2012-07-25 14:37:39 +04:00
|
|
|
|
<?php
|
|
|
|
|
|
|
|
|
|
/**
|
2013-09-17 21:25:15 +04:00
|
|
|
|
* ownCloud – LDAP Connection
|
2012-07-25 14:37:39 +04:00
|
|
|
|
*
|
|
|
|
|
* @author Arthur Schiwon
|
2013-01-11 02:30:26 +04:00
|
|
|
|
* @copyright 2012, 2013 Arthur Schiwon blizzz@owncloud.com
|
2012-07-25 14:37:39 +04:00
|
|
|
|
*
|
|
|
|
|
* This library is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
|
|
|
|
* License as published by the Free Software Foundation; either
|
|
|
|
|
* version 3 of the License, or any later version.
|
|
|
|
|
*
|
|
|
|
|
* This library is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU Affero General Public
|
|
|
|
|
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
*
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
namespace OCA\user_ldap\lib;
|
|
|
|
|
|
2014-07-02 00:02:41 +04:00
|
|
|
|
//magic properties (incomplete)
|
|
|
|
|
/**
|
|
|
|
|
* responsible for LDAP connections in context with the provided configuration
|
|
|
|
|
* @property string ldapUserFilter
|
|
|
|
|
* @property string ldapUserDisplayName
|
|
|
|
|
* @property boolean hasPagedResultSupport
|
2014-11-05 15:05:07 +03:00
|
|
|
|
* @property string[] ldapBaseUsers
|
2014-07-02 00:02:41 +04:00
|
|
|
|
*/
|
2013-09-10 19:11:02 +04:00
|
|
|
|
class Connection extends LDAPUtility {
|
2012-07-25 14:37:39 +04:00
|
|
|
|
private $ldapConnectionRes = null;
|
2013-01-11 02:30:26 +04:00
|
|
|
|
private $configPrefix;
|
2012-07-25 14:37:39 +04:00
|
|
|
|
private $configID;
|
|
|
|
|
private $configured = false;
|
|
|
|
|
|
2013-08-14 18:03:18 +04:00
|
|
|
|
//whether connection should be kept on __destruct
|
|
|
|
|
private $dontDestruct = false;
|
2013-09-27 00:31:57 +04:00
|
|
|
|
private $hasPagedResultSupport = true;
|
2013-08-14 18:03:18 +04:00
|
|
|
|
|
2012-07-26 18:11:23 +04:00
|
|
|
|
//cache handler
|
|
|
|
|
protected $cache;
|
|
|
|
|
|
2013-09-27 00:31:57 +04:00
|
|
|
|
//settings handler
|
|
|
|
|
protected $configuration;
|
2012-07-25 14:37:39 +04:00
|
|
|
|
|
2013-10-24 22:26:05 +04:00
|
|
|
|
protected $doNotValidate = false;
|
|
|
|
|
|
2014-06-11 15:35:35 +04:00
|
|
|
|
protected $ignoreValidation = false;
|
|
|
|
|
|
2013-01-11 02:34:24 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* Constructor
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param ILDAPWrapper $ldap
|
|
|
|
|
* @param string $configPrefix a string with the prefix for the configkey column (appconfig table)
|
2014-06-11 15:35:35 +04:00
|
|
|
|
* @param string|null $configID a string with the value for the appid column (appconfig table) or null for on-the-fly connections
|
2013-01-11 02:34:24 +04:00
|
|
|
|
*/
|
2013-09-10 19:11:02 +04:00
|
|
|
|
public function __construct(ILDAPWrapper $ldap, $configPrefix = '', $configID = 'user_ldap') {
|
|
|
|
|
parent::__construct($ldap);
|
2013-01-11 02:30:26 +04:00
|
|
|
|
$this->configPrefix = $configPrefix;
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$this->configID = $configID;
|
2013-12-13 21:01:42 +04:00
|
|
|
|
$this->configuration = new Configuration($configPrefix,
|
|
|
|
|
!is_null($configID));
|
2014-01-09 16:54:50 +04:00
|
|
|
|
$memcache = \OC::$server->getMemCacheFactory();
|
2013-08-17 19:22:54 +04:00
|
|
|
|
if($memcache->isAvailable()) {
|
|
|
|
|
$this->cache = $memcache->create();
|
|
|
|
|
} else {
|
2014-05-12 18:23:33 +04:00
|
|
|
|
$this->cache = \OC\Cache::getGlobalCache();
|
2013-08-17 19:22:54 +04:00
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$this->hasPagedResultSupport =
|
2013-08-18 15:33:59 +04:00
|
|
|
|
$this->ldap->hasPagedResultSupport();
|
2014-08-21 19:59:13 +04:00
|
|
|
|
$helper = new Helper();
|
2013-10-24 22:26:05 +04:00
|
|
|
|
$this->doNotValidate = !in_array($this->configPrefix,
|
2014-08-21 19:59:13 +04:00
|
|
|
|
$helper->getServerConfigurationPrefixes());
|
2012-07-25 14:37:39 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function __destruct() {
|
2013-08-20 14:39:24 +04:00
|
|
|
|
if(!$this->dontDestruct &&
|
|
|
|
|
$this->ldap->isResource($this->ldapConnectionRes)) {
|
2013-08-18 15:33:59 +04:00
|
|
|
|
@$this->ldap->unbind($this->ldapConnectionRes);
|
2012-10-26 15:30:07 +04:00
|
|
|
|
};
|
2012-07-25 14:37:39 +04:00
|
|
|
|
}
|
|
|
|
|
|
2013-08-14 18:03:18 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* defines behaviour when the instance is cloned
|
2013-08-14 18:03:18 +04:00
|
|
|
|
*/
|
|
|
|
|
public function __clone() {
|
|
|
|
|
//a cloned instance inherits the connection resource. It may use it,
|
|
|
|
|
//but it may not disconnect it
|
|
|
|
|
$this->dontDestruct = true;
|
2014-03-21 18:27:51 +04:00
|
|
|
|
$this->configuration = new Configuration($this->configPrefix,
|
|
|
|
|
!is_null($this->configID));
|
2013-08-14 18:03:18 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
/**
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param string $name
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return bool|mixed|void
|
|
|
|
|
*/
|
2012-07-25 14:37:39 +04:00
|
|
|
|
public function __get($name) {
|
|
|
|
|
if(!$this->configured) {
|
|
|
|
|
$this->readConfiguration();
|
|
|
|
|
}
|
|
|
|
|
|
2013-09-27 00:31:57 +04:00
|
|
|
|
if($name === 'hasPagedResultSupport') {
|
|
|
|
|
return $this->hasPagedResultSupport;
|
2012-07-25 14:37:39 +04:00
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
|
|
|
|
|
return $this->configuration->$name;
|
2012-07-25 14:37:39 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
/**
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param string $name
|
|
|
|
|
* @param mixed $value
|
2014-05-11 17:17:27 +04:00
|
|
|
|
*/
|
2012-08-23 20:29:43 +04:00
|
|
|
|
public function __set($name, $value) {
|
2013-10-24 22:26:05 +04:00
|
|
|
|
$this->doNotValidate = false;
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$before = $this->configuration->$name;
|
|
|
|
|
$this->configuration->$name = $value;
|
|
|
|
|
$after = $this->configuration->$name;
|
|
|
|
|
if($before !== $after) {
|
2012-08-23 20:29:43 +04:00
|
|
|
|
if(!empty($this->configID)) {
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$this->configuration->saveConfiguration();
|
2012-08-23 20:29:43 +04:00
|
|
|
|
}
|
|
|
|
|
$this->validateConfiguration();
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2014-06-11 15:35:35 +04:00
|
|
|
|
/**
|
|
|
|
|
* sets whether the result of the configuration validation shall
|
|
|
|
|
* be ignored when establishing the connection. Used by the Wizard
|
|
|
|
|
* in early configuration state.
|
|
|
|
|
* @param bool $state
|
|
|
|
|
*/
|
|
|
|
|
public function setIgnoreValidation($state) {
|
|
|
|
|
$this->ignoreValidation = (bool)$state;
|
|
|
|
|
}
|
|
|
|
|
|
2012-07-25 14:37:39 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* initializes the LDAP backend
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param bool $force read the config settings no matter what
|
2012-07-25 14:37:39 +04:00
|
|
|
|
*/
|
|
|
|
|
public function init($force = false) {
|
|
|
|
|
$this->readConfiguration($force);
|
|
|
|
|
$this->establishConnection();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* Returns the LDAP handler
|
2012-07-25 14:37:39 +04:00
|
|
|
|
*/
|
|
|
|
|
public function getConnectionResource() {
|
|
|
|
|
if(!$this->ldapConnectionRes) {
|
|
|
|
|
$this->init();
|
2013-08-20 14:39:24 +04:00
|
|
|
|
} else if(!$this->ldap->isResource($this->ldapConnectionRes)) {
|
2012-08-22 17:22:52 +04:00
|
|
|
|
$this->ldapConnectionRes = null;
|
|
|
|
|
$this->establishConnection();
|
2012-07-25 14:37:39 +04:00
|
|
|
|
}
|
|
|
|
|
if(is_null($this->ldapConnectionRes)) {
|
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'Connection could not be established', \OCP\Util::ERROR);
|
|
|
|
|
}
|
|
|
|
|
return $this->ldapConnectionRes;
|
|
|
|
|
}
|
|
|
|
|
|
2014-04-14 19:39:29 +04:00
|
|
|
|
/**
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param string|null $key
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return string
|
2014-04-14 19:39:29 +04:00
|
|
|
|
*/
|
2012-07-26 18:11:23 +04:00
|
|
|
|
private function getCacheKey($key) {
|
2013-01-11 02:30:26 +04:00
|
|
|
|
$prefix = 'LDAP-'.$this->configID.'-'.$this->configPrefix.'-';
|
2012-07-26 18:11:23 +04:00
|
|
|
|
if(is_null($key)) {
|
|
|
|
|
return $prefix;
|
|
|
|
|
}
|
|
|
|
|
return $prefix.md5($key);
|
|
|
|
|
}
|
|
|
|
|
|
2014-02-06 19:30:58 +04:00
|
|
|
|
/**
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param string $key
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return mixed|null
|
2014-02-06 19:30:58 +04:00
|
|
|
|
*/
|
2012-07-26 18:11:23 +04:00
|
|
|
|
public function getFromCache($key) {
|
|
|
|
|
if(!$this->configured) {
|
|
|
|
|
$this->readConfiguration();
|
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
if(!$this->configuration->ldapCacheTTL) {
|
2012-07-26 18:11:23 +04:00
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
if(!$this->isCached($key)) {
|
|
|
|
|
return null;
|
|
|
|
|
|
|
|
|
|
}
|
|
|
|
|
$key = $this->getCacheKey($key);
|
|
|
|
|
|
|
|
|
|
return unserialize(base64_decode($this->cache->get($key)));
|
|
|
|
|
}
|
|
|
|
|
|
2014-02-19 12:31:54 +04:00
|
|
|
|
/**
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param string $key
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return bool
|
2014-02-19 12:31:54 +04:00
|
|
|
|
*/
|
2012-07-26 18:11:23 +04:00
|
|
|
|
public function isCached($key) {
|
|
|
|
|
if(!$this->configured) {
|
|
|
|
|
$this->readConfiguration();
|
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
if(!$this->configuration->ldapCacheTTL) {
|
2012-07-26 18:11:23 +04:00
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
$key = $this->getCacheKey($key);
|
|
|
|
|
return $this->cache->hasKey($key);
|
|
|
|
|
}
|
|
|
|
|
|
2014-02-06 19:30:58 +04:00
|
|
|
|
/**
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param string $key
|
|
|
|
|
* @param mixed $value
|
2014-02-06 19:30:58 +04:00
|
|
|
|
*/
|
2012-07-26 18:11:23 +04:00
|
|
|
|
public function writeToCache($key, $value) {
|
|
|
|
|
if(!$this->configured) {
|
|
|
|
|
$this->readConfiguration();
|
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
if(!$this->configuration->ldapCacheTTL
|
|
|
|
|
|| !$this->configuration->ldapConfigurationActive) {
|
2012-07-26 18:11:23 +04:00
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
$key = $this->getCacheKey($key);
|
|
|
|
|
$value = base64_encode(serialize($value));
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$this->cache->set($key, $value, $this->configuration->ldapCacheTTL);
|
2012-07-26 18:11:23 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public function clearCache() {
|
|
|
|
|
$this->cache->clear($this->getCacheKey(null));
|
|
|
|
|
}
|
|
|
|
|
|
2013-06-22 01:58:44 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* Caches the general LDAP configuration.
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param bool $force optional. true, if the re-read should be forced. defaults
|
2013-09-27 00:31:57 +04:00
|
|
|
|
* to false.
|
|
|
|
|
* @return null
|
2012-07-25 14:37:39 +04:00
|
|
|
|
*/
|
|
|
|
|
private function readConfiguration($force = false) {
|
|
|
|
|
if((!$this->configured || $force) && !is_null($this->configID)) {
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$this->configuration->readConfiguration();
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$this->configured = $this->validateConfiguration();
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-30 06:44:11 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* set LDAP configuration with values delivered by an array, not read from configuration
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param array $config array that holds the config parameters in an associated array
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @param array &$setParameters optional; array where the set fields will be given to
|
2014-02-06 19:30:58 +04:00
|
|
|
|
* @return boolean true if config validates, false otherwise. Check with $setParameters for detailed success on single parameters
|
2012-07-25 14:37:39 +04:00
|
|
|
|
*/
|
|
|
|
|
public function setConfiguration($config, &$setParameters = null) {
|
2013-09-27 00:31:57 +04:00
|
|
|
|
if(is_null($setParameters)) {
|
|
|
|
|
$setParameters = array();
|
2012-07-25 14:37:39 +04:00
|
|
|
|
}
|
2013-10-24 22:26:05 +04:00
|
|
|
|
$this->doNotValidate = false;
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$this->configuration->setConfiguration($config, $setParameters);
|
|
|
|
|
if(count($setParameters) > 0) {
|
|
|
|
|
$this->configured = $this->validateConfiguration();
|
2012-07-25 14:37:39 +04:00
|
|
|
|
}
|
|
|
|
|
|
2013-10-24 22:26:05 +04:00
|
|
|
|
|
2012-07-25 14:37:39 +04:00
|
|
|
|
return $this->configured;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-30 06:44:11 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* saves the current Configuration in the database and empties the
|
2013-09-27 00:31:57 +04:00
|
|
|
|
* cache
|
|
|
|
|
* @return null
|
2013-01-30 06:44:11 +04:00
|
|
|
|
*/
|
2013-01-20 21:02:44 +04:00
|
|
|
|
public function saveConfiguration() {
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$this->configuration->saveConfiguration();
|
2013-01-24 15:44:30 +04:00
|
|
|
|
$this->clearCache();
|
2013-01-20 21:02:44 +04:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-18 16:53:26 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* get the current LDAP configuration
|
2013-01-18 16:53:26 +04:00
|
|
|
|
* @return array
|
|
|
|
|
*/
|
|
|
|
|
public function getConfiguration() {
|
2013-01-24 02:40:21 +04:00
|
|
|
|
$this->readConfiguration();
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$config = $this->configuration->getConfiguration();
|
|
|
|
|
$cta = $this->configuration->getConfigTranslationArray();
|
|
|
|
|
$result = array();
|
|
|
|
|
foreach($cta as $dbkey => $configkey) {
|
|
|
|
|
switch($configkey) {
|
|
|
|
|
case 'homeFolderNamingRule':
|
|
|
|
|
if(strpos($config[$configkey], 'attr:') === 0) {
|
|
|
|
|
$result[$dbkey] = substr($config[$configkey], 5);
|
|
|
|
|
} else {
|
|
|
|
|
$result[$dbkey] = '';
|
|
|
|
|
}
|
|
|
|
|
break;
|
|
|
|
|
case 'ldapBase':
|
|
|
|
|
case 'ldapBaseUsers':
|
|
|
|
|
case 'ldapBaseGroups':
|
|
|
|
|
case 'ldapAttributesForUserSearch':
|
|
|
|
|
case 'ldapAttributesForGroupSearch':
|
|
|
|
|
if(is_array($config[$configkey])) {
|
|
|
|
|
$result[$dbkey] = implode("\n", $config[$configkey]);
|
|
|
|
|
break;
|
|
|
|
|
} //else follows default
|
|
|
|
|
default:
|
|
|
|
|
$result[$dbkey] = $config[$configkey];
|
2013-01-24 02:40:21 +04:00
|
|
|
|
}
|
2013-01-20 21:02:44 +04:00
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
return $result;
|
2013-01-18 16:53:26 +04:00
|
|
|
|
}
|
|
|
|
|
|
2013-09-27 00:31:57 +04:00
|
|
|
|
private function doSoftValidation() {
|
|
|
|
|
//if User or Group Base are not set, take over Base DN setting
|
|
|
|
|
foreach(array('ldapBaseUsers', 'ldapBaseGroups') as $keyBase) {
|
2014-05-16 00:47:28 +04:00
|
|
|
|
$val = $this->configuration->$keyBase;
|
2013-09-27 00:31:57 +04:00
|
|
|
|
if(empty($val)) {
|
|
|
|
|
$obj = strpos('Users', $keyBase) !== false ? 'Users' : 'Groups';
|
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
|
|
|
|
'Base tree for '.$obj.
|
|
|
|
|
' is empty, using Base DN',
|
|
|
|
|
\OCP\Util::INFO);
|
|
|
|
|
$this->configuration->$keyBase = $this->configuration->ldapBase;
|
|
|
|
|
}
|
2012-07-25 14:37:39 +04:00
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
|
|
|
|
|
$groupFilter = $this->configuration->ldapGroupFilter;
|
|
|
|
|
if(empty($groupFilter)) {
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
2013-09-27 00:31:57 +04:00
|
|
|
|
'No group filter is specified, LDAP group '.
|
|
|
|
|
'feature will not be used.',
|
|
|
|
|
\OCP\Util::INFO);
|
|
|
|
|
}
|
|
|
|
|
|
2013-10-17 21:40:59 +04:00
|
|
|
|
foreach(array('ldapExpertUUIDUserAttr' => 'ldapUuidUserAttribute',
|
|
|
|
|
'ldapExpertUUIDGroupAttr' => 'ldapUuidGroupAttribute')
|
|
|
|
|
as $expertSetting => $effectiveSetting) {
|
|
|
|
|
$uuidOverride = $this->configuration->$expertSetting;
|
|
|
|
|
if(!empty($uuidOverride)) {
|
|
|
|
|
$this->configuration->$effectiveSetting = $uuidOverride;
|
|
|
|
|
} else {
|
|
|
|
|
$uuidAttributes = array('auto', 'entryuuid', 'nsuniqueid',
|
|
|
|
|
'objectguid', 'guid');
|
|
|
|
|
if(!in_array($this->configuration->$effectiveSetting,
|
|
|
|
|
$uuidAttributes)
|
|
|
|
|
&& (!is_null($this->configID))) {
|
|
|
|
|
$this->configuration->$effectiveSetting = 'auto';
|
|
|
|
|
$this->configuration->saveConfiguration();
|
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
|
|
|
|
'Illegal value for the '.
|
|
|
|
|
$effectiveSetting.', '.'reset to '.
|
|
|
|
|
'autodetect.', \OCP\Util::INFO);
|
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
|
2013-10-17 21:40:59 +04:00
|
|
|
|
}
|
2012-08-23 20:29:43 +04:00
|
|
|
|
}
|
2013-09-13 21:01:40 +04:00
|
|
|
|
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$backupPort = $this->configuration->ldapBackupPort;
|
|
|
|
|
if(empty($backupPort)) {
|
|
|
|
|
$this->configuration->backupPort = $this->configuration->ldapPort;
|
2013-01-17 16:56:37 +04:00
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
|
|
|
|
|
//make sure empty search attributes are saved as simple, empty array
|
2014-05-11 17:17:27 +04:00
|
|
|
|
$saKeys = array('ldapAttributesForUserSearch',
|
2013-09-27 00:31:57 +04:00
|
|
|
|
'ldapAttributesForGroupSearch');
|
2014-05-11 17:17:27 +04:00
|
|
|
|
foreach($saKeys as $key) {
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$val = $this->configuration->$key;
|
|
|
|
|
if(is_array($val) && count($val) === 1 && empty($val[0])) {
|
|
|
|
|
$this->configuration->$key = array();
|
2013-01-31 04:46:34 +04:00
|
|
|
|
}
|
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
|
|
|
|
|
if((stripos($this->configuration->ldapHost, 'ldaps://') === 0)
|
|
|
|
|
&& $this->configuration->ldapTLS) {
|
|
|
|
|
$this->configuration->ldapTLS = false;
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
2013-09-27 00:31:57 +04:00
|
|
|
|
'LDAPS (already using secure connection) and '.
|
|
|
|
|
'TLS do not work together. Switched off TLS.',
|
|
|
|
|
\OCP\Util::INFO);
|
2013-02-06 17:30:17 +04:00
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
}
|
2013-01-31 04:46:34 +04:00
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
/**
|
|
|
|
|
* @return bool
|
|
|
|
|
*/
|
2013-09-27 00:31:57 +04:00
|
|
|
|
private function doCriticalValidation() {
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$configurationOK = true;
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$errorStr = 'Configuration Error (prefix '.
|
|
|
|
|
strval($this->configPrefix).'): ';
|
|
|
|
|
|
|
|
|
|
//options that shall not be empty
|
|
|
|
|
$options = array('ldapHost', 'ldapPort', 'ldapUserDisplayName',
|
|
|
|
|
'ldapGroupDisplayName', 'ldapLoginFilter');
|
|
|
|
|
foreach($options as $key) {
|
|
|
|
|
$val = $this->configuration->$key;
|
|
|
|
|
if(empty($val)) {
|
|
|
|
|
switch($key) {
|
|
|
|
|
case 'ldapHost':
|
|
|
|
|
$subj = 'LDAP Host';
|
|
|
|
|
break;
|
|
|
|
|
case 'ldapPort':
|
|
|
|
|
$subj = 'LDAP Port';
|
|
|
|
|
break;
|
|
|
|
|
case 'ldapUserDisplayName':
|
|
|
|
|
$subj = 'LDAP User Display Name';
|
|
|
|
|
break;
|
|
|
|
|
case 'ldapGroupDisplayName':
|
|
|
|
|
$subj = 'LDAP Group Display Name';
|
|
|
|
|
break;
|
|
|
|
|
case 'ldapLoginFilter':
|
|
|
|
|
$subj = 'LDAP Login Filter';
|
|
|
|
|
break;
|
|
|
|
|
default:
|
|
|
|
|
$subj = $key;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
$configurationOK = false;
|
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
|
|
|
|
$errorStr.'No '.$subj.' given!',
|
|
|
|
|
\OCP\Util::WARN);
|
|
|
|
|
}
|
2012-07-25 14:37:39 +04:00
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
|
|
|
|
|
//combinations
|
|
|
|
|
$agent = $this->configuration->ldapAgentName;
|
|
|
|
|
$pwd = $this->configuration->ldapAgentPassword;
|
|
|
|
|
if((empty($agent) && !empty($pwd)) || (!empty($agent) && empty($pwd))) {
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$errorStr.'either no password is given for the'.
|
|
|
|
|
'user agent or a password is given, but not an'.
|
|
|
|
|
'LDAP agent.',
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::WARN);
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$configurationOK = false;
|
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
|
|
|
|
|
$base = $this->configuration->ldapBase;
|
|
|
|
|
$baseUsers = $this->configuration->ldapBaseUsers;
|
|
|
|
|
$baseGroups = $this->configuration->ldapBaseGroups;
|
|
|
|
|
|
|
|
|
|
if(empty($base) && empty($baseUsers) && empty($baseGroups)) {
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$errorStr.'Not a single Base DN given.',
|
|
|
|
|
\OCP\Util::WARN);
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$configurationOK = false;
|
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
|
|
|
|
|
if(mb_strpos($this->configuration->ldapLoginFilter, '%uid', 0, 'UTF-8')
|
|
|
|
|
=== false) {
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$errorStr.'login filter does not contain %uid '.
|
|
|
|
|
'place holder.',
|
|
|
|
|
\OCP\Util::WARN);
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$configurationOK = false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return $configurationOK;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-18 16:35:40 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* Validates the user specified configuration
|
2014-05-11 18:29:59 +04:00
|
|
|
|
* @return bool true if configuration seems OK, false otherwise
|
2013-01-18 16:35:40 +04:00
|
|
|
|
*/
|
2013-09-27 00:31:57 +04:00
|
|
|
|
private function validateConfiguration() {
|
2013-10-24 22:26:05 +04:00
|
|
|
|
|
|
|
|
|
if($this->doNotValidate) {
|
|
|
|
|
//don't do a validation if it is a new configuration with pure
|
|
|
|
|
//default values. Will be allowed on changes via __set or
|
|
|
|
|
//setConfiguration
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
2013-09-27 00:31:57 +04:00
|
|
|
|
// first step: "soft" checks: settings that are not really
|
|
|
|
|
// necessary, but advisable. If left empty, give an info message
|
|
|
|
|
$this->doSoftValidation();
|
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
//second step: critical checks. If left empty or filled wrong, mark as
|
|
|
|
|
//not configured and give a warning.
|
2013-09-27 00:31:57 +04:00
|
|
|
|
return $this->doCriticalValidation();
|
2013-01-18 16:35:40 +04:00
|
|
|
|
}
|
|
|
|
|
|
2013-09-27 00:31:57 +04:00
|
|
|
|
|
2012-07-25 14:37:39 +04:00
|
|
|
|
/**
|
|
|
|
|
* Connects and Binds to LDAP
|
|
|
|
|
*/
|
|
|
|
|
private function establishConnection() {
|
2013-09-27 00:31:57 +04:00
|
|
|
|
if(!$this->configuration->ldapConfigurationActive) {
|
2013-01-25 01:39:05 +04:00
|
|
|
|
return null;
|
|
|
|
|
}
|
2012-07-25 20:40:48 +04:00
|
|
|
|
static $phpLDAPinstalled = true;
|
|
|
|
|
if(!$phpLDAPinstalled) {
|
|
|
|
|
return false;
|
|
|
|
|
}
|
2014-06-11 15:35:35 +04:00
|
|
|
|
if(!$this->ignoreValidation && !$this->configured) {
|
2013-09-27 00:31:57 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
|
|
|
|
'Configuration is invalid, cannot connect',
|
|
|
|
|
\OCP\Util::WARN);
|
2012-07-25 14:37:39 +04:00
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
if(!$this->ldapConnectionRes) {
|
2013-08-18 15:33:59 +04:00
|
|
|
|
if(!$this->ldap->areLDAPFunctionsAvailable()) {
|
2012-07-25 20:40:48 +04:00
|
|
|
|
$phpLDAPinstalled = false;
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
2013-09-27 00:31:57 +04:00
|
|
|
|
'function ldap_connect is not available. Make '.
|
|
|
|
|
'sure that the PHP ldap module is installed.',
|
|
|
|
|
\OCP\Util::ERROR);
|
2012-07-25 20:40:48 +04:00
|
|
|
|
|
|
|
|
|
return false;
|
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
if($this->configuration->turnOffCertCheck) {
|
2012-08-06 01:00:47 +04:00
|
|
|
|
if(putenv('LDAPTLS_REQCERT=never')) {
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
|
|
|
|
'Turned off SSL certificate validation successfully.',
|
|
|
|
|
\OCP\Util::WARN);
|
2012-08-06 01:00:47 +04:00
|
|
|
|
} else {
|
2013-09-27 00:31:57 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
|
|
|
|
'Could not turn off SSL certificate validation.',
|
|
|
|
|
\OCP\Util::WARN);
|
2012-08-06 01:00:47 +04:00
|
|
|
|
}
|
|
|
|
|
}
|
2013-09-27 00:31:57 +04:00
|
|
|
|
if(!$this->configuration->ldapOverrideMainServer
|
|
|
|
|
&& !$this->getFromCache('overrideMainServer')) {
|
|
|
|
|
$this->doConnect($this->configuration->ldapHost,
|
|
|
|
|
$this->configuration->ldapPort);
|
2013-01-17 16:31:14 +04:00
|
|
|
|
$bindStatus = $this->bind();
|
2013-09-11 21:42:08 +04:00
|
|
|
|
$error = $this->ldap->isResource($this->ldapConnectionRes) ?
|
|
|
|
|
$this->ldap->errno($this->ldapConnectionRes) : -1;
|
2013-01-17 16:46:32 +04:00
|
|
|
|
} else {
|
|
|
|
|
$bindStatus = false;
|
2013-01-17 16:56:37 +04:00
|
|
|
|
$error = null;
|
2013-01-17 16:31:14 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
//if LDAP server is not reachable, try the Backup (Replica!) Server
|
2013-05-25 13:02:51 +04:00
|
|
|
|
if((!$bindStatus && ($error !== 0))
|
2013-09-27 00:31:57 +04:00
|
|
|
|
|| $this->configuration->ldapOverrideMainServer
|
2013-01-17 16:31:14 +04:00
|
|
|
|
|| $this->getFromCache('overrideMainServer')) {
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$this->doConnect($this->configuration->ldapBackupHost,
|
|
|
|
|
$this->configuration->ldapBackupPort);
|
2013-01-17 16:31:14 +04:00
|
|
|
|
$bindStatus = $this->bind();
|
2013-05-25 13:02:51 +04:00
|
|
|
|
if(!$bindStatus && $error === -1) {
|
2013-01-17 16:56:37 +04:00
|
|
|
|
//when bind to backup server succeeded and failed to main server,
|
|
|
|
|
//skip contacting him until next cache refresh
|
2013-01-17 16:31:14 +04:00
|
|
|
|
$this->writeToCache('overrideMainServer', true);
|
2012-07-25 14:37:39 +04:00
|
|
|
|
}
|
|
|
|
|
}
|
2013-01-17 16:31:14 +04:00
|
|
|
|
return $bindStatus;
|
|
|
|
|
}
|
|
|
|
|
}
|
2012-07-25 14:37:39 +04:00
|
|
|
|
|
2014-05-11 17:17:27 +04:00
|
|
|
|
/**
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param string $host
|
|
|
|
|
* @param string $port
|
2014-05-11 17:17:27 +04:00
|
|
|
|
* @return false|void
|
|
|
|
|
*/
|
2013-01-17 16:31:14 +04:00
|
|
|
|
private function doConnect($host, $port) {
|
2013-02-06 17:32:00 +04:00
|
|
|
|
if(empty($host)) {
|
|
|
|
|
return false;
|
|
|
|
|
}
|
2013-06-04 01:07:32 +04:00
|
|
|
|
if(strpos($host, '://') !== false) {
|
2014-05-11 17:17:27 +04:00
|
|
|
|
//ldap_connect ignores port parameter when URLs are passed
|
2013-06-04 01:07:32 +04:00
|
|
|
|
$host .= ':' . $port;
|
|
|
|
|
}
|
2013-08-18 15:33:59 +04:00
|
|
|
|
$this->ldapConnectionRes = $this->ldap->connect($host, $port);
|
2013-08-20 16:23:49 +04:00
|
|
|
|
if($this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_PROTOCOL_VERSION, 3)) {
|
|
|
|
|
if($this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_REFERRALS, 0)) {
|
2013-09-27 00:31:57 +04:00
|
|
|
|
if($this->configuration->ldapTLS) {
|
2013-08-20 16:23:49 +04:00
|
|
|
|
$this->ldap->startTls($this->ldapConnectionRes);
|
2013-01-17 16:31:14 +04:00
|
|
|
|
}
|
|
|
|
|
}
|
2012-07-25 14:37:39 +04:00
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* Binds to LDAP
|
|
|
|
|
*/
|
|
|
|
|
public function bind() {
|
2013-05-25 13:03:58 +04:00
|
|
|
|
static $getConnectionResourceAttempt = false;
|
2013-09-27 00:31:57 +04:00
|
|
|
|
if(!$this->configuration->ldapConfigurationActive) {
|
2013-01-25 01:39:05 +04:00
|
|
|
|
return false;
|
|
|
|
|
}
|
2013-05-25 13:03:58 +04:00
|
|
|
|
if($getConnectionResourceAttempt) {
|
|
|
|
|
$getConnectionResourceAttempt = false;
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
$getConnectionResourceAttempt = true;
|
2013-02-06 17:32:00 +04:00
|
|
|
|
$cr = $this->getConnectionResource();
|
2013-05-25 13:03:58 +04:00
|
|
|
|
$getConnectionResourceAttempt = false;
|
2013-08-20 14:39:24 +04:00
|
|
|
|
if(!$this->ldap->isResource($cr)) {
|
2013-02-06 17:32:00 +04:00
|
|
|
|
return false;
|
|
|
|
|
}
|
2013-09-11 21:42:08 +04:00
|
|
|
|
$ldapLogin = @$this->ldap->bind($cr,
|
2013-09-27 00:31:57 +04:00
|
|
|
|
$this->configuration->ldapAgentName,
|
|
|
|
|
$this->configuration->ldapAgentPassword);
|
2012-07-25 14:37:39 +04:00
|
|
|
|
if(!$ldapLogin) {
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::writeLog('user_ldap',
|
2013-08-18 15:33:59 +04:00
|
|
|
|
'Bind failed: ' . $this->ldap->errno($cr) . ': ' . $this->ldap->error($cr),
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::ERROR);
|
2012-07-25 14:37:39 +04:00
|
|
|
|
$this->ldapConnectionRes = null;
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
2012-09-19 17:35:50 +04:00
|
|
|
|
}
|