1
|
<?php
|
2
|
|
3
|
|
4
|
|
5
|
|
6
|
|
7
|
|
8
|
|
9
|
|
10
|
|
11
|
module_load_include('php', 'ldap_authorization', 'LdapAuthorizationConsumerAbstract.class');
|
12
|
|
13
|
class LdapAuthorizationConsumerDrupalRole extends LdapAuthorizationConsumerAbstract {
|
14
|
|
15
|
public $consumerType = 'drupal_role';
|
16
|
public $allowConsumerObjectCreation = TRUE;
|
17
|
|
18
|
public $defaultConsumerConfProperties = array(
|
19
|
'onlyApplyToLdapAuthenticated' => TRUE,
|
20
|
'useMappingsAsFilter' => TRUE,
|
21
|
'synchOnLogon' => TRUE,
|
22
|
'revokeLdapProvisioned' => TRUE,
|
23
|
'regrantLdapProvisioned' => TRUE,
|
24
|
'createConsumers' => TRUE,
|
25
|
);
|
26
|
|
27
|
function __construct($consumer_type = NULL) {
|
28
|
$params = ldap_authorization_drupal_role_ldap_authorization_consumer();
|
29
|
parent::__construct('drupal_role', $params['drupal_role']);
|
30
|
}
|
31
|
|
32
|
|
33
|
|
34
|
|
35
|
|
36
|
public function createConsumer($consumer_id, $consumer) {
|
37
|
$roles_by_consumer_id = $this->existingRolesByRoleName();
|
38
|
$existing_role = isset($roles_by_consumer_id[$consumer_id]) ? $roles_by_consumer_id[$consumer_id] : FALSE;
|
39
|
|
40
|
if ($existing_role) {
|
41
|
return FALSE;
|
42
|
}
|
43
|
elseif (drupal_strlen($consumer_id) > 63) {
|
44
|
watchdog('ldap_authorization_drupal_role', 'Tried to create drupal role
|
45
|
with name of over 63 characters (%group_name). Please correct your
|
46
|
drupal ldap_authorization settings', array('%group_name' => $consumer_id));
|
47
|
return FALSE;
|
48
|
}
|
49
|
|
50
|
$new_role = new stdClass();
|
51
|
$new_role->name = empty($consumer['value']) ? $consumer_id : $consumer['value'];
|
52
|
if (! ($status = user_role_save($new_role))) {
|
53
|
|
54
|
watchdog('user', 'failed to create drupal role %role in ldap_authorizations module', array('%role' => $new_role->name));
|
55
|
return FALSE;
|
56
|
}
|
57
|
else {
|
58
|
$roles_by_consumer_id = $this->existingRolesByRoleName(TRUE);
|
59
|
watchdog('user', 'created drupal role %role in ldap_authorizations module', array('%role' => $new_role->name));
|
60
|
}
|
61
|
return TRUE;
|
62
|
}
|
63
|
|
64
|
|
65
|
|
66
|
|
67
|
|
68
|
|
69
|
public function populateConsumersFromConsumerIds(&$consumers, $create_missing_consumers = FALSE) {
|
70
|
|
71
|
$roles_by_consumer_id = $this->existingRolesByRoleName(TRUE);
|
72
|
foreach ($consumers as $consumer_id => $consumer) {
|
73
|
|
74
|
if (!$consumer['exists']) {
|
75
|
if (isset($roles_by_consumer_id[$consumer_id])) {
|
76
|
$consumer['exists'] = TRUE;
|
77
|
$consumer['value'] = $roles_by_consumer_id[$consumer_id]['role_name'];
|
78
|
$consumer['name'] = $consumer['map_to_string'];
|
79
|
$consumer['map_to_string'] = $roles_by_consumer_id[$consumer_id]['role_name'];
|
80
|
}
|
81
|
elseif ($create_missing_consumers) {
|
82
|
$consumer['value'] = $consumer['map_to_string'];
|
83
|
$consumer['name'] = $consumer['map_to_string'];
|
84
|
$result = $this->createConsumer($consumer_id, $consumer);
|
85
|
$consumer['exists'] = $result;
|
86
|
}
|
87
|
else {
|
88
|
$consumer['exists'] = FALSE;
|
89
|
}
|
90
|
}
|
91
|
elseif (empty($consumer['value'])) {
|
92
|
$consumer['value'] = $roles_by_consumer_id[$consumer_id]['role_name'];
|
93
|
}
|
94
|
$consumers[$consumer_id] = $consumer;
|
95
|
}
|
96
|
}
|
97
|
|
98
|
|
99
|
public function revokeSingleAuthorization(&$user, $consumer_id, $consumer, &$user_auth_data, $user_save = FALSE, $reset = FALSE) {
|
100
|
|
101
|
$role_name_lcase = $consumer_id;
|
102
|
$role_name = empty($consumer['value']) ? $consumer_id : $consumer['value'];
|
103
|
$rid = $this->getDrupalRoleIdFromRoleName($role_name);
|
104
|
if (!$rid) {
|
105
|
$result = FALSE;
|
106
|
}
|
107
|
elseif (!$user->roles[$rid]) {
|
108
|
if (isset($user_auth_data[$consumer_id])) {
|
109
|
unset($user_auth_data[$consumer_id]);
|
110
|
}
|
111
|
$result = TRUE;
|
112
|
}
|
113
|
else {
|
114
|
unset($user->roles[$rid]);
|
115
|
$user_edit = array('roles' => $user->roles);
|
116
|
$account = user_load($user->uid);
|
117
|
$user = user_save($account, $user_edit);
|
118
|
$result = ($user && !isset($user->roles[$rid]));
|
119
|
if ($result && isset($user_auth_data[$consumer_id])) {
|
120
|
unset($user_auth_data[$consumer_id]);
|
121
|
}
|
122
|
}
|
123
|
|
124
|
if ($this->detailedWatchdogLog) {
|
125
|
watchdog('ldap_authorization', 'LdapAuthorizationConsumerDrupalRole.revokeSingleAuthorization()
|
126
|
revoked: rid=%rid, role_name=%role_name for username=%username, result=%result',
|
127
|
array('%rid' => $rid, '%role_name' => $role_name, '%username' => $user->name,
|
128
|
'%result' => $result), WATCHDOG_DEBUG);
|
129
|
}
|
130
|
|
131
|
return $result;
|
132
|
|
133
|
}
|
134
|
|
135
|
|
136
|
|
137
|
|
138
|
|
139
|
public function grantSingleAuthorization(&$user, $consumer_id, $consumer, &$user_auth_data, $user_save = FALSE, $reset = FALSE) {
|
140
|
|
141
|
$role_name_lcase = $consumer_id;
|
142
|
$role_name = empty($consumer['value']) ? $consumer_id : $consumer['value'];
|
143
|
$rid = $this->getDrupalRoleIdFromRoleName($role_name);
|
144
|
if (is_null($rid)) {
|
145
|
watchdog('ldap_authorization', 'LdapAuthorizationConsumerDrupalRole.grantSingleAuthorization()
|
146
|
failed to grant %username the role %role_name because role does not exist',
|
147
|
array('%role_name' => $role_name, '%username' => $user->name),
|
148
|
WATCHDOG_ERROR);
|
149
|
return FALSE;
|
150
|
}
|
151
|
|
152
|
$user->roles[$rid] = $role_name;
|
153
|
$user_edit = array('roles' => $user->roles);
|
154
|
if ($this->detailedWatchdogLog) {
|
155
|
watchdog('ldap_authorization', 'grantSingleAuthorization in drupal rold' . print_r($user, TRUE), array(), WATCHDOG_DEBUG);
|
156
|
}
|
157
|
|
158
|
$account = user_load($user->uid);
|
159
|
$user = user_save($account, $user_edit);
|
160
|
$result = ($user && !empty($user->roles[$rid]));
|
161
|
|
162
|
if ($this->detailedWatchdogLog) {
|
163
|
watchdog('ldap_authorization', 'LdapAuthorizationConsumerDrupalRole.grantSingleAuthorization()
|
164
|
granted: rid=%rid, role_name=%role_name for username=%username, result=%result',
|
165
|
array('%rid' => $rid, '%role_name' => $role_name, '%username' => $user->name,
|
166
|
'%result' => $result), WATCHDOG_DEBUG);
|
167
|
}
|
168
|
|
169
|
return $result;
|
170
|
|
171
|
}
|
172
|
|
173
|
public function usersAuthorizations(&$user) {
|
174
|
$authorizations = array();
|
175
|
foreach ($user->roles as $rid => $role_name_mixed_case) {
|
176
|
$authorizations[] = drupal_strtolower($role_name_mixed_case);
|
177
|
}
|
178
|
return $authorizations;
|
179
|
}
|
180
|
|
181
|
public function validateAuthorizationMappingTarget($mapping, $form_values = NULL, $clear_cache = FALSE) {
|
182
|
|
183
|
$has_form_values = is_array($form_values);
|
184
|
$message_type = NULL;
|
185
|
$message_text = NULL;
|
186
|
$role_name = $mapping['normalized'];
|
187
|
$tokens = array('!map_to' => $role_name);
|
188
|
$roles_by_name = $this->existingRolesByRoleName();
|
189
|
$pass = isset($roles_by_name[drupal_strtolower($role_name)]);
|
190
|
|
191
|
|
192
|
if (!$pass) {
|
193
|
$message_text = '"' . t('Drupal role') . ' ' . t('!map_to', $tokens) . '" ' . t('does not map to any existing Drupal roles.');
|
194
|
if ($has_form_values) {
|
195
|
$create_consumers = (isset($form_values['synchronization_actions']['create_consumers']) && $form_values['synchronization_actions']['create_consumers']);
|
196
|
}
|
197
|
else {
|
198
|
$create_consumers = $this->consumerConf->createConsumers;
|
199
|
}
|
200
|
if ($create_consumers && $this->allowConsumerObjectCreation) {
|
201
|
$message_type = 'warning';
|
202
|
$message_text .= ' ' . t('"!map_to" will be created when needed. If "!map_to" is not intentional, please fix it.', $tokens);
|
203
|
}
|
204
|
elseif (!$this->allowConsumerObjectCreation) {
|
205
|
$message_type = 'error';
|
206
|
$message_text .= ' ' . t('Since automatic Drupal role creation is not possible with this module, an existing role must be mapped to.');
|
207
|
}
|
208
|
elseif (!$create_consumers) {
|
209
|
$message_type = 'error';
|
210
|
$message_text .= ' ' . t('Since automatic Drupal role creation is disabled, an existing role must be mapped to. Either enable role creation or map to an existing role.');
|
211
|
}
|
212
|
}
|
213
|
return array($message_type, $message_text);
|
214
|
}
|
215
|
|
216
|
|
217
|
|
218
|
|
219
|
|
220
|
|
221
|
private function getDrupalRoleIdFromRoleName($role_name) {
|
222
|
$role_ids_by_name = $this->existingRolesByRoleName();
|
223
|
$role_name_lowercase = drupal_strtolower($role_name);
|
224
|
return empty($role_ids_by_name[$role_name_lowercase]) ? NULL : $role_ids_by_name[$role_name_lowercase]['rid'];
|
225
|
}
|
226
|
|
227
|
|
228
|
|
229
|
|
230
|
|
231
|
|
232
|
public function existingRolesByRoleName($reset = FALSE) {
|
233
|
|
234
|
static $roles_by_name;
|
235
|
|
236
|
if ($reset || !is_array($roles_by_name)) {
|
237
|
$roles_by_name = array();
|
238
|
foreach (array_flip(user_roles(TRUE)) as $role_name => $rid) {
|
239
|
$roles_by_name[drupal_strtolower($role_name)]['rid'] = $rid;
|
240
|
$roles_by_name[drupal_strtolower($role_name)]['role_name'] = $role_name;
|
241
|
}
|
242
|
}
|
243
|
return $roles_by_name;
|
244
|
}
|
245
|
|
246
|
|
247
|
|
248
|
|
249
|
public function normalizeMappings($mappings) {
|
250
|
|
251
|
$new_mappings = array();
|
252
|
$roles = user_roles(TRUE);
|
253
|
$roles_by_name = array_flip($roles);
|
254
|
foreach ($mappings as $i => $mapping) {
|
255
|
$new_mapping = array();
|
256
|
$new_mapping['user_entered'] = $mapping[1];
|
257
|
$new_mapping['from'] = $mapping[0];
|
258
|
$new_mapping['normalized'] = $mapping[1];
|
259
|
$new_mapping['simplified'] = $mapping[1];
|
260
|
$create_consumers = (boolean)($this->allowConsumerObjectCreation && $this->consumerConf->createConsumers);
|
261
|
$new_mapping['valid'] = (boolean)(!$create_consumers && !empty($roles_by_name[$mapping[1]]));
|
262
|
$new_mapping['error_message'] = ($new_mapping['valid']) ? '' : t("Role %role_name does not exist and role creation is not enabled.", array('%role' => $mapping[1]));
|
263
|
$new_mappings[] = $new_mapping;
|
264
|
}
|
265
|
|
266
|
return $new_mappings;
|
267
|
}
|
268
|
|
269
|
|
270
|
|
271
|
|
272
|
public function convertToFriendlyAuthorizationIds($authorizations) {
|
273
|
$authorization_ids_friendly = array();
|
274
|
foreach ($authorizations as $authorization_id => $authorization) {
|
275
|
$authorization_ids_friendly[] = $authorization['name'] . ' (' . $authorization_id . ')';
|
276
|
}
|
277
|
return $authorization_ids_friendly;
|
278
|
}
|
279
|
|
280
|
}
|