e3597b5f32
Issue:
[Mantis - 21075 - 20786 - 21397]Running ldapcron.php removes Vacation status
Cause:
El estado "VACATION" no existe en ActiveDirectory (Esto hasta donde se pudo investigar/revisar)
Solution:
El estado "VACATION" se mantiene en ProcessMaker (Cuando el estado es "ACTIVO" en ActiveDirectory), el resto de los
estados son sincronizados segun el requerimiento descrito en el card
3056 lines
114 KiB
PHP
3056 lines
114 KiB
PHP
<?php
|
|
/**
|
|
* class.ldapAdvanced.php
|
|
* LDAP plugin for the RBAC class. This class encapsulates all the methods required in order to bind
|
|
* ProcessMaker and a Ldap Directory server.
|
|
*
|
|
* @author
|
|
* Fernando Ontiveros
|
|
* Colosa
|
|
* @copyright
|
|
* Copyright (C) 2004 - 2008 Colosa Inc.
|
|
* @package plugins.ldapAdvanced.classes
|
|
*/
|
|
|
|
// evaluating the requiring of some classes
|
|
if (!class_exists("Department")) {
|
|
require_once "classes/model/Department.php";
|
|
}
|
|
|
|
if (!class_exists("Groupwf")) {
|
|
require_once "classes/model/Groupwf.php";
|
|
}
|
|
|
|
if (!class_exists("GroupUser")) {
|
|
require_once "classes/model/GroupUser.php";
|
|
}
|
|
|
|
if (!class_exists("RbacUsers")) {
|
|
require_once PATH_RBAC."model/RbacUsers.php";
|
|
}
|
|
|
|
if (!class_exists("RBAC")) {
|
|
require_once PATH_TRUNK . "gulliver/system/class.rbac.php";
|
|
}
|
|
|
|
class ldapAdvanced
|
|
{
|
|
/**
|
|
* The authsource id
|
|
* @var String
|
|
*/
|
|
public $sAuthSource = "";
|
|
|
|
/**
|
|
* The organizational unit where the removed users are put into
|
|
* @var String
|
|
*/
|
|
public $sTerminatedOu = "";
|
|
|
|
/**
|
|
* a local variable to store connection with LDAP, and avoid multiple bindings
|
|
* @var String
|
|
*/
|
|
public $ldapcnn = null;
|
|
|
|
/**
|
|
* The users information array
|
|
* @var Array
|
|
*/
|
|
public $aUserInfo = array();
|
|
|
|
/**
|
|
* System information
|
|
* @var String
|
|
*/
|
|
public $sSystem = "";
|
|
|
|
/**
|
|
* Object where an rbac instance is set
|
|
* @var Object
|
|
*/
|
|
static private $instance = null;
|
|
|
|
private $arrayObjectClassFilter = array(
|
|
"user" => "|(objectclass=inetorgperson)(objectclass=organizationalperson)(objectclass=person)(objectclass=user)",
|
|
"group" => "|(objectclass=posixgroup)(objectclass=group)(objectclass=groupofuniquenames)",
|
|
"department" => "|(objectclass=organizationalunit)"
|
|
);
|
|
|
|
private $arrayAttributes = array(
|
|
"ldap" => array("uid" => "uid", "member" => "memberuid"), //OpenLDAP
|
|
"ad" => array("uid" => "samaccountname", "member" => "member"), //Active Directory
|
|
"ds" => array("uid" => "uid", "member" => "uniquemember") //389 DS
|
|
);
|
|
|
|
private $arrayAttributesForUser = array("dn", "uid", "samaccountname", "givenname", "sn", "cn", "mail", "userprincipalname", "useraccountcontrol", "accountexpires", "manager");
|
|
|
|
private $frontEnd = false;
|
|
private $debug = false;
|
|
public $arrayAuthenticationSourceUsersByUid = array();
|
|
public $arrayAuthenticationSourceUsersByUsername = array();
|
|
public $arrayDepartmentUsersByUid = array();
|
|
public $arrayDepartmentUsersByUsername = array();
|
|
public $arrayGroupUsersByUid = array();
|
|
public $arrayGroupUsersByUsername = array();
|
|
|
|
private $arrayDepartmentUserSynchronizedChecked = array();
|
|
private $arrayUserUpdateChecked = array();
|
|
|
|
/**
|
|
* default constructor method
|
|
*/
|
|
public function __construct()
|
|
{
|
|
}
|
|
|
|
/**
|
|
* Set front end flag
|
|
*
|
|
* @param bool $flag Flag
|
|
*
|
|
* return void
|
|
*/
|
|
public function setFrontEnd($flag)
|
|
{
|
|
try {
|
|
$this->frontEnd = $flag;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Set debug
|
|
*
|
|
* @param bool $debug Flag for debug
|
|
*
|
|
* return void
|
|
*/
|
|
public function setDebug($debug)
|
|
{
|
|
try {
|
|
$this->debug = $debug;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Set Users that was registered with this Authentication Source
|
|
*
|
|
* @param string $authenticationSourceUid UID of Authentication Source
|
|
*
|
|
* return void
|
|
*/
|
|
public function setArrayAuthenticationSourceUsers($authenticationSourceUid)
|
|
{
|
|
try {
|
|
$this->arrayAuthenticationSourceUsersByUid = array();
|
|
$this->arrayAuthenticationSourceUsersByUsername = array();
|
|
|
|
//Set data
|
|
$criteria = new Criteria("rbac");
|
|
|
|
$criteria->addSelectColumn(RbacUsersPeer::USR_UID);
|
|
$criteria->addSelectColumn(RbacUsersPeer::USR_USERNAME);
|
|
$criteria->addSelectColumn(RbacUsersPeer::USR_AUTH_USER_DN);
|
|
$criteria->add(RbacUsersPeer::UID_AUTH_SOURCE, $authenticationSourceUid, Criteria::EQUAL);
|
|
$criteria->add(RbacUsersPeer::USR_AUTH_TYPE, "ldapadvanced", Criteria::EQUAL);
|
|
//$criteria->add(RbacUsersPeer::USR_STATUS, 1, Criteria::EQUAL);
|
|
|
|
$rsCriteria = RbacUsersPeer::doSelectRS($criteria);
|
|
$rsCriteria->setFetchmode(\ResultSet::FETCHMODE_ASSOC);
|
|
|
|
while ($rsCriteria->next()) {
|
|
$row = $rsCriteria->getRow();
|
|
|
|
$this->arrayAuthenticationSourceUsersByUid[$row["USR_UID"]] = $row;
|
|
$this->arrayAuthenticationSourceUsersByUsername[$row["USR_USERNAME"]] = $row;
|
|
}
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Set User to this Authentication Source
|
|
*
|
|
* @param string $userUid UID of User
|
|
* @param array $arrayUserLdap User LDAP data
|
|
*
|
|
* return void
|
|
*/
|
|
public function setArrayAuthenticationSourceUser($userUid, array $arrayUserLdap)
|
|
{
|
|
try {
|
|
$arrayUserData = array(
|
|
"USR_UID" => $userUid,
|
|
"USR_USERNAME" => $arrayUserLdap["sUsername"],
|
|
"USR_AUTH_USER_DN" => $arrayUserLdap["sDN"]
|
|
);
|
|
|
|
//Set data
|
|
$this->arrayAuthenticationSourceUsersByUid[$arrayUserData["USR_UID"]] = $arrayUserData;
|
|
$this->arrayAuthenticationSourceUsersByUsername[$arrayUserData["USR_USERNAME"]] = $arrayUserData;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Set Users of the Department
|
|
*
|
|
* @param string $departmentUid UID of Department
|
|
*
|
|
* return void
|
|
*/
|
|
public function setArrayDepartmentUsers($departmentUid)
|
|
{
|
|
try {
|
|
$this->arrayDepartmentUsersByUid = array();
|
|
$this->arrayDepartmentUsersByUsername = array();
|
|
|
|
//Set data
|
|
$criteria = new Criteria("workflow");
|
|
|
|
$criteria->addSelectColumn(UsersPeer::USR_UID);
|
|
$criteria->addSelectColumn(UsersPeer::USR_USERNAME);
|
|
$criteria->addSelectColumn(UsersPeer::USR_REPORTS_TO);
|
|
$criteria->add(UsersPeer::DEP_UID, $departmentUid, Criteria::EQUAL);
|
|
$criteria->add(UsersPeer::USR_STATUS, "CLOSED", Criteria::NOT_EQUAL);
|
|
|
|
$rsCriteria = UsersPeer::doSelectRS($criteria);
|
|
$rsCriteria->setFetchmode(\ResultSet::FETCHMODE_ASSOC);
|
|
|
|
while ($rsCriteria->next()) {
|
|
$row = $rsCriteria->getRow();
|
|
|
|
$this->arrayDepartmentUsersByUid[$row["USR_UID"]] = $row;
|
|
$this->arrayDepartmentUsersByUsername[$row["USR_USERNAME"]] = $row;
|
|
}
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Set Users of the Group
|
|
*
|
|
* @param string $groupUid UID of Group
|
|
*
|
|
* return void
|
|
*/
|
|
public function setArrayGroupUsers($groupUid)
|
|
{
|
|
try {
|
|
$this->arrayGroupUsersByUid = array();
|
|
$this->arrayGroupUsersByUsername = array();
|
|
|
|
//Set data
|
|
$criteria = new Criteria("workflow");
|
|
|
|
$criteria->addSelectColumn(GroupUserPeer::GRP_UID);
|
|
$criteria->addSelectColumn(GroupUserPeer::USR_UID);
|
|
$criteria->addSelectColumn(UsersPeer::USR_USERNAME);
|
|
$criteria->addSelectColumn(UsersPeer::USR_REPORTS_TO);
|
|
$criteria->addJoin(GroupUserPeer::USR_UID, UsersPeer::USR_UID, Criteria::LEFT_JOIN);
|
|
$criteria->add(GroupUserPeer::GRP_UID, $groupUid, Criteria::EQUAL);
|
|
$criteria->add(UsersPeer::USR_STATUS, "CLOSED", Criteria::NOT_EQUAL);
|
|
|
|
$rsCriteria = GroupUserPeer::doSelectRS($criteria);
|
|
$rsCriteria->setFetchmode(\ResultSet::FETCHMODE_ASSOC);
|
|
|
|
while ($rsCriteria->next()) {
|
|
$row = $rsCriteria->getRow();
|
|
|
|
$this->arrayGroupUsersByUid[$row["USR_UID"]] = $row;
|
|
$this->arrayGroupUsersByUsername[$row["USR_USERNAME"]] = $row;
|
|
}
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Set data to array of Users synchronized (Department)
|
|
*
|
|
* @param array $arrayData Data
|
|
*
|
|
* return void
|
|
*/
|
|
public function setArrayDepartmentUserSynchronizedChecked(array $arrayData)
|
|
{
|
|
try {
|
|
$this->arrayDepartmentUserSynchronizedChecked = $arrayData;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Set data to array of updated Users
|
|
*
|
|
* @param array $arrayData Data
|
|
*
|
|
* return void
|
|
*/
|
|
public function setArrayUserUpdateChecked(array $arrayData)
|
|
{
|
|
try {
|
|
$this->arrayUserUpdateChecked = $arrayData;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* This method gets the singleton Rbac instance.
|
|
* @return Object instance of the rbac class
|
|
*/
|
|
public function &getSingleton()
|
|
{
|
|
if (self::$instance == null) {
|
|
self::$instance = new RBAC();
|
|
}
|
|
|
|
return self::$instance;
|
|
}
|
|
|
|
/**
|
|
* Progress bar
|
|
*
|
|
* @param int $total Total
|
|
* @param int $count Count
|
|
*
|
|
* return string Return a string that represent progress bar
|
|
*/
|
|
public function progressBar($total, $count)
|
|
{
|
|
try {
|
|
$p = (int)(($count * 100) / $total);
|
|
$n = (int)($p / 2);
|
|
|
|
return "[" . str_repeat("|", $n) . str_repeat(" ", 50 - $n) . "] $p%";
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Show front end
|
|
*
|
|
* @param string $option Option
|
|
* @param string $data Data string
|
|
*
|
|
* return void
|
|
*/
|
|
public function frontEndShow($option, $data = "")
|
|
{
|
|
try {
|
|
if (!$this->frontEnd) {
|
|
return;
|
|
}
|
|
|
|
$numc = 100;
|
|
|
|
switch ($option) {
|
|
case "BAR":
|
|
echo "\r" . "| " . $data . str_repeat(" ", $numc - 2 - strlen($data));
|
|
break;
|
|
case "TEXT":
|
|
echo "\r" . "| " . $data . str_repeat(" ", $numc - 2 - strlen($data)) . "\n";
|
|
break;
|
|
default:
|
|
//START, END
|
|
echo "\r" . "+" . str_repeat("-", $numc - 2) . "+" . "\n";
|
|
break;
|
|
}
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get valid characteres
|
|
*
|
|
* return array Return an array with valid characteres
|
|
*/
|
|
public function characters()
|
|
{
|
|
try {
|
|
$arrayCharacter = array();
|
|
|
|
for ($i = 33; $i <= 127; $i++) {
|
|
$char = trim(strtolower(chr($i)));
|
|
|
|
if ($char != "") {
|
|
$arrayCharacter[$i] = $char;
|
|
}
|
|
}
|
|
|
|
unset($arrayCharacter[33]); //!
|
|
unset($arrayCharacter[38]); //&
|
|
unset($arrayCharacter[40]); //(
|
|
unset($arrayCharacter[41]); //)
|
|
unset($arrayCharacter[42]); //*
|
|
unset($arrayCharacter[60]); //<
|
|
unset($arrayCharacter[61]); //=
|
|
unset($arrayCharacter[62]); //>
|
|
unset($arrayCharacter[124]); //|
|
|
unset($arrayCharacter[126]); //~
|
|
unset($arrayCharacter[127]); //DEL
|
|
|
|
//Return
|
|
return array_unique($arrayCharacter);
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get User data, if Username was registered with this Authentication Source
|
|
*
|
|
* @param string $username Username
|
|
*
|
|
* return array Return User data, if Username was registered with this Authentication Source; empty data otherwise
|
|
*/
|
|
public function authenticationSourceGetUserDataIfUsernameExists($username)
|
|
{
|
|
try {
|
|
if (isset($this->arrayAuthenticationSourceUsersByUsername[$username])) {
|
|
return $this->arrayAuthenticationSourceUsersByUsername[$username];
|
|
}
|
|
|
|
return array();
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get User data, if Username exists in Department
|
|
*
|
|
* @param string $username Username
|
|
*
|
|
* return array Return User data, if Username exists in Department; empty data otherwise
|
|
*/
|
|
public function departmentGetUserDataIfUsernameExists($username)
|
|
{
|
|
try {
|
|
if (isset($this->arrayDepartmentUsersByUsername[$username])) {
|
|
return $this->arrayDepartmentUsersByUsername[$username];
|
|
}
|
|
|
|
return array();
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get User data, if Username exists in Group
|
|
*
|
|
* @param string $username Username
|
|
*
|
|
* return array Return User data, if Username exists in Group; empty data otherwise
|
|
*/
|
|
public function groupGetUserDataIfUsernameExists($username)
|
|
{
|
|
try {
|
|
if (isset($this->arrayGroupUsersByUsername[$username])) {
|
|
return $this->arrayGroupUsersByUsername[$username];
|
|
}
|
|
|
|
return array();
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
public function getFieldsForPageSetup()
|
|
{
|
|
return array();
|
|
}
|
|
|
|
/**
|
|
* add a line in the ldap log
|
|
*
|
|
* before the log was generated in shared/sites/<site> folder, but it was deprecated
|
|
* and now we are saving the log in shared/log the entry in the log file.
|
|
* @author Fernando Ontiveros Lira <fernando@colosa.com>
|
|
* @param Object $_link ldap connection
|
|
* @param String $text
|
|
*/
|
|
public function log($link, $text)
|
|
{
|
|
//$serverAddr = $_SERVER["SERVER_ADDR"];
|
|
$logFile = PATH_DATA . "log/ldapAdvanced.log";
|
|
|
|
if (!file_exists($logFile) || is_writable($logFile)) {
|
|
$fpt= fopen ($logFile, "a");
|
|
$ldapErrorMsg = "";
|
|
$ldapErrorNr = 0;
|
|
|
|
if ($link != null) {
|
|
$ldapErrorNr = ldap_errno($link);
|
|
|
|
if ( $ldapErrorNr != 0 ) {
|
|
$ldapErrorMsg = ldap_error($link);
|
|
$text = $ldapErrorMsg . " : " . $text;
|
|
}
|
|
}
|
|
|
|
//log format: date hour ipaddress workspace ldapErrorNr
|
|
fwrite($fpt, sprintf("%s %s %s %s %s \n", date("Y-m-d H:i:s"), getenv("REMOTE_ADDR"), SYS_SYS, $ldapErrorNr, $text));
|
|
fclose($fpt);
|
|
} else {
|
|
error_log ("file $logFile is not writable ");
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Add a debug line in the LDAP log
|
|
*
|
|
* @param string $text Text
|
|
*
|
|
* return void
|
|
*/
|
|
public function debugLog($text)
|
|
{
|
|
try {
|
|
if ($this->debug) {
|
|
$this->log(null, "DEBUG: $text");
|
|
}
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* This method generates the ldap connection bind and returns the link object
|
|
* for a determined authsource
|
|
* @author Fernando Ontiveros Lira <fernando@colosa.com>
|
|
* @param Array $aAuthSource the authsource data
|
|
* @return Object A object with the resulting ldap bind
|
|
*/
|
|
public function ldapConnection($aAuthSource)
|
|
{
|
|
$pass = explode("_",$aAuthSource["AUTH_SOURCE_PASSWORD"]);
|
|
|
|
foreach ($pass as $index => $value) {
|
|
if ($value == "2NnV3ujj3w") {
|
|
$aAuthSource["AUTH_SOURCE_PASSWORD"] = G::decrypt($pass[0],$aAuthSource["AUTH_SOURCE_SERVER_NAME"]);
|
|
}
|
|
}
|
|
|
|
$ldapcnn = ldap_connect($aAuthSource['AUTH_SOURCE_SERVER_NAME'], $aAuthSource['AUTH_SOURCE_PORT']);
|
|
|
|
$ldapServer = $aAuthSource["AUTH_SOURCE_SERVER_NAME"] . ":" . $aAuthSource["AUTH_SOURCE_PORT"] ;
|
|
|
|
ldap_set_option($ldapcnn, LDAP_OPT_PROTOCOL_VERSION, 3);
|
|
ldap_set_option($ldapcnn, LDAP_OPT_REFERRALS, 0);
|
|
|
|
if (isset($aAuthSource["AUTH_SOURCE_ENABLED_TLS"]) && $aAuthSource["AUTH_SOURCE_ENABLED_TLS"]) {
|
|
@ldap_start_tls($ldapcnn);
|
|
$ldapServer = "TLS " . $ldapServer;
|
|
//$this->log($ldapcnn, "start tls");
|
|
}
|
|
|
|
if ($aAuthSource["AUTH_ANONYMOUS"] == "1") {
|
|
$bBind = @ldap_bind($ldapcnn);
|
|
$this->log($ldapcnn, "bind $ldapServer like anonymous user");
|
|
} else {
|
|
$bBind = @ldap_bind($ldapcnn, $aAuthSource['AUTH_SOURCE_SEARCH_USER'], $aAuthSource['AUTH_SOURCE_PASSWORD']);
|
|
$this->log($ldapcnn, "bind $ldapServer with user " . $aAuthSource["AUTH_SOURCE_SEARCH_USER"]);
|
|
}
|
|
|
|
if (!$bBind) {
|
|
throw new Exception("Unable to bind to server: $ldapServer . " . "LDAP-Errno: " . ldap_errno($ldapcnn) . " : " . ldap_error($ldapcnn) . " \n");
|
|
}
|
|
|
|
return $ldapcnn;
|
|
}
|
|
|
|
/**
|
|
* This method obtains the attributes of a ldap Connection passed as parameter
|
|
* @param Object $ldapcnn ldap connection
|
|
* @author Fernando Ontiveros Lira <fernando@colosa.com>
|
|
* @param Object $oEntry Entry object
|
|
* @return Array attributes
|
|
*/
|
|
public function ldapGetAttributes($ldapcnn, $entry)
|
|
{
|
|
try {
|
|
$arrayAttributes = array();
|
|
|
|
$arrayAttributes['dn'] = ldap_get_dn($ldapcnn, $entry);
|
|
|
|
$arrayAux = ldap_get_attributes($ldapcnn, $entry);
|
|
|
|
for ($i = 0; $i <= $arrayAux["count"] - 1; $i++) {
|
|
$key = strtolower($arrayAux[$i]);
|
|
|
|
switch ($arrayAux[$arrayAux[$i]]["count"]) {
|
|
case 0:
|
|
$arrayAttributes[$key] = "";
|
|
break;
|
|
case 1:
|
|
$arrayAttributes[$key] = $arrayAux[$arrayAux[$i]][0];
|
|
break;
|
|
default:
|
|
$arrayAttributes[$key] = $arrayAux[$arrayAux[$i]];
|
|
|
|
unset($arrayAttributes[$key]["count"]);
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!isset($arrayAttributes["mail"]) && isset($arrayAttributes["userprincipalname"])) {
|
|
$arrayAttributes["mail"] = $arrayAttributes["userprincipalname"];
|
|
}
|
|
|
|
return $arrayAttributes;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get Users from Department (Search result identifier)
|
|
*
|
|
* @param resource $ldapcnn LDAP link identifier
|
|
* @param resource $searchResult Search result identifier
|
|
* @param string $option Option (GET, SYNCHRONIZE)
|
|
* @param string $dn DN
|
|
* @param string $uidUserIdentifier User identifier
|
|
* @param int $totalUser Total users
|
|
* @param int $countUser User counter
|
|
* @param array $arrayData Data
|
|
*
|
|
* return array Return an array data
|
|
*/
|
|
public function ldapGetUsersFromDepartmentSearchResult($ldapcnn, $searchResult, $option, $dn, $uidUserIdentifier, $totalUser, $countUser, array $arrayData)
|
|
{
|
|
try {
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromDepartmentSearchResult() > START");
|
|
|
|
if ($searchResult) {
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromDepartmentSearchResult() > ldap_list > OK");
|
|
|
|
$numEntries = ldap_count_entries($ldapcnn, $searchResult);
|
|
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromDepartmentSearchResult() > ldap_list > OK > \$numEntries ----> $numEntries");
|
|
|
|
$totalUser += $numEntries;
|
|
|
|
if ($numEntries > 0) {
|
|
$this->log($ldapcnn, "Search $dn accounts with identifier = $uidUserIdentifier");
|
|
|
|
$entry = ldap_first_entry($ldapcnn, $searchResult);
|
|
|
|
do {
|
|
$arrayUserLdap = $this->ldapGetAttributes($ldapcnn, $entry);
|
|
|
|
$username = (isset($arrayUserLdap[$uidUserIdentifier]))? $arrayUserLdap[$uidUserIdentifier] : "";
|
|
|
|
$countUser++;
|
|
|
|
if ((is_array($username) && !empty($username)) || trim($username) != "") {
|
|
$arrayUserData = $this->getUserDataFromAttribute($username, $arrayUserLdap);
|
|
|
|
if (!isset($this->arrayDepartmentUserSynchronizedChecked[$arrayUserData["sUsername"]])) {
|
|
$this->arrayDepartmentUserSynchronizedChecked[$arrayUserData["sUsername"]] = 1;
|
|
|
|
switch ($option) {
|
|
case "GET":
|
|
$arrayData[] = $arrayUserData;
|
|
break;
|
|
case "SYNCHRONIZE":
|
|
$arrayData = $this->departmentSynchronizeUser("", $arrayUserData, $arrayData);
|
|
break;
|
|
}
|
|
} else {
|
|
$this->log($ldapcnn, "User is repeated: Username \"" . $arrayUserData["sUsername"] . "\", DN \"" . $arrayUserData["sDN"] . "\"");
|
|
}
|
|
}
|
|
|
|
if ($option == "SYNCHRONIZE") {
|
|
//Progress bar
|
|
$this->frontEndShow("BAR", "Departments: " . $arrayData["i"] . "/" . $arrayData["n"] . " " . $this->progressBar($totalUser, $countUser));
|
|
}
|
|
} while ($entry = ldap_next_entry($ldapcnn, $entry));
|
|
}
|
|
}
|
|
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromDepartmentSearchResult() > END");
|
|
|
|
//Return
|
|
return array($totalUser, $countUser, $arrayData);
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get Users from Department
|
|
*
|
|
* @param string $option Option (GET, SYNCHRONIZE)
|
|
* @param string $dn DN of Department
|
|
* @param array $arrayData Data
|
|
*
|
|
* return array Return an array with data Users or array data
|
|
*/
|
|
public function ldapGetUsersFromDepartment($option, $dn, array $arrayData = array())
|
|
{
|
|
try {
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromDepartment() > START");
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromDepartment() > \$dn ----> $dn");
|
|
|
|
$arrayUser = array();
|
|
$totalUser = 0;
|
|
$countUser = 0;
|
|
|
|
//Set variables
|
|
$dn = trim($dn);
|
|
$rbac = &RBAC::getSingleton();
|
|
|
|
if (is_null($rbac->authSourcesObj)) {
|
|
$rbac->authSourcesObj = new AuthenticationSource();
|
|
}
|
|
|
|
$arrayAuthenticationSourceData = $rbac->authSourcesObj->load($this->sAuthSource);
|
|
|
|
$this->ldapcnn = $this->ldapConnection($arrayAuthenticationSourceData);
|
|
|
|
$ldapcnn = $this->ldapcnn;
|
|
|
|
//Get Users
|
|
$limit = $this->__getPageSizeLimitByData($arrayAuthenticationSourceData);
|
|
$flagError = false;
|
|
|
|
if (!isset($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_USERS_FILTER"])) {
|
|
$arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_USERS_FILTER"] = "";
|
|
}
|
|
|
|
$uidUserIdentifier = (isset($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_IDENTIFIER_FOR_USER"]))? $arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_IDENTIFIER_FOR_USER"] : "uid";
|
|
|
|
$filterUsers = trim($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_USERS_FILTER"]);
|
|
|
|
$filter = ($filterUsers != "")? $filterUsers : "(" . $this->arrayObjectClassFilter["user"] . ")";
|
|
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromDepartment() > \$filter ----> $filter");
|
|
|
|
$cookie = '';
|
|
|
|
do {
|
|
ldap_control_paged_result($ldapcnn, $limit, true, $cookie);
|
|
|
|
$searchResult = @ldap_list($ldapcnn, $dn, $filter, $this->arrayAttributesForUser);
|
|
|
|
if ($error = ldap_errno($ldapcnn)) {
|
|
$flagError = true;
|
|
} else {
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromDepartment() > ldap_list > OK");
|
|
|
|
switch ($option) {
|
|
case "GET":
|
|
list($totalUser, $countUser, $arrayUser) = $this->ldapGetUsersFromDepartmentSearchResult($ldapcnn, $searchResult, $option, $dn, $uidUserIdentifier, $totalUser, $countUser, $arrayUser);
|
|
break;
|
|
case "SYNCHRONIZE":
|
|
list($totalUser, $countUser, $arrayData) = $this->ldapGetUsersFromDepartmentSearchResult($ldapcnn, $searchResult, $option, $dn, $uidUserIdentifier, $totalUser, $countUser, $arrayData);
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!$flagError) {
|
|
ldap_control_paged_result_response($ldapcnn, $searchResult, $cookie);
|
|
}
|
|
} while (($cookie !== null && $cookie != '') && !$flagError);
|
|
|
|
//Get Users //2
|
|
if ($flagError) {
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromDepartment() > Search by characters > START");
|
|
|
|
foreach ($this->characters() as $value) {
|
|
$char = $value;
|
|
|
|
$ldapcnn = $this->ldapConnection($arrayAuthenticationSourceData);
|
|
|
|
$filter = ($filterUsers != "")? $filterUsers : "(" . $this->arrayObjectClassFilter["user"] . ")";
|
|
$filter = "(&$filter($uidUserIdentifier=$char*))";
|
|
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromDepartment() > \$filter ----> $filter");
|
|
|
|
$searchResult = @ldap_list($ldapcnn, $dn, $filter, $this->arrayAttributesForUser);
|
|
|
|
if ($error = ldap_errno($ldapcnn)) {
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromDepartment() > ldap_list > ERROR > \$error ---->\n" . print_r($error, true));
|
|
} else {
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromDepartment() > ldap_list > OK");
|
|
|
|
switch ($option) {
|
|
case "GET":
|
|
list($totalUser, $countUser, $arrayUser) = $this->ldapGetUsersFromDepartmentSearchResult($ldapcnn, $searchResult, $option, $dn, $uidUserIdentifier, $totalUser, $countUser, $arrayUser);
|
|
break;
|
|
case "SYNCHRONIZE":
|
|
list($totalUser, $countUser, $arrayData) = $this->ldapGetUsersFromDepartmentSearchResult($ldapcnn, $searchResult, $option, $dn, $uidUserIdentifier, $totalUser, $countUser, $arrayData);
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromDepartment() > Search by characters > END");
|
|
}
|
|
|
|
$this->log($ldapcnn, "Found $totalUser users in department $dn");
|
|
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromDepartment() > END");
|
|
|
|
//Return
|
|
switch ($option) {
|
|
case "GET":
|
|
return $arrayUser;
|
|
break;
|
|
case "SYNCHRONIZE":
|
|
return $arrayData;
|
|
break;
|
|
}
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Synchronize Group's members
|
|
*
|
|
* @param resource $ldapcnn LDAP link identifier
|
|
* @param array $arrayAuthSourceData Authentication Source Data
|
|
* @param string $groupUid Unique id of Group
|
|
* @param array $arrayGroupLdap LDAP Group
|
|
* @param string $memberAttribute Member attribute
|
|
* @param array $arrayData Data
|
|
*
|
|
* @return array Return array data
|
|
*/
|
|
private function __ldapGroupSynchronizeMembers(
|
|
$ldapcnn,
|
|
array $arrayAuthSourceData,
|
|
$groupUid,
|
|
array $arrayGroupLdap,
|
|
$memberAttribute,
|
|
array $arrayData = []
|
|
) {
|
|
try {
|
|
unset($arrayData['countMembers']);
|
|
|
|
//Get members
|
|
if (!isset($arrayAuthSourceData['AUTH_SOURCE_DATA']['AUTH_SOURCE_USERS_FILTER'])) {
|
|
$arrayAuthSourceData['AUTH_SOURCE_DATA']['AUTH_SOURCE_USERS_FILTER'] = '';
|
|
}
|
|
|
|
$uidUserIdentifier = (isset($arrayAuthSourceData['AUTH_SOURCE_DATA']['AUTH_SOURCE_IDENTIFIER_FOR_USER']))?
|
|
$arrayAuthSourceData['AUTH_SOURCE_DATA']['AUTH_SOURCE_IDENTIFIER_FOR_USER'] : 'uid';
|
|
|
|
$filterUsers = trim($arrayAuthSourceData['AUTH_SOURCE_DATA']['AUTH_SOURCE_USERS_FILTER']);
|
|
|
|
$filter = ($filterUsers != '')? $filterUsers : '(' . $this->arrayObjectClassFilter['user'] . ')';
|
|
|
|
if (isset($arrayGroupLdap[$memberAttribute])) {
|
|
if (!is_array($arrayGroupLdap[$memberAttribute])) {
|
|
$arrayGroupLdap[$memberAttribute] = [$arrayGroupLdap[$memberAttribute]];
|
|
}
|
|
|
|
$arrayData['countMembers'] = count($arrayGroupLdap[$memberAttribute]);
|
|
$arrayData['totalUser'] += $arrayData['countMembers'];
|
|
|
|
//Synchronize members
|
|
foreach ($arrayGroupLdap[$memberAttribute] as $value) {
|
|
$member = $value; //User DN
|
|
|
|
$searchResult = @ldap_search($ldapcnn, $member, $filter, $this->arrayAttributesForUser);
|
|
|
|
if ($error = ldap_errno($ldapcnn)) {
|
|
//
|
|
} else {
|
|
if ($searchResult) {
|
|
if (ldap_count_entries($ldapcnn, $searchResult) > 0) {
|
|
$entry = ldap_first_entry($ldapcnn, $searchResult);
|
|
|
|
$arrayUserLdap = $this->ldapGetAttributes($ldapcnn, $entry);
|
|
|
|
$username = (isset($arrayUserLdap[$uidUserIdentifier]))? $arrayUserLdap[$uidUserIdentifier] : '';
|
|
|
|
$arrayData['countUser']++;
|
|
|
|
if ((is_array($username) && !empty($username)) || trim($username) != '') {
|
|
$arrayData = $this->groupSynchronizeUser(
|
|
$groupUid, $this->getUserDataFromAttribute($username, $arrayUserLdap), $arrayData
|
|
);
|
|
}
|
|
|
|
//Progress bar
|
|
$this->frontEndShow(
|
|
'BAR',
|
|
'Groups: ' . $arrayData['i'] . '/' . $arrayData['n'] . ' ' .
|
|
$this->progressBar($arrayData['totalUser'], $arrayData['countUser'])
|
|
);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
//Return
|
|
return $arrayData;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get Users from Group
|
|
*
|
|
* @param string $option Option (SYNCHRONIZE)
|
|
* @param array $arrayGroupData Group data
|
|
* @param array $arrayData Data
|
|
*
|
|
* return array Return array data
|
|
*/
|
|
public function ldapGetUsersFromGroup($option, array $arrayGroupData, array $arrayData = array())
|
|
{
|
|
try {
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromGroup() > START");
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromGroup() > \$arrayGroupData ---->\n" . print_r($arrayGroupData, true));
|
|
|
|
$totalUser = 0;
|
|
$countUser = 0;
|
|
|
|
//Set variables
|
|
$dn = trim($arrayGroupData["GRP_LDAP_DN"]);
|
|
$rbac = &RBAC::getSingleton();
|
|
|
|
if (is_null($rbac->authSourcesObj)) {
|
|
$rbac->authSourcesObj = new AuthenticationSource();
|
|
}
|
|
|
|
$arrayAuthenticationSourceData = $rbac->authSourcesObj->load($this->sAuthSource);
|
|
|
|
$this->ldapcnn = $this->ldapConnection($arrayAuthenticationSourceData);
|
|
|
|
$ldapcnn = $this->ldapcnn;
|
|
|
|
//Get Group members
|
|
$memberAttribute = $this->arrayAttributes[$arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["LDAP_TYPE"]]["member"];
|
|
|
|
$filter = "(" . $this->arrayObjectClassFilter["group"] . ")";
|
|
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromGroup() > \$filter ----> $filter");
|
|
|
|
$searchResult = @ldap_search($ldapcnn, $dn, $filter, array($memberAttribute));
|
|
|
|
if ($error = ldap_errno($ldapcnn)) {
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromGroup() > ldap_search > ERROR > \$error ---->\n" . print_r($error, true));
|
|
} else {
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromGroup() > ldap_search > OK1");
|
|
|
|
if ($searchResult) {
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromGroup() > ldap_search > OK2");
|
|
|
|
$numEntries = ldap_count_entries($ldapcnn, $searchResult);
|
|
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromGroup() > ldap_search > OK2 > \$numEntries ----> $numEntries");
|
|
|
|
if ($numEntries > 0) {
|
|
$entry = ldap_first_entry($ldapcnn, $searchResult);
|
|
|
|
$arrayGroupLdap = $this->ldapGetAttributes($ldapcnn, $entry);
|
|
|
|
//Syncronize members
|
|
$flagMemberRange = false;
|
|
|
|
$memberAttribute2 = $memberAttribute;
|
|
|
|
if (isset($arrayGroupLdap[$memberAttribute]) && empty($arrayGroupLdap[$memberAttribute])) {
|
|
foreach ($arrayGroupLdap as $key => $value) {
|
|
if (preg_match('/^member;range=\d+\-\d+$/i', $key)) {
|
|
$memberAttribute2 = $key;
|
|
|
|
$flagMemberRange = true;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
$arrayData = $this->__ldapGroupSynchronizeMembers(
|
|
$ldapcnn,
|
|
$arrayAuthenticationSourceData,
|
|
$arrayGroupData['GRP_UID'],
|
|
$arrayGroupLdap,
|
|
$memberAttribute2,
|
|
array_merge($arrayData, ['totalUser' => $totalUser, 'countUser' => $countUser])
|
|
);
|
|
|
|
$totalUser = $arrayData['totalUser'];
|
|
$countUser = $arrayData['countUser'];
|
|
|
|
$limitMemberRange = (isset($arrayData['countMembers']))? $arrayData['countMembers'] : 0;
|
|
|
|
if ($flagMemberRange) {
|
|
for ($start = $limitMemberRange; true; $start += $limitMemberRange) {
|
|
$end = $start + $limitMemberRange - 1;
|
|
|
|
$memberAttribute2 = $memberAttribute . ';range=' . $start . '-' . $end;
|
|
|
|
$searchResult = @ldap_search($ldapcnn, $dn, $filter, [$memberAttribute2]);
|
|
|
|
if ($error = ldap_errno($ldapcnn)) {
|
|
break;
|
|
} else {
|
|
if ($searchResult) {
|
|
if (ldap_count_entries($ldapcnn, $searchResult) > 0) {
|
|
$entry = ldap_first_entry($ldapcnn, $searchResult);
|
|
|
|
$arrayGroupLdap = $this->ldapGetAttributes($ldapcnn, $entry);
|
|
|
|
foreach ($arrayGroupLdap as $key => $value) {
|
|
if (preg_match('/^member;range=\d+\-\*$/i', $key)) {
|
|
$memberAttribute2 = $key;
|
|
break;
|
|
}
|
|
}
|
|
|
|
$arrayData = $this->__ldapGroupSynchronizeMembers(
|
|
$ldapcnn,
|
|
$arrayAuthenticationSourceData,
|
|
$arrayGroupData['GRP_UID'],
|
|
$arrayGroupLdap,
|
|
$memberAttribute2,
|
|
array_merge($arrayData, ['totalUser' => $totalUser, 'countUser' => $countUser])
|
|
);
|
|
|
|
$totalUser = $arrayData['totalUser'];
|
|
$countUser = $arrayData['countUser'];
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
$this->log($ldapcnn, "Found $totalUser users in group $dn");
|
|
|
|
$this->debugLog("class.ldapAdvanced.php > function ldapGetUsersFromGroup() > END");
|
|
|
|
//Return
|
|
return $arrayData;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* This method authentifies if a user has the RBAC_user privileges
|
|
* also verifies if the user has the rights to start an application
|
|
*
|
|
* @author Fernando Ontiveros Lira <fernando@colosa.com>
|
|
* @access public
|
|
|
|
* @param string $strUser UserId (user login)
|
|
* @param string $strPass Password
|
|
* @return
|
|
* -1: user doesn"t exists / no existe usuario
|
|
* -2: wrong password / password errado
|
|
* -3: inactive user / usuario inactivo
|
|
* -4: user due date / usuario vencido
|
|
* -5: connection error
|
|
* n : user uid / uid de usuario
|
|
*/
|
|
public function VerifyLogin($strUser, $strPass)
|
|
{
|
|
if (is_array($strUser)) {
|
|
$strUser = $strUser[0];
|
|
} else {
|
|
$strUser = trim($strUser);
|
|
}
|
|
|
|
if ( $strUser == "" ) {
|
|
return -1;
|
|
}
|
|
|
|
if ( strlen( $strPass ) == 0) {
|
|
return -2;
|
|
}
|
|
|
|
$ldapcnn = null;
|
|
|
|
$validUserPass = 1;
|
|
|
|
try {
|
|
$rbac = &RBAC::getSingleton();
|
|
|
|
if (is_null($rbac->authSourcesObj)) {
|
|
$rbac->authSourcesObj = new AuthenticationSource();
|
|
}
|
|
|
|
if ($rbac->userObj == null) {
|
|
$rbac->userObj = new RbacUsers();
|
|
}
|
|
|
|
$arrayAuthSource = $rbac->authSourcesObj->load($this->sAuthSource);
|
|
|
|
$setAttributes = 0;
|
|
|
|
if (isset($arrayAuthSource['AUTH_SOURCE_DATA']['AUTH_SOURCE_SHOWGRID']) &&
|
|
$arrayAuthSource['AUTH_SOURCE_DATA']['AUTH_SOURCE_SHOWGRID'] == 'on'
|
|
) {
|
|
$setAttributes = 1;
|
|
}
|
|
|
|
//Get UserName
|
|
$criteria = new Criteria("rbac");
|
|
|
|
$criteria->addSelectColumn(RbacUsersPeer::USR_USERNAME);
|
|
$criteria->addSelectColumn(RbacUsersPeer::USR_UID);
|
|
$criteria->add(RbacUsersPeer::UID_AUTH_SOURCE, $arrayAuthSource["AUTH_SOURCE_UID"]);
|
|
$criteria->add(RbacUsersPeer::USR_AUTH_USER_DN, $strUser);
|
|
$criteria->add(RbacUsersPeer::USR_USERNAME, "", Criteria::NOT_EQUAL);
|
|
|
|
$rsCriteria = RbacUsersPeer::doSelectRS($criteria);
|
|
$rsCriteria->setFetchmode(ResultSet::FETCHMODE_ASSOC);
|
|
|
|
$rsCriteria->next();
|
|
$row = $rsCriteria->getRow();
|
|
|
|
$usrName = $row["USR_USERNAME"];
|
|
$usrUid = $row["USR_UID"];
|
|
|
|
//Get the AuthSource properties
|
|
//Check if the dn in the database record matches with the dn for the ldap account
|
|
$verifiedUser = $this->searchUserByUid(
|
|
$usrName,
|
|
$arrayAuthSource["AUTH_SOURCE_DATA"]["AUTH_SOURCE_IDENTIFIER_FOR_USER"]
|
|
);
|
|
|
|
if (empty($verifiedUser) || trim($verifiedUser["sDN"]) == null) {
|
|
return -1;
|
|
}
|
|
|
|
$userDn = $strUser;
|
|
|
|
if ($verifiedUser["sDN"] != $strUser || $setAttributes==1) {
|
|
$userDn = $verifiedUser['sDN'];
|
|
|
|
//Update data
|
|
$user = new \ProcessMaker\BusinessModel\User();
|
|
$arrayUserData = $user->getUserRecordByPk($usrUid, [], false);
|
|
|
|
$result = $this->__ldapUserUpdateByDnAndData(
|
|
$this->ldapcnn, $arrayAuthSource, $userDn, [$arrayUserData['USR_USERNAME'] => $arrayUserData]
|
|
);
|
|
|
|
//Update DN
|
|
$con = Propel::getConnection(RbacUsersPeer::DATABASE_NAME);
|
|
// select set
|
|
$c1 = new Criteria("rbac");
|
|
$c1->add(RbacUsersPeer::UID_AUTH_SOURCE, $arrayAuthSource["AUTH_SOURCE_UID"]);
|
|
$c1->add(RbacUsersPeer::USR_AUTH_USER_DN, $strUser);
|
|
// update set
|
|
$c2 = new Criteria("rbac");
|
|
$c2->add(RbacUsersPeer::USR_AUTH_USER_DN, $userDn);
|
|
|
|
BasePeer::doUpdate($c1, $c2, $con);
|
|
}
|
|
|
|
//Check ldap connection for user
|
|
$arrayAuthSource["AUTH_ANONYMOUS"] = "0";
|
|
$arrayAuthSource["AUTH_SOURCE_SEARCH_USER"] = $userDn;
|
|
$arrayAuthSource["AUTH_SOURCE_PASSWORD"] = $strPass;
|
|
|
|
$ldapcnn = $this->ldapConnection($arrayAuthSource);
|
|
$flagUpdate = false;
|
|
switch(ldap_errno($ldapcnn)) {
|
|
case '0x00':
|
|
$flagUpdate = true;
|
|
$statusRbac = 1;
|
|
$statusUser = 'ACTIVE';
|
|
break;
|
|
case '0x34':
|
|
case '0x58':
|
|
case '0x5e':
|
|
//LDAP_UNAVAILABLE
|
|
//LDAP_USER_CANCELLED
|
|
//LDAP_NO_RESULTS_RETURNED
|
|
$flagUpdate = true;
|
|
$statusRbac = 0;
|
|
$statusUser = 'INACTIVE';
|
|
break;
|
|
default:
|
|
break;
|
|
}
|
|
if ($flagUpdate) {
|
|
$con = Propel::getConnection(RbacUsersPeer::DATABASE_NAME);
|
|
// select set
|
|
$c1 = new Criteria("rbac");
|
|
$c1->add(RbacUsersPeer::UID_AUTH_SOURCE, $arrayAuthSource["AUTH_SOURCE_UID"]);
|
|
$c1->add(RbacUsersPeer::USR_AUTH_USER_DN, $strUser);
|
|
// update set
|
|
$c2 = new Criteria("rbac");
|
|
$c2->add(RbacUsersPeer::USR_AUTH_USER_DN, $verifiedUser["sDN"]);
|
|
$c2->add(RbacUsersPeer::USR_STATUS, $statusRbac);
|
|
BasePeer::doUpdate($c1, $c2, $con);
|
|
$columnsWf = array();
|
|
$columnsWf['USR_UID'] = $usrUid;
|
|
$columnsWf['USR_STATUS'] = $statusUser;
|
|
$oUser = new Users();
|
|
$oUser->update($columnsWf);
|
|
}
|
|
|
|
$attributes = $arrayAuthSource["AUTH_SOURCE_DATA"];
|
|
|
|
if (!isset($attributes['AUTH_SOURCE_RETIRED_OU'])) {
|
|
$attributes ['AUTH_SOURCE_RETIRED_OU'] = '';
|
|
}
|
|
|
|
//Check if the user is in the terminated organizational unit
|
|
if ($this->userIsTerminated($usrName, $attributes["AUTH_SOURCE_RETIRED_OU"])) {
|
|
$this->deactivateUser($usrName);
|
|
$this->log($ldapcnn, "user $strUser is member of Remove OU, deactivating this user.");
|
|
|
|
return -3;
|
|
}
|
|
$validUserPass = ldap_errno($ldapcnn) == 0;
|
|
} catch (Exception $e) {
|
|
$validUserPass = -5;
|
|
}
|
|
|
|
if ( $validUserPass == 1 ) {
|
|
$this->log($ldapcnn, "sucessful login user " . $verifiedUser["sDN"]);
|
|
} else {
|
|
$this->log($ldapcnn, "failure authentication for user $strUser");
|
|
}
|
|
|
|
return $validUserPass ;
|
|
}
|
|
|
|
/**
|
|
* Get data of a User from attribute
|
|
*
|
|
* @param mixed $username Username
|
|
* @param array $arrayAttributes Attributes
|
|
*
|
|
* return array Return an array with data User
|
|
*/
|
|
public function getUserDataFromAttribute($username, array $arrayAttributes)
|
|
{
|
|
try {
|
|
$keyMail = (isset($arrayAttributes["mail"]))? "mail" : ((isset($arrayAttributes["userprincipalname"]))? "userprincipalname" : "nomail");
|
|
|
|
return array(
|
|
"sUsername" => trim((is_array($username))? $username[0] : $username),
|
|
"sPassword" => trim((isset($arrayAttributes["userpassword"]))? ((is_array($arrayAttributes["userpassword"]))? $arrayAttributes["userpassword"][0] : $arrayAttributes["userpassword"]) : ""),
|
|
"sFullname" => trim((isset($arrayAttributes["cn"]))? ((is_array($arrayAttributes["cn"]))? $arrayAttributes["cn"][0] : $arrayAttributes["cn"]) : ""),
|
|
"sFirstname" => trim((isset($arrayAttributes["givenname"]))? ((is_array($arrayAttributes["givenname"]))? $arrayAttributes["givenname"][0] : $arrayAttributes["givenname"]) : ""),
|
|
"sLastname" => trim((isset($arrayAttributes["sn"]))? ((is_array($arrayAttributes["sn"]))? $arrayAttributes["sn"][0] : $arrayAttributes["sn"]) : ""),
|
|
"sEmail" => trim((isset($arrayAttributes[$keyMail]))? ((is_array($arrayAttributes[$keyMail]))? $arrayAttributes[$keyMail][0] : $arrayAttributes[$keyMail]) : ""),
|
|
"sDN" => trim($arrayAttributes["dn"]),
|
|
"sManagerDN" => trim((isset($arrayAttributes["manager"]))? ((is_array($arrayAttributes["manager"]))? $arrayAttributes["manager"][0] : $arrayAttributes["manager"]) : "")
|
|
);
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* This method searches for the users that has some attribute
|
|
* that matches the keyword.
|
|
* @param String $keyword search criteria
|
|
* @return array Users that match the search criteria
|
|
*/
|
|
public function searchUsers($keyword, $start = null, $limit = null)
|
|
{
|
|
$arrayUser = array();
|
|
$totalUser = 0;
|
|
$countUser = 0;
|
|
|
|
$keyword = trim(trim($keyword), "*");
|
|
$keyword = ($keyword != "")? "*$keyword*" : "*";
|
|
|
|
$paged = !is_null($start) && !is_null($limit);
|
|
|
|
$rbac = &RBAC::getSingleton();
|
|
|
|
if (is_null($rbac->authSourcesObj)) {
|
|
$rbac->authSourcesObj = new AuthenticationSource();
|
|
}
|
|
|
|
$arrayAuthenticationSourceData = $rbac->authSourcesObj->load($this->sAuthSource);
|
|
$attributeUserSet = array();
|
|
$attributeSetAdd = array();
|
|
|
|
if (isset($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"])
|
|
&& !empty($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"])
|
|
) {
|
|
foreach ($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"] as $value) {
|
|
$attributeSetAdd[] = $value['attributeLdap'];
|
|
$attributeUserSet[$value['attributeUser']] = $value['attributeLdap'];
|
|
}
|
|
}
|
|
|
|
if (is_null($this->ldapcnn)) {
|
|
$this->ldapcnn = $this->ldapConnection($arrayAuthenticationSourceData);
|
|
}
|
|
|
|
$ldapcnn = $this->ldapcnn;
|
|
|
|
//Get Users
|
|
if (!isset($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_USERS_FILTER"])) {
|
|
$arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_USERS_FILTER"] = "";
|
|
}
|
|
|
|
$uidUserIdentifier = (isset($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_IDENTIFIER_FOR_USER"]))? $arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_IDENTIFIER_FOR_USER"] : "uid";
|
|
|
|
$filterUsers = trim($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_USERS_FILTER"]);
|
|
|
|
$filter = ($filterUsers != "")? $filterUsers : "(" . $this->arrayObjectClassFilter["user"] . ")";
|
|
$filter = "(&$filter(|(dn=$keyword)(uid=$keyword)(samaccountname=$keyword)(givenname=$keyword)(sn=$keyword)(cn=$keyword)(mail=$keyword)(userprincipalname=$keyword)))";
|
|
|
|
$oSearch = @ldap_search($ldapcnn, $arrayAuthenticationSourceData["AUTH_SOURCE_BASE_DN"], $filter, array_merge($this->arrayAttributesForUser, $attributeSetAdd));
|
|
|
|
if ($oError = ldap_errno($ldapcnn)) {
|
|
$this->log($ldapcnn, "Error in Search users");
|
|
} else {
|
|
if ($oSearch) {
|
|
$entries = ldap_count_entries($ldapcnn, $oSearch);
|
|
$totalUser = $entries;
|
|
|
|
if ( $entries > 0) {
|
|
$oEntry = ldap_first_entry($ldapcnn, $oSearch);
|
|
|
|
$countEntries=0;
|
|
|
|
$flagNextRecord = true;
|
|
|
|
do {
|
|
$aAttr = $this->ldapGetAttributes($ldapcnn, $oEntry);
|
|
$sUsername = (isset($aAttr[$uidUserIdentifier]))? $aAttr[$uidUserIdentifier] : "";
|
|
|
|
if ((is_array($sUsername) && !empty($sUsername)) || trim($sUsername) != "") {
|
|
$countUser++;
|
|
|
|
/*Active Directory userAccountControl Values
|
|
Normal Day to Day Values:
|
|
512 - Enable Account
|
|
514 - Disable account
|
|
544 - Account Enabled - Require user to change password at first logon
|
|
4096 - Workstation/server
|
|
66048 - Enabled, password never expires
|
|
66050 - Disabled, password never expires
|
|
262656 - Smart Card Logon Required
|
|
532480 - Domain controller
|
|
1 - script
|
|
2 - accountdisable
|
|
8 - homedir_required
|
|
16 - lockout
|
|
32 - passwd_notreqd
|
|
64 - passwd_cant_change
|
|
128 - encrypted_text_pwd_allowed
|
|
256 - temp_duplicate_account
|
|
512 - normal_account
|
|
2048 - interdomain_trust_account
|
|
4096 - workstation_trust_account
|
|
8192 - server_trust_account
|
|
65536 - dont_expire_password
|
|
131072 - mns_logon_account
|
|
262144 - smartcard_required
|
|
524288 - trusted_for_delegation
|
|
1048576 - not_delegated
|
|
2097152 - use_des_key_only
|
|
4194304 - dont_req_preauth
|
|
8388608 - password_expired
|
|
16777216 - trusted_to_auth_for_delegation
|
|
*/
|
|
$userCountControl = '';
|
|
//Active Directory, openLdap
|
|
if (isset($aAttr['useraccountcontrol'])) {
|
|
switch ($aAttr['useraccountcontrol']) {
|
|
case '512':
|
|
case '544':
|
|
case '66048':
|
|
case '66080':
|
|
$userCountControl = 'ACTIVE';
|
|
break;
|
|
case '514':
|
|
case '546':
|
|
case '66050':
|
|
case '66082':
|
|
case '2':
|
|
case '16':
|
|
case '8388608':
|
|
default:
|
|
$userCountControl = 'INACTIVE';
|
|
break;
|
|
}
|
|
}
|
|
//apache ldap
|
|
if (isset($aAttr['status'])) {
|
|
$userCountControl = strtoupper($aAttr['status']);
|
|
}
|
|
$aUserAttributes = array();
|
|
foreach ($attributeUserSet as $key => $value) {
|
|
if ($key == 'USR_STATUS') {
|
|
$aUserAttributes[$key] = ($userCountControl != '') ? $userCountControl : 'ACTIVE';
|
|
} elseif (isset($aAttr[ $value ])) {
|
|
$aUserAttributes[$key] = $aAttr[ $value ];
|
|
}
|
|
}
|
|
|
|
if ($paged) {
|
|
if ($countUser - 1 <= $start + $limit - 1) {
|
|
if ($start <= $countUser - 1) {
|
|
$arrayUser[] = array_merge($this->getUserDataFromAttribute($sUsername, $aAttr), $aUserAttributes);
|
|
}
|
|
} else {
|
|
$flagNextRecord = false;
|
|
}
|
|
} else {
|
|
$arrayUser[] = array_merge($this->getUserDataFromAttribute($sUsername, $aAttr), $aUserAttributes);
|
|
}
|
|
|
|
$countEntries++;
|
|
}
|
|
} while (($oEntry = ldap_next_entry($ldapcnn, $oEntry)) && $flagNextRecord);
|
|
}
|
|
}
|
|
/*
|
|
$sUsers = "found $countEntries users: ";
|
|
|
|
foreach ($aUsers as $key => $val) {
|
|
$sUsers .= $val['sUsername'] . ' ';
|
|
}
|
|
|
|
$this->log($ldapcnn, $sUsers);
|
|
*/
|
|
}
|
|
|
|
//Return
|
|
return ($paged)? array("numRecTotal" => $totalUser, "data" => $arrayUser) : $arrayUser;
|
|
}
|
|
|
|
/**
|
|
* This method search in the ldap/active directory source for an user using the UID, (samaccountname or uid )
|
|
* the value should be in $aAuthSource['AUTH_SOURCE_DATA']['AUTH_SOURCE_IDENTIFIER_FOR_USER']
|
|
* @param String $keyword The keyword in order to match the record with the identifier attribute
|
|
* @param String $identifier id identifier, this parameter is optional
|
|
* @return mixed if the user has been found or not
|
|
*/
|
|
public function searchUserByUid($keyword, $identifier = "")
|
|
{
|
|
try {
|
|
$arrayUserData = array();
|
|
|
|
//Set variables
|
|
$rbac = &RBAC::getSingleton();
|
|
//$rbac->userObj = new RbacUsers();
|
|
|
|
if (is_null($rbac->authSourcesObj)) {
|
|
$rbac->authSourcesObj = new AuthenticationSource();
|
|
}
|
|
|
|
$arrayAuthenticationSourceData = $rbac->authSourcesObj->load($this->sAuthSource);
|
|
|
|
if (is_null($this->ldapcnn)) {
|
|
$this->ldapcnn = $this->ldapConnection($arrayAuthenticationSourceData);
|
|
}
|
|
|
|
$ldapcnn = $this->ldapcnn;
|
|
|
|
//Get User
|
|
$attributeUserSet = array();
|
|
$attributeSetAdd = array();
|
|
|
|
if (isset($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"])
|
|
&& !empty($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"])
|
|
) {
|
|
foreach ($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_GRID_ATTRIBUTE"] as $value) {
|
|
$attributeSetAdd[] = $value["attributeLdap"];
|
|
$attributeUserSet[$value["attributeUser"]] = $value["attributeLdap"];
|
|
}
|
|
}
|
|
|
|
$uidUserIdentifier = (isset($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_IDENTIFIER_FOR_USER"]))? $arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_IDENTIFIER_FOR_USER"] : "uid";
|
|
|
|
$filter2 = "";
|
|
|
|
if ($identifier != "" && $identifier != $uidUserIdentifier) {
|
|
$filter2 = "($identifier=$keyword)";
|
|
}
|
|
|
|
$filter = "(&(" . $this->arrayObjectClassFilter["user"] . ")(|($uidUserIdentifier=$keyword)$filter2))";
|
|
|
|
$searchResult = @ldap_search($ldapcnn, $arrayAuthenticationSourceData["AUTH_SOURCE_BASE_DN"], $filter, array_merge($this->arrayAttributesForUser, $attributeSetAdd));
|
|
|
|
if ($error = ldap_errno($ldapcnn)) {
|
|
//
|
|
} else {
|
|
if ($searchResult) {
|
|
$numEntries = ldap_count_entries($ldapcnn, $searchResult);
|
|
|
|
if ($numEntries > 0) {
|
|
$entry = ldap_first_entry($ldapcnn, $searchResult);
|
|
|
|
$arrayUserLdap = $this->ldapGetAttributes($ldapcnn, $entry);
|
|
|
|
$username = (isset($arrayUserLdap[$uidUserIdentifier]))? $arrayUserLdap[$uidUserIdentifier] : "";
|
|
|
|
if ((is_array($username) && !empty($username)) || trim($username) != "") {
|
|
$userCountControl = "";
|
|
|
|
//Active Directory, OpenLDAP
|
|
if (isset($arrayUserLdap["useraccountcontrol"])) {
|
|
switch ($arrayUserLdap["useraccountcontrol"]) {
|
|
case "512":
|
|
case "544":
|
|
case "66048":
|
|
case "66080":
|
|
$userCountControl = "ACTIVE";
|
|
break;
|
|
case "514":
|
|
case "546":
|
|
case "66050":
|
|
case "66082":
|
|
case "2":
|
|
case "16":
|
|
case "8388608":
|
|
default:
|
|
$userCountControl = "INACTIVE";
|
|
break;
|
|
}
|
|
}
|
|
|
|
//Apache LDAP
|
|
if (isset($arrayUserLdap["status"])) {
|
|
$userCountControl = strtoupper($arrayUserLdap["status"]);
|
|
}
|
|
|
|
$aUserAttributes = array();
|
|
|
|
foreach ($attributeUserSet as $key => $value) {
|
|
if ($key == "USR_STATUS") {
|
|
$aUserAttributes[$key] = ($userCountControl != "")? $userCountControl : "ACTIVE";
|
|
} else {
|
|
if (isset($arrayUserLdap[$value])) {
|
|
$aUserAttributes[$key] = $arrayUserLdap[$value];
|
|
}
|
|
}
|
|
}
|
|
|
|
$arrayUserData = array_merge($this->getUserDataFromAttribute($username, $arrayUserLdap), $aUserAttributes);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
//Return
|
|
return $arrayUserData;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
public function automaticRegister($aAuthSource, $strUser, $strPass)
|
|
{
|
|
$rbac = &RBAC::getSingleton();
|
|
|
|
if ($rbac->userObj == null) {
|
|
$rbac->userObj = new RbacUsers();
|
|
}
|
|
|
|
if ($rbac->rolesObj == null) {
|
|
$rbac->rolesObj = new Roles();
|
|
}
|
|
|
|
$user = $this->searchUserByUid($strUser);
|
|
|
|
$res = 0;
|
|
|
|
if (!empty($user)) {
|
|
if ($this->VerifyLogin( $user['sUsername'], $strPass) === true) {
|
|
$res = 1;
|
|
}
|
|
|
|
if ($res == 0 && $this->VerifyLogin( $user['sDN'], $strPass) === true) {
|
|
$res = 1;
|
|
}
|
|
} else {
|
|
return $res;
|
|
}
|
|
|
|
if ($res == 0) {
|
|
$aAuthSource = $rbac->authSourcesObj->load($this->sAuthSource);
|
|
$aAttributes = array();
|
|
|
|
if (isset($aAuthSource['AUTH_SOURCE_DATA']['AUTH_SOURCE_GRID_ATTRIBUTE'])) {
|
|
$aAttributes = $aAuthSource['AUTH_SOURCE_DATA']['AUTH_SOURCE_GRID_ATTRIBUTE'];
|
|
}
|
|
|
|
$aData = array();
|
|
$aData['USR_USERNAME'] = $user['sUsername'];
|
|
$aData["USR_PASSWORD"] = "00000000000000000000000000000000";
|
|
$aData['USR_FIRSTNAME'] = $user['sFirstname'];
|
|
$aData['USR_LASTNAME'] = $user['sLastname'];
|
|
$aData['USR_EMAIL'] = $user['sEmail'];
|
|
$aData['USR_DUE_DATE'] = date('Y-m-d', mktime(0, 0, 0, date('m'), date('d'), date('Y') + 2));
|
|
$aData['USR_CREATE_DATE'] = date('Y-m-d H:i:s');
|
|
$aData['USR_UPDATE_DATE'] = date('Y-m-d H:i:s');
|
|
$aData['USR_BIRTHDAY'] = date('Y-m-d');
|
|
$aData['USR_STATUS'] = (isset($user['USR_STATUS'])) ? (($user['USR_STATUS'] == 'ACTIVE') ? 1 : 0) : 1;
|
|
$aData['USR_AUTH_TYPE'] = strtolower($aAuthSource['AUTH_SOURCE_PROVIDER']);
|
|
$aData['UID_AUTH_SOURCE'] = $aAuthSource['AUTH_SOURCE_UID'];
|
|
$aData['USR_AUTH_USER_DN'] = $user['sDN'];
|
|
$aData['USR_ROLE'] = 'PROCESSMAKER_OPERATOR';
|
|
|
|
if (!empty($aAttributes)) {
|
|
foreach ($aAttributes as $value) {
|
|
if (isset( $user[$value['attributeUser']] )) {
|
|
$aData[$value['attributeUser']] = str_replace( "*", "'", $user[$value['attributeUser']] );
|
|
if ($value['attributeUser'] == 'USR_STATUS') {
|
|
$evalValue = $aData[$value['attributeUser']];
|
|
$statusValue = (isset($user['USR_STATUS'])) ? $user['USR_STATUS'] :'ACTIVE';
|
|
$aData[$value['attributeUser']] = $statusValue;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
//req - accountexpires
|
|
if (isset($user["USR_DUE_DATE"]) && $user["USR_DUE_DATE"]!='' ) {
|
|
$aData["USR_DUE_DATE"] = $this->convertDateADtoPM($user["USR_DUE_DATE"]);
|
|
}
|
|
//end
|
|
|
|
$sUserUID = $rbac->createUser($aData, 'PROCESSMAKER_OPERATOR');
|
|
$aData['USR_UID'] = $sUserUID;
|
|
|
|
require_once 'classes/model/Users.php';
|
|
|
|
$oUser = new Users();
|
|
$aData['USR_STATUS'] = (isset($user['USR_STATUS'])) ? $user['USR_STATUS'] : 'ACTIVE';
|
|
$oUser->create($aData);
|
|
$this->log(null, "Automatic Register for user $strUser ");
|
|
$res = 1;
|
|
}
|
|
|
|
return $res;
|
|
}
|
|
|
|
/**
|
|
* Get a deparment list
|
|
* @return <type>
|
|
*/
|
|
public function searchDepartments()
|
|
{
|
|
try {
|
|
$arrayDepartment = [];
|
|
|
|
//Set variables
|
|
$rbac = &RBAC::getSingleton();
|
|
|
|
if (is_null($rbac->authSourcesObj)) {
|
|
$rbac->authSourcesObj = new AuthenticationSource();
|
|
}
|
|
|
|
$arrayAuthenticationSourceData = $rbac->authSourcesObj->load($this->sAuthSource);
|
|
|
|
if (is_null($this->ldapcnn)) {
|
|
$this->ldapcnn = $this->ldapConnection($arrayAuthenticationSourceData);
|
|
}
|
|
|
|
$ldapcnn = $this->ldapcnn;
|
|
|
|
//Get Departments
|
|
$limit = $this->__getPageSizeLimitByData($arrayAuthenticationSourceData);
|
|
$flagError = false;
|
|
|
|
$filter = '(' . $this->arrayObjectClassFilter['department'] . ')';
|
|
|
|
$this->log($ldapcnn, 'search Departments with Filter: ' . $filter);
|
|
|
|
$unitsBase = $this->custom_ldap_explode_dn($arrayAuthenticationSourceData['AUTH_SOURCE_BASE_DN']);
|
|
|
|
$cookie = '';
|
|
|
|
do {
|
|
ldap_control_paged_result($ldapcnn, $limit, true, $cookie);
|
|
|
|
$searchResult = @ldap_search($ldapcnn, $arrayAuthenticationSourceData['AUTH_SOURCE_BASE_DN'], $filter, ['dn', 'ou']);
|
|
|
|
if ($error = ldap_errno($ldapcnn)) {
|
|
$this->log($ldapcnn, 'Error in Search');
|
|
|
|
$flagError = true;
|
|
} else {
|
|
if ($searchResult) {
|
|
//The first node is root
|
|
if (empty($arrayDepartment)) {
|
|
$arrayDepartment[] = [
|
|
'dn' => $arrayAuthenticationSourceData['AUTH_SOURCE_BASE_DN'],
|
|
'parent' => '',
|
|
'ou' => 'ROOT',
|
|
'users' => 0
|
|
];
|
|
}
|
|
|
|
//Get departments from the ldap entries
|
|
if (ldap_count_entries($ldapcnn, $searchResult) > 0) {
|
|
$entry = ldap_first_entry($ldapcnn, $searchResult);
|
|
|
|
do {
|
|
$arrayEntryData = $this->ldapGetAttributes($ldapcnn, $entry);
|
|
$unitsEqual = $this->custom_ldap_explode_dn($arrayEntryData['dn']);
|
|
|
|
if (count($unitsEqual) == 1 && $unitsEqual[0] == '') {
|
|
continue;
|
|
}
|
|
|
|
if (count($unitsEqual) > count($unitsBase)) {
|
|
unset($unitsEqual[0]);
|
|
}
|
|
|
|
if (isset($arrayEntryData['ou']) && !is_array($arrayEntryData['ou'])) {
|
|
$arrayDepartment[] = [
|
|
'dn' => $arrayEntryData['dn'],
|
|
'parent' => (isset($unitsEqual[1]))? implode(',', $unitsEqual) : '',
|
|
'ou' => trim($arrayEntryData['ou']),
|
|
'users' => 0
|
|
];
|
|
}
|
|
} while ($entry = ldap_next_entry($ldapcnn, $entry));
|
|
}
|
|
}
|
|
}
|
|
|
|
if (!$flagError) {
|
|
ldap_control_paged_result_response($ldapcnn, $searchResult, $cookie);
|
|
}
|
|
} while (($cookie !== null && $cookie != '') && !$flagError);
|
|
|
|
$str = '';
|
|
|
|
foreach ($arrayDepartment as $dep) {
|
|
$str .= ' ' . $dep['ou'];
|
|
}
|
|
|
|
$this->log($ldapcnn, 'found '. count($arrayDepartment) . ' departments: ' . $str);
|
|
|
|
//Return
|
|
return $arrayDepartment;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get the Userlist from a department based on the name
|
|
* @param string $departmentName
|
|
* @return array
|
|
*/
|
|
public function getUsersFromDepartmentByName($departmentName)
|
|
{
|
|
$dFilter = "(&(" . $this->arrayObjectClassFilter["department"] . ")(ou=" . $departmentName . "))";
|
|
|
|
$aUsers = array();
|
|
$rbac = &RBAC::getSingleton();
|
|
//$rbac->userObj = new RbacUsers();
|
|
$rbac->authSourcesObj = new AuthenticationSource();
|
|
$aAuthSource = $rbac->authSourcesObj->load($this->sAuthSource);
|
|
|
|
if (is_null($this->ldapcnn)) {
|
|
$this->ldapcnn = $this->ldapConnection($aAuthSource);
|
|
}
|
|
|
|
$ldapcnn = $this->ldapcnn;
|
|
|
|
$oSearch = @ldap_search($ldapcnn, $aAuthSource["AUTH_SOURCE_BASE_DN"], $dFilter, $this->arrayAttributesForUser);
|
|
|
|
if ($oError = ldap_errno($ldapcnn)) {
|
|
return $aUsers;
|
|
} else {
|
|
if ($oSearch) {
|
|
//get the departments from the ldap entries
|
|
if (ldap_count_entries($ldapcnn, $oSearch) > 0) {
|
|
$oEntry = ldap_first_entry($ldapcnn, $oSearch);
|
|
|
|
do {
|
|
$aAttr = $this->ldapGetAttributes($ldapcnn, $oEntry);
|
|
$aUsers[] = $this->ldapGetUsersFromDepartment("GET", $aAttr["dn"]);
|
|
} while ($oEntry = ldap_next_entry($ldapcnn, $oEntry));
|
|
//$this->createDepartments ($aDepts);
|
|
}
|
|
}
|
|
return $aUsers;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Check if the department exists and returns the PM UID
|
|
* @param <type> $currentDN
|
|
* @return <type>
|
|
*/
|
|
public function getDepUidIfExistsDN ($currentDN)
|
|
{
|
|
try {
|
|
$oCriteria = new Criteria('workflow');
|
|
$oCriteria->add(DepartmentPeer::DEP_STATUS , 'ACTIVE' );
|
|
$oCriteria->add(DepartmentPeer::DEP_LDAP_DN, $currentDN );
|
|
|
|
$oDataset = DepartmentPeer::doSelectRS($oCriteria);
|
|
$oDataset->setFetchmode(ResultSet::FETCHMODE_ASSOC);
|
|
|
|
if ($oDataset->next()) {
|
|
$aRow = $oDataset->getRow();
|
|
|
|
return $aRow["DEP_UID"];
|
|
}
|
|
|
|
return "";
|
|
} catch (Exception $e) {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get number of Users in each Department from the Database
|
|
*
|
|
* return array Return array with the number of Users in each Department from the Database
|
|
*/
|
|
public function departmentsGetNumberOfUsersFromDb()
|
|
{
|
|
try {
|
|
$arrayData = array();
|
|
|
|
//Get data
|
|
$criteria = new Criteria("workflow");
|
|
|
|
$criteria->addSelectColumn(UsersPeer::DEP_UID);
|
|
$criteria->addSelectColumn("COUNT(" . UsersPeer::DEP_UID . ") AS NUM_REC");
|
|
$criteria->add(UsersPeer::USR_STATUS, "CLOSED", Criteria::NOT_EQUAL);
|
|
$criteria->add(UsersPeer::DEP_UID, "", Criteria::NOT_EQUAL);
|
|
$criteria->add(UsersPeer::DEP_UID, null, Criteria::ISNOTNULL);
|
|
$criteria->addGroupByColumn(UsersPeer::DEP_UID);
|
|
|
|
$rsCriteria = UsersPeer::doSelectRS($criteria);
|
|
$rsCriteria->setFetchmode(ResultSet::FETCHMODE_ASSOC);
|
|
|
|
while ($rsCriteria->next()) {
|
|
$row = $rsCriteria->getRow();
|
|
|
|
$arrayData[$row["DEP_UID"]] = $row["NUM_REC"];
|
|
}
|
|
|
|
//Return
|
|
return $arrayData;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
public function userIsTerminated($userUid, $sOuTerminated)
|
|
{
|
|
$terminated = false;
|
|
$aLdapUsers = $this->getUsersFromDepartmentByName($sOuTerminated);
|
|
|
|
foreach ($aLdapUsers as $aLdapUser) {
|
|
if ($aLdapUser['sUsername'] == $userUid) {
|
|
$terminated = true;
|
|
break;
|
|
}
|
|
}
|
|
|
|
return $terminated;
|
|
}
|
|
|
|
/* activate an user previously deactivated
|
|
if user is now in another department, we need the second parameter, the depUid
|
|
|
|
@param string $userUid
|
|
@param string optional department DN
|
|
@param string optional DepUid
|
|
*/
|
|
public function activateUser($userUid, $userDn = null, $depUid = null)
|
|
{
|
|
if (!class_exists('RbacUsers')) {
|
|
require_once(PATH_RBAC.'model/RbacUsers.php');
|
|
}
|
|
|
|
$con = Propel::getConnection(RbacUsersPeer::DATABASE_NAME);
|
|
// select set
|
|
$c1 = new Criteria('rbac');
|
|
$c1->add(RbacUsersPeer::USR_UID, $userUid);
|
|
// update set
|
|
$c2 = new Criteria('rbac');
|
|
$c2->add(RbacUsersPeer::USR_STATUS, '1');
|
|
|
|
if ($userDn != null) {
|
|
$c2->add(RbacUsersPeer::USR_AUTH_USER_DN, $userDn);
|
|
$c2->add(RbacUsersPeer::USR_AUTH_SUPERVISOR_DN, '');
|
|
}
|
|
|
|
BasePeer::doUpdate($c1, $c2, $con);
|
|
|
|
if (!class_exists('Users')) {
|
|
require_once('classes/model/Users.php');
|
|
}
|
|
|
|
$con = Propel::getConnection(UsersPeer::DATABASE_NAME);
|
|
// select set
|
|
$c1 = new Criteria('workflow');
|
|
$c1->add(UsersPeer::USR_UID, $userUid);
|
|
// update set
|
|
$c2 = new Criteria('workflow');
|
|
$c2->add(UsersPeer::USR_STATUS, 'ACTIVE');
|
|
|
|
if ($depUid != null) {
|
|
$c2->add(UsersPeer::DEP_UID, $depUid);
|
|
}
|
|
|
|
BasePeer::doUpdate($c1, $c2, $con);
|
|
}
|
|
|
|
public function deactivateUser ($userUid)
|
|
{
|
|
if (!class_exists('RbacUsers')) {
|
|
require_once(PATH_RBAC.'model/RbacUsers.php');
|
|
}
|
|
|
|
$con = Propel::getConnection(RbacUsersPeer::DATABASE_NAME);
|
|
// select set
|
|
$c1 = new Criteria('rbac');
|
|
$c1->add(RbacUsersPeer::USR_USERNAME, $userUid);
|
|
// update set
|
|
$c2 = new Criteria('rbac');
|
|
$c2->add(RbacUsersPeer::USR_STATUS, '0');
|
|
|
|
BasePeer::doUpdate($c1, $c2, $con);
|
|
|
|
if (!class_exists('Users')) {
|
|
require_once('classes/model/Users.php');
|
|
}
|
|
|
|
$con = Propel::getConnection(UsersPeer::DATABASE_NAME);
|
|
// select set
|
|
$c1 = new Criteria('workflow');
|
|
$c1->add(UsersPeer::USR_USERNAME, $userUid);
|
|
// update set
|
|
$c2 = new Criteria('workflow');
|
|
$c2->add(UsersPeer::USR_STATUS, 'INACTIVE');
|
|
$c2->add(UsersPeer::DEP_UID, '');
|
|
|
|
BasePeer::doUpdate($c1, $c2, $con);
|
|
}
|
|
|
|
public function getTerminatedOu()
|
|
{
|
|
if (trim($this->sAuthSource)!='') {
|
|
$rbac = &RBAC::getSingleton();
|
|
$aAuthSource = $rbac->authSourcesObj->load($this->sAuthSource);
|
|
$attributes = $aAuthSource['AUTH_SOURCE_DATA'];
|
|
$this->sTerminatedOu = isset($attributes['AUTH_SOURCE_RETIRED_OU'])?$attributes['AUTH_SOURCE_RETIRED_OU']:'';
|
|
}
|
|
|
|
return $this->sTerminatedOu;
|
|
}
|
|
|
|
/**
|
|
get all authsource for this plugin ( ldapAdvanced plugin, because other authsources are not needed )
|
|
this function is used only by cron
|
|
returns only AUTH_SOURCE_PROVIDER = ldapAdvanced
|
|
|
|
@return array with authsources with type = ldap
|
|
*/
|
|
public function getAuthSources()
|
|
{
|
|
require_once(PATH_RBAC.'model/AuthenticationSource.php');
|
|
|
|
$oCriteria = new Criteria('rbac');
|
|
$aAuthSources = array();
|
|
|
|
$oAuthSource = new AuthenticationSource();
|
|
$oCriteria = $oAuthSource->getAllAuthSources();
|
|
$oDataset = AuthenticationSourcePeer::doSelectRS($oCriteria);
|
|
$oDataset->setFetchmode(ResultSet::FETCHMODE_ASSOC);
|
|
|
|
while ($oDataset->next()) {
|
|
$aRow = $oDataset->getRow();
|
|
|
|
if ($aRow['AUTH_SOURCE_PROVIDER'] == 'ldapAdvanced') {
|
|
$aRow["AUTH_SOURCE_DATA"] = ($aRow["AUTH_SOURCE_DATA"] != "")? unserialize($aRow["AUTH_SOURCE_DATA"]) : array();
|
|
|
|
$aAuthSources[] = $aRow;
|
|
}
|
|
}
|
|
|
|
return $aAuthSources;
|
|
}
|
|
|
|
/**
|
|
function to get departments from the array previously obtained from LDAP
|
|
we are calling registered departments
|
|
it is a recursive function, in the first call with an array with first top level departments from PM
|
|
then go thru all departments and obtain a list of departments already created in PM and pass that array
|
|
to next function to synchronize All users for each department
|
|
this function is used in cron only
|
|
|
|
@param array departments obtained from LDAP/Active Directory
|
|
@param array of departments, first call have only top level departments
|
|
*/
|
|
public function getRegisteredDepartments(array $arrayLdapDepartment, array $arrayDbDepartment)
|
|
{
|
|
$aResult = array();
|
|
|
|
if (!empty($arrayLdapDepartment)) {
|
|
$arrayLdapDepartment[0]["ou"] = $arrayLdapDepartment[0]["ou"] . " " . $arrayLdapDepartment[0]["dn"]; //Discard ROOT
|
|
|
|
foreach ($arrayLdapDepartment as $ldapDept) {
|
|
//$flagExists = false;
|
|
//
|
|
//foreach ($aResult as $value2) {
|
|
// $arrayDepartmentData = $value2;
|
|
//
|
|
// if ($arrayDepartmentData["DEP_LDAP_DN"] == $ldapDept["dn"]) {
|
|
// $flagExists = true;
|
|
// break;
|
|
// }
|
|
//}
|
|
//
|
|
//if ($flagExists) {
|
|
// continue;
|
|
//}
|
|
|
|
foreach ($arrayDbDepartment as $department) {
|
|
if ($department["DEP_TITLE"] == $ldapDept["ou"] && $department["DEP_LDAP_DN"] == $ldapDept["dn"]) {
|
|
$aResult[] = $department;
|
|
break;
|
|
|
|
//if ($department["HAS_CHILDREN"] != 0) {
|
|
// $aTempDepartments = $this->getDepartments($department["DEP_UID"]);
|
|
// $aTempRegistered = $this->getRegisteredDepartments($arrayLdapDepartment, $aTempDepartments);
|
|
// $aResult = array_merge($aResult, $aTempRegistered);
|
|
//}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
return $aResult;
|
|
}
|
|
|
|
/**
|
|
select departments but it is not recursive, only returns departments in this level
|
|
@param string $DepParent the DEP_UID for parent department
|
|
*/
|
|
public function getDepartments($DepParent)
|
|
{
|
|
try {
|
|
$result = array();
|
|
$criteria = new Criteria('workflow');
|
|
|
|
if (!empty($DepParent)) {
|
|
$criteria->add(DepartmentPeer::DEP_PARENT, $DepParent);
|
|
}
|
|
|
|
$con = Propel::getConnection(DepartmentPeer::DATABASE_NAME);
|
|
$objects = DepartmentPeer::doSelect($criteria, $con);
|
|
|
|
foreach ($objects as $oDepartment) {
|
|
$node = array();
|
|
$node['DEP_UID'] = $oDepartment->getDepUid();
|
|
$node['DEP_PARENT'] = $oDepartment->getDepParent();
|
|
$node['DEP_TITLE'] = stripslashes($oDepartment->getDepTitle());
|
|
$node['DEP_STATUS'] = $oDepartment->getDepStatus();
|
|
$node['DEP_MANAGER'] = $oDepartment->getDepManager();
|
|
$node['DEP_LDAP_DN'] = $oDepartment->getDepLdapDn();
|
|
$node['DEP_LAST'] = 0;
|
|
|
|
$criteriaCount = new Criteria('workflow');
|
|
$criteriaCount->clearSelectColumns();
|
|
$criteriaCount->addSelectColumn( 'COUNT(*)' );
|
|
$criteriaCount->add(DepartmentPeer::DEP_PARENT, $oDepartment->getDepUid(), Criteria::EQUAL);
|
|
$rs = DepartmentPeer::doSelectRS($criteriaCount);
|
|
$rs->next();
|
|
$row = $rs->getRow();
|
|
$node['HAS_CHILDREN'] = $row[0];
|
|
$result[] = $node;
|
|
}
|
|
|
|
if ( count($result) >= 1 ) {
|
|
$result[ count($result) -1 ]['DEP_LAST'] = 1;
|
|
}
|
|
|
|
return $result;
|
|
} catch (exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
function to get users from USERS table in wf_workflow and filter by department
|
|
this function is used in cron only
|
|
|
|
@param string department UID ( DEP_UID value )
|
|
@return array of users
|
|
*/
|
|
public function getUserFromPM($username)
|
|
{
|
|
try {
|
|
$criteria = new Criteria("workflow");
|
|
|
|
$criteria->addSelectColumn(UsersPeer::USR_UID);
|
|
$criteria->addSelectColumn(UsersPeer::USR_USERNAME);
|
|
$criteria->addSelectColumn(UsersPeer::DEP_UID);
|
|
$criteria->add(UsersPeer::USR_STATUS, "CLOSED", Criteria::NOT_EQUAL);
|
|
$criteria->add(UsersPeer::USR_USERNAME, $username, Criteria::EQUAL);
|
|
|
|
$rsCriteria = UsersPeer::doSelectRS($criteria);
|
|
$rsCriteria->setFetchmode(ResultSet::FETCHMODE_ASSOC);
|
|
|
|
if ($rsCriteria->next()) {
|
|
return $rsCriteria->getRow();
|
|
}
|
|
|
|
return array();
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
get all user (UID, USERNAME) moved to Removed OU
|
|
this function is used in cron only
|
|
|
|
@param array authSource row, in this fuction we are validating if Removed OU is defined or not
|
|
@return array of users
|
|
*/
|
|
public function getUsersFromRemovedOu($aAuthSource)
|
|
{
|
|
$aUsers = array(); //empty array is the default result
|
|
$attributes = $aAuthSource["AUTH_SOURCE_DATA"];
|
|
$this->sTerminatedOu = isset($attributes['AUTH_SOURCE_RETIRED_OU'])? trim($attributes['AUTH_SOURCE_RETIRED_OU']) : '';
|
|
|
|
if ($this->sTerminatedOu == '' ) {
|
|
return $aUsers;
|
|
}
|
|
|
|
return $this->getUsersFromDepartmentByName( $this->sTerminatedOu );
|
|
}
|
|
|
|
/**
|
|
set STATUS=0 for all users in the array $aUsers
|
|
this functin is used to deactivate an array of users ( usually used for Removed OU )
|
|
this function is used in cron only
|
|
|
|
@param array authSource row, in this fuction we are validating if Removed OU is defined or not
|
|
@return array of users
|
|
*/
|
|
public function deactiveArrayOfUsers($aUsers)
|
|
{
|
|
if (!class_exists('RbacUsers')) {
|
|
require_once(PATH_RBAC.'model/RbacUsers.php');
|
|
}
|
|
|
|
if (!class_exists('Users')) {
|
|
require_once('classes/model/Users.php');
|
|
}
|
|
|
|
$aUsrUid = array();
|
|
|
|
foreach ($aUsers as $key => $val) {
|
|
$aUsrUid[] = $val['sUsername'];
|
|
}
|
|
|
|
$con = Propel::getConnection('rbac');
|
|
// select set
|
|
$c1 = new Criteria('rbac');
|
|
$c1->add(RbacUsersPeer::USR_USERNAME, $aUsrUid, Criteria::IN );
|
|
$c1->add(RbacUsersPeer::USR_STATUS, 1 );
|
|
// update set
|
|
$c2 = new Criteria('rbac');
|
|
$c2->add(RbacUsersPeer::USR_STATUS, '0');
|
|
BasePeer::doUpdate($c1, $c2, $con);
|
|
|
|
$con = Propel::getConnection('workflow');
|
|
// select set
|
|
$c1 = new Criteria('workflow');
|
|
$c1->add(UsersPeer::USR_USERNAME, $aUsrUid, Criteria::IN );
|
|
// update set
|
|
$c2 = new Criteria('workflow');
|
|
$c2->add(UsersPeer::USR_STATUS, 'INACTIVE');
|
|
$c2->add(UsersPeer::DEP_UID, '');
|
|
|
|
BasePeer::doUpdate($c1, $c2, $con);
|
|
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
creates an users using the data send in the array $aUsers
|
|
and then add the user to specific department
|
|
this function is used in cron only
|
|
|
|
@param array $aUser info taken from ldap
|
|
@param string $depUid the department UID
|
|
@return boolean
|
|
*/
|
|
public function createUserAndActivate($aUser, $depUid)
|
|
{
|
|
$rbac = &RBAC::getSingleton();
|
|
|
|
if ($rbac->userObj == null) {
|
|
$rbac->userObj = new RbacUsers();
|
|
}
|
|
|
|
if ($rbac->rolesObj == null) {
|
|
$rbac->rolesObj = new Roles();
|
|
}
|
|
|
|
if ($rbac->usersRolesObj == null) {
|
|
$rbac->usersRolesObj = new UsersRoles();
|
|
}
|
|
|
|
$sUsername = $aUser['sUsername'];
|
|
$sFullname = $aUser['sFullname'];
|
|
$sFirstname = $aUser['sFirstname'];
|
|
$sLastname = $aUser['sLastname'];
|
|
$sEmail = $aUser['sEmail'];
|
|
$sDn = $aUser['sDN'];
|
|
|
|
$aData = array();
|
|
$aData['USR_USERNAME'] = $sUsername;
|
|
$aData["USR_PASSWORD"] = "00000000000000000000000000000000";
|
|
$aData['USR_FIRSTNAME'] = $sFirstname;
|
|
$aData['USR_LASTNAME'] = $sLastname;
|
|
$aData['USR_EMAIL'] = $sEmail;
|
|
$aData['USR_DUE_DATE'] = date('Y-m-d', mktime(0, 0, 0, date('m'), date('d'), date('Y') + 2));
|
|
$aData['USR_CREATE_DATE'] = date('Y-m-d H:i:s');
|
|
$aData['USR_UPDATE_DATE'] = date('Y-m-d H:i:s');
|
|
$aData['USR_BIRTHDAY'] = date('Y-m-d');
|
|
$aData['USR_STATUS'] = 1;
|
|
$aData['USR_AUTH_TYPE'] = 'ldapadvanced';
|
|
$aData['UID_AUTH_SOURCE'] = $this->sAuthSource;
|
|
$aData['USR_AUTH_USER_DN'] = $sDn;
|
|
|
|
$sUserUID = $rbac->createUser($aData, "PROCESSMAKER_OPERATOR");
|
|
|
|
$aData['USR_STATUS'] = 'ACTIVE';
|
|
$aData['USR_UID'] = $sUserUID;
|
|
$aData['DEP_UID'] = $depUid;
|
|
$aData['USR_ROLE'] = 'PROCESSMAKER_OPERATOR';
|
|
|
|
require_once 'classes/model/Users.php';
|
|
|
|
$oUser = new Users();
|
|
$oUser->create($aData);
|
|
|
|
return $sUserUID;
|
|
}
|
|
|
|
public function synchronizeManagers($managersHierarchy)
|
|
{
|
|
require_once 'classes/model/RbacUsers.php';
|
|
|
|
try {
|
|
foreach ($managersHierarchy as $managerDN => $subordinates) {
|
|
$criteria = new Criteria('rbac');
|
|
$criteria->addSelectColumn('*');
|
|
$criteria->add(RbacUsersPeer::USR_AUTH_USER_DN, $managerDN);
|
|
$dataset = RbacUsersPeer::doSelectRS($criteria);
|
|
$dataset->setFetchmode(ResultSet::FETCHMODE_ASSOC);
|
|
|
|
if ($dataset->next()) {
|
|
$row = $dataset->getRow();
|
|
$criteriaSet = new Criteria('workflow');
|
|
$criteriaSet->add(UsersPeer::USR_REPORTS_TO, $row['USR_UID']);
|
|
$criteriaWhere = new Criteria('workflow');
|
|
$criteriaWhere->add(UsersPeer::USR_UID, $subordinates, Criteria::IN);
|
|
BasePeer::doUpdate($criteriaWhere, $criteriaSet, Propel::getConnection('workflow'));
|
|
}
|
|
}
|
|
} catch (Exception $error) {
|
|
$this->log($this->ldapcnn, $error->getMessage());
|
|
}
|
|
}
|
|
|
|
public function clearManager($usersUIDs)
|
|
{
|
|
try {
|
|
$criteriaSet = new Criteria('workflow');
|
|
$criteriaSet->add(UsersPeer::USR_REPORTS_TO, '');
|
|
$criteriaWhere = new Criteria('workflow');
|
|
$criteriaWhere->add(UsersPeer::USR_UID, $usersUIDs, Criteria::IN);
|
|
BasePeer::doUpdate($criteriaWhere, $criteriaSet, Propel::getConnection('workflow'));
|
|
} catch (Exception $error) {
|
|
$this->log($this->ldapcnn, $error->getMessage());
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get a group list
|
|
* @return <type>
|
|
*/
|
|
public function searchGroups()
|
|
{
|
|
try {
|
|
$arrayGroup = [];
|
|
|
|
//Set variables
|
|
$rbac = &RBAC::getSingleton();
|
|
|
|
if (is_null($rbac->authSourcesObj)) {
|
|
$rbac->authSourcesObj = new AuthenticationSource();
|
|
}
|
|
|
|
$arrayAuthenticationSourceData = $rbac->authSourcesObj->load($this->sAuthSource);
|
|
|
|
if (is_null($this->ldapcnn)) {
|
|
$this->ldapcnn = $this->ldapConnection($arrayAuthenticationSourceData);
|
|
}
|
|
|
|
$ldapcnn = $this->ldapcnn;
|
|
|
|
//Get Groups
|
|
$limit = $this->__getPageSizeLimitByData($arrayAuthenticationSourceData);
|
|
$flagError = false;
|
|
|
|
$filter = '(' . $this->arrayObjectClassFilter['group'] . ')';
|
|
|
|
$this->log($ldapcnn, 'search groups with Filter: ' . $filter);
|
|
|
|
$cookie = '';
|
|
|
|
do {
|
|
ldap_control_paged_result($ldapcnn, $limit, true, $cookie);
|
|
|
|
$searchResult = @ldap_search($ldapcnn, $arrayAuthenticationSourceData['AUTH_SOURCE_BASE_DN'], $filter, ['dn', 'cn']);
|
|
|
|
if ($error = ldap_errno($ldapcnn)) {
|
|
$this->log($ldapcnn, 'Error in Search');
|
|
|
|
$flagError = true;
|
|
} else {
|
|
if ($searchResult) {
|
|
//Get groups from the ldap entries
|
|
$countEntries = ldap_count_entries($ldapcnn, $searchResult);
|
|
|
|
if ($countEntries > 0) {
|
|
$entry = ldap_first_entry($ldapcnn, $searchResult);
|
|
|
|
do {
|
|
$arrayEntryData = $this->ldapGetAttributes($ldapcnn, $entry);
|
|
|
|
if (isset($arrayEntryData['cn']) && !is_array($arrayEntryData['cn'])) {
|
|
$arrayGroup[] = [
|
|
'dn' => $arrayEntryData['dn'],
|
|
'cn' => trim($arrayEntryData['cn']),
|
|
'users' => 0,
|
|
];
|
|
}
|
|
} while ($entry = ldap_next_entry($ldapcnn, $entry));
|
|
}
|
|
}
|
|
}
|
|
|
|
if (!$flagError) {
|
|
ldap_control_paged_result_response($ldapcnn, $searchResult, $cookie);
|
|
}
|
|
} while (($cookie !== null && $cookie != '') && !$flagError);
|
|
|
|
$str = '';
|
|
|
|
foreach ($arrayGroup as $group) {
|
|
$str .= ' ' . $group['cn'];
|
|
}
|
|
|
|
$this->log($ldapcnn, 'found '. count($arrayGroup) . ' groups: ' . $str);
|
|
|
|
//Return
|
|
return $arrayGroup;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Check if the group exists and returns the PM UID
|
|
* @param <type> $currentDN
|
|
* @return <type>
|
|
*/
|
|
|
|
public function getGrpUidIfExistsDN($currentDN)
|
|
{
|
|
try {
|
|
$criteria = new Criteria('workflow');
|
|
$criteria->add(GroupwfPeer::GRP_STATUS , 'ACTIVE');
|
|
$criteria->add(GroupwfPeer::GRP_LDAP_DN, $currentDN);
|
|
$dataset = GroupwfPeer::doSelectRS($criteria);
|
|
$dataset->setFetchmode(ResultSet::FETCHMODE_ASSOC);
|
|
|
|
if ($dataset->next()) {
|
|
$row = $dataset->getRow();
|
|
|
|
return $row['GRP_UID'];
|
|
}
|
|
|
|
return "";
|
|
} catch (Exception $e) {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get number of Users in each Group from the Database
|
|
*
|
|
* return array Return array with the number of Users in each Group from the Database
|
|
*/
|
|
public function groupsGetNumberOfUsersFromDb()
|
|
{
|
|
try {
|
|
$arrayData = array();
|
|
|
|
//Get data
|
|
$criteria = new Criteria("workflow");
|
|
|
|
$criteria->addSelectColumn(GroupUserPeer::GRP_UID);
|
|
$criteria->addSelectColumn("COUNT(" . GroupUserPeer::GRP_UID . ") AS NUM_REC");
|
|
$criteria->addJoin(GroupUserPeer::USR_UID, UsersPeer::USR_UID, Criteria::LEFT_JOIN);
|
|
$criteria->add(UsersPeer::USR_STATUS, "CLOSED", Criteria::NOT_EQUAL);
|
|
$criteria->addGroupByColumn(GroupUserPeer::GRP_UID);
|
|
|
|
$rsCriteria = GroupUserPeer::doSelectRS($criteria);
|
|
$rsCriteria->setFetchmode(ResultSet::FETCHMODE_ASSOC);
|
|
|
|
while ($rsCriteria->next()) {
|
|
$row = $rsCriteria->getRow();
|
|
|
|
$arrayData[$row["GRP_UID"]] = $row["NUM_REC"];
|
|
}
|
|
|
|
//Return
|
|
return $arrayData;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
select groups but it is not recursive, only returns groups in this level
|
|
*/
|
|
public function getGroups()
|
|
{
|
|
try {
|
|
$result = array();
|
|
$criteria = new Criteria('workflow');
|
|
$con = Propel::getConnection(GroupwfPeer::DATABASE_NAME);
|
|
$objects = GroupwfPeer::doSelect($criteria, $con);
|
|
|
|
foreach ($objects as $oGroup) {
|
|
$node = array();
|
|
$node['GRP_UID'] = $oGroup->getGrpUid();
|
|
$node['GRP_TITLE'] = stripslashes($oGroup->getGrpTitle());
|
|
$node['GRP_STATUS'] = $oGroup->getGrpStatus();
|
|
$node['GRP_LDAP_DN'] = $oGroup->getGrpLdapDn();
|
|
$result[] = $node;
|
|
}
|
|
|
|
return $result;
|
|
} catch (exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
function to get groups from the array previously obtained from LDAP
|
|
we are calling registered groups
|
|
it is a recursive function, in the first call with an array with first top level groups from PM
|
|
then go thru all groups and obtain a list of groups already created in PM and pass that array
|
|
to next function to synchronize All users for each group
|
|
this function is used in cron only
|
|
|
|
@param array groups obtained from LDAP/Active Directory
|
|
@param array of groups, first call have only top level groups
|
|
*/
|
|
public function getRegisteredGroups(array $arrayLdapGroup, array $arrayDbGroup)
|
|
{
|
|
$aResult = array();
|
|
|
|
if (!empty($arrayLdapGroup)) {
|
|
foreach ($arrayLdapGroup as $ldapGroup) {
|
|
foreach ($arrayDbGroup as $group) {
|
|
if ($group["GRP_TITLE"] == $ldapGroup["cn"] && $group["GRP_LDAP_DN"] == $ldapGroup["dn"]) {
|
|
$aResult[] = $group;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
return $aResult;
|
|
}
|
|
|
|
/**
|
|
* Convert 18-digit LDAP timestamps to format PM
|
|
*
|
|
* @author Ronald Escobar <ronald@colosa.com>
|
|
* @param Date | $dateAD | Date of AD ('Windows NT time format' and 'Win32 FILETIME or SYSTEMTIME')
|
|
* @param Date | $datePM | Date of PM
|
|
*/
|
|
public function convertDateADtoPM($dateAD)
|
|
{
|
|
$unixTimestamp = ($dateAD / 10000000) - 11644560000;
|
|
$datePM = date('Y-m-d', mktime(0, 0, 0, date('m'), '01', date('Y') + 2));//(date('Y') + 10)."-12-01";
|
|
if ($unixTimestamp >0) {
|
|
$dateAux = date("Y-m-d", $unixTimestamp);
|
|
$yearAux = date("Y", $unixTimestamp);
|
|
if (strlen(trim($yearAux)) <= 4) {
|
|
$datePM = $dateAux;
|
|
}
|
|
}
|
|
return $datePM;
|
|
}
|
|
|
|
public function custom_ldap_explode_dn($dn)
|
|
{
|
|
$dn = trim($dn, ',');
|
|
$result = ldap_explode_dn($dn, 0);
|
|
|
|
if (is_array($result)) {
|
|
unset($result['count']);
|
|
|
|
foreach ($result as $key => $value) {
|
|
$result[$key] = addcslashes(preg_replace("/\\\([0-9A-Fa-f]{2})/e", "''.chr(hexdec('\\1')).''", $value), '<>,"');
|
|
}
|
|
}
|
|
|
|
return $result;
|
|
}
|
|
|
|
/**
|
|
* Synchronize User for this Department
|
|
*
|
|
* @param string $departmentUid UID of Department
|
|
* @param array $arrayUserLdap User LDAP data
|
|
* @param array $arrayData Data
|
|
*
|
|
* return array Return data
|
|
*/
|
|
public function departmentSynchronizeUser($departmentUid, array $arrayUserLdap, array $arrayData)
|
|
{
|
|
try {
|
|
$this->debugLog("class.ldapAdvanced.php > function departmentSynchronizeUser() > START");
|
|
$this->debugLog("class.ldapAdvanced.php > function departmentSynchronizeUser() > \$arrayUserLdap[sUsername] ----> " . $arrayUserLdap["sUsername"]);
|
|
|
|
$userUid = "";
|
|
$found = false;
|
|
|
|
$arrayUserData = $this->departmentGetUserDataIfUsernameExists($arrayUserLdap["sUsername"]);
|
|
|
|
if (!empty($arrayUserData)) {
|
|
//User already exists in this department and there is nothing to do
|
|
//User already exists
|
|
$userUid = $arrayUserData["USR_UID"];
|
|
$found = true;
|
|
|
|
$arrayData["already"]++;
|
|
$arrayData["alreadyUsers"] .= $arrayUserData["USR_USERNAME"] . " ";
|
|
}
|
|
|
|
if (!$found) {
|
|
//If user DO NOT exists in this department.. do:
|
|
//If exists with another AuthSource -> impossible
|
|
//If exists in another department, but in PM and for this authsource, we need to move it
|
|
|
|
//$arrayNewUserData = $this->searchUserByUid($arrayUserLdap["sUsername"]);
|
|
$arrayNewUserData = $arrayUserLdap;
|
|
|
|
$arrayAux = $this->custom_ldap_explode_dn($arrayNewUserData["sDN"]);
|
|
array_shift($arrayAux);
|
|
|
|
$departmentUid = $this->getDepUidIfExistsDN(implode(",", $arrayAux)); //Check if exists the Department DN in DB
|
|
|
|
$this->debugLog("class.ldapAdvanced.php > function departmentSynchronizeUser() > \$departmentUid ----> $departmentUid");
|
|
|
|
if ($departmentUid != "") {
|
|
$arrayUserData = $this->authenticationSourceGetUserDataIfUsernameExists($arrayNewUserData["sUsername"]);
|
|
|
|
if (!empty($arrayUserData)) {
|
|
//User exists in this Authentication Source
|
|
//Move User
|
|
$userUid = $arrayUserData["USR_UID"];
|
|
|
|
$this->activateUser($arrayUserData["USR_UID"], $arrayNewUserData["sDN"], $departmentUid);
|
|
|
|
$arrayData["moved"]++;
|
|
$arrayData["movedUsers"] .= $arrayUserData["USR_USERNAME"] . " ";
|
|
|
|
$this->setArrayAuthenticationSourceUser($userUid, $arrayNewUserData); //INITIALIZE DATA //Update User
|
|
} else {
|
|
$arrayUserData = $this->getUserFromPM($arrayNewUserData["sUsername"]);
|
|
|
|
if (!empty($arrayUserData)) {
|
|
//User exists in another Authentication Source and another Department
|
|
//Impossible
|
|
$userUid = $arrayUserData["USR_UID"];
|
|
|
|
$arrayData["impossible"]++;
|
|
$arrayData["impossibleUsers"] .= $arrayUserData["USR_USERNAME"] . " ";
|
|
} else {
|
|
//User not exists
|
|
//Create User
|
|
$userUid = $this->createUserAndActivate($arrayNewUserData, $departmentUid);
|
|
|
|
$arrayData["created"]++;
|
|
$arrayData["createdUsers"] .= $arrayNewUserData["sUsername"] . " ";
|
|
|
|
$this->setArrayAuthenticationSourceUser($userUid, $arrayNewUserData); //INITIALIZE DATA //Add User
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
if ($userUid != "") {
|
|
$arrayData["arrayUserUid"][] = $userUid;
|
|
|
|
if (isset($arrayUserLdap["sManagerDN"]) && $arrayUserLdap["sManagerDN"] != "") {
|
|
if (!isset($arrayData["managersHierarchy"][$arrayUserLdap["sManagerDN"]])) {
|
|
$arrayData["managersHierarchy"][$arrayUserLdap["sManagerDN"]] = array();
|
|
}
|
|
|
|
$arrayData["managersHierarchy"][$arrayUserLdap["sManagerDN"]][$userUid] = $userUid;
|
|
}
|
|
}
|
|
|
|
$this->debugLog("class.ldapAdvanced.php > function departmentSynchronizeUser() > \$userUid ----> $userUid");
|
|
$this->debugLog("class.ldapAdvanced.php > function departmentSynchronizeUser() > END");
|
|
|
|
//Return
|
|
return $arrayData;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Synchronize User for this Group
|
|
*
|
|
* @param string $groupUid UID of Group
|
|
* @param array $arrayUserLdap User LDAP data
|
|
* @param array $arrayData Data
|
|
*
|
|
* return array Return data
|
|
*/
|
|
public function groupSynchronizeUser($groupUid, array $arrayUserLdap, array $arrayData)
|
|
{
|
|
try {
|
|
$this->debugLog("class.ldapAdvanced.php > function groupSynchronizeUser() > START");
|
|
$this->debugLog("class.ldapAdvanced.php > function groupSynchronizeUser() > \$arrayUserLdap[sUsername] ----> " . $arrayUserLdap["sUsername"]);
|
|
|
|
$group = new Groups();
|
|
|
|
$userUid = "";
|
|
$found = false;
|
|
|
|
$arrayUserData = $this->groupGetUserDataIfUsernameExists($arrayUserLdap["sUsername"]);
|
|
|
|
if (!empty($arrayUserData)) {
|
|
//User already exists in this group and there is nothing to do
|
|
//User already exists
|
|
$userUid = $arrayUserData["USR_UID"];
|
|
$found = true;
|
|
|
|
$arrayData["already"]++;
|
|
$arrayData["alreadyUsers"] .= $arrayUserData["USR_USERNAME"] . " ";
|
|
}
|
|
|
|
if (!$found) {
|
|
//If user DO NOT exists in this group.. do:
|
|
//If exists with another AuthSource -> impossible
|
|
//If exists in another group, but in PM and for this authsource, we need to move it
|
|
|
|
//$arrayNewUserData = $this->searchUserByUid($arrayUserLdap["sUsername"]);
|
|
$arrayNewUserData = $arrayUserLdap;
|
|
|
|
$arrayUserData = $this->authenticationSourceGetUserDataIfUsernameExists($arrayNewUserData["sUsername"]);
|
|
|
|
if (!empty($arrayUserData)) {
|
|
//User exists in this Authentication Source
|
|
//Move User
|
|
$userUid = $arrayUserData["USR_UID"];
|
|
|
|
$this->activateUser($arrayUserData["USR_UID"], $arrayNewUserData["sDN"]);
|
|
|
|
$group->addUserToGroup($groupUid, $userUid);
|
|
|
|
$arrayData["moved"]++;
|
|
$arrayData["movedUsers"] .= $arrayUserData["USR_USERNAME"] . " ";
|
|
|
|
$this->setArrayAuthenticationSourceUser($userUid, $arrayNewUserData); //INITIALIZE DATA //Update User
|
|
} else {
|
|
$arrayUserData = $this->getUserFromPM($arrayNewUserData["sUsername"]);
|
|
|
|
if (!empty($arrayUserData)) {
|
|
//User exists in another Authentication Source and another Group
|
|
//Impossible
|
|
$userUid = $arrayUserData["USR_UID"];
|
|
|
|
$arrayData["impossible"]++;
|
|
$arrayData["impossibleUsers"] .= $arrayUserData["USR_USERNAME"] . " ";
|
|
} else {
|
|
//User not exists
|
|
//Create User
|
|
$userUid = $this->createUserAndActivate($arrayNewUserData, "");
|
|
|
|
$group->addUserToGroup($groupUid, $userUid);
|
|
|
|
$arrayData["created"]++;
|
|
$arrayData["createdUsers"] .= $arrayNewUserData["sUsername"] . " ";
|
|
|
|
$this->setArrayAuthenticationSourceUser($userUid, $arrayNewUserData); //INITIALIZE DATA //Add User
|
|
}
|
|
}
|
|
}
|
|
|
|
if ($userUid != "") {
|
|
$arrayData["arrayUserUid"][] = $userUid;
|
|
|
|
if (isset($arrayUserLdap["sManagerDN"]) && $arrayUserLdap["sManagerDN"] != "") {
|
|
if (!isset($arrayData["managersHierarchy"][$arrayUserLdap["sManagerDN"]])) {
|
|
$arrayData["managersHierarchy"][$arrayUserLdap["sManagerDN"]] = array();
|
|
}
|
|
|
|
$arrayData["managersHierarchy"][$arrayUserLdap["sManagerDN"]][$userUid] = $userUid;
|
|
}
|
|
}
|
|
|
|
$this->debugLog("class.ldapAdvanced.php > function groupSynchronizeUser() > \$userUid ----> $userUid");
|
|
$this->debugLog("class.ldapAdvanced.php > function groupSynchronizeUser() > END");
|
|
|
|
//Return
|
|
return $arrayData;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Update User data based on the LDAP Server
|
|
*
|
|
* @param resource $ldapcnn LDAP link identifier
|
|
* @param array $arrayAuthSourceData Authentication Source Data
|
|
* @param string $userDn User DN
|
|
* @param array $arrayUser Users
|
|
*
|
|
* @return bool
|
|
*/
|
|
private function __ldapUserUpdateByDnAndData($ldapcnn, array $arrayAuthSourceData, $userDn, array $arrayUser)
|
|
{
|
|
try {
|
|
//Set variables
|
|
$rbac = &RBAC::getSingleton();
|
|
|
|
if (is_null($rbac->userObj)) {
|
|
$rbac->userObj = new RbacUsers();
|
|
}
|
|
|
|
//Set variables
|
|
$flagUser = false;
|
|
|
|
$arrayAttributesToSync = [
|
|
//Default attributes to sync
|
|
'USR_FIRSTNAME' => 'givenname',
|
|
'USR_LASTNAME' => 'sn',
|
|
'USR_EMAIL' => 'mail',
|
|
'USR_STATUS' => 'useraccountcontrol'
|
|
];
|
|
|
|
if (isset($arrayAuthSourceData['AUTH_SOURCE_DATA']['AUTH_SOURCE_GRID_ATTRIBUTE']) &&
|
|
!empty($arrayAuthSourceData['AUTH_SOURCE_DATA']['AUTH_SOURCE_GRID_ATTRIBUTE'])
|
|
) {
|
|
foreach ($arrayAuthSourceData['AUTH_SOURCE_DATA']['AUTH_SOURCE_GRID_ATTRIBUTE'] as $value) {
|
|
$arrayAttributesToSync[$value['attributeUser']] = $value['attributeLdap'];
|
|
}
|
|
}
|
|
|
|
//Search User from LDAP Server
|
|
$uidUserIdentifier = (isset($arrayAuthSourceData['AUTH_SOURCE_DATA']['AUTH_SOURCE_IDENTIFIER_FOR_USER']))?
|
|
$arrayAuthSourceData['AUTH_SOURCE_DATA']['AUTH_SOURCE_IDENTIFIER_FOR_USER'] : 'uid';
|
|
|
|
$arrayAttribute = array_merge($this->arrayAttributesForUser, array_values($arrayAttributesToSync));
|
|
|
|
$searchResult = @ldap_search($ldapcnn, $userDn, '(objectclass=*)', $arrayAttribute);
|
|
|
|
if ($error = ldap_errno($ldapcnn)) {
|
|
//
|
|
} else {
|
|
if ($searchResult && ldap_count_entries($ldapcnn, $searchResult) > 0) {
|
|
$entry = ldap_first_entry($ldapcnn, $searchResult);
|
|
|
|
$arrayUserLdap = $this->ldapGetAttributes($ldapcnn, $entry);
|
|
|
|
$username = (isset($arrayUserLdap[$uidUserIdentifier]))? $arrayUserLdap[$uidUserIdentifier] : '';
|
|
|
|
if ((is_array($username) && !empty($username)) || trim($username) != '') {
|
|
$username = trim((is_array($username))? $username[0] : $username);
|
|
|
|
if (isset($arrayUser[$username])) {
|
|
if (!isset($this->arrayUserUpdateChecked[$username])) {
|
|
$this->arrayUserUpdateChecked[$username] = 1;
|
|
|
|
$arrayUserDataUpdate = [];
|
|
|
|
foreach ($arrayAttributesToSync as $key => $value) {
|
|
$fieldName = $key;
|
|
$attributeName = strtolower($value);
|
|
|
|
if (isset($arrayUserLdap[$attributeName])) {
|
|
$ldapAttributeValue = trim((is_array($arrayUserLdap[$attributeName]))? $arrayUserLdap[$attributeName][0] : $arrayUserLdap[$attributeName]);
|
|
|
|
switch ($fieldName) {
|
|
case 'USR_STATUS':
|
|
if ($attributeName == 'useraccountcontrol') {
|
|
$ldapAttributeValue = (preg_match('/^(?:' . '512|544|66048|66080' . ')$/', $ldapAttributeValue))? (($arrayUser[$username][$fieldName] == 'VACATION')? 'VACATION' : 'ACTIVE') : 'INACTIVE';
|
|
}
|
|
break;
|
|
case 'USR_DUE_DATE':
|
|
if ($attributeName == 'accountexpires') {
|
|
$ldapAttributeValue = $this->convertDateADtoPM($ldapAttributeValue);
|
|
}
|
|
break;
|
|
}
|
|
|
|
if ($ldapAttributeValue != $arrayUser[$username][$fieldName]) {
|
|
$arrayUserDataUpdate[$fieldName] = $ldapAttributeValue;
|
|
}
|
|
}
|
|
}
|
|
|
|
if (!empty($arrayUserDataUpdate)) {
|
|
$arrayUserDataUpdate['USR_UID'] = $arrayUser[$username]['USR_UID'];
|
|
|
|
//Update User data
|
|
$rbac->updateUser($arrayUserDataUpdate);
|
|
|
|
$user = new Users();
|
|
$result = $user->update($arrayUserDataUpdate);
|
|
}
|
|
} else {
|
|
$this->log(
|
|
$ldapcnn,
|
|
'User is repeated: Username "' . $username .'", DN "' . $arrayUserLdap['dn'] . '"'
|
|
);
|
|
}
|
|
|
|
$flagUser = true;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
//Return
|
|
return $flagUser;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Update Users data based on the LDAP Server
|
|
*
|
|
* @param resource $ldapcnn LDAP link identifier
|
|
* @param array $arrayAuthSourceData Authentication Source Data
|
|
* @param string $filterUsers Filter
|
|
* @param array $arrayUserUid UID of Users
|
|
* @param array $arrayData Data
|
|
*
|
|
* @return array
|
|
*/
|
|
private function __ldapUsersUpdateData(
|
|
$ldapcnn,
|
|
array $arrayAuthSourceData,
|
|
$filterUsers,
|
|
array $arrayUserUid,
|
|
array $arrayData
|
|
) {
|
|
try {
|
|
$totalUser = $arrayData['totalUser'];
|
|
$countUser = $arrayData['countUser'];
|
|
|
|
//Search Users
|
|
$filter = '(&(' . $this->arrayObjectClassFilter['user'] . ')(|' . $filterUsers . '))';
|
|
|
|
$searchResult = @ldap_search($ldapcnn, $arrayAuthSourceData['AUTH_SOURCE_BASE_DN'], $filter, $this->arrayAttributesForUser);
|
|
|
|
if ($error = ldap_errno($ldapcnn)) {
|
|
//
|
|
} else {
|
|
if ($searchResult && ldap_count_entries($ldapcnn, $searchResult) > 0) {
|
|
//Get Users from DB
|
|
$arrayUser = [];
|
|
|
|
$criteria = new Criteria('workflow');
|
|
|
|
$criteria->add(UsersPeer::USR_UID, $arrayUserUid, Criteria::IN);
|
|
//$criteria->add(UsersPeer::USR_USERNAME, '', Criteria::NOT_EQUAL);
|
|
$criteria->add(UsersPeer::USR_STATUS, 'CLOSED', Criteria::NOT_EQUAL);
|
|
|
|
$rsCriteria = UsersPeer::doSelectRS($criteria);
|
|
$rsCriteria->setFetchmode(ResultSet::FETCHMODE_ASSOC);
|
|
|
|
while ($rsCriteria->next()) {
|
|
$row = $rsCriteria->getRow();
|
|
|
|
$arrayUser[$row['USR_USERNAME']] = $row;
|
|
}
|
|
|
|
//Get Users from LDAP Server
|
|
$entry = ldap_first_entry($ldapcnn, $searchResult);
|
|
|
|
do {
|
|
if ($this->__ldapUserUpdateByDnAndData(
|
|
$ldapcnn, $arrayAuthSourceData, ldap_get_dn($ldapcnn, $entry), $arrayUser
|
|
)
|
|
) {
|
|
$countUser++;
|
|
|
|
//Progress bar
|
|
$this->frontEndShow(
|
|
'BAR',
|
|
'Update Users data: ' . $countUser . '/' . $totalUser . ' ' . $this->progressBar($totalUser, $countUser)
|
|
);
|
|
}
|
|
} while ($entry = ldap_next_entry($ldapcnn, $entry));
|
|
}
|
|
}
|
|
|
|
//Return
|
|
return [$totalUser, $countUser];
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Update Users data based on the LDAP Server
|
|
*
|
|
* @param string $authenticationSourceUid UID of Authentication Source
|
|
*
|
|
* return void
|
|
*/
|
|
public function usersUpdateData($authenticationSourceUid)
|
|
{
|
|
try {
|
|
$totalUser = count($this->arrayAuthenticationSourceUsersByUid);
|
|
$countUser = 0;
|
|
|
|
//Set variables
|
|
$rbac = &RBAC::getSingleton();
|
|
|
|
if (is_null($rbac->authSourcesObj)) {
|
|
$rbac->authSourcesObj = new AuthenticationSource();
|
|
}
|
|
|
|
$arrayAuthenticationSourceData = $rbac->authSourcesObj->load($authenticationSourceUid);
|
|
|
|
$this->ldapcnn = $this->ldapConnection($arrayAuthenticationSourceData);
|
|
|
|
$ldapcnn = $this->ldapcnn;
|
|
|
|
//Update Users
|
|
$limit = $this->__getPageSizeLimitByData($arrayAuthenticationSourceData);
|
|
$count = 0;
|
|
|
|
$uidUserIdentifier = (isset($arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_IDENTIFIER_FOR_USER"]))? $arrayAuthenticationSourceData["AUTH_SOURCE_DATA"]["AUTH_SOURCE_IDENTIFIER_FOR_USER"] : "uid";
|
|
|
|
$filterUsers = "";
|
|
$arrayUserUid = array();
|
|
|
|
foreach ($this->arrayAuthenticationSourceUsersByUid as $value) {
|
|
$arrayUserData = $value;
|
|
|
|
$count++;
|
|
|
|
$filterUsers .= "($uidUserIdentifier=" . $arrayUserData["USR_USERNAME"] . ")";
|
|
$arrayUserUid[] = $arrayUserData["USR_UID"];
|
|
|
|
if ($count == $limit) {
|
|
list($totalUser, $countUser) = $this->__ldapUsersUpdateData(
|
|
$ldapcnn, $arrayAuthenticationSourceData, $filterUsers, $arrayUserUid, ['totalUser' => $totalUser, 'countUser' => $countUser]
|
|
);
|
|
|
|
$count = 0;
|
|
|
|
$filterUsers = "";
|
|
$arrayUserUid = array();
|
|
}
|
|
}
|
|
|
|
if ($count > 0) {
|
|
list($totalUser, $countUser) = $this->__ldapUsersUpdateData(
|
|
$ldapcnn, $arrayAuthenticationSourceData, $filterUsers, $arrayUserUid, ['totalUser' => $totalUser, 'countUser' => $countUser]
|
|
);
|
|
}
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get page size limit for a search result
|
|
*
|
|
* @param array $arrayAuthSourceData Authentication Source Data
|
|
*
|
|
* @return int Returns the page size limit for a search result
|
|
*/
|
|
private function __getPageSizeLimitByData(array $arrayAuthSourceData)
|
|
{
|
|
if (isset($arrayAuthSourceData['AUTH_SOURCE_DATA']['LDAP_PAGE_SIZE_LIMIT'])) {
|
|
return $arrayAuthSourceData['AUTH_SOURCE_DATA']['LDAP_PAGE_SIZE_LIMIT'];
|
|
} else {
|
|
return $this->getPageSizeLimit(false);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get page size limit for a search result
|
|
*
|
|
* @param resource $ldapcnn LDAP link identifier
|
|
* @param string $baseDn The base DN for the directory
|
|
*
|
|
* @return int Returns the page size limit for a search result
|
|
*/
|
|
public function getPageSizeLimit($ldapcnn, $baseDn = '')
|
|
{
|
|
try {
|
|
$limit = 1000;
|
|
|
|
if ($ldapcnn === false) {
|
|
return $limit;
|
|
}
|
|
|
|
$searchResult = @ldap_search($ldapcnn, $baseDn, '(|(objectclass=*))', ['dn']);
|
|
|
|
if ($searchResult) {
|
|
$countEntries = ldap_count_entries($ldapcnn, $searchResult);
|
|
|
|
if ($countEntries > 0) {
|
|
$limit = ($countEntries > $limit)? $limit : $countEntries;
|
|
}
|
|
}
|
|
|
|
//Return
|
|
return $limit;
|
|
} catch (Exception $e) {
|
|
throw $e;
|
|
}
|
|
}
|
|
}
|