' .
@@ -111,6 +120,12 @@ class LdapAuthenticationConfAdmin extends LdapAuthenticationConf {
array('%blog' => 'blog', '%blog-wildcard' => 'blog/*', '%front' => '
' . + t('If your site is accessible via multiple hostnames, you may only want + the LDAP SSO module to authenticate against some of them. To exclude + any hostnames from SSO, enter them here. Enter one host per line.'); + '
'; + $values['ssoRemoteUserStripDomainNameDescription'] = t('Useful when the ' . 'WWW server provides authentication in the form of user@realm and you ' . 'want to have both SSO and regular forms based authentication ' . @@ -376,6 +391,20 @@ class LdapAuthenticationConfAdmin extends LdapAuthenticationConf { ); + $form['password'] = array( + '#type' => 'fieldset', + '#title' => t('Password'), + '#collapsible' => TRUE, + '#collapsed' => FALSE, + ); + $form['password']['passwordOption'] = array( + '#type' => 'radios', + '#title' => t('Password Behavior'), + '#required' => 1, + '#default_value' => $this->passwordOption, + '#options' => $this->passwordUpdateOptions, + ); + /** * Begin single sign-on settings */ @@ -443,6 +472,14 @@ class LdapAuthenticationConfAdmin extends LdapAuthenticationConf { '#disabled' => (boolean)(!$this->ssoEnabled), ); + $form['sso']['ssoExcludedHosts'] = array( + '#type' => 'textarea', + '#title' => t('SSO Excluded Hosts'), + '#description' => t($this->ssoExcludedHostsDescription), + '#default_value' => $this->arrayToLines($this->ssoExcludedHosts), + '#disabled' => (boolean)(!$this->ssoEnabled), + ); + $form['submit'] = array( '#type' => 'submit', '#value' => 'Save', @@ -504,7 +541,9 @@ class LdapAuthenticationConfAdmin extends LdapAuthenticationConf { $this->excludeIfNoAuthorizations = ($values['excludeIfNoAuthorizations']) ? (int)$values['excludeIfNoAuthorizations'] : NULL; $this->emailOption = ($values['emailOption']) ? (int)$values['emailOption'] : NULL; $this->emailUpdate = ($values['emailUpdate']) ? (int)$values['emailUpdate'] : NULL; + $this->passwordOption = ($values['passwordOption']) ? (int)$values['passwordOption'] : NULL; $this->ssoExcludedPaths = $this->linesToArray($values['ssoExcludedPaths']); + $this->ssoExcludedHosts = $this->linesToArray($values['ssoExcludedHosts']); $this->ssoRemoteUserStripDomainName = ($values['ssoRemoteUserStripDomainName']) ? (int)$values['ssoRemoteUserStripDomainName'] : NULL; $this->seamlessLogin = ($values['seamlessLogin']) ? (int)$values['seamlessLogin'] : NULL; $this->cookieExpire = ($values['cookieExpire']) ? (int)$values['cookieExpire'] : NULL; diff --git a/ldap_authentication/ldap_authentication.inc b/ldap_authentication/ldap_authentication.inc index faf254f..d2708de 100644 --- a/ldap_authentication/ldap_authentication.inc +++ b/ldap_authentication/ldap_authentication.inc @@ -34,29 +34,10 @@ function _ldap_authentication_login_form_alter(&$form, &$form_state, $form_id) { * array('user_login_name_validate', 'user_login_authenticate_validate', 'user_login_final_validate') */ - if (@in_array('user_login_authenticate_validate', $form['#validate'])) { - $new_validation_sequence = array(); - foreach ($form['#validate'] as $validate_function_name) { - if ($validate_function_name == 'user_login_authenticate_validate') { - if ($auth_conf->authenticationMode == LDAP_AUTHENTICATION_MIXED) { - // if mixed mode, allow drupal authentication first - $new_validation_sequence[] = 'user_login_authenticate_validate'; - $new_validation_sequence[] = 'ldap_authentication_user_login_authenticate_validate'; - } - elseif ($auth_conf->authenticationMode == LDAP_AUTHENTICATION_EXCLUSIVE) { - // see drupal.org/node/1009990 and drupal.org/node/1022362 change back when fixed. - $new_validation_sequence[] = 'user_login_authenticate_validate'; - $new_validation_sequence[] = 'ldap_authentication_user_login_authenticate_validate'; - } - else { // misconfigured ldap authentication, restore to original validation sequence - $new_validation_sequence[] = 'user_login_authenticate_validate'; - } - } - else { - $new_validation_sequence[] = $validate_function_name; - } - } - $form['#validate'] = $new_validation_sequence; + if (@in_array('user_login_authenticate_validate', $form['#validate']) && $auth_conf->authenticationMode) { + $key = array_search('user_login_authenticate_validate', $form['#validate']); + $form['#validate'][$key] = 'ldap_authentication_core_override_user_login_authenticate_validate'; + array_splice($form['#validate'], $key + 1, 0, 'ldap_authentication_user_login_authenticate_validate'); } if ($form_id == 'user_login_block') { @@ -123,18 +104,17 @@ function _ldap_authentication_form_user_profile_form_alter(&$form, $form_state) /** * user form validation will take care of username, pwd fields - * this function validates ldap autentication specific issues - * ldap authentication exclusively + * this function validates ldap authentication specific * * @param array $form_state array from user logon form - * @return NULL (form_set_error() calls throw validation errors) + * @return null, but success or failure is indicated by: + * -- form_set_error() to invalidate authentication process + * -- setting $form_state['uid'] to indicate successful authentication */ -function _ldap_authentication_user_login_authenticate_validate(&$form_state) { +function _ldap_authentication_user_login_authenticate_validate(&$form_state, $return_user) { $detailed_watchdog_log = variable_get('ldap_help_watchdog_detail', 0); $authname = $form_state['values']['name']; // $authname is the name the user is authenticated with from the logon form // patch 1599632 - $accountname = $authname; // $accountname is used as the drupal account name $account->name property. - $pass = $form_state['values']['pass']; /* * If a fake form state was passed into this function from @@ -145,68 +125,266 @@ function _ldap_authentication_user_login_authenticate_validate(&$form_state) { */ $sso_login = (isset($form_state['sso_login']) && $form_state['sso_login']) ? TRUE : FALSE; - $watchdog_tokens = array('%username' => $authname); // $watchdog_tokens = array('%username' => $name); // patch 1599632 + $watchdog_tokens = array('%username' => $authname, '%authname' => $authname); // $watchdog_tokens = array('%username' => $name); // patch 1599632 if ($detailed_watchdog_log) { watchdog('ldap_authentication', '%username : Beginning authentification....', $watchdog_tokens, WATCHDOG_DEBUG); } - + if (!$auth_conf = ldap_authentication_get_valid_conf()) { watchdog('ldap_authentication', 'Failed to get valid ldap authentication configuration.', array(), WATCHDOG_ERROR); form_set_error('name', 'Server Error: Failed to get valid ldap authentication configuration.' . $error); - return FALSE; + return; } - // if already succeeded at authentication, see if LDAP Exclusive is set + /** + * I. Test for previous module authentication success. + * + * if already succeeded at authentication, $form_state['uid'] will be set by other authentication module. + * - if LDAP Mixed mode is set, return and don't disrupt authentication process + * - otherwise override other authenication by setting $form_state['uid'] = NULL + */ if (isset($form_state['uid']) && is_numeric($form_state['uid'])) { if ($auth_conf->authenticationMode == LDAP_AUTHENTICATION_MIXED || $form_state['uid'] == 1) { if ($detailed_watchdog_log) { watchdog('ldap_authentication', '%username : Previously authenticated in mixed mode or uid=1', $watchdog_tokens, WATCHDOG_DEBUG); } - return; // already passed previous authentication validation + return; // already passed a previous module's authentication validation } elseif ($auth_conf->authenticationMode == LDAP_AUTHENTICATION_EXCLUSIVE) { if ($detailed_watchdog_log) { watchdog('ldap_authentication', '%username : Previously authenticated in exclusive mode or uid is not 1. Clear uid in form_state and attempt ldap authentication.', $watchdog_tokens, WATCHDOG_DEBUG); } - $form_state['uid'] = NULL; // passed previous authentication, but only ldap should be used + $form_state['uid'] = NULL; // passed previous authentication, but only ldap should be used so override } } + /** + * II. Exit if no authentication servers. + */ if (!$auth_conf->hasEnabledAuthenticationServers()) { watchdog('ldap_authentication', 'No LDAP servers configured.', array(), WATCHDOG_ERROR); form_set_error('name', 'Server Error: No LDAP servers configured.'); + return; } - if ($detailed_watchdog_log) { - watchdog('ldap_authentication', '%username : user_load_by_name(%username)', $watchdog_tokens, WATCHDOG_DEBUG); + /** + * III. determine if corresponding drupal account exists for $authname + */ + $drupal_account_is_authmapped = FALSE; + list($drupal_account, $drupal_account_is_authmapped) = ldap_authentication_corresponding_drupal_user($authname, $auth_conf, $watchdog_tokens); + $drupal_account_exists = is_object($drupal_account); + if ($drupal_account_exists && $drupal_account->uid == 1) { + return; // user 1 is not allowed to ldap authenticate } - if (!($account = user_load_by_name($authname))) { - $uid = db_query("SELECT uid FROM {authmap} WHERE authname = :authname AND module = 'ldap_user'", array(':authname' => $authname))->fetchColumn(); - $account = $uid ? user_load($uid) : FALSE; + /** + * IV. test credentials and if available get corresponding ldap user and ldap server + */ + list($authentication_result, $ldap_user, $ldap_server_authenticated_on) = ldap_authentication_test_credentials($auth_conf, $sso_login, $authname, $form_state['values']['pass'], $watchdog_tokens); + if ($authentication_result != LDAP_AUTHENTICATION_RESULT_SUCCESS) { + ldap_authentication_fail_response($authentication_result, $auth_conf, $detailed_watchdog_log, $watchdog_tokens); + return; } - if (is_object($account)) { - if ($account->uid == 1) { - if ($detailed_watchdog_log) { - watchdog('ldap_authentication', '%username : Drupal username maps to user 1, so do not authenticate with ldap', $watchdog_tokens, WATCHDOG_DEBUG); + /** + * V. if account_name_attr is set, drupal username is different than authname + */ + if ($ldap_server_authenticated_on->account_name_attr != '') { + $watchdog_tokens['%account_name_attr'] = $ldap_server_authenticated_on->account_name_attr; + $drupal_accountname = $ldap_user['attr'][ldap_server_massage_text($ldap_server_authenticated_on->account_name_attr, 'attr_name', LDAP_SERVER_MASSAGE_QUERY_ARRAY)][0]; + if (!$drupal_accountname) { + watchdog('ldap_authentication', 'Derived drupal username from attribute %account_name_attr returned no username for authname %authname.', $watchdog_tokens, WATCHDOG_ERROR); + return; + } + } + else { + $drupal_accountname = $authname; + } + $watchdog_tokens['%drupal_accountname'] = $drupal_accountname; + + /** + * VI. Find or create corresponding drupal account and set authmaps + * + * at this point, the following are know: + * - a corresponding ldap account has been found + * - user's credentials tested against it and passed + * - their drupal accountname has been derived + * + */ + + + /** + * VI.A: Drupal account doesn't exist with $authname used to logon, + * but puid exists in another Drupal account; this means username has changed + * and needs to be saved in Drupal account + * + */ + if (!$drupal_account_exists && $ldap_server_authenticated_on) { + $puid = $ldap_server_authenticated_on->userPuidFromLdapEntry($ldap_user['attr']); + if ($puid) { + $drupal_account = $ldap_server_authenticated_on->userUserEntityFromPuid($puid); + if ($drupal_account) { + $drupal_account_exists = TRUE; + $user_edit = array('name' => $drupal_accountname); + $drupal_account = user_save($drupal_account, $user_edit, 'ldap_user'); + user_set_authmaps($drupal_account, array("authname_ldap_user" => $authname)); + $drupal_account_is_authmapped = TRUE; } - return FALSE; // user 1 must use drupal authentication } - else { - $account_exists = TRUE; - $user_data = $account->data; - $authmaps = user_get_authmaps($authname); // $authmaps = user_get_authmaps($name); // patch 1599632 - $ldap_authentication_authmap = isset($authmaps['ldap_user']); - $no_authmaps = (boolean)(count($authmaps)); + } + + /** + * VI.B: existing Drupal account but not authmapped to ldap modules, + * ldap authmap or disallow + * + */ + + if ($drupal_account_exists && !$drupal_account_is_authmapped) { // account already exists + if ($auth_conf->ldapUser->loginConflictResolve == LDAP_USER_CONFLICT_LOG) { + if ($account_with_same_email = user_load_by_mail($ldap_user['mail'])) { + $watchdog_tokens['%conflict_name'] = $account_with_same_email->name; + watchdog('ldap_authentication', 'LDAP user with DN %dn has a naming conflict with a local drupal user %conflict_name', $watchdog_tokens, WATCHDOG_ERROR); + } + drupal_set_message(t('Another user already exists in the system with the same login name. You should contact the system administrator in order to solve this conflict.'), 'error'); + return; + } + else { // LDAP_authen.AC.disallow.ldap.drupal + // add ldap_authentication authmap to user. account name is fine here, though cn could be used + user_set_authmaps($drupal_account, array('authname_ldap_user' => $authname)); + $drupal_account_is_authmapped = TRUE; if ($detailed_watchdog_log) { - watchdog('ldap_authentication', '%username : Drupal User Account found. Continuing on to attempt ldap authentication', $watchdog_tokens, WATCHDOG_DEBUG); + watchdog('ldap_authentication', 'set authmap for %username authname_ldap_user', $watchdog_tokens, WATCHDOG_DEBUG); + } + } + } + + /** + * VI.C: existing Drupal account with incorrect email. fix email if appropriate + * + */ + if ($drupal_account_exists && $drupal_account->mail != $ldap_user['mail'] && ( + $auth_conf->emailUpdate == LDAP_AUTHENTICATION_EMAIL_UPDATE_ON_LDAP_CHANGE_ENABLE_NOTIFY || + $auth_conf->emailUpdate == LDAP_AUTHENTICATION_EMAIL_UPDATE_ON_LDAP_CHANGE_ENABLE + )) { + $user_edit = array('mail' => $ldap_user['mail']); + + $watchdog_tokens['%username'] = $drupal_account->name; + if (!$updated_account = user_save($drupal_account, $user_edit)) { + watchdog('ldap_authentication', 'Failed to make changes to user %username updated %changed.', $watchdog_tokens, WATCHDOG_ERROR); + } + elseif ($auth_conf->emailUpdate == LDAP_AUTHENTICATION_EMAIL_UPDATE_ON_LDAP_CHANGE_ENABLE_NOTIFY ) { + if (isset($user_edit['mail'])) { + $watchdog_tokens['%mail'] = $user_edit['mail']; + drupal_set_message(t('Your e-mail has been updated to match your current account (%mail).', $watchdog_tokens), 'status'); + } + if (isset($user_edit['name'])) { + $watchdog_tokens['%new_username'] = $user_edit['name']; + drupal_set_message(t('Your old account username %username has been updated to %new_username.', $watchdog_tokens), 'status'); } } } + + /** + * VI.C: no existing Drupal account. consider provisioning Drupal account. + * + */ + if (!$drupal_account_exists) { + + // VI.C.1 Do not provision Drupal account if another account has same email. + if ($account_with_same_email = user_load_by_mail($ldap_user['mail'])) { + /** + * username does not exist but email does. Since user_external_login_register does not deal with + * mail attribute and the email conflict error needs to be caught beforehand, need to throw error here + */ + $watchdog_tokens['%duplicate_name'] = $account_with_same_email->name; + watchdog('ldap_authentication', 'LDAP user with DN %dn has email address + (%mail) conflict with a drupal user %duplicate_name', $watchdog_tokens, WATCHDOG_ERROR); + drupal_set_message(t('Another user already exists in the system with the same email address. You should contact the system administrator in order to solve this conflict.'), 'error'); + return; + } + + // VI.C.2 Do not provision Drupal account if provisioning disabled + if (!$auth_conf->ldapUser->provisionEnabled(LDAP_USER_PROV_DIRECTION_TO_DRUPAL_USER, LDAP_USER_DRUPAL_USER_PROV_ON_AUTHENTICATE)) { + watchdog('ldap_user', 'Drupal account for authname=%authname account name=%account_name_attr does not exist and provisioning of Drupal accounts on authentication is not enabled', $watchdog_tokens, WATCHDOG_INFO); + return; + } + + // VI.C.3 Provision Drupal account + /** + * + * new ldap_authentication provisioned account could let user_external_login_register create the account and set authmaps, but would need + * to add mail and any other user->data data in hook_user_presave which would mean requerying ldap + * or having a global variable. At this point the account does not exist, so there is no + * reason not to create it here. + * + * @todo create patch for core user module's user_external_login_register to deal with new external accounts + * a little tweak to add user->data and mail etc as parameters would make it more useful + * for external authentication modules + */ + + if ($auth_conf->ldapUser->acctCreation == LDAP_AUTHENTICATION_ACCT_CREATION_USER_SETTINGS_FOR_LDAP && + variable_get('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL) == USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL) { + $user_edit = array('name' => $drupal_accountname, 'status' => 0); // if admin approval required, set status to 0. + } + else { + $user_edit = array('name' => $drupal_accountname, 'status' => 1); + } + + // don't pass in ldap user to provisionDrupalAccount, because want to requery with correct attributes needed + // this may be a case where efficiency dictates querying for all attributes + $drupal_account = $auth_conf->ldapUser->provisionDrupalAccount(NULL, $user_edit, NULL, TRUE); + + if ($drupal_account === FALSE) { + watchdog('ldap_user', 'Failed to find or create %drupal_accountname on logon.', $watchdog_tokens, WATCHDOG_ERROR); + form_set_error('name', t('Server Error: Failed to create Drupal user account for %drupal_accountname', $watchdog_tokens)); + return; + } + } + + /** + * we now have valid, ldap authenticated username with an account authmapped to ldap_authentication. + * since user_external_login_register can't deal with user mail attribute and doesn't do much else, it is not + * being used here. + * + * without doing the user_login_submit, + * [#1009990],[#1865938] + */ + + $form_state['uid'] = $drupal_account->uid; + // $fake_form_state = array('uid' => $drupal_account->uid); + // user_login_submit(array(), $fake_form_state); + // global $user; + // $form_state['uid'] = $user->uid; + + + // the uid is returned so that special login modules, namely ldap sso, can manually call this function. + return ($return_user) ? $drupal_account : null; +} + +/** + * given authname, determine if corresponding drupal account exists and is authmapped + */ +function ldap_authentication_corresponding_drupal_user($authname, $auth_conf, &$watchdog_tokens) { + $detailed_watchdog_log = variable_get('ldap_help_watchdog_detail', 0); + if (!($drupal_account = user_load_by_name($authname))) { + $uid = db_query("SELECT uid FROM {authmap} WHERE authname = :authname AND module = 'ldap_user'", array(':authname' => $authname))->fetchColumn(); + $drupal_account = $uid ? user_load($uid) : FALSE; + } + + if (is_object($drupal_account)) { + $authmaps = user_get_authmaps($authname); // $authmaps = user_get_authmaps($name); // patch 1599632 + $drupal_account_is_authmapped = isset($authmaps['ldap_user']); + $user_data = $drupal_account->data; + if ($drupal_account->uid == 1 && $detailed_watchdog_log) { + watchdog('ldap_authentication', '%username : Drupal username maps to user 1, so do not authenticate with ldap', $watchdog_tokens, WATCHDOG_DEBUG); + } + elseif ($detailed_watchdog_log) { + watchdog('ldap_authentication', '%username : Drupal User Account found. Continuing on to attempt ldap authentication', $watchdog_tokens, WATCHDOG_DEBUG); + } + } else { // account does not exist - $account_exists = FALSE; + $drupal_account_is_authmapped = FALSE; if ($auth_conf->ldapUser->createLDAPAccounts == FALSE) { if ($detailed_watchdog_log) { watchdog('ldap_authentication', '%username : Drupal User Account not found and configuration is set to not create new accounts.', $watchdog_tokens, WATCHDOG_DEBUG); @@ -216,7 +394,14 @@ function _ldap_authentication_user_login_authenticate_validate(&$form_state) { watchdog('ldap_authentication', '%username : Existing Drupal User Account not found. Continuing on to attempt ldap authentication', $watchdog_tokens, WATCHDOG_DEBUG); } } + return array($drupal_account, $drupal_account_is_authmapped); +} +function ldap_authentication_test_credentials($auth_conf, $sso_login, $authname, $password, &$watchdog_tokens) { + $detailed_watchdog_log = variable_get('ldap_help_watchdog_detail', 0); + $authentication_result = LDAP_AUTHENTICATION_RESULT_FAIL_GENERIC; + $ldap_user = FALSE; + $ldap_server = NULL; foreach ($auth_conf->enabledAuthenticationServers as $sid => $ldap_server) { $watchdog_tokens['%sid'] = $sid; $watchdog_tokens['%bind_method'] = $ldap_server->bind_method; @@ -261,12 +446,11 @@ function _ldap_authentication_user_login_authenticate_validate(&$form_state) { */ $bind_success = FALSE; - if ($ldap_server->bind_method == LDAP_SERVERS_BIND_METHOD_SERVICE_ACCT || - $ldap_server->bind_method == LDAP_SERVERS_BIND_METHOD_ANON_USER - ) { - $bind_success = ($ldap_server->bind() == LDAP_SUCCESS); + if ($ldap_server->bind_method == LDAP_SERVERS_BIND_METHOD_SERVICE_ACCT) { + $bind_success = ($ldap_server->bind(NULL, NULL, FALSE) == LDAP_SUCCESS); } - elseif ($ldap_server->bind_method == LDAP_SERVERS_BIND_METHOD_ANON) { + elseif ($ldap_server->bind_method == LDAP_SERVERS_BIND_METHOD_ANON || + $ldap_server->bind_method == LDAP_SERVERS_BIND_METHOD_ANON_USER) { $bind_success = ($ldap_server->bind(NULL, NULL, TRUE) == LDAP_SUCCESS); } elseif ($sso_login) { @@ -279,7 +463,7 @@ function _ldap_authentication_user_login_authenticate_validate(&$form_state) { $transformname = $ldap_server->userUsernameToLdapNameTransform($authname, $watchdog_tokens); $replace = array($basedn, $transformname); $userdn = str_replace($search, $replace, $ldap_server->user_dn_expression); - $bind_success = ($ldap_server->bind($userdn, $pass) == LDAP_SUCCESS); + $bind_success = ($ldap_server->bind($userdn, $password, FALSE) == LDAP_SUCCESS); if ($bind_success) { break; } @@ -337,9 +521,7 @@ function _ldap_authentication_user_login_authenticate_validate(&$form_state) { * #4 CHECK ALLOWED AND EXCLUDED LIST AND PHP FOR ALLOWED USERS */ - $allow = $auth_conf->allowUser($authname, $ldap_user, $account_exists); - - if (!$allow) { + if (!$auth_conf->allowUser($authname, $ldap_user)) { $authentication_result = LDAP_AUTHENTICATION_RESULT_FAIL_DISALLOWED; break; // regardless of how many servers, disallowed user fails } @@ -362,7 +544,7 @@ function _ldap_authentication_user_login_authenticate_validate(&$form_state) { $credentials_pass = (boolean)($ldap_user); } else { - $credentials_pass = ($ldap_server->bind($ldap_user['dn'], $pass) == LDAP_SUCCESS); + $credentials_pass = ($ldap_server->bind($ldap_user['dn'], $password, FALSE) == LDAP_SUCCESS); } if (!$credentials_pass) { if ($detailed_watchdog_log) { @@ -379,11 +561,6 @@ function _ldap_authentication_user_login_authenticate_validate(&$form_state) { $ldap_user = $ldap_server->userUserNameToExistingLdapEntry($authname); // after successful bind, lookup user again to get private attributes $watchdog_tokens['%mail'] = $ldap_user['mail']; } - if ($ldap_server->account_name_attr != '') { - $accountname = $ldap_user['attr'][ldap_server_massage_text($ldap_server->account_name_attr, 'attr_name', LDAP_SERVER_MASSAGE_QUERY_ARRAY)][0]; - } - $watchdog_tokens['%account_name_attr'] = $accountname; - if ($ldap_server->bind_method == LDAP_SERVERS_BIND_METHOD_SERVICE_ACCT || $ldap_server->bind_method == LDAP_SERVERS_BIND_METHOD_ANON_USER) { $ldap_server->disconnect(); @@ -399,21 +576,24 @@ function _ldap_authentication_user_login_authenticate_validate(&$form_state) { if ($detailed_watchdog_log) { watchdog('ldap_authentication', '%username : Authentication result id=%result auth_result=%auth_result (%err_text)', $watchdog_tokens, WATCHDOG_DEBUG); } + + return array($authentication_result, $ldap_user, $ldap_server); +} - if ($authentication_result != LDAP_AUTHENTICATION_RESULT_SUCCESS) { - $watchdog_tokens['%err_text'] = _ldap_authentication_err_text($authentication_result); - // fail scenario 1. ldap auth exclusive and failed throw error - if ($auth_conf->authenticationMode == LDAP_AUTHENTICATION_EXCLUSIVE) { - if ($detailed_watchdog_log) { - watchdog('ldap_authentication', '%username : setting error because failed at ldap and - LDAP_AUTHENTICATION_EXCLUSIVE is set to true. So need to stop authentication of Drupal user that is not user 1. - error message: %err_text', $watchdog_tokens, WATCHDOG_DEBUG); - } - form_set_error('name', $watchdog_tokens['%err_text']); +function ldap_authentication_fail_response($authentication_result, $auth_conf, $detailed_watchdog_log, &$watchdog_tokens) { + $watchdog_tokens['%err_text'] = _ldap_authentication_err_text($authentication_result); + // fail scenario 1. ldap auth exclusive and failed throw error so no other authentication methods are allowed + if ($auth_conf->authenticationMode == LDAP_AUTHENTICATION_EXCLUSIVE) { + if ($detailed_watchdog_log) { + watchdog('ldap_authentication', '%username : setting error because failed at ldap and + LDAP_AUTHENTICATION_EXCLUSIVE is set to true. So need to stop authentication of Drupal user that is not user 1. + error message: %err_text', $watchdog_tokens, WATCHDOG_DEBUG); } - else { - // fail scenario 2. simply fails ldap. return false. - // don't show user message, may be using other authentication after this that may succeed. + form_set_error('name', $watchdog_tokens['%err_text']); + } + else { + // fail scenario 2. simply fails ldap. return false, but don't throw form error + // don't show user message, may be using other authentication after this that may succeed. if ($detailed_watchdog_log) { watchdog('ldap_authentication', '%username : Failed ldap authentication. @@ -422,159 +602,10 @@ function _ldap_authentication_user_login_authenticate_validate(&$form_state) { $watchdog_tokens, WATCHDOG_DEBUG ); - } - } - return FALSE; - } - - /** - * case 0: account doesn't exist with $name used to logon, - * but puid exists in another user; that is username has changed - * - */ - - $user_edit = array(); // array of attributes that are changing for existing users - if (!$account_exists && isset($auth_conf->enabledAuthenticationServers[$ldap_user['sid']])) { - $ldap_server = $auth_conf->enabledAuthenticationServers[$ldap_user['sid']]; - $puid = $ldap_server->userPuidFromLdapEntry($ldap_user['attr']); - if ($puid) { - $account = $ldap_server->userUserEntityFromPuid($puid); - if ($account) { - $account_exists = TRUE; - $user_edit['name'] = $accountname; - $account = user_save($account, $user_edit, 'ldap_user'); - user_set_authmaps($account, array("authname_ldap_user" => $authname)); - } - } - } - - /** - * case 1: previously drupal authenticated user authenticated successfully on ldap - * - */ - if (!$account_exists && ($account = user_load_by_name($accountname))) { - user_set_authmaps($account, array('authname_ldap_user' => $authname)); - $account_exists = TRUE; - } - if (!$account_exists) { - - if ($account_with_same_email = user_load_by_mail($ldap_user['mail'])) { - // dpm('account with same email'); - /** - * username does not exist but email does. Since user_external_login_register does not deal with - * mail attribute and the email conflict error needs to be caught beforehand, need to throw error here - */ - $watchdog_tokens['%duplicate_name'] = $account_with_same_email->name; - watchdog('ldap_authentication', 'LDAP user with DN %dn has email address - (%mail) conflict with a drupal user %duplicate_name', $watchdog_tokens, WATCHDOG_ERROR); - drupal_set_message(t('Another user already exists in the system with the same email address. You should contact the system administrator in order to solve this conflict.'), 'error'); - return FALSE; - } - - if (!$auth_conf->ldapUser->provisionEnabled(LDAP_USER_PROV_DIRECTION_TO_DRUPAL_USER, LDAP_USER_DRUPAL_USER_PROV_ON_AUTHENTICATE)) { - watchdog('ldap_user', 'Drupal account for authname=%authname account name=%account_name_attr does not exist and provisioning of Drupal accounts on authentication is not enabled', $watchdog_tokens); - return FALSE; - } - /** - * - * new ldap_authentication provisioned account could let user_external_login_register create the account and set authmaps, but would need - * to add mail and any other user->data data in hook_user_presave which would mean requerying ldap - * or having a global variable. At this point the account does not exist, so there is no - * reason not to create it here. - * - * @todo create patch for user_external_login_register to deal with new external accounts - * a little tweak to add user->data and mail etc as parameters would make it more useful - * for external authentication modules - */ - ldap_servers_module_load_include('inc', 'ldap_servers', 'ldap_servers.functions'); - - // $ldap_user['sid'] = $sid; - $account = NULL; - $user_edit = array('name' => $accountname, 'status' => 1); - $user_register = variable_get('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL); - if ($auth_conf->ldapUser->acctCreation == LDAP_AUTHENTICATION_ACCT_CREATION_USER_SETTINGS_FOR_LDAP && $user_register == USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL) { - $user_edit['status'] = 0; // if admin approval required, set status to 1. - } - - // don't pass in ldap user, because want to requery with correct attributes needed - // this may be a case where efficiency dictates querying for all attributes - $account = $auth_conf->ldapUser->provisionDrupalAccount($account, $user_edit, NULL, TRUE); - if ($account === FALSE) { - // need to throw error that account was not created so logging in is not happenning via ldap - } - } - else { // account already exists - if ($ldap_authentication_authmap == FALSE) { - if ($auth_conf->ldapUser->loginConflictResolve == LDAP_USER_CONFLICT_LOG) { - if ($account_with_same_email = user_load_by_mail($ldap_user['mail'])) { - $watchdog_tokens['%conflict_name'] = $account_with_same_email->name; - watchdog('ldap_authentication', 'LDAP user with DN %dn has a naming conflict with a local drupal user %conflict_name', $watchdog_tokens, WATCHDOG_ERROR); - } - drupal_set_message(t('Another user already exists in the system with the same login name. You should contact the system administrator in order to solve this conflict.'), 'error'); - return FALSE; - } - else { // LDAP_authen.AC.disallow.ldap.drupal - // add ldap_authentication authmap to user. account name is fine here, though cn could be used - user_set_authmaps($account, array('authname_ldap_user' => $authname)); - if ($detailed_watchdog_log) { - watchdog('ldap_authentication', 'set authmap for %username authname_ldap_user', $watchdog_tokens, WATCHDOG_DEBUG); - } - } - } - - - /** - * @todo. mail, name, and all other attributes should be synched in this case. need to - * generalise this instead of dealing with mail and name individually. - * - * $account = ldap_user_synch_drupal_account($ldap_user); - */ - - if ($account->mail != $ldap_user['mail'] && ( - $auth_conf->emailUpdate == LDAP_AUTHENTICATION_EMAIL_UPDATE_ON_LDAP_CHANGE_ENABLE_NOTIFY || - $auth_conf->emailUpdate == LDAP_AUTHENTICATION_EMAIL_UPDATE_ON_LDAP_CHANGE_ENABLE - )) { - $user_edit['mail'] = $ldap_user['mail']; - } - - if (count($user_edit)) { - $watchdog_tokens['%username'] = $account->name; - if (!$updated_account = user_save($account, $user_edit)) { - watchdog('ldap_authentication', 'Failed to make changes to user %username updated %changed.', $watchdog_tokens, WATCHDOG_ERROR); - } - elseif ($auth_conf->emailUpdate == LDAP_AUTHENTICATION_EMAIL_UPDATE_ON_LDAP_CHANGE_ENABLE_NOTIFY ) { - if (isset($user_edit['mail'])) { - $watchdog_tokens['%mail'] = $user_edit['mail']; - drupal_set_message(t('Your e-mail has been updated to match your current account (%mail).', $watchdog_tokens), 'status'); - } - if (isset($user_edit['name'])) { - $watchdog_tokens['%new_username'] = $user_edit['name']; - drupal_set_message(t('Your old account username %username has been updated to %new_username.', $watchdog_tokens), 'status'); - } - } } } - - /** - * we now have valid, ldap authenticated username with an account authmapped to ldap_authentication. - * since user_external_login_register can't deal with user mail attribute and doesn't do much else, it is not - * being used here. - */ - - /** - * without doing the user_login_submit, - * [#1009990] - * - */ - $fake_form_state = array('uid' => $account->uid); - user_login_submit(array(), $fake_form_state); - global $user; - $form_state['uid'] = $user->uid; - return $user; - } - - + /** * get human readable authentication error string * diff --git a/ldap_authentication/ldap_authentication.module b/ldap_authentication/ldap_authentication.module index f262f26..0678c26 100644 --- a/ldap_authentication/ldap_authentication.module +++ b/ldap_authentication/ldap_authentication.module @@ -29,6 +29,11 @@ define('LDAP_AUTHENTICATION_EMAIL_FIELD_DISABLE', 3); define('LDAP_AUTHENTICATION_EMAIL_FIELD_ALLOW', 4); define('LDAP_AUTHENTICATION_EMAIL_FIELD_DEFAULT', 3); +define('LDAP_AUTHENTICATION_PASSWORD_FIELD_SHOW', 2); +define('LDAP_AUTHENTICATION_PASSWORD_FIELD_HIDE', 3); +define('LDAP_AUTHENTICATION_PASSWORD_FIELD_ALLOW', 4); +define('LDAP_AUTHENTICATION_PASSWORD_FIELD_DEFAULT', 2); + define('LDAP_AUTHENTICATION_RESULT_FAIL_CONNECT', 1); define('LDAP_AUTHENTICATION_RESULT_FAIL_BIND', 2); define('LDAP_AUTHENTICATION_RESULT_FAIL_FIND', 3); @@ -246,12 +251,25 @@ function ldap_authentication_show_reset_pwd($user = NULL) { } if ($user->uid == 0) { - // hide reset password for anonymous users if ldap only authentication, otherwise show - return ($auth_conf->authenticationMode != LDAP_AUTHENTICATION_EXCLUSIVE); + // hide reset password for anonymous users if ldap only authentication and password updates are disabled, otherwise show + if ($auth_conf->authenticationMode != LDAP_AUTHENTICATION_EXCLUSIVE) { + if ($auth_conf->passwordOption == LDAP_AUTHENTICATION_PASSWORD_FIELD_ALLOW) { + return TRUE; + } + return FALSE; + } + return TRUE; } else { - // authenticated user. hide if ldap authenticated otherwise show. - return (!ldap_authentication_ldap_authenticated($user)); + // authenticated user. hide if ldap authenticated and updating password is + // not allowed, otherwise show. + if (ldap_authentication_ldap_authenticated($user)) { + if ($auth_conf->passwordOption == LDAP_AUTHENTICATION_PASSWORD_FIELD_ALLOW) { + return TRUE; + } + return FALSE; + } + return TRUE; } } @@ -275,6 +293,21 @@ function ldap_authentication_form_user_pass_alter(&$form, $form_state) { } +/** + * A validate handler on the login form. Check supplied username/password + * against local users table. If successful, $form_state['uid'] + * is set to the matching user ID. + */ +function ldap_authentication_core_override_user_login_authenticate_validate($form, &$form_state) { + // No additional validation of user credentials is needed when + // $form_state['uid'] is set. + if (!empty($form_state['uid'])) { + return; + } + user_login_authenticate_validate($form, $form_state); +} + + function ldap_authentication_user_pass_validate(&$form_state) { $name_or_mail = trim($form_state['name']['#value']); if ($account = user_load_by_mail($name_or_mail)) { @@ -289,7 +322,15 @@ function ldap_authentication_user_pass_validate(&$form_state) { 'account' => $account, 'auth_conf' => ldap_authentication_get_valid_conf(), ); - form_set_error('name', theme('ldap_authentication_user_pass_validate_ldap_authenticated', $vars)); + $error = TRUE; + if (is_object($vars['auth_conf'])) { + if ($vars['auth_conf']->passwordOption == LDAP_AUTHENTICATION_PASSWORD_FIELD_ALLOW) { + $error = FALSE; + } + } + if (!empty($error)) { + form_set_error('name', theme('ldap_authentication_user_pass_validate_ldap_authenticated', $vars)); + } } } @@ -325,9 +366,9 @@ function ldap_authentication_form_user_login_block_alter(&$form, &$form_state) { /** * validate function for user logon forms. */ -function ldap_authentication_user_login_authenticate_validate($form, &$form_state) { +function ldap_authentication_user_login_authenticate_validate($form, &$form_state, $return_user = FALSE) { ldap_servers_module_load_include('inc', 'ldap_authentication', 'ldap_authentication'); - return _ldap_authentication_user_login_authenticate_validate($form_state); + return _ldap_authentication_user_login_authenticate_validate($form_state, $return_user); } diff --git a/ldap_authentication/ldap_authentication.theme.inc b/ldap_authentication/ldap_authentication.theme.inc index 500133e..15bd646 100644 --- a/ldap_authentication/ldap_authentication.theme.inc +++ b/ldap_authentication/ldap_authentication.theme.inc @@ -44,7 +44,7 @@ function theme_ldap_authentication_user_login_block_links($variables) { */ function theme_ldap_authentication_user_pass_message($variables) { extract($variables); - if ($auth_conf->authenticationMode == LDAP_AUTHENTICATION_EXCLUSIVE) { + if ($auth_conf->authenticationMode == LDAP_AUTHENTICATION_EXCLUSIVE && $auth_conf->passwordOption != LDAP_AUTHENTICATION_PASSWORD_FIELD_ALLOW) { $msg = t('This page is only useful for the site administrator. All other users need to reset their passwords'); if ($auth_conf->ldapUserHelpLinkUrl) { diff --git a/ldap_authentication/tests/ldap_authentication.test b/ldap_authentication/tests/ldap_authentication.test index 30565e9..a606c50 100644 --- a/ldap_authentication/tests/ldap_authentication.test +++ b/ldap_authentication/tests/ldap_authentication.test @@ -6,7 +6,7 @@ * */ module_load_include('php', 'ldap_test', 'LdapTestCase.class'); -module_load_include('module', 'ldap_authentication', 'ldap_authentication'); +module_load_include('module', 'ldap_authentication'); class LdapAuthenticationTestCase extends LdapTestCase { public static function getInfo() { @@ -28,7 +28,8 @@ class LdapAuthenticationTestCase extends LdapTestCase { parent::setUp(array( 'ldap_authentication', 'ldap_authorization', - 'ldap_authorization_drupal_role' + 'ldap_authorization_drupal_role', + 'ldap_test', )); // don't need any real servers, configured, just ldap_servers code base variable_set('ldap_simpletest', 2); } @@ -63,7 +64,7 @@ class LdapAuthenticationTestCase extends LdapTestCase { $testid = 'MixedModeUserLogon3'; $sids = array($sid); $this->prepTestData( - 'hogwarts', + LDAP_TEST_LDAP_NAME, $sids, 'provisionToDrupal', 'MixedModeUserLogon3', @@ -181,7 +182,7 @@ class LdapAuthenticationTestCase extends LdapTestCase { $testid = 'ExclusiveModeUserLogon3'; $sids = array($sid); $this->prepTestData( - 'hogwarts', + LDAP_TEST_LDAP_NAME, $sids, 'ad_authentication', 'ExclusiveModeUserLogon3', @@ -330,7 +331,7 @@ class LdapAuthenticationTestCase extends LdapTestCase { $testid = 'SSOUserLogon3'; $sids = array($sid); $this->prepTestData( - 'hogwarts', + LDAP_TEST_LDAP_NAME, $sids, 'ad_authentication', 'SSOUserLogon' @@ -655,13 +656,13 @@ class LdapAuthenticationTestCase extends LdapTestCase { module_exists('ldap_user') && module_exists('ldap_servers') && module_exists('ldap_authentication') && - (variable_get('ldap_simpletest', 0) > 0) + (variable_get('ldap_simpletest', 2) > 0) ); $this->assertTrue($setup_success, ' ldap_authentication UI setup successful', $this->testId('user interface tests')); $sid = 'activedirectory1'; $sids = array('activedirectory1'); - $this->prepTestData('hogwarts', $sids, 'provisionToDrupal', 'default'); + $this->prepTestData(LDAP_TEST_LDAP_NAME, $sids, 'provisionToDrupal', 'default'); $this->privileged_user = $this->drupalCreateUser(array( 'administer site configuration', diff --git a/ldap_authorization/LdapAuthorizationConsumerAbstract.class.php b/ldap_authorization/LdapAuthorizationConsumerAbstract.class.php index 79d0172..42079dc 100644 --- a/ldap_authorization/LdapAuthorizationConsumerAbstract.class.php +++ b/ldap_authorization/LdapAuthorizationConsumerAbstract.class.php @@ -169,6 +169,10 @@ class LdapAuthorizationConsumerAbstract { // method must be overridden } + public function authorizationDiff($initial, $current) { + return array_diff($initial, $current); + } + /** * grant authorizations to a user @@ -190,6 +194,7 @@ class LdapAuthorizationConsumerAbstract { */ public function authorizationGrant(&$user, &$user_auth_data, $consumers, $ldap_entry = NULL, $user_save = TRUE) { + $this->filterOffPastAuthorizationRecords($user, $user_auth_data); $this->grantsAndRevokes('grant', $user, $user_auth_data, $consumers, $ldap_entry, $user_save); } @@ -213,9 +218,31 @@ class LdapAuthorizationConsumerAbstract { */ public function authorizationRevoke(&$user, &$user_auth_data, $consumers, $ldap_entry, $user_save = TRUE) { + $this->filterOffPastAuthorizationRecords($user, $user_auth_data); $this->grantsAndRevokes('revoke', $user, $user_auth_data, $consumers, $ldap_entry, $user_save); } + + + /** + * this is a function to clear off + */ + public function filterOffPastAuthorizationRecords(&$user, &$user_auth_data, $time = NULL) { + if ($time != NULL || variable_get('ldap_help_user_data_clear', 0)) { + $clear_time = ($time) ? $time : variable_get('ldap_help_user_data_clear_set_date', 0); + if ($clear_time > 0 && $clear_time < time()) { + foreach ($user_auth_data as $consumer_id => $entry) { + if ($entry['date_granted'] < $clear_time) { + unset($user_auth_data[$consumer_id]); + if (isset($user->data['ldap_authorizations'][$this->consumerType][$consumer_id])) { + unset($user->data['ldap_authorizations'][$this->consumerType][$consumer_id]); + } + } + } + } + } + } + /** * some authorization schemes such as organic groups, require a certain order. implement this method * to sort consumer ids/authorization ids @@ -255,7 +282,6 @@ class LdapAuthorizationConsumerAbstract { $detailed_watchdog_log = variable_get('ldap_help_watchdog_detail', 0); $this->sortConsumerIds($op, $consumers); - $results = array(); $watchdog_tokens = array(); $watchdog_tokens['%username'] = $user->name; @@ -283,13 +309,14 @@ class LdapAuthorizationConsumerAbstract { $results[$consumer_id] = TRUE; $user_auth_data[$consumer_id] = array( 'date_granted' => time(), - 'consumer_id' => $consumer_id, + 'consumer_id_mixed_case' => $consumer_id, ); } elseif (!$user_has_authorization && $consumer['exists']) { // grant case 2: consumer exists, but user is not member. grant authorization - $results[$consumer_id] = $this->grantSingleAuthorization($user, $consumer_id, $consumer, $user_auth_data); // allow consuming module to add additional data to $user_auth_data - $user_auth_data[$consumer_id] = array( + $results[$consumer_id] = $this->grantSingleAuthorization($user, $consumer_id, $consumer, $user_auth_data, $user_save); // allow consuming module to add additional data to $user_auth_data + $existing = empty($user_auth_data[$consumer_id]) ? array() : $user_auth_data[$consumer_id]; + $user_auth_data[$consumer_id] = $existing + array( 'date_granted' => time(), 'consumer_id_mixed_case' => $consumer_id, ); @@ -315,7 +342,7 @@ class LdapAuthorizationConsumerAbstract { if ($user_has_authorization) { // revoke case 1: user has authorization, revoke it. revokeSingleAuthorization will remove $user_auth_data[$consumer_id] //debug("op=revoke, consumer_id=$consumer_id, calling revokeSingleAuthorization"); - $results[$consumer_id] = $this->revokeSingleAuthorization($user, $consumer_id, $consumer, $user_auth_data); // defer to default for $user_save param + $results[$consumer_id] = $this->revokeSingleAuthorization($user, $consumer_id, $consumer, $user_auth_data, $user_save); // defer to default for $user_save param $log .= t(',result=') . (boolean)($results[$consumer_id]); } elseif ($user_has_authorization_recorded) { @@ -337,6 +364,7 @@ class LdapAuthorizationConsumerAbstract { $watchdog_tokens['%consumer_ids_log'] = (count($consumer_ids_log)) ? join('" . print_r($data, TRUE) . "", + ); + } + } + + $form['intro'] = array( '#type' => 'item', '#markup' => t('
$user->data[ldap_authorization][data for test users.', $consumer_tokens), + ); + $form['submit'] = array( '#type' => 'submit', '#value' => 'test', @@ -209,14 +241,21 @@ function ldap_authorization_test_form_submit($form, &$form_state) { dpm("user: $username"); dpm($user); } } - list($results[$username], $notifications[$username]) = ldap_authorizations_user_authorizations($user, 'test_query', $consumer_type, 'logon'); + + if ($form_state['values']['user_data_clear'] == 1) { + $user_data = $user->data; + unset($user_data['ldap_authorizations'][$consumer_type]); + $user = user_save($user, array('data' => $user_data)); + } + + $action = ($form_state['values']['execute_authorizations'] == 1) ? "test_query_set" : 'test_query'; + list($results[$username], $notifications[$username]) = ldap_authorizations_user_authorizations($user, $action, $consumer_type, 'logon'); // remove authorizations from other consumer types $results[$username] = array($consumer_type => $results[$username][$consumer_type]); $i++; if ($i == 10) { break; } - } } diff --git a/ldap_authorization/ldap_authorization.inc b/ldap_authorization/ldap_authorization.inc index 6fb1f14..6c3ed58 100644 --- a/ldap_authorization/ldap_authorization.inc +++ b/ldap_authorization/ldap_authorization.inc @@ -37,6 +37,7 @@ function ldap_authorization_help_watchdog() { // remove after testing * @param string $op = * set -- grant authorizations (store in db) and return authorizations * test_query -- don't grant authorization, just query and return authorizations. assume user is ldap authenticated and exists + * test_query_set -- do grant authorizations, but also log data for debugging * query -- don't grant authorization, just query and return authorizations * * @param string $consumer_type e.g. drupal_roles @@ -83,17 +84,15 @@ function _ldap_authorizations_user_authorizations(&$user, $op, $consumer_type, $ /** * determine if user is ldap authenticated */ - if ($context == 'test_if_authorizations_granted' || ($op == 'test_query' && @$user->ldap_test == TRUE)) { + if ($context == 'test_if_authorizations_granted' || (($op == 'test_query_set' || $op == 'test_query') && @$user->ldap_test == TRUE)) { $ldap_authenticated = $user->ldap_authenticated; // property 'ldap_authenticated' only exists for fake user objects submitted from testing form } else { $ldap_authenticated = (boolean)(module_exists('ldap_authentication') && ldap_authentication_ldap_authenticated($user)); } - // debug("_ldap_authorizations_user_authorizations" . $user->name .",ldap_authenticated=$ldap_authenticated"); $watchdog_tokens['%ldap_authenticated'] = ($ldap_authenticated) ? 'yes' : 'no'; foreach ($consumers as $consumer_type => $consumer) { - // dpm($consumer); $authorizations[$consumer_type] = array(); /** * each consumer type has only one consumer conf and each consumer conf has only one ldap server id (sid) @@ -104,9 +103,7 @@ function _ldap_authorizations_user_authorizations(&$user, $op, $consumer_type, $ * */ - $consumer = ldap_authorization_get_consumer_object($consumer_type); - // debug("$consumer_type consumer->consumerConf->status"); debug($consumer->consumerConf->status); //$debug = TRUE; if (!$consumer->consumerConf->status) { continue; } @@ -128,9 +125,9 @@ function _ldap_authorizations_user_authorizations(&$user, $op, $consumer_type, $ } if ($debug) { debug(t('%username : testing with consumer type %consumer_type. ldap authenticated=%ldap_authenticated'), $watchdog_tokens); + debug("op=$op,ldap_authenticated=$ldap_authenticated $consumer_type context=$context, consumer->consumerConf->synchOnLogon=". (int)$consumer->consumerConf->synchOnLogon); //$debug = TRUE; } - // dpm("context=$context,ldap_authenticated=$ldap_authenticated"); - // debug("op=$op,ldap_authenticated=$ldap_authenticated $consumer_type context=$context, consumer->consumerConf->synchOnLogon=". (int)$consumer->consumerConf->synchOnLogon); //$debug = TRUE; + if ($context == 'logon' && !$consumer->consumerConf->synchOnLogon) { $notifications[$consumer_type][] = LDAP_AUTHORIZATION_MAP_NOT_CONF_FOR_LOGON; if ($detailed_watchdog_log) { @@ -139,7 +136,7 @@ function _ldap_authorizations_user_authorizations(&$user, $op, $consumer_type, $ continue; } - if ($consumer->consumerConf->onlyApplyToLdapAuthenticated && !$ldap_authenticated && $op != 'test_query') { + if ($consumer->consumerConf->onlyApplyToLdapAuthenticated && !$ldap_authenticated && $op != 'test_query' && $op != 'test_query_set') { if ($detailed_watchdog_log) { watchdog('ldap_authorization', '%username : not used because it is set to be applied only to ldap authenticated users. %username is not ldap authenticated.', $watchdog_tokens, WATCHDOG_DEBUG); @@ -183,6 +180,7 @@ function _ldap_authorizations_user_authorizations(&$user, $op, $consumer_type, $ /** make sure keys of array are lower case and values are mixed case and strip to first attribute is configured */ + foreach ($proposed_ldap_authorizations as $key => $authorization_id) { if ($consumer->consumerConf->useFirstAttrAsGroupId) { $attr_parts = ldap_explode_dn($authorization_id, 0); @@ -192,14 +190,18 @@ function _ldap_authorizations_user_authorizations(&$user, $op, $consumer_type, $ $authorization_id = ldap_pear_unescape_dn_value(trim($first_part[1])); } } + $new_key = drupal_strtolower($authorization_id); } - $proposed_ldap_authorizations[drupal_strtolower($key)] = $authorization_id; - if ($key != drupal_strtolower($key)) { + else { + $new_key = drupal_strtolower($key); + } + $proposed_ldap_authorizations[$new_key] = $authorization_id; + if ($key != $new_key) { unset($proposed_ldap_authorizations[$key]); } } - if ($op == 'test_query') { + if ($op == 'test_query' || $op == 'test_query_set') { $_SESSION['ldap_authorization_test_query']['useFirstAttrAsGroupId'] = $proposed_ldap_authorizations; } @@ -216,8 +218,6 @@ function _ldap_authorizations_user_authorizations(&$user, $op, $consumer_type, $ $watchdog_tokens)); } - - /** * 2. filter can be both a whitelist and a mapping of an ldap results to an authorization id. * goal of this step is to generate $filtered_ldap_authorizations[$consumer_type] @@ -225,7 +225,6 @@ function _ldap_authorizations_user_authorizations(&$user, $op, $consumer_type, $ */ $filtered_ldap_authorizations = array(); - if ($consumer->consumerConf->useMappingsAsFilter) { // filter + map foreach ($consumer->consumerConf->mappings as $mapping_filter) { $map_from = $mapping_filter['from']; @@ -239,9 +238,6 @@ function _ldap_authorizations_user_authorizations(&$user, $op, $consumer_type, $ $_authorizations = array_values($proposed_ldap_authorizations); if (is_array($consumer->consumerConf->mappings) && is_array($proposed_ldap_authorizations)) { foreach ($consumer->consumerConf->mappings as $mapping_filter) { - if (!isset($mapping_filter['from'])) { - //debug('unset mapping'); debug($mapping_filter); debug('all mappings'); debug($consumer->consumerConf->mappings); - } $map_from = $mapping_filter['from']; $map_to = $mapping_filter['normalized']; $map_from_key = array_search(drupal_strtolower($map_from), array_keys($proposed_ldap_authorizations)); @@ -265,7 +261,6 @@ function _ldap_authorizations_user_authorizations(&$user, $op, $consumer_type, $ } $consumer->populateConsumersFromConsumerIds($filtered_ldap_authorizations, $consumer->consumerConf->createConsumers); // set values of $filtered_ldap_authorizations to consumers - /** * now that we have list of consumers that are to be granted, give other modules a chance to alter it * @@ -277,6 +272,7 @@ function _ldap_authorizations_user_authorizations(&$user, $op, $consumer_type, $ 'ldap_server' => $ldap_server, 'consumer' => $consumer, ); + drupal_alter('ldap_authorization_authorizations', $filtered_ldap_authorizations, $params); $watchdog_tokens['%filtered_ldap_authorizations'] = join(', ', array_keys($filtered_ldap_authorizations)); @@ -289,23 +285,26 @@ function _ldap_authorizations_user_authorizations(&$user, $op, $consumer_type, $ $watchdog_tokens)); } - if ($op == 'test_query') { + if ($op == 'test_query' || $op == 'test_query_set') { $display_authorizations = array(); - foreach ($filtered_ldap_authorizations as $consumer_id => $consumer) { - $display_authorizations[] = $consumer['map_to_string']; + foreach ($filtered_ldap_authorizations as $consumer_id => $_consumer) { + $display_authorizations[] = $_consumer['map_to_string']; } $_SESSION['ldap_authorization_test_query']['post mappings'] = $display_authorizations; + $data = property_exists($user, 'data') ? $user->data['ldap_authorizations'][$consumer->consumerType] : array(); + $_SESSION['ldap_authorization_test_query']['user data'] = $data; } /** * 3. third, grant any proposed authorizations not already granted */ - if ($op == 'test_query') { + if ($op == 'test_query' || $op == 'test_query_set') { $_SESSION['ldap_authorization_test_query']['tokens'] = $watchdog_tokens; } - if ($op == 'set') { - _ldap_authorizations_user_authorizations_set($user, $consumer, $filtered_ldap_authorizations, $ldap_user, $watchdog_tokens); + if ($op == 'set' || $op == "test_query_set") { + $test = ($op == "test_query_set"); + _ldap_authorizations_user_authorizations_set($user, $consumer, $filtered_ldap_authorizations, $ldap_user, $watchdog_tokens, $test); } $authorizations[$consumer_type] = $filtered_ldap_authorizations; @@ -327,7 +326,7 @@ function _ldap_authorizations_user_authorizations(&$user, $op, $consumer_type, $ * returns nothing */ -function _ldap_authorizations_user_authorizations_set(&$user, $consumer, $filtered_ldap_authorizations, &$ldap_entry, $watchdog_tokens) { +function _ldap_authorizations_user_authorizations_set(&$user, $consumer, $filtered_ldap_authorizations, &$ldap_entry, $watchdog_tokens, $test) { $detailed_watchdog_log = variable_get('ldap_help_watchdog_detail', 0); ldap_authorization_cleanse_empty_og_fields($user); @@ -346,19 +345,28 @@ function _ldap_authorizations_user_authorizations_set(&$user, $consumer, $filter $initial_existing_ldap_authorizations = array(); } + if ($test) { + $_SESSION['ldap_authorization_test_query']['setting_data']['Pre Grant/Revokes $user->data[ldap_authorizations][' . $consumer->consumerType. ']'] = $user_auth_data; + $_SESSION['ldap_authorization_test_query']['setting_data']['Pre Grant/Revokes authorizations user has'] = $consumer->usersAuthorizations($user); + } + $watchdog_tokens['%initial'] = join(', ', $initial_existing_ldap_authorizations); $watchdog_tokens['%filtered_ldap_authorizations'] = join(', ', array_keys($filtered_ldap_authorizations)); /** * B. if regrantLdapProvisioned is false, $grants_lcase array should only be new authorizations */ - if ($consumer->consumerConf->regrantLdapProvisioned === FALSE) { + if (!$consumer->consumerConf->regrantLdapProvisioned) { // if regranting disabled, filter off previously granted roles $grants = array_diff(array_keys($filtered_ldap_authorizations), $initial_existing_ldap_authorizations); + if ($test) { + $_SESSION['ldap_authorization_test_query']['setting_data']['Grants after regrantLdapProvisioned filter'] = $grants; + } } else { $grants = array_keys($filtered_ldap_authorizations); } + $watchdog_tokens['%grants1'] = join(', ', $grants); /** @@ -378,6 +386,7 @@ function _ldap_authorizations_user_authorizations_set(&$user, $consumer, $filter $consumer->authorizationGrant($user, $user_auth_data, $existing_grants, $ldap_entry, FALSE); $watchdog_tokens['%user_auth_data_post_grants'] = print_r($user_auth_data, TRUE); $watchdog_tokens['%user_data_post_grants'] = print_r($user->data, TRUE); + /** * 3.F take away any authorizations not in proposed authorization, * but previously granted by ldap @@ -385,8 +394,7 @@ function _ldap_authorizations_user_authorizations_set(&$user, $consumer, $filter $watchdog_tokens['%revokes'] = t('none'); if ($consumer->consumerConf->revokeLdapProvisioned) { - $revokes_lcase = array_diff($initial_existing_ldap_authorizations, array_keys($filtered_ldap_authorizations)); - + $revokes_lcase = $consumer->authorizationDiff($initial_existing_ldap_authorizations, array_keys($filtered_ldap_authorizations)); if (count($revokes_lcase)) { $revokes = array(); // keys are lcase, values are mixed case foreach ($revokes_lcase as $i => $revoke_lcase) { @@ -396,6 +404,9 @@ function _ldap_authorizations_user_authorizations_set(&$user, $consumer, $filter 'exists' => TRUE, ); } + if ($test) { + $_SESSION['ldap_authorization_test_query']['setting_data']['Revokes'] = $revokes; + } $consumer->authorizationRevoke($user, $user_auth_data, $revokes, $ldap_entry, FALSE); $watchdog_tokens['%revokes'] = join(', ', array_keys($revokes)); } @@ -410,6 +421,9 @@ function _ldap_authorizations_user_authorizations_set(&$user, $consumer, $filter */ $uid = $user->uid; + $user_edit = array('data' => $user->data); + $user_edit['data']['ldap_authorizations'] = empty($user->data['ldap_authorizations']) ? array() : $user->data['ldap_authorizations']; + $consumer->sortConsumerIds('grant', $user_auth_data); // keep in good display order $user_edit['data']['ldap_authorizations'][$consumer->consumerType] = $user_auth_data; $watchdog_tokens['%user_edit_presave'] = print_r($user_edit, TRUE); $user = user_save($user, $user_edit); @@ -439,6 +453,11 @@ function _ldap_authorizations_user_authorizations_set(&$user, $consumer, $filter $watchdog_tokens, WATCHDOG_DEBUG); } + if ($test) { + $_SESSION['ldap_authorization_test_query']['setting_data']['Post Grant/Revokes authorizations user has'] = $consumer->usersAuthorizations($user); + $_SESSION['ldap_authorization_test_query']['setting_data']['Post Grant/Revokes $user->data[ldap_authorizations][' . $consumer->consumerType. ']'] = $user->data['ldap_authorizations'][$consumer->consumerType]; + } + } function _ldap_authorization_ldap_authorization_maps_alter(&$user, &$user_ldap_entry, &$ldap_server, &$consumer_conf, &$authz_ids, $op) { @@ -454,19 +473,20 @@ function _ldap_authorization_ldap_authorization_maps_alter(&$user, &$user_ldap_e else { $derive_from_dn_authorizations = array(); } - if ($op == 'test_query') { + if ($op == 'test_query' || $op == 'test_query_set') { $_SESSION['ldap_authorization_test_query']['maps']['Derive from DN'] = ($rdn_values) ? $derive_from_dn_authorizations : t('disabled'); } // traditional groups (dns) $group_dns = $consumer_conf->server->groupMembershipsFromUser($user, 'group_dns'); + // debug("groupMembershipsFromUser, group_dns"); debug($group_dns); if (!$group_dns) { $group_dns = array(); } elseif (count($group_dns)) { $group_dns = array_unique($group_dns); } - if ($op == 'test_query') { + if ($op == 'test_query' || $op == 'test_query_set') { $_SESSION['ldap_authorization_test_query']['maps']['Groups DNs'] = $group_dns; } diff --git a/ldap_authorization/ldap_authorization.install b/ldap_authorization/ldap_authorization.install index ae3cfe1..9af28ec 100644 --- a/ldap_authorization/ldap_authorization.install +++ b/ldap_authorization/ldap_authorization.install @@ -100,7 +100,7 @@ function ldap_authorization_schema() { module_load_include('inc', 'ldap_servers', 'ldap_servers.functions'); module_load_include('php', 'ldap_authorization', 'LdapAuthorizationConsumerConfAdmin.class'); - + $fields = LdapAuthorizationConsumerConfAdmin::fields(); foreach ($fields as $name => $props) { if (isset($props['schema'])) { @@ -352,8 +352,12 @@ function ldap_authorization_update_7203() { $schema = ldap_authorization_schema(); $field_schema = $schema['ldap_authorization']['fields']['use_first_attr_as_groupid']; if (db_field_exists('ldap_authorization', 'useFirstAttrAsGroupId')) { - db_change_field('ldap_authorization', 'useFirstAttrAsGroupId', 'use_first_attr_as_groupid', $field_schema); + if (db_field_exists('ldap_authorization', 'use_first_attr_as_groupid')) { + db_drop_field('ldap_authorization', 'useFirstAttrAsGroupId'); + } + else { + db_change_field('ldap_authorization', 'useFirstAttrAsGroupId', 'use_first_attr_as_groupid', $field_schema); + } } - } \ No newline at end of file diff --git a/ldap_authorization/ldap_authorization.module b/ldap_authorization/ldap_authorization.module index 39ba3c4..0faa848 100644 --- a/ldap_authorization/ldap_authorization.module +++ b/ldap_authorization/ldap_authorization.module @@ -90,7 +90,6 @@ function ldap_authorization_menu() { * Implements hook_user_login() login operation. */ function ldap_authorization_user_login(&$edit, $user) { - list($authorizations, $notifications) = ldap_authorizations_user_authorizations($user, 'set', NULL, 'logon'); if (variable_get('ldap_help_watchdog_detail', FALSE)) { foreach ($authorizations as $consumer_type => $authorization_ids) { @@ -98,10 +97,6 @@ function ldap_authorization_user_login(&$edit, $user) { watchdog('ldap_authentication', 'ldap_authorization_user_login.authorizations' . $ul , array(), WATCHDOG_DEBUG); } } - - - // dpm('ldap_authorization_user_login'); dpm($user); dpm($authorizations); - } /** @@ -140,10 +135,8 @@ function ldap_authorization_ldap_server_in_use($sid, $server_name) { * Implements hook_ldap_attributes_needed_alter(). */ function ldap_authorization_ldap_attributes_needed_alter(&$attribute_maps, $params) { - // dpm('ldap_authorization_ldap_attributes_needed_alter'); dpm($params); if (isset($params['ldap_context'])) { - // 'ldap_authorization__' . $consumer_type $parts = explode('__', $params['ldap_context']); if (count($parts) == 2 && $parts[0] == 'ldap_authorization') { $consumer_type = $parts[1]; @@ -154,7 +147,6 @@ function ldap_authorization_ldap_attributes_needed_alter(&$attribute_maps, $para $attribute_maps[$attribute_name] = ldap_servers_set_attribute_map($attribute_name); //array($attribute_name, 0, NULL); } } - // dpm('ldap_authorization_ldap_attributes_needed_alter, consumer_conf'); dpm($consumer_conf); dpm($attribute_maps); } } @@ -251,7 +243,7 @@ function ldap_authorization_get_consumers($consumer_type = NULL, $reset = FALSE, * so it can be called from a batch synchronization process for example * * @param drupal user object $user - * @param string $op indicateing operation such as query, set, test_query, etc. + * @param string $op indicating operation such as query, set, test_query, etc. * @param string $consumer_type e.g. drupal_role, or og_groups * @param string $context * diff --git a/ldap_authorization/ldap_authorization_drupal_role/LdapAuthorizationConsumerRole.class.php b/ldap_authorization/ldap_authorization_drupal_role/LdapAuthorizationConsumerRole.class.php index d6a2dd6..104a0fb 100644 --- a/ldap_authorization/ldap_authorization_drupal_role/LdapAuthorizationConsumerRole.class.php +++ b/ldap_authorization/ldap_authorization_drupal_role/LdapAuthorizationConsumerRole.class.php @@ -55,6 +55,7 @@ class LdapAuthorizationConsumerDrupalRole extends LdapAuthorizationConsumerAbstr return FALSE; } else { + $roles_by_consumer_id = $this->existingRolesByRoleName(TRUE); // flush existingRolesByRoleName cache after creating new role watchdog('user', 'created drupal role %role in ldap_authorizations module', array('%role' => $new_role->name)); } return TRUE; @@ -95,7 +96,7 @@ class LdapAuthorizationConsumerDrupalRole extends LdapAuthorizationConsumerAbstr } - public function revokeSingleAuthorization(&$user, $consumer_id, $consumer, &$user_auth_data, $reset = FALSE) { + public function revokeSingleAuthorization(&$user, $consumer_id, $consumer, &$user_auth_data, $user_save = FALSE, $reset = FALSE) { $role_name_lcase = $consumer_id; $role_name = empty($consumer['value']) ? $consumer_id : $consumer['value']; @@ -135,12 +136,11 @@ class LdapAuthorizationConsumerDrupalRole extends LdapAuthorizationConsumerAbstr * extends grantSingleAuthorization() */ - public function grantSingleAuthorization(&$user, $consumer_id, $consumer, &$user_auth_data, $reset = FALSE) { + public function grantSingleAuthorization(&$user, $consumer_id, $consumer, &$user_auth_data, $user_save = FALSE, $reset = FALSE) { $role_name_lcase = $consumer_id; $role_name = empty($consumer['value']) ? $consumer_id : $consumer['value']; $rid = $this->getDrupalRoleIdFromRoleName($role_name); - if (is_null($rid)) { watchdog('ldap_authorization', 'LdapAuthorizationConsumerDrupalRole.grantSingleAuthorization() failed to grant %username the role %role_name because role does not exist', diff --git a/ldap_authorization/ldap_authorization_og/LdapAuthorizationConsumerOG.class.php b/ldap_authorization/ldap_authorization_og/LdapAuthorizationConsumerOG.class.php index bb6d1ad..1c9aaa0 100644 --- a/ldap_authorization/ldap_authorization_og/LdapAuthorizationConsumerOG.class.php +++ b/ldap_authorization/ldap_authorization_og/LdapAuthorizationConsumerOG.class.php @@ -8,14 +8,20 @@ * */ -module_load_include('php', 'ldap_authorization', 'LdapAuthorizationConsumerAbstract.class'); +if (function_exists('ldap_servers_module_load_include')) { + ldap_servers_module_load_include('php', 'ldap_authorization', 'LdapAuthorizationConsumerAbstract.class'); +} +else { + module_load_include('php', 'ldap_authorization', 'LdapAuthorizationConsumerAbstract.class'); +} class LdapAuthorizationConsumerOG extends LdapAuthorizationConsumerAbstract { public $consumerType = 'og_group'; public $allowConsumerObjectCreation = FALSE; public $ogVersion = NULL; // 1, 2, etc. - + public $defaultMembershipRid; + public $anonymousRid; public $defaultConsumerConfProperties = array( 'onlyApplyToLdapAuthenticated' => TRUE, 'useMappingsAsFilter' => TRUE, @@ -26,45 +32,41 @@ class LdapAuthorizationConsumerOG extends LdapAuthorizationConsumerAbstract { ); function __construct($consumer_type) { + $this->ogVersion = ldap_authorization_og_og_version(); + if ($this->ogVersion == 1) { + $this->defaultMembershipRid = ldap_authorization_og1_role_name_to_role_id(OG_AUTHENTICATED_ROLE); + $this->anonymousRid = ldap_authorization_og1_role_name_to_role_id(OG_ANONYMOUS_ROLE); + } + else { + //@todo these properties are not used in ldap og 2, but when they are their derivation needs to be examined and tested + // as they may be per entity rids, not global. + $this->defaultMembershipRid = NULL; // ldap_authorization_og_rid_from_role_name(OG_AUTHENTICATED_ROLE); + $this->anonymousRid = NULL; //ldap_authorization_og_rid_from_role_name(OG_ANONYMOUS_ROLE); + } + $params = ldap_authorization_og_ldap_authorization_consumer(); parent::__construct('og_group', $params['og_group']); } + public function og1ConsumerIdParts($consumer_id) { + if (!is_scalar($consumer_id)) { + return array(NULL, NULL); + } + $parts = explode('-', $consumer_id); + return (count($parts) != 2) ? array(NULL, NULL) : $parts; + } + /** * @see LdapAuthorizationConsumerAbstract::createConsumer + * + * this function is not implemented for og, but could be + * if a use case for generating og groups and roles on the + * fly existed. */ public function createConsumer($consumer_id, $consumer) { - - list($entity_type, $group_name, $rid) = explode(':', $consumer_id); - - $group = @ldap_authorization_og2_get_group_from_name($entity_type, $group_name); - if ($group) { - return FALSE; - } - - // create og group with name of $group_name of entity type $entity_type - $entity_info = entity_get_info($entity_type); - - $new_group_created = FALSE; - - /** - * - * @todo - * need to create new entity with title of $group_name here - * - */ - - if ($new_group_created === FALSE) { - // if role is not created, remove from array to user object doesn't have it stored as granted - watchdog('user', 'failed to create og group %group_name in ldap_authorizations module', array('%group_name' => $group_name)); - return FALSE; - } - else { - watchdog('user', 'created og group %group_name in ldap_authorizations module', array('%group_name' => $group_name)); - } - return TRUE; + return FALSE; } /** @@ -76,11 +78,9 @@ class LdapAuthorizationConsumerOG extends LdapAuthorizationConsumerAbstract { if ($this->ogVersion == 2) { $group_entity_types = og_get_all_group_bundle(); foreach ($mappings as $i => $mapping) { - $from = $mapping[0]; $to = $mapping[1]; $to_parts = explode('(raw: ', $to); - $user_entered = $to_parts[0]; $new_mapping = array( 'from' => $from, @@ -139,7 +139,7 @@ class LdapAuthorizationConsumerOG extends LdapAuthorizationConsumerAbstract { } else { $role_id = is_numeric($role) ? $role : ldap_authorization_og2_rid_from_role_name($entity_type, $group_entity->type, $group_entity_id, $role); - $roles = og_roles($entity_type, $group_entity->type, 0, FALSE, TRUE); + $roles = og_roles($entity_type, isset($group_entity->type) ? $group_entity->type : NULL, 0, FALSE, TRUE); $role_name = is_numeric($role) ? $roles[$role] : $role; $to_normalized = join(':', array($entity_type, $group_entity_id, $role_id)); $to_simplified = ($to_simplified) ? $to_simplified . ':' . $role_name : $to_normalized; @@ -159,11 +159,9 @@ class LdapAuthorizationConsumerOG extends LdapAuthorizationConsumerAbstract { } - // dpm("convert $to, to: $to_simplified ($to_normalized)"); $new_mappings[] = $new_mapping; } - // dpm($new_mappings); } else { // og 1 foreach ($mappings as $i => $mapping) { @@ -193,7 +191,7 @@ class LdapAuthorizationConsumerOG extends LdapAuthorizationConsumerAbstract { $new_mapping['error_message'] = $incorrect_syntax; continue; } - $new_mapping['simplified'] = $group_target_and_value; + list($group_target, $group_target_value) = $group_target_and_value; $role_target_and_value = explode('=', $targets[1]); @@ -204,6 +202,8 @@ class LdapAuthorizationConsumerOG extends LdapAuthorizationConsumerAbstract { } list($role_target, $role_target_value) = $role_target_and_value; + + $og_group = FALSE; if ($group_target == 'gid') { $gid = $group_target_value; } @@ -232,25 +232,29 @@ class LdapAuthorizationConsumerOG extends LdapAuthorizationConsumerAbstract { $entities = array_keys($result[$entity_type]); $gid = ldap_authorization_og1_entity_id_to_gid($entities[0]); } + + } + if (!$og_group && $gid) { + $og_group = og_load($gid); } + if ($role_target == 'rid') { + $role_name = ldap_authorization_og1_role_name_from_rid($role_target_value); $rid = $role_target_value; } elseif ($role_target == 'role-name') { $rid = ldap_authorization_og_rid_from_role_name($role_target_value); + $role_name = $role_target_value; } - if ($gid && $rid) { - $new_mapping['normalized'] = ldap_authorization_og_authorization_id($gid, $rid); - } - else { - $new_mappings['normalized'] = FALSE; - } + $new_mapping['simplified'] = $og_group->label . ', '. $role_name; + $new_mapping['normalized'] = ($gid && $rid) ? ldap_authorization_og_authorization_id($gid, $rid) : FALSE; + $new_mappings[] = $new_mapping; } - } + } return $new_mappings; } @@ -263,10 +267,10 @@ class LdapAuthorizationConsumerOG extends LdapAuthorizationConsumerAbstract { public function sortConsumerIds($op, &$consumers) { if ($op == 'revoke') { - arsort($consumers, SORT_STRING); + krsort($consumers, SORT_STRING); } else { - asort($consumers, SORT_STRING); + ksort($consumers, SORT_STRING); } } @@ -275,19 +279,20 @@ class LdapAuthorizationConsumerOG extends LdapAuthorizationConsumerAbstract { */ public function populateConsumersFromConsumerIds(&$consumers, $create_missing_consumers = FALSE) { - //debug('populateConsumersFromConsumerIds'); debug($consumers); + // generate a query for all og groups of interest $gids = array(); foreach ($consumers as $consumer_id => $consumer) { if (ldap_authorization_og_og_version() == 1) { - list($gid, $rid) = explode('-', $consumer_id); + list($gid, $rid) = $this->og1ConsumerIdParts($consumer_id); $gids[] = $gid; } else { //debug("populateConsumersFromConsumerIds.consumer_id=$consumer_id"); list($entity_type, $gid, $rid) = explode(':', $consumer_id); + $gids[$entity_type][] = $gid; } - $gids[$entity_type][] = $gid; + } if (ldap_authorization_og_og_version() == 1) { $og_group_entities = og_load_multiple($gids); @@ -300,7 +305,7 @@ class LdapAuthorizationConsumerOG extends LdapAuthorizationConsumerAbstract { foreach ($consumers as $consumer_id => $consumer) { if (ldap_authorization_og_og_version() == 1) { - list($gid, $rid) = explode('-', $consumer_id); + list($gid, $rid) = $this->og1ConsumerIdParts($consumer_id); $consumer['exists'] = isset($og_group_entities[$gid]); if ($consumer['exists']) { $consumer['value'] = $og_group_entities[$gid]; @@ -341,30 +346,251 @@ class LdapAuthorizationConsumerOG extends LdapAuthorizationConsumerAbstract { } - - public function hasAuthorization(&$user, $consumer_id) { if ($this->ogVersion == 1) { - list($gid, $rid) = @explode('-', $consumer_id); - $roles = og_get_user_roles($gid, $uid); - $result = (!empty($roles[$rid])); + $result = FALSE; + list($gid, $rid) = $this->og1ConsumerIdParts($consumer_id); + return ldap_authorization_og1_has_membership($gid, $user->uid) && ldap_authorization_og1_has_role($gid, $user->uid, $rid); } else { - $result = ldap_authorization_og2_has_consumer_id($consumer_id, $user->uid); + return ldap_authorization_og2_has_consumer_id($consumer_id, $user->uid); } - return $result; } public function flushRelatedCaches($consumers = NULL) { if ($this->ogVersion == 1) { // og 7.x-1.x - og_invalidate_cache(); + og_group_membership_invalidate_cache(); + if ($consumers) { + $gids_to_clear_cache = array(); + foreach ($consumers as $i => $consumer_id) { + list($gid, $rid) = $this->og1ConsumerIdParts($consumer_id); + $gids_to_clear_cache[$gid] = $gid; + } + og_invalidate_cache(array_keys($gids_to_clear_cache)); + } + else { + og_invalidate_cache(); + } } else { // og 7.x-2.x og_invalidate_cache(); //gids could be passed in here, but not implemented within og } } + /** + * @param string $op 'grant' or 'revoke' signifying what to do with the $consumer_ids + * @param drupal user object $object + * @param array $user_auth_data is array specific to this consumer_type. Stored at $user->data['ldap_authorizations'][]
Student Accounts|group-name=students,role-name=member
cn=honors students,ou=groups,dc=hogwarts,dc=edu|gid=7,rid=28
- cn=gryffindor,ou=groups,dc=hogwarts,dc=edu|node.house=gryffindor,role-name=administrator member
';
}
else {
@@ -85,6 +84,25 @@ function ldap_authorization_og1_entity_id_to_gid($entity_id) {
}
/**
+ * Convert entity id to group id
+ *
+ * @param int $entity_id as id of entity associated with organic group
+ * @return int og group id
+ */
+function ldap_authorization_og1_group_name_to_gid($group_name) {
+
+ $gid = db_select('og', 'og')
+ ->fields('og', array('gid'))
+ ->condition('og.label', $group_name, '=')
+ ->range(0, 1)
+ ->execute()
+ ->fetchField();
+ return ($gid && is_scalar($gid)) ? $gid : FALSE;
+
+}
+
+
+/**
* Generic function to convert between query values and organic groups structures and attributes
*
* @param mixed $value signifies query value e.g. 'bakers', 7 etc.
@@ -94,32 +112,25 @@ function ldap_authorization_og1_entity_id_to_gid($entity_id) {
*/
function ldap_authorization_og1_get_group($value, $value_type = 'group_name', $return = 'object') {
- $groups = og_load_multiple(og_get_all_group());
- $group = NULL;
- $node = NULL;
-
if ($value_type == 'gid') {
- $group = $groups[$value];
+ $group = og_load($value);
}
elseif ($value_type == 'group_name') {
- foreach ($groups as $gid => $discard) {
- $group_obj = og_load($gid);
- $group_node = node_load($group_obj->etid);
- if ($group_node && $group_node->type == $value) {
- $group = $group_obj;
- $node = $group_node;
- break;
- }
- }
+ $gid = ldap_authorization_og1_group_name_to_gid($value);
+ $group = ($gid) ? og_load($gid) : FALSE;
}
- if ($return == 'object' && is_object($group) && is_object($node)) {
- return array($group, $node);
+ if (!$group || !is_object($group)) {
+ return FALSE;
+ }
+ if ($return == 'object' && is_object($group)) {
+ $group_entity = node_load($group->etid);
+ return array($group, $group_entity);
}
- elseif ($return == 'label' || $return == 'name' && is_object($group)) {
+ elseif ($return == 'label' || $return == 'name') {
return $group->label;
}
- elseif ($return == 'gid' && is_object($group)) {
+ elseif ($return == 'gid') {
return $group->gid;
}
else {
@@ -136,7 +147,7 @@ function ldap_authorization_og1_get_group($value, $value_type = 'group_name', $r
* @return mixed organic group object, gid, label, etc.
*/
function ldap_authorization_og2_get_group_from_name($entity_type, $group_name) {
- // dpm("ldap_authorization_og2_get_group_from_name( $entity_type, $group_name)");
+
require_once(drupal_get_path('module', 'ldap_authorization_og') . '/LdapAuthorizationConsumerOG.class.php');
$group_entity = FALSE;
$group_entity_id = FALSE;
@@ -144,7 +155,6 @@ function ldap_authorization_og2_get_group_from_name($entity_type, $group_name) {
$query->entityCondition('entity_type', $entity_type)
->propertyCondition('title', $group_name);
$result = $query->execute();
- // dpm($result);
if (isset($result[$entity_type])) {
$group_ids = array_keys($result[$entity_type]);
if (count($group_ids) == 1) {
@@ -158,18 +168,35 @@ function ldap_authorization_og2_get_group_from_name($entity_type, $group_name) {
}
+function ldap_authorization_og1_has_membership($gid, $uid) {
+ return (boolean)og_get_group_membership($gid, 'user', $uid);
+}
/**
* Test if a user has a particular group role
*
* @param int $gid as og group id
* @param int $uid as user id
- * @param string $role_name as og role name
+ * @param string $rid as og role id
*
* @return boolean signifying if user has group x role
*/
-function ldap_authorization_og1_has_role($gid, $uid, $role_name) {
+function ldap_authorization_og1_has_role($gid, $uid, $rid) {
$roles = og_get_user_roles($gid, $uid);
- return (is_array($roles) && in_array($role_name, array_values($roles)));
+ return (is_array($roles) && in_array($rid, array_values($roles)));
+}
+
+/** avoid excessive calls to og_roles() **/
+function ldap_authorization_og1_roles($reset = false) {
+ static $roles;
+ if ($reset || !is_array($roles)) {
+ $roles = og_roles();
+ }
+ return $roles;
+}
+
+function ldap_authorization_og1_role_name_to_role_id($role_name) {
+ $roles = ldap_authorization_og1_roles();
+ return array_search($role_name, $roles); //empty($roles[$role_name]) ? FALSE : $roles[$role_name];
}
function ldap_authorization_og2_has_consumer_id($consumer_id, $uid) {
@@ -204,19 +231,7 @@ function ldap_authorization_og2_has_role($group_type, $gid, $uid, $role_name) {
return (is_array($roles) && in_array($role_name, array_values($roles)));
}
-/**
- * Derive og role id from role name
- *
- * @param string $role_name as og role name
- * @return int og role id
- */
-function ldap_authorization_og2_rid_from_role_name($entity_type, $bundle, $gid, $role_name) {
- $roles = og_roles($entity_type, $bundle, 0, FALSE, TRUE);
- $roles_flipped = array_flip($roles);
- // debug("ldap_authorization_og2_rid_from_role_name,role_name=$role_name, og_roles"); debug($roles_flipped);
- return (empty($roles_flipped[$role_name])) ? NULL : $roles_flipped[$role_name];
-}
/**
* Derive og role id from role name
@@ -224,12 +239,24 @@ function ldap_authorization_og2_rid_from_role_name($entity_type, $bundle, $gid,
* @param string $role_name as og role name
* @return int og role id
*/
+
function ldap_authorization_og_rid_from_role_name($role_name) {
$roles = og_roles(0);
$rids = array_flip($roles);
return isset($rids[$role_name]) ? $rids[$role_name] : FALSE;
}
+function ldap_authorization_og1_role_name_from_rid($rid) {
+ $roles = og_roles(0);
+ return isset($roles[$rid]) ? $roles[$rid] : FALSE;
+}
+
+function ldap_authorization_og2_rid_from_role_name($entity_type, $bundle, $gid, $role_name) {
+ $roles = og_roles($entity_type, $bundle, 0, FALSE, TRUE);
+ $roles_flipped = array_flip($roles);
+ return (empty($roles_flipped[$role_name])) ? NULL : $roles_flipped[$role_name];
+}
+
function ldap_authorization_og_get_all_group_entities() {
$entities = array();
$group_entity_types = og_get_all_group_bundle();
diff --git a/ldap_authorization/tests/BasicTests.test b/ldap_authorization/tests/BasicTests.test
index d663ad9..a8e58df 100644
--- a/ldap_authorization/tests/BasicTests.test
+++ b/ldap_authorization/tests/BasicTests.test
@@ -24,7 +24,11 @@ class LdapAuthorizationBasicTests extends LdapTestCase {
protected $ldap_test_data;
function setUp() {
- parent::setUp(array('ldap_authentication', 'ldap_authorization', 'ldap_authorization_drupal_role')); // don't need any real servers, configured, just ldap_servers code base
+ parent::setUp(array(
+ 'ldap_authentication',
+ 'ldap_authorization',
+ 'ldap_authorization_drupal_role',
+ 'ldap_test')); // don't need any real servers, configured, just ldap_servers code base
variable_set('ldap_simpletest', 2);
}
@@ -45,7 +49,7 @@ class LdapAuthorizationBasicTests extends LdapTestCase {
module_exists('ldap_servers') &&
module_exists('ldap_authorization') &&
module_exists('ldap_authorization_drupal_role') &&
- (variable_get('ldap_simpletest', 0) > 0)
+ (variable_get('ldap_simpletest', 2) > 0)
);
$this->assertTrue($setup_success, ' ldap_authorizations setup successful', 'LDAP Authorization: Test Setup Success');
@@ -80,13 +84,13 @@ class LdapAuthorizationBasicTests extends LdapTestCase {
$sid = 'activedirectory1';
$testid = 'ExclusiveModeUserLogon3';
$sids = array($sid);
- $this->prepTestData('hogwarts', $sids, 'provisionToDrupal', 'default', 'drupal_role_default');
+ $this->prepTestData(LDAP_TEST_LDAP_NAME, $sids, 'provisionToDrupal', 'default', 'drupal_role_default');
- $edit = array(
+ $hpotter_logon_edit = array(
'name' => 'hpotter',
'pass' => 'goodpwd',
);
- $this->drupalPost('user', $edit, t('Log in'));
+ $this->drupalPost('user', $hpotter_logon_edit, t('Log in'));
$this->assertText(t('Member for'), 'New Ldap user with good password authenticated.', 'LDAP Authorization: Test Logon');
$this->assertTrue(
$this->testFunctions->ldapUserIsAuthmapped('hpotter'),
@@ -94,9 +98,9 @@ class LdapAuthorizationBasicTests extends LdapTestCase {
'LDAP Authorization: Test Logon'
);
- $hpotter = user_load_by_name('hpotter');
+ $hpotter = $this->testFunctions->userByNameFlushingCache('hpotter');
$roles = array_values($hpotter->roles);
- $desired_roles = array('students', 'authenticated user', 'gryffindor', 'honors students');
+ $desired_roles = array('students', 'authenticated user', 'cn=gryffindor,ou=groups,dc=hogwarts,dc=edu', 'cn=honors students,ou=groups,dc=hogwarts,dc=edu');
$diff1 = array_diff($roles, $desired_roles);
$diff2 = array_diff($desired_roles, $roles);
$correct_roles = (count($diff1) == 0 && count($diff2) == 0);
@@ -112,6 +116,80 @@ class LdapAuthorizationBasicTests extends LdapTestCase {
$this->drupalGet('user/logout');
+ /**
+ * test revoking of no longer deserved roles when revokeLdapProvisioned=1
+ */
+ $this->consumerAdminConf['drupal_role']->revokeLdapProvisioned = 1;
+ $this->consumerAdminConf['drupal_role']->save();
+
+ // setup: remove hpotter from honors members
+ $test_data_pre_test = variable_get('ldap_test_server__' . $sid, NULL);
+ $test_data = variable_get('ldap_test_server__' . $sid, NULL);
+
+ $this->removeUserFromGroup($test_data, 'cn=hpotter,ou=people,dc=hogwarts,dc=edu', 'cn=honors students,ou=groups,dc=hogwarts,dc=edu', "dc=hogwarts,dc=edu");
+
+ variable_set('ldap_test_server__' . $sid, $test_data);
+
+ $hpotter_dn = 'cn=hpotter,ou=people,dc=hogwarts,dc=edu';
+ $this->drupalPost('user', $hpotter_logon_edit, t('Log in'));
+ $hpotter = $this->testFunctions->userByNameFlushingCache('hpotter');
+ $roles = array_values($hpotter->roles);
+
+ $this->assertFalse(
+ in_array('cn=honors students,ou=groups,dc=hogwarts,dc=edu', $roles),
+ 'when revokeLdapProvisioned=1, removed role from user',
+ 'LDAP Authorization: Test Logon'
+ );
+
+ $this->assertTrue(
+ empty($hpotter->data['ldap_authorizations']['drupal_role']['cn=honors students,ou=groups,dc=hogwarts,dc=edu']),
+ 'when revokeLdapProvisioned=1, removed user->data[ldap_authorizations][drupal_role][You would be surprised how much is documented about your local ldap. Find your organization's LDAP documentation and - support staff before you stuggle blindly. Know if ldap or ldaps is used. Know if an odd port is used. +
You would be surprised how much is documented about your local LDAP. Find your organization's LDAP documentation and + support staff before you struggle blindly. Know whether LDAP or LDAPS is used. Know if an odd port is used. + A sample email to an LDAP Administrator is available at http://drupal.org/node/1925794 Know how service accounts are expected to be used. Below are examples of ldap implementation documentation:
More than one LDAP server configuration can exist for a physical LDAP server. -Multiple configurations for the same physical ldap server are useful in cases such as: (1) different -base dns for authentication and authorization and (2) service accounts with different privileges -for different purposes.
-EOF; - - $form['#prefix'] = t($form['#prefix']); - $form['server'] = array( '#type' => 'fieldset', '#title' => t('Connection settings'), @@ -221,6 +216,7 @@ EOF; $form['bind_method'] = array( '#type' => 'fieldset', '#title' => t('Binding Method'), + '#description' => t('How the Drupal system is authenticated by the LDAP server.'), '#collapsible' => TRUE, '#collapsed' => TRUE, ); @@ -309,11 +305,6 @@ EOF; } } - $form['submit'] = array( - '#type' => 'submit', - '#value' => t('Save configuration'), - ); - $action = ($op == 'add') ? 'Add' : 'Update'; $form['submit'] = array( '#type' => 'submit', @@ -321,7 +312,6 @@ EOF; '#weight' => 100, ); - return $form; } @@ -657,21 +647,21 @@ public function drupalFormSubmit($op, $values) { '#type' => 'radios', '#title' => t('Binding Method for Searches (such as finding user object or their group memberships)'), '#options' => array( - LDAP_SERVERS_BIND_METHOD_SERVICE_ACCT => t('Service Account Bind. Use credentials in following section to - bind to ldap. This option is usually a best practice. Service account is entered in next section.'), + LDAP_SERVERS_BIND_METHOD_SERVICE_ACCT => t('Service Account Bind: Use credentials in the + Service Account field to bind to LDAP. This option is usually a best practice.'), - LDAP_SERVERS_BIND_METHOD_USER => t('Bind with Users Credentials. Use users\' entered credentials - to bind to LDAP. This is only useful for modules that work during user logon such - as ldap authentication and ldap authorization. This option is not a best practice in most cases. - The users dn must be of the form "cn=[username],[base dn]" for this option to work.'), + LDAP_SERVERS_BIND_METHOD_USER => t('Bind with Users Credentials: Use user\'s entered credentials + to bind to LDAP.thumbnailPhoto). Leave empty if no such attribute exists'),
+ ),
+ 'schema' => array(
+ 'type' => 'varchar',
+ 'length' => 255,
+ 'not null' => FALSE,
+ ),
+ ),
+
'unique_persistent_attr' => array(
'form' => array(
'fieldset' => 'users',
diff --git a/ldap_servers/ldap_servers.api.php b/ldap_servers/ldap_servers.api.php
index 5dbc605..306d58a 100644
--- a/ldap_servers/ldap_servers.api.php
+++ b/ldap_servers/ldap_servers.api.php
@@ -109,9 +109,8 @@ function hook_ldap_entry_post_provision(&$ldap_entries, $ldap_server, $context)
* array of attributes to be returned from ldap queries where:
* - each key is ldap attribute name (e.g. mail, cn)
* - each value is associative array of form:
- * - 'source_data_type' => NULL,
- * - 'target_data_type' => NULL,
- * - 'values' =>
+ * - 'conversion' => NULL,
+ * - 'values' => array(0 => 'john', 1 => 'johnny'))
*
* @param array $params context array with some or all of the following key/values
* 'sid' => drupal account object,
@@ -121,7 +120,7 @@ function hook_ldap_entry_post_provision(&$ldap_entries, $ldap_server, $context)
*/
function hook_ldap_attributes_needed_alter(&$attributes, $params) {
- $attributes['dn'] = ldap_servers_set_attribute_map(@$attributes['dn'], NULL, 'ldap_dn') ;
+ $attributes['dn'] = ldap_servers_set_attribute_map(@$attributes['dn'], 'ldap_dn') ;
if ($params['sid']) { // puid attributes are server specific
$ldap_server = (is_object($params['sid'])) ? $params['sid'] : ldap_servers_get_servers($params['sid'], 'enabled', TRUE);
diff --git a/ldap_servers/ldap_servers.functions.inc b/ldap_servers/ldap_servers.functions.inc
index 8c77eaa..3195b38 100644
--- a/ldap_servers/ldap_servers.functions.inc
+++ b/ldap_servers/ldap_servers.functions.inc
@@ -106,8 +106,7 @@ function ldap_badattr($attr, $attr_name) {
*
*/
function ldap_servers_attributes_needed($sid, $ldap_context = 'all', $reset = TRUE) {
- // debug("call of ldap_servers_attributes_needed, op=$op,ldap_server="); debug($ldap_server);
- // dpm("call of ldap_servers_attributes_needed, op=$op,ldap_server="); dpm($ldap_server);
+
static $attributes;
$sid = is_object($sid) ? $sid->sid : $sid;
$static_cache_id = ($sid) ? $ldap_context . '__' . $sid : $ldap_context;
diff --git a/ldap_servers/ldap_servers.info b/ldap_servers/ldap_servers.info
index b8b59cc..0ddbecc 100644
--- a/ldap_servers/ldap_servers.info
+++ b/ldap_servers/ldap_servers.info
@@ -1,7 +1,7 @@
name = LDAP Servers
description = Implements LDAP Server Configuration
package = Lightweight Directory Access Protocol
-
+dependencies[] = ctools
core = 7.x
files[] = LdapServer.class.php
diff --git a/ldap_servers/ldap_servers.install b/ldap_servers/ldap_servers.install
index 9501ed7..c3f37e1 100644
--- a/ldap_servers/ldap_servers.install
+++ b/ldap_servers/ldap_servers.install
@@ -14,7 +14,7 @@ function ldap_servers_install() {
variable_set('ldap_servers_require_ssl_for_credentails', 0);
if (! ($key = variable_get('ldap_servers_encrypt_key', NULL))) {
- module_load_include('inc', 'ldap_servers', 'ldap_servers.functions');
+ module_load_include('module', 'ldap_servers');
ldap_servers_module_load_include('inc', 'ldap_servers', 'ldap_servers.encryption');
$key = ldap_servers_random_salt(10);
variable_set('ldap_servers_encrypt_key', $key);
@@ -108,12 +108,13 @@ function ldap_servers_schema() {
*/
function ldap_servers_update_7100() {
-
- db_change_field('ldap_servers', 'type', 'ldap_type', array(
- 'type' => 'varchar',
- 'length' => 20,
- 'not null' => FALSE
- ));
+ if (!db_field_exists('ldap_servers', 'ldap_type') && db_field_exists('ldap_servers', 'type')) {
+ db_change_field('ldap_servers', 'type', 'ldap_type', array(
+ 'type' => 'varchar',
+ 'length' => 20,
+ 'not null' => FALSE
+ ));
+ }
return t('ldap_servers table field "type" renamed to "ldap_type"');
@@ -254,7 +255,7 @@ function ldap_servers_update_7104() {
function ldap_servers_update_7105() {
if (!module_exists('ldap_user')) {
- module_enable('ldap_user');
+ module_enable(array('ldap_user'));
$msg = t('LDAP User module enabled. Some authentication and authorization functionality shifted to LDAP User module.');
}
@@ -563,7 +564,6 @@ function ldap_servers_update_7201() {
foreach ($select as $record) {
$ldap_server_records[$record->sid] = $record;
}
- //dpm("ldap_server_records"); dpm($ldap_server_records);
if (db_table_exists('ldap_authorization')) {
$ldap_authorization_record = NULL;
@@ -579,7 +579,7 @@ function ldap_servers_update_7201() {
$ldap_authorization_record = $record;
}
}
- //dpm("ldap_authorization_record"); dpm($ldap_authorization_record);
+
foreach ($ldap_server_records as $sid => $ldap_server_record) {
if ($ldap_authorization_record && $ldap_authorization_record->sid == $sid) {
$consumer_type = $ldap_authorization_record->consumer_type;
@@ -608,7 +608,7 @@ function ldap_servers_update_7201() {
}
}
}
-// dpm("field_changes"); dpm($field_changes);
+
foreach ($field_changes as $table_name => $record) {
foreach ($record as $id => $field_data) {
if ($table_name == 'ldap_servers' || $table_name == 'ldap_authorization') {
@@ -751,12 +751,31 @@ function ldap_servers_update_7203() {
foreach ($changes as $old_field_name => $new_field_name) {
$field_schema = $schema['ldap_servers']['fields'][$new_field_name];
if (db_field_exists('ldap_servers', $old_field_name)) {
- db_change_field('ldap_servers', $old_field_name, $new_field_name, $field_schema);
+ if (db_field_exists('ldap_servers', $new_field_name)) {
+ db_drop_field('ldap_servers', $old_field_name);
+ }
+ else {
+ db_change_field('ldap_servers', $old_field_name, $new_field_name, $field_schema);
+ }
}
}
}
+/**
+ * Add picture_attr field in schema
+ */
+function ldap_servers_update_7204() {
+ db_add_field(
+ 'ldap_servers',
+ 'picture_attr',
+ array(
+ 'type' => 'varchar',
+ 'length' => 255,
+ 'not null' => FALSE,
+ )
+ );
+}
function ldap_servers_install_update_schema($schema, &$change_log) {
foreach ($schema as $table_name => $table_schema) {
diff --git a/ldap_servers/ldap_servers.module b/ldap_servers/ldap_servers.module
index 7bf6aab..9b03d5a 100644
--- a/ldap_servers/ldap_servers.module
+++ b/ldap_servers/ldap_servers.module
@@ -304,7 +304,7 @@ function ldap_servers_theme() {
*/
function ldap_servers_ldap_attributes_needed_alter(&$attributes, $params) {
- $attributes['dn'] = ldap_servers_set_attribute_map(@$attributes['dn'], 'ldap_dn', 'ldap_dn'); // force this data type
+ $attributes['dn'] = ldap_servers_set_attribute_map(@$attributes['dn'], 'ldap_dn'); // force this data type
if ($params['sid'] && $params['sid']) { // puid attributes are server specific
if (is_scalar($params['sid'])) {
@@ -317,14 +317,17 @@ function ldap_servers_theme() {
if (!isset($attributes[$ldap_server->mail_attr])) {
$attributes[$ldap_server->mail_attr] = ldap_servers_set_attribute_map();
}
+ if(!isset($attributes[$ldap_server->picture_attr])){
+ $attributes[$ldap_server->picture_attr] = ldap_servers_set_attribute_map();
+ }
if ($ldap_server->unique_persistent_attr && !isset($attributes[$ldap_server->unique_persistent_attr])) {
$attributes[$ldap_server->unique_persistent_attr] = ldap_servers_set_attribute_map();
}
if ($ldap_server->user_dn_expression) {
- ldap_servers_token_extract_attributes($attributes, $ldap_server->user_dn_expression, TRUE);
+ ldap_servers_token_extract_attributes($attributes, $ldap_server->user_dn_expression, TRUE);
}
if ($ldap_server->mail_template) {
- ldap_servers_token_extract_attributes($attributes, $ldap_server->mail_template);
+ ldap_servers_token_extract_attributes($attributes, $ldap_server->mail_template);
}
if (!isset($attributes[$ldap_server->user_attr])) {
$attributes[$ldap_server->user_attr] = ldap_servers_set_attribute_map();
@@ -363,60 +366,65 @@ function ldap_servers_ldap_user_attrs_list_alter(&$available_user_attrs, &$param
fields/properties are provisioned or synched
*/
- foreach (array(
- 'field.ldap_user_puid_sid',
- 'field.ldap_user_puid',
- 'field.ldap_user_puid_property',
- 'field.ldap_user_current_dn',
- ) as $i => $property_id) {
- $property_token = '[' . $property_id . ']';
- if (!isset($available_user_attrs[$property_token]) || !is_array($available_user_attrs[$property_token])) {
- $available_user_attrs[$property_token] = array();
+ if ($ldap_server->unique_persistent_attr) {
+ foreach (array(
+ 'field.ldap_user_puid_sid',
+ 'field.ldap_user_puid',
+ 'field.ldap_user_puid_property',
+ ) as $i => $property_id) {
+ $property_token = '[' . $property_id . ']';
+ if (!isset($available_user_attrs[$property_token]) || !is_array($available_user_attrs[$property_token])) {
+ $available_user_attrs[$property_token] = array();
+ }
}
- }
-
- $available_user_attrs['[field.ldap_user_puid_sid]'] = array(
- 'name' => t('Field: sid providing PUID'),
- 'configurable_to_drupal' => 0,
- 'configurable_to_ldap' => 1,
- 'source' => t('!sid', $tokens),
- 'notes' => 'not configurable',
- 'direction' => LDAP_USER_PROV_DIRECTION_TO_DRUPAL_USER,
- 'enabled' => TRUE,
- 'prov_events' => array(LDAP_USER_EVENT_CREATE_DRUPAL_USER),
- 'config_module' => 'ldap_server',
- 'prov_module' => 'ldap_user',
- ) + $available_user_attrs['[field.ldap_user_puid_sid]'];
- $available_user_attrs['[field.ldap_user_puid]'] = array(
- 'name' => t('Field: PUID', $tokens),
- 'configurable_to_drupal' => 0,
- 'configurable_to_ldap' => 1,
- 'source' => '[' . $ldap_server->unique_persistent_attr . ']',
- 'notes' => 'configure at ' . $server_edit_path,
- 'convert' => $ldap_server->unique_persistent_attr_binary,
- 'direction' => LDAP_USER_PROV_DIRECTION_TO_DRUPAL_USER,
- 'enabled' => TRUE,
- 'prov_events' => array(LDAP_USER_EVENT_CREATE_DRUPAL_USER),
- 'config_module' => 'ldap_server',
- 'prov_module' => 'ldap_user',
- ) + $available_user_attrs['[field.ldap_user_puid]'];
+ $available_user_attrs['[field.ldap_user_puid_sid]'] = array(
+ 'name' => t('Field: sid providing PUID'),
+ 'configurable_to_drupal' => 0,
+ 'configurable_to_ldap' => 1,
+ 'source' => t('!sid', $tokens),
+ 'notes' => 'not configurable',
+ 'direction' => LDAP_USER_PROV_DIRECTION_TO_DRUPAL_USER,
+ 'enabled' => TRUE,
+ 'prov_events' => array(LDAP_USER_EVENT_CREATE_DRUPAL_USER),
+ 'config_module' => 'ldap_servers',
+ 'prov_module' => 'ldap_user',
+ ) + $available_user_attrs['[field.ldap_user_puid_sid]'];
+
+ $available_user_attrs['[field.ldap_user_puid]'] = array(
+ 'name' => t('Field: PUID', $tokens),
+ 'configurable_to_drupal' => 0,
+ 'configurable_to_ldap' => 1,
+ 'source' => '[' . $ldap_server->unique_persistent_attr . ']',
+ 'notes' => 'configure at ' . $server_edit_path,
+ 'convert' => $ldap_server->unique_persistent_attr_binary,
+ 'direction' => LDAP_USER_PROV_DIRECTION_TO_DRUPAL_USER,
+ 'enabled' => TRUE,
+ 'prov_events' => array(LDAP_USER_EVENT_CREATE_DRUPAL_USER),
+ 'config_module' => 'ldap_servers',
+ 'prov_module' => 'ldap_user',
+ ) + $available_user_attrs['[field.ldap_user_puid]'];
- $available_user_attrs['[field.ldap_user_puid_property]'] =
- array(
- 'name' => t('Field: PUID Attribute', $tokens),
- 'configurable_to_drupal' => 0,
- 'configurable_to_ldap' => 1,
- 'source' => $ldap_server->unique_persistent_attr ,
- 'notes' => 'configure at ' . $server_edit_path,
- 'direction' => LDAP_USER_PROV_DIRECTION_TO_DRUPAL_USER,
- 'enabled' => TRUE,
- 'prov_events' => array(LDAP_USER_EVENT_CREATE_DRUPAL_USER),
- 'config_module' => 'ldap_server',
- 'prov_module' => 'ldap_user',
- ) + $available_user_attrs['[field.ldap_user_puid_property]'];
+ $available_user_attrs['[field.ldap_user_puid_property]'] =
+ array(
+ 'name' => t('Field: PUID Attribute', $tokens),
+ 'configurable_to_drupal' => 0,
+ 'configurable_to_ldap' => 1,
+ 'source' => $ldap_server->unique_persistent_attr ,
+ 'notes' => 'configure at ' . $server_edit_path,
+ 'direction' => LDAP_USER_PROV_DIRECTION_TO_DRUPAL_USER,
+ 'enabled' => TRUE,
+ 'prov_events' => array(LDAP_USER_EVENT_CREATE_DRUPAL_USER),
+ 'config_module' => 'ldap_servers',
+ 'prov_module' => 'ldap_user',
+ ) + $available_user_attrs['[field.ldap_user_puid_property]'];
+ }
- $available_user_attrs['[field.ldap_user_current_dn]'] =
+ $token = '[field.ldap_user_current_dn]';
+ if (!isset($available_user_attrs[$token]) || !is_array($available_user_attrs[$token])) {
+ $available_user_attrs[$token] = array();
+ }
+ $available_user_attrs[$token] =
array(
'name' => t('Field: Most Recent DN', $tokens),
'configurable_to_drupal' => 0,
@@ -426,9 +434,9 @@ function ldap_servers_ldap_user_attrs_list_alter(&$available_user_attrs, &$param
'direction' => LDAP_USER_PROV_DIRECTION_TO_DRUPAL_USER,
'enabled' => TRUE,
'prov_events' => array(LDAP_USER_EVENT_CREATE_DRUPAL_USER, LDAP_USER_EVENT_SYNCH_TO_DRUPAL_USER),
- 'config_module' => 'ldap_server',
+ 'config_module' => 'ldap_servers',
'prov_module' => 'ldap_user',
- ) + $available_user_attrs['[field.ldap_user_current_dn]'];
+ ) + $available_user_attrs[$token];
if ($ldap_user_conf->provisionsDrupalAccountsFromLdap) {
if (!isset($available_user_attrs['[property.name]']) || !is_array($available_user_attrs['[property.name]'])) {
@@ -440,7 +448,7 @@ function ldap_servers_ldap_user_attrs_list_alter(&$available_user_attrs, &$param
'direction' => LDAP_USER_PROV_DIRECTION_TO_DRUPAL_USER,
'enabled' => TRUE,
'prov_events' => array(LDAP_USER_EVENT_CREATE_DRUPAL_USER, LDAP_USER_EVENT_SYNCH_TO_DRUPAL_USER),
- 'config_module' => 'ldap_server',
+ 'config_module' => 'ldap_servers',
'prov_module' => 'ldap_user',
) + $available_user_attrs['[property.name]'];
@@ -453,9 +461,24 @@ function ldap_servers_ldap_user_attrs_list_alter(&$available_user_attrs, &$param
'direction' => LDAP_USER_PROV_DIRECTION_TO_DRUPAL_USER,
'enabled' => TRUE,
'prov_events' => array(LDAP_USER_EVENT_CREATE_DRUPAL_USER, LDAP_USER_EVENT_SYNCH_TO_DRUPAL_USER),
- 'config_module' => 'ldap_server',
+ 'config_module' => 'ldap_servers',
'prov_module' => 'ldap_user',
) + $available_user_attrs['[property.mail]'];
+
+ if ($ldap_server->picture_attr) {
+ if (!isset($available_user_attrs['[property.picture]']) || !is_array($available_user_attrs['[property.picture]'])) {
+ $available_user_attrs['[property.picture]'] = array();
+ }
+ $available_user_attrs['[property.picture]'] = array(
+ 'name' => 'Property: Picture',
+ 'source' => '[' . $ldap_server->picture_attr . ']',
+ 'direction' => LDAP_USER_PROV_DIRECTION_TO_DRUPAL_USER,
+ 'enabled' => TRUE,
+ 'prov_events' => array(LDAP_USER_EVENT_CREATE_DRUPAL_USER, LDAP_USER_EVENT_SYNCH_TO_DRUPAL_USER),
+ 'config_module' => 'ldap_servers',
+ 'prov_module' => 'ldap_user',
+ ) + $available_user_attrs['[property.picture]'];
+ }
}
}
// debug('available_user_attrs2'); debug($available_user_attrs);
@@ -558,7 +581,6 @@ function _ldap_servers_get_simpletest_servers($sid, $type = NULL, $flatten, $res
$servers['enabled'][$_sid] = $ldap_server;
}
}
- // dpm('servers'); dpm($servers);
}
if ($sid) {
@@ -604,6 +626,30 @@ function ldap_servers_msguid($value) {
return $value;
}
+ /**
+ * Create a "binary safe" string for use in LDAP filters
+ * @param $value
+ * @return string
+ */
+function ldap_servers_binary_filter($value) {
+ $match = '';
+ if (preg_match('/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i', $value)) {
+ // Reconstruct proper "memory" order from (MS?) GUID string.
+ $hex_string = str_replace('-', '', $value);
+ $value = substr($hex_string, 6, 2) . substr($hex_string, 4, 2) .
+ substr($hex_string, 2, 2) . substr($hex_string, 0, 2) .
+ substr($hex_string, 10, 2) . substr($hex_string, 8, 2) .
+ substr($hex_string, 14, 2) . substr($hex_string, 12, 2) .
+ substr($hex_string, 16, 4) . substr($hex_string, 20, 12);
+ }
+
+ for ($i = 0; $i < strlen($value); $i = $i + 2 ) {
+ $match .= '\\' . substr($value, $i, 2);
+ }
+
+ return $match;
+}
+
/**
* general binary conversion function for guids
* tries to determine which approach based on length
@@ -629,7 +675,6 @@ function ldap_servers_binary($value) {
*/
function ldap_servers_get_user_ldap_data($drupal_user, $sid = NULL, $ldap_context = NULL) {
- //dpm("_ldap_servers_get_user_ldap_data, sid=$sid, ldap_context=$ldap_context"); dpm($drupal_user);
if (is_object($drupal_user) && property_exists($drupal_user, 'uid') && $authname = db_query("SELECT authname FROM {authmap} WHERE uid = :uid AND module = 'ldap_user'", array(':uid' => $drupal_user->uid))->fetchColumn()) {
$drupal_username = $authname;
@@ -659,7 +704,6 @@ function ldap_servers_get_user_ldap_data($drupal_user, $sid = NULL, $ldap_contex
$ldap_server = ($sid) ? ldap_servers_get_servers($sid, 'enabled', TRUE) : FALSE;
- // debug("ldap_servers_get_user_ldap_data,sid=$sid"); debug($ldap_server->entries['cn=hpotter,ou=people,dc=hogwarts,dc=edu']);
if ($ldap_server === FALSE) {
watchdog('ldap_servers', 'Failed to load server object %sid in _ldap_servers_get_user_ldap_data', array('%sid' => $sid), WATCHDOG_ERROR);
return FALSE;
@@ -678,34 +722,71 @@ function ldap_servers_get_user_ldap_data($drupal_user, $sid = NULL, $ldap_contex
}
/**
- * @param array $attribute in form array('values' => array(), 'data_type' => NULL) as outlined in ldap_user/README.developers.txt
- * @param enum string $data_type NULL, string, binary, ldap_dn, etc.
+ * @param array $attribute_map for a given attribute in form array('values' => array(), 'data_type' => NULL) as outlined in ldap_user/README.developers.txt
+ * @param enum string $conversion as type of conversion to do @see ldap_servers_convert_attribute(). e.g. base64_encode, bin2hex, msguid, md5
* @param array $values in form array(' . t('LDAP Servers store "LDAP server configurations" so other modules can connect to them and leverage their data. '); + $servers_help .= t('LDAP Authentication and LDAP Authorization are two such modules. Generally, only one LDAP Server configuration is needed. ') . '
'; + $servers_help .= '' . t('When multiple LDAP server configurations are needed, each is not necessarily a separate physical LDAP server; they may have different binding users or some other configuration difference. ') . '
'; switch ($path) { case 'admin/config/people/ldap/servers': - $output = '' . $servers_help . '
'; - return $output; - - case 'admin/help#ldap_servers': - $output = '' . $servers_help . '
'; + return $servers_help; + + case 'admin/help#ldap_servers': + $servers_help .= '' . t('Setup an LDAP server configuration to be used by other modules such as LDAP Authentication, LDAP Authorization, etc.') . '
'; + $output .= '' . t('More than one LDAP server configuration can exist for a physical LDAP server. Multiple configurations for the same physical ldap server are useful in cases such as: (1) different base dn\'s for authentication and authorization and (2) service accounts with different privileges for different purposes.') . '
'; return $output; } } diff --git a/ldap_servers/ldap_servers.test_form.inc b/ldap_servers/ldap_servers.test_form.inc index c56aa4a..d78c631 100644 --- a/ldap_servers/ldap_servers.test_form.inc +++ b/ldap_servers/ldap_servers.test_form.inc @@ -136,6 +136,8 @@ function ldap_servers_test_form($form, &$form_state, $op = NULL, $sid = NULL) { dpm("Drupal user entity for: $user_name"); dpm($user_entity); } + dpm("Test Group LDAP Entry"); + dpm($test_data['group_entry'][0]); } } } @@ -262,7 +264,7 @@ function ldap_servers_test_form_submit($form, &$form_state) { } $results_tables['basic'][] = array(t('Binding with DN (%bind_dn). Using supplied password ', array('%bind_dn' => $ldap_user['dn']))); - $result = $ldap_server->bind($ldap_user['dn'], $values['testing_drupal_userpw']); + $result = $ldap_server->bind($ldap_user['dn'], $values['testing_drupal_userpw'], FALSE); if ($result == LDAP_SUCCESS) { $results_tables['basic'][] = array(t('Successfully bound to server'), 'PASS'); } @@ -273,6 +275,9 @@ function ldap_servers_test_form_submit($form, &$form_state) { if (!$has_errors && isset($values['grp_test_grp_dn'])) { $group_dn = $values['grp_test_grp_dn']; + + $result = @ldap_read($ldap_server->connection, $group_dn, 'objectClass=*'); + $group_entry = ldap_get_entries($ldap_server->connection, $result); $user = isset($values['testing_drupal_username']) ? $values['testing_drupal_username'] : NULL; foreach (array(FALSE, TRUE) as $nested) { //FALSE @@ -333,6 +338,7 @@ function ldap_servers_test_form_submit($form, &$form_state) { } $form_state['ldap_server_test_data'] = array( 'username' => $values['testing_drupal_username'], + 'group_entry' => $group_entry, 'results_tables' => $results_tables, ); if (isset($ldap_user)) { @@ -359,7 +365,7 @@ function ldap_servers_test_binding_credentials(&$ldap_server, $bindpw, &$results } if (!$errors) { - $bind_result = $ldap_server->bind($ldap_server->binddn, $bindpw); + $bind_result = $ldap_server->bind($ldap_server->binddn, $bindpw, FALSE); if ($bind_result == LDAP_SUCCESS) { $results_tables['basic'][] = array(t('Successfully bound to server')); } diff --git a/ldap_servers/ldap_servers.tokens.inc b/ldap_servers/ldap_servers.tokens.inc index 0c121ed..8613f6b 100644 --- a/ldap_servers/ldap_servers.tokens.inc +++ b/ldap_servers/ldap_servers.tokens.inc @@ -5,11 +5,6 @@ * collection of functions related to ldap tokens */ -//define('LDAP_SERVERS_TOKEN_PRE', '['); -//define('LDAP_SERVERS_TOKEN_POST', ']'); -//define('LDAP_SERVERS_TOKEN_DEL', ':'); -//define('LDAP_SERVERS_TOKEN_MODIFIER_DEL', ';'); - /** * @param string $attr_name such 'field_user_lname', 'name', 'mail', 'dn' * @param string $attr_type such as 'field', 'property', etc. NULL for ldap attributes @@ -54,13 +49,18 @@ function ldap_servers_parse_user_attr_name($user_attr_key) { /** * @param array $ldap_entry - * @param string $text + * @param string $text such as "[dn]", "[cn]@my.org", "[displayName] [sn]", "Drupal Provisioned" * @return string $text with tokens replaced */ function ldap_servers_token_replace($resource, $text, $resource_type = 'ldap_entry') { // user_account $desired_tokens = ldap_servers_token_tokens_needed_for_template($text); + + if (empty($desired_tokens)) { + return $text; // if no tokens exist in text, return text itself. + } + switch ($resource_type) { case 'ldap_entry': @@ -72,29 +72,24 @@ function ldap_servers_token_replace($resource, $text, $resource_type = 'ldap_ent break; } + // add lowercase tokens to avoid case sensitivity foreach ($tokens as $attribute => $value) { $tokens[drupal_strtolower($attribute)] = $value; } - // If $text is not present as an attribute key, insert it and set the key's value to an empty string. - if (!array_key_exists(drupal_strtolower($text), $tokens)) { - $tokens[$text] = ''; - $tokens[drupal_strtolower($text)] = ''; - } - $attributes = array_keys($tokens); //array of attributes (sn, givenname, etc) $values = array_values($tokens); //array of attribute values (Lincoln, Abe, etc) $result = str_replace($attributes, $values, $text); - return $result; + $result = preg_replace('/\[[^\]]*>/', '', $result); // strip out any unreplace tokens + return ($result == '') ? NULL : $result; // return NULL if $result is empty, else $result } /** * @param array $attributes array of attributes passed by reference * @param string $text with tokens in it - * @param boolean $ignore_attr_count signifies if :1, :0, etc should be stripped off attribute. * - * by reference return add ldap attribute triplet array ("; print_r($this->ldapUserSynchMappings);
+
}
@@ -304,11 +303,11 @@ the top of this form.
if ($direction == LDAP_USER_PROV_DIRECTION_TO_DRUPAL_USER) {
$parent_fieldset = 'basic_to_drupal';
- $description = t('Provisioning from LDAP to Drupal Mapppings:');
+ $description = t('Provisioning from LDAP to Drupal Mappings:');
}
elseif ($direction == LDAP_USER_PROV_DIRECTION_TO_LDAP_ENTRY) {
$parent_fieldset = 'basic_to_ldap';
- $description = t('Provisioning from Drupal to LDAP Mapppings:');
+ $description = t('Provisioning from Drupal to LDAP Mappings:');
}
$form[$parent_fieldset]['mappings__' . $direction] = array(
@@ -324,13 +323,18 @@ the top of this form.
);
- $password_notes = <<
-- Pwd: Random -- Uses a random Drupal generated password
-- Pwd: User or Random -- Uses password supplied on user forms.
- If none available uses random password.
-