //
        $upArray = [];
+        $upLdap = [];
        $transferUser = null;
        switch ($type) {
            case 'setadmin':
@ -751,10 +760,10 @@ class UsersController extends AbstractController
                break;
        }
        if (isset($upArray['identity'])) {
-            $upArray['identity'] = "," . implode(",", $upArray['identity']) . ",";
+            $upArray['identity'] = Base::arrayImplode($upArray['identity']);
        }
        if (isset($upArray['department'])) {
-            $upArray['department'] = "," . implode(",", $upArray['department']) . ",";
+            $upArray['department'] = Base::arrayImplode($upArray['department']);
        }
        // 邮箱
        if (Arr::exists($data, 'email')) {
@ -762,6 +771,9 @@ class UsersController extends AbstractController
            if (User::whereEmail($email)->where('userid', '!=', $userInfo->userid)->exists()) {
                return Base::retError('邮箱地址已存在');
            }
+            if ($userInfo->isLdap()) {
+                return Base::retError('LDAP 用户禁止修改邮箱');
+            }
            $upArray['email'] = $email;
        }
        // 电话
@ -771,6 +783,7 @@ class UsersController extends AbstractController
                return Base::retError('联系电话已存在');
            }
            $upArray['tel'] = $tel;
+            $upLdap['mobile'] = $tel;
        }
        // 密码
        if (Arr::exists($data, 'password')) {
@ -779,6 +792,7 @@ class UsersController extends AbstractController
            $upArray['encrypt'] = Base::generatePassword(6);
            $upArray['password'] = Base::md52($password, $upArray['encrypt']);
            $upArray['changepass'] = 1;
+            $upLdap['userPassword'] = $password;
        }
        // 昵称
        if (Arr::exists($data, 'nickname')) {
@ -791,6 +805,7 @@ class UsersController extends AbstractController
                $upArray['nickname'] = $nickname;
                $upArray['az'] = Base::getFirstCharter($nickname);
                $upArray['pinyin'] = Base::cn2pinyin($nickname);
+                $upLdap['displayName'] = $nickname;
            }
        }
        // 职位/职称
@ -802,14 +817,16 @@ class UsersController extends AbstractController
                return Base::retError('职位/职称最多只能设置20个字');
            } else {
                $upArray['profession'] = $profession;
+                $upLdap['employeeType'] = $profession;
            }
        }
        if ($upArray) {
-            AbstractModel::transaction(function() use ($user, $type, $upArray, $userInfo, $transferUser) {
+            AbstractModel::transaction(function() use ($upLdap, $user, $type, $upArray, $userInfo, $transferUser) {
                $exitIds = array_diff($userInfo->department, Base::explodeInt($upArray['department']));
                $joinIds = array_diff(Base::explodeInt($upArray['department']), $userInfo->department);
                $userInfo->updateInstance($upArray);
                $userInfo->save();
+                LdapUser::userUpdate($userInfo->email, $upLdap);
                if ($type === 'department') {
                    $userids = [$userInfo->userid];
                    // 退出群组
@ -1146,6 +1163,10 @@ class UsersController extends AbstractController
        //
        $user->checkSystem();
        //
+        if ($user->isLdap()) {
+            return Base::retError('LDAP 用户禁止修改邮箱');
+        }
+        //
        $newEmail = trim(Request::input('newEmail'));
        $code = trim(Request::input('code'));
        if (!$newEmail) {
--- a/app/Ldap/LdapUser.php
+++ b/app/Ldap/LdapUser.php
@ -5,6 +5,7 @@ namespace App\Ldap;
 use App\Exceptions\ApiException;
 use App\Models\User;
 use App\Module\Base;
+use LdapRecord\Configuration\ConfigurationException;
 use LdapRecord\Container;
 use LdapRecord\LdapRecordException;
 use LdapRecord\Models\Model;
@ -25,6 +26,23 @@ class LdapUser extends Model
        'posixAccount',
    ];

+    /**
+     * @return mixed|null
+     */
+    public function getPhoto()
+    {
+        return $this->jpegPhoto && is_array($this->jpegPhoto) ? $this->jpegPhoto[0] : null;
+    }
+
+    /**
+     * @return mixed|null
+     */
+    public function getDisplayName()
+    {
+        $nickname = $this->displayName ?: $this->uid;
+        return is_array($nickname) ? $nickname[0] : $nickname;
+    }
+
    /**
     * @return LdapUser
     */
@ -39,14 +57,21 @@ class LdapUser extends Model
     */
    public static function isOpen(): bool
    {
-        $setting = Base::setting('thirdAccessSetting');
-        return $setting['ldap_open'] === 'open';
+        return Base::settingFind('thirdAccessSetting', 'ldap_open') === 'open';
+    }
+
+    /**
+     * 同步本地是否打开
+     * @return bool
+     */
+    public static function isSyncLocal(): bool
+    {
+        return Base::settingFind('thirdAccessSetting', 'ldap_sync_local') === 'open';
    }

    /**
     * 初始化配置
     * @return void
-     * @throws \LdapRecord\Configuration\ConfigurationException
     */
    public static function initConfig()
    {
@ -57,13 +82,37 @@ class LdapUser extends Model
        //
        $setting = Base::setting('thirdAccessSetting');
        $connection = Container::getDefaultConnection();
-        $connection->setConfiguration([
-            "hosts" => [$setting['ldap_host']],
-            "port" => intval($setting['ldap_port']),
-            "password" => $setting['ldap_password'],
-            "username" => $setting['ldap_cn'],
-            "base_dn" => $setting['ldap_dn'],
-        ]);
+        try {
+            $connection->setConfiguration([
+                "hosts" => [$setting['ldap_host']],
+                "port" => intval($setting['ldap_port']),
+                "base_dn" => $setting['ldap_base_dn'],
+                "username" => $setting['ldap_user_dn'],
+                "password" => $setting['ldap_password'],
+            ]);
+        } catch (ConfigurationException $e) {
+            throw new ApiException($e->getMessage());
+        }
+    }
+
+    /**
+     * 获取
+     * @param $username
+     * @param $password
+     * @return Model|null
+     */
+    public static function userFirst($username, $password): ?Model
+    {
+        self::initConfig();
+        try {
+            return self::static()
+                ->where([
+                    'cn' => $username,
+                    'userPassword' => $password
+                ])->first();
+        } catch (\Exception) {
+            return null;
+        }
    }

    /**
@ -72,50 +121,69 @@ class LdapUser extends Model
     * @param $password
     * @param User|null $user
     * @return User|mixed|null
-     * @throws \LdapRecord\Configuration\ConfigurationException
     */
    public static function userLogin($username, $password, $user = null)
    {
        self::initConfig();
-        $row = self::static()
-            ->where([
-                'cn' => $username,
-                'userPassword' => $password
-            ])->first();
+        $row = self::userFirst($username, $password);
        if (!$row) {
            return null;
        }
-        if ($user) {
-            return $user;
+        if (empty($user)) {
+            $user = User::reg($username, $password);
        }
-        return User::reg($username, Base::generatePassword(32));
+        if ($user) {
+            $userimg = $row->getPhoto();
+            if ($userimg) {
+                $path = "uploads/user/ldap/";
+                Base::makeDir(public_path($path));
+                file_put_contents(public_path("{$path}{$user->userid}.jpeg"), $userimg);
+                $user->userimg = "{$path}{$user->userid}.jpeg";
+            }
+            $user->nickname = $row->getDisplayName();
+            $user->save();
+        }
+        return $user;
    }

    /**
-     * 添加
-     * @param $userid
-     * @param $username
+     * 同步
+     * @param User $user
     * @param $password
-     * @param $description
     * @return void
-     * @throws \LdapRecord\Configuration\ConfigurationException
     */
-    public static function userReg($userid, $username, $password, $description = '')
+    public static function userSync(User $user, $password)
    {
        self::initConfig();
-        try {
-            self::static()->create([
-                'cn' => $username,
-                'gidNumber' => 0,
-                'homeDirectory' => '/home/ldap/dootask/' . env("APP_NAME"),
-                'sn' => $username,
-                'uid' => $username,
-                'uidNumber' => $userid,
-                'userPassword' => $password,
-                'description' => $description,
-            ]);
-        } catch (LdapRecordException $e) {
-            throw new ApiException("reg ldap fail: " . $e->getMessage());
+        //
+        if (self::isSyncLocal()) {
+            $row = self::userFirst($user->email, $password);
+            if ($row) {
+                return;
+            }
+            try {
+                $userimg = public_path($user->getRawOriginal('userimg'));
+                if (file_exists($userimg)) {
+                    $userimg = file_get_contents($userimg);
+                } else {
+                    $userimg = '';
+                }
+                self::static()->create([
+                    'cn' => $user->email,
+                    'gidNumber' => 0,
+                    'homeDirectory' => '/home/ldap/dootask/' . env("APP_NAME"),
+                    'sn' => $user->email,
+                    'uid' => $user->email,
+                    'uidNumber' => $user->userid,
+                    'userPassword' => $password,
+                    'displayName' => $user->nickname,
+                    'jpegPhoto' => $userimg,
+                ]);
+                $user->identity = Base::arrayImplode(array_merge(array_diff($user->identity, ['ldap']), ['ldap']));
+                $user->save();
+            } catch (LdapRecordException $e) {
+                info("[LDAP] sync fail: " . $e->getMessage());
+            }
        }
    }

@ -124,10 +192,12 @@ class LdapUser extends Model
     * @param $username
     * @param $array
     * @return void
-     * @throws \LdapRecord\Configuration\ConfigurationException
     */
    public static function userUpdate($username, $array)
    {
+        if (empty($array)) {
+            return;
+        }
        self::initConfig();
        $row = self::static()
            ->where([
@ -136,7 +206,7 @@ class LdapUser extends Model
        try {
            $row?->update($array);
        } catch (LdapRecordException $e) {
-            throw new ApiException("update ldap fail: " . $e->getMessage());
+            throw new ApiException("[LDAP] update fail: " . $e->getMessage());
        }
    }

@ -144,7 +214,6 @@ class LdapUser extends Model
     * 删除
     * @param $username
     * @return void
-     * @throws \LdapRecord\Configuration\ConfigurationException
     */
    public static function userDelete($username)
    {
@ -156,7 +225,7 @@ class LdapUser extends Model
        try {
            $row?->delete();
        } catch (LdapRecordException $e) {
-            throw new ApiException("delete ldap fail: " . $e->getMessage());
+            throw new ApiException("[LDAP] delete fail: " . $e->getMessage());
        }
    }
 }
--- a/app/Models/User.php
+++ b/app/Models/User.php
@ -170,10 +170,19 @@ class User extends AbstractModel
        return WebSocket::whereUserid($this->userid)->exists();
    }

+    /**
+     * 返回是否LDAP用户
+     * @return bool
+     */
+    public function isLdap()
+    {
+        return in_array('ldap', $this->identity);
+    }
+
    /**
     * 判断是否管理员
     */
-    public function isAdmin()
+    public function checkAdmin()
    {
        $this->identity('admin');
    }
--- a/app/Models/WebSocketDialog.php
+++ b/app/Models/WebSocketDialog.php
@ -306,7 +306,7 @@ class WebSocketDialog extends AbstractModel
                case 'all':
                    throw new ApiException('当前会话全员禁言');
                case 'user':
-                    if (!User::find($userid)?->isAdmin()) {
+                    if (!User::find($userid)?->checkAdmin()) {
                        throw new ApiException('当前会话禁言');
                    }
            }
--- a/app/Module/Base.php
+++ b/app/Module/Base.php
@ -917,6 +917,27 @@ class Base
        return array_values($array);
    }

+    /**
+     * 数组拼接字符串（前后也加上）
+     * @param $glue
+     * @param $pieces
+     * @param $around
+     * @return string
+     */
+    public static function arrayImplode($glue = "", $pieces = null, $around = true)
+    {
+        if ($pieces == null) {
+            $pieces = $glue;
+            $glue = ',';
+        }
+        $pieces = array_values(array_filter(array_unique($pieces)));
+        $string = implode($glue, $pieces);
+        if ($around && $string) {
+            $string = ",{$string},";
+        }
+        return $string;
+    }
+
    /**
     * 判断是否二维数组
     * @param $array
--- a/composer.lock
+++ b/composer.lock
@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "1f71e1f0a7f452788cfd5285ba0ecf62",
+    "content-hash": "d09676319c2877afde501237e463d885",
    "packages": [
        {
            "name": "asm89/stack-cors",
@ -193,6 +193,145 @@
            },
            "time": "2022-10-27T11:44:00+00:00"
        },
+        {
+            "name": "directorytree/ldaprecord",
+            "version": "v2.19.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/DirectoryTree/LdapRecord.git",
+                "reference": "3557d500b24b331852e4c9ebea1e712b7629cb09"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/DirectoryTree/LdapRecord/zipball/3557d500b24b331852e4c9ebea1e712b7629cb09",
+                "reference": "3557d500b24b331852e4c9ebea1e712b7629cb09",
+                "shasum": ""
+            },
+            "require": {
+                "ext-json": "*",
+                "ext-ldap": "*",
+                "illuminate/contracts": "^5.0|^6.0|^7.0|^8.0|^9.0",
+                "nesbot/carbon": "^1.0|^2.0",
+                "php": ">=7.3",
+                "psr/log": "^1.0|^2.0|^3.0",
+                "psr/simple-cache": "^1.0|^2.0",
+                "symfony/polyfill-php80": "^1.25",
+                "tightenco/collect": "^5.6|^6.0|^7.0|^8.0|^9.0"
+            },
+            "require-dev": {
+                "mockery/mockery": "^1.0",
+                "phpunit/phpunit": "^9.0",
+                "spatie/ray": "^1.24"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "LdapRecord\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Steve Bauman",
+                    "email": "steven_bauman@outlook.com",
+                    "role": "Developer"
+                }
+            ],
+            "description": "A fully-featured LDAP ORM.",
+            "homepage": "https://www.ldaprecord.com",
+            "keywords": [
+                "active directory",
+                "ad",
+                "adLDAP",
+                "adldap2",
+                "directory",
+                "ldap",
+                "ldaprecord",
+                "orm",
+                "windows"
+            ],
+            "support": {
+                "docs": "https://ldaprecord.com",
+                "email": "steven_bauman@outlook.com",
+                "issues": "https://github.com/DirectoryTree/LdapRecord/issues",
+                "source": "https://github.com/DirectoryTree/LdapRecord"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/stevebauman",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-01-16T14:11:36+00:00"
+        },
+        {
+            "name": "directorytree/ldaprecord-laravel",
+            "version": "v2.7.2",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/DirectoryTree/LdapRecord-Laravel.git",
+                "reference": "35eb11817833da9f605ea0429c4e2ff42c481d3d"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/DirectoryTree/LdapRecord-Laravel/zipball/35eb11817833da9f605ea0429c4e2ff42c481d3d",
+                "reference": "35eb11817833da9f605ea0429c4e2ff42c481d3d",
+                "shasum": ""
+            },
+            "require": {
+                "directorytree/ldaprecord": "^2.4.4",
+                "ext-ldap": "*",
+                "illuminate/support": "^5.6|^6.0|^7.0|^8.0|^9.0|^10.0",
+                "php": ">=7.3",
+                "ramsey/uuid": "*"
+            },
+            "require-dev": {
+                "laravel/sanctum": "*",
+                "mockery/mockery": "^1.0",
+                "orchestra/testbench": "^3.7|^4.0|^5.0|^6.0|^7.0",
+                "phpunit/phpunit": "^7.0|^8.0|^9.0",
+                "spatie/ray": "^1.28"
+            },
+            "type": "project",
+            "extra": {
+                "laravel": {
+                    "providers": [
+                        "LdapRecord\\Laravel\\LdapServiceProvider",
+                        "LdapRecord\\Laravel\\LdapAuthServiceProvider"
+                    ]
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "LdapRecord\\Laravel\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "description": "LDAP Authentication & Management for Laravel.",
+            "keywords": [
+                "adldap2",
+                "laravel",
+                "ldap",
+                "ldaprecord"
+            ],
+            "support": {
+                "issues": "https://github.com/DirectoryTree/LdapRecord-Laravel/issues",
+                "source": "https://github.com/DirectoryTree/LdapRecord-Laravel/tree/v2.7.2"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/stevebauman",
+                    "type": "github"
+                }
+            ],
+            "time": "2023-01-16T14:13:28+00:00"
+        },
        {
            "name": "doctrine/inflector",
            "version": "2.0.6",
@ -6653,6 +6792,60 @@
            ],
            "time": "2022-10-07T08:01:20+00:00"
        },
+        {
+            "name": "tightenco/collect",
+            "version": "v9.47.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/tighten/collect.git",
+                "reference": "7bc3f863032e4458d798a4d2fa9379d32504aa97"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/tighten/collect/zipball/7bc3f863032e4458d798a4d2fa9379d32504aa97",
+                "reference": "7bc3f863032e4458d798a4d2fa9379d32504aa97",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^8.0",
+                "symfony/var-dumper": "^3.4 || ^4.0 || ^5.0 || ^6.0"
+            },
+            "require-dev": {
+                "mockery/mockery": "^1.0",
+                "nesbot/carbon": "^2.23.0",
+                "phpunit/phpunit": "^8.3"
+            },
+            "type": "library",
+            "autoload": {
+                "files": [
+                    "src/Collect/Support/helpers.php",
+                    "src/Collect/Support/alias.php"
+                ],
+                "psr-4": {
+                    "Tightenco\\Collect\\": "src/Collect"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Taylor Otwell",
+                    "email": "taylorotwell@gmail.com"
+                }
+            ],
+            "description": "Collect - Illuminate Collections as a separate package.",
+            "keywords": [
+                "collection",
+                "laravel"
+            ],
+            "support": {
+                "issues": "https://github.com/tighten/collect/issues",
+                "source": "https://github.com/tighten/collect/tree/v9.47.0"
+            },
+            "time": "2023-01-13T19:14:21+00:00"
+        },
        {
            "name": "tijsverkoyen/css-to-inline-styles",
            "version": "2.2.5",
--- a/config/ldap.php
+++ b/config/ldap.php
@ -52,7 +52,7 @@ return [
    |
    */

-    'logging' => env('LDAP_LOGGING', true),
+    'logging' => (bool) env('APP_DEBUG', false),

    /*
    |--------------------------------------------------------------------------
--- a/resources/assets/js/pages/manage/setting/components/SystemThirdAccess.vue
+++ b/resources/assets/js/pages/manage/setting/components/SystemThirdAccess.vue
@ -8,23 +8,31 @@
                        <Radio label="open">{{ $L('开启') }}</Radio>
                        <Radio label="close">{{ $L('关闭') }}</Radio>
                    </RadioGroup>
+                    <div class="form-tip">{{$L('开启后可以直接使用 LDAP 帐号密码登录')}}</div>
                </FormItem>
                <template v-if="formData.ldap_open === 'open'">
                    <FormItem :label="$L('LDAP 地址')" prop="ldap_host">
                        <Input v-model="formData.ldap_host"/>
-                        <div class="form-tip">{{$L('如：192.168.1.200')}}</div>
+                        <div class="form-tip">{{$L('例如')}}: 192.168.1.200、www.ldap.com</div>
                    </FormItem>
                    <FormItem :label="$L('LDAP 端口')" prop="ldap_port">
                        <Input v-model="formData.ldap_port" type="number" :placeholder="`${$L('默认')}: 389`"/>
                    </FormItem>
+                    <FormItem label="Base DN" prop="ldap_base_dn">
+                        <Input v-model="formData.ldap_base_dn"/>
+                    </FormItem>
+                    <FormItem label="User DN" prop="ldap_user_dn">
+                        <Input v-model="formData.ldap_user_dn"/>
+                    </FormItem>
                    <FormItem :label="$L('密码')" prop="ldap_password">
-                        <Input v-model="formData.ldap_password"/>
+                        <Input v-model="formData.ldap_password" type="password"/>
                    </FormItem>
-                    <FormItem :label="$L('绑定 CN')" prop="ldap_cn">
-                        <Input v-model="formData.ldap_cn"/>
-                    </FormItem>
-                    <FormItem :label="$L('绑定 DN')" prop="ldap_dn">
-                        <Input v-model="formData.ldap_dn"/>
+                    <FormItem :label="$L('同步本地帐号')" prop="ldap_sync_local">
+                        <RadioGroup v-model="formData.ldap_sync_local">
+                            <Radio label="open">{{ $L('开启') }}</Radio>
+                            <Radio label="close">{{ $L('关闭') }}</Radio>
+                        </RadioGroup>
+                        <div class="form-tip">{{$L('开启同步本地帐号登录后将同步到 LDAP 服务器')}}</div>
                    </FormItem>
                    <FormItem>
                        <Button :loading="testLoad" @click="checkTest">{{ $L('测试链接') }}</Button>
--- a/resources/assets/js/pages/manage/setting/email.vue
+++ b/resources/assets/js/pages/manage/setting/email.vue
@ -2,18 +2,23 @@
    <div class="setting-item submit">
        <Loading v-if="configLoad > 0"/>
        <Form v-else ref="formDatum" :model="formDatum" :rules="ruleDatum" label-width="auto" @submit.native.prevent>
+            <Alert v-if="isLdap" type="warning">{{$L('LDAP 用户禁止修改邮箱地址')}}</Alert>
            <FormItem :label="$L('新邮箱地址')" prop="newEmail">
                <Input v-if="isRegVerify == 1" v-model="formDatum.newEmail"
                       :class="count > 0 ? 'setting-send-input':'setting-input'" search @on-search="sendEmailCode"
-                       :enter-button="$L(sendBtnText)" :placeholder="$L('输入新邮箱地址')"/>
-                <Input v-else class="setting-input" v-model="formDatum.newEmail" :placeholder="$L('输入新邮箱地址')"/>
+                       :enter-button="$L(sendBtnText)"
+                       :disabled="isLdap"
+                       :placeholder="$L('输入新邮箱地址')"/>
+                <Input v-else class="setting-input" v-model="formDatum.newEmail"
+                       :disabled="isLdap"
+                       :placeholder="$L('输入新邮箱地址')"/>
            </FormItem>
            <FormItem :label="$L('验证码')" prop="code" v-if="isRegVerify == 1">
                <Input v-model="formDatum.code" :placeholder="$L('输入邮箱验证码')"/>
            </FormItem>
        </Form>
        <div class="setting-footer">
-            <Button :loading="loadIng > 0" type="primary" @click="submitForm">{{ $L('提交') }}</Button>
+            <Button :loading="loadIng > 0" type="primary" :disabled="isLdap" @click="submitForm">{{ $L('提交') }}</Button>
            <Button :loading="loadIng > 0" @click="resetForm" style="margin-left: 8px">{{ $L('重置') }}</Button>
        </div>
    </div>
@ -58,6 +63,12 @@ export default {
        this.getRegVerify();
    },

+    computed: {
+        isLdap() {
+            return this.$store.state.userInfo.identity.includes("ldap")
+        }
+    },
+
    methods: {
        sendEmailCode() {
            this.$store.dispatch("call", {