Skip to content

strict LDAP #359

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
simonLeary42 merged 4 commits into from
Nov 14, 2025
Merged

strict LDAP #359

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0e3c44c
strict LDAP
simonLeary42 Nov 14, 2025
daf47de
update phpopenldaper
simonLeary42 Nov 14, 2025
5089535
more default_values args
simonLeary42 Nov 14, 2025
f912080
optional
simonLeary42 Nov 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 31 additions & 14 deletions resources/lib/UnityLDAP.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,7 +169,11 @@ private function getAllUIDNumbersInUse(): array
// use baseOU for awareness of externally managed entries
return array_map(
fn($x) => $x["uidnumber"][0],
$this->baseOU->getChildrenArray(["uidNumber"], true, "(objectClass=posixAccount)"),
$this->baseOU->getChildrenArrayStrict(
["uidNumber"],
true,
"(objectClass=posixAccount)",
),
);
}

Expand All @@ -178,7 +182,7 @@ private function getAllGIDNumbersInUse(): array
// use baseOU for awareness of externally managed entries
return array_map(
fn($x) => $x["gidnumber"][0],
$this->baseOU->getChildrenArray(["gidNumber"], true, "(objectClass=posixGroup)"),
$this->baseOU->getChildrenArrayStrict(["gidNumber"], true, "(objectClass=posixGroup)"),
);
}

Expand Down Expand Up @@ -227,13 +231,16 @@ public function getQualifiedUsers(
return $out;
}

public function getQualifiedUsersAttributes(array $attributes): array
{
public function getQualifiedUsersAttributes(
array $attributes,
array $default_values = [],
): array {
$include_uids = $this->getQualifiedUsersUIDs();
$user_attributes = $this->baseOU->getChildrenArray(
$user_attributes = $this->baseOU->getChildrenArrayStrict(
$attributes,
true, // recursive
"(objectClass=posixAccount)",
$default_values,
);
foreach ($user_attributes as $i => $attributes) {
if (!in_array($attributes["uid"][0], $include_uids)) {
Expand Down Expand Up @@ -283,31 +290,38 @@ public function getAllPIGroups(
return $out;
}

public function getAllPIGroupsAttributes(array $attributes): array
public function getAllPIGroupsAttributes(array $attributes, array $default_values = []): array
{
return $this->pi_groupOU->getChildrenArray($attributes);
return $this->pi_groupOU->getChildrenArrayStrict(
$attributes,
false, // non-recursive
"objectClass=posixGroup",
$default_values,
);
}

public function getPIGroupGIDsWithMemberUID(string $uid): array
{
return array_map(
fn($x) => $x["cn"][0],
$this->pi_groupOU->getChildrenArray(
$this->pi_groupOU->getChildrenArrayStrict(
["cn"],
false,
"(memberuid=" . ldap_escape($uid, LDAP_ESCAPE_FILTER) . ")",
),
);
}

public function getAllPIGroupOwnerAttributes(array $attributes): array
{
public function getAllPIGroupOwnerAttributes(
array $attributes,
array $default_values = [],
): array {
// get the PI groups, filter for just the GIDs, then map the GIDs to owner UIDs
$owner_uids = array_map(
fn($x) => UnityGroup::GID2OwnerUID($x),
array_map(fn($x) => $x["cn"][0], $this->pi_groupOU->getChildrenArray(["cn"])),
array_map(fn($x) => $x["cn"][0], $this->pi_groupOU->getChildrenArrayStrict(["cn"])),
);
$owner_attributes = $this->getQualifiedUsersAttributes($attributes);
$owner_attributes = $this->getQualifiedUsersAttributes($attributes, $default_values);
foreach ($owner_attributes as $i => $attributes) {
if (!in_array($attributes["uid"][0], $owner_uids)) {
unset($owner_attributes[$i]);
Expand Down Expand Up @@ -400,9 +414,12 @@ public function getAllOrgGroups(
return $out;
}

public function getAllOrgGroupsAttributes(array $attributes): array
public function getAllOrgGroupsAttributes(array $attributes, array $default_values = []): array
{
return $this->org_groupOU->getChildrenArray($attributes);
return $this->org_groupOU->getChildrenArrayStrict(
$attributes,
default_values: $default_values,
);
}

public function getUserEntry(string $uid): LDAPEntry
Expand Down
2 changes: 1 addition & 1 deletion resources/lib/phpopenldaper
Open in desktop
Submodule phpopenldaper updated 1 files
+45 −0 src/PHPOpenLDAPer/LDAPEntry.php
4 changes: 2 additions & 2 deletions workers/update-ldap-cache.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@

$org_group_ou = new LDAPEntry($LDAP->getConn(), CONFIG["ldap"]["orggroup_ou"]);
echo "waiting for LDAP search (org groups)...\n";
$org_groups = $org_group_ou->getChildrenArray(["cn", "memberuid"], true);
$org_groups = $org_group_ou->getChildrenArrayStrict(["cn", "memberuid"], true);
echo "response received.\n";
// phpcs:disable
$org_group_CNs = array_map(function ($x) {
Expand All @@ -73,7 +73,7 @@

$pi_group_ou = new LDAPEntry($LDAP->getConn(), CONFIG["ldap"]["pigroup_ou"]);
echo "waiting for LDAP search (pi groups)...\n";
$pi_groups = $pi_group_ou->getChildrenArray(["cn", "memberuid"], true);
$pi_groups = $pi_group_ou->getChildrenArrayStrict(["cn", "memberuid"], true);
echo "response received.\n";
// phpcs:disable
$pi_group_CNs = array_map(function ($x) {
Expand Down