|
1
|
<?php
|
|
2
|
|
|
3
|
/**
|
|
4
|
* @file
|
|
5
|
* Cron relate functions.
|
|
6
|
*/
|
|
7
|
|
|
8
|
/**
|
|
9
|
* Function to respond to ldap associated drupal accounts which no
|
|
10
|
* longer have a related LDAP entry.
|
|
11
|
*
|
|
12
|
* @param LdapUserConf $ldap_user_conf
|
|
13
|
*
|
|
14
|
* @return boolean FALSE on error or incompletion or TRUE otherwise
|
|
15
|
*/
|
|
16
|
function _ldap_user_orphans($ldap_user_conf) {
|
|
17
|
if (!$ldap_user_conf->orphanedDrupalAcctBehavior ||
|
|
18
|
$ldap_user_conf->orphanedDrupalAcctBehavior == 'ldap_user_orphan_do_not_check') {
|
|
19
|
return TRUE;
|
|
20
|
}
|
|
21
|
|
|
22
|
/**
|
|
23
|
* query drupal accounts
|
|
24
|
* - ldap associated drupal accounts
|
|
25
|
* - where (ldap_user_current_dn not null)
|
|
26
|
* - ordered by ldap_user_last_checked
|
|
27
|
* - order by uid asc (get oldest first)
|
|
28
|
*/
|
|
29
|
|
|
30
|
$last_uid_checked = variable_get('ldap_user_cron_last_uid_checked', 1);
|
|
31
|
|
|
32
|
$query = new EntityFieldQuery();
|
|
33
|
$query->entityCondition('entity_type', 'user')
|
|
34
|
->fieldCondition('ldap_user_puid_sid', 'value', 'NULL', '!=')
|
|
35
|
->fieldCondition('ldap_user_puid_property', 'value', 'NULL', '!=')
|
|
36
|
->fieldCondition('ldap_user_puid', 'value', 'NULL', '!=')
|
|
37
|
->fieldCondition('ldap_user_current_dn', 'value', 'NULL', '!=')
|
|
38
|
->propertyCondition('uid', $last_uid_checked, '>')
|
|
39
|
->propertyCondition('status', 1)
|
|
40
|
->propertyOrderBy('uid', 'ASC')
|
|
41
|
->range(0, $ldap_user_conf->orphanedCheckQty)
|
|
42
|
// Run the query as user 1.
|
|
43
|
->addMetaData('account', user_load(1));
|
|
44
|
$result = $query->execute();
|
|
45
|
|
|
46
|
$email_list = [];
|
|
47
|
$ldap_servers = ldap_servers_get_servers(NULL, 'enabled');
|
|
48
|
$watchdogs_sids_missing_watchdogged = [];
|
|
49
|
/**
|
|
50
|
* First produce array of form:
|
|
51
|
* $drupal_users[$sid][$puid_attr][$puid]['exists'] = bool
|
|
52
|
* signifying if corresponding LDAP Entry exists.
|
|
53
|
*/
|
|
54
|
if (!(isset($result['user']) && count($result['user']) > 0)) {
|
|
55
|
return TRUE;
|
|
56
|
}
|
|
57
|
|
|
58
|
$uids = array_keys($result['user']);
|
|
59
|
$user_count = count($uids);
|
|
60
|
|
|
61
|
// If maxed out reset uid check counter.
|
|
62
|
if ($user_count < $ldap_user_conf->orphanedCheckQty) {
|
|
63
|
variable_set('ldap_user_cron_last_uid_checked', 1);
|
|
64
|
}
|
|
65
|
else {
|
|
66
|
variable_set('ldap_user_cron_last_uid_checked', $uids[count($uids) - 1]);
|
|
67
|
}
|
|
68
|
|
|
69
|
$batches = floor($user_count / LDAP_SERVERS_MAXFILTER_ORS) + 1;
|
|
70
|
// e.g. 175 users and 50 max ldap query ors will yield 4 batches.
|
|
71
|
for ($batch = 1; $batch <= $batches; $batch++) {
|
|
72
|
$email_list = _ldap_user_orphan_process_batch($ldap_user_conf, $batch, $user_count, $uids, $ldap_servers, $watchdogs_sids_missing_watchdogged, $query, $email_list);
|
|
73
|
}
|
|
74
|
|
|
75
|
if (count($email_list) > 0) {
|
|
76
|
$site_email = variable_get('site_mail', FALSE);
|
|
77
|
$params = ['accounts' => $email_list];
|
|
78
|
if ($site_email) {
|
|
79
|
drupal_mail(
|
|
80
|
'ldap_user',
|
|
81
|
'orphaned_accounts',
|
|
82
|
$site_email,
|
|
83
|
language_default(),
|
|
84
|
$params
|
|
85
|
);
|
|
86
|
}
|
|
87
|
}
|
|
88
|
|
|
89
|
return TRUE;
|
|
90
|
}
|
|
91
|
|
|
92
|
/**
|
|
93
|
* @param $ldap_user_conf
|
|
94
|
* @param $batch
|
|
95
|
* @param $user_count
|
|
96
|
* @param $uids
|
|
97
|
* @param $ldap_servers
|
|
98
|
* @param $watchdogs_sids_missing_watchdogged
|
|
99
|
* @param $query
|
|
100
|
* @param $email_list
|
|
101
|
*
|
|
102
|
* @return array
|
|
103
|
* @throws \Exception
|
|
104
|
*/
|
|
105
|
function _ldap_user_orphan_process_batch($ldap_user_conf, $batch, $user_count, $uids, $ldap_servers, $watchdogs_sids_missing_watchdogged, $query, $email_list) {
|
|
106
|
$filters = [];
|
|
107
|
$drupal_users = [];
|
|
108
|
/**
|
|
109
|
* 1. populate $drupal_users[$sid][$puid_attr][$puid]['exists'] = TRUE
|
|
110
|
*
|
|
111
|
* e.g. first batch $i=0; $i<50; $i++
|
|
112
|
* 2nd batch $i=50; $i<100; $i++
|
|
113
|
* 4th batch $i=150; $i<175; $i++
|
|
114
|
*/
|
|
115
|
// e.g 0, 50, 100.
|
|
116
|
$start = ($batch - 1) * LDAP_SERVERS_MAXFILTER_ORS;
|
|
117
|
// e.g. 50, 100, 150.
|
|
118
|
$end_plus_1 = min(($batch) * LDAP_SERVERS_MAXFILTER_ORS, $user_count);
|
|
119
|
// e.g. 50, 50; 100, 50.
|
|
120
|
$batch_uids = array_slice($uids, $start, ($end_plus_1 - $start));
|
|
121
|
$accounts = entity_load('user', $batch_uids);
|
|
122
|
|
|
123
|
foreach ($accounts as $uid => $user) {
|
|
124
|
$sid = @$user->ldap_user_puid_sid[LANGUAGE_NONE][0]['value'];
|
|
125
|
$puid = @$user->ldap_user_puid[LANGUAGE_NONE][0]['value'];
|
|
126
|
$puid_attr = @$user->ldap_user_puid_property[LANGUAGE_NONE][0]['value'];
|
|
127
|
if ($sid && $puid && $puid_attr) {
|
|
128
|
if ($ldap_servers[$sid]->unique_persistent_attr_binary) {
|
|
129
|
$filters[$sid][$puid_attr][] = "($puid_attr=" . ldap_servers_binary_filter($puid) . ")";
|
|
130
|
}
|
|
131
|
else {
|
|
132
|
$filters[$sid][$puid_attr][] = "($puid_attr=$puid)";
|
|
133
|
}
|
|
134
|
$drupal_users[$sid][$puid_attr][$puid]['uid'] = $uid;
|
|
135
|
$drupal_users[$sid][$puid_attr][$puid]['exists'] = FALSE;
|
|
136
|
}
|
|
137
|
else {
|
|
138
|
// User with missing ldap data fields
|
|
139
|
// perhaps should be watchdogged?
|
|
140
|
}
|
|
141
|
}
|
|
142
|
|
|
143
|
// 2. set $drupal_users[$sid][$puid_attr][$puid]['exists'] to FALSE
|
|
144
|
// if entry doesn't exist.
|
|
145
|
foreach ($filters as $sid => $puid_attrs) {
|
|
146
|
if (!isset($ldap_servers[$sid])) {
|
|
147
|
if (!isset($watchdogs_sids_missing_watchdogged[$sid])) {
|
|
148
|
watchdog(
|
|
149
|
'ldap_user',
|
|
150
|
'Server %sid not enabled, but needed to remove orphaned ldap users',
|
|
151
|
['%sid' => $sid],
|
|
152
|
WATCHDOG_ERROR
|
|
153
|
);
|
|
154
|
$watchdogs_sids_missing_watchdogged[$sid] = TRUE;
|
|
155
|
}
|
|
156
|
continue;
|
|
157
|
}
|
|
158
|
foreach ($puid_attrs as $puid_attr => $ors) {
|
|
159
|
// Query should look like (|(guid=3243243)(guid=3243243)(guid=3243243))
|
|
160
|
$ldap_filter = '(|' . join("", $ors) . ')';
|
|
161
|
$ldap_entries = $ldap_servers[$sid]->searchAllBaseDns($ldap_filter, [$puid_attr]);
|
|
162
|
if ($ldap_entries === FALSE) {
|
|
163
|
// If query has error, don't remove ldap entries!
|
|
164
|
unset($drupal_users[$sid]);
|
|
165
|
watchdog(
|
|
166
|
'ldap_user',
|
|
167
|
'ldap server %sid had error while querying to
|
|
168
|
deal with orphaned ldap user entries. Please check that the ldap
|
|
169
|
server is configured correctly. Query; %query',
|
|
170
|
['%sid' => $sid, '%query' => serialize($query)],
|
|
171
|
WATCHDOG_ERROR);
|
|
172
|
continue;
|
|
173
|
}
|
|
174
|
|
|
175
|
unset($ldap_entries['count']);
|
|
176
|
|
|
177
|
foreach ($ldap_entries as $i => $ldap_entry) {
|
|
178
|
$puid = $ldap_servers[$sid]->userPuidFromLdapEntry($ldap_entry);
|
|
179
|
$drupal_users[$sid][$puid_attr][$puid]['exists'] = TRUE;
|
|
180
|
}
|
|
181
|
}
|
|
182
|
}
|
|
183
|
// 3. we now have $drupal_users[$sid][$puid_attr][$puid]['exists'] = bool.
|
|
184
|
global $base_url;
|
|
185
|
foreach ($drupal_users as $sid => $puid_x_puid_attrs) {
|
|
186
|
foreach ($puid_x_puid_attrs as $puid_attr => $puids) {
|
|
187
|
foreach ($puids as $puid => $user_data) {
|
|
188
|
|
|
189
|
if ($account = $accounts[$user_data['uid']]) {
|
|
190
|
$user_edit = [];
|
|
191
|
$user_edit['ldap_user_last_checked'][LANGUAGE_NONE][0]['value'] = time();
|
|
192
|
$account = user_save($account, $user_edit, 'ldap_user');
|
|
193
|
if (!$user_data['exists']) {
|
|
194
|
/**
|
|
195
|
* $ldap_user_conf->orphanedDrupalAcctBehavior will either be
|
|
196
|
* 'ldap_user_orphan_email' or one of the user module options:
|
|
197
|
* user_cancel_block, user_cancel_block_unpublish,
|
|
198
|
* user_cancel_reassign, user_cancel_delete
|
|
199
|
*/
|
|
200
|
if ($ldap_user_conf->orphanedDrupalAcctBehavior == 'ldap_user_orphan_email') {
|
|
201
|
$email_list[] = $account->name . "," . $account->mail . "," . $base_url . "/user/" . $account->uid . "/edit";
|
|
202
|
}
|
|
203
|
else {
|
|
204
|
_user_cancel([], $account, $ldap_user_conf->orphanedDrupalAcctBehavior);
|
|
205
|
}
|
|
206
|
}
|
|
207
|
}
|
|
208
|
}
|
|
209
|
}
|
|
210
|
}
|
|
211
|
return $email_list;
|
|
212
|
}
|
