nextcloud/apps/user_ldap/group_ldap.php

315 lines
9.6 KiB
PHP
Raw Normal View History

<?php
/**
* ownCloud LDAP group backend
*
* @author Arthur Schiwon
* @copyright 2012 Arthur Schiwon blizzz@owncloud.com
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
* License as published by the Free Software Foundation; either
* version 3 of the License, or any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
*
* You should have received a copy of the GNU Affero General Public
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
*
*/
namespace OCA\user_ldap;
class GROUP_LDAP extends lib\Access implements \OCP\GroupInterface {
protected $enabled = false;
public function setConnector(lib\Connection &$connection) {
parent::setConnector($connection);
$filter = $this->connection->ldapGroupFilter;
$gassoc = $this->connection->ldapGroupMemberAssocAttr;
if(!empty($filter) && !empty($gassoc)) {
$this->enabled = true;
}
}
/**
* @brief is user in group?
* @param $uid uid of the user
* @param $gid gid of the group
* @returns true/false
*
* Checks whether the user is member of a group or not.
*/
public function inGroup($uid, $gid) {
if(!$this->enabled) {
return false;
}
if($this->connection->isCached('inGroup'.$uid.':'.$gid)) {
return $this->connection->getFromCache('inGroup'.$uid.':'.$gid);
}
$dn_user = $this->username2dn($uid);
$dn_group = $this->groupname2dn($gid);
// just in case
if(!$dn_group || !$dn_user) {
$this->connection->writeToCache('inGroup'.$uid.':'.$gid, false);
return false;
2012-04-15 15:37:35 +04:00
}
//usually, LDAP attributes are said to be case insensitive. But there are exceptions of course.
$members = $this->readAttribute($dn_group, $this->connection->ldapGroupMemberAssocAttr);
if(!$members) {
$this->connection->writeToCache('inGroup'.$uid.':'.$gid, false);
return false;
}
//extra work if we don't get back user DNs
//TODO: this can be done with one LDAP query
if(strtolower($this->connection->ldapGroupMemberAssocAttr) == 'memberuid') {
$dns = array();
foreach($members as $mid) {
$filter = str_replace('%uid', $mid, $this->connection->ldapLoginFilter);
$ldap_users = $this->fetchListOfUsers($filter, 'dn');
if(count($ldap_users) < 1) {
continue;
}
$dns[] = $ldap_users[0];
}
$members = $dns;
}
$isInGroup = in_array($dn_user, $members);
$this->connection->writeToCache('inGroup'.$uid.':'.$gid, $isInGroup);
return $isInGroup;
}
/**
* @brief Get all groups a user belongs to
* @param $uid Name of the user
* @returns array with group names
*
* This function fetches all groups a user belongs to. It does not check
* if the user exists at all.
*/
public function getUserGroups($uid) {
if(!$this->enabled) {
return array();
}
$cacheKey = 'getUserGroups'.$uid;
if($this->connection->isCached($cacheKey)) {
return $this->connection->getFromCache($cacheKey);
}
$userDN = $this->username2dn($uid);
if(!$userDN) {
$this->connection->writeToCache($cacheKey, array());
return array();
}
//uniqueMember takes DN, memberuid the uid, so we need to distinguish
if((strtolower($this->connection->ldapGroupMemberAssocAttr) == 'uniquemember')
2012-07-25 15:09:51 +04:00
|| (strtolower($this->connection->ldapGroupMemberAssocAttr) == 'member')
2012-07-25 17:10:56 +04:00
) {
$uid = $userDN;
} else if(strtolower($this->connection->ldapGroupMemberAssocAttr) == 'memberuid') {
$result = $this->readAttribute($userDN, 'uid');
$uid = $result[0];
} else {
// just in case
$uid = $userDN;
}
$filter = $this->combineFilterWithAnd(array(
$this->connection->ldapGroupFilter,
$this->connection->ldapGroupMemberAssocAttr.'='.$uid
));
2012-11-04 14:10:46 +04:00
$groups = $this->fetchListOfGroups($filter, array($this->connection->ldapGroupDisplayName, 'dn'));
$groups = array_unique($this->ownCloudGroupNames($groups), SORT_LOCALE_STRING);
$this->connection->writeToCache($cacheKey, $groups);
return $groups;
}
/**
* @brief get a list of all users in a group
* @returns array with user ids
*/
public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
if(!$this->enabled) {
return array();
}
if(!$this->groupExists($gid)) {
2013-03-20 16:17:40 +04:00
return array();
}
$cachekey = 'usersInGroup-'.$gid.'-'.$search.'-'.$limit.'-'.$offset;
// check for cache of the exact query
$groupUsers = $this->connection->getFromCache($cachekey);
if(!is_null($groupUsers)) {
return $groupUsers;
}
// check for cache of the query without limit and offset
$groupUsers = $this->connection->getFromCache('usersInGroup-'.$gid.'-'.$search);
if(!is_null($groupUsers)) {
$groupUsers = array_slice($groupUsers, $offset, $limit);
$this->connection->writeToCache($cachekey, $groupUsers);
return $groupUsers;
}
if($limit == -1) {
$limit = null;
}
$groupDN = $this->groupname2dn($gid);
if(!$groupDN) {
// group couldn't be found, return empty resultset
$this->connection->writeToCache($cachekey, array());
return array();
}
$members = $this->readAttribute($groupDN, $this->connection->ldapGroupMemberAssocAttr);
if(!$members) {
//in case users could not be retrieved, return empty resultset
$this->connection->writeToCache($cachekey, array());
return array();
}
$groupUsers = array();
$isMemberUid = (strtolower($this->connection->ldapGroupMemberAssocAttr) == 'memberuid');
foreach($members as $member) {
if($isMemberUid) {
//we got uids, need to get their DNs to 'tranlsate' them to usernames
$filter = $this->combineFilterWithAnd(array(
2013-02-15 01:16:48 +04:00
\OCP\Util::mb_str_replace('%uid', $member,
2013-04-03 19:52:34 +04:00
$this->connection->ldapLoginFilter, 'UTF-8'),
$this->getFilterPartForUserSearch($search)
));
$ldap_users = $this->fetchListOfUsers($filter, 'dn');
if(count($ldap_users) < 1) {
continue;
}
$groupUsers[] = $this->dn2username($ldap_users[0]);
} else {
//we got DNs, check if we need to filter by search or we can give back all of them
if(!empty($search)) {
2013-02-15 01:16:48 +04:00
if(!$this->readAttribute($member,
$this->connection->ldapUserDisplayName,
$this->getFilterPartForUserSearch($search))) {
continue;
}
}
// dn2username will also check if the users belong to the allowed base
2012-07-25 15:09:51 +04:00
if($ocname = $this->dn2username($member)) {
$groupUsers[] = $ocname;
}
}
}
natsort($groupUsers);
$this->connection->writeToCache('usersInGroup-'.$gid.'-'.$search, $groupUsers);
$groupUsers = array_slice($groupUsers, $offset, $limit);
$this->connection->writeToCache($cachekey, $groupUsers);
return $groupUsers;
}
/**
* @brief get a list of all display names in a group
* @returns array with display names (value) and user ids(key)
*/
public function displayNamesInGroup($gid, $search, $limit, $offset) {
if(!$this->enabled) {
return array();
}
if(!$this->groupExists($gid)) {
2013-03-20 16:17:40 +04:00
return array();
}
$users = $this->usersInGroup($gid, $search, $limit, $offset);
$displayNames = array();
foreach($users as $user) {
$displayNames[$user] = \OC_User::getDisplayName($user);
}
return $displayNames;
}
/**
* @brief get a list of all groups
* @returns array with group names
*
* Returns a list with all groups
*/
public function getGroups($search = '', $limit = -1, $offset = 0) {
if(!$this->enabled) {
return array();
}
2012-10-27 19:36:55 +04:00
$cachekey = 'getGroups-'.$search.'-'.$limit.'-'.$offset;
2012-10-27 19:36:55 +04:00
//Check cache before driving unnecessary searches
\OCP\Util::writeLog('user_ldap', 'getGroups '.$cachekey, \OCP\Util::DEBUG);
$ldap_groups = $this->connection->getFromCache($cachekey);
if(!is_null($ldap_groups)) {
return $ldap_groups;
}
2012-10-27 19:36:55 +04:00
2013-02-15 01:16:48 +04:00
// if we'd pass -1 to LDAP search, we'd end up in a Protocol
// error. With a limit of 0, we get 0 results. So we pass null.
2012-10-27 19:36:55 +04:00
if($limit <= 0) {
$limit = null;
}
2012-10-27 19:36:55 +04:00
$filter = $this->combineFilterWithAnd(array(
$this->connection->ldapGroupFilter,
$this->getFilterPartForGroupSearch($search)
2012-10-27 19:36:55 +04:00
));
\OCP\Util::writeLog('user_ldap', 'getGroups Filter '.$filter, \OCP\Util::DEBUG);
2013-02-15 01:16:48 +04:00
$ldap_groups = $this->fetchListOfGroups($filter, array($this->connection->ldapGroupDisplayName, 'dn'),
$limit, $offset);
2012-10-27 19:36:55 +04:00
$ldap_groups = $this->ownCloudGroupNames($ldap_groups);
$this->connection->writeToCache($cachekey, $ldap_groups);
return $ldap_groups;
}
public function groupMatchesFilter($group) {
return (strripos($group, $this->groupSearch) !== false);
}
/**
* check if a group exists
* @param string $gid
* @return bool
*/
2012-09-07 17:22:01 +04:00
public function groupExists($gid) {
if($this->connection->isCached('groupExists'.$gid)) {
return $this->connection->getFromCache('groupExists'.$gid);
}
//getting dn, if false the group does not exist. If dn, it may be mapped only, requires more checking.
$dn = $this->groupname2dn($gid);
if(!$dn) {
$this->connection->writeToCache('groupExists'.$gid, false);
return false;
}
//if group really still exists, we will be able to read its objectclass
$objcs = $this->readAttribute($dn, 'objectclass');
if(!$objcs || empty($objcs)) {
$this->connection->writeToCache('groupExists'.$gid, false);
return false;
}
$this->connection->writeToCache('groupExists'.$gid, true);
return true;
}
/**
* @brief Check if backend implements actions
* @param $actions bitwise-or'ed actions
* @returns boolean
*
* Returns the supported actions as int to be
* compared with OC_USER_BACKEND_CREATE_USER etc.
*/
public function implementsActions($actions) {
return (bool)(OC_GROUP_BACKEND_GET_DISPLAYNAME & $actions);
}
2013-02-15 01:16:48 +04:00
}