2012-04-14 20:05:29 +04:00
|
|
|
|
<?php
|
|
|
|
|
|
|
|
|
|
/**
|
|
|
|
|
* ownCloud – LDAP group backend
|
|
|
|
|
*
|
|
|
|
|
* @author Arthur Schiwon
|
|
|
|
|
* @copyright 2012 Arthur Schiwon blizzz@owncloud.com
|
|
|
|
|
*
|
|
|
|
|
* This library is free software; you can redistribute it and/or
|
|
|
|
|
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
|
|
|
|
* License as published by the Free Software Foundation; either
|
|
|
|
|
* version 3 of the License, or any later version.
|
|
|
|
|
*
|
|
|
|
|
* This library is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU Affero General Public
|
|
|
|
|
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
*
|
|
|
|
|
*/
|
|
|
|
|
|
2012-07-20 19:43:44 +04:00
|
|
|
|
namespace OCA\user_ldap;
|
|
|
|
|
|
2013-09-10 19:11:02 +04:00
|
|
|
|
use OCA\user_ldap\lib\Access;
|
|
|
|
|
use OCA\user_ldap\lib\BackendUtility;
|
|
|
|
|
|
|
|
|
|
class GROUP_LDAP extends BackendUtility implements \OCP\GroupInterface {
|
2012-07-25 14:37:39 +04:00
|
|
|
|
protected $enabled = false;
|
2012-04-14 20:05:29 +04:00
|
|
|
|
|
2013-09-10 19:11:02 +04:00
|
|
|
|
public function __construct(Access $access) {
|
|
|
|
|
parent::__construct($access);
|
|
|
|
|
$filter = $this->access->connection->ldapGroupFilter;
|
|
|
|
|
$gassoc = $this->access->connection->ldapGroupMemberAssocAttr;
|
2012-10-24 20:24:06 +04:00
|
|
|
|
if(!empty($filter) && !empty($gassoc)) {
|
2012-10-24 02:22:04 +04:00
|
|
|
|
$this->enabled = true;
|
2012-06-01 15:49:11 +04:00
|
|
|
|
}
|
2012-04-14 20:05:29 +04:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* is user in group?
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param string $uid uid of the user
|
|
|
|
|
* @param string $gid gid of the group
|
|
|
|
|
* @return bool
|
2012-04-14 20:05:29 +04:00
|
|
|
|
*
|
|
|
|
|
* Checks whether the user is member of a group or not.
|
|
|
|
|
*/
|
|
|
|
|
public function inGroup($uid, $gid) {
|
2012-07-25 14:37:39 +04:00
|
|
|
|
if(!$this->enabled) {
|
2012-06-01 15:49:11 +04:00
|
|
|
|
return false;
|
|
|
|
|
}
|
2013-09-10 19:11:02 +04:00
|
|
|
|
if($this->access->connection->isCached('inGroup'.$uid.':'.$gid)) {
|
|
|
|
|
return $this->access->connection->getFromCache('inGroup'.$uid.':'.$gid);
|
2012-06-07 20:55:32 +04:00
|
|
|
|
}
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$dn_user = $this->access->username2dn($uid);
|
|
|
|
|
$dn_group = $this->access->groupname2dn($gid);
|
2012-04-25 22:34:58 +04:00
|
|
|
|
// just in case
|
|
|
|
|
if(!$dn_group || !$dn_user) {
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$this->access->connection->writeToCache('inGroup'.$uid.':'.$gid, false);
|
2012-04-23 15:04:58 +04:00
|
|
|
|
return false;
|
2012-04-15 15:37:35 +04:00
|
|
|
|
}
|
2012-05-10 14:59:05 +04:00
|
|
|
|
//usually, LDAP attributes are said to be case insensitive. But there are exceptions of course.
|
2013-12-06 19:46:52 +04:00
|
|
|
|
$members = array_keys($this->_groupMembers($dn_group));
|
2012-05-11 17:42:05 +04:00
|
|
|
|
if(!$members) {
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$this->access->connection->writeToCache('inGroup'.$uid.':'.$gid, false);
|
2012-05-10 14:59:05 +04:00
|
|
|
|
return false;
|
|
|
|
|
}
|
2012-05-09 01:47:23 +04:00
|
|
|
|
|
|
|
|
|
//extra work if we don't get back user DNs
|
|
|
|
|
//TODO: this can be done with one LDAP query
|
2013-09-10 19:11:02 +04:00
|
|
|
|
if(strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid') {
|
2012-05-09 01:47:23 +04:00
|
|
|
|
$dns = array();
|
2012-06-07 20:55:32 +04:00
|
|
|
|
foreach($members as $mid) {
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$filter = str_replace('%uid', $mid, $this->access->connection->ldapLoginFilter);
|
|
|
|
|
$ldap_users = $this->access->fetchListOfUsers($filter, 'dn');
|
2012-05-09 01:47:23 +04:00
|
|
|
|
if(count($ldap_users) < 1) {
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
$dns[] = $ldap_users[0];
|
|
|
|
|
}
|
|
|
|
|
$members = $dns;
|
|
|
|
|
}
|
2012-04-25 22:34:58 +04:00
|
|
|
|
|
2012-07-26 18:11:23 +04:00
|
|
|
|
$isInGroup = in_array($dn_user, $members);
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$this->access->connection->writeToCache('inGroup'.$uid.':'.$gid, $isInGroup);
|
2012-07-26 18:11:23 +04:00
|
|
|
|
|
|
|
|
|
return $isInGroup;
|
2012-04-14 20:05:29 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-04-14 19:39:29 +04:00
|
|
|
|
/**
|
|
|
|
|
* @param string $dnGroup
|
|
|
|
|
* @param array|null &$seen
|
|
|
|
|
*/
|
2013-12-11 13:43:48 +04:00
|
|
|
|
private function _groupMembers($dnGroup, &$seen = null) {
|
|
|
|
|
if ($seen === null) {
|
|
|
|
|
$seen = array();
|
2013-12-06 19:46:52 +04:00
|
|
|
|
}
|
2013-12-11 13:43:48 +04:00
|
|
|
|
$allMembers = array();
|
|
|
|
|
if (array_key_exists($dnGroup, $seen)) {
|
2014-02-21 20:09:36 +04:00
|
|
|
|
// avoid loops
|
|
|
|
|
return array();
|
2013-12-06 19:46:52 +04:00
|
|
|
|
}
|
|
|
|
|
// used extensively in cron job, caching makes sense for nested groups
|
2013-12-11 13:43:48 +04:00
|
|
|
|
$cacheKey = '_groupMembers'.$dnGroup;
|
|
|
|
|
if($this->access->connection->isCached($cacheKey)) {
|
|
|
|
|
return $this->access->connection->getFromCache($cacheKey);
|
2013-12-06 19:46:52 +04:00
|
|
|
|
}
|
2013-12-11 13:43:48 +04:00
|
|
|
|
$seen[$dnGroup] = 1;
|
|
|
|
|
$members = $this->access->readAttribute($dnGroup, $this->access->connection->ldapGroupMemberAssocAttr,
|
|
|
|
|
$this->access->connection->ldapGroupFilter);
|
2014-02-12 19:56:17 +04:00
|
|
|
|
if (is_array($members)) {
|
2013-12-11 13:43:48 +04:00
|
|
|
|
foreach ($members as $memberDN) {
|
2014-02-21 20:09:36 +04:00
|
|
|
|
$allMembers[$memberDN] = 1;
|
2014-02-12 19:56:17 +04:00
|
|
|
|
$nestedGroups = $this->access->connection->ldapNestedGroups;
|
|
|
|
|
if (!empty($nestedGroups)) {
|
2013-12-11 13:43:48 +04:00
|
|
|
|
$subMembers = $this->_groupMembers($memberDN, $seen);
|
|
|
|
|
if ($subMembers) {
|
|
|
|
|
$allMembers = array_merge($allMembers, $subMembers);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
2014-02-21 20:09:36 +04:00
|
|
|
|
$this->access->connection->writeToCache($cacheKey, $allMembers);
|
2013-12-11 13:43:48 +04:00
|
|
|
|
return $allMembers;
|
|
|
|
|
}
|
2013-12-06 19:46:52 +04:00
|
|
|
|
|
2012-04-14 20:05:29 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* Get all groups a user belongs to
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param string $uid Name of the user
|
|
|
|
|
* @return array with group names
|
2012-04-14 20:05:29 +04:00
|
|
|
|
*
|
|
|
|
|
* This function fetches all groups a user belongs to. It does not check
|
|
|
|
|
* if the user exists at all.
|
|
|
|
|
*/
|
|
|
|
|
public function getUserGroups($uid) {
|
2012-07-25 14:37:39 +04:00
|
|
|
|
if(!$this->enabled) {
|
2012-06-01 15:49:11 +04:00
|
|
|
|
return array();
|
|
|
|
|
}
|
2012-10-23 00:46:28 +04:00
|
|
|
|
$cacheKey = 'getUserGroups'.$uid;
|
2013-09-10 19:11:02 +04:00
|
|
|
|
if($this->access->connection->isCached($cacheKey)) {
|
|
|
|
|
return $this->access->connection->getFromCache($cacheKey);
|
2012-06-07 20:55:32 +04:00
|
|
|
|
}
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$userDN = $this->access->username2dn($uid);
|
2012-04-25 22:34:58 +04:00
|
|
|
|
if(!$userDN) {
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$this->access->connection->writeToCache($cacheKey, array());
|
2012-04-25 22:34:58 +04:00
|
|
|
|
return array();
|
|
|
|
|
}
|
|
|
|
|
|
2012-05-09 01:47:23 +04:00
|
|
|
|
//uniqueMember takes DN, memberuid the uid, so we need to distinguish
|
2013-09-10 19:11:02 +04:00
|
|
|
|
if((strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'uniquemember')
|
|
|
|
|
|| (strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'member')
|
2012-07-25 17:10:56 +04:00
|
|
|
|
) {
|
2012-05-09 01:47:23 +04:00
|
|
|
|
$uid = $userDN;
|
2013-09-10 19:11:02 +04:00
|
|
|
|
} else if(strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid') {
|
|
|
|
|
$result = $this->access->readAttribute($userDN, 'uid');
|
2012-05-09 01:47:23 +04:00
|
|
|
|
$uid = $result[0];
|
|
|
|
|
} else {
|
|
|
|
|
// just in case
|
|
|
|
|
$uid = $userDN;
|
|
|
|
|
}
|
|
|
|
|
|
2014-02-12 19:56:17 +04:00
|
|
|
|
$groups = array_values($this->getGroupsByMember($uid));
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$groups = array_unique($this->access->ownCloudGroupNames($groups), SORT_LOCALE_STRING);
|
|
|
|
|
$this->access->connection->writeToCache($cacheKey, $groups);
|
2012-04-15 15:56:14 +04:00
|
|
|
|
|
2012-07-26 18:11:23 +04:00
|
|
|
|
return $groups;
|
2012-04-14 20:05:29 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-04-14 19:39:29 +04:00
|
|
|
|
/**
|
|
|
|
|
* @param string $dn
|
|
|
|
|
* @param array|null &$seen
|
|
|
|
|
*/
|
2014-02-12 19:56:17 +04:00
|
|
|
|
private function getGroupsByMember($dn, &$seen = null) {
|
2013-12-11 13:43:48 +04:00
|
|
|
|
if ($seen === null) {
|
|
|
|
|
$seen = array();
|
2013-12-06 19:46:52 +04:00
|
|
|
|
}
|
2013-12-11 13:43:48 +04:00
|
|
|
|
$allGroups = array();
|
2013-12-06 19:46:52 +04:00
|
|
|
|
if (array_key_exists($dn, $seen)) {
|
2014-05-16 00:47:28 +04:00
|
|
|
|
// avoid loops
|
|
|
|
|
return array();
|
2013-12-06 19:46:52 +04:00
|
|
|
|
}
|
2014-02-21 20:09:36 +04:00
|
|
|
|
$seen[$dn] = true;
|
2013-12-08 18:49:25 +04:00
|
|
|
|
$filter = $this->access->combineFilterWithAnd(array(
|
2013-12-06 19:46:52 +04:00
|
|
|
|
$this->access->connection->ldapGroupFilter,
|
|
|
|
|
$this->access->connection->ldapGroupMemberAssocAttr.'='.$dn
|
|
|
|
|
));
|
2013-12-08 18:49:25 +04:00
|
|
|
|
$groups = $this->access->fetchListOfGroups($filter,
|
2013-12-11 13:43:48 +04:00
|
|
|
|
array($this->access->connection->ldapGroupDisplayName, 'dn'));
|
2014-02-12 19:56:17 +04:00
|
|
|
|
if (is_array($groups)) {
|
2013-12-11 13:43:48 +04:00
|
|
|
|
foreach ($groups as $groupobj) {
|
|
|
|
|
$groupDN = $groupobj['dn'];
|
|
|
|
|
$allGroups[$groupDN] = $groupobj;
|
2014-02-12 19:56:17 +04:00
|
|
|
|
$nestedGroups = $this->access->connection->ldapNestedGroups;
|
|
|
|
|
if (!empty($nestedGroups)) {
|
|
|
|
|
$supergroups = $this->getGroupsByMember($groupDN, $seen);
|
|
|
|
|
if (is_array($supergroups) && (count($supergroups)>0)) {
|
2013-12-11 13:43:48 +04:00
|
|
|
|
$allGroups = array_merge($allGroups, $supergroups);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
return $allGroups;
|
2013-12-06 19:46:52 +04:00
|
|
|
|
}
|
|
|
|
|
|
2012-04-14 20:05:29 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* get a list of all users in a group
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @return array with user ids
|
2012-04-14 20:05:29 +04:00
|
|
|
|
*/
|
2012-08-14 16:30:03 +04:00
|
|
|
|
public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
|
2012-07-25 14:37:39 +04:00
|
|
|
|
if(!$this->enabled) {
|
2012-06-01 15:49:11 +04:00
|
|
|
|
return array();
|
|
|
|
|
}
|
2013-03-19 14:52:35 +04:00
|
|
|
|
if(!$this->groupExists($gid)) {
|
2013-03-20 16:17:40 +04:00
|
|
|
|
return array();
|
2013-03-19 14:52:35 +04:00
|
|
|
|
}
|
2012-10-27 21:42:50 +04:00
|
|
|
|
$cachekey = 'usersInGroup-'.$gid.'-'.$search.'-'.$limit.'-'.$offset;
|
|
|
|
|
// check for cache of the exact query
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$groupUsers = $this->access->connection->getFromCache($cachekey);
|
2012-10-27 21:42:50 +04:00
|
|
|
|
if(!is_null($groupUsers)) {
|
|
|
|
|
return $groupUsers;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// check for cache of the query without limit and offset
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$groupUsers = $this->access->connection->getFromCache('usersInGroup-'.$gid.'-'.$search);
|
2012-10-27 21:42:50 +04:00
|
|
|
|
if(!is_null($groupUsers)) {
|
|
|
|
|
$groupUsers = array_slice($groupUsers, $offset, $limit);
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$this->access->connection->writeToCache($cachekey, $groupUsers);
|
2012-10-27 21:42:50 +04:00
|
|
|
|
return $groupUsers;
|
2012-06-07 20:55:32 +04:00
|
|
|
|
}
|
2012-06-01 15:49:11 +04:00
|
|
|
|
|
2013-04-21 00:45:17 +04:00
|
|
|
|
if($limit === -1) {
|
2012-10-27 21:42:50 +04:00
|
|
|
|
$limit = null;
|
|
|
|
|
}
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$groupDN = $this->access->groupname2dn($gid);
|
2012-04-25 22:34:58 +04:00
|
|
|
|
if(!$groupDN) {
|
2012-10-27 21:42:50 +04:00
|
|
|
|
// group couldn't be found, return empty resultset
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$this->access->connection->writeToCache($cachekey, array());
|
2012-04-25 22:34:58 +04:00
|
|
|
|
return array();
|
|
|
|
|
}
|
2012-05-10 14:59:05 +04:00
|
|
|
|
|
2013-12-06 19:46:52 +04:00
|
|
|
|
$members = array_keys($this->_groupMembers($groupDN));
|
2012-05-11 17:42:05 +04:00
|
|
|
|
if(!$members) {
|
2012-10-27 21:42:50 +04:00
|
|
|
|
//in case users could not be retrieved, return empty resultset
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$this->access->connection->writeToCache($cachekey, array());
|
2012-05-10 14:59:05 +04:00
|
|
|
|
return array();
|
|
|
|
|
}
|
|
|
|
|
|
2012-10-27 21:42:50 +04:00
|
|
|
|
$groupUsers = array();
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$isMemberUid = (strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid');
|
2012-04-25 22:34:58 +04:00
|
|
|
|
foreach($members as $member) {
|
2012-05-11 21:21:02 +04:00
|
|
|
|
if($isMemberUid) {
|
2012-10-27 21:42:50 +04:00
|
|
|
|
//we got uids, need to get their DNs to 'tranlsate' them to usernames
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$filter = $this->access->combineFilterWithAnd(array(
|
2013-02-15 01:16:48 +04:00
|
|
|
|
\OCP\Util::mb_str_replace('%uid', $member,
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$this->access->connection->ldapLoginFilter, 'UTF-8'),
|
|
|
|
|
$this->access->getFilterPartForUserSearch($search)
|
2012-10-27 21:42:50 +04:00
|
|
|
|
));
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$ldap_users = $this->access->fetchListOfUsers($filter, 'dn');
|
2012-05-09 01:47:23 +04:00
|
|
|
|
if(count($ldap_users) < 1) {
|
|
|
|
|
continue;
|
|
|
|
|
}
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$groupUsers[] = $this->access->dn2username($ldap_users[0]);
|
2012-05-11 21:21:02 +04:00
|
|
|
|
} else {
|
2012-10-27 21:42:50 +04:00
|
|
|
|
//we got DNs, check if we need to filter by search or we can give back all of them
|
2013-01-31 04:46:34 +04:00
|
|
|
|
if(!empty($search)) {
|
2013-09-10 19:11:02 +04:00
|
|
|
|
if(!$this->access->readAttribute($member,
|
|
|
|
|
$this->access->connection->ldapUserDisplayName,
|
|
|
|
|
$this->access->getFilterPartForUserSearch($search))) {
|
2012-10-27 21:42:50 +04:00
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
// dn2username will also check if the users belong to the allowed base
|
2013-09-10 19:11:02 +04:00
|
|
|
|
if($ocname = $this->access->dn2username($member)) {
|
2012-10-27 21:42:50 +04:00
|
|
|
|
$groupUsers[] = $ocname;
|
2012-06-19 03:15:58 +04:00
|
|
|
|
}
|
2012-05-09 01:47:23 +04:00
|
|
|
|
}
|
2012-05-11 21:21:02 +04:00
|
|
|
|
}
|
2012-10-27 21:42:50 +04:00
|
|
|
|
natsort($groupUsers);
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$this->access->connection->writeToCache('usersInGroup-'.$gid.'-'.$search, $groupUsers);
|
2012-10-27 21:42:50 +04:00
|
|
|
|
$groupUsers = array_slice($groupUsers, $offset, $limit);
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$this->access->connection->writeToCache($cachekey, $groupUsers);
|
2012-08-14 16:30:03 +04:00
|
|
|
|
|
2012-10-27 21:42:50 +04:00
|
|
|
|
return $groupUsers;
|
2012-04-14 20:05:29 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-04-04 20:56:34 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* returns the number of users in a group, who match the search term
|
2014-05-15 16:12:17 +04:00
|
|
|
|
* @param string $gid the internal group name
|
|
|
|
|
* @param string $search optional, a search string
|
2014-05-16 00:41:39 +04:00
|
|
|
|
* @return int|bool
|
2014-04-04 20:56:34 +04:00
|
|
|
|
*/
|
|
|
|
|
public function countUsersInGroup($gid, $search = '') {
|
|
|
|
|
$cachekey = 'countUsersInGroup-'.$gid.'-'.$search;
|
|
|
|
|
if(!$this->enabled || !$this->groupExists($gid)) {
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
$groupUsers = $this->access->connection->getFromCache($cachekey);
|
|
|
|
|
if(!is_null($groupUsers)) {
|
|
|
|
|
return $groupUsers;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
$groupDN = $this->access->groupname2dn($gid);
|
|
|
|
|
if(!$groupDN) {
|
|
|
|
|
// group couldn't be found, return empty resultset
|
|
|
|
|
$this->access->connection->writeToCache($cachekey, false);
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
$members = array_keys($this->_groupMembers($groupDN));
|
|
|
|
|
if(!$members) {
|
|
|
|
|
//in case users could not be retrieved, return empty resultset
|
|
|
|
|
$this->access->connection->writeToCache($cachekey, false);
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if(empty($search)) {
|
|
|
|
|
$groupUsers = count($members);
|
|
|
|
|
$this->access->connection->writeToCache($cachekey, $groupUsers);
|
|
|
|
|
return $groupUsers;
|
|
|
|
|
}
|
|
|
|
|
$isMemberUid =
|
|
|
|
|
(strtolower($this->access->connection->ldapGroupMemberAssocAttr)
|
|
|
|
|
=== 'memberuid');
|
|
|
|
|
|
|
|
|
|
//we need to apply the search filter
|
|
|
|
|
//alternatives that need to be checked:
|
|
|
|
|
//a) get all users by search filter and array_intersect them
|
|
|
|
|
//b) a, but only when less than 1k 10k ?k users like it is
|
|
|
|
|
//c) put all DNs|uids in a LDAP filter, combine with the search string
|
|
|
|
|
// and let it count.
|
|
|
|
|
//For now this is not important, because the only use of this method
|
|
|
|
|
//does not supply a search string
|
2014-04-08 14:53:59 +04:00
|
|
|
|
$groupUsers = array();
|
2014-04-04 20:56:34 +04:00
|
|
|
|
foreach($members as $member) {
|
|
|
|
|
if($isMemberUid) {
|
|
|
|
|
//we got uids, need to get their DNs to 'tranlsate' them to usernames
|
|
|
|
|
$filter = $this->access->combineFilterWithAnd(array(
|
|
|
|
|
\OCP\Util::mb_str_replace('%uid', $member,
|
|
|
|
|
$this->access->connection->ldapLoginFilter, 'UTF-8'),
|
|
|
|
|
$this->access->getFilterPartForUserSearch($search)
|
|
|
|
|
));
|
|
|
|
|
$ldap_users = $this->access->fetchListOfUsers($filter, 'dn');
|
|
|
|
|
if(count($ldap_users) < 1) {
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
$groupUsers[] = $this->access->dn2username($ldap_users[0]);
|
|
|
|
|
} else {
|
|
|
|
|
//we need to apply the search filter now
|
|
|
|
|
if(!$this->access->readAttribute($member,
|
|
|
|
|
$this->access->connection->ldapUserDisplayName,
|
|
|
|
|
$this->access->getFilterPartForUserSearch($search))) {
|
|
|
|
|
continue;
|
|
|
|
|
}
|
|
|
|
|
// dn2username will also check if the users belong to the allowed base
|
|
|
|
|
if($ocname = $this->access->dn2username($member)) {
|
|
|
|
|
$groupUsers[] = $ocname;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2014-04-08 14:53:59 +04:00
|
|
|
|
return count($groupUsers);
|
2014-04-04 20:56:34 +04:00
|
|
|
|
}
|
|
|
|
|
|
2012-04-14 20:05:29 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* get a list of all groups
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @return array with group names
|
2012-04-14 20:05:29 +04:00
|
|
|
|
*
|
2014-03-04 21:02:27 +04:00
|
|
|
|
* Returns a list with all groups (used by getGroups)
|
2012-04-14 20:05:29 +04:00
|
|
|
|
*/
|
2014-03-13 13:57:19 +04:00
|
|
|
|
protected function getGroupsChunk($search = '', $limit = -1, $offset = 0) {
|
2012-07-25 14:37:39 +04:00
|
|
|
|
if(!$this->enabled) {
|
2012-06-01 15:49:11 +04:00
|
|
|
|
return array();
|
|
|
|
|
}
|
2012-10-27 19:36:55 +04:00
|
|
|
|
$cachekey = 'getGroups-'.$search.'-'.$limit.'-'.$offset;
|
2012-08-14 16:22:05 +04:00
|
|
|
|
|
2012-10-27 19:36:55 +04:00
|
|
|
|
//Check cache before driving unnecessary searches
|
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'getGroups '.$cachekey, \OCP\Util::DEBUG);
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$ldap_groups = $this->access->connection->getFromCache($cachekey);
|
2012-10-27 19:36:55 +04:00
|
|
|
|
if(!is_null($ldap_groups)) {
|
|
|
|
|
return $ldap_groups;
|
2012-06-07 20:55:32 +04:00
|
|
|
|
}
|
2012-10-27 19:36:55 +04:00
|
|
|
|
|
2013-02-15 01:16:48 +04:00
|
|
|
|
// if we'd pass -1 to LDAP search, we'd end up in a Protocol
|
|
|
|
|
// error. With a limit of 0, we get 0 results. So we pass null.
|
2012-10-27 19:36:55 +04:00
|
|
|
|
if($limit <= 0) {
|
2012-08-22 12:29:15 +04:00
|
|
|
|
$limit = null;
|
|
|
|
|
}
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$filter = $this->access->combineFilterWithAnd(array(
|
|
|
|
|
$this->access->connection->ldapGroupFilter,
|
|
|
|
|
$this->access->getFilterPartForGroupSearch($search)
|
2012-10-27 19:36:55 +04:00
|
|
|
|
));
|
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'getGroups Filter '.$filter, \OCP\Util::DEBUG);
|
2013-09-11 21:42:08 +04:00
|
|
|
|
$ldap_groups = $this->access->fetchListOfGroups($filter,
|
|
|
|
|
array($this->access->connection->ldapGroupDisplayName, 'dn'),
|
|
|
|
|
$limit,
|
|
|
|
|
$offset);
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$ldap_groups = $this->access->ownCloudGroupNames($ldap_groups);
|
2012-10-27 19:36:55 +04:00
|
|
|
|
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$this->access->connection->writeToCache($cachekey, $ldap_groups);
|
2012-10-27 19:36:55 +04:00
|
|
|
|
return $ldap_groups;
|
2012-08-14 16:22:05 +04:00
|
|
|
|
}
|
2012-07-26 18:11:23 +04:00
|
|
|
|
|
2013-12-06 18:46:00 +04:00
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* get a list of all groups using a paged search
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @return array with group names
|
2013-12-06 18:46:00 +04:00
|
|
|
|
*
|
|
|
|
|
* Returns a list with all groups
|
2014-03-04 21:02:27 +04:00
|
|
|
|
* Uses a paged search if available to override a
|
|
|
|
|
* server side search limit.
|
|
|
|
|
* (active directory has a limit of 1000 by default)
|
2013-12-06 18:46:00 +04:00
|
|
|
|
*/
|
2014-03-04 21:02:27 +04:00
|
|
|
|
public function getGroups($search = '', $limit = -1, $offset = 0) {
|
2013-12-06 18:46:00 +04:00
|
|
|
|
if(!$this->enabled) {
|
|
|
|
|
return array();
|
|
|
|
|
}
|
2014-03-04 21:02:27 +04:00
|
|
|
|
$pagingsize = $this->access->connection->ldapPagingSize;
|
|
|
|
|
if ((! $this->access->connection->hasPagedResultSupport)
|
|
|
|
|
|| empty($pagingsize)) {
|
|
|
|
|
return $this->getGroupsChunk($search, $limit, $offset);
|
2013-12-06 18:46:00 +04:00
|
|
|
|
}
|
2014-03-13 12:33:07 +04:00
|
|
|
|
$maxGroups = 100000; // limit max results (just for safety reasons)
|
2014-03-05 00:07:27 +04:00
|
|
|
|
if ($limit > -1) {
|
2014-03-13 12:33:07 +04:00
|
|
|
|
$overallLimit = min($limit, $maxGroups);
|
2014-03-05 00:07:27 +04:00
|
|
|
|
} else {
|
2014-03-13 12:33:07 +04:00
|
|
|
|
$overallLimit = $maxGroups;
|
|
|
|
|
}
|
|
|
|
|
$chunkOffset = $offset;
|
|
|
|
|
$allGroups = array();
|
|
|
|
|
while ($chunkOffset < $overallLimit) {
|
|
|
|
|
$chunkLimit = min($pagingsize, $overallLimit - $chunkOffset);
|
|
|
|
|
$ldapGroups = $this->getGroupsChunk($search, $chunkLimit, $chunkOffset);
|
|
|
|
|
$nread = count($ldapGroups);
|
|
|
|
|
\OCP\Util::writeLog('user_ldap', 'getGroups('.$search.'): read '.$nread.' at offset '.$chunkOffset.' (limit: '.$chunkLimit.')', \OCP\Util::DEBUG);
|
2013-12-06 18:46:00 +04:00
|
|
|
|
if ($nread) {
|
2014-03-13 12:33:07 +04:00
|
|
|
|
$allGroups = array_merge($allGroups, $ldapGroups);
|
|
|
|
|
$chunkOffset += $nread;
|
2013-12-06 18:46:00 +04:00
|
|
|
|
}
|
2014-03-13 12:33:07 +04:00
|
|
|
|
if ($nread < $chunkLimit) {
|
2013-12-06 18:46:00 +04:00
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
2014-03-13 12:33:07 +04:00
|
|
|
|
return $allGroups;
|
2013-12-06 18:46:00 +04:00
|
|
|
|
}
|
|
|
|
|
|
2014-04-14 19:39:29 +04:00
|
|
|
|
/**
|
|
|
|
|
* @param string $group
|
|
|
|
|
*/
|
2012-08-14 16:22:05 +04:00
|
|
|
|
public function groupMatchesFilter($group) {
|
|
|
|
|
return (strripos($group, $this->groupSearch) !== false);
|
2012-04-14 20:05:29 +04:00
|
|
|
|
}
|
|
|
|
|
|
2012-04-16 18:23:00 +04:00
|
|
|
|
/**
|
|
|
|
|
* check if a group exists
|
|
|
|
|
* @param string $gid
|
|
|
|
|
* @return bool
|
|
|
|
|
*/
|
2012-09-07 17:22:01 +04:00
|
|
|
|
public function groupExists($gid) {
|
2013-09-10 19:11:02 +04:00
|
|
|
|
if($this->access->connection->isCached('groupExists'.$gid)) {
|
|
|
|
|
return $this->access->connection->getFromCache('groupExists'.$gid);
|
2012-08-29 21:11:32 +04:00
|
|
|
|
}
|
|
|
|
|
|
2013-09-11 21:42:08 +04:00
|
|
|
|
//getting dn, if false the group does not exist. If dn, it may be mapped
|
|
|
|
|
//only, requires more checking.
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$dn = $this->access->groupname2dn($gid);
|
2012-08-29 21:11:32 +04:00
|
|
|
|
if(!$dn) {
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$this->access->connection->writeToCache('groupExists'.$gid, false);
|
2012-08-29 21:11:32 +04:00
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
//if group really still exists, we will be able to read its objectclass
|
2014-06-12 15:32:21 +04:00
|
|
|
|
$objcs = $this->access->readAttribute($dn, '');
|
2012-08-29 21:11:32 +04:00
|
|
|
|
if(!$objcs || empty($objcs)) {
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$this->access->connection->writeToCache('groupExists'.$gid, false);
|
2012-08-29 21:11:32 +04:00
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
2013-09-10 19:11:02 +04:00
|
|
|
|
$this->access->connection->writeToCache('groupExists'.$gid, true);
|
2012-08-29 21:11:32 +04:00
|
|
|
|
return true;
|
2012-04-16 18:23:00 +04:00
|
|
|
|
}
|
2012-07-24 13:18:08 +04:00
|
|
|
|
|
|
|
|
|
/**
|
2014-05-19 19:50:53 +04:00
|
|
|
|
* Check if backend implements actions
|
2014-05-13 15:29:25 +04:00
|
|
|
|
* @param int $actions bitwise-or'ed actions
|
|
|
|
|
* @return boolean
|
2012-07-24 13:18:08 +04:00
|
|
|
|
*
|
|
|
|
|
* Returns the supported actions as int to be
|
|
|
|
|
* compared with OC_USER_BACKEND_CREATE_USER etc.
|
|
|
|
|
*/
|
|
|
|
|
public function implementsActions($actions) {
|
2014-03-14 16:51:17 +04:00
|
|
|
|
return (bool)(OC_GROUP_BACKEND_COUNT_USERS & $actions);
|
2012-07-24 13:18:08 +04:00
|
|
|
|
}
|
2013-02-15 01:16:48 +04:00
|
|
|
|
}
|