fernando/luos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merged in bugfix/HOR-3221 (pull request #6052)

Browse Source 
HOR-3221

Approved-by: Julio Cesar Laura Avendaño <contact@julio-laura.com>
This commit is contained in:
Roly
2017-09-25 20:36:16 +00:00
committed by Julio Cesar Laura Avendaño
parent a0f0d21e5a 5ef5c28d38
commit ac313f342c
3 changed files with 525 additions and 639 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
gulliver/system/class.rbac.php
View File

@@ -453,17 +453,24 @@ class RBAC
$plugin->sSystem = $this->sSystem;
//search the usersRolesObj
//create the users in ProcessMaker
try {
$res = $plugin->automaticRegister($aRow, $strUser, $strPass);
if ($res == 1) {
return $res;
}
} catch (Exception $e) {
$context = Bootstrap::getDefaultContextLog();
$context["action"] = "ldapSynchronize";
$context["authSource"] = $aRow;
Bootstrap::registerMonolog("ldapSynchronize", 400, $e->getMessage(), $context, $context["workspace"], "processmaker.log");
}
}
$oDataset->next();
$aRow = $oDataset->getRow();
}
}
}
return $result;
}
/**

142
workflow/engine/classes/LdapAdvanced.php
View File

@@ -1,5 +1,7 @@
<?php
use \ProcessMaker\BusinessModel\User;
/**
* class.ldapAdvanced.php
* LDAP plugin for the RBAC class. This
@@ -41,21 +43,17 @@ class LdapAdvanced
* @var Object
*/
private static $instance = null;
private $arrayObjectClassFilter = array(
"user" => "|(objectclass=inetorgperson)(objectclass=organizationalperson)(objectclass=person)(objectclass=user)",
"group" => "|(objectclass=posixgroup)(objectclass=group)(objectclass=groupofuniquenames)",
"department" => "|(objectclass=organizationalunit)"
);
private $arrayAttributes = array(
"ldap" => array("uid" => "uid", "member" => "memberuid"), //OpenLDAP
"ad" => array("uid" => "samaccountname", "member" => "member"), //Active Directory
"ds" => array("uid" => "uid", "member" => "uniquemember") //389 DS
);
private $arrayAttributesForUser = array("dn", "uid", "samaccountname", "givenname", "sn", "cn", "mail", "userprincipalname", "useraccountcontrol", "accountexpires", "manager");
private $frontEnd = false;
private $debug = false;
public $arrayAuthenticationSourceUsersByUid = array();
@@ -64,7 +62,6 @@ class LdapAdvanced
public $arrayDepartmentUsersByUsername = array();
public $arrayGroupUsersByUid = array();
public $arrayGroupUsersByUsername = array();
private $arrayDepartmentUserSynchronizedChecked = array();
private $arrayUserUpdateChecked = array();
@@ -371,7 +368,6 @@ class LdapAdvanced
unset($arrayCharacter[124]); //|
unset($arrayCharacter[126]); //~
unset($arrayCharacter[127]); //DEL
//Return
return array_unique($arrayCharacter);
} catch (Exception $e) {
@@ -449,9 +445,10 @@ class LdapAdvanced
*
* before the log was generated in shared/sites/<site> folder, but it was deprecated
* and now we are saving the log in shared/log the entry in the log file.
* @author Fernando Ontiveros Lira <fernando@colosa.com>
*
* @param Object $_link ldap connection
* @param String $text
* @return void
*/
public function log($link, $text)
{
@@ -501,7 +498,7 @@ class LdapAdvanced
/**
* This method generates the ldap connection bind and returns the link object
* for a determined authsource
* @author Fernando Ontiveros Lira <fernando@colosa.com>
*
* @param Array $aAuthSource the authsource data
* @return Object A object with the resulting ldap bind
*/
@@ -546,7 +543,7 @@ class LdapAdvanced
/**
* This method obtains the attributes of a ldap Connection passed as parameter
* @param Object $ldapcnn ldap connection
* @author Fernando Ontiveros Lira <fernando@colosa.com>
*
* @param Object $oEntry Entry object
* @return Array attributes
*/
@@ -804,14 +801,8 @@ class LdapAdvanced
*
* @return array Return array data
*/
private function __ldapGroupSynchronizeMembers(
$ldapcnn,
array $arrayAuthSourceData,
$groupUid,
array $arrayGroupLdap,
$memberAttribute,
array $arrayData = []
) {
private function __ldapGroupSynchronizeMembers($ldapcnn, array $arrayAuthSourceData, $groupUid, array $arrayGroupLdap, $memberAttribute, array $arrayData = [])
{
try {
unset($arrayData['countMembers']);
@@ -862,8 +853,7 @@ class LdapAdvanced
//Progress bar
$this->frontEndShow(
'BAR',
'Groups: ' . $arrayData['i'] . '/' . $arrayData['n'] . ' ' .
'BAR', 'Groups: ' . $arrayData['i'] . '/' . $arrayData['n'] . ' ' .
$this->progressBar($arrayData['totalUser'], $arrayData['countUser'])
);
}
@@ -954,12 +944,7 @@ class LdapAdvanced
}
$arrayData = $this->__ldapGroupSynchronizeMembers(
$ldapcnn,
$arrayAuthenticationSourceData,
$arrayGroupData['GRP_UID'],
$arrayGroupLdap,
$memberAttribute2,
array_merge($arrayData, ['totalUser' => $totalUser, 'countUser' => $countUser])
$ldapcnn, $arrayAuthenticationSourceData, $arrayGroupData['GRP_UID'], $arrayGroupLdap, $memberAttribute2, array_merge($arrayData, ['totalUser' => $totalUser, 'countUser' => $countUser])
);
$totalUser = $arrayData['totalUser'];
@@ -992,12 +977,7 @@ class LdapAdvanced
}
$arrayData = $this->__ldapGroupSynchronizeMembers(
$ldapcnn,
$arrayAuthenticationSourceData,
$arrayGroupData['GRP_UID'],
$arrayGroupLdap,
$memberAttribute2,
array_merge($arrayData, ['totalUser' => $totalUser, 'countUser' => $countUser])
$ldapcnn, $arrayAuthenticationSourceData, $arrayGroupData['GRP_UID'], $arrayGroupLdap, $memberAttribute2, array_merge($arrayData, ['totalUser' => $totalUser, 'countUser' => $countUser])
);
$totalUser = $arrayData['totalUser'];
@@ -1026,7 +1006,7 @@ class LdapAdvanced
* This method authentifies if a user has the RBAC_user privileges
* also verifies if the user has the rights to start an application
*
* @author Fernando Ontiveros Lira <fernando@colosa.com>
*
* @access public
* @param string $strUser UserId (user login)
@@ -1098,24 +1078,21 @@ class LdapAdvanced
$usrName = $row["USR_USERNAME"];
$usrUid = $row["USR_UID"];
$userDn = $strUser;
//Get the AuthSource properties
//Check if the dn in the database record matches with the dn for the ldap account
$verifiedUser = $this->searchUserByUid(
$usrName,
$arrayAuthSource["AUTH_SOURCE_DATA"]["AUTH_SOURCE_IDENTIFIER_FOR_USER"]
);
try {
$verifiedUser = $this->searchUserByUid($usrName, $arrayAuthSource["AUTH_SOURCE_DATA"]["AUTH_SOURCE_IDENTIFIER_FOR_USER"]);
if (empty($verifiedUser) || trim($verifiedUser["sDN"]) == null) {
return -1;
}
$userDn = $strUser;
if ($verifiedUser["sDN"] != $strUser || $setAttributes == 1) {
$userDn = $verifiedUser['sDN'];
//Update data
$user = new \ProcessMaker\BusinessModel\User();
$user = new User();
$arrayUserData = $user->getUserRecordByPk($usrUid, [], false);
$result = $this->__ldapUserUpdateByDnAndData(
@@ -1134,6 +1111,12 @@ class LdapAdvanced
BasePeer::doUpdate($c1, $c2, $con);
}
} catch (Exception $e) {
$context = Bootstrap::getDefaultContextLog();
$context["action"] = "ldapSynchronize";
$context["authSource"] = $arrayAuthSource;
Bootstrap::registerMonolog("ldapSynchronize", 400, $e->getMessage(), $context, $context["workspace"], "processmaker.log");
}
//Check ldap connection for user
$arrayAuthSource["AUTH_ANONYMOUS"] = "0";
@@ -1169,7 +1152,7 @@ class LdapAdvanced
$c1->add(RbacUsersPeer::USR_AUTH_USER_DN, $strUser);
// update set
$c2 = new Criteria("rbac");
$c2->add(RbacUsersPeer::USR_AUTH_USER_DN, $verifiedUser["sDN"]);
$c2->add(RbacUsersPeer::USR_AUTH_USER_DN, $userDn);
$c2->add(RbacUsersPeer::USR_STATUS, $statusRbac);
BasePeer::doUpdate($c1, $c2, $con);
$columnsWf = array();
@@ -1186,7 +1169,7 @@ class LdapAdvanced
}
//Check if the user is in the terminated organizational unit
if ($this->userIsTerminated($usrName, $attributes["AUTH_SOURCE_RETIRED_OU"])) {
if (!empty($verifiedUser) && $this->userIsTerminated($usrName, $attributes["AUTH_SOURCE_RETIRED_OU"])) {
$this->deactivateUser($usrName);
$this->log($ldapcnn, "user $strUser is member of Remove OU, deactivating this user.");
@@ -1198,7 +1181,7 @@ class LdapAdvanced
}
if ($validUserPass == 1) {
$this->log($ldapcnn, "sucessful login user " . $verifiedUser["sDN"]);
$this->log($ldapcnn, "sucessful login user " . $userDn);
} else {
$this->log($ldapcnn, "failure authentication for user $strUser");
}
@@ -1261,8 +1244,7 @@ class LdapAdvanced
$attributeUserSet = array();
$attributeSetAdd = array();
if (isset($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"])
&& !empty($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"])
if (isset($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"]) && !empty($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"])
) {
foreach ($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"] as $value) {
$attributeSetAdd[] = $value['attributeLdap'];
@@ -1395,18 +1377,8 @@ class LdapAdvanced
} while (($oEntry = ldap_next_entry($ldapcnn, $oEntry)) && $flagNextRecord);
}
}
/*
$sUsers = "found $countEntries users: ";
foreach ($aUsers as $key => $val) {
$sUsers .= $val['sUsername'] . ' ';
}
$this->log($ldapcnn, $sUsers);
*/
}
//Return
return ($paged) ? array("numRecTotal" => $totalUser, "data" => $arrayUser) : $arrayUser;
}
@@ -1424,7 +1396,6 @@ class LdapAdvanced
//Set variables
$rbac = &RBAC::getSingleton();
//$rbac->userObj = new RbacUsers();
if (is_null($rbac->authSourcesObj)) {
$rbac->authSourcesObj = new AuthenticationSource();
@@ -1442,8 +1413,7 @@ class LdapAdvanced
$attributeUserSet = array();
$attributeSetAdd = array();
if (isset($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"])
&& !empty($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"])
if (isset($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"]) && !empty($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"])
) {
foreach ($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"] as $value) {
$attributeSetAdd[] = $value["attributeLdap"];
@@ -1524,7 +1494,6 @@ class LdapAdvanced
}
}
//Return
return $arrayUserData;
} catch (Exception $e) {
throw $e;
@@ -1716,7 +1685,6 @@ class LdapAdvanced
$this->log($ldapcnn, 'found ' . count($arrayDepartment) . ' departments: ' . $str);
//Return
return $arrayDepartment;
} catch (Exception $e) {
throw $e;
@@ -1734,7 +1702,7 @@ class LdapAdvanced
$aUsers = array();
$rbac = &RBAC::getSingleton();
//$rbac->userObj = new RbacUsers();
$rbac->authSourcesObj = new AuthenticationSource();
$aAuthSource = $rbac->authSourcesObj->load($this->sAuthSource);
@@ -1758,7 +1726,6 @@ class LdapAdvanced
$aAttr = $this->ldapGetAttributes($ldapcnn, $oEntry);
$aUsers[] = $this->ldapGetUsersFromDepartment("GET", $aAttr["dn"]);
} while ($oEntry = ldap_next_entry($ldapcnn, $oEntry));
//$this->createDepartments ($aDepts);
}
}
return $aUsers;
@@ -1821,7 +1788,6 @@ class LdapAdvanced
$arrayData[$row["DEP_UID"]] = $row["NUM_REC"];
}
//Return
return $arrayData;
} catch (Exception $e) {
throw $e;
@@ -1842,7 +1808,6 @@ class LdapAdvanced
return $terminated;
}
/* activate an user previously deactivated
if user is now in another department, we need the second parameter, the depUid
@@ -1850,6 +1815,7 @@ class LdapAdvanced
@param string optional department DN
@param string optional DepUid
*/
public function activateUser($userUid, $userDn = null, $depUid = null)
{
if (!class_exists('RbacUsers')) {
@@ -1985,31 +1951,10 @@ class LdapAdvanced
$arrayLdapDepartment[0]["ou"] = $arrayLdapDepartment[0]["ou"] . " " . $arrayLdapDepartment[0]["dn"]; //Discard ROOT
foreach ($arrayLdapDepartment as $ldapDept) {
//$flagExists = false;
//
//foreach ($aResult as $value2) {
// $arrayDepartmentData = $value2;
//
// if ($arrayDepartmentData["DEP_LDAP_DN"] == $ldapDept["dn"]) {
// $flagExists = true;
// break;
// }
//}
//
//if ($flagExists) {
// continue;
//}
foreach ($arrayDbDepartment as $department) {
if ($department["DEP_TITLE"] == $ldapDept["ou"] && $department["DEP_LDAP_DN"] == $ldapDept["dn"]) {
$aResult[] = $department;
break;
//if ($department["HAS_CHILDREN"] != 0) {
// $aTempDepartments = $this->getDepartments($department["DEP_UID"]);
// $aTempRegistered = $this->getRegisteredDepartments($arrayLdapDepartment, $aTempDepartments);
// $aResult = array_merge($aResult, $aTempRegistered);
//}
}
}
}
@@ -2345,7 +2290,6 @@ class LdapAdvanced
$this->log($ldapcnn, 'found ' . count($arrayGroup) . ' groups: ' . $str);
//Return
return $arrayGroup;
} catch (Exception $e) {
throw $e;
@@ -2357,7 +2301,6 @@ class LdapAdvanced
* @param <type> $currentDN
* @return <type>
*/
public function getGrpUidIfExistsDN($currentDN)
{
try {
@@ -2407,7 +2350,6 @@ class LdapAdvanced
$arrayData[$row["GRP_UID"]] = $row["NUM_REC"];
}
//Return
return $arrayData;
} catch (Exception $e) {
throw $e;
@@ -2471,14 +2413,13 @@ class LdapAdvanced
/**
* Convert 18-digit LDAP timestamps to format PM
*
* @author Ronald Escobar <ronald@colosa.com>
* @param Date | $dateAD | Date of AD ('Windows NT time format' and 'Win32 FILETIME or SYSTEMTIME')
* @param Date | $datePM | Date of PM
*/
public function convertDateADtoPM($dateAD)
{
$unixTimestamp = ($dateAD / 10000000) - 11644560000;
$datePM = date('Y-m-d', mktime(0, 0, 0, date('m'), '01', date('Y') + 2));//(date('Y') + 10)."-12-01";
$datePM = date('Y-m-d', mktime(0, 0, 0, date('m'), '01', date('Y') + 2));
if ($unixTimestamp > 0) {
$dateAux = date("Y-m-d", $unixTimestamp);
$yearAux = date("Y", $unixTimestamp);
@@ -2539,7 +2480,6 @@ class LdapAdvanced
//If user DO NOT exists in this department.. do:
//If exists with another AuthSource -> impossible
//If exists in another department, but in PM and for this authsource, we need to move it
//$arrayNewUserData = $this->searchUserByUid($arrayUserLdap["sUsername"]);
$arrayNewUserData = $arrayUserLdap;
@@ -2603,7 +2543,6 @@ class LdapAdvanced
$this->debugLog("class.ldapAdvanced.php > function departmentSynchronizeUser() > \$userUid ----> $userUid");
$this->debugLog("class.ldapAdvanced.php > function departmentSynchronizeUser() > END");
//Return
return $arrayData;
} catch (Exception $e) {
throw $e;
@@ -2646,7 +2585,6 @@ class LdapAdvanced
//If user DO NOT exists in this group.. do:
//If exists with another AuthSource -> impossible
//If exists in another group, but in PM and for this authsource, we need to move it
//$arrayNewUserData = $this->searchUserByUid($arrayUserLdap["sUsername"]);
$arrayNewUserData = $arrayUserLdap;
@@ -2815,8 +2753,7 @@ class LdapAdvanced
}
} else {
$this->log(
$ldapcnn,
'User is repeated: Username "' . $username .'", DN "' . $arrayUserLdap['dn'] . '"'
$ldapcnn, 'User is repeated: Username "' . $username . '", DN "' . $arrayUserLdap['dn'] . '"'
);
}
@@ -2844,13 +2781,8 @@ class LdapAdvanced
*
* @return array
*/
private function __ldapUsersUpdateData(
$ldapcnn,
array $arrayAuthSourceData,
$filterUsers,
array $arrayUserUid,
array $arrayData
) {
private function __ldapUsersUpdateData($ldapcnn, array $arrayAuthSourceData, $filterUsers, array $arrayUserUid, array $arrayData)
{
try {
$totalUser = $arrayData['totalUser'];
$countUser = $arrayData['countUser'];
@@ -2870,7 +2802,6 @@ class LdapAdvanced
$criteria = new Criteria('workflow');
$criteria->add(UsersPeer::USR_UID, $arrayUserUid, Criteria::IN);
//$criteria->add(UsersPeer::USR_USERNAME, '', Criteria::NOT_EQUAL);
$criteria->add(UsersPeer::USR_STATUS, 'CLOSED', Criteria::NOT_EQUAL);
$rsCriteria = UsersPeer::doSelectRS($criteria);
@@ -2894,15 +2825,13 @@ class LdapAdvanced
//Progress bar
$this->frontEndShow(
'BAR',
'Update Users data: ' . $countUser . '/' . $totalUser . ' ' . $this->progressBar($totalUser, $countUser)
'BAR', 'Update Users data: ' . $countUser . '/' . $totalUser . ' ' . $this->progressBar($totalUser, $countUser)
);
}
} while ($entry = ldap_next_entry($ldapcnn, $entry));
}
}
//Return
return [$totalUser, $countUser];
} catch (Exception $e) {
throw $e;
@@ -3017,7 +2946,6 @@ class LdapAdvanced
}
}
//Return
return $limit;
} catch (Exception $e) {
throw $e;

63
workflow/engine/methods/services/ldapadvanced.php
View File

@@ -60,18 +60,13 @@ class ldapadvancedClassCron
$aDepartments = $plugin->getDepartments("");
$aGroups = $plugin->getGroups();
//$arrayDepartmentUserAd = array(); //(D) Update Users
//$arrayGroupUserAd = array(); //(G) Update Users
//echo "\n";
$plugin->frontEndShow("START");
$plugin->debugLog("START");
foreach ($arrayAuthenticationSource as $value) {
$arrayAuthenticationSourceData = $value;
try {
$plugin->debugLog("ldapadvanced.php > function executeCron() > foreach > \$arrayAuthenticationSourceData ---->\n" . print_r($arrayAuthenticationSourceData, true));
$plugin->sAuthSource = $arrayAuthenticationSourceData["AUTH_SOURCE_UID"];
@@ -141,17 +136,6 @@ class ldapadvancedClassCron
foreach ($aRegisteredDepts as $registeredDept) {
$count++;
//(D) Update Users
//if (!isset($arrayDepartmentUserAd[$registeredDept["DEP_UID"]])) {
// $arrayDepartmentUserAd[$registeredDept["DEP_UID"]] = array(); //Current users in department based in Active Directory
//}
//
//$arrayAux = $this->departmentSynchronizeUsers($plugin, $numDepartments, $count, $registeredDept);
//$arrayAux = array_merge($arrayDepartmentUserAd[$registeredDept["DEP_UID"]], $arrayAux);
//
//$arrayDepartmentUserAd[$registeredDept["DEP_UID"]] = array_unique($arrayAux);
$arrayAux = $this->departmentSynchronizeUsers($plugin, $numDepartments, $count, $registeredDept);
}
@@ -177,17 +161,6 @@ class ldapadvancedClassCron
foreach ($aRegisteredGroups as $registeredGroup) {
$count++;
//(G) Update Users
//if (!isset($arrayGroupUserAd[$registeredGroup["GRP_UID"]])) {
// $arrayGroupUserAd[$registeredGroup["GRP_UID"]] = array(); //Current users in group based in Active Directory
//}
//
//$arrayAux = $this->groupSynchronizeUsers($plugin, $numGroups, $count, $registeredGroup);
//$arrayAux = array_merge($arrayGroupUserAd[$registeredGroup["GRP_UID"]], $arrayAux);
//
//$arrayGroupUserAd[$registeredGroup["GRP_UID"]] = array_unique($arrayAux);
$arrayAux = $this->groupSynchronizeUsers($plugin, $numGroups, $count, $registeredGroup);
}
@@ -386,37 +359,15 @@ class ldapadvancedClassCron
//Update Users data based on the LDAP Server
$plugin->usersUpdateData($arrayAuthenticationSourceData["AUTH_SOURCE_UID"]);
} catch (Exception $e) {
$context = Bootstrap::getDefaultContextLog();
$context["action"] = "ldapSynchronize";
$context["authSource"] = $arrayAuthenticationSourceData;
Bootstrap::registerMonolog("ldapSynchronize", 400, $e->getMessage(), $context, $context["workspace"], "processmaker.log");
}
}
$plugin->frontEndShow("END");
//(D) Update Users
////Department //Upgrade users in departments
//foreach ($arrayDepartmentUserAd as $departmentUid => $arrayUserAd) {
// $plugin->setArrayDepartmentUsers($departmentUid); //INITIALIZE DATA
//
// $arrayAux = array_diff(array_keys($plugin->arrayDepartmentUsersByUid), $arrayUserAd);
//
// $this->departmentRemoveUsers($departmentUid, $arrayAux);
//}
//(G) Update Users
////Group //Upgrade users in groups
//foreach ($arrayGroupUserAd as $groupUid => $arrayUserAd) {
// $plugin->setArrayGroupUsers($groupUid); //INITIALIZE DATA
//
// $arrayAux = array_diff(array_keys($plugin->arrayGroupUsersByUid), $arrayUserAd);
//
// $this->groupRemoveUsers($groupUid, $arrayAux);
//}
//// Developed by Gary and Ronald
//$usersInfo = $plugin->ASUpdateInfo('');
//if (isset($usersInfo) && $usersInfo > 0) {
// $this->dMoved = $usersInfo;
//}
//// End Developed by Gary and Ronald
$plugin->debugLog("END");
}