LDAP Authorization: MAC OS X: Authorization & nested groups

Following the first issue here MAC OSX and Role Authorization my investigation brought me further than only role authorization.

As mentioned, the following is available for OS X, and more precisely Mountain Lion server. I haven't tested with any other LDAP setup.

So here is the setup to make sure authorization is working.
Group settings:

1. Name of Group Object Class: apple-group
2. Nested groups are used in my LDAP: checked
3. LDAP Group Entry Attribute Holding User's DN, CN, etc.: apple-group-memberguid
4. User attribute held in "LDAP Group Entry Attribute Holding...": apple-generateduid

Authorization settings - role & og: the mapping is pretty simple - just map the dns of your groups with your roles, or with node:[nid]:[group-rid]

So these are the basic settings I could define. I tried a couple of other configurations (in the group settings, for example, by using member uid and uid for respectively "LDAP Group Entry Attribute Holding User's DN, CN, etc" and ""User attribute held in "LDAP Group Entry Attribute Holding...") - actually, just like this, none of them worked. But the settings above are in my opinion the optimal configuration that can go with the hack below.

Warning: as I said, I don't know about the side effects with other LDAP setup. This is a lead to enhance the module, either its code (in case there is actually a bug) or its documentation (in case I really missed something...).

So here is the hack: in LdapServer.class.php, change the groupMembershipsFromEntryResursive function with the one below:

/**
   * recurse through all groups, adding parent groups to $all_group_dns array.
   *
   * @param array $current_group_entries of ldap group entries that are starting point.  should include at least 1 entry.
   * @param array $all_group_dns as array of all groups user is a member of.  MIXED CASE VALUES
   * @param array $tested_group_ids as array of tested group dn, cn, uid, etc.  MIXED CASE VALUES
   *   whether these value are dn, cn, uid, etc depends on what attribute members, uniquemember, memberUid contains
   *   whatever attribute is in $this->$tested_group_ids to avoid redundant recursing
   * @param int $level of recursion
   * @param int $max_levels as max recursion allowed
   * @param array $user_ldap_entry as array of user properties from LDAP - new param from the HACK
   *
   * given set of groups entries ($current_group_entries such as it, hr, accounting),
   * find parent groups (such as staff, people, users) and add them to list of group memberships ($all_group_dns)
   *
   * (&(objectClass=[$this->groupObjectClass])(|([$this->groupMembershipsAttr]=groupid1)([$this->groupMembershipsAttr]=groupid2))
   *
   * @return FALSE for error or misconfiguration, otherwise TRUE.  results are passed by reference.
   */

  public function groupMembershipsFromEntryResursive($current_group_entries, &$all_group_dns, &$tested_group_ids, $level, $max_levels, $user_ldap_entry) {

    if (!$this->groupGroupEntryMembershipsConfigured || !is_array($current_group_entries) || count($current_group_entries) == 0) {
      return FALSE;
    }
    if (isset($current_group_entries['count'])) {
      unset($current_group_entries['count']);
    };
    $ors = array();
    foreach ($current_group_entries as $i => $group_entry) {
      if ($this->groupMembershipsAttrMatchingUserAttr == 'dn') {
        $member_id = $group_entry['dn'];
      }
      else {// maybe cn, uid, etc is held
        //HACK: we use the member id from the new variable.
        //$member_id = ldap_servers_get_first_rdn_value_from_dn($group_entry['dn'], $this->groupMembershipsAttrMatchingUserAttr);
        $member_id = $user_ldap_entry['attr'][$this->groupMembershipsAttrMatchingUserAttr][0];
      }
  //HACK: we go through nesting by adding a or condition in the ldap query. So we need to define the good condition, and make sure this is executed once per user id
  //    if ($member_id && !in_array($member_id, $tested_group_ids)) {
      if (!in_array($group_entry[$this->groupMembershipsAttrMatchingUserAttr][0], $tested_group_ids)) {
//HACK remove the count value
        if(isset($group_entry[$this->groupMembershipsAttrMatchingUserAttr]['count'])){
          unset($group_entry[$this->groupMembershipsAttrMatchingUserAttr]['count']);
        }

        //$tested_group_ids[] = $member_id;
//HACK we want to remember all the user ids
        foreach ($group_entry[$this->groupMembershipsAttrMatchingUserAttr] as $key => $uid) {
          $tested_group_ids[] = $uid;
//HACK and we want to setup the recursion: the recursion is held by a specific attribute - need to add it to the group setting form?
          $ors[] = 'apple-group-nestedgroup='.$uid;
        }

        $all_group_dns[] = $group_entry['dn'];
        // add $group_id (dn, cn, uid) to query
        //$ors[] =  $this->groupMembershipsAttr . '=' . $member_id;
      }
    }

    if (count($ors)) {
      $count = count($ors);
      for ($i=0; $i < $count; $i=$i+LDAP_SERVER_LDAP_QUERY_CHUNK) { // only 50 or so per query
        $current_ors = array_slice($ors, $i, LDAP_SERVER_LDAP_QUERY_CHUNK);
        //dpm("current_ors $i," . LDAP_SERVER_LDAP_QUERY_CHUNK); dpm($current_ors);
        $or = '(|(' . join(")(", $current_ors) . '))';  // e.g. (|(cn=group1)(cn=group2)) or   (|(dn=cn=group1,ou=blah...)(dn=cn=group2,ou=blah...))
        $query_for_parent_groups = '(&(objectClass=' . $this->groupObjectClass . ')' . $or . ')';


        // debug('query_for_parent_groups'); debug($query_for_parent_groups);
        foreach ($this->basedn as $base_dn) {  // need to search on all basedns one at a time
          $group_entries = $this->search($base_dn, $query_for_parent_groups);  // no attributes, just dns needed
          if ($group_entries !== FALSE  && $level < $max_levels) {
//HACK call the function with its new parameter
            $this->groupMembershipsFromEntryResursive($group_entries, $all_group_dns, $tested_group_ids, $level + 1, $max_levels, $user_ldap_entry);
          }
        }
      }
    }
//HACK actually return a value
    return TRUE;
  }

And then, in the only function calling this one, groupUserMembershipsFromEntry, line 1592:

        $this->groupMembershipsFromEntryResursive($group_entries, $all_group_dns, $tested_group_ids, $level, $max_levels, $user_ldap_entry);

I hope it is useful - it was the only way for me to make the authorization work with MAC OS X, OG, roles and nested groups, after one week of hair-pulling.