From 296744ceb39b1b4b4e3d516ef26ad27298c6d8f7 Mon Sep 17 00:00:00 2001 From: c12simple Date: Thu, 13 Nov 2014 16:09:46 +0100 Subject: [PATCH] create fakeMemberOf for openldap and enable map memberOf to roleID with prefix --- .../auth.ldap/class.ldapAuthDriver.php | 83 +++++++++++++++++-- core/src/plugins/auth.ldap/manifest.xml | 35 ++++---- 2 files changed, 95 insertions(+), 23 deletions(-) diff --git a/core/src/plugins/auth.ldap/class.ldapAuthDriver.php b/core/src/plugins/auth.ldap/class.ldapAuthDriver.php index f29048ff2f..c6539bedef 100644 --- a/core/src/plugins/auth.ldap/class.ldapAuthDriver.php +++ b/core/src/plugins/auth.ldap/class.ldapAuthDriver.php @@ -39,6 +39,9 @@ class ldapAuthDriver extends AbstractAuthDriver public $dynamicExpected; public $ldapUserAttr; public $ldapGroupAttr; + public $enableMemberOf; + public $mappedRolePrefix; + public $pageSize; public $ldapconn = null; public $separateGroup = ""; @@ -69,6 +72,9 @@ public function init($options) if ($options["LDAP_PORT"]) $this->ldapPort = $options["LDAP_PORT"]; if ($options["LDAP_USER"]) $this->ldapAdminUsername = $options["LDAP_USER"]; if ($options["LDAP_PASSWORD"]) $this->ldapAdminPassword = $options["LDAP_PASSWORD"]; + if ($options["LDAP_FAKE_MEMBEROF"]) $this->enableMemberOf = $options["LDAP_FAKE_MEMBEROF"]; + if ($options["LDAP_PAGE_SIZE"]) $this->pageSize = $options["LDAP_PAGE_SIZE"]; + if ($options["LDAP_GROUP_PREFIX"]) $this->mappedRolePrefix = $options["LDAP_GROUP_PREFIX"]; if ($options["LDAP_DN"]) $this->ldapDN = $this->parseReplicatedParams($options, array("LDAP_DN")); if ($options["LDAP_GDN"]) $this->ldapGDN = $this->parseReplicatedParams($options, array("LDAP_GDN")); if (is_array($options["CUSTOM_DATA_MAPPING"])) $this->customParamsMapping = $options["CUSTOM_DATA_MAPPING"]; @@ -297,6 +303,13 @@ public function getUserEntries($login = null, $countOnly = false, $offset = -1, if ($offset != -1 && $index < $offset) { $index ++; continue; } + + if (in_array(strtolower("memberof"), array_map("strtolower", $expected)) && ($this->enableMemberOf)) { + $uid = $entry["dn"]; + $strldap = "(&" . $this->ldapGFilter . "(member=".$uid."))"; + $this->fakeMemberOf($conn, $this->ldapGDN, $strldap, array("cn"), $entry); + } + $allEntries[] = $entry; $index ++; if($limit!= -1 && $index >= $offset + $limit) break; @@ -628,6 +641,9 @@ public function updateUserObject(&$userObject) } switch ($params['MAPPING_LOCAL_TYPE']) { case "role_id": + $valueFilters = null; + $matchFilter = null; + $filter = $params["MAPPING_LOCAL_PARAM"]; if (strpos($filter, "preg:") !== false) { $matchFilter = "/".str_replace("preg:", "", $filter)."/i"; @@ -635,15 +651,36 @@ public function updateUserObject(&$userObject) $valueFilters = array_map("trim", explode(",", $filter)); } if ($key == "memberof") { - foreach ($memberValues as $uniqValue => $fullDN) { - if (!in_array($uniqValue, array_keys($userObject->getRoles()))) { - if(isSet($matchFilter) && !preg_match($matchFilter, $uniqValue)) continue; - if(isSet($valueFilters) && !in_array($uniqValue, $valueFilters)) continue; - $userObject->addRole(AuthService::getRole($uniqValue, true)); - $userObject->recomputeMergedRole(); - $changes = true; + + if($this->mappedRolePrefix){ + $ldap_prefix = $this->mappedRolePrefix; + } + else{ + $ldap_prefix = ""; + } + + /* + $userroles = $userObject->getRoles(); + //remove all mapped roles before + + if (is_array($userroles)) { + foreach ($userroles as $key => $role) { + if ((AuthService::getRole($key)) && !(strpos($key, $this->mappedRolePrefix) === false)) { + $userObject->removeRole($key); + } } } + $userObject->recomputeMergedRole(); + */ + + foreach ($memberValues as $uniqValue => $fullDN) { + $uniqValue = $ldap_prefix.$uniqValue; + if (isSet($matchFilter) && !preg_match($matchFilter, $uniqValue)) continue; + if (isSet($valueFilters) && !in_array($uniqValue, $valueFilters)) continue; + $userObject->addRole(AuthService::getRole($uniqValue, true)); + $userObject->recomputeMergedRole(); + $changes = true; + } } else { foreach ($entry[$key] as $uniqValue) { if(isSet($matchFilter) && !preg_match($matchFilter, $uniqValue)) continue; @@ -722,4 +759,36 @@ public function updateUserObject(&$userObject) } } + public function fakeMemberOf($conn, $groupDN, $filterString, $atts, &$entry) + { + if (!($conn) || !($groupDN)) return null; + + $searchForGroups = ldap_search($conn, $groupDN, $filterString, $atts); + $memberOf = array(); + foreach ($searchForGroups as $i => $resourceResult) { + if ($resourceResult === false) continue; + $res = ldap_get_entries($conn[$i], $resourceResult); + if (!empty($res)) { + $memberOf["count"] += $res["count"]; + unset($res["count"]); + foreach ($res as $element) { + $memberOf[] = $element["dn"]; + } + } + } + if ($memberOf) { + $isMemberOf = false; + for($i = 0; $i < $entry["count"]; $i++){ + if(strcmp("memberof", strtolower($entry[$i])) === 0 ){ + $isMemberOf = true; + } + } + if(!$isMemberOf){ + $entry[$entry["count"]] = "memberof"; + $entry["count"]++; + } + $entry["memberof"] = $memberOf; + } + } + } diff --git a/core/src/plugins/auth.ldap/manifest.xml b/core/src/plugins/auth.ldap/manifest.xml index fe1f5c1689..b2f145d05b 100644 --- a/core/src/plugins/auth.ldap/manifest.xml +++ b/core/src/plugins/auth.ldap/manifest.xml @@ -8,27 +8,30 @@ - - - - - - - - + + + + + + + + + + + - - + + - - - - - - + + + + + + \ No newline at end of file