nextcloud/apps/user_ldap/group_ldap.php

269 lines
8.1 KiB
PHP
Raw Normal View History

<?php
/**
* ownCloud LDAP group backend
*
* @author Arthur Schiwon
* @copyright 2012 Arthur Schiwon blizzz@owncloud.com
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
* License as published by the Free Software Foundation; either
* version 3 of the License, or any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
*
* You should have received a copy of the GNU Affero General Public
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
*
*/
2012-10-16 19:57:07 +04:00
namespace OCA\user_ldap;
2012-10-16 19:57:07 +04:00
class GROUP_LDAP extends lib\Access implements \OCP\GroupInterface {
protected $enabled = false;
2012-10-16 19:57:07 +04:00
public function setConnector(lib\Connection &$connection) {
parent::setConnector($connection);
if(empty($this->connection->ldapGroupFilter) || empty($this->connection->ldapGroupMemberAssocAttr)) {
$this->enabled = false;
}
2012-10-16 19:57:07 +04:00
$this->enabled = true;
}
/**
* @brief is user in group?
* @param $uid uid of the user
* @param $gid gid of the group
* @returns true/false
*
* Checks whether the user is member of a group or not.
*/
public function inGroup($uid, $gid) {
2012-10-16 19:57:07 +04:00
if(!$this->enabled) {
return false;
}
2012-10-16 19:57:07 +04:00
if($this->connection->isCached('inGroup'.$uid.':'.$gid)) {
return $this->connection->getFromCache('inGroup'.$uid.':'.$gid);
}
2012-10-16 19:57:07 +04:00
$dn_user = $this->username2dn($uid);
$dn_group = $this->groupname2dn($gid);
// just in case
if(!$dn_group || !$dn_user) {
2012-10-16 19:57:07 +04:00
$this->connection->writeToCache('inGroup'.$uid.':'.$gid, false);
return false;
2012-04-15 15:37:35 +04:00
}
//usually, LDAP attributes are said to be case insensitive. But there are exceptions of course.
2012-10-16 19:57:07 +04:00
$members = $this->readAttribute($dn_group, $this->connection->ldapGroupMemberAssocAttr);
if(!$members) {
2012-10-16 19:57:07 +04:00
$this->connection->writeToCache('inGroup'.$uid.':'.$gid, false);
return false;
}
//extra work if we don't get back user DNs
//TODO: this can be done with one LDAP query
2012-10-16 19:57:07 +04:00
if(strtolower($this->connection->ldapGroupMemberAssocAttr) == 'memberuid') {
$dns = array();
foreach($members as $mid) {
2012-10-16 19:57:07 +04:00
$filter = str_replace('%uid', $mid, $this->connection->ldapLoginFilter);
$ldap_users = $this->fetchListOfUsers($filter, 'dn');
if(count($ldap_users) < 1) {
continue;
}
$dns[] = $ldap_users[0];
}
$members = $dns;
}
2012-10-16 19:57:07 +04:00
$isInGroup = in_array($dn_user, $members);
$this->connection->writeToCache('inGroup'.$uid.':'.$gid, $isInGroup);
return $isInGroup;
}
/**
* @brief Get all groups a user belongs to
* @param $uid Name of the user
* @returns array with group names
*
* This function fetches all groups a user belongs to. It does not check
* if the user exists at all.
*/
public function getUserGroups($uid) {
2012-10-16 19:57:07 +04:00
if(!$this->enabled) {
return array();
}
2012-10-16 19:57:07 +04:00
if($this->connection->isCached('getUserGroups'.$uid)) {
return $this->connection->getFromCache('getUserGroups'.$uid);
}
2012-10-16 19:57:07 +04:00
$userDN = $this->username2dn($uid);
if(!$userDN) {
2012-10-16 19:57:07 +04:00
$this->connection->writeToCache('getUserGroups'.$uid, array());
return array();
}
//uniqueMember takes DN, memberuid the uid, so we need to distinguish
2012-10-16 19:57:07 +04:00
if((strtolower($this->connection->ldapGroupMemberAssocAttr) == 'uniquemember')
|| (strtolower($this->connection->ldapGroupMemberAssocAttr) == 'member')
) {
$uid = $userDN;
2012-10-16 19:57:07 +04:00
} else if(strtolower($this->connection->ldapGroupMemberAssocAttr) == 'memberuid') {
$result = $this->readAttribute($userDN, 'uid');
$uid = $result[0];
} else {
// just in case
$uid = $userDN;
}
2012-10-16 19:57:07 +04:00
$filter = $this->combineFilterWithAnd(array(
$this->connection->ldapGroupFilter,
$this->connection->ldapGroupMemberAssocAttr.'='.$uid
));
2012-10-16 19:57:07 +04:00
$groups = $this->fetchListOfGroups($filter, array($this->connection->ldapGroupDisplayName,'dn'));
$groups = array_unique($this->ownCloudGroupNames($groups), SORT_LOCALE_STRING);
$this->connection->writeToCache('getUserGroups'.$uid, $groups);
2012-10-16 19:57:07 +04:00
return $groups;
}
/**
* @brief get a list of all users in a group
* @returns array with user ids
*/
2012-10-16 19:57:07 +04:00
public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
if(!$this->enabled) {
return array();
}
2012-10-16 19:57:07 +04:00
$this->groupSearch = $search;
if($this->connection->isCached('usersInGroup'.$gid)) {
$groupUsers = $this->connection->getFromCache('usersInGroup'.$gid);
if(!empty($this->groupSearch)) {
$groupUsers = array_filter($groupUsers, array($this, 'groupMatchesFilter'));
}
if($limit == -1) {
$limit = null;
}
return array_slice($groupUsers, $offset, $limit);
}
2012-10-16 19:57:07 +04:00
$groupDN = $this->groupname2dn($gid);
if(!$groupDN) {
2012-10-16 19:57:07 +04:00
$this->connection->writeToCache('usersInGroup'.$gid, array());
return array();
}
2012-10-16 19:57:07 +04:00
$members = $this->readAttribute($groupDN, $this->connection->ldapGroupMemberAssocAttr);
if(!$members) {
2012-10-16 19:57:07 +04:00
$this->connection->writeToCache('usersInGroup'.$gid, array());
return array();
}
$result = array();
2012-10-16 19:57:07 +04:00
$isMemberUid = (strtolower($this->connection->ldapGroupMemberAssocAttr) == 'memberuid');
foreach($members as $member) {
if($isMemberUid) {
2012-10-16 19:57:07 +04:00
$filter = \OCP\Util::mb_str_replace('%uid', $member, $this->connection->ldapLoginFilter, 'UTF-8');
$ldap_users = $this->fetchListOfUsers($filter, 'dn');
if(count($ldap_users) < 1) {
continue;
}
2012-10-16 19:57:07 +04:00
$result[] = $this->dn2username($ldap_users[0]);
continue;
} else {
2012-10-16 19:57:07 +04:00
if($ocname = $this->dn2username($member)) {
$result[] = $ocname;
}
}
}
if(!$isMemberUid) {
2012-10-16 19:57:07 +04:00
$result = array_intersect($result, \OCP\User::getUsers());
}
$groupUsers = array_unique($result, SORT_LOCALE_STRING);
$this->connection->writeToCache('usersInGroup'.$gid, $groupUsers);
if(!empty($this->groupSearch)) {
$groupUsers = array_filter($groupUsers, array($this, 'groupMatchesFilter'));
}
if($limit == -1) {
$limit = null;
}
2012-10-16 19:57:07 +04:00
return array_slice($groupUsers, $offset, $limit);
}
/**
* @brief get a list of all groups
* @returns array with group names
*
* Returns a list with all groups
*/
2012-10-16 19:57:07 +04:00
public function getGroups($search = '', $limit = -1, $offset = 0) {
if(!$this->enabled) {
return array();
}
2012-10-16 19:57:07 +04:00
if($this->connection->isCached('getGroups')) {
$ldap_groups = $this->connection->getFromCache('getGroups');
} else {
$ldap_groups = $this->fetchListOfGroups($this->connection->ldapGroupFilter, array($this->connection->ldapGroupDisplayName, 'dn'));
$ldap_groups = $this->ownCloudGroupNames($ldap_groups);
$this->connection->writeToCache('getGroups', $ldap_groups);
}
$this->groupSearch = $search;
if(!empty($this->groupSearch)) {
$ldap_groups = array_filter($ldap_groups, array($this, 'groupMatchesFilter'));
}
if($limit = -1) {
$limit = null;
}
2012-10-16 19:57:07 +04:00
return array_slice($ldap_groups, $offset, $limit);
}
public function groupMatchesFilter($group) {
return (strripos($group, $this->groupSearch) !== false);
}
/**
* check if a group exists
* @param string $gid
* @return bool
*/
2012-10-16 19:57:07 +04:00
public function groupExists($gid) {
if($this->connection->isCached('groupExists'.$gid)) {
return $this->connection->getFromCache('groupExists'.$gid);
}
//getting dn, if false the group does not exist. If dn, it may be mapped only, requires more checking.
$dn = $this->groupname2dn($gid);
if(!$dn) {
$this->connection->writeToCache('groupExists'.$gid, false);
return false;
}
//if group really still exists, we will be able to read its objectclass
$objcs = $this->readAttribute($dn, 'objectclass');
if(!$objcs || empty($objcs)) {
$this->connection->writeToCache('groupExists'.$gid, false);
return false;
}
$this->connection->writeToCache('groupExists'.$gid, true);
return true;
}
/**
* @brief Check if backend implements actions
* @param $actions bitwise-or'ed actions
* @returns boolean
*
* Returns the supported actions as int to be
* compared with OC_USER_BACKEND_CREATE_USER etc.
*/
public function implementsActions($actions) {
//always returns false, because possible actions are modifying actions. We do not write to LDAP, at least for now.
return false;
}
2012-04-15 15:37:35 +04:00
}