2012-04-14 20:05:29 +04:00
|
|
|
|
<?php
|
|
|
|
|
|
|
|
|
|
/**
|
2012-07-25 14:37:39 +04:00
|
|
|
|
* ownCloud – LDAP Access
|
2012-04-14 20:05:29 +04:00
|
|
|
|
*
|
|
|
|
|
* @author Arthur Schiwon
|
2013-02-11 00:53:27 +04:00
|
|
|
|
* @copyright 2012, 2013 Arthur Schiwon blizzz@owncloud.com
|
2012-04-14 20:05:29 +04:00
|
|
|
|
*
|
|
|
|
|
* This library is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
|
|
|
|
* License as published by the Free Software Foundation; either
|
|
|
|
|
* version 3 of the License, or any later version.
|
|
|
|
|
*
|
|
|
|
|
* This library is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU Affero General Public
|
|
|
|
|
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
*
|
|
|
|
|
*/
|
|
|
|
|
|
2012-07-25 14:37:39 +04:00
|
|
|
|
namespace OCA\user_ldap\lib;
|
2012-04-15 15:37:35 +04:00
|
|
|
|
|
2014-11-05 15:05:07 +03:00
|
|
|
|
use OCA\User_LDAP\Mapping\AbstractMapping;
|
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
/**
|
|
|
|
|
* Class Access
|
|
|
|
|
* @package OCA\user_ldap\lib
|
|
|
|
|
*/
|
2014-03-27 21:01:14 +04:00
|
|
|
|
class Access extends LDAPUtility implements user\IUserTools {
|
2014-07-02 00:02:41 +04:00
|
|
|
|
/**
|
|
|
|
|
* @var \OCA\user_ldap\lib\Connection
|
|
|
|
|
*/
|
2013-09-10 19:11:02 +04:00
|
|
|
|
public $connection;
|
2014-03-27 21:01:14 +04:00
|
|
|
|
public $userManager;
|
2012-10-26 23:53:56 +04:00
|
|
|
|
//never ever check this var directly, always use getPagedSearchResultState
|
|
|
|
|
protected $pagedSearchedSuccessful;
|
|
|
|
|
|
2014-08-19 20:01:58 +04:00
|
|
|
|
/**
|
|
|
|
|
* @var string[] $cookies an array of returned Paged Result cookies
|
|
|
|
|
*/
|
2013-10-25 16:15:05 +04:00
|
|
|
|
protected $cookies = array();
|
|
|
|
|
|
2014-08-19 20:01:58 +04:00
|
|
|
|
/**
|
|
|
|
|
* @var string $lastCookie the last cookie returned from a Paged Results
|
|
|
|
|
* operation, defaults to an empty string
|
|
|
|
|
*/
|
|
|
|
|
protected $lastCookie = '';
|
2014-06-03 15:01:14 +04:00
|
|
|
|
|
2014-11-05 15:05:07 +03:00
|
|
|
|
/**
|
|
|
|
|
* @var AbstractMapping $userMapper
|
|
|
|
|
*/
|
|
|
|
|
protected $userMapper;
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* @var AbstractMapping $userMapper
|
|
|
|
|
*/
|
|
|
|
|
protected $groupMapper;
|
|
|
|
|
|
2014-03-27 21:01:14 +04:00
|
|
|
|
public function __construct(Connection $connection, ILDAPWrapper $ldap,
|
|
|
|
|
user\Manager $userManager) {
|
2013-09-10 19:11:02 +04:00
|
|
|
|
parent::__construct($ldap);
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$this->connection = $connection;
|
2014-03-27 21:01:14 +04:00
|
|
|
|
$this->userManager = $userManager;
|
|
|
|
|
$this->userManager->setLdapAccess($this);
|
2012-07-25 14:37:39 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-11-05 15:05:07 +03:00
|
|
|
|
/**
|
|
|
|
|
* sets the User Mapper
|
|
|
|
|
* @param AbstractMapping $mapper
|
|
|
|
|
*/
|
|
|
|
|
public function setUserMapper(AbstractMapping $mapper) {
|
|
|
|
|
$this->userMapper = $mapper;
|
|
|
|
|
}
|
|
|
|
|
|
2014-12-20 18:09:04 +03:00
|
|
|
|
/**
|
|
|
|
|
* returns the User Mapper
|
|
|
|
|
* @throws \Exception
|
|
|
|
|
* @return AbstractMapping
|
|
|
|
|
*/
|
|
|
|
|
public function getUserMapper() {
|
|
|
|
|
if(is_null($this->userMapper)) {
|
|
|
|
|
throw new \Exception('UserMapper was not assigned to this Access instance.');
|
|
|
|
|
}
|
|
|
|
|
return $this->userMapper;
|
|
|
|
|
}
|
|
|
|
|
|
2014-11-05 15:05:07 +03:00
|
|
|
|
/**
|
|
|
|
|
* sets the Group Mapper
|
|
|
|
|
* @param AbstractMapping $mapper
|
|
|
|
|
*/
|
|
|
|
|
public function setGroupMapper(AbstractMapping $mapper) {
|
|
|
|
|
$this->groupMapper = $mapper;
|
|
|
|
|
}
|
|
|
|
|
|
2014-12-20 18:09:04 +03:00
|
|
|
|
/**
|
|
|
|
|
* returns the Group Mapper
|
|
|
|
|
* @throws \Exception
|
|
|
|
|
* @return AbstractMapping
|
|
|
|
|
*/
|
|
|
|
|
public function getGroupMapper() {
|
|
|
|
|
if(is_null($this->groupMapper)) {
|
|
|
|
|
throw new \Exception('GroupMapper was not assigned to this Access instance.');
|
|
|
|
|
}
|
|
|
|
|
return $this->groupMapper;
|
|
|
|
|
}
|
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
/**
|
|
|
|
|
* @return bool
|
|
|
|
|
*/
|
2012-07-25 14:37:39 +04:00
|
|
|
|
private function checkConnection() {
|
|
|
|
|
return ($this->connection instanceof Connection);
|
2012-04-16 20:03:02 +04:00
|
|
|
|
}
|
2012-06-07 20:13:41 +04:00
|
|
|
|
|
2012-05-17 21:33:38 +04:00
|
|
|
|
/**
|
2014-06-03 15:01:14 +04:00
|
|
|
|
* returns the Connection instance
|
2014-03-27 21:01:14 +04:00
|
|
|
|
* @return \OCA\user_ldap\lib\Connection
|
|
|
|
|
*/
|
|
|
|
|
public function getConnection() {
|
|
|
|
|
return $this->connection;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-06-03 15:01:14 +04:00
|
|
|
|
* reads a given attribute for an LDAP record identified by a DN
|
2014-07-02 00:02:41 +04:00
|
|
|
|
* @param string $dn the record in question
|
|
|
|
|
* @param string $attr the attribute that shall be retrieved
|
2012-11-05 18:38:49 +04:00
|
|
|
|
* if empty, just check the record's existence
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $filter
|
|
|
|
|
* @return array|false an array of values on success or an empty
|
2012-11-05 20:35:09 +04:00
|
|
|
|
* array if $attr is empty, false otherwise
|
2012-05-17 21:33:38 +04:00
|
|
|
|
*/
|
2012-10-27 21:15:13 +04:00
|
|
|
|
public function readAttribute($dn, $attr, $filter = 'objectClass=*') {
|
2012-07-25 14:37:39 +04:00
|
|
|
|
if(!$this->checkConnection()) {
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
|
|
|
|
'No LDAP Connector assigned, access impossible for readAttribute.',
|
|
|
|
|
\OCP\Util::WARN);
|
2012-07-25 14:37:39 +04:00
|
|
|
|
return false;
|
2012-06-07 20:13:41 +04:00
|
|
|
|
}
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$cr = $this->connection->getConnectionResource();
|
2013-08-20 14:39:24 +04:00
|
|
|
|
if(!$this->ldap->isResource($cr)) {
|
2012-07-25 20:40:48 +04:00
|
|
|
|
//LDAP not available
|
2012-08-23 20:29:43 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', \OCP\Util::DEBUG);
|
2012-07-25 20:40:48 +04:00
|
|
|
|
return false;
|
|
|
|
|
}
|
2014-08-19 20:01:58 +04:00
|
|
|
|
//Cancel possibly running Paged Results operation, otherwise we run in
|
|
|
|
|
//LDAP protocol errors
|
|
|
|
|
$this->abandonPagedSearch();
|
2014-09-30 19:00:25 +04:00
|
|
|
|
// openLDAP requires that we init a new Paged Search. Not needed by AD,
|
|
|
|
|
// but does not hurt either.
|
2014-10-01 13:55:53 +04:00
|
|
|
|
$this->initPagedSearch($filter, array($dn), array($attr), 1, 0);
|
2012-11-20 20:36:25 +04:00
|
|
|
|
$dn = $this->DNasBaseParameter($dn);
|
2013-06-12 04:08:02 +04:00
|
|
|
|
$rr = @$this->ldap->read($cr, $dn, $filter, array($attr));
|
2013-08-20 14:39:24 +04:00
|
|
|
|
if(!$this->ldap->isResource($rr)) {
|
2013-03-19 03:23:59 +04:00
|
|
|
|
if(!empty($attr)) {
|
|
|
|
|
//do not throw this message on userExists check, irritates
|
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'readAttribute failed for DN '.$dn, \OCP\Util::DEBUG);
|
|
|
|
|
}
|
2012-07-25 14:54:23 +04:00
|
|
|
|
//in case an error occurs , e.g. object does not exist
|
|
|
|
|
return false;
|
|
|
|
|
}
|
2012-11-05 18:38:49 +04:00
|
|
|
|
if (empty($attr)) {
|
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'readAttribute: '.$dn.' found', \OCP\Util::DEBUG);
|
2012-11-05 20:35:09 +04:00
|
|
|
|
return array();
|
2012-11-05 18:38:49 +04:00
|
|
|
|
}
|
2013-08-20 16:23:49 +04:00
|
|
|
|
$er = $this->ldap->firstEntry($cr, $rr);
|
2013-08-20 14:39:24 +04:00
|
|
|
|
if(!$this->ldap->isResource($er)) {
|
2012-10-27 21:15:13 +04:00
|
|
|
|
//did not match the filter, return false
|
|
|
|
|
return false;
|
|
|
|
|
}
|
2012-07-25 14:37:39 +04:00
|
|
|
|
//LDAP attributes are not case sensitive
|
2013-09-11 21:42:08 +04:00
|
|
|
|
$result = \OCP\Util::mb_array_change_key_case(
|
|
|
|
|
$this->ldap->getAttributes($cr, $er), MB_CASE_LOWER, 'UTF-8');
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$attr = mb_strtolower($attr, 'UTF-8');
|
2012-04-14 20:05:29 +04:00
|
|
|
|
|
2012-07-25 15:18:31 +04:00
|
|
|
|
if(isset($result[$attr]) && $result[$attr]['count'] > 0) {
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$values = array();
|
|
|
|
|
for($i=0;$i<$result[$attr]['count'];$i++) {
|
2012-11-09 02:01:28 +04:00
|
|
|
|
if($this->resemblesDN($attr)) {
|
|
|
|
|
$values[] = $this->sanitizeDN($result[$attr][$i]);
|
2013-04-21 00:45:50 +04:00
|
|
|
|
} elseif(strtolower($attr) === 'objectguid' || strtolower($attr) === 'guid') {
|
2012-11-09 02:01:28 +04:00
|
|
|
|
$values[] = $this->convertObjectGUID2Str($result[$attr][$i]);
|
|
|
|
|
} else {
|
|
|
|
|
$values[] = $result[$attr][$i];
|
|
|
|
|
}
|
2012-07-25 14:37:39 +04:00
|
|
|
|
}
|
|
|
|
|
return $values;
|
|
|
|
|
}
|
2012-08-23 20:29:43 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'Requested attribute '.$attr.' not found for '.$dn, \OCP\Util::DEBUG);
|
2012-07-25 14:37:39 +04:00
|
|
|
|
return false;
|
2012-04-16 20:03:02 +04:00
|
|
|
|
}
|
|
|
|
|
|
2012-04-25 22:34:58 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* checks whether the given attributes value is probably a DN
|
2014-02-06 19:30:58 +04:00
|
|
|
|
* @param string $attr the attribute in question
|
|
|
|
|
* @return boolean if so true, otherwise false
|
2012-04-25 22:34:58 +04:00
|
|
|
|
*/
|
2012-07-25 14:37:39 +04:00
|
|
|
|
private function resemblesDN($attr) {
|
|
|
|
|
$resemblingAttributes = array(
|
|
|
|
|
'dn',
|
|
|
|
|
'uniquemember',
|
|
|
|
|
'member'
|
2012-04-16 15:27:20 +04:00
|
|
|
|
);
|
2012-07-25 14:37:39 +04:00
|
|
|
|
return in_array($attr, $resemblingAttributes);
|
|
|
|
|
}
|
2012-04-15 16:47:33 +04:00
|
|
|
|
|
2014-08-11 18:40:41 +04:00
|
|
|
|
/**
|
|
|
|
|
* checks whether the given string is probably a DN
|
|
|
|
|
* @param string $string
|
|
|
|
|
* @return boolean
|
|
|
|
|
*/
|
|
|
|
|
public function stringResemblesDN($string) {
|
|
|
|
|
$r = $this->ldap->explodeDN($string, 0);
|
|
|
|
|
// if exploding a DN succeeds and does not end up in
|
|
|
|
|
// an empty array except for $r[count] being 0.
|
|
|
|
|
return (is_array($r) && count($r) > 1);
|
|
|
|
|
}
|
|
|
|
|
|
2012-07-25 14:37:39 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* sanitizes a DN received from the LDAP server
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param array $dn the DN in question
|
|
|
|
|
* @return array the sanitized DN
|
2012-07-25 14:37:39 +04:00
|
|
|
|
*/
|
|
|
|
|
private function sanitizeDN($dn) {
|
2013-01-04 00:38:53 +04:00
|
|
|
|
//treating multiple base DNs
|
|
|
|
|
if(is_array($dn)) {
|
|
|
|
|
$result = array();
|
|
|
|
|
foreach($dn as $singleDN) {
|
2014-05-16 00:47:28 +04:00
|
|
|
|
$result[] = $this->sanitizeDN($singleDN);
|
2013-01-04 00:38:53 +04:00
|
|
|
|
}
|
|
|
|
|
return $result;
|
|
|
|
|
}
|
|
|
|
|
|
2013-02-15 01:16:48 +04:00
|
|
|
|
//OID sometimes gives back DNs with whitespace after the comma
|
|
|
|
|
// a la "uid=foo, cn=bar, dn=..." We need to tackle this!
|
2012-07-25 15:18:31 +04:00
|
|
|
|
$dn = preg_replace('/([^\\\]),(\s+)/u', '\1,', $dn);
|
2012-04-25 22:34:58 +04:00
|
|
|
|
|
2012-07-25 14:37:39 +04:00
|
|
|
|
//make comparisons and everything work
|
|
|
|
|
$dn = mb_strtolower($dn, 'UTF-8');
|
|
|
|
|
|
2012-11-20 16:15:02 +04:00
|
|
|
|
//escape DN values according to RFC 2253 – this is already done by ldap_explode_dn
|
|
|
|
|
//to use the DN in search filters, \ needs to be escaped to \5c additionally
|
|
|
|
|
//to use them in bases, we convert them back to simple backslashes in readAttribute()
|
2012-12-01 03:27:48 +04:00
|
|
|
|
$replacements = array(
|
|
|
|
|
'\,' => '\5c2C',
|
|
|
|
|
'\=' => '\5c3D',
|
|
|
|
|
'\+' => '\5c2B',
|
|
|
|
|
'\<' => '\5c3C',
|
|
|
|
|
'\>' => '\5c3E',
|
|
|
|
|
'\;' => '\5c3B',
|
|
|
|
|
'\"' => '\5c22',
|
|
|
|
|
'\#' => '\5c23',
|
2013-03-05 17:33:20 +04:00
|
|
|
|
'(' => '\28',
|
|
|
|
|
')' => '\29',
|
|
|
|
|
'*' => '\2A',
|
2012-12-01 03:27:48 +04:00
|
|
|
|
);
|
2012-12-15 01:52:40 +04:00
|
|
|
|
$dn = str_replace(array_keys($replacements), array_values($replacements), $dn);
|
2012-11-17 02:29:00 +04:00
|
|
|
|
|
2012-07-25 14:37:39 +04:00
|
|
|
|
return $dn;
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-07-02 00:02:41 +04:00
|
|
|
|
/**
|
|
|
|
|
* returns a DN-string that is cleaned from not domain parts, e.g.
|
|
|
|
|
* cn=foo,cn=bar,dc=foobar,dc=server,dc=org
|
|
|
|
|
* becomes dc=foobar,dc=server,dc=org
|
|
|
|
|
* @param string $dn
|
|
|
|
|
* @return string
|
|
|
|
|
*/
|
|
|
|
|
public function getDomainDNFromDN($dn) {
|
|
|
|
|
$allParts = $this->ldap->explodeDN($dn, 0);
|
|
|
|
|
if($allParts === false) {
|
|
|
|
|
//not a valid DN
|
|
|
|
|
return '';
|
|
|
|
|
}
|
|
|
|
|
$domainParts = array();
|
|
|
|
|
$dcFound = false;
|
|
|
|
|
foreach($allParts as $part) {
|
|
|
|
|
if(!$dcFound && strpos($part, 'dc=') === 0) {
|
|
|
|
|
$dcFound = true;
|
|
|
|
|
}
|
|
|
|
|
if($dcFound) {
|
|
|
|
|
$domainParts[] = $part;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
$domainDN = implode(',', $domainParts);
|
|
|
|
|
return $domainDN;
|
|
|
|
|
}
|
|
|
|
|
|
2012-04-25 22:34:58 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* returns the LDAP DN for the given internal ownCloud name of the group
|
2014-02-06 19:30:58 +04:00
|
|
|
|
* @param string $name the ownCloud name in question
|
2014-11-05 15:05:07 +03:00
|
|
|
|
* @return string|false LDAP DN on success, otherwise false
|
2012-04-25 22:34:58 +04:00
|
|
|
|
*/
|
2012-07-25 14:37:39 +04:00
|
|
|
|
public function groupname2dn($name) {
|
2014-11-05 15:05:07 +03:00
|
|
|
|
return $this->groupMapper->getDNbyName($name);
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* returns the LDAP DN for the given internal ownCloud name of the user
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $name the ownCloud name in question
|
|
|
|
|
* @return string with the LDAP DN on success, otherwise false
|
2012-04-25 22:34:58 +04:00
|
|
|
|
*/
|
2012-07-25 14:37:39 +04:00
|
|
|
|
public function username2dn($name) {
|
2014-11-05 15:05:07 +03:00
|
|
|
|
$fdn = $this->userMapper->getDNbyName($name);
|
|
|
|
|
|
2013-11-26 01:08:11 +04:00
|
|
|
|
//Check whether the DN belongs to the Base, to avoid issues on multi-
|
|
|
|
|
//server setups
|
2014-11-05 15:05:07 +03:00
|
|
|
|
if(is_string($fdn) && $this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
|
|
|
|
|
return $fdn;
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-08-21 19:59:13 +04:00
|
|
|
|
public function ocname2dn($name, $isUser) {
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* returns the internal ownCloud name for the given LDAP DN of the group, false on DN outside of search DN or failure
|
2014-11-05 15:05:07 +03:00
|
|
|
|
* @param string $fdn the dn of the group object
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $ldapName optional, the display name of the object
|
|
|
|
|
* @return string with the name to use in ownCloud, false on DN outside of search DN
|
2012-04-25 22:34:58 +04:00
|
|
|
|
*/
|
2014-11-05 15:05:07 +03:00
|
|
|
|
public function dn2groupname($fdn, $ldapName = null) {
|
2013-01-08 22:00:49 +04:00
|
|
|
|
//To avoid bypassing the base DN settings under certain circumstances
|
|
|
|
|
//with the group support, check whether the provided DN matches one of
|
|
|
|
|
//the given Bases
|
2014-11-05 15:05:07 +03:00
|
|
|
|
if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseGroups)) {
|
2012-06-19 03:15:58 +04:00
|
|
|
|
return false;
|
|
|
|
|
}
|
2013-01-04 00:38:53 +04:00
|
|
|
|
|
2014-11-05 15:05:07 +03:00
|
|
|
|
return $this->dn2ocname($fdn, $ldapName, false);
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* returns the internal ownCloud name for the given LDAP DN of the user, false on DN outside of search DN or failure
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $dn the dn of the user object
|
|
|
|
|
* @param string $ldapName optional, the display name of the object
|
|
|
|
|
* @return string with with the name to use in ownCloud
|
2012-04-25 22:34:58 +04:00
|
|
|
|
*/
|
2014-11-05 15:05:07 +03:00
|
|
|
|
public function dn2username($fdn, $ldapName = null) {
|
2013-01-08 22:00:49 +04:00
|
|
|
|
//To avoid bypassing the base DN settings under certain circumstances
|
|
|
|
|
//with the group support, check whether the provided DN matches one of
|
|
|
|
|
//the given Bases
|
2014-11-05 15:05:07 +03:00
|
|
|
|
if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
|
2012-06-19 03:15:58 +04:00
|
|
|
|
return false;
|
|
|
|
|
}
|
2013-01-04 00:38:53 +04:00
|
|
|
|
|
2014-11-05 15:05:07 +03:00
|
|
|
|
return $this->dn2ocname($fdn, $ldapName, true);
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
|
2012-07-25 14:37:39 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* returns an internal ownCloud name for the given LDAP DN, false on DN outside of search DN
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $dn the dn of the user object
|
|
|
|
|
* @param string $ldapName optional, the display name of the object
|
|
|
|
|
* @param bool $isUser optional, whether it is a user object (otherwise group assumed)
|
|
|
|
|
* @return string with with the name to use in ownCloud
|
2012-07-25 14:37:39 +04:00
|
|
|
|
*/
|
2014-11-05 15:05:07 +03:00
|
|
|
|
public function dn2ocname($fdn, $ldapName = null, $isUser = true) {
|
2012-04-25 22:34:58 +04:00
|
|
|
|
if($isUser) {
|
2014-12-20 18:09:04 +03:00
|
|
|
|
$mapper = $this->getUserMapper();
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$nameAttribute = $this->connection->ldapUserDisplayName;
|
2012-04-25 22:34:58 +04:00
|
|
|
|
} else {
|
2014-12-20 18:09:04 +03:00
|
|
|
|
$mapper = $this->getGroupMapper();
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$nameAttribute = $this->connection->ldapGroupDisplayName;
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
|
2012-08-23 20:29:43 +04:00
|
|
|
|
//let's try to retrieve the ownCloud name from the mappings table
|
2014-11-05 15:05:07 +03:00
|
|
|
|
$ocName = $mapper->getNameByDN($fdn);
|
|
|
|
|
if(is_string($ocName)) {
|
2014-05-11 17:17:27 +04:00
|
|
|
|
return $ocName;
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
|
2012-08-23 20:29:43 +04:00
|
|
|
|
//second try: get the UUID and check if it is known. Then, update the DN and return the name.
|
2014-11-05 15:05:07 +03:00
|
|
|
|
$uuid = $this->getUUID($fdn, $isUser);
|
|
|
|
|
if(is_string($uuid)) {
|
|
|
|
|
$ocName = $mapper->getNameByUUID($uuid);
|
|
|
|
|
if(is_string($ocName)) {
|
|
|
|
|
$mapper->setDNbyUUID($fdn, $uuid);
|
|
|
|
|
return $ocName;
|
2012-08-23 20:29:43 +04:00
|
|
|
|
}
|
2013-02-11 00:52:57 +04:00
|
|
|
|
} else {
|
|
|
|
|
//If the UUID can't be detected something is foul.
|
2014-11-05 15:05:07 +03:00
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'Cannot determine UUID for '.$fdn.'. Skipping.', \OCP\Util::INFO);
|
2013-02-11 00:52:57 +04:00
|
|
|
|
return false;
|
2012-08-23 20:29:43 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
if(is_null($ldapName)) {
|
2014-11-05 15:05:07 +03:00
|
|
|
|
$ldapName = $this->readAttribute($fdn, $nameAttribute);
|
2014-05-11 17:17:27 +04:00
|
|
|
|
if(!isset($ldapName[0]) && empty($ldapName[0])) {
|
2014-11-05 15:05:07 +03:00
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'No or empty name for '.$fdn.'.', \OCP\Util::INFO);
|
2012-07-30 19:42:33 +04:00
|
|
|
|
return false;
|
|
|
|
|
}
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$ldapName = $ldapName[0];
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
2013-05-08 16:56:52 +04:00
|
|
|
|
|
|
|
|
|
if($isUser) {
|
|
|
|
|
$usernameAttribute = $this->connection->ldapExpertUsernameAttr;
|
2014-11-05 15:05:07 +03:00
|
|
|
|
if(!empty($usernameAttribute)) {
|
|
|
|
|
$username = $this->readAttribute($fdn, $usernameAttribute);
|
2013-05-08 16:56:52 +04:00
|
|
|
|
$username = $username[0];
|
|
|
|
|
} else {
|
|
|
|
|
$username = $uuid;
|
|
|
|
|
}
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$intName = $this->sanitizeUsername($username);
|
2013-05-08 16:56:52 +04:00
|
|
|
|
} else {
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$intName = $ldapName;
|
2013-05-08 16:56:52 +04:00
|
|
|
|
}
|
2012-04-25 22:34:58 +04:00
|
|
|
|
|
2012-12-06 21:11:14 +04:00
|
|
|
|
//a new user/group! Add it only if it doesn't conflict with other backend's users or existing groups
|
2013-02-11 00:52:57 +04:00
|
|
|
|
//disabling Cache is required to avoid that the new user is cached as not-existing in fooExists check
|
2014-11-28 14:08:33 +03:00
|
|
|
|
//NOTE: mind, disabling cache affects only this instance! Using it
|
|
|
|
|
// outside of core user management will still cache the user as non-existing.
|
2013-02-11 00:52:57 +04:00
|
|
|
|
$originalTTL = $this->connection->ldapCacheTTL;
|
|
|
|
|
$this->connection->setConfiguration(array('ldapCacheTTL' => 0));
|
2014-05-11 17:17:27 +04:00
|
|
|
|
if(($isUser && !\OCP\User::userExists($intName))
|
|
|
|
|
|| (!$isUser && !\OC_Group::groupExists($intName))) {
|
2014-11-05 15:05:07 +03:00
|
|
|
|
if($mapper->map($fdn, $intName, $uuid)) {
|
2013-02-11 00:52:57 +04:00
|
|
|
|
$this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL));
|
2014-05-11 17:17:27 +04:00
|
|
|
|
return $intName;
|
2012-08-29 03:23:36 +04:00
|
|
|
|
}
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
2013-02-11 00:52:57 +04:00
|
|
|
|
$this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL));
|
2012-04-25 22:34:58 +04:00
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$altName = $this->createAltInternalOwnCloudName($intName, $isUser);
|
2014-11-05 15:05:07 +03:00
|
|
|
|
if(is_string($altName) && $mapper->map($fdn, $altName, $uuid)) {
|
2014-05-11 17:17:27 +04:00
|
|
|
|
return $altName;
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
|
2012-07-30 19:42:33 +04:00
|
|
|
|
//if everything else did not help..
|
2014-11-05 15:05:07 +03:00
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'Could not create unique name for '.$fdn.'.', \OCP\Util::INFO);
|
2012-08-29 03:23:36 +04:00
|
|
|
|
return false;
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* gives back the user names as they are used ownClod internally
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param array $ldapUsers an array with the ldap Users result in style of array ( array ('dn' => foo, 'uid' => bar), ... )
|
|
|
|
|
* @return array an array with the user names to use in ownCloud
|
2012-04-25 22:34:58 +04:00
|
|
|
|
*
|
|
|
|
|
* gives back the user names as they are used ownClod internally
|
|
|
|
|
*/
|
2012-07-25 14:37:39 +04:00
|
|
|
|
public function ownCloudUserNames($ldapUsers) {
|
|
|
|
|
return $this->ldap2ownCloudNames($ldapUsers, true);
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* gives back the group names as they are used ownClod internally
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param array $ldapGroups an array with the ldap Groups result in style of array ( array ('dn' => foo, 'cn' => bar), ... )
|
|
|
|
|
* @return array an array with the group names to use in ownCloud
|
2012-04-25 22:34:58 +04:00
|
|
|
|
*
|
|
|
|
|
* gives back the group names as they are used ownClod internally
|
|
|
|
|
*/
|
2012-07-25 14:37:39 +04:00
|
|
|
|
public function ownCloudGroupNames($ldapGroups) {
|
|
|
|
|
return $this->ldap2ownCloudNames($ldapGroups, false);
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-02-06 19:30:58 +04:00
|
|
|
|
/**
|
2014-05-12 21:31:21 +04:00
|
|
|
|
* @param array $ldapObjects
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param bool $isUsers
|
|
|
|
|
* @return array
|
2014-02-06 19:30:58 +04:00
|
|
|
|
*/
|
2012-07-25 14:37:39 +04:00
|
|
|
|
private function ldap2ownCloudNames($ldapObjects, $isUsers) {
|
2012-04-25 22:34:58 +04:00
|
|
|
|
if($isUsers) {
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$nameAttribute = $this->connection->ldapUserDisplayName;
|
2012-04-25 22:34:58 +04:00
|
|
|
|
} else {
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$nameAttribute = $this->connection->ldapGroupDisplayName;
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
$ownCloudNames = array();
|
|
|
|
|
|
|
|
|
|
foreach($ldapObjects as $ldapObject) {
|
2012-10-15 19:16:47 +04:00
|
|
|
|
$nameByLDAP = isset($ldapObject[$nameAttribute]) ? $ldapObject[$nameAttribute] : null;
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$ocName = $this->dn2ocname($ldapObject['dn'], $nameByLDAP, $isUsers);
|
|
|
|
|
if($ocName) {
|
|
|
|
|
$ownCloudNames[] = $ocName;
|
2014-04-16 19:16:51 +04:00
|
|
|
|
if($isUsers) {
|
|
|
|
|
//cache the user names so it does not need to be retrieved
|
|
|
|
|
//again later (e.g. sharing dialogue).
|
2014-11-28 14:08:33 +03:00
|
|
|
|
$this->cacheUserExists($ocName);
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$this->cacheUserDisplayName($ocName, $nameByLDAP);
|
2014-04-16 19:16:51 +04:00
|
|
|
|
}
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
2012-08-29 03:23:36 +04:00
|
|
|
|
continue;
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
return $ownCloudNames;
|
|
|
|
|
}
|
|
|
|
|
|
2014-11-28 14:08:33 +03:00
|
|
|
|
/**
|
|
|
|
|
* caches a user as existing
|
|
|
|
|
* @param string $ocName the internal ownCloud username
|
|
|
|
|
*/
|
|
|
|
|
public function cacheUserExists($ocName) {
|
|
|
|
|
$this->connection->writeToCache('userExists'.$ocName, true);
|
|
|
|
|
}
|
|
|
|
|
|
2014-04-16 19:16:51 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* caches the user display name
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $ocName the internal ownCloud username
|
|
|
|
|
* @param string $displayName the display name
|
2014-04-16 19:16:51 +04:00
|
|
|
|
*/
|
2014-05-11 17:17:27 +04:00
|
|
|
|
public function cacheUserDisplayName($ocName, $displayName) {
|
2014-04-16 14:56:08 +04:00
|
|
|
|
$cacheKeyTrunk = 'getDisplayName';
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$this->connection->writeToCache($cacheKeyTrunk.$ocName, $displayName);
|
2014-04-16 14:56:08 +04:00
|
|
|
|
}
|
|
|
|
|
|
2012-04-25 22:34:58 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* creates a unique name for internal ownCloud use for users. Don't call it directly.
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $name the display name of the object
|
|
|
|
|
* @return string with with the name to use in ownCloud or false if unsuccessful
|
2013-02-11 00:52:57 +04:00
|
|
|
|
*
|
|
|
|
|
* Instead of using this method directly, call
|
|
|
|
|
* createAltInternalOwnCloudName($name, true)
|
|
|
|
|
*/
|
|
|
|
|
private function _createAltInternalOwnCloudNameForUsers($name) {
|
|
|
|
|
$attempts = 0;
|
|
|
|
|
//while loop is just a precaution. If a name is not generated within
|
|
|
|
|
//20 attempts, something else is very wrong. Avoids infinite loop.
|
|
|
|
|
while($attempts < 20){
|
2013-05-30 16:14:43 +04:00
|
|
|
|
$altName = $name . '_' . rand(1000,9999);
|
|
|
|
|
if(!\OCP\User::userExists($altName)) {
|
2013-02-11 00:52:57 +04:00
|
|
|
|
return $altName;
|
|
|
|
|
}
|
|
|
|
|
$attempts++;
|
|
|
|
|
}
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* creates a unique name for internal ownCloud use for groups. Don't call it directly.
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $name the display name of the object
|
|
|
|
|
* @return string with with the name to use in ownCloud or false if unsuccessful.
|
2013-02-11 00:52:57 +04:00
|
|
|
|
*
|
|
|
|
|
* Instead of using this method directly, call
|
|
|
|
|
* createAltInternalOwnCloudName($name, false)
|
2012-04-25 22:34:58 +04:00
|
|
|
|
*
|
2013-02-11 00:52:57 +04:00
|
|
|
|
* Group names are also used as display names, so we do a sequential
|
|
|
|
|
* numbering, e.g. Developers_42 when there are 41 other groups called
|
|
|
|
|
* "Developers"
|
|
|
|
|
*/
|
|
|
|
|
private function _createAltInternalOwnCloudNameForGroups($name) {
|
2014-11-05 15:05:07 +03:00
|
|
|
|
$usedNames = $this->groupMapper->getNamesBySearch($name.'_%');
|
2013-04-21 00:45:50 +04:00
|
|
|
|
if(!($usedNames) || count($usedNames) === 0) {
|
2013-02-11 00:52:57 +04:00
|
|
|
|
$lastNo = 1; //will become name_2
|
|
|
|
|
} else {
|
|
|
|
|
natsort($usedNames);
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$lastName = array_pop($usedNames);
|
|
|
|
|
$lastNo = intval(substr($lastName, strrpos($lastName, '_') + 1));
|
2013-02-11 00:52:57 +04:00
|
|
|
|
}
|
|
|
|
|
$altName = $name.'_'.strval($lastNo+1);
|
|
|
|
|
unset($usedNames);
|
|
|
|
|
|
|
|
|
|
$attempts = 1;
|
|
|
|
|
while($attempts < 21){
|
2014-05-11 17:17:27 +04:00
|
|
|
|
// Check to be really sure it is unique
|
|
|
|
|
// while loop is just a precaution. If a name is not generated within
|
|
|
|
|
// 20 attempts, something else is very wrong. Avoids infinite loop.
|
2013-02-11 00:52:57 +04:00
|
|
|
|
if(!\OC_Group::groupExists($altName)) {
|
|
|
|
|
return $altName;
|
|
|
|
|
}
|
2014-07-02 00:02:41 +04:00
|
|
|
|
$altName = $name . '_' . ($lastNo + $attempts);
|
2013-02-11 00:52:57 +04:00
|
|
|
|
$attempts++;
|
|
|
|
|
}
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* creates a unique name for internal ownCloud use.
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $name the display name of the object
|
2014-02-06 19:30:58 +04:00
|
|
|
|
* @param boolean $isUser whether name should be created for a user (true) or a group (false)
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return string with with the name to use in ownCloud or false if unsuccessful
|
2012-04-25 22:34:58 +04:00
|
|
|
|
*/
|
2013-02-11 00:52:57 +04:00
|
|
|
|
private function createAltInternalOwnCloudName($name, $isUser) {
|
|
|
|
|
$originalTTL = $this->connection->ldapCacheTTL;
|
|
|
|
|
$this->connection->setConfiguration(array('ldapCacheTTL' => 0));
|
|
|
|
|
if($isUser) {
|
|
|
|
|
$altName = $this->_createAltInternalOwnCloudNameForUsers($name);
|
|
|
|
|
} else {
|
|
|
|
|
$altName = $this->_createAltInternalOwnCloudNameForGroups($name);
|
|
|
|
|
}
|
|
|
|
|
$this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL));
|
|
|
|
|
|
|
|
|
|
return $altName;
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-02-06 19:30:58 +04:00
|
|
|
|
/**
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param string $filter
|
2014-05-15 16:12:17 +04:00
|
|
|
|
* @param string|string[] $attr
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param int $limit
|
|
|
|
|
* @param int $offset
|
|
|
|
|
* @return array
|
2014-02-06 19:30:58 +04:00
|
|
|
|
*/
|
2012-10-26 23:53:56 +04:00
|
|
|
|
public function fetchListOfUsers($filter, $attr, $limit = null, $offset = null) {
|
|
|
|
|
return $this->fetchList($this->searchUsers($filter, $attr, $limit, $offset), (count($attr) > 1));
|
2012-05-04 01:38:55 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-02-06 19:30:58 +04:00
|
|
|
|
/**
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param string $filter
|
2014-05-15 16:12:17 +04:00
|
|
|
|
* @param string|string[] $attr
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param int $limit
|
|
|
|
|
* @param int $offset
|
|
|
|
|
* @return array
|
2014-02-06 19:30:58 +04:00
|
|
|
|
*/
|
2012-10-26 23:53:56 +04:00
|
|
|
|
public function fetchListOfGroups($filter, $attr, $limit = null, $offset = null) {
|
|
|
|
|
return $this->fetchList($this->searchGroups($filter, $attr, $limit, $offset), (count($attr) > 1));
|
2012-05-04 01:38:55 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-02-06 19:30:58 +04:00
|
|
|
|
/**
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param array $list
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param bool $manyAttributes
|
|
|
|
|
* @return array
|
2014-02-06 19:30:58 +04:00
|
|
|
|
*/
|
2012-07-25 14:37:39 +04:00
|
|
|
|
private function fetchList($list, $manyAttributes) {
|
2012-05-04 01:38:55 +04:00
|
|
|
|
if(is_array($list)) {
|
|
|
|
|
if($manyAttributes) {
|
|
|
|
|
return $list;
|
|
|
|
|
} else {
|
|
|
|
|
return array_unique($list, SORT_LOCALE_STRING);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
//error cause actually, maybe throw an exception in future.
|
|
|
|
|
return array();
|
|
|
|
|
}
|
|
|
|
|
|
2012-04-23 15:04:58 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* executes an LDAP search, optimized for Users
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $filter the LDAP filter for the search
|
2014-05-15 16:12:17 +04:00
|
|
|
|
* @param string|string[] $attr optional, when a certain attribute shall be filtered out
|
2014-02-19 12:31:54 +04:00
|
|
|
|
* @param integer $limit
|
|
|
|
|
* @param integer $offset
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return array with the search result
|
2012-04-23 15:04:58 +04:00
|
|
|
|
*
|
|
|
|
|
* Executes an LDAP search
|
|
|
|
|
*/
|
2012-10-26 23:53:56 +04:00
|
|
|
|
public function searchUsers($filter, $attr = null, $limit = null, $offset = null) {
|
|
|
|
|
return $this->search($filter, $this->connection->ldapBaseUsers, $attr, $limit, $offset);
|
2012-04-23 15:04:58 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-02-06 19:30:58 +04:00
|
|
|
|
/**
|
|
|
|
|
* @param string $filter
|
2014-05-15 16:12:17 +04:00
|
|
|
|
* @param string|string[] $attr
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param int $limit
|
|
|
|
|
* @param int $offset
|
|
|
|
|
* @return false|int
|
2014-02-06 19:30:58 +04:00
|
|
|
|
*/
|
2014-01-08 15:07:57 +04:00
|
|
|
|
public function countUsers($filter, $attr = array('dn'), $limit = null, $offset = null) {
|
2014-03-20 03:21:51 +04:00
|
|
|
|
return $this->count($filter, $this->connection->ldapBaseUsers, $attr, $limit, $offset);
|
2014-01-08 15:07:57 +04:00
|
|
|
|
}
|
|
|
|
|
|
2012-04-23 15:04:58 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* executes an LDAP search, optimized for Groups
|
2014-02-19 12:31:54 +04:00
|
|
|
|
* @param string $filter the LDAP filter for the search
|
2014-05-15 16:12:17 +04:00
|
|
|
|
* @param string|string[] $attr optional, when a certain attribute shall be filtered out
|
2014-02-19 12:31:54 +04:00
|
|
|
|
* @param integer $limit
|
|
|
|
|
* @param integer $offset
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return array with the search result
|
2012-04-23 15:04:58 +04:00
|
|
|
|
*
|
|
|
|
|
* Executes an LDAP search
|
|
|
|
|
*/
|
2012-10-26 23:53:56 +04:00
|
|
|
|
public function searchGroups($filter, $attr = null, $limit = null, $offset = null) {
|
|
|
|
|
return $this->search($filter, $this->connection->ldapBaseGroups, $attr, $limit, $offset);
|
2012-04-23 15:04:58 +04:00
|
|
|
|
}
|
|
|
|
|
|
2012-04-14 20:26:46 +04:00
|
|
|
|
/**
|
2014-06-11 15:35:35 +04:00
|
|
|
|
* returns the number of available groups
|
|
|
|
|
* @param string $filter the LDAP search filter
|
|
|
|
|
* @param string[] $attr optional
|
|
|
|
|
* @param int|null $limit
|
|
|
|
|
* @param int|null $offset
|
|
|
|
|
* @return int|bool
|
|
|
|
|
*/
|
|
|
|
|
public function countGroups($filter, $attr = array('dn'), $limit = null, $offset = null) {
|
|
|
|
|
return $this->count($filter, $this->connection->ldapBaseGroups, $attr, $limit, $offset);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2013-02-27 01:27:09 +04:00
|
|
|
|
* retrieved. Results will according to the order in the array.
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param int $limit optional, maximum results to be counted
|
|
|
|
|
* @param int $offset optional, a starting point
|
|
|
|
|
* @return array|false array with the search result as first value and pagedSearchOK as
|
2014-01-08 15:07:57 +04:00
|
|
|
|
* second | false if not successful
|
2012-04-14 20:26:46 +04:00
|
|
|
|
*/
|
2014-01-08 15:07:57 +04:00
|
|
|
|
private function executeSearch($filter, $base, &$attr = null, $limit = null, $offset = null) {
|
2012-04-25 22:34:58 +04:00
|
|
|
|
if(!is_null($attr) && !is_array($attr)) {
|
2012-07-02 22:31:07 +04:00
|
|
|
|
$attr = array(mb_strtolower($attr, 'UTF-8'));
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
2012-05-28 17:54:38 +04:00
|
|
|
|
|
2012-10-26 23:53:56 +04:00
|
|
|
|
// See if we have a resource, in case not cancel with message
|
2014-01-08 15:07:57 +04:00
|
|
|
|
$cr = $this->connection->getConnectionResource();
|
|
|
|
|
if(!$this->ldap->isResource($cr)) {
|
2012-05-28 17:54:38 +04:00
|
|
|
|
// Seems like we didn't find any resource.
|
|
|
|
|
// Return an empty array just like before.
|
2012-07-25 14:37:39 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'Could not search, because resource is missing.', \OCP\Util::DEBUG);
|
2014-01-08 15:07:57 +04:00
|
|
|
|
return false;
|
2012-05-01 14:17:33 +04:00
|
|
|
|
}
|
2012-04-14 20:05:29 +04:00
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
//check whether paged search should be attempted
|
2014-11-21 16:51:20 +03:00
|
|
|
|
$pagedSearchOK = $this->initPagedSearch($filter, $base, $attr, intval($limit), $offset);
|
2012-10-26 23:53:56 +04:00
|
|
|
|
|
2014-01-08 15:07:57 +04:00
|
|
|
|
$linkResources = array_pad(array(), count($base), $cr);
|
2013-06-12 04:08:02 +04:00
|
|
|
|
$sr = $this->ldap->search($linkResources, $base, $filter, $attr);
|
2014-01-08 15:07:57 +04:00
|
|
|
|
$error = $this->ldap->errno($cr);
|
2013-04-21 00:45:50 +04:00
|
|
|
|
if(!is_array($sr) || $error !== 0) {
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
2014-01-08 15:07:57 +04:00
|
|
|
|
'Error when searching: '.$this->ldap->error($cr).
|
|
|
|
|
' code '.$this->ldap->errno($cr),
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::ERROR);
|
2012-10-27 19:35:39 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'Attempt for Paging? '.print_r($pagedSearchOK, true), \OCP\Util::ERROR);
|
2014-01-08 15:07:57 +04:00
|
|
|
|
return false;
|
2012-10-27 19:35:39 +04:00
|
|
|
|
}
|
2013-02-27 01:27:09 +04:00
|
|
|
|
|
2014-01-08 15:07:57 +04:00
|
|
|
|
return array($sr, $pagedSearchOK);
|
|
|
|
|
}
|
2013-02-27 01:27:09 +04:00
|
|
|
|
|
2014-01-08 15:07:57 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* processes an LDAP paged search operation
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param array $sr the array containing the LDAP search resources
|
|
|
|
|
* @param string $filter the LDAP filter for the search
|
|
|
|
|
* @param array $base an array containing the LDAP subtree(s) that shall be searched
|
|
|
|
|
* @param int $iFoundItems number of results in the search operation
|
|
|
|
|
* @param int $limit maximum results to be counted
|
|
|
|
|
* @param int $offset a starting point
|
|
|
|
|
* @param bool $pagedSearchOK whether a paged search has been executed
|
|
|
|
|
* @param bool $skipHandling required for paged search when cookies to
|
2014-01-08 15:07:57 +04:00
|
|
|
|
* prior results need to be gained
|
2014-05-11 18:27:18 +04:00
|
|
|
|
* @return array|false array with the search result as first value and pagedSearchOK as
|
2014-01-08 15:07:57 +04:00
|
|
|
|
* second | false if not successful
|
|
|
|
|
*/
|
|
|
|
|
private function processPagedSearchStatus($sr, $filter, $base, $iFoundItems, $limit, $offset, $pagedSearchOK, $skipHandling) {
|
2012-10-26 23:53:56 +04:00
|
|
|
|
if($pagedSearchOK) {
|
2014-01-08 15:07:57 +04:00
|
|
|
|
$cr = $this->connection->getConnectionResource();
|
2013-01-05 02:54:42 +04:00
|
|
|
|
foreach($sr as $key => $res) {
|
|
|
|
|
$cookie = null;
|
2014-01-08 15:07:57 +04:00
|
|
|
|
if($this->ldap->controlPagedResultResponse($cr, $res, $cookie)) {
|
2013-01-05 02:54:42 +04:00
|
|
|
|
$this->setPagedResultCookie($base[$key], $filter, $limit, $offset, $cookie);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2012-10-26 23:53:56 +04:00
|
|
|
|
//browsing through prior pages to get the cookie for the new one
|
|
|
|
|
if($skipHandling) {
|
|
|
|
|
return;
|
|
|
|
|
}
|
2013-02-15 01:16:48 +04:00
|
|
|
|
// if count is bigger, then the server does not support
|
|
|
|
|
// paged search. Instead, he did a normal search. We set a
|
|
|
|
|
// flag here, so the callee knows how to deal with it.
|
2014-01-08 15:07:57 +04:00
|
|
|
|
if($iFoundItems <= $limit) {
|
2012-10-26 23:53:56 +04:00
|
|
|
|
$this->pagedSearchedSuccessful = true;
|
|
|
|
|
}
|
|
|
|
|
} else {
|
2013-01-05 02:54:42 +04:00
|
|
|
|
if(!is_null($limit)) {
|
2014-02-05 13:33:44 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'Paged search was not available', \OCP\Util::INFO);
|
2013-01-05 02:54:42 +04:00
|
|
|
|
}
|
2012-10-26 23:53:56 +04:00
|
|
|
|
}
|
2014-01-08 15:07:57 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* executes an LDAP search, but counts the results only
|
2014-02-19 12:31:54 +04:00
|
|
|
|
* @param string $filter the LDAP filter for the search
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param array $base an array containing the LDAP subtree(s) that shall be searched
|
2014-05-15 16:12:17 +04:00
|
|
|
|
* @param string|string[] $attr optional, array, one or more attributes that shall be
|
2014-01-08 15:07:57 +04:00
|
|
|
|
* retrieved. Results will according to the order in the array.
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param int $limit optional, maximum results to be counted
|
|
|
|
|
* @param int $offset optional, a starting point
|
|
|
|
|
* @param bool $skipHandling indicates whether the pages search operation is
|
2014-01-08 15:07:57 +04:00
|
|
|
|
* completed
|
2014-05-11 18:27:18 +04:00
|
|
|
|
* @return int|false Integer or false if the search could not be initialized
|
2014-01-08 15:07:57 +04:00
|
|
|
|
*
|
|
|
|
|
*/
|
|
|
|
|
private function count($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
|
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'Count filter: '.print_r($filter, true), \OCP\Util::DEBUG);
|
2014-03-20 03:21:51 +04:00
|
|
|
|
|
2014-11-21 16:51:20 +03:00
|
|
|
|
$limitPerPage = intval($this->connection->ldapPagingSize);
|
|
|
|
|
if(!is_null($limit) && $limit < $limitPerPage && $limit > 0) {
|
|
|
|
|
$limitPerPage = $limit;
|
2014-01-08 15:07:57 +04:00
|
|
|
|
}
|
2014-03-20 03:21:51 +04:00
|
|
|
|
|
2014-01-08 15:07:57 +04:00
|
|
|
|
$counter = 0;
|
2014-03-20 12:14:41 +04:00
|
|
|
|
$count = null;
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$this->connection->getConnectionResource();
|
2014-03-20 03:21:51 +04:00
|
|
|
|
|
|
|
|
|
do {
|
2014-03-20 13:59:58 +04:00
|
|
|
|
$continue = false;
|
2014-03-20 03:21:51 +04:00
|
|
|
|
$search = $this->executeSearch($filter, $base, $attr,
|
2014-10-29 12:24:48 +03:00
|
|
|
|
$limitPerPage, $offset);
|
2014-03-20 03:21:51 +04:00
|
|
|
|
if($search === false) {
|
|
|
|
|
return $counter > 0 ? $counter : false;
|
|
|
|
|
}
|
|
|
|
|
list($sr, $pagedSearchOK) = $search;
|
|
|
|
|
|
2014-10-29 12:24:48 +03:00
|
|
|
|
$count = $this->countEntriesInSearchResults($sr, $limitPerPage, $continue);
|
2014-03-20 14:38:05 +04:00
|
|
|
|
$counter += $count;
|
2014-01-08 15:07:57 +04:00
|
|
|
|
|
2014-10-29 12:24:48 +03:00
|
|
|
|
$this->processPagedSearchStatus($sr, $filter, $base, $count, $limitPerPage,
|
2014-01-08 15:07:57 +04:00
|
|
|
|
$offset, $pagedSearchOK, $skipHandling);
|
2014-10-29 12:24:48 +03:00
|
|
|
|
$offset += $limitPerPage;
|
|
|
|
|
} while($continue && (is_null($limit) || $limit <= 0 || $limit > $counter));
|
2014-01-08 15:07:57 +04:00
|
|
|
|
|
|
|
|
|
return $counter;
|
|
|
|
|
}
|
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
/**
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param array $searchResults
|
|
|
|
|
* @param int $limit
|
|
|
|
|
* @param bool $hasHitLimit
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return int
|
|
|
|
|
*/
|
|
|
|
|
private function countEntriesInSearchResults($searchResults, $limit, &$hasHitLimit) {
|
2014-03-20 14:38:05 +04:00
|
|
|
|
$cr = $this->connection->getConnectionResource();
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$counter = 0;
|
2014-03-20 14:38:05 +04:00
|
|
|
|
|
|
|
|
|
foreach($searchResults as $res) {
|
|
|
|
|
$count = intval($this->ldap->countEntries($cr, $res));
|
|
|
|
|
$counter += $count;
|
2014-11-11 14:15:30 +03:00
|
|
|
|
if($count > 0 && $count === $limit) {
|
2014-03-20 14:38:05 +04:00
|
|
|
|
$hasHitLimit = true;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return $counter;
|
|
|
|
|
}
|
|
|
|
|
|
2014-01-08 15:07:57 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* Executes an LDAP search
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $filter the LDAP filter for the search
|
|
|
|
|
* @param array $base an array containing the LDAP subtree(s) that shall be searched
|
2014-05-15 16:12:17 +04:00
|
|
|
|
* @param string|string[] $attr optional, array, one or more attributes that shall be
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param int $limit
|
|
|
|
|
* @param int $offset
|
|
|
|
|
* @param bool $skipHandling
|
|
|
|
|
* @return array with the search result
|
2014-01-08 15:07:57 +04:00
|
|
|
|
*/
|
|
|
|
|
private function search($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
|
2014-07-02 00:02:41 +04:00
|
|
|
|
if($limit <= 0) {
|
|
|
|
|
//otherwise search will fail
|
|
|
|
|
$limit = null;
|
|
|
|
|
}
|
2014-01-08 15:07:57 +04:00
|
|
|
|
$search = $this->executeSearch($filter, $base, $attr, $limit, $offset);
|
|
|
|
|
if($search === false) {
|
|
|
|
|
return array();
|
|
|
|
|
}
|
|
|
|
|
list($sr, $pagedSearchOK) = $search;
|
|
|
|
|
$cr = $this->connection->getConnectionResource();
|
|
|
|
|
|
|
|
|
|
if($skipHandling) {
|
|
|
|
|
//i.e. result do not need to be fetched, we just need the cookie
|
|
|
|
|
//thus pass 1 or any other value as $iFoundItems because it is not
|
|
|
|
|
//used
|
|
|
|
|
$this->processPagedSearchStatus($sr, $filter, $base, 1, $limit,
|
|
|
|
|
$offset, $pagedSearchOK,
|
|
|
|
|
$skipHandling);
|
2014-07-02 00:02:41 +04:00
|
|
|
|
return array();
|
2014-01-08 15:07:57 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Do the server-side sorting
|
|
|
|
|
foreach(array_reverse($attr) as $sortAttr){
|
|
|
|
|
foreach($sr as $searchResource) {
|
|
|
|
|
$this->ldap->sort($cr, $searchResource, $sortAttr);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
$findings = array();
|
2014-05-11 17:17:27 +04:00
|
|
|
|
foreach($sr as $res) {
|
2014-05-16 00:47:28 +04:00
|
|
|
|
$findings = array_merge($findings, $this->ldap->getEntries($cr , $res ));
|
2014-01-08 15:07:57 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
$this->processPagedSearchStatus($sr, $filter, $base, $findings['count'],
|
|
|
|
|
$limit, $offset, $pagedSearchOK,
|
|
|
|
|
$skipHandling);
|
2012-10-26 23:53:56 +04:00
|
|
|
|
|
|
|
|
|
// if we're here, probably no connection resource is returned.
|
|
|
|
|
// to make ownCloud behave nicely, we simply give back an empty array.
|
|
|
|
|
if(is_null($findings)) {
|
|
|
|
|
return array();
|
|
|
|
|
}
|
|
|
|
|
|
2012-04-14 20:05:29 +04:00
|
|
|
|
if(!is_null($attr)) {
|
|
|
|
|
$selection = array();
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$multiArray = false;
|
2012-04-25 22:34:58 +04:00
|
|
|
|
if(count($attr) > 1) {
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$multiArray = true;
|
2012-04-25 22:34:58 +04:00
|
|
|
|
$i = 0;
|
|
|
|
|
}
|
2012-04-14 20:05:29 +04:00
|
|
|
|
foreach($findings as $item) {
|
2012-05-17 15:15:26 +04:00
|
|
|
|
if(!is_array($item)) {
|
|
|
|
|
continue;
|
|
|
|
|
}
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$item = \OCP\Util::mb_array_change_key_case($item, MB_CASE_LOWER, 'UTF-8');
|
2012-05-17 15:15:26 +04:00
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
if($multiArray) {
|
2012-04-25 22:34:58 +04:00
|
|
|
|
foreach($attr as $key) {
|
2012-07-02 22:31:07 +04:00
|
|
|
|
$key = mb_strtolower($key, 'UTF-8');
|
2012-04-25 22:34:58 +04:00
|
|
|
|
if(isset($item[$key])) {
|
2013-04-21 00:45:50 +04:00
|
|
|
|
if($key !== 'dn') {
|
2013-02-15 01:16:48 +04:00
|
|
|
|
$selection[$i][$key] = $this->resemblesDN($key) ?
|
|
|
|
|
$this->sanitizeDN($item[$key][0])
|
|
|
|
|
: $item[$key][0];
|
2012-04-25 22:34:58 +04:00
|
|
|
|
} else {
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$selection[$i][$key] = $this->sanitizeDN($item[$key]);
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
$i++;
|
|
|
|
|
} else {
|
2012-05-11 17:42:05 +04:00
|
|
|
|
//tribute to case insensitivity
|
2012-07-02 22:31:07 +04:00
|
|
|
|
$key = mb_strtolower($attr[0], 'UTF-8');
|
2012-05-11 17:42:05 +04:00
|
|
|
|
|
|
|
|
|
if(isset($item[$key])) {
|
2012-07-25 14:37:39 +04:00
|
|
|
|
if($this->resemblesDN($key)) {
|
|
|
|
|
$selection[] = $this->sanitizeDN($item[$key]);
|
2012-05-14 14:25:10 +04:00
|
|
|
|
} else {
|
|
|
|
|
$selection[] = $item[$key];
|
|
|
|
|
}
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
2012-04-14 20:05:29 +04:00
|
|
|
|
}
|
|
|
|
|
}
|
2012-10-27 14:18:50 +04:00
|
|
|
|
$findings = $selection;
|
|
|
|
|
}
|
2012-10-27 19:36:08 +04:00
|
|
|
|
//we slice the findings, when
|
2014-05-11 17:17:27 +04:00
|
|
|
|
//a) paged search unsuccessful, though attempted
|
2012-10-27 19:36:08 +04:00
|
|
|
|
//b) no paged search, but limit set
|
2014-03-20 03:21:51 +04:00
|
|
|
|
if((!$this->getPagedSearchResultState()
|
2012-12-15 02:50:21 +04:00
|
|
|
|
&& $pagedSearchOK)
|
2012-10-27 14:18:50 +04:00
|
|
|
|
|| (
|
2012-10-27 19:36:08 +04:00
|
|
|
|
!$pagedSearchOK
|
|
|
|
|
&& !is_null($limit)
|
2012-10-27 14:18:50 +04:00
|
|
|
|
)
|
|
|
|
|
) {
|
|
|
|
|
$findings = array_slice($findings, intval($offset), $limit);
|
2012-04-14 20:05:29 +04:00
|
|
|
|
}
|
|
|
|
|
return $findings;
|
|
|
|
|
}
|
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
/**
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param string $name
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return bool|mixed|string
|
|
|
|
|
*/
|
2012-07-25 14:37:39 +04:00
|
|
|
|
public function sanitizeUsername($name) {
|
|
|
|
|
if($this->connection->ldapIgnoreNamingRules) {
|
2012-05-17 21:33:38 +04:00
|
|
|
|
return $name;
|
|
|
|
|
}
|
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
// Transliteration
|
|
|
|
|
// latin characters to ASCII
|
2012-08-27 23:32:32 +04:00
|
|
|
|
$name = iconv('UTF-8', 'ASCII//TRANSLIT', $name);
|
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
// Replacements
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$name = \OCP\Util::mb_str_replace(' ', '_', $name, 'UTF-8');
|
2012-05-17 17:14:47 +04:00
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
// Every remaining disallowed characters will be removed
|
2012-07-02 22:31:07 +04:00
|
|
|
|
$name = preg_replace('/[^a-zA-Z0-9_.@-]/u', '', $name);
|
2012-05-17 17:14:47 +04:00
|
|
|
|
|
|
|
|
|
return $name;
|
|
|
|
|
}
|
|
|
|
|
|
2014-02-19 16:13:01 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* escapes (user provided) parts for LDAP filter
|
2014-04-14 19:39:29 +04:00
|
|
|
|
* @param string $input, the provided value
|
2014-12-08 19:22:52 +03:00
|
|
|
|
* @param bool $allowAsterisk wether in * at the beginning should be preserved
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return string the escaped string
|
2014-02-19 16:13:01 +04:00
|
|
|
|
*/
|
2014-12-08 19:12:13 +03:00
|
|
|
|
public function escapeFilterPart($input, $allowAsterisk = false) {
|
|
|
|
|
$asterisk = '';
|
|
|
|
|
if($allowAsterisk && strlen($input) > 0 && $input[0] === '*') {
|
|
|
|
|
$asterisk = '*';
|
|
|
|
|
$input = mb_substr($input, 1, null, 'UTF-8');
|
|
|
|
|
}
|
2014-02-19 16:13:01 +04:00
|
|
|
|
$search = array('*', '\\', '(', ')');
|
|
|
|
|
$replace = array('\\*', '\\\\', '\\(', '\\)');
|
2014-12-08 19:12:13 +03:00
|
|
|
|
return $asterisk . str_replace($search, $replace, $input);
|
2014-02-19 16:13:01 +04:00
|
|
|
|
}
|
|
|
|
|
|
2012-04-15 15:37:35 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* combines the input filters with AND
|
2014-05-15 16:12:17 +04:00
|
|
|
|
* @param string[] $filters the filters to connect
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return string the combined filter
|
2012-04-15 15:37:35 +04:00
|
|
|
|
*/
|
2012-07-25 14:37:39 +04:00
|
|
|
|
public function combineFilterWithAnd($filters) {
|
2012-07-25 15:18:31 +04:00
|
|
|
|
return $this->combineFilter($filters, '&');
|
2012-04-15 15:37:35 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-06-11 15:35:35 +04:00
|
|
|
|
* combines the input filters with OR
|
2014-05-15 16:12:17 +04:00
|
|
|
|
* @param string[] $filters the filters to connect
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return string the combined filter
|
2014-06-11 15:35:35 +04:00
|
|
|
|
* Combines Filter arguments with OR
|
2012-04-15 15:37:35 +04:00
|
|
|
|
*/
|
2012-07-25 14:37:39 +04:00
|
|
|
|
public function combineFilterWithOr($filters) {
|
2012-07-25 15:18:31 +04:00
|
|
|
|
return $this->combineFilter($filters, '|');
|
2012-04-15 15:37:35 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* combines the input filters with given operator
|
2014-05-15 16:12:17 +04:00
|
|
|
|
* @param string[] $filters the filters to connect
|
2014-02-06 19:30:58 +04:00
|
|
|
|
* @param string $operator either & or |
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return string the combined filter
|
2012-04-15 15:37:35 +04:00
|
|
|
|
*/
|
2012-07-25 14:37:39 +04:00
|
|
|
|
private function combineFilter($filters, $operator) {
|
2012-04-15 15:37:35 +04:00
|
|
|
|
$combinedFilter = '('.$operator;
|
|
|
|
|
foreach($filters as $filter) {
|
2014-05-16 00:47:28 +04:00
|
|
|
|
if(!empty($filter) && $filter[0] !== '(') {
|
2012-04-15 15:37:35 +04:00
|
|
|
|
$filter = '('.$filter.')';
|
2014-05-16 00:47:28 +04:00
|
|
|
|
}
|
|
|
|
|
$combinedFilter.=$filter;
|
2012-04-15 15:37:35 +04:00
|
|
|
|
}
|
|
|
|
|
$combinedFilter.=')';
|
|
|
|
|
return $combinedFilter;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-31 04:46:34 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* creates a filter part for to perform search for users
|
2013-01-31 04:46:34 +04:00
|
|
|
|
* @param string $search the search term
|
|
|
|
|
* @return string the final filter part to use in LDAP searches
|
|
|
|
|
*/
|
|
|
|
|
public function getFilterPartForUserSearch($search) {
|
2013-02-15 01:16:48 +04:00
|
|
|
|
return $this->getFilterPartForSearch($search,
|
|
|
|
|
$this->connection->ldapAttributesForUserSearch,
|
|
|
|
|
$this->connection->ldapUserDisplayName);
|
2013-01-31 04:46:34 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* creates a filter part for to perform search for groups
|
2013-01-31 04:46:34 +04:00
|
|
|
|
* @param string $search the search term
|
|
|
|
|
* @return string the final filter part to use in LDAP searches
|
|
|
|
|
*/
|
|
|
|
|
public function getFilterPartForGroupSearch($search) {
|
2013-02-15 01:16:48 +04:00
|
|
|
|
return $this->getFilterPartForSearch($search,
|
|
|
|
|
$this->connection->ldapAttributesForGroupSearch,
|
|
|
|
|
$this->connection->ldapGroupDisplayName);
|
2013-01-31 04:46:34 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-11-28 14:08:33 +03:00
|
|
|
|
/**
|
|
|
|
|
* creates a filter part for searches by splitting up the given search
|
|
|
|
|
* string into single words
|
|
|
|
|
* @param string $search the search term
|
|
|
|
|
* @param string[] $searchAttributes needs to have at least two attributes,
|
|
|
|
|
* otherwise it does not make sense :)
|
|
|
|
|
* @return string the final filter part to use in LDAP searches
|
|
|
|
|
* @throws \Exception
|
|
|
|
|
*/
|
|
|
|
|
private function getAdvancedFilterPartForSearch($search, $searchAttributes) {
|
|
|
|
|
if(!is_array($searchAttributes) || count($searchAttributes) < 2) {
|
|
|
|
|
throw new \Exception('searchAttributes must be an array with at least two string');
|
|
|
|
|
}
|
|
|
|
|
$searchWords = explode(' ', trim($search));
|
|
|
|
|
$wordFilters = array();
|
|
|
|
|
foreach($searchWords as $word) {
|
|
|
|
|
$word .= '*';
|
|
|
|
|
//every word needs to appear at least once
|
|
|
|
|
$wordMatchOneAttrFilters = array();
|
|
|
|
|
foreach($searchAttributes as $attr) {
|
|
|
|
|
$wordMatchOneAttrFilters[] = $attr . '=' . $word;
|
|
|
|
|
}
|
|
|
|
|
$wordFilters[] = $this->combineFilterWithOr($wordMatchOneAttrFilters);
|
|
|
|
|
}
|
|
|
|
|
return $this->combineFilterWithAnd($wordFilters);
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-31 04:46:34 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* creates a filter part for searches
|
2013-01-31 04:46:34 +04:00
|
|
|
|
* @param string $search the search term
|
2014-05-15 16:12:17 +04:00
|
|
|
|
* @param string[]|null $searchAttributes
|
2013-01-31 04:46:34 +04:00
|
|
|
|
* @param string $fallbackAttribute a fallback attribute in case the user
|
|
|
|
|
* did not define search attributes. Typically the display name attribute.
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return string the final filter part to use in LDAP searches
|
2013-01-31 04:46:34 +04:00
|
|
|
|
*/
|
|
|
|
|
private function getFilterPartForSearch($search, $searchAttributes, $fallbackAttribute) {
|
|
|
|
|
$filter = array();
|
2014-11-28 14:08:33 +03:00
|
|
|
|
$haveMultiSearchAttributes = (is_array($searchAttributes) && count($searchAttributes) > 0);
|
|
|
|
|
if($haveMultiSearchAttributes && strpos(trim($search), ' ') !== false) {
|
|
|
|
|
try {
|
|
|
|
|
return $this->getAdvancedFilterPartForSearch($search, $searchAttributes);
|
|
|
|
|
} catch(\Exception $e) {
|
|
|
|
|
\OCP\Util::writeLog(
|
|
|
|
|
'user_ldap',
|
|
|
|
|
'Creating advanced filter for search failed, falling back to simple method.',
|
|
|
|
|
\OCP\Util::INFO
|
|
|
|
|
);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
$search = empty($search) ? '*' : $search.'*';
|
2013-04-21 00:45:50 +04:00
|
|
|
|
if(!is_array($searchAttributes) || count($searchAttributes) === 0) {
|
2013-01-31 04:46:34 +04:00
|
|
|
|
if(empty($fallbackAttribute)) {
|
|
|
|
|
return '';
|
|
|
|
|
}
|
|
|
|
|
$filter[] = $fallbackAttribute . '=' . $search;
|
|
|
|
|
} else {
|
|
|
|
|
foreach($searchAttributes as $attribute) {
|
|
|
|
|
$filter[] = $attribute . '=' . $search;
|
|
|
|
|
}
|
|
|
|
|
}
|
2013-04-21 00:45:50 +04:00
|
|
|
|
if(count($filter) === 1) {
|
2013-01-31 04:46:34 +04:00
|
|
|
|
return '('.$filter[0].')';
|
|
|
|
|
}
|
|
|
|
|
return $this->combineFilterWithOr($filter);
|
|
|
|
|
}
|
|
|
|
|
|
2014-10-28 01:39:30 +03:00
|
|
|
|
/**
|
|
|
|
|
* returns the filter used for counting users
|
2014-11-20 20:03:47 +03:00
|
|
|
|
* @return string
|
2014-10-28 01:39:30 +03:00
|
|
|
|
*/
|
|
|
|
|
public function getFilterForUserCount() {
|
|
|
|
|
$filter = $this->combineFilterWithAnd(array(
|
|
|
|
|
$this->connection->ldapUserFilter,
|
|
|
|
|
$this->connection->ldapUserDisplayName . '=*'
|
|
|
|
|
));
|
|
|
|
|
|
|
|
|
|
return $filter;
|
|
|
|
|
}
|
|
|
|
|
|
2014-02-19 12:31:54 +04:00
|
|
|
|
/**
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $name
|
2014-02-19 12:31:54 +04:00
|
|
|
|
* @param string $password
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return bool
|
2014-02-19 12:31:54 +04:00
|
|
|
|
*/
|
2012-07-25 14:37:39 +04:00
|
|
|
|
public function areCredentialsValid($name, $password) {
|
2012-11-20 20:36:25 +04:00
|
|
|
|
$name = $this->DNasBaseParameter($name);
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$testConnection = clone $this->connection;
|
|
|
|
|
$credentials = array(
|
|
|
|
|
'ldapAgentName' => $name,
|
|
|
|
|
'ldapAgentPassword' => $password
|
|
|
|
|
);
|
|
|
|
|
if(!$testConnection->setConfiguration($credentials)) {
|
2012-04-16 19:28:58 +04:00
|
|
|
|
return false;
|
|
|
|
|
}
|
2013-10-18 19:13:36 +04:00
|
|
|
|
$result=$testConnection->bind();
|
|
|
|
|
$this->connection->bind();
|
|
|
|
|
return $result;
|
2012-04-25 22:34:58 +04:00
|
|
|
|
}
|
2012-08-23 20:29:43 +04:00
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* auto-detects the directory's UUID attribute
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $dn a known DN used to check against
|
|
|
|
|
* @param bool $isUser
|
|
|
|
|
* @param bool $force the detection should be run, even if it is not set to auto
|
2014-05-11 18:27:18 +04:00
|
|
|
|
* @return bool true on success, false otherwise
|
2012-08-23 20:29:43 +04:00
|
|
|
|
*/
|
2013-09-13 21:01:40 +04:00
|
|
|
|
private function detectUuidAttribute($dn, $isUser = true, $force = false) {
|
|
|
|
|
if($isUser) {
|
|
|
|
|
$uuidAttr = 'ldapUuidUserAttribute';
|
|
|
|
|
$uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
|
|
|
|
|
} else {
|
|
|
|
|
$uuidAttr = 'ldapUuidGroupAttribute';
|
|
|
|
|
$uuidOverride = $this->connection->ldapExpertUUIDGroupAttr;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if(($this->connection->$uuidAttr !== 'auto') && !$force) {
|
2012-08-23 20:29:43 +04:00
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
2013-09-13 21:01:40 +04:00
|
|
|
|
if(!empty($uuidOverride) && !$force) {
|
|
|
|
|
$this->connection->$uuidAttr = $uuidOverride;
|
2013-05-08 16:56:52 +04:00
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
// for now, supported attributes are entryUUID, nsuniqueid, objectGUID, ipaUniqueID
|
2014-03-21 00:38:06 +04:00
|
|
|
|
$testAttributes = array('entryuuid', 'nsuniqueid', 'objectguid', 'guid', 'ipauniqueid');
|
2012-08-23 20:29:43 +04:00
|
|
|
|
|
|
|
|
|
foreach($testAttributes as $attribute) {
|
2013-02-15 01:16:48 +04:00
|
|
|
|
$value = $this->readAttribute($dn, $attribute);
|
|
|
|
|
if(is_array($value) && isset($value[0]) && !empty($value[0])) {
|
2013-09-13 21:01:40 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
|
|
|
|
'Setting '.$attribute.' as '.$uuidAttr,
|
|
|
|
|
\OCP\Util::DEBUG);
|
|
|
|
|
$this->connection->$uuidAttr = $attribute;
|
2012-08-23 20:29:43 +04:00
|
|
|
|
return true;
|
2013-02-15 01:16:48 +04:00
|
|
|
|
}
|
2012-08-23 20:29:43 +04:00
|
|
|
|
}
|
2013-09-13 21:01:40 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
|
|
|
|
'Could not autodetect the UUID attribute',
|
|
|
|
|
\OCP\Util::ERROR);
|
2012-08-23 20:29:43 +04:00
|
|
|
|
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
/**
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param string $dn
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param bool $isUser
|
2014-11-05 15:05:07 +03:00
|
|
|
|
* @return string|bool
|
2014-05-11 17:17:27 +04:00
|
|
|
|
*/
|
2013-09-13 21:01:40 +04:00
|
|
|
|
public function getUUID($dn, $isUser = true) {
|
|
|
|
|
if($isUser) {
|
|
|
|
|
$uuidAttr = 'ldapUuidUserAttribute';
|
|
|
|
|
$uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
|
|
|
|
|
} else {
|
|
|
|
|
$uuidAttr = 'ldapUuidGroupAttribute';
|
|
|
|
|
$uuidOverride = $this->connection->ldapExpertUUIDGroupAttr;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
$uuid = false;
|
|
|
|
|
if($this->detectUuidAttribute($dn, $isUser)) {
|
|
|
|
|
$uuid = $this->readAttribute($dn, $this->connection->$uuidAttr);
|
|
|
|
|
if( !is_array($uuid)
|
|
|
|
|
&& !empty($uuidOverride)
|
|
|
|
|
&& $this->detectUuidAttribute($dn, $isUser, true)) {
|
|
|
|
|
$uuid = $this->readAttribute($dn,
|
|
|
|
|
$this->connection->$uuidAttr);
|
2012-08-23 20:29:43 +04:00
|
|
|
|
}
|
|
|
|
|
if(is_array($uuid) && isset($uuid[0]) && !empty($uuid[0])) {
|
|
|
|
|
$uuid = $uuid[0];
|
|
|
|
|
}
|
|
|
|
|
}
|
2013-09-13 21:01:40 +04:00
|
|
|
|
|
2012-08-23 20:29:43 +04:00
|
|
|
|
return $uuid;
|
|
|
|
|
}
|
2012-10-26 23:53:56 +04:00
|
|
|
|
|
2012-11-09 02:01:28 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* converts a binary ObjectGUID into a string representation
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $oguid the ObjectGUID in it's binary form as retrieved from AD
|
|
|
|
|
* @return string
|
|
|
|
|
* @link http://www.php.net/manual/en/function.ldap-get-values-len.php#73198
|
2012-11-09 02:01:28 +04:00
|
|
|
|
*/
|
|
|
|
|
private function convertObjectGUID2Str($oguid) {
|
|
|
|
|
$hex_guid = bin2hex($oguid);
|
|
|
|
|
$hex_guid_to_guid_str = '';
|
|
|
|
|
for($k = 1; $k <= 4; ++$k) {
|
|
|
|
|
$hex_guid_to_guid_str .= substr($hex_guid, 8 - 2 * $k, 2);
|
|
|
|
|
}
|
|
|
|
|
$hex_guid_to_guid_str .= '-';
|
|
|
|
|
for($k = 1; $k <= 2; ++$k) {
|
|
|
|
|
$hex_guid_to_guid_str .= substr($hex_guid, 12 - 2 * $k, 2);
|
|
|
|
|
}
|
|
|
|
|
$hex_guid_to_guid_str .= '-';
|
|
|
|
|
for($k = 1; $k <= 2; ++$k) {
|
|
|
|
|
$hex_guid_to_guid_str .= substr($hex_guid, 16 - 2 * $k, 2);
|
|
|
|
|
}
|
|
|
|
|
$hex_guid_to_guid_str .= '-' . substr($hex_guid, 16, 4);
|
|
|
|
|
$hex_guid_to_guid_str .= '-' . substr($hex_guid, 20);
|
|
|
|
|
|
|
|
|
|
return strtoupper($hex_guid_to_guid_str);
|
|
|
|
|
}
|
|
|
|
|
|
2014-07-02 00:02:41 +04:00
|
|
|
|
/**
|
|
|
|
|
* gets a SID of the domain of the given dn
|
|
|
|
|
* @param string $dn
|
|
|
|
|
* @return string|bool
|
|
|
|
|
*/
|
|
|
|
|
public function getSID($dn) {
|
|
|
|
|
$domainDN = $this->getDomainDNFromDN($dn);
|
|
|
|
|
$cacheKey = 'getSID-'.$domainDN;
|
|
|
|
|
if($this->connection->isCached($cacheKey)) {
|
|
|
|
|
return $this->connection->getFromCache($cacheKey);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
$objectSid = $this->readAttribute($domainDN, 'objectsid');
|
|
|
|
|
if(!is_array($objectSid) || empty($objectSid)) {
|
|
|
|
|
$this->connection->writeToCache($cacheKey, false);
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
$domainObjectSid = $this->convertSID2Str($objectSid[0]);
|
|
|
|
|
$this->connection->writeToCache($cacheKey, $domainObjectSid);
|
|
|
|
|
|
|
|
|
|
return $domainObjectSid;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* converts a binary SID into a string representation
|
|
|
|
|
* @param string $sid
|
|
|
|
|
* @return string
|
|
|
|
|
*/
|
|
|
|
|
public function convertSID2Str($sid) {
|
2014-09-19 02:01:57 +04:00
|
|
|
|
// The format of a SID binary string is as follows:
|
|
|
|
|
// 1 byte for the revision level
|
|
|
|
|
// 1 byte for the number n of variable sub-ids
|
|
|
|
|
// 6 bytes for identifier authority value
|
|
|
|
|
// n*4 bytes for n sub-ids
|
|
|
|
|
//
|
|
|
|
|
// Example: 010400000000000515000000a681e50e4d6c6c2bca32055f
|
|
|
|
|
// Legend: RRNNAAAAAAAAAAAA11111111222222223333333344444444
|
|
|
|
|
$revision = ord($sid[0]);
|
|
|
|
|
$numberSubID = ord($sid[1]);
|
|
|
|
|
|
|
|
|
|
$subIdStart = 8; // 1 + 1 + 6
|
|
|
|
|
$subIdLength = 4;
|
|
|
|
|
if (strlen($sid) !== $subIdStart + $subIdLength * $numberSubID) {
|
|
|
|
|
// Incorrect number of bytes present.
|
2014-07-02 00:02:41 +04:00
|
|
|
|
return '';
|
|
|
|
|
}
|
|
|
|
|
|
2014-09-19 02:01:57 +04:00
|
|
|
|
// 6 bytes = 48 bits can be represented using floats without loss of
|
|
|
|
|
// precision (see https://gist.github.com/bantu/886ac680b0aef5812f71)
|
|
|
|
|
$iav = number_format(hexdec(bin2hex(substr($sid, 2, 6))), 0, '', '');
|
|
|
|
|
|
|
|
|
|
$subIDs = array();
|
|
|
|
|
for ($i = 0; $i < $numberSubID; $i++) {
|
|
|
|
|
$subID = unpack('V', substr($sid, $subIdStart + $subIdLength * $i, $subIdLength));
|
|
|
|
|
$subIDs[] = sprintf('%u', $subID[1]);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Result for example above: S-1-5-21-249921958-728525901-1594176202
|
|
|
|
|
return sprintf('S-%d-%s-%s', $revision, $iav, implode('-', $subIDs));
|
2014-07-02 00:02:41 +04:00
|
|
|
|
}
|
|
|
|
|
|
2012-11-20 20:36:25 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* converts a stored DN so it can be used as base parameter for LDAP queries, internally we store them for usage in LDAP filters
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $dn the DN
|
|
|
|
|
* @return string
|
2012-11-20 20:36:25 +04:00
|
|
|
|
*/
|
|
|
|
|
private function DNasBaseParameter($dn) {
|
2013-08-27 15:47:31 +04:00
|
|
|
|
return str_ireplace('\\5c', '\\', $dn);
|
2012-11-20 20:36:25 +04:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-04 00:38:53 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* checks if the given DN is part of the given base DN(s)
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $dn the DN
|
2014-05-15 16:12:17 +04:00
|
|
|
|
* @param string[] $bases array containing the allowed base DN or DNs
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return bool
|
2013-01-04 00:38:53 +04:00
|
|
|
|
*/
|
2014-10-10 23:29:11 +04:00
|
|
|
|
public function isDNPartOfBase($dn, $bases) {
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$belongsToBase = false;
|
2013-01-04 00:38:53 +04:00
|
|
|
|
$bases = $this->sanitizeDN($bases);
|
2014-05-11 17:17:27 +04:00
|
|
|
|
|
2013-01-04 00:38:53 +04:00
|
|
|
|
foreach($bases as $base) {
|
|
|
|
|
$belongsToBase = true;
|
2013-10-18 16:40:08 +04:00
|
|
|
|
if(mb_strripos($dn, $base, 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8')-mb_strlen($base, 'UTF-8'))) {
|
2013-01-04 00:38:53 +04:00
|
|
|
|
$belongsToBase = false;
|
2013-01-08 22:00:49 +04:00
|
|
|
|
}
|
|
|
|
|
if($belongsToBase) {
|
2013-01-04 00:38:53 +04:00
|
|
|
|
break;
|
2013-01-08 22:00:49 +04:00
|
|
|
|
}
|
2013-01-04 00:38:53 +04:00
|
|
|
|
}
|
|
|
|
|
return $belongsToBase;
|
|
|
|
|
}
|
|
|
|
|
|
2014-08-19 20:01:58 +04:00
|
|
|
|
/**
|
|
|
|
|
* resets a running Paged Search operation
|
|
|
|
|
*/
|
|
|
|
|
private function abandonPagedSearch() {
|
2014-09-30 15:13:52 +04:00
|
|
|
|
if($this->connection->hasPagedResultSupport) {
|
2014-08-19 20:01:58 +04:00
|
|
|
|
$cr = $this->connection->getConnectionResource();
|
|
|
|
|
$this->ldap->controlPagedResult($cr, 0, false, $this->lastCookie);
|
|
|
|
|
$this->getPagedSearchResultState();
|
|
|
|
|
$this->lastCookie = '';
|
|
|
|
|
$this->cookies = array();
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2012-10-26 23:53:56 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* get a cookie for the next LDAP paged search
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $base a string with the base DN for the search
|
|
|
|
|
* @param string $filter the search filter to identify the correct search
|
|
|
|
|
* @param int $limit the limit (or 'pageSize'), to identify the correct search well
|
|
|
|
|
* @param int $offset the offset for the new search to identify the correct search really good
|
2014-05-11 18:27:18 +04:00
|
|
|
|
* @return string containing the key or empty if none is cached
|
2012-10-26 23:53:56 +04:00
|
|
|
|
*/
|
2013-01-05 02:54:42 +04:00
|
|
|
|
private function getPagedResultCookie($base, $filter, $limit, $offset) {
|
2013-04-21 00:45:50 +04:00
|
|
|
|
if($offset === 0) {
|
2012-10-26 23:53:56 +04:00
|
|
|
|
return '';
|
|
|
|
|
}
|
|
|
|
|
$offset -= $limit;
|
|
|
|
|
//we work with cache here
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' . intval($limit) . '-' . intval($offset);
|
2013-10-25 16:15:05 +04:00
|
|
|
|
$cookie = '';
|
2014-05-11 17:17:27 +04:00
|
|
|
|
if(isset($this->cookies[$cacheKey])) {
|
|
|
|
|
$cookie = $this->cookies[$cacheKey];
|
2013-10-25 16:15:05 +04:00
|
|
|
|
if(is_null($cookie)) {
|
|
|
|
|
$cookie = '';
|
|
|
|
|
}
|
2012-10-26 23:53:56 +04:00
|
|
|
|
}
|
|
|
|
|
return $cookie;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* set a cookie for LDAP paged search run
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $base a string with the base DN for the search
|
|
|
|
|
* @param string $filter the search filter to identify the correct search
|
|
|
|
|
* @param int $limit the limit (or 'pageSize'), to identify the correct search well
|
|
|
|
|
* @param int $offset the offset for the run search to identify the correct search really good
|
|
|
|
|
* @param string $cookie string containing the cookie returned by ldap_control_paged_result_response
|
2012-10-26 23:53:56 +04:00
|
|
|
|
* @return void
|
|
|
|
|
*/
|
2013-01-05 02:54:42 +04:00
|
|
|
|
private function setPagedResultCookie($base, $filter, $limit, $offset, $cookie) {
|
2012-10-26 23:53:56 +04:00
|
|
|
|
if(!empty($cookie)) {
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' .intval($limit) . '-' . intval($offset);
|
|
|
|
|
$this->cookies[$cacheKey] = $cookie;
|
2014-08-19 20:01:58 +04:00
|
|
|
|
$this->lastCookie = $cookie;
|
2012-10-26 23:53:56 +04:00
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* Check whether the most recent paged search was successful. It flushed the state var. Use it always after a possible paged search.
|
2014-02-06 19:30:58 +04:00
|
|
|
|
* @return boolean|null true on success, null or false otherwise
|
2012-10-26 23:53:56 +04:00
|
|
|
|
*/
|
|
|
|
|
public function getPagedSearchResultState() {
|
|
|
|
|
$result = $this->pagedSearchedSuccessful;
|
|
|
|
|
$this->pagedSearchedSuccessful = null;
|
|
|
|
|
return $result;
|
|
|
|
|
}
|
|
|
|
|
|
2012-10-27 13:02:35 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* Prepares a paged search, if possible
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param string $filter the LDAP filter for the search
|
2014-05-15 16:12:17 +04:00
|
|
|
|
* @param string[] $bases an array containing the LDAP subtree(s) that shall be searched
|
|
|
|
|
* @param string[] $attr optional, when a certain attribute shall be filtered outside
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param int $limit
|
|
|
|
|
* @param int $offset
|
|
|
|
|
* @return bool|true
|
2012-10-27 13:02:35 +04:00
|
|
|
|
*/
|
2013-01-05 02:54:42 +04:00
|
|
|
|
private function initPagedSearch($filter, $bases, $attr, $limit, $offset) {
|
2012-10-27 13:02:35 +04:00
|
|
|
|
$pagedSearchOK = false;
|
2014-11-21 16:51:20 +03:00
|
|
|
|
if($this->connection->hasPagedResultSupport && ($limit !== 0)) {
|
2012-10-27 13:02:35 +04:00
|
|
|
|
$offset = intval($offset); //can be null
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
2013-12-10 20:50:45 +04:00
|
|
|
|
'initializing paged search for Filter '.$filter.' base '.print_r($bases, true)
|
2013-02-15 01:16:48 +04:00
|
|
|
|
.' attr '.print_r($attr, true). ' limit ' .$limit.' offset '.$offset,
|
2013-12-10 20:50:45 +04:00
|
|
|
|
\OCP\Util::DEBUG);
|
2012-10-27 13:02:35 +04:00
|
|
|
|
//get the cookie from the search for the previous search, required by LDAP
|
2013-01-05 02:54:42 +04:00
|
|
|
|
foreach($bases as $base) {
|
|
|
|
|
|
|
|
|
|
$cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
|
|
|
|
|
if(empty($cookie) && ($offset > 0)) {
|
2013-02-15 18:45:34 +04:00
|
|
|
|
// no cookie known, although the offset is not 0. Maybe cache run out. We need
|
2014-05-11 17:17:27 +04:00
|
|
|
|
// to start all over *sigh* (btw, Dear Reader, did you know LDAP paged
|
2013-02-15 01:16:48 +04:00
|
|
|
|
// searching was designed by MSFT?)
|
2014-05-11 17:17:27 +04:00
|
|
|
|
// Lukas: No, but thanks to reading that source I finally know!
|
2013-01-05 02:54:42 +04:00
|
|
|
|
$reOffset = ($offset - $limit) < 0 ? 0 : $offset - $limit;
|
|
|
|
|
//a bit recursive, $offset of 0 is the exit
|
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'Looking for cookie L/O '.$limit.'/'.$reOffset, \OCP\Util::INFO);
|
2013-01-16 17:56:57 +04:00
|
|
|
|
$this->search($filter, array($base), $attr, $limit, $reOffset, true);
|
2013-01-05 02:54:42 +04:00
|
|
|
|
$cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
|
|
|
|
|
//still no cookie? obviously, the server does not like us. Let's skip paging efforts.
|
|
|
|
|
//TODO: remember this, probably does not change in the next request...
|
|
|
|
|
if(empty($cookie)) {
|
|
|
|
|
$cookie = null;
|
|
|
|
|
}
|
2012-10-27 13:02:35 +04:00
|
|
|
|
}
|
2013-01-05 02:54:42 +04:00
|
|
|
|
if(!is_null($cookie)) {
|
2014-09-18 19:00:51 +04:00
|
|
|
|
//since offset = 0, this is a new search. We abandon other searches that might be ongoing.
|
|
|
|
|
$this->abandonPagedSearch();
|
2013-08-20 16:23:49 +04:00
|
|
|
|
$pagedSearchOK = $this->ldap->controlPagedResult(
|
|
|
|
|
$this->connection->getConnectionResource(), $limit,
|
|
|
|
|
false, $cookie);
|
2013-01-05 02:54:42 +04:00
|
|
|
|
if(!$pagedSearchOK) {
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'Ready for a paged search', \OCP\Util::INFO);
|
|
|
|
|
} else {
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
|
|
|
|
'No paged search for us, Cpt., Limit '.$limit.' Offset '.$offset,
|
|
|
|
|
\OCP\Util::INFO);
|
2012-10-27 13:02:35 +04:00
|
|
|
|
}
|
2013-01-05 02:54:42 +04:00
|
|
|
|
|
2012-10-27 13:02:35 +04:00
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return $pagedSearchOK;
|
|
|
|
|
}
|
|
|
|
|
|
2012-12-06 21:11:14 +04:00
|
|
|
|
}
|