1
|
<?php
|
2
|
|
3
|
/**
|
4
|
* @file
|
5
|
* Bulk of authorization code executed to determine a users authorizations.
|
6
|
*/
|
7
|
|
8
|
// Remove after testing.
|
9
|
/**
|
10
|
*
|
11
|
*/
|
12
|
|
13
|
function ldap_authorization_help_watchdog() {
|
14
|
|
15
|
$path = drupal_get_path("module", "ldap_help");
|
16
|
$_content = "";
|
17
|
if (module_exists('dblog')) {
|
18
|
include_once drupal_get_path('module', 'dblog') . '/dblog.admin.inc';
|
19
|
$_SESSION['dblog_overview_filter']['type'] = array('ldap' => 'ldap');
|
20
|
$_content .= "<h3>" . t('LDAP Watchdog Errors and Notifications') . "</h3>";
|
21
|
$overview = dblog_overview();
|
22
|
$_content .= render($overview);
|
23
|
|
24
|
$_content .= l(t('...more watchdog'), 'admin/reports/dblog');
|
25
|
}
|
26
|
else {
|
27
|
$_content .= "<h3>" . t('LDAP Help Watchdog Errors and Notifications') . "</h3>";
|
28
|
$_content .= 'This feature requires <code>Database logging</code> module to be turned on. ';
|
29
|
$_content .= l(t('Module enable page'), 'admin/build/modules');
|
30
|
}
|
31
|
|
32
|
return $_content;
|
33
|
}
|
34
|
|
35
|
/**
|
36
|
* Return all desired authorizations for a given user.
|
37
|
*
|
38
|
* @param object $user
|
39
|
*
|
40
|
* @param string $op
|
41
|
* =
|
42
|
* set -- grant authorizations (store in db) and return authorizations
|
43
|
* test_query -- don't grant authorization, just query and return authorizations. assume user is ldap authenticated and exists
|
44
|
* test_query_set -- do grant authorizations, but also log data for debugging
|
45
|
* query -- don't grant authorization, just query and return authorizations.
|
46
|
*
|
47
|
* @param string $consumer_type
|
48
|
* e.g. drupal_roles.
|
49
|
* @param string $context
|
50
|
* 'logon', 'test_if_authorizations_granted'.
|
51
|
*
|
52
|
* @return
|
53
|
*
|
54
|
* LDAP_AUTHORIZATION_NO_LDAP_SERVERS if no servers configured
|
55
|
* LDAP_AUTHORIZATION_LDAP_ERROR if ldap error
|
56
|
* TRUE if servers configured but no roles derived from ldap
|
57
|
* array of potential authorizations (user may or may not already have these)
|
58
|
*
|
59
|
* by reference $user->data[<consumer_type>][<authorization_id>] = array();
|
60
|
* e.g. $var['drupal_role']['content_admin'] = array('rid' => 4)
|
61
|
* e.g. $var['og_membership']['bakers club'] = array('expires' => '01/01/2012');
|
62
|
*/
|
63
|
function _ldap_authorizations_user_authorizations(&$user, $op, $consumer_type, $context) {
|
64
|
$debug = FALSE;
|
65
|
$detailed_watchdog_log = variable_get('ldap_help_watchdog_detail', 0);
|
66
|
$authorizations = array();
|
67
|
$notifications = array();
|
68
|
$watchdog_tokens = array('%username' => $user->name);
|
69
|
$consumers = ldap_authorization_get_consumers($consumer_type, TRUE, FALSE);
|
70
|
|
71
|
$servers = ldap_servers_get_servers(NULL, 'enabled', TRUE);
|
72
|
|
73
|
/**
|
74
|
* user 1 not used in ldap authorization. this is a design decision.
|
75
|
*/
|
76
|
if (property_exists($user, 'uid') && $user->uid == 1) {
|
77
|
if ($detailed_watchdog_log) {
|
78
|
watchdog('ldap_authorization', '%username : ldap_authorization not applied to user 1', $watchdog_tokens, WATCHDOG_DEBUG);
|
79
|
}
|
80
|
$notifications['all'] = LDAP_AUTHORIZATION_NOT_APPLY_USER_1;
|
81
|
foreach ($consumers as $consumer_type => $consumer) {
|
82
|
$authorizations[$consumer_type] = array();
|
83
|
}
|
84
|
return array($authorizations, $notifications);
|
85
|
}
|
86
|
|
87
|
/**
|
88
|
* determine if user is ldap authenticated
|
89
|
*/
|
90
|
if ($context == 'test_if_authorizations_granted' || (($op == 'test_query_set' || $op == 'test_query') && @$user->ldap_test == TRUE)) {
|
91
|
// Property 'ldap_authenticated' only exists for fake user objects submitted from testing form.
|
92
|
$ldap_authenticated = $user->ldap_authenticated;
|
93
|
}
|
94
|
else {
|
95
|
$ldap_authenticated = (boolean) (module_exists('ldap_authentication') && ldap_authentication_ldap_authenticated($user));
|
96
|
}
|
97
|
$watchdog_tokens['%ldap_authenticated'] = ($ldap_authenticated) ? 'yes' : 'no';
|
98
|
|
99
|
foreach ($consumers as $consumer_type => $consumer) {
|
100
|
$authorizations[$consumer_type] = array();
|
101
|
/**
|
102
|
* each consumer type has only one consumer conf and each consumer conf has only one ldap server id (sid)
|
103
|
* so there is a one-to-one-to-one relationship between:
|
104
|
* - consumer object ($consumer),
|
105
|
* - server object ($ldap_server),
|
106
|
* - and consumer conf object.
|
107
|
*
|
108
|
*/
|
109
|
|
110
|
$consumer = ldap_authorization_get_consumer_object($consumer_type);
|
111
|
if (!$consumer->consumerConf->status) {
|
112
|
continue;
|
113
|
}
|
114
|
$proposed_ldap_authorizations = array();
|
115
|
$watchdog_tokens['%consumer_type'] = $consumer_type;
|
116
|
$watchdog_tokens['%sid'] = $consumer->consumerConf->sid;
|
117
|
|
118
|
if (!is_object($consumer->consumerConf)) {
|
119
|
if ($detailed_watchdog_log) {
|
120
|
watchdog('ldap_authorization', '%username : consumer type %consumer_type has no
|
121
|
configuration set.', $watchdog_tokens, WATCHDOG_DEBUG);
|
122
|
}
|
123
|
continue;
|
124
|
}
|
125
|
|
126
|
if ($detailed_watchdog_log) {
|
127
|
watchdog('ldap_authorization', '%username : testing with
|
128
|
consumer type %consumer_type. ldap authenticated=%ldap_authenticated', $watchdog_tokens, WATCHDOG_DEBUG);
|
129
|
}
|
130
|
if ($debug) {
|
131
|
debug(t('%username : testing with consumer type %consumer_type. ldap authenticated=%ldap_authenticated'), $watchdog_tokens);
|
132
|
// $debug = TRUE;.
|
133
|
debug("op=$op,ldap_authenticated=$ldap_authenticated $consumer_type context=$context, consumer->consumerConf->synchOnLogon=" . (int) $consumer->consumerConf->synchOnLogon);
|
134
|
}
|
135
|
|
136
|
if ($context == 'logon' && !$consumer->consumerConf->synchOnLogon) {
|
137
|
$notifications[$consumer_type][] = LDAP_AUTHORIZATION_MAP_NOT_CONF_FOR_LOGON;
|
138
|
if ($detailed_watchdog_log) {
|
139
|
watchdog('ldap_authorization', '%username : %consumer_type not set to run on user logon.', $watchdog_tokens, WATCHDOG_DEBUG);
|
140
|
}
|
141
|
continue;
|
142
|
}
|
143
|
|
144
|
if ($consumer->consumerConf->onlyApplyToLdapAuthenticated && !$ldap_authenticated && $op != 'test_query' && $op != 'test_query_set') {
|
145
|
if ($detailed_watchdog_log) {
|
146
|
watchdog('ldap_authorization', '%username : not used because it is set to be applied only to ldap authenticated users.
|
147
|
%username is not ldap authenticated.', $watchdog_tokens, WATCHDOG_DEBUG);
|
148
|
}
|
149
|
$notifications[$consumer_type][] = LDAP_AUTHORIZATION_USER_NOT_LDAP_AUTHENTICATED;
|
150
|
continue;
|
151
|
}
|
152
|
|
153
|
$ldap_user = ldap_servers_get_user_ldap_data($user, $consumer->consumerConf->sid, 'ldap_authorization__' . $consumer_type);
|
154
|
|
155
|
if (!$ldap_user) {
|
156
|
$notifications[$consumer_type][] = LDAP_AUTHORIZATION_USER_LDAP_NOT_FOUND;
|
157
|
if ($detailed_watchdog_log) {
|
158
|
watchdog('ldap_authorization', '%username : %consumer_type ldap user not found.', $watchdog_tokens, WATCHDOG_DEBUG);
|
159
|
}
|
160
|
continue;
|
161
|
}
|
162
|
|
163
|
if (!isset($servers[$consumer->consumerConf->sid])) {
|
164
|
$notifications[$consumer_type][] = LDAP_AUTHORIZATION_SERVER_CONFIG_NOT_FOUND;
|
165
|
if ($detailed_watchdog_log) {
|
166
|
watchdog('ldap_authorization', '%username : %consumer_type ldap server %sid not enabled or found.', $watchdog_tokens, WATCHDOG_DEBUG);
|
167
|
}
|
168
|
continue;
|
169
|
}
|
170
|
|
171
|
$ldap_server = $consumer->consumerConf->server;
|
172
|
|
173
|
/**
|
174
|
* 1. first just need to figure out what authz_ids are generated for this consumer type/mapping configuration
|
175
|
*
|
176
|
* goal here is simply to build an array of authorizations for this ldap authz mapping
|
177
|
* $proposed_ldap_authorizations[<authorization id>] = properties associative array or empty array
|
178
|
* e.g. $proposed_ldap_authorizations['admin'] = array()
|
179
|
*
|
180
|
* @see ldap_authorization.api.php hook_ldap_authorization_maps_alter() notes
|
181
|
*/
|
182
|
|
183
|
ldap_authorization_maps_alter_invoke($user, $ldap_user, $ldap_server, $consumer->consumerConf, $proposed_ldap_authorizations, $op);
|
184
|
|
185
|
/** make sure keys of array are lower case and values are mixed case
|
186
|
* and strip to first attribute is configured
|
187
|
*/
|
188
|
|
189
|
foreach ($proposed_ldap_authorizations as $key => $authorization_id) {
|
190
|
if ($consumer->consumerConf->useFirstAttrAsGroupId) {
|
191
|
$attr_parts = ldap_explode_dn($authorization_id, 0);
|
192
|
if (count($attr_parts) > 0) {
|
193
|
$first_part = explode('=', $attr_parts[0]);
|
194
|
if (count($first_part) > 1) {
|
195
|
$authorization_id = ldap_pear_unescape_dn_value(trim($first_part[1]));
|
196
|
}
|
197
|
}
|
198
|
$new_key = drupal_strtolower($authorization_id);
|
199
|
}
|
200
|
else {
|
201
|
$new_key = drupal_strtolower($key);
|
202
|
}
|
203
|
$proposed_ldap_authorizations[$new_key] = $authorization_id;
|
204
|
if ($key != $new_key) {
|
205
|
unset($proposed_ldap_authorizations[$key]);
|
206
|
}
|
207
|
}
|
208
|
|
209
|
if ($op == 'test_query' || $op == 'test_query_set') {
|
210
|
$_SESSION['ldap_authorization_test_query']['useFirstAttrAsGroupId'] = $proposed_ldap_authorizations;
|
211
|
}
|
212
|
|
213
|
if ($detailed_watchdog_log || $debug) {
|
214
|
$_proposed_ldap_authorizations = is_array($proposed_ldap_authorizations) ? $proposed_ldap_authorizations : array();
|
215
|
$watchdog_tokens['%proposed_authorizations'] = join(', ', $_proposed_ldap_authorizations);
|
216
|
}
|
217
|
if ($detailed_watchdog_log) {
|
218
|
watchdog('ldap_authorization', '%username : initial proposed authorization for %consumer_type: %proposed_authorizations.',
|
219
|
$watchdog_tokens, WATCHDOG_DEBUG);
|
220
|
}
|
221
|
if ($debug) {
|
222
|
debug(t('%username : initial proposed authorization for %consumer_type: %proposed_authorizations.',
|
223
|
$watchdog_tokens));
|
224
|
}
|
225
|
|
226
|
/**
|
227
|
* 2. filter can be both a whitelist and a mapping of an ldap results to an authorization id.
|
228
|
* goal of this step is to generate $filtered_ldap_authorizations[$consumer_type]
|
229
|
* an array of filtered and mapped authorization ids
|
230
|
*/
|
231
|
|
232
|
$filtered_ldap_authorizations = array();
|
233
|
// Filter + map.
|
234
|
if ($consumer->consumerConf->useMappingsAsFilter) {
|
235
|
foreach ($consumer->consumerConf->mappings as $mapping_filter) {
|
236
|
$map_from = $mapping_filter['from'];
|
237
|
$map_to = $mapping_filter['normalized'];
|
238
|
if (isset($proposed_ldap_authorizations[drupal_strtolower($map_from)])) {
|
239
|
$filtered_ldap_authorizations[drupal_strtolower($map_to)] = array('map_to_string' => $map_to, 'exists' => NULL);
|
240
|
}
|
241
|
}
|
242
|
}
|
243
|
// Only map, don't filter off authorizations that have no mapping.
|
244
|
else {
|
245
|
$_authorizations = array_values($proposed_ldap_authorizations);
|
246
|
if (is_array($consumer->consumerConf->mappings) && is_array($proposed_ldap_authorizations)) {
|
247
|
foreach ($consumer->consumerConf->mappings as $mapping_filter) {
|
248
|
$map_from = $mapping_filter['from'];
|
249
|
$map_to = $mapping_filter['normalized'];
|
250
|
$map_from_key = array_search(drupal_strtolower($map_from), array_keys($proposed_ldap_authorizations));
|
251
|
if ($map_from_key !== FALSE) {
|
252
|
// Remove non mapped authorization.
|
253
|
$_authorizations = array_diff($_authorizations, array($map_from));
|
254
|
$_authorizations = array_diff($_authorizations, array(drupal_strtolower($map_from)));
|
255
|
// Add mapped authorization.
|
256
|
$_authorizations[] = $map_to;
|
257
|
// Remove map from;.
|
258
|
}
|
259
|
}
|
260
|
}
|
261
|
foreach ($_authorizations as $i => $authorization_id) {
|
262
|
$filtered_ldap_authorizations[drupal_strtolower($authorization_id)] = array(
|
263
|
'map_to_string' => $authorization_id,
|
264
|
'exists' => NULL,
|
265
|
'value' => $authorization_id,
|
266
|
);
|
267
|
}
|
268
|
}
|
269
|
|
270
|
// Set values of $filtered_ldap_authorizations to consumers.
|
271
|
$consumer->populateConsumersFromConsumerIds($filtered_ldap_authorizations, $consumer->consumerConf->createConsumers);
|
272
|
/**
|
273
|
* now that we have list of consumers that are to be granted, give other modules a chance to alter it
|
274
|
*
|
275
|
* @see ldap_authorization.api.php hook_ldap_authorization_authorizations_alter() notes
|
276
|
*/
|
277
|
$params = array(
|
278
|
'user' => $user,
|
279
|
'ldap_user' => $ldap_user,
|
280
|
'ldap_server' => $ldap_server,
|
281
|
'consumer' => $consumer,
|
282
|
);
|
283
|
|
284
|
drupal_alter('ldap_authorization_authorizations', $filtered_ldap_authorizations, $params);
|
285
|
|
286
|
$watchdog_tokens['%filtered_ldap_authorizations'] = join(', ', array_keys($filtered_ldap_authorizations));
|
287
|
if ($detailed_watchdog_log) {
|
288
|
watchdog('ldap_authorization', '%username : filtered authorization for %consumer_type: %filtered_ldap_authorizations.',
|
289
|
$watchdog_tokens, WATCHDOG_DEBUG);
|
290
|
}
|
291
|
if ($debug) {
|
292
|
debug(t('%username : filtered authorization for %consumer_type: %filtered_ldap_authorizations.',
|
293
|
$watchdog_tokens));
|
294
|
}
|
295
|
|
296
|
if ($op == 'test_query' || $op == 'test_query_set') {
|
297
|
$display_authorizations = array();
|
298
|
foreach ($filtered_ldap_authorizations as $consumer_id => $_consumer) {
|
299
|
$display_authorizations[] = $_consumer['map_to_string'];
|
300
|
}
|
301
|
$_SESSION['ldap_authorization_test_query']['post mappings'] = $display_authorizations;
|
302
|
if (property_exists($user, 'data') &&
|
303
|
isset($user->data['ldap_authorizations'][$consumer->consumerType])) {
|
304
|
$data = $user->data['ldap_authorizations'][$consumer->consumerType];
|
305
|
}
|
306
|
else {
|
307
|
$data = [];
|
308
|
}
|
309
|
$_SESSION['ldap_authorization_test_query']['user data'] = $data;
|
310
|
}
|
311
|
|
312
|
/**
|
313
|
* 3. third, grant any proposed authorizations not already granted
|
314
|
*/
|
315
|
|
316
|
if ($op == 'test_query' || $op == 'test_query_set') {
|
317
|
$_SESSION['ldap_authorization_test_query']['tokens'] = $watchdog_tokens;
|
318
|
}
|
319
|
if ($op == 'set' || $op == "test_query_set") {
|
320
|
$test = ($op == "test_query_set");
|
321
|
_ldap_authorizations_user_authorizations_set($user, $consumer, $filtered_ldap_authorizations, $ldap_user, $watchdog_tokens, $test);
|
322
|
}
|
323
|
|
324
|
$authorizations[$consumer_type] = $filtered_ldap_authorizations;
|
325
|
} // end foreach $consumers
|
326
|
|
327
|
return array($authorizations, $notifications);
|
328
|
|
329
|
}
|
330
|
|
331
|
/**
|
332
|
* @param object $user
|
333
|
* is a drupal user account object, need not be current user.
|
334
|
* @param object $consumer
|
335
|
* is instance of an authorization consumer class
|
336
|
* such as LdapAuthorizationConsumerDrupalRole.
|
337
|
* @param associative array of lower case authorization ids as keys and
|
338
|
* mixed case strings as values $filtered_ldap_authorizations
|
339
|
* all authorization ids a user is granted via ldap authorization configuration
|
340
|
* @param object $ldap_entry
|
341
|
* is users ldap entry. mapping of drupal user to
|
342
|
* ldap entry is stored in ldap_server configuration
|
343
|
*
|
344
|
* returns nothing.
|
345
|
*/
|
346
|
function _ldap_authorizations_user_authorizations_set(&$user, $consumer, $filtered_ldap_authorizations, &$ldap_entry, $watchdog_tokens, $test) {
|
347
|
|
348
|
$detailed_watchdog_log = variable_get('ldap_help_watchdog_detail', 0);
|
349
|
ldap_authorization_cleanse_empty_og_fields($user);
|
350
|
|
351
|
/**
|
352
|
* A. Determine what authorizations have been granted in the past by ldap authorization
|
353
|
*/
|
354
|
|
355
|
if (isset($user->data['ldap_authorizations'][$consumer->consumerType])
|
356
|
&& is_array($user->data['ldap_authorizations'][$consumer->consumerType])) {
|
357
|
$user_auth_data = $user->data['ldap_authorizations'][$consumer->consumerType];
|
358
|
$initial_existing_ldap_authorizations = array_keys($user_auth_data);
|
359
|
}
|
360
|
else {
|
361
|
$user_auth_data = array();
|
362
|
$initial_existing_ldap_authorizations = array();
|
363
|
}
|
364
|
|
365
|
if ($test) {
|
366
|
$_SESSION['ldap_authorization_test_query']['setting_data']['Pre Grant/Revokes $user->data[ldap_authorizations][' . $consumer->consumerType . ']'] = $user_auth_data;
|
367
|
$_SESSION['ldap_authorization_test_query']['setting_data']['Pre Grant/Revokes authorizations user has'] = $consumer->usersAuthorizations($user);
|
368
|
}
|
369
|
|
370
|
$watchdog_tokens['%initial'] = join(', ', $initial_existing_ldap_authorizations);
|
371
|
$watchdog_tokens['%filtered_ldap_authorizations'] = join(', ', array_keys($filtered_ldap_authorizations));
|
372
|
/**
|
373
|
* B. if regrantLdapProvisioned is false, $grants_lcase array should only be new authorizations
|
374
|
*/
|
375
|
|
376
|
if (!$consumer->consumerConf->regrantLdapProvisioned) {
|
377
|
// If regranting disabled, filter off previously granted roles.
|
378
|
$grants = array_diff(array_keys($filtered_ldap_authorizations), $initial_existing_ldap_authorizations);
|
379
|
if ($test) {
|
380
|
$_SESSION['ldap_authorization_test_query']['setting_data']['Grants after regrantLdapProvisioned filter'] = $grants;
|
381
|
}
|
382
|
}
|
383
|
else {
|
384
|
$grants = array_keys($filtered_ldap_authorizations);
|
385
|
}
|
386
|
|
387
|
$watchdog_tokens['%grants1'] = join(', ', $grants);
|
388
|
|
389
|
/**
|
390
|
* D. Only grant authorization consumer ids that exist
|
391
|
*/
|
392
|
|
393
|
// Keys are lcase, values are mixed case.
|
394
|
$existing_grants = array();
|
395
|
foreach ($grants as $i => $grant) {
|
396
|
if (!empty($filtered_ldap_authorizations[$grant]['exists'])) {
|
397
|
$existing_grants[$grant] = $filtered_ldap_authorizations[$grant];
|
398
|
}
|
399
|
}
|
400
|
/**
|
401
|
* E. Do grants
|
402
|
*/
|
403
|
$watchdog_tokens['%filtered_grants_full_array'] = print_r($existing_grants, TRUE);
|
404
|
$consumer->authorizationGrant($user, $user_auth_data, $existing_grants, $ldap_entry, FALSE);
|
405
|
$watchdog_tokens['%user_auth_data_post_grants'] = print_r($user_auth_data, TRUE);
|
406
|
$watchdog_tokens['%user_data_post_grants'] = print_r($user->data, TRUE);
|
407
|
|
408
|
/**
|
409
|
* 3.F take away any authorizations not in proposed authorization,
|
410
|
* but previously granted by ldap
|
411
|
*/
|
412
|
$watchdog_tokens['%revokes'] = t('none');
|
413
|
|
414
|
if ($consumer->consumerConf->revokeLdapProvisioned) {
|
415
|
$revokes_lcase = $consumer->authorizationDiff($initial_existing_ldap_authorizations, array_keys($filtered_ldap_authorizations));
|
416
|
if (count($revokes_lcase)) {
|
417
|
// Keys are lcase, values are mixed case.
|
418
|
$revokes = array();
|
419
|
foreach ($revokes_lcase as $i => $revoke_lcase) {
|
420
|
$revokes[$revoke_lcase] = array(
|
421
|
'value' => NULL,
|
422
|
'map_to_string' => NULL,
|
423
|
'exists' => TRUE,
|
424
|
);
|
425
|
}
|
426
|
if ($test) {
|
427
|
$_SESSION['ldap_authorization_test_query']['setting_data']['Revokes'] = $revokes;
|
428
|
}
|
429
|
$consumer->authorizationRevoke($user, $user_auth_data, $revokes, $ldap_entry, FALSE);
|
430
|
$watchdog_tokens['%revokes'] = join(', ', array_keys($revokes));
|
431
|
}
|
432
|
}
|
433
|
|
434
|
$watchdog_tokens['%user_auth_data_post_revokes'] = print_r($user_auth_data, TRUE);
|
435
|
$watchdog_tokens['%user_data_post_revokes'] = print_r($user->data, TRUE);
|
436
|
|
437
|
/**
|
438
|
* 3.G save user object and user data
|
439
|
* note $user object is passed by reference into this function
|
440
|
*/
|
441
|
|
442
|
$uid = $user->uid;
|
443
|
$user_edit = array('data' => $user->data);
|
444
|
$user_edit['data']['ldap_authorizations'] = empty($user->data['ldap_authorizations']) ? array() : $user->data['ldap_authorizations'];
|
445
|
// Keep in good display order.
|
446
|
$consumer->sortConsumerIds('grant', $user_auth_data);
|
447
|
$user_edit['data']['ldap_authorizations'][$consumer->consumerType] = $user_auth_data;
|
448
|
$watchdog_tokens['%user_edit_presave'] = print_r($user_edit, TRUE);
|
449
|
// See #1973352 and #935592.
|
450
|
if (empty($user->picture->fid)) {
|
451
|
$user2 = user_load($user->uid);
|
452
|
$user->picture = $user2->picture;
|
453
|
}
|
454
|
$user = user_save($user, $user_edit);
|
455
|
|
456
|
$watchdog_tokens['%user_data_post_save'] = print_r($user->data, TRUE);
|
457
|
$watchdog_tokens['%user_roles_post_save'] = print_r($user->roles, TRUE);
|
458
|
|
459
|
if ($detailed_watchdog_log) {
|
460
|
watchdog('ldap_authorization',
|
461
|
'%username : user_authorizations_set results for %consumer_type:
|
462
|
<hr/>1. Initial existing authorizations: %initial
|
463
|
<hr/>2. Filtered Authorizations: %filtered_ldap_authorizations
|
464
|
<hr/>3. After filtering off previously granted authorizations (if regrant is false): %grants1
|
465
|
|
466
|
<hr/>4a. full consumers array, pre grants: %filtered_grants_full_array
|
467
|
<hr/>4b. user auth data after grants %consumer_type: <pre>%user_auth_data_post_grants</pre>
|
468
|
<hr/>4c. user data after grants for %consumer_type: <pre>%user_data_post_grants</pre>
|
469
|
|
470
|
<hr/>5a. revokes passed to authorizationRevoke(): %revokes
|
471
|
<hr/>5b. user auth data after revokes %consumer_type: <pre>%user_auth_data_post_revokes</pre>
|
472
|
<hr/>5c. user data after revokes for %consumer_type: <pre>%user_data_post_revokes</pre>
|
473
|
|
474
|
<hr/>6a. user_edit pre save : <pre>%user_edit_presave</pre>
|
475
|
<hr/>6b. user data post save: <pre>%user_data_post_save</pre>
|
476
|
<hr/>6c. user roles post save: <pre>%user_roles_post_save</pre>
|
477
|
',
|
478
|
$watchdog_tokens, WATCHDOG_DEBUG);
|
479
|
}
|
480
|
|
481
|
if ($test) {
|
482
|
$_SESSION['ldap_authorization_test_query']['setting_data']['Post Grant/Revokes authorizations user has'] = $consumer->usersAuthorizations($user);
|
483
|
$_SESSION['ldap_authorization_test_query']['setting_data']['Post Grant/Revokes $user->data[ldap_authorizations][' . $consumer->consumerType . ']'] = $user->data['ldap_authorizations'][$consumer->consumerType];
|
484
|
}
|
485
|
|
486
|
}
|
487
|
|
488
|
/**
|
489
|
*
|
490
|
*/
|
491
|
function _ldap_authorization_ldap_authorization_maps_alter(&$user, &$user_ldap_entry, &$ldap_server, &$consumer_conf, &$authz_ids, $op) {
|
492
|
|
493
|
$detailed_watchdog_log = variable_get('ldap_help_watchdog_detail', 0);
|
494
|
$watchdog_tokens = array();
|
495
|
|
496
|
// Groups extracted from user's DN. such as ou=IT => group = "IT".
|
497
|
$derive_from_dn_authorizations = array();
|
498
|
if ($rdn_values = $consumer_conf->server->groupUserMembershipsFromDn($user)) {
|
499
|
$derive_from_dn_authorizations = array_combine($rdn_values, $rdn_values);
|
500
|
}
|
501
|
else {
|
502
|
$derive_from_dn_authorizations = array();
|
503
|
}
|
504
|
if ($op == 'test_query' || $op == 'test_query_set') {
|
505
|
$_SESSION['ldap_authorization_test_query']['maps']['Derive from DN'] = ($rdn_values) ? $derive_from_dn_authorizations : t('disabled');
|
506
|
}
|
507
|
|
508
|
// Traditional groups (dns)
|
509
|
$group_dns = $consumer_conf->server->groupMembershipsFromUser($user, 'group_dns');
|
510
|
if (!$group_dns) {
|
511
|
$group_dns = array();
|
512
|
}
|
513
|
elseif (count($group_dns)) {
|
514
|
$group_dns = array_unique($group_dns);
|
515
|
}
|
516
|
if ($op == 'test_query' || $op == 'test_query_set') {
|
517
|
$_SESSION['ldap_authorization_test_query']['maps']['Groups DNs'] = $group_dns;
|
518
|
}
|
519
|
|
520
|
$values = array_merge($derive_from_dn_authorizations, $group_dns);
|
521
|
$values = array_unique($values);
|
522
|
$authz_ids = (count($values)) ? array_combine($values, $values) : array();
|
523
|
if ($detailed_watchdog_log) {
|
524
|
$watchdog_tokens['%username'] = $user->name;
|
525
|
$watchdog_tokens['%ldap_server'] = $ldap_server->sid;
|
526
|
$watchdog_tokens['%deriveFromDn'] = join(', ', $derive_from_dn_authorizations);
|
527
|
$watchdog_tokens['%deriveFromGroups'] = join(', ', $group_dns);
|
528
|
$watchdog_tokens['%authz_ids'] = join(', ', array_keys($authz_ids));
|
529
|
|
530
|
watchdog('ldap_authorization', '%username :_ldap_authorization_ldap_authorization_maps_alter:
|
531
|
<hr/>deriveFromDn authorization ids: %deriveFromDn
|
532
|
<hr/>deriveFromAttr authorization ids: %deriveFromGroups
|
533
|
<hr/>merged authz_ids authorization ids: %authz_ids
|
534
|
',
|
535
|
$watchdog_tokens, WATCHDOG_DEBUG);
|
536
|
}
|
537
|
|
538
|
}
|