nextcloud/apps/user_ldap/lib/wizard.php

1354 lines
39 KiB
PHP
Raw Normal View History

<?php
/**
2015-03-26 13:44:34 +03:00
* @author Alexander Bergolth <leo@strike.wu.ac.at>
* @author Arthur Schiwon <blizzz@owncloud.com>
* @author Bart Visscher <bartv@thisnet.nl>
* @author Jean-Louis Dupond <jean-louis@dupond.be>
* @author Jörn Friedrich Dreyer <jfd@butonic.de>
* @author Lukas Reschke <lukas@owncloud.com>
* @author Morris Jobke <hey@morrisjobke.de>
* @author Robin Appelman <icewind@owncloud.com>
* @author Robin McCorkell <rmccorkell@karoshi.org.uk>
* @author Scrutinizer Auto-Fixer <auto-fixer@scrutinizer-ci.com>
* @author Victor Dubiniuk <dubiniuk@owncloud.com>
*
2015-03-26 13:44:34 +03:00
* @copyright Copyright (c) 2015, ownCloud, Inc.
* @license AGPL-3.0
*
2015-03-26 13:44:34 +03:00
* This code is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License, version 3,
* as published by the Free Software Foundation.
*
2015-03-26 13:44:34 +03:00
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
2015-03-26 13:44:34 +03:00
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
2015-03-26 13:44:34 +03:00
* You should have received a copy of the GNU Affero General Public License, version 3,
* along with this program. If not, see <http://www.gnu.org/licenses/>
*
*/
namespace OCA\user_ldap\lib;
class Wizard extends LDAPUtility {
static protected $l;
protected $access;
protected $cr;
protected $configuration;
protected $result;
protected $resultCache = array();
const LRESULT_PROCESSED_OK = 2;
const LRESULT_PROCESSED_INVALID = 3;
const LRESULT_PROCESSED_SKIP = 4;
const LFILTER_LOGIN = 2;
const LFILTER_USER_LIST = 3;
const LFILTER_GROUP_LIST = 4;
const LFILTER_MODE_ASSISTED = 2;
const LFILTER_MODE_RAW = 1;
const LDAP_NW_TIMEOUT = 4;
/**
* Constructor
* @param Configuration $configuration an instance of Configuration
* @param ILDAPWrapper $ldap an instance of ILDAPWrapper
*/
public function __construct(Configuration $configuration, ILDAPWrapper $ldap, Access $access) {
parent::__construct($ldap);
$this->configuration = $configuration;
if(is_null(Wizard::$l)) {
2014-08-31 12:05:59 +04:00
Wizard::$l = \OC::$server->getL10N('user_ldap');
}
$this->access = $access;
$this->result = new WizardResult();
}
public function __destruct() {
if($this->result->hasChanges()) {
$this->configuration->saveConfiguration();
}
}
/**
* counts entries in the LDAP directory
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
*
* @param string $filter the LDAP search filter
* @param string $type a string being either 'users' or 'groups';
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
* @return bool|int
* @throws \Exception
*/
public function countEntries($filter, $type) {
$reqs = array('ldapHost', 'ldapPort', 'ldapBase');
if($type === 'users') {
$reqs[] = 'ldapUserFilter';
}
if(!$this->checkRequirements($reqs)) {
throw new \Exception('Requirements not met', 400);
}
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
$attr = array('dn'); // default
$limit = 1001;
if($type === 'groups') {
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
$result = $this->access->countGroups($filter, $attr, $limit);
} else if($type === 'users') {
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
$result = $this->access->countUsers($filter, $attr, $limit);
} else if ($type === 'objects') {
$result = $this->access->countObjects($limit);
} else {
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
throw new \Exception('internal error: invalid object type', 500);
}
return $result;
}
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
/**
* formats the return value of a count operation to the string to be
* inserted.
*
* @param bool|int $count
* @return int|string
*/
private function formatCountResult($count) {
$formatted = ($count !== false) ? $count : 0;
if($formatted > 1000) {
$formatted = '> 1000';
}
return $formatted;
}
public function countGroups() {
$filter = $this->configuration->ldapGroupFilter;
if(empty($filter)) {
$output = self::$l->n('%s group found', '%s groups found', 0, array(0));
$this->result->addChange('ldap_group_count', $output);
return $this->result;
}
try {
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
$groupsTotal = $this->formatCountResult($this->countEntries($filter, 'groups'));
} catch (\Exception $e) {
//400 can be ignored, 500 is forwarded
if($e->getCode() === 500) {
throw $e;
}
return false;
}
2015-01-16 21:31:15 +03:00
$output = self::$l->n('%s group found', '%s groups found', $groupsTotal, array($groupsTotal));
$this->result->addChange('ldap_group_count', $output);
return $this->result;
}
/**
* @return WizardResult
* @throws \Exception
*/
public function countUsers() {
$filter = $this->access->getFilterForUserCount();
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
$usersTotal = $this->formatCountResult($this->countEntries($filter, 'users'));
2015-01-16 21:31:15 +03:00
$output = self::$l->n('%s user found', '%s users found', $usersTotal, array($usersTotal));
$this->result->addChange('ldap_user_count', $output);
return $this->result;
}
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
/**
* counts any objects in the currently set base dn
*
* @return WizardResult
* @throws \Exception
*/
public function countInBaseDN() {
// we don't need to provide a filter in this case
$total = $this->countEntries(null, 'objects');
if($total === false) {
throw new \Exception('invalid results received');
}
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
$this->result->addChange('ldap_test_base', $total);
return $this->result;
}
2014-06-25 16:04:06 +04:00
/**
* counts users with a specified attribute
* @param string $attr
* @param bool $existsCheck
2014-06-25 16:04:06 +04:00
* @return int|bool
*/
public function countUsersWithAttribute($attr, $existsCheck = false) {
2014-06-25 16:04:06 +04:00
if(!$this->checkRequirements(array('ldapHost',
'ldapPort',
'ldapBase',
'ldapUserFilter',
))) {
return false;
}
$filter = $this->access->combineFilterWithAnd(array(
2014-06-25 16:04:06 +04:00
$this->configuration->ldapUserFilter,
$attr . '=*'
));
$limit = ($existsCheck === false) ? null : 1;
return $this->access->countUsers($filter, array('dn'), $limit);
2014-06-25 16:04:06 +04:00
}
/**
* detects the display name attribute. If a setting is already present that
* returns at least one hit, the detection will be canceled.
* @return WizardResult|bool
2014-11-20 20:03:47 +03:00
* @throws \Exception
*/
public function detectUserDisplayNameAttribute() {
if(!$this->checkRequirements(array('ldapHost',
'ldapPort',
'ldapBase',
'ldapUserFilter',
))) {
return false;
}
$attr = $this->configuration->ldapUserDisplayName;
if($attr !== 'displayName' && !empty($attr)) {
// most likely not the default value with upper case N,
// verify it still produces a result
$count = intval($this->countUsersWithAttribute($attr, true));
if($count > 0) {
//no change, but we sent it back to make sure the user interface
//is still correct, even if the ajax call was cancelled inbetween
$this->result->addChange('ldap_display_name', $attr);
return $this->result;
}
}
// first attribute that has at least one result wins
$displayNameAttrs = array('displayname', 'cn');
foreach ($displayNameAttrs as $attr) {
$count = intval($this->countUsersWithAttribute($attr, true));
if($count > 0) {
$this->applyFind('ldap_display_name', $attr);
return $this->result;
}
};
2014-11-20 20:03:47 +03:00
throw new \Exception(self::$l->t('Could not detect user display name attribute. Please specify it yourself in advanced ldap settings.'));
}
2014-06-25 16:04:06 +04:00
/**
* detects the most often used email attribute for users applying to the
* user list filter. If a setting is already present that returns at least
* one hit, the detection will be canceled.
* @return WizardResult|bool
2014-06-25 16:04:06 +04:00
*/
public function detectEmailAttribute() {
if(!$this->checkRequirements(array('ldapHost',
'ldapPort',
'ldapBase',
'ldapUserFilter',
))) {
return false;
}
$attr = $this->configuration->ldapEmailAttribute;
if(!empty($attr)) {
$count = intval($this->countUsersWithAttribute($attr, true));
2014-06-25 16:04:06 +04:00
if($count > 0) {
return false;
}
$writeLog = true;
} else {
$writeLog = false;
2014-06-25 16:04:06 +04:00
}
$emailAttributes = array('mail', 'mailPrimaryAddress');
$winner = '';
$maxUsers = 0;
foreach($emailAttributes as $attr) {
$count = $this->countUsersWithAttribute($attr);
if($count > $maxUsers) {
$maxUsers = $count;
$winner = $attr;
}
}
if($winner !== '') {
$this->applyFind('ldap_email_attr', $winner);
if($writeLog) {
\OCP\Util::writeLog('user_ldap', 'The mail attribute has ' .
'automatically been reset, because the original value ' .
'did not return any results.', \OCP\Util::INFO);
}
2014-06-25 16:04:06 +04:00
}
return $this->result;
2014-06-25 16:04:06 +04:00
}
/**
* @return WizardResult
* @throws \Exception
*/
public function determineAttributes() {
if(!$this->checkRequirements(array('ldapHost',
'ldapPort',
'ldapBase',
'ldapUserFilter',
))) {
return false;
}
$attributes = $this->getUserAttributes();
natcasesort($attributes);
$attributes = array_values($attributes);
$this->result->addOptions('ldap_loginfilter_attributes', $attributes);
$selected = $this->configuration->ldapLoginFilterAttributes;
if(is_array($selected) && !empty($selected)) {
$this->result->addChange('ldap_loginfilter_attributes', $selected);
}
return $this->result;
}
/**
* detects the available LDAP attributes
2015-01-16 21:31:15 +03:00
* @return array|false The instance's WizardResult instance
* @throws \Exception
*/
private function getUserAttributes() {
if(!$this->checkRequirements(array('ldapHost',
'ldapPort',
'ldapBase',
'ldapUserFilter',
))) {
return false;
}
$cr = $this->getConnection();
if(!$cr) {
2013-11-01 13:19:44 +04:00
throw new \Exception('Could not connect to LDAP');
}
$base = $this->configuration->ldapBase[0];
$filter = $this->configuration->ldapUserFilter;
$rr = $this->ldap->search($cr, $base, $filter, array(), 1, 1);
if(!$this->ldap->isResource($rr)) {
return false;
}
$er = $this->ldap->firstEntry($cr, $rr);
$attributes = $this->ldap->getAttributes($cr, $er);
$pureAttributes = array();
for($i = 0; $i < $attributes['count']; $i++) {
$pureAttributes[] = $attributes[$i];
}
return $pureAttributes;
}
2013-10-07 19:56:45 +04:00
/**
* detects the available LDAP groups
2015-01-16 21:31:15 +03:00
* @return WizardResult|false the instance's WizardResult instance
2013-10-07 19:56:45 +04:00
*/
public function determineGroupsForGroups() {
return $this->determineGroups('ldap_groupfilter_groups',
'ldapGroupFilterGroups',
false);
}
/**
* detects the available LDAP groups
2015-01-16 21:31:15 +03:00
* @return WizardResult|false the instance's WizardResult instance
*/
public function determineGroupsForUsers() {
return $this->determineGroups('ldap_userfilter_groups',
'ldapUserFilterGroups');
}
/**
* detects the available LDAP groups
* @param string $dbKey
* @param string $confKey
* @param bool $testMemberOf
2015-01-16 21:31:15 +03:00
* @return WizardResult|false the instance's WizardResult instance
* @throws \Exception
*/
private function determineGroups($dbKey, $confKey, $testMemberOf = true) {
if(!$this->checkRequirements(array('ldapHost',
'ldapPort',
'ldapBase',
))) {
return false;
}
$cr = $this->getConnection();
if(!$cr) {
2013-11-01 13:19:44 +04:00
throw new \Exception('Could not connect to LDAP');
}
2014-07-24 16:18:41 +04:00
$groups = $this->fetchGroups($dbKey, $confKey);
2013-10-07 19:56:45 +04:00
if($testMemberOf) {
2014-07-24 16:18:41 +04:00
$this->configuration->hasMemberOfFilterSupport = $this->testMemberOf($groups);
$this->result->markChange();
if(!$this->configuration->hasMemberOfFilterSupport) {
throw new \Exception('memberOf is not supported by the server');
}
}
return $this->result;
}
/**
* fetches all groups from LDAP
* @param string $dbKey
* @param string $confKey
2014-08-11 11:15:56 +04:00
* @return array $groupEntries
*/
public function fetchGroups($dbKey, $confKey) {
$obclasses = array('posixGroup', 'group', 'zimbraDistributionList', 'groupOfNames');
$filterParts = array();
foreach($obclasses as $obclass) {
$filterParts[] = 'objectclass='.$obclass;
}
//we filter for everything
//- that looks like a group and
//- has the group display name set
$filter = $this->access->combineFilterWithOr($filterParts);
$filter = $this->access->combineFilterWithAnd(array($filter, 'cn=*'));
2014-08-11 15:50:13 +04:00
$groupNames = array();
2014-08-11 11:15:56 +04:00
$groupEntries = array();
$limit = 400;
$offset = 0;
do {
// we need to request dn additionally here, otherwise memberOf
// detection will fail later
$result = $this->access->searchGroups($filter, array('cn', 'dn'), $limit, $offset);
foreach($result as $item) {
$groupNames[] = $item['cn'];
2014-08-11 11:15:56 +04:00
$groupEntries[] = $item;
}
$offset += $limit;
2014-08-11 11:15:56 +04:00
} while (count($groupNames) > 0 && count($groupNames) % $limit === 0);
2014-08-11 11:15:56 +04:00
if(count($groupNames) > 0) {
natsort($groupNames);
$this->result->addOptions($dbKey, array_values($groupNames));
} else {
throw new \Exception(self::$l->t('Could not find the desired feature'));
}
$setFeatures = $this->configuration->$confKey;
if(is_array($setFeatures) && !empty($setFeatures)) {
//something is already configured? pre-select it.
$this->result->addChange($dbKey, $setFeatures);
}
2014-08-11 11:15:56 +04:00
return $groupEntries;
}
public function determineGroupMemberAssoc() {
if(!$this->checkRequirements(array('ldapHost',
'ldapPort',
'ldapGroupFilter',
))) {
return false;
}
$attribute = $this->detectGroupMemberAssoc();
if($attribute === false) {
return false;
}
$this->configuration->setConfiguration(array('ldapGroupMemberAssocAttr' => $attribute));
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
$this->result->addChange('ldap_group_member_assoc_attribute', $attribute);
return $this->result;
}
2013-10-07 19:56:45 +04:00
/**
* Detects the available object classes
2015-01-16 21:31:15 +03:00
* @return WizardResult|false the instance's WizardResult instance
* @throws \Exception
2013-10-07 19:56:45 +04:00
*/
public function determineGroupObjectClasses() {
if(!$this->checkRequirements(array('ldapHost',
'ldapPort',
'ldapBase',
))) {
return false;
}
$cr = $this->getConnection();
if(!$cr) {
2013-11-01 13:19:44 +04:00
throw new \Exception('Could not connect to LDAP');
}
$obclasses = array('group', 'posixGroup', '*');
$this->determineFeature($obclasses,
'objectclass',
'ldap_groupfilter_objectclass',
'ldapGroupFilterObjectclass',
false);
return $this->result;
}
/**
* detects the available object classes
* @return WizardResult
* @throws \Exception
*/
public function determineUserObjectClasses() {
if(!$this->checkRequirements(array('ldapHost',
'ldapPort',
'ldapBase',
))) {
return false;
}
$cr = $this->getConnection();
if(!$cr) {
2013-11-01 13:19:44 +04:00
throw new \Exception('Could not connect to LDAP');
}
$obclasses = array('inetOrgPerson', 'person', 'organizationalPerson',
'user', 'posixAccount', '*');
$filter = $this->configuration->ldapUserFilter;
//if filter is empty, it is probably the first time the wizard is called
//then, apply suggestions.
$this->determineFeature($obclasses,
'objectclass',
'ldap_userfilter_objectclass',
'ldapUserFilterObjectclass',
empty($filter));
return $this->result;
}
/**
2015-01-16 21:31:15 +03:00
* @return WizardResult|false
* @throws \Exception
*/
public function getGroupFilter() {
if(!$this->checkRequirements(array('ldapHost',
'ldapPort',
'ldapBase',
))) {
return false;
}
//make sure the use display name is set
$displayName = $this->configuration->ldapGroupDisplayName;
if(empty($displayName)) {
$d = $this->configuration->getDefaults();
$this->applyFind('ldap_group_display_name',
$d['ldap_group_display_name']);
}
$filter = $this->composeLdapFilter(self::LFILTER_GROUP_LIST);
$this->applyFind('ldap_group_filter', $filter);
return $this->result;
}
/**
2015-01-16 21:31:15 +03:00
* @return WizardResult|false
* @throws \Exception
*/
public function getUserListFilter() {
if(!$this->checkRequirements(array('ldapHost',
'ldapPort',
'ldapBase',
))) {
return false;
}
//make sure the use display name is set
$displayName = $this->configuration->ldapUserDisplayName;
if(empty($displayName)) {
$d = $this->configuration->getDefaults();
$this->applyFind('ldap_display_name', $d['ldap_display_name']);
}
$filter = $this->composeLdapFilter(self::LFILTER_USER_LIST);
if(!$filter) {
throw new \Exception('Cannot create filter');
}
$this->applyFind('ldap_userlist_filter', $filter);
return $this->result;
}
/**
* @return bool|WizardResult
* @throws \Exception
*/
public function getUserLoginFilter() {
if(!$this->checkRequirements(array('ldapHost',
'ldapPort',
'ldapBase',
'ldapUserFilter',
))) {
return false;
}
$filter = $this->composeLdapFilter(self::LFILTER_LOGIN);
if(!$filter) {
throw new \Exception('Cannot create filter');
}
$this->applyFind('ldap_login_filter', $filter);
return $this->result;
}
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
/**
* @return bool|WizardResult
* @param string $loginName
* @throws \Exception
*/
public function testLoginName($loginName) {
if(!$this->checkRequirements(array('ldapHost',
'ldapPort',
'ldapBase',
'ldapLoginFilter',
))) {
return false;
}
$cr = $this->access->connection->getConnectionResource();
if(!$this->ldap->isResource($cr)) {
throw new \Exception('connection error');
}
if(mb_strpos($this->access->connection->ldapLoginFilter, '%uid', 0, 'UTF-8')
=== false) {
throw new \Exception('missing placeholder');
}
$users = $this->access->fetchUsersByLoginName($loginName);
if($this->ldap->errno($cr) !== 0) {
throw new \Exception($this->ldap->error($cr));
}
$filter = \OCP\Util::mb_str_replace(
'%uid', $loginName, $this->access->connection->ldapLoginFilter, 'UTF-8');
$this->result->addChange('ldap_test_loginname', count($users));
$this->result->addChange('ldap_test_effective_filter', $filter);
return $this->result;
}
/**
* Tries to determine the port, requires given Host, User DN and Password
2014-05-11 18:27:18 +04:00
* @return WizardResult|false WizardResult on success, false otherwise
* @throws \Exception
*/
public function guessPortAndTLS() {
if(!$this->checkRequirements(array('ldapHost',
))) {
return false;
}
$this->checkHost();
$portSettings = $this->getPortSettingsToTry();
if(!is_array($portSettings)) {
throw new \Exception(print_r($portSettings, true));
}
//proceed from the best configuration and return on first success
foreach($portSettings as $setting) {
$p = $setting['port'];
$t = $setting['tls'];
\OCP\Util::writeLog('user_ldap', 'Wiz: trying port '. $p . ', TLS '. $t, \OCP\Util::DEBUG);
//connectAndBind may throw Exception, it needs to be catched by the
//callee of this method
if($this->connectAndBind($p, $t) === true) {
$config = array('ldapPort' => $p,
'ldapTLS' => intval($t)
);
$this->configuration->setConfiguration($config);
\OCP\Util::writeLog('user_ldap', 'Wiz: detected Port '. $p, \OCP\Util::DEBUG);
$this->result->addChange('ldap_port', $p);
return $this->result;
}
}
//custom port, undetected (we do not brute force)
return false;
}
2013-09-30 01:53:14 +04:00
/**
* tries to determine a base dn from User DN or LDAP Host
* @return WizardResult|false WizardResult on success, false otherwise
2013-09-30 01:53:14 +04:00
*/
public function guessBaseDN() {
if(!$this->checkRequirements(array('ldapHost',
'ldapPort',
))) {
return false;
}
2013-09-30 01:53:14 +04:00
//check whether a DN is given in the agent name (99.9% of all cases)
$base = null;
$i = stripos($this->configuration->ldapAgentName, 'dc=');
if($i !== false) {
$base = substr($this->configuration->ldapAgentName, $i);
if($this->testBaseDN($base)) {
$this->applyFind('ldap_base', $base);
return $this->result;
}
}
//this did not help :(
//Let's see whether we can parse the Host URL and convert the domain to
//a base DN
LDAP User Cleanup: Port from stable7 without further adjustements LDAP User Cleanup background job for user clean up adjust user backend for clean up register background job remove dead code dependency injection make Helper non-static for proper testing check whether it is OK to run clean up job. Do not forget to pass arguments. use correct method to get the config from server methods can be private, proper indirect testing is given no automatic user deletion make limit readable for test purposes make method less complex add first tests let preferences accept limit and offset for getUsersForValue DI via constructor does not work for background jobs after detecting, now we have retrieving deleted users and their details we need this method to be public for now finalize export method, add missing getter clean up namespaces and get rid of unnecessary files helper is not static anymore cleanup according to scrutinizer add cli tool to show deleted users uses are necessary after recent namespace change also remove user from mappings table on deletion add occ command to delete users fix use statement improve output big fixes / improvements PHP doc return true in userExists early for cleaning up deleted users bump version control state and interval with one config.php setting, now ldapUserCleanupInterval. 0 will disable it. enabled by default. improve doc rename cli method to be consistent with others introduce ldapUserCleanupInterval in sample config don't show last login as unix epoche start when no login happend less log output consistent namespace for OfflineUser rename GarbageCollector to DeletedUsersIndex and move it to user subdir fix unit tests add tests for deleteUser more test adjustements Conflicts: apps/user_ldap/ajax/clearMappings.php apps/user_ldap/appinfo/app.php apps/user_ldap/lib/access.php apps/user_ldap/lib/helper.php apps/user_ldap/tests/helper.php core/register_command.php lib/private/preferences.php lib/private/user.php add ldap:check-user to check user existance on the fly Conflicts: apps/user_ldap/lib/helper.php forgotten file PHPdoc fixes, no code change and don't forget to adjust tests
2014-08-21 19:59:13 +04:00
$helper = new Helper();
$domain = $helper->getDomainFromURL($this->configuration->ldapHost);
2013-09-30 01:53:14 +04:00
if(!$domain) {
return false;
}
2013-09-30 01:53:14 +04:00
$dparts = explode('.', $domain);
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
while(count($dparts) > 0) {
$base2 = 'dc=' . implode(',dc=', $dparts);
if ($base !== $base2 && $this->testBaseDN($base2)) {
$this->applyFind('ldap_base', $base2);
return $this->result;
}
array_shift($dparts);
2013-09-30 01:53:14 +04:00
}
return false;
}
/**
* sets the found value for the configuration key in the WizardResult
2013-09-30 01:53:14 +04:00
* as well as in the Configuration instance
* @param string $key the configuration key
* @param string $value the (detected) value
2013-09-30 01:53:14 +04:00
*
*/
private function applyFind($key, $value) {
$this->result->addChange($key, $value);
$this->configuration->setConfiguration(array($key => $value));
}
/**
* Checks, whether a port was entered in the Host configuration
* field. In this case the port will be stripped off, but also stored as
* setting.
*/
private function checkHost() {
$host = $this->configuration->ldapHost;
$hostInfo = parse_url($host);
//removes Port from Host
if(is_array($hostInfo) && isset($hostInfo['port'])) {
$port = $hostInfo['port'];
$host = str_replace(':'.$port, '', $host);
2013-09-30 01:53:14 +04:00
$this->applyFind('ldap_host', $host);
$this->applyFind('ldap_port', $port);
}
}
/**
* tries to detect the group member association attribute which is
* one of 'uniqueMember', 'memberUid', 'member'
* @return string|false, string with the attribute name, false on error
* @throws \Exception
*/
private function detectGroupMemberAssoc() {
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
$possibleAttrs = array('uniqueMember', 'memberUid', 'member');
$filter = $this->configuration->ldapGroupFilter;
if(empty($filter)) {
return false;
}
$cr = $this->getConnection();
if(!$cr) {
2013-11-01 13:19:44 +04:00
throw new \Exception('Could not connect to LDAP');
}
$base = $this->configuration->ldapBase[0];
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
$rr = $this->ldap->search($cr, $base, $filter, $possibleAttrs, 0, 1000);
if(!$this->ldap->isResource($rr)) {
return false;
}
$er = $this->ldap->firstEntry($cr, $rr);
while(is_resource($er)) {
$this->ldap->getDN($cr, $er);
$attrs = $this->ldap->getAttributes($cr, $er);
$result = array();
$possibleAttrsCount = count($possibleAttrs);
for($i = 0; $i < $possibleAttrsCount; $i++) {
if(isset($attrs[$possibleAttrs[$i]])) {
$result[$possibleAttrs[$i]] = $attrs[$possibleAttrs[$i]]['count'];
}
}
if(!empty($result)) {
natsort($result);
return key($result);
}
$er = $this->ldap->nextEntry($cr, $er);
}
return false;
}
2013-09-30 01:53:14 +04:00
/**
* Checks whether for a given BaseDN results will be returned
* @param string $base the BaseDN to test
2013-09-30 01:53:14 +04:00
* @return bool true on success, false otherwise
* @throws \Exception
2013-09-30 01:53:14 +04:00
*/
private function testBaseDN($base) {
$cr = $this->getConnection();
if(!$cr) {
2013-11-01 13:19:44 +04:00
throw new \Exception('Could not connect to LDAP');
2013-09-30 01:53:14 +04:00
}
//base is there, let's validate it. If we search for anything, we should
//get a result set > 0 on a proper base
$rr = $this->ldap->search($cr, $base, 'objectClass=*', array('dn'), 0, 1);
if(!$this->ldap->isResource($rr)) {
$errorNo = $this->ldap->errno($cr);
$errorMsg = $this->ldap->error($cr);
\OCP\Util::writeLog('user_ldap', 'Wiz: Could not search base '.$base.
' Error '.$errorNo.': '.$errorMsg, \OCP\Util::INFO);
2013-09-30 01:53:14 +04:00
return false;
}
2013-09-30 01:53:14 +04:00
$entries = $this->ldap->countEntries($cr, $rr);
return ($entries !== false) && ($entries > 0);
}
2013-10-08 13:19:55 +04:00
/**
* Checks whether the server supports memberOf in LDAP Filter.
2013-10-08 13:19:55 +04:00
* Requires that groups are determined, thus internally called from within
* determineGroups()
2014-08-11 11:15:56 +04:00
* @param array $groups
* @return bool true if it does, false otherwise
* @throws \Exception
2013-10-08 13:19:55 +04:00
*/
2014-07-24 16:18:41 +04:00
private function testMemberOf($groups) {
2013-10-08 13:19:55 +04:00
$cr = $this->getConnection();
if(!$cr) {
2013-11-01 13:19:44 +04:00
throw new \Exception('Could not connect to LDAP');
2013-10-08 13:19:55 +04:00
}
if(!is_array($this->configuration->ldapBase)
|| !isset($this->configuration->ldapBase[0])) {
return false;
}
$base = $this->configuration->ldapBase[0];
$filterPrefix = '(&(objectclass=*)(memberOf=';
$filterSuffix = '))';
2014-08-11 11:15:56 +04:00
foreach($groups as $groupProperties) {
if(!isset($groupProperties['cn'])) {
2013-10-08 13:19:55 +04:00
//assuming only groups have their cn cached :)
continue;
}
2014-08-11 11:15:56 +04:00
$filter = strtolower($filterPrefix . $groupProperties['dn'] . $filterSuffix);
2013-10-08 13:19:55 +04:00
$rr = $this->ldap->search($cr, $base, $filter, array('dn'));
if(!$this->ldap->isResource($rr)) {
continue;
}
$entries = $this->ldap->countEntries($cr, $rr);
//we do not know which groups are empty, so test any and return
//success on the first match that returns at least one user
if(($entries !== false) && ($entries > 0)) {
return true;
}
}
return false;
}
/**
* creates an LDAP Filter from given configuration
* @param integer $filterType int, for which use case the filter shall be created
* can be any of self::LFILTER_USER_LIST, self::LFILTER_LOGIN or
* self::LFILTER_GROUP_LIST
* @return string|false string with the filter on success, false otherwise
* @throws \Exception
*/
private function composeLdapFilter($filterType) {
$filter = '';
$parts = 0;
switch ($filterType) {
case self::LFILTER_USER_LIST:
$objcs = $this->configuration->ldapUserFilterObjectclass;
//glue objectclasses
if(is_array($objcs) && count($objcs) > 0) {
$filter .= '(|';
foreach($objcs as $objc) {
$filter .= '(objectclass=' . $objc . ')';
}
$filter .= ')';
$parts++;
}
//glue group memberships
if($this->configuration->hasMemberOfFilterSupport) {
$cns = $this->configuration->ldapUserFilterGroups;
if(is_array($cns) && count($cns) > 0) {
$filter .= '(|';
$cr = $this->getConnection();
if(!$cr) {
2013-11-01 13:19:44 +04:00
throw new \Exception('Could not connect to LDAP');
}
$base = $this->configuration->ldapBase[0];
foreach($cns as $cn) {
$rr = $this->ldap->search($cr, $base, 'cn=' . $cn, array('dn', 'primaryGroupToken'));
if(!$this->ldap->isResource($rr)) {
continue;
}
$er = $this->ldap->firstEntry($cr, $rr);
$attrs = $this->ldap->getAttributes($cr, $er);
$dn = $this->ldap->getDN($cr, $er);
if(empty($dn)) {
continue;
}
$filterPart = '(memberof=' . $dn . ')';
if(isset($attrs['primaryGroupToken'])) {
$pgt = $attrs['primaryGroupToken'][0];
$primaryFilterPart = '(primaryGroupID=' . $pgt .')';
$filterPart = '(|' . $filterPart . $primaryFilterPart . ')';
}
$filter .= $filterPart;
}
$filter .= ')';
}
$parts++;
}
//wrap parts in AND condition
if($parts > 1) {
$filter = '(&' . $filter . ')';
}
if(empty($filter)) {
$filter = '(objectclass=*)';
}
break;
case self::LFILTER_GROUP_LIST:
$objcs = $this->configuration->ldapGroupFilterObjectclass;
//glue objectclasses
if(is_array($objcs) && count($objcs) > 0) {
$filter .= '(|';
foreach($objcs as $objc) {
$filter .= '(objectclass=' . $objc . ')';
}
$filter .= ')';
$parts++;
}
//glue group memberships
$cns = $this->configuration->ldapGroupFilterGroups;
if(is_array($cns) && count($cns) > 0) {
$filter .= '(|';
$base = $this->configuration->ldapBase[0];
foreach($cns as $cn) {
$filter .= '(cn=' . $cn . ')';
}
$filter .= ')';
}
$parts++;
//wrap parts in AND condition
if($parts > 1) {
$filter = '(&' . $filter . ')';
}
break;
case self::LFILTER_LOGIN:
$ulf = $this->configuration->ldapUserFilter;
$loginpart = '=%uid';
$filterUsername = '';
$userAttributes = $this->getUserAttributes();
$userAttributes = array_change_key_case(array_flip($userAttributes));
$parts = 0;
$x = $this->configuration->ldapLoginFilterUsername;
if($this->configuration->ldapLoginFilterUsername === '1') {
$attr = '';
if(isset($userAttributes['uid'])) {
$attr = 'uid';
} else if(isset($userAttributes['samaccountname'])) {
$attr = 'samaccountname';
} else if(isset($userAttributes['cn'])) {
//fallback
$attr = 'cn';
}
if(!empty($attr)) {
$filterUsername = '(' . $attr . $loginpart . ')';
$parts++;
}
}
$filterEmail = '';
if($this->configuration->ldapLoginFilterEmail === '1') {
$filterEmail = '(|(mailPrimaryAddress=%uid)(mail=%uid))';
$parts++;
}
$filterAttributes = '';
$attrsToFilter = $this->configuration->ldapLoginFilterAttributes;
if(is_array($attrsToFilter) && count($attrsToFilter) > 0) {
$filterAttributes = '(|';
foreach($attrsToFilter as $attribute) {
2014-05-16 00:47:28 +04:00
$filterAttributes .= '(' . $attribute . $loginpart . ')';
}
$filterAttributes .= ')';
$parts++;
}
$filterLogin = '';
if($parts > 1) {
$filterLogin = '(|';
}
$filterLogin .= $filterUsername;
$filterLogin .= $filterEmail;
$filterLogin .= $filterAttributes;
if($parts > 1) {
$filterLogin .= ')';
}
$filter = '(&'.$ulf.$filterLogin.')';
break;
}
\OCP\Util::writeLog('user_ldap', 'Wiz: Final filter '.$filter, \OCP\Util::DEBUG);
return $filter;
}
/**
* Connects and Binds to an LDAP Server
* @param int $port the port to connect with
* @param bool $tls whether startTLS is to be used
* @param bool $ncc
* @return bool
* @throws \Exception
*/
private function connectAndBind($port = 389, $tls = false, $ncc = false) {
if($ncc) {
//No certificate check
//FIXME: undo afterwards
putenv('LDAPTLS_REQCERT=never');
}
//connect, does not really trigger any server communication
\OCP\Util::writeLog('user_ldap', 'Wiz: Checking Host Info ', \OCP\Util::DEBUG);
$host = $this->configuration->ldapHost;
$hostInfo = parse_url($host);
if(!$hostInfo) {
throw new \Exception($this->l->t('Invalid Host'));
}
if(isset($hostInfo['scheme'])) {
if(isset($hostInfo['port'])) {
//problem
} else {
$host .= ':' . $port;
}
}
\OCP\Util::writeLog('user_ldap', 'Wiz: Attempting to connect ', \OCP\Util::DEBUG);
$cr = $this->ldap->connect($host, $port);
if(!is_resource($cr)) {
throw new \Exception($this->l->t('Invalid Host'));
}
\OCP\Util::writeLog('user_ldap', 'Wiz: Setting LDAP Options ', \OCP\Util::DEBUG);
//set LDAP options
2013-12-13 20:52:43 +04:00
$this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
$this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
2013-12-13 20:52:43 +04:00
$this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
if($tls) {
2013-12-13 20:52:19 +04:00
$isTlsWorking = @$this->ldap->startTls($cr);
if(!$isTlsWorking) {
return false;
}
}
\OCP\Util::writeLog('user_ldap', 'Wiz: Attemping to Bind ', \OCP\Util::DEBUG);
//interesting part: do the bind!
$login = $this->ldap->bind($cr,
$this->configuration->ldapAgentName,
$this->configuration->ldapAgentPassword);
if($login === true) {
$this->ldap->unbind($cr);
if($ncc) {
throw new \Exception('Certificate cannot be validated.');
}
\OCP\Util::writeLog('user_ldap', 'Wiz: Bind successful to Port '. $port . ' TLS ' . intval($tls), \OCP\Util::DEBUG);
return true;
}
$errNo = $this->ldap->errno($cr);
$error = ldap_error($cr);
$this->ldap->unbind($cr);
if($errNo === -1 || ($errNo === 2 && $ncc)) {
//host, port or TLS wrong
return false;
} else if ($errNo === 2) {
return $this->connectAndBind($port, $tls, true);
}
throw new \Exception($error);
}
/**
* checks whether a valid combination of agent and password has been
* provided (either two values or nothing for anonymous connect)
* @return bool, true if everything is fine, false otherwise
*/
private function checkAgentRequirements() {
$agent = $this->configuration->ldapAgentName;
$pwd = $this->configuration->ldapAgentPassword;
return ( (!empty($agent) && !empty($pwd))
|| (empty($agent) && empty($pwd)));
}
/**
* @param array $reqs
* @return bool
*/
private function checkRequirements($reqs) {
$this->checkAgentRequirements();
foreach($reqs as $option) {
$value = $this->configuration->$option;
if(empty($value)) {
return false;
}
}
return true;
}
/**
* does a cumulativeSearch on LDAP to get different values of a
* specified attribute
* @param string[] $filters array, the filters that shall be used in the search
* @param string $attr the attribute of which a list of values shall be returned
* @param int $dnReadLimit the amount of how many DNs should be analyzed.
* The lower, the faster
* @param string $maxF string. if not null, this variable will have the filter that
* yields most result entries
* @return array|false an array with the values on success, false otherwise
*/
public function cumulativeSearchOnAttribute($filters, $attr, $dnReadLimit = 3, &$maxF = null) {
$dnRead = array();
$foundItems = array();
$maxEntries = 0;
2013-10-07 20:03:54 +04:00
if(!is_array($this->configuration->ldapBase)
|| !isset($this->configuration->ldapBase[0])) {
return false;
}
$base = $this->configuration->ldapBase[0];
$cr = $this->getConnection();
if(!$this->ldap->isResource($cr)) {
return false;
}
2014-03-21 13:10:49 +04:00
$lastFilter = null;
if(isset($filters[count($filters)-1])) {
$lastFilter = $filters[count($filters)-1];
}
foreach($filters as $filter) {
if($lastFilter === $filter && count($foundItems) > 0) {
//skip when the filter is a wildcard and results were found
continue;
}
LDAP Wizard Overhaul wizard refactor reimplement save spinners and cursor implement Port detector introduced detector queue, added base dn detector disable input fields when detectors are running introduce spinners for fields that are being updated by detector cache jq element objects consolidate processing of detector results in generic / abstract base class display notification if a detector discovered a problem don't run base dn detector if a base is configured reset detector queue on configuration switch implement functionality check and update of status indicator document ConfigModel jsdoc for controller and main view more documentation implement the user filter tab view so far the multiselects get initialized (not filled yet) and the mode can be switched. mode is also restored. reintroduce filter switch confirmation in admin XP mode new detector for user object classes. so we also load user object classes if necessary and are able to save and show the setting. multiselect trigger save actions now on close only show spinners automatically, when a detector is running 20k limit for object classes preselection test adjust wordings, fix grammar add group (for users tab) detector also includes wording fixes error presentation moved from detectors to view, where it belongs add info label to users page missing wording changes show effective LDAP filter in Assisted Mode add user filter detector implement count button for users and limit all count actions to 1001 for performance reasons make port field a bit bigger. not perfect though. do not detect port automatically implement login filter tab view only load features in assisted mode and don't enable assisted fields while in raw mode add tooltips on login filter checkbox options for better understanding permanently show filter on login tab and also compile login filter in assisted mode test/verify button on login attributes tab, with backend changes. only run wizard requests if your an active tab. also run compile filter requests when switching to assisted mode underline toggle filter links to stress that they are clickable unity user and group tab functionality in common abstract class, add group filter tab view. only detectors and template adjustments left to have group tab implementation complete add object class and group detector for groups as well as filter composer show ldap filter permanently on groups tab introduce input element that can deal better with many groups, will be used with > 40 fix disabling complex group chooser while detection is running hide complex group chooser on config switch fix few more issues with complex chooser make complex group chooser available on Users tab as well detect base dn improvements/changes: - do not look for Base DN automatically, offer a button instead - fix for alternative way to detect a base dn (if agent dn is not given) - do not trigger filter composers on config switch Changes with configuration chooser controls - "New" was removed out of the configuration list - and split into buttons "add" and "copy" - delete button is also now an icon add test button for Base DN reimplement advanced tab. The save button is gone. reimplement expert tab remove unused methods implement mail attribute detector implement user display name attribute detection implement member group association detector replace text input with textarea for raw filter input finish functionality check auto-enable good configurations, as it was before cleanup move save confirmation handling to base class, reduces code duplication enable tabs only if no running save processes are left. move onConfigLoaded to base class, avoids code duplication simplify, save LOCs Test Configuration button to be dealt with in main view as it is a cross-tab element require detectorQueue in constructor cleanup put bootstrap into a function and thus make it testable get rid of old stuff
2015-03-03 13:56:03 +03:00
// 20k limit for performance and reason
$rr = $this->ldap->search($cr, $base, $filter, array($attr), 0, 20000);
if(!$this->ldap->isResource($rr)) {
continue;
}
$entries = $this->ldap->countEntries($cr, $rr);
$getEntryFunc = 'firstEntry';
if(($entries !== false) && ($entries > 0)) {
if(!is_null($maxF) && $entries > $maxEntries) {
$maxEntries = $entries;
$maxF = $filter;
}
$dnReadCount = 0;
do {
$entry = $this->ldap->$getEntryFunc($cr, $rr);
$getEntryFunc = 'nextEntry';
if(!$this->ldap->isResource($entry)) {
continue 2;
}
$rr = $entry; //will be expected by nextEntry next round
$attributes = $this->ldap->getAttributes($cr, $entry);
$dn = $this->ldap->getDN($cr, $entry);
if($dn === false || in_array($dn, $dnRead)) {
continue;
}
$newItems = array();
$state = $this->getAttributeValuesFromEntry($attributes,
$attr,
$newItems);
$dnReadCount++;
$foundItems = array_merge($foundItems, $newItems);
$this->resultCache[$dn][$attr] = $newItems;
$dnRead[] = $dn;
} while(($state === self::LRESULT_PROCESSED_SKIP
|| $this->ldap->isResource($entry))
&& ($dnReadLimit === 0 || $dnReadCount < $dnReadLimit));
}
}
return array_unique($foundItems);
}
2013-10-07 19:56:45 +04:00
/**
* determines if and which $attr are available on the LDAP server
* @param string[] $objectclasses the objectclasses to use as search filter
* @param string $attr the attribute to look for
* @param string $dbkey the dbkey of the setting the feature is connected to
* @param string $confkey the confkey counterpart for the $dbkey as used in the
2013-10-07 19:56:45 +04:00
* Configuration class
2014-05-13 15:29:25 +04:00
* @param bool $po whether the objectClass with most result entries
2013-10-07 19:56:45 +04:00
* shall be pre-selected via the result
2015-01-16 21:31:15 +03:00
* @return array|false list of found items.
* @throws \Exception
2013-10-07 19:56:45 +04:00
*/
private function determineFeature($objectclasses, $attr, $dbkey, $confkey, $po = false) {
$cr = $this->getConnection();
if(!$cr) {
2013-11-01 13:19:44 +04:00
throw new \Exception('Could not connect to LDAP');
2013-10-07 19:56:45 +04:00
}
$p = 'objectclass=';
foreach($objectclasses as $key => $value) {
$objectclasses[$key] = $p.$value;
}
$maxEntryObjC = '';
//how deep to dig?
//When looking for objectclasses, testing few entries is sufficient,
$dig = 3;
2013-10-07 19:56:45 +04:00
$availableFeatures =
$this->cumulativeSearchOnAttribute($objectclasses, $attr,
$dig, $maxEntryObjC);
2013-10-07 19:56:45 +04:00
if(is_array($availableFeatures)
&& count($availableFeatures) > 0) {
2013-10-08 13:19:55 +04:00
natcasesort($availableFeatures);
//natcasesort keeps indices, but we must get rid of them for proper
//sorting in the web UI. Therefore: array_values
$this->result->addOptions($dbkey, array_values($availableFeatures));
2013-10-07 19:56:45 +04:00
} else {
throw new \Exception(self::$l->t('Could not find the desired feature'));
}
$setFeatures = $this->configuration->$confkey;
if(is_array($setFeatures) && !empty($setFeatures)) {
//something is already configured? pre-select it.
$this->result->addChange($dbkey, $setFeatures);
} else if($po && !empty($maxEntryObjC)) {
//pre-select objectclass with most result entries
$maxEntryObjC = str_replace($p, '', $maxEntryObjC);
$this->applyFind($dbkey, $maxEntryObjC);
$this->result->addChange($dbkey, $maxEntryObjC);
2013-10-07 19:56:45 +04:00
}
return $availableFeatures;
2013-10-07 19:56:45 +04:00
}
/**
* appends a list of values fr
2014-05-13 15:29:25 +04:00
* @param resource $result the return value from ldap_get_attributes
* @param string $attribute the attribute values to look for
2014-05-13 15:29:25 +04:00
* @param array &$known new values will be appended here
* @return int, state on of the class constants LRESULT_PROCESSED_OK,
* LRESULT_PROCESSED_INVALID or LRESULT_PROCESSED_SKIP
*/
private function getAttributeValuesFromEntry($result, $attribute, &$known) {
if(!is_array($result)
|| !isset($result['count'])
|| !$result['count'] > 0) {
return self::LRESULT_PROCESSED_INVALID;
}
// strtolower on all keys for proper comparison
$result = \OCP\Util::mb_array_change_key_case($result);
$attribute = strtolower($attribute);
if(isset($result[$attribute])) {
foreach($result[$attribute] as $key => $val) {
if($key === 'count') {
continue;
}
if(!in_array($val, $known)) {
$known[] = $val;
}
}
return self::LRESULT_PROCESSED_OK;
} else {
return self::LRESULT_PROCESSED_SKIP;
}
}
/**
* @return bool|mixed
*/
private function getConnection() {
if(!is_null($this->cr)) {
2013-12-03 19:37:11 +04:00
return $this->cr;
}
$cr = $this->ldap->connect(
$this->configuration->ldapHost.':'.$this->configuration->ldapPort,
$this->configuration->ldapPort);
$this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
$this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
$this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
if($this->configuration->ldapTLS === 1) {
$this->ldap->startTls($cr);
}
$lo = @$this->ldap->bind($cr,
$this->configuration->ldapAgentName,
$this->configuration->ldapAgentPassword);
if($lo === true) {
$this->$cr = $cr;
return $cr;
}
return false;
}
/**
* @return array
*/
private function getDefaultLdapPortSettings() {
static $settings = array(
array('port' => 7636, 'tls' => false),
array('port' => 636, 'tls' => false),
array('port' => 7389, 'tls' => true),
array('port' => 389, 'tls' => true),
array('port' => 7389, 'tls' => false),
array('port' => 389, 'tls' => false),
);
return $settings;
}
/**
* @return array
*/
private function getPortSettingsToTry() {
//389 ← LDAP / Unencrypted or StartTLS
//636 ← LDAPS / SSL
//7xxx ← UCS. need to be checked first, because both ports may be open
$host = $this->configuration->ldapHost;
$port = intval($this->configuration->ldapPort);
$portSettings = array();
//In case the port is already provided, we will check this first
if($port > 0) {
$hostInfo = parse_url($host);
if(!(is_array($hostInfo)
&& isset($hostInfo['scheme'])
&& stripos($hostInfo['scheme'], 'ldaps') !== false)) {
$portSettings[] = array('port' => $port, 'tls' => true);
}
$portSettings[] =array('port' => $port, 'tls' => false);
}
//default ports
$portSettings = array_merge($portSettings,
$this->getDefaultLdapPortSettings());
return $portSettings;
}
}