nextcloud/apps/user_ldap/lib/access.php

1369 lines
42 KiB
PHP
Raw Normal View History

<?php
/**
* ownCloud LDAP Access
*
* @author Arthur Schiwon
2013-02-11 00:53:27 +04:00
* @copyright 2012, 2013 Arthur Schiwon blizzz@owncloud.com
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
* License as published by the Free Software Foundation; either
* version 3 of the License, or any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
*
* You should have received a copy of the GNU Affero General Public
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
*
*/
namespace OCA\user_ldap\lib;
2012-04-15 15:37:35 +04:00
/**
* Class Access
* @package OCA\user_ldap\lib
*/
class Access extends LDAPUtility implements user\IUserTools {
public $connection;
public $userManager;
2012-10-26 23:53:56 +04:00
//never ever check this var directly, always use getPagedSearchResultState
protected $pagedSearchedSuccessful;
2013-10-25 16:15:05 +04:00
protected $cookies = array();
public function __construct(Connection $connection, ILDAPWrapper $ldap,
user\Manager $userManager) {
parent::__construct($ldap);
$this->connection = $connection;
$this->userManager = $userManager;
$this->userManager->setLdapAccess($this);
}
/**
* @return bool
*/
private function checkConnection() {
return ($this->connection instanceof Connection);
2012-04-16 20:03:02 +04:00
}
2012-06-07 20:13:41 +04:00
/**
* returns the Connection instance
* @return \OCA\user_ldap\lib\Connection
*/
public function getConnection() {
return $this->connection;
}
/**
* reads a given attribute for an LDAP record identified by a DN
* @param $dn the record in question
* @param $attr the attribute that shall be retrieved
* if empty, just check the record's existence
* @param string $filter
* @return array|false an array of values on success or an empty
* array if $attr is empty, false otherwise
*/
public function readAttribute($dn, $attr, $filter = 'objectClass=*') {
if(!$this->checkConnection()) {
2013-02-15 01:16:48 +04:00
\OCP\Util::writeLog('user_ldap',
'No LDAP Connector assigned, access impossible for readAttribute.',
\OCP\Util::WARN);
return false;
2012-06-07 20:13:41 +04:00
}
$cr = $this->connection->getConnectionResource();
if(!$this->ldap->isResource($cr)) {
//LDAP not available
\OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', \OCP\Util::DEBUG);
return false;
}
2013-10-25 16:15:05 +04:00
//all or nothing! otherwise we get in trouble with.
2012-11-20 20:36:25 +04:00
$dn = $this->DNasBaseParameter($dn);
$rr = @$this->ldap->read($cr, $dn, $filter, array($attr));
if(!$this->ldap->isResource($rr)) {
2013-03-19 03:23:59 +04:00
if(!empty($attr)) {
//do not throw this message on userExists check, irritates
\OCP\Util::writeLog('user_ldap', 'readAttribute failed for DN '.$dn, \OCP\Util::DEBUG);
}
//in case an error occurs , e.g. object does not exist
return false;
}
if (empty($attr)) {
\OCP\Util::writeLog('user_ldap', 'readAttribute: '.$dn.' found', \OCP\Util::DEBUG);
return array();
}
$er = $this->ldap->firstEntry($cr, $rr);
if(!$this->ldap->isResource($er)) {
//did not match the filter, return false
return false;
}
//LDAP attributes are not case sensitive
2013-09-11 21:42:08 +04:00
$result = \OCP\Util::mb_array_change_key_case(
$this->ldap->getAttributes($cr, $er), MB_CASE_LOWER, 'UTF-8');
$attr = mb_strtolower($attr, 'UTF-8');
2012-07-25 15:18:31 +04:00
if(isset($result[$attr]) && $result[$attr]['count'] > 0) {
$values = array();
for($i=0;$i<$result[$attr]['count'];$i++) {
if($this->resemblesDN($attr)) {
$values[] = $this->sanitizeDN($result[$attr][$i]);
} elseif(strtolower($attr) === 'objectguid' || strtolower($attr) === 'guid') {
$values[] = $this->convertObjectGUID2Str($result[$attr][$i]);
} else {
$values[] = $result[$attr][$i];
}
}
return $values;
}
\OCP\Util::writeLog('user_ldap', 'Requested attribute '.$attr.' not found for '.$dn, \OCP\Util::DEBUG);
return false;
2012-04-16 20:03:02 +04:00
}
/**
* checks whether the given attributes value is probably a DN
* @param string $attr the attribute in question
* @return boolean if so true, otherwise false
*/
private function resemblesDN($attr) {
$resemblingAttributes = array(
'dn',
'uniquemember',
'member'
2012-04-16 15:27:20 +04:00
);
return in_array($attr, $resemblingAttributes);
}
/**
* sanitizes a DN received from the LDAP server
* @param array $dn the DN in question
* @return array the sanitized DN
*/
private function sanitizeDN($dn) {
2013-01-04 00:38:53 +04:00
//treating multiple base DNs
if(is_array($dn)) {
$result = array();
foreach($dn as $singleDN) {
2014-05-16 00:47:28 +04:00
$result[] = $this->sanitizeDN($singleDN);
2013-01-04 00:38:53 +04:00
}
return $result;
}
2013-02-15 01:16:48 +04:00
//OID sometimes gives back DNs with whitespace after the comma
// a la "uid=foo, cn=bar, dn=..." We need to tackle this!
2012-07-25 15:18:31 +04:00
$dn = preg_replace('/([^\\\]),(\s+)/u', '\1,', $dn);
//make comparisons and everything work
$dn = mb_strtolower($dn, 'UTF-8');
2012-11-20 16:15:02 +04:00
//escape DN values according to RFC 2253 this is already done by ldap_explode_dn
//to use the DN in search filters, \ needs to be escaped to \5c additionally
//to use them in bases, we convert them back to simple backslashes in readAttribute()
$replacements = array(
'\,' => '\5c2C',
'\=' => '\5c3D',
'\+' => '\5c2B',
'\<' => '\5c3C',
'\>' => '\5c3E',
'\;' => '\5c3B',
'\"' => '\5c22',
'\#' => '\5c23',
'(' => '\28',
')' => '\29',
'*' => '\2A',
);
$dn = str_replace(array_keys($replacements), array_values($replacements), $dn);
return $dn;
}
/**
* gives back the database table for the query
* @param bool $isUser
* @return string
*/
private function getMapTable($isUser) {
if($isUser) {
return '*PREFIX*ldap_user_mapping';
} else {
return '*PREFIX*ldap_group_mapping';
}
}
/**
* returns the LDAP DN for the given internal ownCloud name of the group
* @param string $name the ownCloud name in question
* @return string with the LDAP DN on success, otherwise false
*/
public function groupname2dn($name) {
$dn = $this->ocname2dn($name, false);
if($dn) {
return $dn;
}
return false;
}
/**
* returns the LDAP DN for the given internal ownCloud name of the user
* @param string $name the ownCloud name in question
* @return string with the LDAP DN on success, otherwise false
*/
public function username2dn($name) {
$dn = $this->ocname2dn($name, true);
//Check whether the DN belongs to the Base, to avoid issues on multi-
//server setups
if($dn && $this->isDNPartOfBase($dn, $this->connection->ldapBaseUsers)) {
return $dn;
}
return false;
}
/**
* returns the LDAP DN for the given internal ownCloud name
* @param string $name the ownCloud name in question
* @param boolean $isUser is it a user? otherwise group
* @return string with the LDAP DN on success, otherwise false
*/
private function ocname2dn($name, $isUser) {
$table = $this->getMapTable($isUser);
$query = \OCP\DB::prepare('
SELECT `ldap_dn`
FROM `'.$table.'`
WHERE `owncloud_name` = ?
');
$record = $query->execute(array($name))->fetchOne();
return $record;
}
/**
* returns the internal ownCloud name for the given LDAP DN of the group, false on DN outside of search DN or failure
* @param string $dn the dn of the group object
* @param string $ldapName optional, the display name of the object
* @return string with the name to use in ownCloud, false on DN outside of search DN
*/
public function dn2groupname($dn, $ldapName = null) {
2013-01-08 22:00:49 +04:00
//To avoid bypassing the base DN settings under certain circumstances
//with the group support, check whether the provided DN matches one of
//the given Bases
2013-01-04 00:38:53 +04:00
if(!$this->isDNPartOfBase($dn, $this->connection->ldapBaseGroups)) {
return false;
}
2013-01-04 00:38:53 +04:00
return $this->dn2ocname($dn, $ldapName, false);
}
/**
* returns the internal ownCloud name for the given LDAP DN of the user, false on DN outside of search DN or failure
* @param string $dn the dn of the user object
* @param string $ldapName optional, the display name of the object
* @return string with with the name to use in ownCloud
*/
public function dn2username($dn, $ldapName = null) {
2013-01-08 22:00:49 +04:00
//To avoid bypassing the base DN settings under certain circumstances
//with the group support, check whether the provided DN matches one of
//the given Bases
2013-01-04 00:38:53 +04:00
if(!$this->isDNPartOfBase($dn, $this->connection->ldapBaseUsers)) {
return false;
}
2013-01-04 00:38:53 +04:00
return $this->dn2ocname($dn, $ldapName, true);
}
/**
* returns an internal ownCloud name for the given LDAP DN, false on DN outside of search DN
* @param string $dn the dn of the user object
* @param string $ldapName optional, the display name of the object
* @param bool $isUser optional, whether it is a user object (otherwise group assumed)
* @return string with with the name to use in ownCloud
*/
public function dn2ocname($dn, $ldapName = null, $isUser = true) {
$table = $this->getMapTable($isUser);
if($isUser) {
$fncFindMappedName = 'findMappedUser';
$nameAttribute = $this->connection->ldapUserDisplayName;
} else {
$fncFindMappedName = 'findMappedGroup';
$nameAttribute = $this->connection->ldapGroupDisplayName;
}
//let's try to retrieve the ownCloud name from the mappings table
$ocName = $this->$fncFindMappedName($dn);
if($ocName) {
return $ocName;
}
//second try: get the UUID and check if it is known. Then, update the DN and return the name.
$uuid = $this->getUUID($dn, $isUser);
if($uuid) {
$query = \OCP\DB::prepare('
SELECT `owncloud_name`
FROM `'.$table.'`
WHERE `directory_uuid` = ?
');
$component = $query->execute(array($uuid))->fetchOne();
if($component) {
$query = \OCP\DB::prepare('
UPDATE `'.$table.'`
SET `ldap_dn` = ?
WHERE `directory_uuid` = ?
');
$query->execute(array($dn, $uuid));
return $component;
}
} else {
//If the UUID can't be detected something is foul.
\OCP\Util::writeLog('user_ldap', 'Cannot determine UUID for '.$dn.'. Skipping.', \OCP\Util::INFO);
return false;
}
if(is_null($ldapName)) {
$ldapName = $this->readAttribute($dn, $nameAttribute);
if(!isset($ldapName[0]) && empty($ldapName[0])) {
\OCP\Util::writeLog('user_ldap', 'No or empty name for '.$dn.'.', \OCP\Util::INFO);
return false;
}
$ldapName = $ldapName[0];
}
if($isUser) {
$usernameAttribute = $this->connection->ldapExpertUsernameAttr;
if(!emptY($usernameAttribute)) {
$username = $this->readAttribute($dn, $usernameAttribute);
$username = $username[0];
} else {
$username = $uuid;
}
$intName = $this->sanitizeUsername($username);
} else {
$intName = $ldapName;
}
//a new user/group! Add it only if it doesn't conflict with other backend's users or existing groups
//disabling Cache is required to avoid that the new user is cached as not-existing in fooExists check
$originalTTL = $this->connection->ldapCacheTTL;
$this->connection->setConfiguration(array('ldapCacheTTL' => 0));
if(($isUser && !\OCP\User::userExists($intName))
|| (!$isUser && !\OC_Group::groupExists($intName))) {
if($this->mapComponent($dn, $intName, $isUser)) {
$this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL));
return $intName;
}
}
$this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL));
$altName = $this->createAltInternalOwnCloudName($intName, $isUser);
if($this->mapComponent($dn, $altName, $isUser)) {
return $altName;
}
//if everything else did not help..
\OCP\Util::writeLog('user_ldap', 'Could not create unique name for '.$dn.'.', \OCP\Util::INFO);
return false;
}
/**
* gives back the user names as they are used ownClod internally
* @param array $ldapUsers an array with the ldap Users result in style of array ( array ('dn' => foo, 'uid' => bar), ... )
* @return array an array with the user names to use in ownCloud
*
* gives back the user names as they are used ownClod internally
*/
public function ownCloudUserNames($ldapUsers) {
return $this->ldap2ownCloudNames($ldapUsers, true);
}
/**
* gives back the group names as they are used ownClod internally
* @param array $ldapGroups an array with the ldap Groups result in style of array ( array ('dn' => foo, 'cn' => bar), ... )
* @return array an array with the group names to use in ownCloud
*
* gives back the group names as they are used ownClod internally
*/
public function ownCloudGroupNames($ldapGroups) {
return $this->ldap2ownCloudNames($ldapGroups, false);
}
/**
2014-05-13 15:29:25 +04:00
* @param string $dn
* @return bool|string
*/
private function findMappedUser($dn) {
static $query = null;
if(is_null($query)) {
$query = \OCP\DB::prepare('
SELECT `owncloud_name`
FROM `'.$this->getMapTable(true).'`
WHERE `ldap_dn` = ?'
);
}
$res = $query->execute(array($dn))->fetchOne();
if($res) {
return $res;
}
return false;
}
/**
2014-05-13 15:29:25 +04:00
* @param string $dn
* @return bool|string
*/
private function findMappedGroup($dn) {
2012-12-15 02:16:32 +04:00
static $query = null;
if(is_null($query)) {
$query = \OCP\DB::prepare('
2012-12-15 02:16:32 +04:00
SELECT `owncloud_name`
FROM `'.$this->getMapTable(false).'`
WHERE `ldap_dn` = ?'
);
}
2012-12-15 02:16:32 +04:00
$res = $query->execute(array($dn))->fetchOne();
2012-12-15 02:04:42 +04:00
if($res) {
2012-12-15 02:16:32 +04:00
return $res;
}
return false;
2012-12-15 02:16:32 +04:00
}
/**
2014-05-12 21:31:21 +04:00
* @param array $ldapObjects
* @param bool $isUsers
* @return array
*/
private function ldap2ownCloudNames($ldapObjects, $isUsers) {
if($isUsers) {
$nameAttribute = $this->connection->ldapUserDisplayName;
} else {
$nameAttribute = $this->connection->ldapGroupDisplayName;
}
$ownCloudNames = array();
foreach($ldapObjects as $ldapObject) {
$nameByLDAP = isset($ldapObject[$nameAttribute]) ? $ldapObject[$nameAttribute] : null;
$ocName = $this->dn2ocname($ldapObject['dn'], $nameByLDAP, $isUsers);
if($ocName) {
$ownCloudNames[] = $ocName;
if($isUsers) {
//cache the user names so it does not need to be retrieved
//again later (e.g. sharing dialogue).
$this->cacheUserDisplayName($ocName, $nameByLDAP);
}
}
continue;
}
return $ownCloudNames;
}
/**
* caches the user display name
* @param string $ocName the internal ownCloud username
* @param string $displayName the display name
*/
public function cacheUserDisplayName($ocName, $displayName) {
$cacheKeyTrunk = 'getDisplayName';
$this->connection->writeToCache($cacheKeyTrunk.$ocName, $displayName);
}
/**
* creates a unique name for internal ownCloud use for users. Don't call it directly.
* @param string $name the display name of the object
* @return string with with the name to use in ownCloud or false if unsuccessful
*
* Instead of using this method directly, call
* createAltInternalOwnCloudName($name, true)
*/
private function _createAltInternalOwnCloudNameForUsers($name) {
$attempts = 0;
//while loop is just a precaution. If a name is not generated within
//20 attempts, something else is very wrong. Avoids infinite loop.
while($attempts < 20){
$altName = $name . '_' . rand(1000,9999);
if(!\OCP\User::userExists($altName)) {
return $altName;
}
$attempts++;
}
return false;
}
/**
* creates a unique name for internal ownCloud use for groups. Don't call it directly.
* @param string $name the display name of the object
* @return string with with the name to use in ownCloud or false if unsuccessful.
*
* Instead of using this method directly, call
* createAltInternalOwnCloudName($name, false)
*
* Group names are also used as display names, so we do a sequential
* numbering, e.g. Developers_42 when there are 41 other groups called
* "Developers"
*/
private function _createAltInternalOwnCloudNameForGroups($name) {
$query = \OCP\DB::prepare('
SELECT `owncloud_name`
FROM `'.$this->getMapTable(false).'`
WHERE `owncloud_name` LIKE ?
');
$usedNames = array();
$res = $query->execute(array($name.'_%'));
while($row = $res->fetchRow()) {
$usedNames[] = $row['owncloud_name'];
}
if(!($usedNames) || count($usedNames) === 0) {
$lastNo = 1; //will become name_2
} else {
natsort($usedNames);
$lastName = array_pop($usedNames);
$lastNo = intval(substr($lastName, strrpos($lastName, '_') + 1));
}
$altName = $name.'_'.strval($lastNo+1);
unset($usedNames);
$attempts = 1;
while($attempts < 21){
// Check to be really sure it is unique
// while loop is just a precaution. If a name is not generated within
// 20 attempts, something else is very wrong. Avoids infinite loop.
if(!\OC_Group::groupExists($altName)) {
return $altName;
}
$altName = $name . '_' . $lastNo + $attempts;
$attempts++;
}
return false;
}
/**
* creates a unique name for internal ownCloud use.
* @param string $name the display name of the object
* @param boolean $isUser whether name should be created for a user (true) or a group (false)
* @return string with with the name to use in ownCloud or false if unsuccessful
*/
private function createAltInternalOwnCloudName($name, $isUser) {
$originalTTL = $this->connection->ldapCacheTTL;
$this->connection->setConfiguration(array('ldapCacheTTL' => 0));
if($isUser) {
$altName = $this->_createAltInternalOwnCloudNameForUsers($name);
} else {
$altName = $this->_createAltInternalOwnCloudNameForGroups($name);
}
$this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL));
return $altName;
}
/**
* retrieves all known groups from the mappings table
* @return array with the results
*
* retrieves all known groups from the mappings table
*/
private function mappedGroups() {
return $this->mappedComponents(false);
}
/**
* retrieves all known users from the mappings table
* @return array with the results
*
* retrieves all known users from the mappings table
*/
private function mappedUsers() {
return $this->mappedComponents(true);
}
/**
* @param boolean $isUsers
*/
private function mappedComponents($isUsers) {
$table = $this->getMapTable($isUsers);
$query = \OCP\DB::prepare('
SELECT `ldap_dn`, `owncloud_name`
FROM `'. $table . '`'
);
return $query->execute()->fetchAll();
}
/**
* inserts a new user or group into the mappings table
* @param string $dn the record in question
* @param string $ocName the name to use in ownCloud
* @param bool $isUser is it a user or a group?
* @return bool true on success, false otherwise
*
* inserts a new user or group into the mappings table
*/
private function mapComponent($dn, $ocName, $isUser = true) {
$table = $this->getMapTable($isUser);
$sqlAdjustment = '';
$dbType = \OCP\Config::getSystemValue('dbtype');
if($dbType === 'mysql') {
$sqlAdjustment = 'FROM DUAL';
2012-05-08 15:56:07 +04:00
}
$insert = \OCP\DB::prepare('
INSERT INTO `'.$table.'` (`ldap_dn`, `owncloud_name`, `directory_uuid`)
SELECT ?,?,?
'.$sqlAdjustment.'
WHERE NOT EXISTS (
SELECT 1
FROM `'.$table.'`
WHERE `ldap_dn` = ?
OR `owncloud_name` = ?)
');
//feed the DB
$insRows = $insert->execute(array($dn, $ocName,
$this->getUUID($dn, $isUser), $dn,
$ocName));
2013-06-20 16:47:12 +04:00
if(\OCP\DB::isError($insRows)) {
return false;
}
if($insRows === 0) {
return false;
}
if($isUser) {
//make sure that email address is retrieved prior to login, so user
//will be notified when something is shared with him
2014-06-05 18:16:08 +04:00
$this->userManager->get($ocName)->update();
}
return true;
}
/**
2014-05-13 15:29:25 +04:00
* @param string $filter
2014-05-15 16:12:17 +04:00
* @param string|string[] $attr
* @param int $limit
* @param int $offset
* @return array
*/
2012-10-26 23:53:56 +04:00
public function fetchListOfUsers($filter, $attr, $limit = null, $offset = null) {
return $this->fetchList($this->searchUsers($filter, $attr, $limit, $offset), (count($attr) > 1));
}
/**
2014-05-13 15:29:25 +04:00
* @param string $filter
2014-05-15 16:12:17 +04:00
* @param string|string[] $attr
* @param int $limit
* @param int $offset
* @return array
*/
2012-10-26 23:53:56 +04:00
public function fetchListOfGroups($filter, $attr, $limit = null, $offset = null) {
return $this->fetchList($this->searchGroups($filter, $attr, $limit, $offset), (count($attr) > 1));
}
/**
2014-05-13 15:29:25 +04:00
* @param array $list
* @param bool $manyAttributes
* @return array
*/
private function fetchList($list, $manyAttributes) {
if(is_array($list)) {
if($manyAttributes) {
return $list;
} else {
return array_unique($list, SORT_LOCALE_STRING);
}
}
//error cause actually, maybe throw an exception in future.
return array();
}
/**
* executes an LDAP search, optimized for Users
* @param string $filter the LDAP filter for the search
2014-05-15 16:12:17 +04:00
* @param string|string[] $attr optional, when a certain attribute shall be filtered out
* @param integer $limit
* @param integer $offset
* @return array with the search result
*
* Executes an LDAP search
*/
2012-10-26 23:53:56 +04:00
public function searchUsers($filter, $attr = null, $limit = null, $offset = null) {
return $this->search($filter, $this->connection->ldapBaseUsers, $attr, $limit, $offset);
}
/**
* @param string $filter
2014-05-15 16:12:17 +04:00
* @param string|string[] $attr
* @param int $limit
* @param int $offset
* @return false|int
*/
public function countUsers($filter, $attr = array('dn'), $limit = null, $offset = null) {
return $this->count($filter, $this->connection->ldapBaseUsers, $attr, $limit, $offset);
}
/**
* executes an LDAP search, optimized for Groups
* @param string $filter the LDAP filter for the search
2014-05-15 16:12:17 +04:00
* @param string|string[] $attr optional, when a certain attribute shall be filtered out
* @param integer $limit
* @param integer $offset
* @return array with the search result
*
* Executes an LDAP search
*/
2012-10-26 23:53:56 +04:00
public function searchGroups($filter, $attr = null, $limit = null, $offset = null) {
return $this->search($filter, $this->connection->ldapBaseGroups, $attr, $limit, $offset);
}
2012-04-14 20:26:46 +04:00
/**
* prepares and executes an LDAP search operation
* @param string $filter the LDAP filter for the search
* @param array $base an array containing the LDAP subtree(s) that shall be searched
2014-05-15 16:12:17 +04:00
* @param string|string[] $attr optional, array, one or more attributes that shall be
2013-02-27 01:27:09 +04:00
* retrieved. Results will according to the order in the array.
* @param int $limit optional, maximum results to be counted
* @param int $offset optional, a starting point
* @return array|false array with the search result as first value and pagedSearchOK as
* second | false if not successful
2012-04-14 20:26:46 +04:00
*/
private function executeSearch($filter, $base, &$attr = null, $limit = null, $offset = null) {
if(!is_null($attr) && !is_array($attr)) {
2012-07-02 22:31:07 +04:00
$attr = array(mb_strtolower($attr, 'UTF-8'));
}
2012-10-26 23:53:56 +04:00
// See if we have a resource, in case not cancel with message
$cr = $this->connection->getConnectionResource();
if(!$this->ldap->isResource($cr)) {
// Seems like we didn't find any resource.
// Return an empty array just like before.
\OCP\Util::writeLog('user_ldap', 'Could not search, because resource is missing.', \OCP\Util::DEBUG);
return false;
}
//check whether paged search should be attempted
$pagedSearchOK = $this->initPagedSearch($filter, $base, $attr, $limit, $offset);
2012-10-26 23:53:56 +04:00
$linkResources = array_pad(array(), count($base), $cr);
$sr = $this->ldap->search($linkResources, $base, $filter, $attr);
$error = $this->ldap->errno($cr);
if ($pagedSearchOK) {
$this->ldap->controlPagedResult($cr, 999999, false, "");
}
if(!is_array($sr) || $error !== 0) {
2013-02-15 01:16:48 +04:00
\OCP\Util::writeLog('user_ldap',
'Error when searching: '.$this->ldap->error($cr).
' code '.$this->ldap->errno($cr),
2013-02-15 01:16:48 +04:00
\OCP\Util::ERROR);
\OCP\Util::writeLog('user_ldap', 'Attempt for Paging? '.print_r($pagedSearchOK, true), \OCP\Util::ERROR);
return false;
}
2013-02-27 01:27:09 +04:00
return array($sr, $pagedSearchOK);
}
2013-02-27 01:27:09 +04:00
/**
* processes an LDAP paged search operation
* @param array $sr the array containing the LDAP search resources
* @param string $filter the LDAP filter for the search
* @param array $base an array containing the LDAP subtree(s) that shall be searched
* @param int $iFoundItems number of results in the search operation
* @param int $limit maximum results to be counted
* @param int $offset a starting point
* @param bool $pagedSearchOK whether a paged search has been executed
* @param bool $skipHandling required for paged search when cookies to
* prior results need to be gained
2014-05-11 18:27:18 +04:00
* @return array|false array with the search result as first value and pagedSearchOK as
* second | false if not successful
*/
private function processPagedSearchStatus($sr, $filter, $base, $iFoundItems, $limit, $offset, $pagedSearchOK, $skipHandling) {
2012-10-26 23:53:56 +04:00
if($pagedSearchOK) {
$cr = $this->connection->getConnectionResource();
foreach($sr as $key => $res) {
$cookie = null;
if($this->ldap->controlPagedResultResponse($cr, $res, $cookie)) {
$this->setPagedResultCookie($base[$key], $filter, $limit, $offset, $cookie);
}
}
2012-10-26 23:53:56 +04:00
//browsing through prior pages to get the cookie for the new one
if($skipHandling) {
return;
}
2013-02-15 01:16:48 +04:00
// if count is bigger, then the server does not support
// paged search. Instead, he did a normal search. We set a
// flag here, so the callee knows how to deal with it.
if($iFoundItems <= $limit) {
2012-10-26 23:53:56 +04:00
$this->pagedSearchedSuccessful = true;
}
} else {
if(!is_null($limit)) {
2014-02-05 13:33:44 +04:00
\OCP\Util::writeLog('user_ldap', 'Paged search was not available', \OCP\Util::INFO);
}
2012-10-26 23:53:56 +04:00
}
}
/**
* executes an LDAP search, but counts the results only
* @param string $filter the LDAP filter for the search
* @param array $base an array containing the LDAP subtree(s) that shall be searched
2014-05-15 16:12:17 +04:00
* @param string|string[] $attr optional, array, one or more attributes that shall be
* retrieved. Results will according to the order in the array.
* @param int $limit optional, maximum results to be counted
* @param int $offset optional, a starting point
* @param bool $skipHandling indicates whether the pages search operation is
* completed
2014-05-11 18:27:18 +04:00
* @return int|false Integer or false if the search could not be initialized
*
*/
private function count($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
\OCP\Util::writeLog('user_ldap', 'Count filter: '.print_r($filter, true), \OCP\Util::DEBUG);
if(is_null($limit)) {
$limit = $this->connection->ldapPagingSize;
}
$counter = 0;
2014-03-20 12:14:41 +04:00
$count = null;
$this->connection->getConnectionResource();
do {
$continue = false;
$search = $this->executeSearch($filter, $base, $attr,
$limit, $offset);
if($search === false) {
return $counter > 0 ? $counter : false;
}
list($sr, $pagedSearchOK) = $search;
$count = $this->countEntriesInSearchResults($sr, $limit, $continue);
$counter += $count;
$this->processPagedSearchStatus($sr, $filter, $base, $count, $limit,
$offset, $pagedSearchOK, $skipHandling);
$offset += $limit;
} while($continue);
return $counter;
}
/**
2014-05-13 15:29:25 +04:00
* @param array $searchResults
* @param int $limit
* @param bool $hasHitLimit
* @return int
*/
private function countEntriesInSearchResults($searchResults, $limit, &$hasHitLimit) {
$cr = $this->connection->getConnectionResource();
$counter = 0;
foreach($searchResults as $res) {
$count = intval($this->ldap->countEntries($cr, $res));
$counter += $count;
if($count === $limit) {
$hasHitLimit = true;
}
}
return $counter;
}
/**
* Executes an LDAP search
* @param string $filter the LDAP filter for the search
* @param array $base an array containing the LDAP subtree(s) that shall be searched
2014-05-15 16:12:17 +04:00
* @param string|string[] $attr optional, array, one or more attributes that shall be
* @param int $limit
* @param int $offset
* @param bool $skipHandling
* @return array with the search result
*/
private function search($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
$search = $this->executeSearch($filter, $base, $attr, $limit, $offset);
if($search === false) {
return array();
}
list($sr, $pagedSearchOK) = $search;
$cr = $this->connection->getConnectionResource();
if($skipHandling) {
//i.e. result do not need to be fetched, we just need the cookie
//thus pass 1 or any other value as $iFoundItems because it is not
//used
$this->processPagedSearchStatus($sr, $filter, $base, 1, $limit,
$offset, $pagedSearchOK,
$skipHandling);
return;
}
// Do the server-side sorting
foreach(array_reverse($attr) as $sortAttr){
foreach($sr as $searchResource) {
$this->ldap->sort($cr, $searchResource, $sortAttr);
}
}
$findings = array();
foreach($sr as $res) {
2014-05-16 00:47:28 +04:00
$findings = array_merge($findings, $this->ldap->getEntries($cr , $res ));
}
$this->processPagedSearchStatus($sr, $filter, $base, $findings['count'],
$limit, $offset, $pagedSearchOK,
$skipHandling);
2012-10-26 23:53:56 +04:00
// if we're here, probably no connection resource is returned.
// to make ownCloud behave nicely, we simply give back an empty array.
if(is_null($findings)) {
return array();
}
if(!is_null($attr)) {
$selection = array();
$multiArray = false;
if(count($attr) > 1) {
$multiArray = true;
$i = 0;
}
foreach($findings as $item) {
if(!is_array($item)) {
continue;
}
$item = \OCP\Util::mb_array_change_key_case($item, MB_CASE_LOWER, 'UTF-8');
if($multiArray) {
foreach($attr as $key) {
2012-07-02 22:31:07 +04:00
$key = mb_strtolower($key, 'UTF-8');
if(isset($item[$key])) {
if($key !== 'dn') {
2013-02-15 01:16:48 +04:00
$selection[$i][$key] = $this->resemblesDN($key) ?
$this->sanitizeDN($item[$key][0])
: $item[$key][0];
} else {
$selection[$i][$key] = $this->sanitizeDN($item[$key]);
}
}
}
$i++;
} else {
//tribute to case insensitivity
2012-07-02 22:31:07 +04:00
$key = mb_strtolower($attr[0], 'UTF-8');
if(isset($item[$key])) {
if($this->resemblesDN($key)) {
$selection[] = $this->sanitizeDN($item[$key]);
} else {
$selection[] = $item[$key];
}
}
}
}
$findings = $selection;
}
2012-10-27 19:36:08 +04:00
//we slice the findings, when
//a) paged search unsuccessful, though attempted
2012-10-27 19:36:08 +04:00
//b) no paged search, but limit set
if((!$this->getPagedSearchResultState()
2012-12-15 02:50:21 +04:00
&& $pagedSearchOK)
|| (
2012-10-27 19:36:08 +04:00
!$pagedSearchOK
&& !is_null($limit)
)
) {
$findings = array_slice($findings, intval($offset), $limit);
}
return $findings;
}
/**
2014-05-13 15:29:25 +04:00
* @param string $name
* @return bool|mixed|string
*/
public function sanitizeUsername($name) {
if($this->connection->ldapIgnoreNamingRules) {
return $name;
}
// Transliteration
// latin characters to ASCII
$name = iconv('UTF-8', 'ASCII//TRANSLIT', $name);
// Replacements
$name = \OCP\Util::mb_str_replace(' ', '_', $name, 'UTF-8');
// Every remaining disallowed characters will be removed
2012-07-02 22:31:07 +04:00
$name = preg_replace('/[^a-zA-Z0-9_.@-]/u', '', $name);
return $name;
}
2014-02-19 16:13:01 +04:00
/**
* escapes (user provided) parts for LDAP filter
* @param string $input, the provided value
* @return string the escaped string
2014-02-19 16:13:01 +04:00
*/
public function escapeFilterPart($input) {
$search = array('*', '\\', '(', ')');
$replace = array('\\*', '\\\\', '\\(', '\\)');
return str_replace($search, $replace, $input);
}
2012-04-15 15:37:35 +04:00
/**
* combines the input filters with AND
2014-05-15 16:12:17 +04:00
* @param string[] $filters the filters to connect
* @return string the combined filter
2012-04-15 15:37:35 +04:00
*/
public function combineFilterWithAnd($filters) {
2012-07-25 15:18:31 +04:00
return $this->combineFilter($filters, '&');
2012-04-15 15:37:35 +04:00
}
/**
* combines the input filters with AND
2014-05-15 16:12:17 +04:00
* @param string[] $filters the filters to connect
* @return string the combined filter
2012-04-15 15:37:35 +04:00
*/
public function combineFilterWithOr($filters) {
2012-07-25 15:18:31 +04:00
return $this->combineFilter($filters, '|');
2012-04-15 15:37:35 +04:00
}
/**
* combines the input filters with given operator
2014-05-15 16:12:17 +04:00
* @param string[] $filters the filters to connect
* @param string $operator either & or |
* @return string the combined filter
2012-04-15 15:37:35 +04:00
*/
private function combineFilter($filters, $operator) {
2012-04-15 15:37:35 +04:00
$combinedFilter = '('.$operator;
foreach($filters as $filter) {
2014-05-16 00:47:28 +04:00
if(!empty($filter) && $filter[0] !== '(') {
2012-04-15 15:37:35 +04:00
$filter = '('.$filter.')';
2014-05-16 00:47:28 +04:00
}
$combinedFilter.=$filter;
2012-04-15 15:37:35 +04:00
}
$combinedFilter.=')';
return $combinedFilter;
}
/**
* creates a filter part for to perform search for users
* @param string $search the search term
* @return string the final filter part to use in LDAP searches
*/
public function getFilterPartForUserSearch($search) {
2013-02-15 01:16:48 +04:00
return $this->getFilterPartForSearch($search,
$this->connection->ldapAttributesForUserSearch,
$this->connection->ldapUserDisplayName);
}
/**
* creates a filter part for to perform search for groups
* @param string $search the search term
* @return string the final filter part to use in LDAP searches
*/
public function getFilterPartForGroupSearch($search) {
2013-02-15 01:16:48 +04:00
return $this->getFilterPartForSearch($search,
$this->connection->ldapAttributesForGroupSearch,
$this->connection->ldapGroupDisplayName);
}
/**
* creates a filter part for searches
* @param string $search the search term
2014-05-15 16:12:17 +04:00
* @param string[]|null $searchAttributes
* @param string $fallbackAttribute a fallback attribute in case the user
* did not define search attributes. Typically the display name attribute.
* @return string the final filter part to use in LDAP searches
*/
private function getFilterPartForSearch($search, $searchAttributes, $fallbackAttribute) {
$filter = array();
$search = empty($search) ? '*' : '*'.$search.'*';
if(!is_array($searchAttributes) || count($searchAttributes) === 0) {
if(empty($fallbackAttribute)) {
return '';
}
$filter[] = $fallbackAttribute . '=' . $search;
} else {
foreach($searchAttributes as $attribute) {
$filter[] = $attribute . '=' . $search;
}
}
if(count($filter) === 1) {
return '('.$filter[0].')';
}
return $this->combineFilterWithOr($filter);
}
/**
* @param string $name
* @param string $password
* @return bool
*/
public function areCredentialsValid($name, $password) {
2012-11-20 20:36:25 +04:00
$name = $this->DNasBaseParameter($name);
$testConnection = clone $this->connection;
$credentials = array(
'ldapAgentName' => $name,
'ldapAgentPassword' => $password
);
if(!$testConnection->setConfiguration($credentials)) {
2012-04-16 19:28:58 +04:00
return false;
}
$result=$testConnection->bind();
$this->connection->bind();
return $result;
}
/**
* auto-detects the directory's UUID attribute
* @param string $dn a known DN used to check against
* @param bool $isUser
* @param bool $force the detection should be run, even if it is not set to auto
2014-05-11 18:27:18 +04:00
* @return bool true on success, false otherwise
*/
private function detectUuidAttribute($dn, $isUser = true, $force = false) {
if($isUser) {
$uuidAttr = 'ldapUuidUserAttribute';
$uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
} else {
$uuidAttr = 'ldapUuidGroupAttribute';
$uuidOverride = $this->connection->ldapExpertUUIDGroupAttr;
}
if(($this->connection->$uuidAttr !== 'auto') && !$force) {
return true;
}
if(!empty($uuidOverride) && !$force) {
$this->connection->$uuidAttr = $uuidOverride;
return true;
}
// for now, supported attributes are entryUUID, nsuniqueid, objectGUID, ipaUniqueID
2014-03-21 00:38:06 +04:00
$testAttributes = array('entryuuid', 'nsuniqueid', 'objectguid', 'guid', 'ipauniqueid');
foreach($testAttributes as $attribute) {
2013-02-15 01:16:48 +04:00
$value = $this->readAttribute($dn, $attribute);
if(is_array($value) && isset($value[0]) && !empty($value[0])) {
\OCP\Util::writeLog('user_ldap',
'Setting '.$attribute.' as '.$uuidAttr,
\OCP\Util::DEBUG);
$this->connection->$uuidAttr = $attribute;
return true;
2013-02-15 01:16:48 +04:00
}
}
\OCP\Util::writeLog('user_ldap',
'Could not autodetect the UUID attribute',
\OCP\Util::ERROR);
return false;
}
/**
2014-05-13 15:29:25 +04:00
* @param string $dn
* @param bool $isUser
* @return array|bool|false
*/
public function getUUID($dn, $isUser = true) {
if($isUser) {
$uuidAttr = 'ldapUuidUserAttribute';
$uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
} else {
$uuidAttr = 'ldapUuidGroupAttribute';
$uuidOverride = $this->connection->ldapExpertUUIDGroupAttr;
}
$uuid = false;
if($this->detectUuidAttribute($dn, $isUser)) {
$uuid = $this->readAttribute($dn, $this->connection->$uuidAttr);
if( !is_array($uuid)
&& !empty($uuidOverride)
&& $this->detectUuidAttribute($dn, $isUser, true)) {
$uuid = $this->readAttribute($dn,
$this->connection->$uuidAttr);
}
if(is_array($uuid) && isset($uuid[0]) && !empty($uuid[0])) {
$uuid = $uuid[0];
}
}
return $uuid;
}
2012-10-26 23:53:56 +04:00
/**
* converts a binary ObjectGUID into a string representation
* @param string $oguid the ObjectGUID in it's binary form as retrieved from AD
* @return string
* @link http://www.php.net/manual/en/function.ldap-get-values-len.php#73198
*/
private function convertObjectGUID2Str($oguid) {
$hex_guid = bin2hex($oguid);
$hex_guid_to_guid_str = '';
for($k = 1; $k <= 4; ++$k) {
$hex_guid_to_guid_str .= substr($hex_guid, 8 - 2 * $k, 2);
}
$hex_guid_to_guid_str .= '-';
for($k = 1; $k <= 2; ++$k) {
$hex_guid_to_guid_str .= substr($hex_guid, 12 - 2 * $k, 2);
}
$hex_guid_to_guid_str .= '-';
for($k = 1; $k <= 2; ++$k) {
$hex_guid_to_guid_str .= substr($hex_guid, 16 - 2 * $k, 2);
}
$hex_guid_to_guid_str .= '-' . substr($hex_guid, 16, 4);
$hex_guid_to_guid_str .= '-' . substr($hex_guid, 20);
return strtoupper($hex_guid_to_guid_str);
}
2012-11-20 20:36:25 +04:00
/**
* converts a stored DN so it can be used as base parameter for LDAP queries, internally we store them for usage in LDAP filters
* @param string $dn the DN
* @return string
2012-11-20 20:36:25 +04:00
*/
private function DNasBaseParameter($dn) {
return str_ireplace('\\5c', '\\', $dn);
2012-11-20 20:36:25 +04:00
}
2013-01-04 00:38:53 +04:00
/**
* checks if the given DN is part of the given base DN(s)
* @param string $dn the DN
2014-05-15 16:12:17 +04:00
* @param string[] $bases array containing the allowed base DN or DNs
* @return bool
2013-01-04 00:38:53 +04:00
*/
private function isDNPartOfBase($dn, $bases) {
$belongsToBase = false;
2013-01-04 00:38:53 +04:00
$bases = $this->sanitizeDN($bases);
2013-01-04 00:38:53 +04:00
foreach($bases as $base) {
$belongsToBase = true;
if(mb_strripos($dn, $base, 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8')-mb_strlen($base, 'UTF-8'))) {
2013-01-04 00:38:53 +04:00
$belongsToBase = false;
2013-01-08 22:00:49 +04:00
}
if($belongsToBase) {
2013-01-04 00:38:53 +04:00
break;
2013-01-08 22:00:49 +04:00
}
2013-01-04 00:38:53 +04:00
}
return $belongsToBase;
}
2012-10-26 23:53:56 +04:00
/**
* get a cookie for the next LDAP paged search
* @param string $base a string with the base DN for the search
* @param string $filter the search filter to identify the correct search
* @param int $limit the limit (or 'pageSize'), to identify the correct search well
* @param int $offset the offset for the new search to identify the correct search really good
2014-05-11 18:27:18 +04:00
* @return string containing the key or empty if none is cached
2012-10-26 23:53:56 +04:00
*/
private function getPagedResultCookie($base, $filter, $limit, $offset) {
if($offset === 0) {
2012-10-26 23:53:56 +04:00
return '';
}
$offset -= $limit;
//we work with cache here
$cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' . intval($limit) . '-' . intval($offset);
2013-10-25 16:15:05 +04:00
$cookie = '';
if(isset($this->cookies[$cacheKey])) {
$cookie = $this->cookies[$cacheKey];
2013-10-25 16:15:05 +04:00
if(is_null($cookie)) {
$cookie = '';
}
2012-10-26 23:53:56 +04:00
}
return $cookie;
}
/**
* set a cookie for LDAP paged search run
* @param string $base a string with the base DN for the search
* @param string $filter the search filter to identify the correct search
* @param int $limit the limit (or 'pageSize'), to identify the correct search well
* @param int $offset the offset for the run search to identify the correct search really good
* @param string $cookie string containing the cookie returned by ldap_control_paged_result_response
2012-10-26 23:53:56 +04:00
* @return void
*/
private function setPagedResultCookie($base, $filter, $limit, $offset, $cookie) {
2012-10-26 23:53:56 +04:00
if(!empty($cookie)) {
$cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' .intval($limit) . '-' . intval($offset);
$this->cookies[$cacheKey] = $cookie;
2012-10-26 23:53:56 +04:00
}
}
/**
* Check whether the most recent paged search was successful. It flushed the state var. Use it always after a possible paged search.
* @return boolean|null true on success, null or false otherwise
2012-10-26 23:53:56 +04:00
*/
public function getPagedSearchResultState() {
$result = $this->pagedSearchedSuccessful;
$this->pagedSearchedSuccessful = null;
return $result;
}
/**
* Prepares a paged search, if possible
* @param string $filter the LDAP filter for the search
2014-05-15 16:12:17 +04:00
* @param string[] $bases an array containing the LDAP subtree(s) that shall be searched
* @param string[] $attr optional, when a certain attribute shall be filtered outside
* @param int $limit
* @param int $offset
* @return bool|true
*/
private function initPagedSearch($filter, $bases, $attr, $limit, $offset) {
$pagedSearchOK = false;
if($this->connection->hasPagedResultSupport && !is_null($limit)) {
$offset = intval($offset); //can be null
2013-02-15 01:16:48 +04:00
\OCP\Util::writeLog('user_ldap',
'initializing paged search for Filter '.$filter.' base '.print_r($bases, true)
2013-02-15 01:16:48 +04:00
.' attr '.print_r($attr, true). ' limit ' .$limit.' offset '.$offset,
\OCP\Util::DEBUG);
//get the cookie from the search for the previous search, required by LDAP
foreach($bases as $base) {
$cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
if(empty($cookie) && ($offset > 0)) {
2013-02-15 18:45:34 +04:00
// no cookie known, although the offset is not 0. Maybe cache run out. We need
// to start all over *sigh* (btw, Dear Reader, did you know LDAP paged
2013-02-15 01:16:48 +04:00
// searching was designed by MSFT?)
// Lukas: No, but thanks to reading that source I finally know!
$reOffset = ($offset - $limit) < 0 ? 0 : $offset - $limit;
//a bit recursive, $offset of 0 is the exit
\OCP\Util::writeLog('user_ldap', 'Looking for cookie L/O '.$limit.'/'.$reOffset, \OCP\Util::INFO);
$this->search($filter, array($base), $attr, $limit, $reOffset, true);
$cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
//still no cookie? obviously, the server does not like us. Let's skip paging efforts.
//TODO: remember this, probably does not change in the next request...
if(empty($cookie)) {
$cookie = null;
}
}
if(!is_null($cookie)) {
if($offset > 0) {
\OCP\Util::writeLog('user_ldap', 'Cookie '.CRC32($cookie), \OCP\Util::INFO);
}
$pagedSearchOK = $this->ldap->controlPagedResult(
$this->connection->getConnectionResource(), $limit,
false, $cookie);
if(!$pagedSearchOK) {
return false;
}
\OCP\Util::writeLog('user_ldap', 'Ready for a paged search', \OCP\Util::INFO);
} else {
2013-02-15 01:16:48 +04:00
\OCP\Util::writeLog('user_ldap',
'No paged search for us, Cpt., Limit '.$limit.' Offset '.$offset,
\OCP\Util::INFO);
}
}
}
return $pagedSearchOK;
}
}