1
|
<?php
|
2
|
|
3
|
|
4
|
|
5
|
|
6
|
|
7
|
|
8
|
|
9
|
|
10
|
|
11
|
|
12
|
|
13
|
|
14
|
|
15
|
function pretty_print_ldap_entry($ldap_entry) {
|
16
|
$m=array();
|
17
|
for ($i=0; $i < $ldap_entry['count']; $i++) {
|
18
|
$k=$ldap_entry[$i];
|
19
|
$v=$ldap_entry[$k];
|
20
|
if(is_array($v)) {
|
21
|
$m2=array();
|
22
|
$max=$v['count']>3 ? 3 : $v['count'];
|
23
|
for ($j=0; $j < $max; $j++) {
|
24
|
$m2[] = $v[$j];
|
25
|
}
|
26
|
$v="(".join(", ", $m2).")";
|
27
|
}
|
28
|
$m[] = $k . ": " . $v;
|
29
|
}
|
30
|
return join(", ", $m);
|
31
|
}
|
32
|
|
33
|
|
34
|
|
35
|
|
36
|
|
37
|
|
38
|
|
39
|
|
40
|
|
41
|
class LdapServer {
|
42
|
|
43
|
|
44
|
const LDAP_CONNECT_ERROR = 0x5b;
|
45
|
const LDAP_SUCCESS = 0x00;
|
46
|
const LDAP_OPERATIONS_ERROR = 0x01;
|
47
|
const LDAP_PROTOCOL_ERROR = 0x02;
|
48
|
|
49
|
public $sid;
|
50
|
public $numericSid;
|
51
|
public $name;
|
52
|
public $status;
|
53
|
public $ldap_type;
|
54
|
public $address;
|
55
|
public $port = 389;
|
56
|
public $tls = FALSE;
|
57
|
public $followrefs = FALSE;
|
58
|
public $bind_method = 0;
|
59
|
public $basedn = array();
|
60
|
public $binddn = FALSE;
|
61
|
public $bindpw = FALSE;
|
62
|
public $user_dn_expression;
|
63
|
public $user_attr;
|
64
|
public $account_name_attr;
|
65
|
public $mail_attr;
|
66
|
public $mail_template;
|
67
|
public $picture_attr;
|
68
|
public $unique_persistent_attr;
|
69
|
public $unique_persistent_attr_binary = FALSE;
|
70
|
public $ldapToDrupalUserPhp;
|
71
|
public $testingDrupalUsername;
|
72
|
public $testingDrupalUserDn;
|
73
|
public $detailed_watchdog_log;
|
74
|
public $editPath;
|
75
|
public $queriableWithoutUserCredentials = FALSE;
|
76
|
public $userAttributeNeededCache = array();
|
77
|
|
78
|
public $groupFunctionalityUnused = 0;
|
79
|
public $groupObjectClass;
|
80
|
public $groupNested = 0;
|
81
|
public $groupDeriveFromDn = FALSE;
|
82
|
public $groupDeriveFromDnAttr = NULL;
|
83
|
public $groupUserMembershipsAttrExists = FALSE;
|
84
|
public $groupUserMembershipsAttr = NULL;
|
85
|
public $groupUserMembershipsConfigured = FALSE;
|
86
|
|
87
|
public $groupMembershipsAttr = NULL;
|
88
|
public $groupMembershipsAttrMatchingUserAttr = NULL;
|
89
|
public $groupGroupEntryMembershipsConfigured = FALSE;
|
90
|
|
91
|
public $groupTestGroupDn = NULL;
|
92
|
public $groupTestGroupDnWriteable = NULL;
|
93
|
|
94
|
private $group_properties = array(
|
95
|
'groupObjectClass', 'groupNested', 'groupDeriveFromDn', 'groupDeriveFromDnAttr', 'groupUserMembershipsAttrExists',
|
96
|
'groupUserMembershipsAttr', 'groupMembershipsAttrMatchingUserAttr', 'groupTestGroupDn', 'groupTestGroupDnWriteable'
|
97
|
);
|
98
|
|
99
|
public $paginationEnabled = FALSE;
|
100
|
public $searchPagination = FALSE;
|
101
|
public $searchPageSize = 1000;
|
102
|
public $searchPageStart = 0;
|
103
|
public $searchPageEnd = NULL;
|
104
|
|
105
|
public $inDatabase = FALSE;
|
106
|
public $connection;
|
107
|
|
108
|
|
109
|
|
110
|
|
111
|
|
112
|
public static function field_to_properties_map() {
|
113
|
return array(
|
114
|
'sid' => 'sid',
|
115
|
'numeric_sid' => 'numericSid',
|
116
|
'name' => 'name' ,
|
117
|
'status' => 'status',
|
118
|
'ldap_type' => 'ldap_type',
|
119
|
'address' => 'address',
|
120
|
'port' => 'port',
|
121
|
'tls' => 'tls',
|
122
|
'followrefs' => 'followrefs',
|
123
|
'bind_method' => 'bind_method',
|
124
|
'basedn' => 'basedn',
|
125
|
'binddn' => 'binddn',
|
126
|
'user_dn_expression' => 'user_dn_expression',
|
127
|
'user_attr' => 'user_attr',
|
128
|
'account_name_attr' => 'account_name_attr',
|
129
|
'mail_attr' => 'mail_attr',
|
130
|
'mail_template' => 'mail_template',
|
131
|
'picture_attr' => 'picture_attr',
|
132
|
'unique_persistent_attr' => 'unique_persistent_attr',
|
133
|
'unique_persistent_attr_binary' => 'unique_persistent_attr_binary',
|
134
|
'ldap_to_drupal_user' => 'ldapToDrupalUserPhp',
|
135
|
'testing_drupal_username' => 'testingDrupalUsername',
|
136
|
'testing_drupal_user_dn' => 'testingDrupalUserDn',
|
137
|
|
138
|
'grp_unused' => 'groupFunctionalityUnused',
|
139
|
'grp_object_cat' => 'groupObjectClass',
|
140
|
'grp_nested' => 'groupNested',
|
141
|
'grp_user_memb_attr_exists' => 'groupUserMembershipsAttrExists',
|
142
|
'grp_user_memb_attr' => 'groupUserMembershipsAttr',
|
143
|
'grp_memb_attr' => 'groupMembershipsAttr',
|
144
|
'grp_memb_attr_match_user_attr' => 'groupMembershipsAttrMatchingUserAttr',
|
145
|
'grp_derive_from_dn' => 'groupDeriveFromDn',
|
146
|
'grp_derive_from_dn_attr' => 'groupDeriveFromDnAttr',
|
147
|
'grp_test_grp_dn' => 'groupTestGroupDn',
|
148
|
'grp_test_grp_dn_writeable' => 'groupTestGroupDnWriteable',
|
149
|
|
150
|
'search_pagination' => 'searchPagination',
|
151
|
'search_page_size' => 'searchPageSize',
|
152
|
|
153
|
);
|
154
|
|
155
|
}
|
156
|
|
157
|
|
158
|
|
159
|
|
160
|
function __construct($sid) {
|
161
|
if (!is_scalar($sid)) {
|
162
|
return;
|
163
|
}
|
164
|
$this->detailed_watchdog_log = variable_get('ldap_help_watchdog_detail', 0);
|
165
|
$server_record = FALSE;
|
166
|
if (module_exists('ctools')) {
|
167
|
ctools_include('export');
|
168
|
$result = ctools_export_load_object('ldap_servers', 'names', array($sid));
|
169
|
if (isset($result[$sid])) {
|
170
|
$server_record = new stdClass();
|
171
|
foreach ($result[$sid] as $db_field_name => $value) {
|
172
|
$server_record->{$db_field_name} = $value;
|
173
|
}
|
174
|
}
|
175
|
|
176
|
}
|
177
|
else {
|
178
|
$select = db_select('ldap_servers')
|
179
|
->fields('ldap_servers')
|
180
|
->condition('ldap_servers.sid', $sid)
|
181
|
->execute();
|
182
|
foreach ($select as $record) {
|
183
|
if ($record->sid == $sid) {
|
184
|
$server_record = $record;
|
185
|
}
|
186
|
}
|
187
|
}
|
188
|
|
189
|
$server_record_bindpw = NULL;
|
190
|
if (!$server_record) {
|
191
|
$this->inDatabase = FALSE;
|
192
|
}
|
193
|
else {
|
194
|
$this->inDatabase = TRUE;
|
195
|
$this->sid = $sid;
|
196
|
$this->detailedWatchdogLog = variable_get('ldap_help_watchdog_detail', 0);
|
197
|
foreach ($this->field_to_properties_map() as $db_field_name => $property_name ) {
|
198
|
if (isset($server_record->$db_field_name)) {
|
199
|
$this->{$property_name} = $server_record->$db_field_name;
|
200
|
}
|
201
|
}
|
202
|
$server_record_bindpw = property_exists($server_record, 'bindpw') ? $server_record->bindpw : '';
|
203
|
}
|
204
|
$this->initDerivedProperties($server_record_bindpw);
|
205
|
}
|
206
|
|
207
|
|
208
|
|
209
|
|
210
|
protected function initDerivedProperties($bindpw) {
|
211
|
|
212
|
|
213
|
if (!$this->basedn) {
|
214
|
$this->basedn = array();
|
215
|
}
|
216
|
elseif (is_array($this->basedn)) {
|
217
|
}
|
218
|
else {
|
219
|
$basedn_unserialized = @unserialize($this->basedn);
|
220
|
if (is_array($basedn_unserialized)) {
|
221
|
$this->basedn = $basedn_unserialized;
|
222
|
}
|
223
|
else {
|
224
|
$this->basedn = array();
|
225
|
$token = is_scalar($basedn_unserialized) ? $basedn_unserialized : print_r($basedn_unserialized, TRUE);
|
226
|
debug("basednb desearialization error". $token);
|
227
|
watchdog('ldap_server', 'Failed to deserialize LdapServer::basedn of !basedn', array('!basedn' => $token), WATCHDOG_ERROR);
|
228
|
}
|
229
|
|
230
|
}
|
231
|
|
232
|
if ($this->followrefs && !function_exists('ldap_set_rebind_proc')) {
|
233
|
$this->followrefs = FALSE;
|
234
|
}
|
235
|
|
236
|
if ($bindpw) {
|
237
|
$this->bindpw = ($bindpw == '') ? '' : ldap_servers_decrypt($bindpw);
|
238
|
}
|
239
|
|
240
|
$this->paginationEnabled = (boolean)(ldap_servers_php_supports_pagination() && $this->searchPagination);
|
241
|
|
242
|
$this->queriableWithoutUserCredentials = (boolean)(
|
243
|
$this->bind_method == LDAP_SERVERS_BIND_METHOD_SERVICE_ACCT ||
|
244
|
$this->bind_method == LDAP_SERVERS_BIND_METHOD_ANON_USER
|
245
|
);
|
246
|
$this->editPath = (!$this->sid) ? '' : 'admin/config/people/ldap/servers/edit/' . $this->sid;
|
247
|
|
248
|
$this->groupGroupEntryMembershipsConfigured = ($this->groupMembershipsAttrMatchingUserAttr && $this->groupMembershipsAttr);
|
249
|
$this->groupUserMembershipsConfigured = ($this->groupUserMembershipsAttrExists && $this->groupUserMembershipsAttr);
|
250
|
}
|
251
|
|
252
|
|
253
|
|
254
|
function __destruct() {
|
255
|
|
256
|
$this->disconnect();
|
257
|
}
|
258
|
|
259
|
|
260
|
|
261
|
|
262
|
|
263
|
function __invoke() {
|
264
|
$this->connect();
|
265
|
$this->bind();
|
266
|
}
|
267
|
|
268
|
|
269
|
|
270
|
|
271
|
|
272
|
|
273
|
function connect() {
|
274
|
|
275
|
if (!$con = ldap_connect($this->address, $this->port)) {
|
276
|
watchdog('user', 'LDAP Connect failure to ' . $this->address . ':' . $this->port);
|
277
|
return LDAP_CONNECT_ERROR;
|
278
|
}
|
279
|
|
280
|
ldap_set_option($con, LDAP_OPT_PROTOCOL_VERSION, 3);
|
281
|
ldap_set_option($con, LDAP_OPT_REFERRALS, (int)$this->followrefs);
|
282
|
|
283
|
|
284
|
if ($this->tls) {
|
285
|
ldap_get_option($con, LDAP_OPT_PROTOCOL_VERSION, $vers);
|
286
|
if ($vers == -1) {
|
287
|
watchdog('user', 'Could not get LDAP protocol version.');
|
288
|
return LDAP_PROTOCOL_ERROR;
|
289
|
}
|
290
|
if ($vers != 3) {
|
291
|
watchdog('user', 'Could not start TLS, only supported by LDAP v3.');
|
292
|
return LDAP_CONNECT_ERROR;
|
293
|
}
|
294
|
elseif (!function_exists('ldap_start_tls')) {
|
295
|
watchdog('user', 'Could not start TLS. It does not seem to be supported by this PHP setup.');
|
296
|
return LDAP_CONNECT_ERROR;
|
297
|
}
|
298
|
elseif (!ldap_start_tls($con)) {
|
299
|
$msg = t("Could not start TLS. (Error %errno: %error).", array('%errno' => ldap_errno($con), '%error' => ldap_error($con)));
|
300
|
watchdog('user', $msg);
|
301
|
return LDAP_CONNECT_ERROR;
|
302
|
}
|
303
|
}
|
304
|
|
305
|
|
306
|
$this->connection = $con;
|
307
|
return LDAP_SUCCESS;
|
308
|
}
|
309
|
|
310
|
|
311
|
|
312
|
|
313
|
|
314
|
|
315
|
|
316
|
|
317
|
|
318
|
|
319
|
|
320
|
|
321
|
|
322
|
function bind($userdn = NULL, $pass = NULL, $anon_bind = FALSE) {
|
323
|
|
324
|
|
325
|
if (!$this->connection) {
|
326
|
watchdog('ldap', "LDAP bind failure for user %user. Not connected to LDAP server.", array('%user' => $userdn));
|
327
|
return LDAP_CONNECT_ERROR;
|
328
|
}
|
329
|
|
330
|
if ($anon_bind !== FALSE && $userdn === NULL && $pass === NULL && $this->bind_method == LDAP_SERVERS_BIND_METHOD_ANON) {
|
331
|
$anon_bind = TRUE;
|
332
|
}
|
333
|
if ($anon_bind === TRUE) {
|
334
|
if (@!ldap_bind($this->connection)) {
|
335
|
if ($this->detailedWatchdogLog) {
|
336
|
watchdog('ldap', "LDAP anonymous bind error. Error %errno: %error", array('%errno' => ldap_errno($this->connection), '%error' => ldap_error($this->connection)));
|
337
|
}
|
338
|
return ldap_errno($this->connection);
|
339
|
}
|
340
|
}
|
341
|
else {
|
342
|
$userdn = ($userdn != NULL) ? $userdn : $this->binddn;
|
343
|
$pass = ($pass != NULL) ? $pass : $this->bindpw;
|
344
|
|
345
|
if ($this->followrefs) {
|
346
|
$rebHandler = new LdapServersRebindHandler($userdn, $pass);
|
347
|
ldap_set_rebind_proc($this->connection, array($rebHandler, 'rebind_callback'));
|
348
|
}
|
349
|
|
350
|
if (drupal_strlen($pass) == 0 || drupal_strlen($userdn) == 0) {
|
351
|
watchdog('ldap', "LDAP bind failure for user userdn=%userdn, pass=%pass.", array('%userdn' => $userdn, '%pass' => $pass));
|
352
|
return LDAP_LOCAL_ERROR;
|
353
|
}
|
354
|
if (@!ldap_bind($this->connection, $userdn, $pass)) {
|
355
|
if ($this->detailedWatchdogLog) {
|
356
|
watchdog('ldap', "LDAP bind failure for user %user. Error %errno: %error", array('%user' => $userdn, '%errno' => ldap_errno($this->connection), '%error' => ldap_error($this->connection)));
|
357
|
}
|
358
|
return ldap_errno($this->connection);
|
359
|
}
|
360
|
}
|
361
|
|
362
|
return LDAP_SUCCESS;
|
363
|
}
|
364
|
|
365
|
|
366
|
|
367
|
|
368
|
function disconnect() {
|
369
|
if (!$this->connection) {
|
370
|
|
371
|
|
372
|
}
|
373
|
else {
|
374
|
ldap_unbind($this->connection);
|
375
|
$this->connection = NULL;
|
376
|
}
|
377
|
}
|
378
|
|
379
|
public function connectAndBindIfNotAlready() {
|
380
|
if (! $this->connection) {
|
381
|
$this->connect();
|
382
|
$this->bind();
|
383
|
}
|
384
|
}
|
385
|
|
386
|
|
387
|
|
388
|
|
389
|
|
390
|
|
391
|
|
392
|
|
393
|
|
394
|
|
395
|
|
396
|
|
397
|
|
398
|
function dnExists($dn, $return = 'boolean', $attributes = NULL) {
|
399
|
|
400
|
$params = array(
|
401
|
'base_dn' => $dn,
|
402
|
'attributes' => $attributes,
|
403
|
'attrsonly' => FALSE,
|
404
|
'filter' => '(objectclass=*)',
|
405
|
'sizelimit' => 0,
|
406
|
'timelimit' => 0,
|
407
|
'deref' => NULL,
|
408
|
);
|
409
|
|
410
|
if ($return == 'boolean' || !is_array($attributes)) {
|
411
|
$params['attributes'] = array('objectclass');
|
412
|
}
|
413
|
else {
|
414
|
$params['attributes'] = $attributes;
|
415
|
}
|
416
|
|
417
|
$result = $this->ldapQuery(LDAP_SCOPE_BASE, $params);
|
418
|
if ($result !== FALSE) {
|
419
|
$entries = @ldap_get_entries($this->connection, $result);
|
420
|
if ($entries !== FALSE && $entries['count'] > 0) {
|
421
|
return ($return == 'boolean') ? TRUE : $entries[0];
|
422
|
}
|
423
|
}
|
424
|
|
425
|
return FALSE;
|
426
|
|
427
|
}
|
428
|
|
429
|
|
430
|
|
431
|
|
432
|
|
433
|
|
434
|
|
435
|
public function countEntries($ldap_result) {
|
436
|
return ldap_count_entries($this->connection, $ldap_result);
|
437
|
}
|
438
|
|
439
|
|
440
|
|
441
|
|
442
|
|
443
|
|
444
|
|
445
|
|
446
|
|
447
|
|
448
|
|
449
|
|
450
|
|
451
|
|
452
|
public function createLdapEntry($attributes, $dn = NULL) {
|
453
|
|
454
|
if (!$this->connection) {
|
455
|
$this->connect();
|
456
|
$this->bind();
|
457
|
}
|
458
|
if (isset($attributes['dn'])) {
|
459
|
$dn = $attributes['dn'];
|
460
|
unset($attributes['dn']);
|
461
|
}
|
462
|
elseif (!$dn) {
|
463
|
return FALSE;
|
464
|
}
|
465
|
|
466
|
$result = @ldap_add($this->connection, $dn, $attributes);
|
467
|
if (!$result) {
|
468
|
$error = "LDAP Server ldap_add(%dn) Error Server ID = %sid, LDAP Err No: %ldap_errno LDAP Err Message: %ldap_err2str ";
|
469
|
$tokens = array('%dn' => $dn, '%sid' => $this->sid, '%ldap_errno' => ldap_errno($this->connection), '%ldap_err2str' => ldap_err2str(ldap_errno($this->connection)));
|
470
|
debug(t($error, $tokens));
|
471
|
watchdog('ldap_server', $error, $tokens, WATCHDOG_ERROR);
|
472
|
}
|
473
|
|
474
|
return $result;
|
475
|
}
|
476
|
|
477
|
|
478
|
|
479
|
|
480
|
|
481
|
|
482
|
|
483
|
|
484
|
|
485
|
|
486
|
|
487
|
|
488
|
static public function removeUnchangedAttributes($new_entry, $old_entry) {
|
489
|
|
490
|
foreach ($new_entry as $key => $new_val) {
|
491
|
$old_value = FALSE;
|
492
|
$key_lcase = drupal_strtolower($key);
|
493
|
if (isset($old_entry[$key_lcase])) {
|
494
|
if ($old_entry[$key_lcase]['count'] == 1) {
|
495
|
$old_value = $old_entry[$key_lcase][0];
|
496
|
$old_value_is_scalar = TRUE;
|
497
|
}
|
498
|
else {
|
499
|
unset($old_entry[$key_lcase]['count']);
|
500
|
$old_value = $old_entry[$key_lcase];
|
501
|
$old_value_is_scalar = FALSE;
|
502
|
}
|
503
|
}
|
504
|
|
505
|
|
506
|
if (is_array($new_val) && is_array($old_value) && count(array_diff($new_val, $old_value)) == 0) {
|
507
|
unset($new_entry[$key]);
|
508
|
}
|
509
|
elseif ($old_value_is_scalar && !is_array($new_val) && drupal_strtolower($old_value) == drupal_strtolower($new_val)) {
|
510
|
unset($new_entry[$key]);
|
511
|
}
|
512
|
}
|
513
|
return $new_entry;
|
514
|
}
|
515
|
|
516
|
|
517
|
|
518
|
|
519
|
|
520
|
|
521
|
|
522
|
|
523
|
|
524
|
|
525
|
|
526
|
|
527
|
|
528
|
|
529
|
|
530
|
|
531
|
|
532
|
|
533
|
function modifyLdapEntry($dn, $attributes = array(), $old_attributes = FALSE) {
|
534
|
|
535
|
$this->connectAndBindIfNotAlready();
|
536
|
|
537
|
if (!$old_attributes) {
|
538
|
$result = @ldap_read($this->connection, $dn, 'objectClass=*');
|
539
|
if (!$result) {
|
540
|
$error = "LDAP Server ldap_read(%dn) in LdapServer::modifyLdapEntry() Error Server ID = %sid, LDAP Err No: %ldap_errno LDAP Err Message: %ldap_err2str ";
|
541
|
$tokens = array('%dn' => $dn, '%sid' => $this->sid, '%ldap_errno' => ldap_errno($this->connection), '%ldap_err2str' => ldap_err2str(ldap_errno($this->connection)));
|
542
|
watchdog('ldap_server', $error, $tokens, WATCHDOG_ERROR);
|
543
|
return FALSE;
|
544
|
}
|
545
|
|
546
|
$entries = ldap_get_entries($this->connection, $result);
|
547
|
if (is_array($entries) && $entries['count'] == 1) {
|
548
|
$old_attributes = $entries[0];
|
549
|
}
|
550
|
}
|
551
|
$attributes = $this->removeUnchangedAttributes($attributes, $old_attributes);
|
552
|
|
553
|
foreach ($attributes as $key => $cur_val) {
|
554
|
$old_value = FALSE;
|
555
|
$key_lcase = drupal_strtolower($key);
|
556
|
if (isset($old_attributes[$key_lcase])) {
|
557
|
if ($old_attributes[$key_lcase]['count'] == 1) {
|
558
|
$old_value = $old_attributes[$key_lcase][0];
|
559
|
}
|
560
|
else {
|
561
|
unset($old_attributes[$key_lcase]['count']);
|
562
|
$old_value = $old_attributes[$key_lcase];
|
563
|
}
|
564
|
}
|
565
|
|
566
|
if ($cur_val == '' && $old_value != '') {
|
567
|
unset($attributes[$key]);
|
568
|
$result = @ldap_mod_del($this->connection, $dn, array($key_lcase => $old_value));
|
569
|
if (!$result) {
|
570
|
$error = "LDAP Server ldap_mod_del(%dn) in LdapServer::modifyLdapEntry() Error Server ID = %sid, LDAP Err No: %ldap_errno LDAP Err Message: %ldap_err2str ";
|
571
|
$tokens = array('%dn' => $dn, '%sid' => $this->sid, '%ldap_errno' => ldap_errno($this->connection), '%ldap_err2str' => ldap_err2str(ldap_errno($this->connection)));
|
572
|
watchdog('ldap_server', $error, $tokens, WATCHDOG_ERROR);
|
573
|
return FALSE;
|
574
|
}
|
575
|
}
|
576
|
elseif (is_array($cur_val)) {
|
577
|
foreach ($cur_val as $mv_key => $mv_cur_val) {
|
578
|
if ($mv_cur_val == '') {
|
579
|
unset($attributes[$key][$mv_key]);
|
580
|
}
|
581
|
else {
|
582
|
$attributes[$key][$mv_key] = $mv_cur_val;
|
583
|
}
|
584
|
}
|
585
|
}
|
586
|
}
|
587
|
|
588
|
if (count($attributes) > 0) {
|
589
|
$result = @ldap_modify($this->connection, $dn, $attributes);
|
590
|
if (!$result) {
|
591
|
$error = "LDAP Server ldap_modify(%dn) in LdapServer::modifyLdapEntry() Error Server ID = %sid, LDAP Err No: %ldap_errno LDAP Err Message: %ldap_err2str ";
|
592
|
$tokens = array('%dn' => $dn, '%sid' => $this->sid, '%ldap_errno' => ldap_errno($this->connection), '%ldap_err2str' => ldap_err2str(ldap_errno($this->connection)));
|
593
|
watchdog('ldap_server', $error, $tokens, WATCHDOG_ERROR);
|
594
|
return FALSE;
|
595
|
}
|
596
|
}
|
597
|
|
598
|
return TRUE;
|
599
|
|
600
|
}
|
601
|
|
602
|
|
603
|
|
604
|
|
605
|
|
606
|
|
607
|
|
608
|
|
609
|
|
610
|
public function delete($dn) {
|
611
|
if (!$this->connection) {
|
612
|
$this->connect();
|
613
|
$this->bind();
|
614
|
}
|
615
|
$result = @ldap_delete($this->connection, $dn);
|
616
|
if (!$result) {
|
617
|
$error = "LDAP Server delete(%dn) in LdapServer::delete() Error Server ID = %sid, LDAP Err No: %ldap_errno LDAP Err Message: %ldap_err2str ";
|
618
|
$tokens = array('%dn' => $dn, '%sid' => $this->sid, '%ldap_errno' => ldap_errno($this->connection), '%ldap_err2str' => ldap_err2str(ldap_errno($this->connection)));
|
619
|
watchdog('ldap_server', $error, $tokens, WATCHDOG_ERROR);
|
620
|
}
|
621
|
return $result;
|
622
|
}
|
623
|
|
624
|
|
625
|
|
626
|
|
627
|
|
628
|
|
629
|
|
630
|
|
631
|
|
632
|
|
633
|
|
634
|
|
635
|
|
636
|
|
637
|
|
638
|
|
639
|
|
640
|
|
641
|
public function searchAllBaseDns(
|
642
|
$filter,
|
643
|
$attributes = array(),
|
644
|
$attrsonly = 0,
|
645
|
$sizelimit = 0,
|
646
|
$timelimit = 0,
|
647
|
$deref = NULL,
|
648
|
$scope = LDAP_SCOPE_SUBTREE
|
649
|
) {
|
650
|
$all_entries = array();
|
651
|
foreach ($this->basedn as $base_dn) {
|
652
|
$entries = $this->search($base_dn, $filter, $attributes, $attrsonly, $sizelimit, $timelimit, $deref, $scope);
|
653
|
if ($entries === FALSE) {
|
654
|
return FALSE;
|
655
|
}
|
656
|
if (count($all_entries) == 0) {
|
657
|
$all_entries = $entries;
|
658
|
unset($all_entries['count']);
|
659
|
}
|
660
|
else {
|
661
|
$existing_count = count($all_entries);
|
662
|
unset($entries['count']);
|
663
|
foreach ($entries as $i => $entry) {
|
664
|
$all_entries[$existing_count + $i] = $entry;
|
665
|
}
|
666
|
}
|
667
|
}
|
668
|
$all_entries['count'] = count($all_entries);
|
669
|
return $all_entries;
|
670
|
|
671
|
}
|
672
|
|
673
|
|
674
|
|
675
|
|
676
|
|
677
|
|
678
|
|
679
|
|
680
|
|
681
|
|
682
|
|
683
|
|
684
|
|
685
|
|
686
|
|
687
|
|
688
|
|
689
|
|
690
|
|
691
|
|
692
|
|
693
|
function search($base_dn = NULL, $filter, $attributes = array(),
|
694
|
$attrsonly = 0, $sizelimit = 0, $timelimit = 0, $deref = NULL, $scope = LDAP_SCOPE_SUBTREE) {
|
695
|
|
696
|
|
697
|
|
698
|
|
699
|
|
700
|
|
701
|
|
702
|
|
703
|
|
704
|
if ($base_dn == NULL) {
|
705
|
if (count($this->basedn) == 1) {
|
706
|
$base_dn = $this->basedn[0];
|
707
|
}
|
708
|
else {
|
709
|
return FALSE;
|
710
|
}
|
711
|
}
|
712
|
|
713
|
$attr_display = is_array($attributes) ? join(',', $attributes) : 'none';
|
714
|
$query = 'ldap_search() call: ' . join(",\n", array(
|
715
|
'base_dn: ' . $base_dn,
|
716
|
'filter = ' . $filter,
|
717
|
'attributes: ' . $attr_display,
|
718
|
'attrsonly = ' . $attrsonly,
|
719
|
'sizelimit = ' . $sizelimit,
|
720
|
'timelimit = ' . $timelimit,
|
721
|
'deref = ' . $deref,
|
722
|
'scope = ' . $scope,
|
723
|
)
|
724
|
);
|
725
|
if ($this->detailed_watchdog_log) {
|
726
|
watchdog('ldap_server', $query, array());
|
727
|
}
|
728
|
|
729
|
|
730
|
if (! $this->connection) {
|
731
|
$this->connect();
|
732
|
$this->bind();
|
733
|
}
|
734
|
|
735
|
$ldap_query_params = array(
|
736
|
'connection' => $this->connection,
|
737
|
'base_dn' => $base_dn,
|
738
|
'filter' => $filter,
|
739
|
'attributes' => $attributes,
|
740
|
'attrsonly' => $attrsonly,
|
741
|
'sizelimit' => $sizelimit,
|
742
|
'timelimit' => $timelimit,
|
743
|
'deref' => $deref,
|
744
|
'query_display' => $query,
|
745
|
'scope' => $scope,
|
746
|
);
|
747
|
|
748
|
if ($this->searchPagination && $this->paginationEnabled) {
|
749
|
$aggregated_entries = $this->pagedLdapQuery($ldap_query_params);
|
750
|
return $aggregated_entries;
|
751
|
}
|
752
|
else {
|
753
|
$result = $this->ldapQuery($scope, $ldap_query_params);
|
754
|
if ($result && ($this->countEntries($result) !== FALSE) ) {
|
755
|
$entries = ldap_get_entries($this->connection, $result);
|
756
|
drupal_alter('ldap_server_search_results', $entries, $ldap_query_params);
|
757
|
return (is_array($entries)) ? $entries : FALSE;
|
758
|
}
|
759
|
elseif ($this->ldapErrorNumber()) {
|
760
|
$watchdog_tokens = array('%basedn' => $ldap_query_params['base_dn'], '%filter' => $ldap_query_params['filter'],
|
761
|
'%attributes' => print_r($ldap_query_params['attributes'], TRUE), '%errmsg' => $this->errorMsg('ldap'),
|
762
|
'%errno' => $this->ldapErrorNumber());
|
763
|
watchdog('ldap', "LDAP ldap_search error. basedn: %basedn| filter: %filter| attributes:
|
764
|
%attributes| errmsg: %errmsg| ldap err no: %errno|", $watchdog_tokens);
|
765
|
return FALSE;
|
766
|
}
|
767
|
else {
|
768
|
return FALSE;
|
769
|
}
|
770
|
}
|
771
|
}
|
772
|
|
773
|
|
774
|
|
775
|
|
776
|
|
777
|
|
778
|
|
779
|
|
780
|
|
781
|
|
782
|
|
783
|
|
784
|
|
785
|
|
786
|
|
787
|
|
788
|
|
789
|
|
790
|
|
791
|
|
792
|
|
793
|
|
794
|
|
795
|
public function pagedLdapQuery($ldap_query_params) {
|
796
|
|
797
|
if (!($this->searchPagination && $this->paginationEnabled)) {
|
798
|
watchdog('ldap', "LDAP server pagedLdapQuery() called when functionality not available in php install or
|
799
|
not enabled in ldap server configuration. error. basedn: %basedn| filter: %filter| attributes:
|
800
|
%attributes| errmsg: %errmsg| ldap err no: %errno|", $watchdog_tokens);
|
801
|
RETURN FALSE;
|
802
|
}
|
803
|
|
804
|
$paged_entries = array();
|
805
|
$page_token = '';
|
806
|
$page = 0;
|
807
|
$estimated_entries = 0;
|
808
|
$aggregated_entries = array();
|
809
|
$aggregated_entries_count = 0;
|
810
|
$has_page_results = FALSE;
|
811
|
|
812
|
do {
|
813
|
ldap_control_paged_result($this->connection, $this->searchPageSize, TRUE, $page_token);
|
814
|
$result = $this->ldapQuery($ldap_query_params['scope'], $ldap_query_params);
|
815
|
|
816
|
if ($page >= $this->searchPageStart) {
|
817
|
$skipped_page = FALSE;
|
818
|
if ($result && ($this->countEntries($result) !== FALSE) ) {
|
819
|
$page_entries = ldap_get_entries($this->connection, $result);
|
820
|
unset($page_entries['count']);
|
821
|
$has_page_results = (is_array($page_entries) && count($page_entries) > 0);
|
822
|
$aggregated_entries = array_merge($aggregated_entries, $page_entries);
|
823
|
$aggregated_entries_count = count($aggregated_entries);
|
824
|
}
|
825
|
elseif ($this->ldapErrorNumber()) {
|
826
|
$watchdog_tokens = array('%basedn' => $ldap_query_params['base_dn'], '%filter' => $ldap_query_params['filter'],
|
827
|
'%attributes' => print_r($ldap_query_params['attributes'], TRUE), '%errmsg' => $this->errorMsg('ldap'),
|
828
|
'%errno' => $this->ldapErrorNumber());
|
829
|
watchdog('ldap', "LDAP ldap_search error. basedn: %basedn| filter: %filter| attributes:
|
830
|
%attributes| errmsg: %errmsg| ldap err no: %errno|", $watchdog_tokens);
|
831
|
RETURN FALSE;
|
832
|
}
|
833
|
else {
|
834
|
return FALSE;
|
835
|
}
|
836
|
}
|
837
|
else {
|
838
|
$skipped_page = TRUE;
|
839
|
}
|
840
|
@ldap_control_paged_result_response($this->connection, $result, $page_token, $estimated_entries);
|
841
|
if ($ldap_query_params['sizelimit'] && $this->ldapErrorNumber() == LDAP_SIZELIMIT_EXCEEDED) {
|
842
|
|
843
|
}
|
844
|
elseif ($this->hasError()) {
|
845
|
watchdog('ldap_server', 'ldap_control_paged_result_response() function error. LDAP Error: %message, ldap_list() parameters: %query',
|
846
|
array('%message' => $this->errorMsg('ldap'), '%query' => $ldap_query_params['query_display']),
|
847
|
WATCHDOG_ERROR);
|
848
|
}
|
849
|
|
850
|
if (isset($ldap_query_params['sizelimit']) && $ldap_query_params['sizelimit'] && $aggregated_entries_count >= $ldap_query_params['sizelimit']) {
|
851
|
$discarded_entries = array_splice($aggregated_entries, $ldap_query_params['sizelimit']);
|
852
|
break;
|
853
|
}
|
854
|
elseif ($this->searchPageEnd !== NULL && $page >= $this->searchPageEnd) {
|
855
|
break;
|
856
|
}
|
857
|
elseif ($page_token === NULL || $page_token == '') {
|
858
|
break;
|
859
|
}
|
860
|
$page++;
|
861
|
} while ($skipped_page || $has_page_results);
|
862
|
|
863
|
$aggregated_entries['count'] = count($aggregated_entries);
|
864
|
return $aggregated_entries;
|
865
|
}
|
866
|
|
867
|
|
868
|
|
869
|
|
870
|
|
871
|
|
872
|
|
873
|
|
874
|
|
875
|
function ldapQuery($scope, $params) {
|
876
|
|
877
|
$this->connectAndBindIfNotAlready();
|
878
|
|
879
|
switch ($scope) {
|
880
|
case LDAP_SCOPE_SUBTREE:
|
881
|
$result = @ldap_search($this->connection, $params['base_dn'], $params['filter'], $params['attributes'], $params['attrsonly'],
|
882
|
$params['sizelimit'], $params['timelimit'], $params['deref']);
|
883
|
if ($params['sizelimit'] && $this->ldapErrorNumber() == LDAP_SIZELIMIT_EXCEEDED) {
|
884
|
|
885
|
}
|
886
|
elseif ($this->hasError()) {
|
887
|
watchdog('ldap_server', 'ldap_search() function error. LDAP Error: %message, ldap_search() parameters: %query',
|
888
|
array('%message' => $this->errorMsg('ldap'), '%query' => $params['query_display']),
|
889
|
WATCHDOG_ERROR);
|
890
|
}
|
891
|
break;
|
892
|
|
893
|
case LDAP_SCOPE_BASE:
|
894
|
$result = @ldap_read($this->connection, $params['base_dn'], $params['filter'], $params['attributes'], $params['attrsonly'],
|
895
|
$params['sizelimit'], $params['timelimit'], $params['deref']);
|
896
|
if ($params['sizelimit'] && $this->ldapErrorNumber() == LDAP_SIZELIMIT_EXCEEDED) {
|
897
|
|
898
|
}
|
899
|
elseif ($this->hasError()) {
|
900
|
watchdog('ldap_server', 'ldap_read() function error. LDAP Error: %message, ldap_read() parameters: %query',
|
901
|
array('%message' => $this->errorMsg('ldap'), '%query' => @$params['query_display']),
|
902
|
WATCHDOG_ERROR);
|
903
|
}
|
904
|
break;
|
905
|
|
906
|
case LDAP_SCOPE_ONELEVEL:
|
907
|
$result = @ldap_list($this->connection, $params['base_dn'], $params['filter'], $params['attributes'], $params['attrsonly'],
|
908
|
$params['sizelimit'], $params['timelimit'], $params['deref']);
|
909
|
if ($params['sizelimit'] && $this->ldapErrorNumber() == LDAP_SIZELIMIT_EXCEEDED) {
|
910
|
|
911
|
}
|
912
|
elseif ($this->hasError()) {
|
913
|
watchdog('ldap_server', 'ldap_list() function error. LDAP Error: %message, ldap_list() parameters: %query',
|
914
|
array('%message' => $this->errorMsg('ldap'), '%query' => $params['query_display']),
|
915
|
WATCHDOG_ERROR);
|
916
|
}
|
917
|
break;
|
918
|
}
|
919
|
return $result;
|
920
|
}
|
921
|
|
922
|
|
923
|
|
924
|
|
925
|
|
926
|
|
927
|
public function dnArrayToLowerCase($dns) {
|
928
|
return array_keys(array_change_key_case(array_flip($dns), CASE_LOWER));
|
929
|
}
|
930
|
|
931
|
|
932
|
|
933
|
|
934
|
|
935
|
public function userUserEntityFromPuid($puid) {
|
936
|
|
937
|
$query = new EntityFieldQuery();
|
938
|
$query->entityCondition('entity_type', 'user')
|
939
|
->fieldCondition('ldap_user_puid_sid', 'value', $this->sid, '=')
|
940
|
->fieldCondition('ldap_user_puid', 'value', $puid, '=')
|
941
|
->fieldCondition('ldap_user_puid_property', 'value', $this->unique_persistent_attr, '=')
|
942
|
->addMetaData('account', user_load(1));
|
943
|
|
944
|
$result = $query->execute();
|
945
|
|
946
|
if (isset($result['user'])) {
|
947
|
$uids = array_keys($result['user']);
|
948
|
if (count($uids) == 1) {
|
949
|
$user = entity_load('user', array_keys($result['user']));
|
950
|
return $user[$uids[0]];
|
951
|
}
|
952
|
else {
|
953
|
$uids = join(',', $uids);
|
954
|
$tokens = array('%uids' => $uids, '%puid' => $puid, '%sid' => $this->sid, '%ldap_user_puid_property' => $this->unique_persistent_attr);
|
955
|
watchdog('ldap_server', 'multiple users (uids: %uids) with same puid (puid=%puid, sid=%sid, ldap_user_puid_property=%ldap_user_puid_property)', $tokens, WATCHDOG_ERROR);
|
956
|
return FALSE;
|
957
|
}
|
958
|
}
|
959
|
else {
|
960
|
return FALSE;
|
961
|
}
|
962
|
|
963
|
}
|
964
|
|
965
|
function userUsernameToLdapNameTransform($drupal_username, &$watchdog_tokens) {
|
966
|
if ($this->ldapToDrupalUserPhp && module_exists('php')) {
|
967
|
global $name;
|
968
|
$old_name_value = $name;
|
969
|
$name = $drupal_username;
|
970
|
$code = "<?php global \$name; \n" . $this->ldapToDrupalUserPhp . "; \n ?>";
|
971
|
$watchdog_tokens['%code'] = $this->ldapToDrupalUserPhp;
|
972
|
$code_result = php_eval($code);
|
973
|
$watchdog_tokens['%code_result'] = $code_result;
|
974
|
$ldap_username = $code_result;
|
975
|
$watchdog_tokens['%ldap_username'] = $ldap_username;
|
976
|
$name = $old_name_value;
|
977
|
if ($this->detailedWatchdogLog) {
|
978
|
watchdog('ldap_server', '%drupal_user_name tansformed to %ldap_username by applying code <code>%code</code>', $watchdog_tokens, WATCHDOG_DEBUG);
|
979
|
}
|
980
|
}
|
981
|
else {
|
982
|
$ldap_username = $drupal_username;
|
983
|
}
|
984
|
|
985
|
|
986
|
$context = array(
|
987
|
'ldap_server' => $this,
|
988
|
);
|
989
|
drupal_alter('ldap_servers_username_to_ldapname', $ldap_username, $drupal_username, $context);
|
990
|
|
991
|
return $ldap_username;
|
992
|
|
993
|
}
|
994
|
|
995
|
|
996
|
|
997
|
|
998
|
|
999
|
|
1000
|
|
1001
|
public function userUsernameFromLdapEntry($ldap_entry) {
|
1002
|
|
1003
|
|
1004
|
if ($this->account_name_attr) {
|
1005
|
$accountname = (empty($ldap_entry[$this->account_name_attr][0])) ? FALSE : $ldap_entry[$this->account_name_attr][0];
|
1006
|
}
|
1007
|
elseif ($this->user_attr) {
|
1008
|
$accountname = (empty($ldap_entry[$this->user_attr][0])) ? FALSE : $ldap_entry[$this->user_attr][0];
|
1009
|
}
|
1010
|
else {
|
1011
|
$accountname = FALSE;
|
1012
|
}
|
1013
|
|
1014
|
return $accountname;
|
1015
|
}
|
1016
|
|
1017
|
|
1018
|
|
1019
|
|
1020
|
|
1021
|
|
1022
|
public function userUsernameFromDn($dn) {
|
1023
|
|
1024
|
$ldap_entry = @$this->dnExists($dn, 'ldap_entry', array());
|
1025
|
if (!$ldap_entry || !is_array($ldap_entry)) {
|
1026
|
return FALSE;
|
1027
|
}
|
1028
|
else {
|
1029
|
return $this->userUsernameFromLdapEntry($ldap_entry);
|
1030
|
}
|
1031
|
|
1032
|
}
|
1033
|
|
1034
|
|
1035
|
|
1036
|
|
1037
|
|
1038
|
|
1039
|
public function userEmailFromLdapEntry($ldap_entry) {
|
1040
|
|
1041
|
if ($ldap_entry && $this->mail_attr) {
|
1042
|
$mail = isset($ldap_entry[$this->mail_attr][0]) ? $ldap_entry[$this->mail_attr][0] : FALSE;
|
1043
|
return $mail;
|
1044
|
}
|
1045
|
elseif ($ldap_entry && $this->mail_template) {
|
1046
|
ldap_servers_module_load_include('inc', 'ldap_servers', 'ldap_servers.functions');
|
1047
|
return ldap_servers_token_replace($ldap_entry, $this->mail_template, 'ldap_entry');
|
1048
|
}
|
1049
|
else {
|
1050
|
return FALSE;
|
1051
|
}
|
1052
|
}
|
1053
|
|
1054
|
|
1055
|
|
1056
|
|
1057
|
|
1058
|
|
1059
|
public function userPictureFromLdapEntry($ldap_entry, $drupal_username = FALSE) {
|
1060
|
if ($ldap_entry && $this->picture_attr) {
|
1061
|
|
1062
|
|
1063
|
$thumb = isset($ldap_entry[$this->picture_attr][0]) ? $ldap_entry[$this->picture_attr][0] : FALSE;
|
1064
|
if(!$thumb){
|
1065
|
return FALSE;
|
1066
|
}
|
1067
|
|
1068
|
|
1069
|
$md5thumb = md5($thumb);
|
1070
|
|
1071
|
|
1072
|
|
1073
|
|
1074
|
|
1075
|
if ($drupal_username && $account = user_load_by_name($drupal_username)) {
|
1076
|
if ($account->uid == 0 || $account->uid == 1){
|
1077
|
return FALSE;
|
1078
|
}
|
1079
|
if (isset($account->picture)){
|
1080
|
|
1081
|
if (isset($account->data['ldap_user']['init']['thumb5md']) && $md5thumb === $account->data['ldap_user']['init']['thumb5md']){
|
1082
|
|
1083
|
return $account->picture;
|
1084
|
}
|
1085
|
else {
|
1086
|
|
1087
|
if (is_object($account->picture)){
|
1088
|
file_delete($account->picture, TRUE);
|
1089
|
}
|
1090
|
elseif (is_string($account->picture)){
|
1091
|
$file = file_load(intval($account->picture));
|
1092
|
file_delete($file, TRUE);
|
1093
|
}
|
1094
|
}
|
1095
|
}
|
1096
|
elseif (isset($account->data['ldap_user']['init']['thumb5md'])) {
|
1097
|
watchdog('ldap_server', "Some error happened during thumbnailPhoto sync");
|
1098
|
return FALSE;
|
1099
|
}
|
1100
|
}
|
1101
|
|
1102
|
$filename = uniqid();
|
1103
|
$fileuri = file_directory_temp() .'/'. $filename;
|
1104
|
$size = file_put_contents($fileuri, $thumb);
|
1105
|
$info = image_get_info($fileuri);
|
1106
|
unlink($fileuri);
|
1107
|
|
1108
|
$file = file_save_data($thumb, 'public://' . variable_get('user_picture_path') .'/'. $filename .'.'. $info['extension']);
|
1109
|
$file->md5Sum = $md5thumb;
|
1110
|
|
1111
|
$validators = array(
|
1112
|
'file_validate_is_image' => array(),
|
1113
|
'file_validate_image_resolution' => array(variable_get('user_picture_dimensions', '85x85')),
|
1114
|
'file_validate_size' => array(variable_get('user_picture_file_size', '30') * 1024),
|
1115
|
);
|
1116
|
$errors = file_validate($file ,$validators);
|
1117
|
if (empty($errors)) {
|
1118
|
return $file;
|
1119
|
}
|
1120
|
else {
|
1121
|
foreach ($errors as $err => $err_val){
|
1122
|
watchdog('ldap_server', "Error storing picture: %$err", "%$err_val", WATCHDOG_ERROR );
|
1123
|
}
|
1124
|
return FALSE;
|
1125
|
}
|
1126
|
}
|
1127
|
}
|
1128
|
|
1129
|
|
1130
|
|
1131
|
|
1132
|
|
1133
|
|
1134
|
|
1135
|
public function userPuidFromLdapEntry($ldap_entry) {
|
1136
|
|
1137
|
if ($this->unique_persistent_attr
|
1138
|
&& isset($ldap_entry[$this->unique_persistent_attr][0])
|
1139
|
&& is_scalar($ldap_entry[$this->unique_persistent_attr][0])
|
1140
|
) {
|
1141
|
$puid = $ldap_entry[$this->unique_persistent_attr][0];
|
1142
|
return ($this->unique_persistent_attr_binary) ? ldap_servers_binary($puid) : $puid;
|
1143
|
}
|
1144
|
else {
|
1145
|
return FALSE;
|
1146
|
}
|
1147
|
}
|
1148
|
|
1149
|
|
1150
|
|
1151
|
|
1152
|
|
1153
|
|
1154
|
|
1155
|
|
1156
|
|
1157
|
|
1158
|
public function user_lookup($user) {
|
1159
|
return $this->userUserToExistingLdapEntry($user);
|
1160
|
}
|
1161
|
public function userUserToExistingLdapEntry($user) {
|
1162
|
|
1163
|
if (is_object($user)) {
|
1164
|
$user_ldap_entry = $this->userUserNameToExistingLdapEntry($user->name);
|
1165
|
}
|
1166
|
elseif (is_array($user)) {
|
1167
|
$user_ldap_entry = $user;
|
1168
|
}
|
1169
|
elseif (is_scalar($user)) {
|
1170
|
if (strpos($user, '=') === FALSE) {
|
1171
|
$user_ldap_entry = $this->userUserNameToExistingLdapEntry($user);
|
1172
|
}
|
1173
|
else {
|
1174
|
$user_ldap_entry = $this->dnExists($user, 'ldap_entry');
|
1175
|
}
|
1176
|
}
|
1177
|
return $user_ldap_entry;
|
1178
|
}
|
1179
|
|
1180
|
|
1181
|
|
1182
|
|
1183
|
|
1184
|
|
1185
|
|
1186
|
|
1187
|
|
1188
|
|
1189
|
|
1190
|
|
1191
|
|
1192
|
|
1193
|
|
1194
|
|
1195
|
|
1196
|
function userUserNameToExistingLdapEntry($drupal_user_name, $ldap_context = NULL) {
|
1197
|
|
1198
|
$watchdog_tokens = array('%drupal_user_name' => $drupal_user_name);
|
1199
|
$ldap_username = $this->userUsernameToLdapNameTransform($drupal_user_name, $watchdog_tokens);
|
1200
|
if (!$ldap_username) {
|
1201
|
return FALSE;
|
1202
|
}
|
1203
|
if (!$ldap_context) {
|
1204
|
$attributes = array();
|
1205
|
}
|
1206
|
else {
|
1207
|
$attribute_maps = ldap_servers_attributes_needed($this->sid, $ldap_context);
|
1208
|
$attributes = array_keys($attribute_maps);
|
1209
|
}
|
1210
|
|
1211
|
foreach ($this->basedn as $basedn) {
|
1212
|
if (empty($basedn)) continue;
|
1213
|
$filter = '(' . $this->user_attr . '=' . ldap_server_massage_text($ldap_username, 'attr_value', LDAP_SERVER_MASSAGE_QUERY_LDAP) . ')';
|
1214
|
$result = $this->search($basedn, $filter, $attributes);
|
1215
|
if (!$result || !isset($result['count']) || !$result['count']) continue;
|
1216
|
|
1217
|
|
1218
|
|
1219
|
if ($result['count'] != 1) {
|
1220
|
$count = $result['count'];
|
1221
|
watchdog('ldap_servers', "Error: !count users found with $filter under $basedn.", array('!count' => $count), WATCHDOG_ERROR);
|
1222
|
continue;
|
1223
|
}
|
1224
|
$match = $result[0];
|
1225
|
|
1226
|
|
1227
|
|
1228
|
|
1229
|
|
1230
|
$name_attr = $this->user_attr;
|
1231
|
|
1232
|
if (isset($match[$name_attr][0])) {
|
1233
|
|
1234
|
}
|
1235
|
elseif (isset($match[drupal_strtolower($name_attr)][0])) {
|
1236
|
$name_attr = drupal_strtolower($name_attr);
|
1237
|
|
1238
|
}
|
1239
|
else {
|
1240
|
if ($this->bind_method == LDAP_SERVERS_BIND_METHOD_ANON_USER) {
|
1241
|
$result = array(
|
1242
|
'dn' => $match['dn'],
|
1243
|
'mail' => $this->userEmailFromLdapEntry($match),
|
1244
|
'attr' => $match,
|
1245
|
'sid' => $this->sid,
|
1246
|
);
|
1247
|
return $result;
|
1248
|
}
|
1249
|
else {
|
1250
|
continue;
|
1251
|
}
|
1252
|
}
|
1253
|
|
1254
|
|
1255
|
|
1256
|
|
1257
|
|
1258
|
|
1259
|
|
1260
|
|
1261
|
|
1262
|
foreach ($match[$name_attr] as $value) {
|
1263
|
if (drupal_strtolower(trim($value)) == drupal_strtolower($ldap_username)) {
|
1264
|
$result = array(
|
1265
|
'dn' => $match['dn'],
|
1266
|
'mail' => $this->userEmailFromLdapEntry($match),
|
1267
|
'attr' => $match,
|
1268
|
'sid' => $this->sid,
|
1269
|
);
|
1270
|
return $result;
|
1271
|
}
|
1272
|
}
|
1273
|
}
|
1274
|
}
|
1275
|
|
1276
|
|
1277
|
|
1278
|
|
1279
|
|
1280
|
|
1281
|
|
1282
|
|
1283
|
|
1284
|
|
1285
|
|
1286
|
|
1287
|
public function groupIsMember($group_dn, $user, $nested = NULL) {
|
1288
|
|
1289
|
$nested = ($nested === TRUE || $nested === FALSE) ? $nested : $this->groupNested;
|
1290
|
$group_dns = $this->groupMembershipsFromUser($user, 'group_dns', $nested);
|
1291
|
|
1292
|
|
1293
|
return (is_array($group_dns) && in_array(drupal_strtolower($group_dn), $this->dnArrayToLowerCase($group_dns)));
|
1294
|
}
|
1295
|
|
1296
|
|
1297
|
|
1298
|
|
1299
|
|
1300
|
|
1301
|
|
1302
|
|
1303
|
|
1304
|
|
1305
|
|
1306
|
|
1307
|
|
1308
|
|
1309
|
|
1310
|
public function groupAddGroup($group_dn, $attributes = array()) {
|
1311
|
|
1312
|
|
1313
|
|
1314
|
if ($this->dnExists($group_dn, 'boolean')) {
|
1315
|
return FALSE;
|
1316
|
}
|
1317
|
|
1318
|
$attributes = array_change_key_case($attributes, CASE_LOWER);
|
1319
|
$objectclass = (empty($attributes['objectclass'])) ? $this->groupObjectClass : $attributes['objectclass'];
|
1320
|
$attributes['objectclass'] = $objectclass;
|
1321
|
|
1322
|
|
1323
|
|
1324
|
|
1325
|
$context = array(
|
1326
|
'action' => 'add',
|
1327
|
'corresponding_drupal_data' => array($group_dn => $attributes),
|
1328
|
'corresponding_drupal_data_type' => 'group',
|
1329
|
);
|
1330
|
$ldap_entries = array($group_dn => $attributes);
|
1331
|
drupal_alter('ldap_entry_pre_provision', $ldap_entries, $this, $context);
|
1332
|
$attributes = $ldap_entries[$group_dn];
|
1333
|
|
1334
|
|
1335
|
|
1336
|
|
1337
|
|
1338
|
|
1339
|
$ldap_entry_created = $this->createLdapEntry($attributes, $group_dn);
|
1340
|
|
1341
|
|
1342
|
|
1343
|
|
1344
|
|
1345
|
|
1346
|
if ($ldap_entry_created) {
|
1347
|
module_invoke_all('ldap_entry_post_provision', $ldap_entries, $this, $context);
|
1348
|
return TRUE;
|
1349
|
}
|
1350
|
else {
|
1351
|
return FALSE;
|
1352
|
}
|
1353
|
|
1354
|
}
|
1355
|
|
1356
|
|
1357
|
|
1358
|
|
1359
|
|
1360
|
|
1361
|
|
1362
|
|
1363
|
|
1364
|
|
1365
|
public function groupRemoveGroup($group_dn, $only_if_group_empty = TRUE) {
|
1366
|
|
1367
|
if ($only_if_group_empty) {
|
1368
|
$members = $this->groupAllMembers($group_dn);
|
1369
|
if (is_array($members) && count($members) > 0) {
|
1370
|
return FALSE;
|
1371
|
}
|
1372
|
}
|
1373
|
|
1374
|
return $this->delete($group_dn);
|
1375
|
|
1376
|
}
|
1377
|
|
1378
|
|
1379
|
|
1380
|
|
1381
|
|
1382
|
|
1383
|
|
1384
|
|
1385
|
|
1386
|
|
1387
|
|
1388
|
|
1389
|
public function groupAddMember($group_dn, $user) {
|
1390
|
|
1391
|
$user_ldap_entry = $this->userUserToExistingLdapEntry($user);
|
1392
|
$result = FALSE;
|
1393
|
if ($user_ldap_entry && $this->groupGroupEntryMembershipsConfigured) {
|
1394
|
$add = array();
|
1395
|
$add[$this->groupMembershipsAttr] = $user_ldap_entry['dn'];
|
1396
|
$this->connectAndBindIfNotAlready();
|
1397
|
$result = @ldap_mod_add($this->connection, $group_dn, $add);
|
1398
|
}
|
1399
|
|
1400
|
return $result;
|
1401
|
}
|
1402
|
|
1403
|
|
1404
|
|
1405
|
|
1406
|
|
1407
|
|
1408
|
|
1409
|
|
1410
|
|
1411
|
|
1412
|
|
1413
|
|
1414
|
public function groupRemoveMember($group_dn, $user) {
|
1415
|
|
1416
|
$user_ldap_entry = $this->userUserToExistingLdapEntry($user);
|
1417
|
$result = FALSE;
|
1418
|
if ($user_ldap_entry && $this->groupGroupEntryMembershipsConfigured) {
|
1419
|
$del = array();
|
1420
|
$del[$this->groupMembershipsAttr] = $user_ldap_entry['dn'];
|
1421
|
$this->connectAndBindIfNotAlready();
|
1422
|
$result = @ldap_mod_del($this->connection, $group_dn, $del);
|
1423
|
}
|
1424
|
return $result;
|
1425
|
}
|
1426
|
|
1427
|
|
1428
|
|
1429
|
|
1430
|
|
1431
|
|
1432
|
|
1433
|
|
1434
|
|
1435
|
|
1436
|
|
1437
|
|
1438
|
public function groupAllMembers($group_dn) {
|
1439
|
|
1440
|
if (!$this->groupGroupEntryMembershipsConfigured) {
|
1441
|
return FALSE;
|
1442
|
}
|
1443
|
$attributes = array($this->groupMembershipsAttr, 'cn');
|
1444
|
$group_entry = $this->dnExists($group_dn, 'ldap_entry', $attributes);
|
1445
|
if (!$group_entry) {
|
1446
|
return FALSE;
|
1447
|
}
|
1448
|
else {
|
1449
|
if (empty($group_entry['cn'])) {
|
1450
|
return FALSE;
|
1451
|
}
|
1452
|
if (empty($group_entry[$this->groupMembershipsAttr])) {
|
1453
|
return array();
|
1454
|
}
|
1455
|
$members = $group_entry[$this->groupMembershipsAttr];
|
1456
|
if (isset($members['count'])) {
|
1457
|
unset($members['count']);
|
1458
|
}
|
1459
|
return $members;
|
1460
|
}
|
1461
|
|
1462
|
$this->groupMembersResursive($current_group_entries, $all_group_dns, $tested_group_ids, 0, $max_levels, $object_classes);
|
1463
|
|
1464
|
return $all_group_dns;
|
1465
|
|
1466
|
}
|
1467
|
|
1468
|
|
1469
|
|
1470
|
|
1471
|
|
1472
|
|
1473
|
|
1474
|
|
1475
|
|
1476
|
|
1477
|
|
1478
|
|
1479
|
|
1480
|
|
1481
|
|
1482
|
public function groupMembersResursive($current_member_entries, &$all_member_dns, &$tested_group_ids, $level, $max_levels, $object_classes = FALSE) {
|
1483
|
|
1484
|
if (!$this->groupGroupEntryMembershipsConfigured || !is_array($current_member_entries) || count($current_member_entries) == 0) {
|
1485
|
return FALSE;
|
1486
|
}
|
1487
|
if (isset($current_member_entries['count'])) {
|
1488
|
unset($current_member_entries['count']);
|
1489
|
};
|
1490
|
|
1491
|
foreach ($current_member_entries as $i => $member_entry) {
|
1492
|
|
1493
|
|
1494
|
$objectClassMatch = (!$object_classes || (count(array_intersect(array_values($member_entry['objectclass']), $object_classes)) > 0));
|
1495
|
$objectIsGroup = in_array($this->groupObjectClass, array_values($member_entry['objectclass']));
|
1496
|
if ($objectClassMatch && !in_array($member_entry['dn'], $all_member_dns)) {
|
1497
|
$all_member_dns[] = $member_entry['dn'];
|
1498
|
}
|
1499
|
|
1500
|
|
1501
|
if ($objectIsGroup && $level < $max_levels) {
|
1502
|
if ($this->groupMembershipsAttrMatchingUserAttr == 'dn') {
|
1503
|
$group_id = $member_entry['dn'];
|
1504
|
}
|
1505
|
else {
|
1506
|
$group_id = $member_entry[$this->groupMembershipsAttrMatchingUserAttr][0];
|
1507
|
}
|
1508
|
|
1509
|
if (!in_array($group_id, $tested_group_ids)) {
|
1510
|
$tested_group_ids[] = $group_id;
|
1511
|
$member_ids = $member_entry[$this->groupMembershipsAttr];
|
1512
|
if (isset($member_ids['count'])) {
|
1513
|
unset($member_ids['count']);
|
1514
|
};
|
1515
|
$ors = array();
|
1516
|
foreach ($member_ids as $i => $member_id) {
|
1517
|
$ors[] = $this->groupMembershipsAttr . '=' . ldap_pear_escape_filter_value($member_id);
|
1518
|
}
|
1519
|
|
1520
|
if (count($ors)) {
|
1521
|
$query_for_child_members = '(|(' . join(")(", $ors) . '))';
|
1522
|
if (count($object_classes)) {
|
1523
|
$object_classes_ors = array('(objectClass=' . $this->groupObjectClass . ')');
|
1524
|
foreach ($object_classes as $object_class) {
|
1525
|
$object_classes_ors[] = '(objectClass=' . $object_class . ')';
|
1526
|
}
|
1527
|
$query_for_child_members = '&(|' . join($object_classes_ors) . ')(' . $query_for_child_members . ')';
|
1528
|
}
|
1529
|
foreach ($this->basedn as $base_dn) {
|
1530
|
$child_member_entries = $this->search($base_dn, $query_for_child_members, array('objectclass', $this->groupMembershipsAttr, $this->groupMembershipsAttrMatchingUserAttr));
|
1531
|
if ($child_member_entries !== FALSE) {
|
1532
|
$this->groupMembersResursive($child_member_entries, $all_member_dns, $tested_group_ids, $level + 1, $max_levels, $object_classes);
|
1533
|
}
|
1534
|
}
|
1535
|
}
|
1536
|
}
|
1537
|
}
|
1538
|
}
|
1539
|
}
|
1540
|
|
1541
|
|
1542
|
|
1543
|
|
1544
|
|
1545
|
|
1546
|
|
1547
|
|
1548
|
|
1549
|
|
1550
|
|
1551
|
|
1552
|
|
1553
|
|
1554
|
|
1555
|
|
1556
|
|
1557
|
|
1558
|
|
1559
|
|
1560
|
|
1561
|
|
1562
|
|
1563
|
|
1564
|
public function groupMembershipsFromUser($user, $return = 'group_dns', $nested = NULL) {
|
1565
|
|
1566
|
$group_dns = FALSE;
|
1567
|
$user_ldap_entry = @$this->userUserToExistingLdapEntry($user);
|
1568
|
if (!$user_ldap_entry || $this->groupFunctionalityUnused) {
|
1569
|
return FALSE;
|
1570
|
}
|
1571
|
if ($nested === NULL) {
|
1572
|
$nested = $this->groupNested;
|
1573
|
}
|
1574
|
|
1575
|
if ($this->groupUserMembershipsConfigured) {
|
1576
|
$group_dns = $this->groupUserMembershipsFromUserAttr($user_ldap_entry, $nested);
|
1577
|
}
|
1578
|
elseif ($this->groupGroupEntryMembershipsConfigured) {
|
1579
|
$group_dns = $this->groupUserMembershipsFromEntry($user_ldap_entry, $nested);
|
1580
|
}
|
1581
|
else {
|
1582
|
watchdog('ldap_servers', 'groupMembershipsFromUser: Group memberships for server have not been configured.', array(), WATCHDOG_WARNING);
|
1583
|
return FALSE;
|
1584
|
}
|
1585
|
if ($return == 'group_dns') {
|
1586
|
return $group_dns;
|
1587
|
}
|
1588
|
|
1589
|
}
|
1590
|
|
1591
|
|
1592
|
|
1593
|
|
1594
|
|
1595
|
|
1596
|
|
1597
|
|
1598
|
|
1599
|
|
1600
|
|
1601
|
|
1602
|
|
1603
|
|
1604
|
|
1605
|
|
1606
|
|
1607
|
|
1608
|
|
1609
|
|
1610
|
|
1611
|
|
1612
|
|
1613
|
public function groupUserMembershipsFromUserAttr($user, $nested = NULL) {
|
1614
|
|
1615
|
if (!$this->groupUserMembershipsConfigured) {
|
1616
|
return FALSE;
|
1617
|
}
|
1618
|
if ($nested === NULL) {
|
1619
|
$nested = $this->groupNested;
|
1620
|
}
|
1621
|
|
1622
|
$not_user_ldap_entry = empty($user['attr'][$this->groupUserMembershipsAttr]);
|
1623
|
if ($not_user_ldap_entry) {
|
1624
|
$user = $this->userUserToExistingLdapEntry($user);
|
1625
|
$not_user_ldap_entry = empty($user['attr'][$this->groupUserMembershipsAttr]);
|
1626
|
if ($not_user_ldap_entry) {
|
1627
|
return FALSE;
|
1628
|
}
|
1629
|
}
|
1630
|
|
1631
|
$user_ldap_entry = $user;
|
1632
|
$all_group_dns = array();
|
1633
|
$tested_group_ids = array();
|
1634
|
$level = 0;
|
1635
|
|
1636
|
$member_group_dns = $user_ldap_entry['attr'][$this->groupUserMembershipsAttr];
|
1637
|
if (isset($member_group_dns['count'])) {
|
1638
|
unset($member_group_dns['count']);
|
1639
|
}
|
1640
|
$ors = array();
|
1641
|
foreach ($member_group_dns as $i => $member_group_dn) {
|
1642
|
$all_group_dns[] = $member_group_dn;
|
1643
|
if ($nested) {
|
1644
|
if ($this->groupMembershipsAttrMatchingUserAttr == 'dn') {
|
1645
|
$member_value = $member_group_dn;
|
1646
|
}
|
1647
|
else {
|
1648
|
$member_value = ldap_servers_get_first_rdn_value_from_dn($member_group_dn, $this->groupMembershipsAttrMatchingUserAttr);
|
1649
|
}
|
1650
|
$ors[] = $this->groupMembershipsAttr . '=' . ldap_pear_escape_filter_value($member_value);
|
1651
|
}
|
1652
|
}
|
1653
|
|
1654
|
if ($nested && count($ors)) {
|
1655
|
$count = count($ors);
|
1656
|
for ($i=0; $i < $count; $i=$i+LDAP_SERVER_LDAP_QUERY_CHUNK) {
|
1657
|
$current_ors = array_slice($ors, $i, LDAP_SERVER_LDAP_QUERY_CHUNK);
|
1658
|
$or = '(|(' . join(")(", $current_ors) . '))';
|
1659
|
$query_for_parent_groups = '(&(objectClass=' . $this->groupObjectClass . ')' . $or . ')';
|
1660
|
|
1661
|
foreach ($this->basedn as $base_dn) {
|
1662
|
|
1663
|
$group_entries = $this->search($base_dn, $query_for_parent_groups);
|
1664
|
if ($group_entries !== FALSE && $level < LDAP_SERVER_LDAP_QUERY_RECURSION_LIMIT) {
|
1665
|
$this->groupMembershipsFromEntryRecursive($group_entries, $all_group_dns, $tested_group_ids, $level + 1, LDAP_SERVER_LDAP_QUERY_RECURSION_LIMIT);
|
1666
|
}
|
1667
|
}
|
1668
|
}
|
1669
|
}
|
1670
|
|
1671
|
return $all_group_dns;
|
1672
|
}
|
1673
|
|
1674
|
|
1675
|
|
1676
|
|
1677
|
|
1678
|
|
1679
|
|
1680
|
|
1681
|
|
1682
|
|
1683
|
|
1684
|
|
1685
|
|
1686
|
|
1687
|
|
1688
|
|
1689
|
|
1690
|
|
1691
|
|
1692
|
|
1693
|
|
1694
|
|
1695
|
public function groupUserMembershipsFromEntry($user, $nested = NULL) {
|
1696
|
|
1697
|
if (!$this->groupGroupEntryMembershipsConfigured) {
|
1698
|
return FALSE;
|
1699
|
}
|
1700
|
if ($nested === NULL) {
|
1701
|
$nested = $this->groupNested;
|
1702
|
}
|
1703
|
|
1704
|
$user_ldap_entry = $this->userUserToExistingLdapEntry($user);
|
1705
|
|
1706
|
$all_group_dns = array();
|
1707
|
$tested_group_ids = array();
|
1708
|
$level = 0;
|
1709
|
|
1710
|
if ($this->groupMembershipsAttrMatchingUserAttr == 'dn') {
|
1711
|
$member_value = $user_ldap_entry['dn'];
|
1712
|
}
|
1713
|
else {
|
1714
|
$member_value = $user_ldap_entry['attr'][$this->groupMembershipsAttrMatchingUserAttr][0];
|
1715
|
}
|
1716
|
$member_value = ldap_pear_escape_filter_value($member_value);
|
1717
|
if ($this->groupObjectClass == '') {
|
1718
|
$group_query = '(' . $this->groupMembershipsAttr . "=$member_value)";
|
1719
|
}
|
1720
|
else {
|
1721
|
$group_query = '(&(objectClass=' . $this->groupObjectClass . ')(' . $this->groupMembershipsAttr . "=$member_value))";
|
1722
|
}
|
1723
|
|
1724
|
foreach ($this->basedn as $base_dn) {
|
1725
|
$group_entries = $this->search($base_dn, $group_query, array());
|
1726
|
if ($group_entries !== FALSE) {
|
1727
|
$max_levels = ($nested) ? LDAP_SERVER_LDAP_QUERY_RECURSION_LIMIT : 0;
|
1728
|
$this->groupMembershipsFromEntryRecursive($group_entries, $all_group_dns, $tested_group_ids, $level, $max_levels);
|
1729
|
}
|
1730
|
}
|
1731
|
|
1732
|
return $all_group_dns;
|
1733
|
}
|
1734
|
|
1735
|
|
1736
|
|
1737
|
|
1738
|
|
1739
|
|
1740
|
|
1741
|
|
1742
|
|
1743
|
|
1744
|
|
1745
|
|
1746
|
|
1747
|
|
1748
|
|
1749
|
|
1750
|
|
1751
|
|
1752
|
|
1753
|
|
1754
|
public function groupMembershipsFromEntryRecursive($current_group_entries, &$all_group_dns, &$tested_group_ids, $level, $max_levels) {
|
1755
|
|
1756
|
if (!$this->groupGroupEntryMembershipsConfigured || !is_array($current_group_entries) || count($current_group_entries) == 0) {
|
1757
|
return FALSE;
|
1758
|
}
|
1759
|
if (isset($current_group_entries['count'])) {
|
1760
|
unset($current_group_entries['count']);
|
1761
|
};
|
1762
|
|
1763
|
$ors = array();
|
1764
|
foreach ($current_group_entries as $i => $group_entry) {
|
1765
|
if ($this->groupMembershipsAttrMatchingUserAttr == 'dn') {
|
1766
|
$member_id = $group_entry['dn'];
|
1767
|
}
|
1768
|
else {
|
1769
|
$member_id = ldap_servers_get_first_rdn_value_from_dn($group_entry['dn'], $this->groupMembershipsAttrMatchingUserAttr);
|
1770
|
if(!$member_id) {
|
1771
|
if ($this->detailed_watchdog_log) {
|
1772
|
watchdog('ldap_server', 'group_entry: %ge', array('%ge'=>pretty_print_ldap_entry($group_entry)));
|
1773
|
}
|
1774
|
|
1775
|
|
1776
|
|
1777
|
$goc=$group_entry['objectclass'];
|
1778
|
if(is_array($goc)) {
|
1779
|
foreach($goc as $g) {
|
1780
|
$g=drupal_strtolower($g);
|
1781
|
if($g == $this->groupObjectClass) {
|
1782
|
|
1783
|
if ($this->detailed_watchdog_log) {
|
1784
|
watchdog('ldap_server', 'adding %mi', array('%mi'=>$member_id));
|
1785
|
}
|
1786
|
$member_id=$group_entry['dn'];
|
1787
|
break;
|
1788
|
}
|
1789
|
}
|
1790
|
}
|
1791
|
}
|
1792
|
}
|
1793
|
|
1794
|
if ($member_id && !in_array($member_id, $tested_group_ids)) {
|
1795
|
$tested_group_ids[] = $member_id;
|
1796
|
$all_group_dns[] = $group_entry['dn'];
|
1797
|
|
1798
|
$ors[] = $this->groupMembershipsAttr . '=' . ldap_pear_escape_filter_value($member_id);
|
1799
|
}
|
1800
|
}
|
1801
|
|
1802
|
if ($level < $max_levels && count($ors)) {
|
1803
|
$count = count($ors);
|
1804
|
for ($i=0; $i < $count; $i=$i+LDAP_SERVER_LDAP_QUERY_CHUNK) {
|
1805
|
$current_ors = array_slice($ors, $i, LDAP_SERVER_LDAP_QUERY_CHUNK);
|
1806
|
$or = '(|(' . join(")(", $current_ors) . '))';
|
1807
|
$query_for_parent_groups = '(&(objectClass=' . $this->groupObjectClass . ')' . $or . ')';
|
1808
|
|
1809
|
foreach ($this->basedn as $base_dn) {
|
1810
|
$group_entries = $this->search($base_dn, $query_for_parent_groups);
|
1811
|
if ($group_entries !== FALSE) {
|
1812
|
$this->groupMembershipsFromEntryRecursive($group_entries, $all_group_dns, $tested_group_ids, $level + 1, $max_levels);
|
1813
|
}
|
1814
|
}
|
1815
|
}
|
1816
|
}
|
1817
|
|
1818
|
return TRUE;
|
1819
|
}
|
1820
|
|
1821
|
|
1822
|
|
1823
|
|
1824
|
|
1825
|
|
1826
|
|
1827
|
|
1828
|
|
1829
|
|
1830
|
|
1831
|
|
1832
|
|
1833
|
public function groupUserMembershipsFromDn($user) {
|
1834
|
|
1835
|
if (!$this->groupDeriveFromDn || !$this->groupDeriveFromDnAttr) {
|
1836
|
return FALSE;
|
1837
|
}
|
1838
|
elseif ($user_ldap_entry = $this->userUserToExistingLdapEntry($user)) {
|
1839
|
return ldap_servers_get_all_rdn_values_from_dn($user_ldap_entry['dn'], $this->groupDeriveFromDnAttr);
|
1840
|
}
|
1841
|
else {
|
1842
|
return FALSE;
|
1843
|
}
|
1844
|
|
1845
|
}
|
1846
|
|
1847
|
|
1848
|
|
1849
|
|
1850
|
public $detailedWatchdogLog = FALSE;
|
1851
|
protected $_errorMsg = NULL;
|
1852
|
protected $_hasError = FALSE;
|
1853
|
protected $_errorName = NULL;
|
1854
|
|
1855
|
public function setError($_errorName, $_errorMsgText = NULL) {
|
1856
|
$this->_errorMsgText = $_errorMsgText;
|
1857
|
$this->_errorName = $_errorName;
|
1858
|
$this->_hasError = TRUE;
|
1859
|
}
|
1860
|
|
1861
|
public function clearError() {
|
1862
|
$this->_hasError = FALSE;
|
1863
|
$this->_errorMsg = NULL;
|
1864
|
$this->_errorName = NULL;
|
1865
|
}
|
1866
|
|
1867
|
public function hasError() {
|
1868
|
return ($this->_hasError || $this->ldapErrorNumber());
|
1869
|
}
|
1870
|
|
1871
|
public function errorMsg($type = NULL) {
|
1872
|
if ($type == 'ldap' && $this->connection) {
|
1873
|
return ldap_err2str(ldap_errno($this->connection));
|
1874
|
}
|
1875
|
elseif ($type == NULL) {
|
1876
|
return $this->_errorMsg;
|
1877
|
}
|
1878
|
else {
|
1879
|
return NULL;
|
1880
|
}
|
1881
|
}
|
1882
|
|
1883
|
public function errorName($type = NULL) {
|
1884
|
if ($type == 'ldap' && $this->connection) {
|
1885
|
return "LDAP Error: " . ldap_error($this->connection);
|
1886
|
}
|
1887
|
elseif ($type == NULL) {
|
1888
|
return $this->_errorName;
|
1889
|
}
|
1890
|
else {
|
1891
|
return NULL;
|
1892
|
}
|
1893
|
}
|
1894
|
|
1895
|
public function ldapErrorNumber() {
|
1896
|
if ($this->connection && ldap_errno($this->connection)) {
|
1897
|
return ldap_errno($this->connection);
|
1898
|
}
|
1899
|
else {
|
1900
|
return FALSE;
|
1901
|
}
|
1902
|
}
|
1903
|
|
1904
|
}
|
1905
|
|
1906
|
|
1907
|
|
1908
|
|
1909
|
class LdapServersRebindHandler {
|
1910
|
|
1911
|
private $bind_dn = 'Anonymous';
|
1912
|
private $bind_passwd = '';
|
1913
|
|
1914
|
public function __construct($bind_user_dn, $bind_user_passwd){
|
1915
|
$this->bind_dn = $bind_user_dn;
|
1916
|
$this->bind_passwd = $bind_user_passwd;
|
1917
|
}
|
1918
|
|
1919
|
public function rebind_callback($ldap, $referral){
|
1920
|
|
1921
|
ldap_set_option($ldap, LDAP_OPT_PROTOCOL_VERSION, 3);
|
1922
|
ldap_set_option($ldap, LDAP_OPT_REFERRALS, 1);
|
1923
|
ldap_set_rebind_proc($ldap, array($this, 'rebind_callback'));
|
1924
|
|
1925
|
|
1926
|
if (!ldap_bind($ldap, $this->bind_dn, $this->bind_passwd)) {
|
1927
|
echo "Could not bind to referral server: $referral";
|
1928
|
return 1;
|
1929
|
}
|
1930
|
return 0;
|
1931
|
}
|
1932
|
}
|