--- /dev/null
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2021 Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace OCA\User_LDAP\Command;
+
+use OCA\User_LDAP\Access;
+use OCA\User_LDAP\Group_Proxy;
+use OCA\User_LDAP\Mapping\AbstractMapping;
+use OCA\User_LDAP\Mapping\GroupMapping;
+use OCA\User_LDAP\Mapping\UserMapping;
+use OCA\User_LDAP\User_Proxy;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Helper\ProgressBar;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use function sprintf;
+
+class UuidUpdateReport {
+ const UNCHANGED = 0;
+ const UNKNOWN = 1;
+ const UNREADABLE = 2;
+ const UPDATED = 3;
+ const UNWRITABLE = 4;
+ const UNMAPPED = 5;
+
+ public $id = '';
+ public $dn = '';
+ public $isUser = true;
+ public $state = self::UNCHANGED;
+ public $oldUuid = '';
+ public $newUuid = '';
+
+ public function __construct(string $id, string $dn, bool $isUser, int $state, $oldUuid = '', $newUuid = '') {
+ $this->id = $id;
+ $this->dn = $dn;
+ $this->isUser = $isUser;
+ $this->state = $state;
+ $this->oldUuid = $oldUuid;
+ $this->newUuid = $newUuid;
+ }
+}
+
+class UpdateUUID extends Command {
+ /** @var UserMapping */
+ private $userMapping;
+ /** @var GroupMapping */
+ private $groupMapping;
+ /** @var User_Proxy */
+ private $userProxy;
+ /** @var Group_Proxy */
+ private $groupProxy;
+ /** @var array<UuidUpdateReport> */
+ protected $reports = [];
+ /** @var LoggerInterface */
+ private $logger;
+ /** @var bool */
+ private $dryRun = false;
+
+ public function __construct(UserMapping $userMapping, GroupMapping $groupMapping, User_Proxy $userProxy, Group_Proxy $groupProxy, LoggerInterface $logger) {
+ $this->userMapping = $userMapping;
+ $this->groupMapping = $groupMapping;
+ $this->userProxy = $userProxy;
+ $this->groupProxy = $groupProxy;
+ $this->logger = $logger;
+ $this->reports = [
+ UuidUpdateReport::UPDATED => [],
+ UuidUpdateReport::UNKNOWN => [],
+ UuidUpdateReport::UNREADABLE => [],
+ UuidUpdateReport::UNWRITABLE => [],
+ UuidUpdateReport::UNMAPPED => [],
+ ];
+ parent::__construct();
+ }
+
+ protected function configure(): void {
+ $this
+ ->setName('ldap:update-uuid')
+ ->setDescription('Attempts to update UUIDs of user and group entries. By default, the command attempts to update UUIDs that have been invalidated by a migration step.')
+ ->addOption(
+ 'all',
+ null,
+ InputOption::VALUE_NONE,
+ 'updates every user and group. All other options are ignored.'
+ )
+ ->addOption(
+ 'userId',
+ null,
+ InputOption::VALUE_REQUIRED | InputOption::VALUE_IS_ARRAY,
+ 'a user ID to update'
+ )
+ ->addOption(
+ 'groupId',
+ null,
+ InputOption::VALUE_REQUIRED | InputOption::VALUE_IS_ARRAY,
+ 'a group ID to update'
+ )
+ ->addOption(
+ 'dn',
+ null,
+ InputOption::VALUE_REQUIRED | InputOption::VALUE_IS_ARRAY,
+ 'a DN to update'
+ )
+ ->addOption(
+ 'dry-run',
+ null,
+ InputOption::VALUE_NONE,
+ 'UUIDs will not be updated in the database'
+ )
+ ;
+ }
+
+ protected function execute(InputInterface $input, OutputInterface $output): int {
+ $this->dryRun = $input->getOption('dry-run');
+ $entriesToUpdates = $this->estimateNumberOfUpdates($input);
+ $progressBar = new ProgressBar($output);
+ $progressBar->iterate($this->handleUpdates($input), $entriesToUpdates);
+ $this->printReport($input, $output);
+ $this->printReport($output);
+ return count($this->reports[UuidUpdateReport::UNMAPPED]) === 0
+ && count($this->reports[UuidUpdateReport::UNREADABLE]) === 0
+ && count($this->reports[UuidUpdateReport::UNWRITABLE]) === 0
+ ? 0
+ : 1;
+ }
+
+ protected function printReport(OutputInterface $output) {
+ if ($output->isQuiet()) {
+ return;
+ }
+
+ if (count($this->reports[UuidUpdateReport::UPDATED]) === 0) {
+ $output->writeln('<info>No record was updated.</info>');
+ } else {
+ $output->writeln(sprintf('<info>%d record(s) were updated.</info>', count($this->reports[UuidUpdateReport::UPDATED])));
+ if ($output->isVerbose()) {
+ /** @var UuidUpdateReport $report */
+ foreach ($this->reports[UuidUpdateReport::UPDATED] as $report) {
+ $output->writeln(sprintf(' %s had their old UUID %s updated to %s', $report->id, $report->oldUuid, $report->newUuid));
+ }
+ $output->writeln('');
+ }
+ }
+
+ if (count($this->reports[UuidUpdateReport::UNMAPPED]) > 0) {
+ $output->writeln(sprintf('<error>%d provided IDs were not mapped. These were:</error>', count($this->reports[UuidUpdateReport::UNMAPPED])));
+ /** @var UuidUpdateReport $report */
+ foreach ($this->reports[UuidUpdateReport::UNMAPPED] as $report) {
+ if (!empty($report->id)) {
+ $output->writeln(sprintf(' %s: %s',
+ $report->isUser ? 'User' : 'Group', $report->id));
+ } else if (!empty($report->dn)) {
+ $output->writeln(sprintf(' DN: %s', $report->dn));
+ }
+ }
+ $output->writeln('');
+ }
+
+ if (count($this->reports[UuidUpdateReport::UNKNOWN]) > 0) {
+ $output->writeln(sprintf('<info>%d provided IDs were unknown on LDAP.</info>', count($this->reports[UuidUpdateReport::UNKNOWN])));
+ if ($output->isVerbose()) {
+ /** @var UuidUpdateReport $report */
+ foreach ($this->reports[UuidUpdateReport::UNKNOWN] as $report) {
+ $output->writeln(sprintf(' %s: %s',$report->isUser ? 'User' : 'Group', $report->id));
+ }
+ $output->writeln(PHP_EOL . 'Old users can be removed along with their data per occ user:delete.' . PHP_EOL);
+ }
+ }
+
+ if (count($this->reports[UuidUpdateReport::UNREADABLE]) > 0) {
+ $output->writeln(sprintf('<error>For %d records, the UUID could not be read. Double-check your configuration.</error>', count($this->reports[UuidUpdateReport::UNREADABLE])));
+ if ($output->isVerbose()) {
+ /** @var UuidUpdateReport $report */
+ foreach ($this->reports[UuidUpdateReport::UNREADABLE] as $report) {
+ $output->writeln(sprintf(' %s: %s',$report->isUser ? 'User' : 'Group', $report->id));
+ }
+ }
+ }
+
+ if (count($this->reports[UuidUpdateReport::UNWRITABLE]) > 0) {
+ $output->writeln(sprintf('<error>For %d records, the UUID could not be saved to database. Double-check your configuration.</error>', count($this->reports[UuidUpdateReport::UNWRITABLE])));
+ if ($output->isVerbose()) {
+ /** @var UuidUpdateReport $report */
+ foreach ($this->reports[UuidUpdateReport::UNWRITABLE] as $report) {
+ $output->writeln(sprintf(' %s: %s',$report->isUser ? 'User' : 'Group', $report->id));
+ }
+ }
+ }
+ }
+
+ protected function handleUpdates(InputInterface $input): \Generator {
+ if ($input->getOption('all')) {
+ return $this->handleMappingBasedUpdates(false);
+ } else if ($input->getOption('userId')
+ || $input->getOption('groupId')
+ || $input->getOption('dn')
+ ) {
+ while($this->handleUpdatesByUserId($input->getOption('userId'))) {
+ yield;
+ }
+ while($this->handleUpdatesByUserId($input->getOption('groupId'))) {
+ yield;
+ }
+ while($this->handleUpdatesByDN($input->getOption('dn'))) {
+ yield;
+ }
+ } else {
+ return $this->handleMappingBasedUpdates(true);
+ }
+ }
+
+ protected function handleUpdatesByUserId(array $userIds): \Generator {
+ while($this->handleUpdatesByEntryId($userIds, $this->userMapping)) {
+ yield;
+ }
+ }
+
+ protected function handleUpdatesByGroupId(array $groupIds): \Generator {
+ while($this->handleUpdatesByEntryId($groupIds, $this->groupMapping)) {
+ yield;
+ }
+ }
+
+ protected function handleUpdatesByDN(array $dns): \Generator {
+ $userList = $groupList = [];
+ while ($dn = array_pop($dns)) {
+ $uuid = $this->userMapping->getUUIDByDN($dn);
+ if ($uuid) {
+ $id = $this->userMapping->getNameByDN($dn);
+ $userList[] = ['name' => $id, 'uuid' => $uuid];
+ continue;
+ }
+ $uuid = $this->groupMapping->getUUIDByDN($dn);
+ if ($uuid) {
+ $id = $this->groupMapping->getNameByDN($dn);
+ $groupList[] = ['name' => $id, 'uuid' => $uuid];
+ continue;
+ }
+ $this->reports[UuidUpdateReport::UNMAPPED][] = new UuidUpdateReport('', $dn, true, UuidUpdateReport::UNMAPPED);
+ yield;
+ }
+ while($this->handleUpdatesByList($this->userMapping, $userList)) {
+ yield;
+ }
+ while($this->handleUpdatesByList($this->groupMapping, $groupList)) {
+ yield;
+ }
+ }
+
+ protected function handleUpdatesByEntryId(array $ids, AbstractMapping $mapping): \Generator {
+ $isUser = $mapping instanceof UserMapping;
+ $list = [];
+ while ($id = array_pop($ids)) {
+ if(!$dn = $mapping->getDNByName($id)) {
+ $this->reports[UuidUpdateReport::UNMAPPED][] = new UuidUpdateReport($id, '', $isUser, UuidUpdateReport::UNMAPPED);
+ yield;
+ continue;
+ }
+ // Since we know it was mapped the UUID is populated
+ $uuid = $mapping->getUUIDByDN($dn);
+ $list[] = ['name' => $id, 'uuid' => $uuid];
+ }
+ while($this->handleUpdatesByList($mapping, $list)) {
+ yield;
+ }
+ }
+
+ protected function handleMappingBasedUpdates(bool $invalidatedOnly): \Generator {
+ $limit = 1000;
+ /** @var AbstractMapping $mapping*/
+ foreach([$this->userMapping, $this->groupMapping] as $mapping) {
+ $offset = 0;
+ do {
+ $list = $mapping->getList($offset, $limit, $invalidatedOnly);
+ $offset += $limit;
+
+ foreach($this->handleUpdatesByList($mapping, $list) as $tick) {
+ yield; // null, for it only advances progress counter
+ }
+ } while (count($list) === $limit);
+ }
+ }
+
+ protected function handleUpdatesByList(AbstractMapping $mapping, array $list): \Generator {
+ if ($mapping instanceof UserMapping) {
+ $isUser = true;
+ $backendProxy = $this->userProxy;
+ } else {
+ $isUser = false;
+ $backendProxy = $this->groupProxy;
+ }
+
+ foreach ($list as $row) {
+ $access = $backendProxy->getLDAPAccess($row['name']);
+ if ($access instanceof Access
+ && $dn = $mapping->getDNByName($row['name']))
+ {
+ if ($uuid = $access->getUUID($dn, $isUser)) {
+ if ($uuid !== $row['uuid']) {
+ if ($this->dryRun || $mapping->setUUIDbyDN($uuid, $dn)) {
+ $this->reports[UuidUpdateReport::UPDATED][]
+ = new UuidUpdateReport($row['name'], $dn, $isUser, UuidUpdateReport::UPDATED, $row['uuid'], $uuid);
+ } else {
+ $this->reports[UuidUpdateReport::UNWRITABLE][]
+ = new UuidUpdateReport($row['name'], $dn, $isUser, UuidUpdateReport::UNWRITABLE, $row['uuid'], $uuid);
+ }
+ $this->logger->info('UUID of {id} was updated from {from} to {to}',
+ [
+ 'appid' => 'user_ldap',
+ 'id' => $row['name'],
+ 'from' => $row['uuid'],
+ 'to' => $uuid,
+ ]
+ );
+ }
+ } else {
+ $this->reports[UuidUpdateReport::UNREADABLE][] = new UuidUpdateReport($row['name'], $dn, $isUser, UuidUpdateReport::UNREADABLE);
+ }
+ } else {
+ $this->reports[UuidUpdateReport::UNKNOWN][] = new UuidUpdateReport($row['name'], '', $isUser, UuidUpdateReport::UNKNOWN);
+ }
+ yield; // null, for it only advances progress counter
+ }
+ }
+
+ protected function estimateNumberOfUpdates(InputInterface $input) {
+ if ($input->getOption('all')) {
+ return $this->userMapping->count() + $this->groupMapping->count();
+ } else if ($input->getOption('userId')
+ || $input->getOption('groupId')
+ || $input->getOption('dn')
+ ) {
+ return count($input->getOption('userId'))
+ + count($input->getOption('groupId'))
+ + count($input->getOption('dn'));
+ } else {
+ return $this->userMapping->countInvalidated() + $this->groupMapping->countInvalidated();
+ }
+ }
+
+}
* @param $fdn
* @return bool
*/
- public function setUUIDbyDN($uuid, $fdn) {
+ public function setUUIDbyDN($uuid, $fdn): bool {
$statement = $this->dbc->prepare('
UPDATE `' . $this->getTableName() . '`
SET `directory_uuid` = ?
return $this->getXbyY('directory_uuid', 'ldap_dn_hash', $this->getDNHash($dn));
}
- /**
- * gets a piece of the mapping list
- *
- * @param int $offset
- * @param int $limit
- * @return array
- */
- public function getList($offset = null, $limit = null) {
- $query = $this->dbc->prepare('
- SELECT
- `ldap_dn` AS `dn`,
- `owncloud_name` AS `name`,
- `directory_uuid` AS `uuid`
- FROM `' . $this->getTableName() . '`',
- $limit,
- $offset
- );
-
- $query->execute();
- return $query->fetchAll();
+ public function getList(int $offset = null, int $limit = null, $invalidatedOnly = false): array {
+ $select = $this->dbc->getQueryBuilder();
+ $select->selectAlias('ldap_dn', 'dn')
+ ->selectAlias('owncloud_name', 'name')
+ ->selectAlias('directory_uuid', 'uuid')
+ ->from($this->getTableName(false))
+ ->setMaxResults($limit)
+ ->setFirstResult($offset);
+
+ if ($invalidatedOnly) {
+ $select->where($select->expr()->like('directory_uuid', $select->createNamedParameter('invalidated_%')));
+ }
+
+ $result = $select->executeQuery();
+ $entries = $result->fetchAll();
+ $result->closeCursor();
+
+ return $entries;
}
/**
*
* @return int
*/
- public function count() {
- $qb = $this->dbc->getQueryBuilder();
- $query = $qb->select($qb->func()->count('ldap_dn_hash'))
+ public function count(): int {
+ $query = $this->dbc->getQueryBuilder();
+ $query->select($query->func()->count('ldap_dn_hash'))
->from($this->getTableName());
$res = $query->execute();
$count = $res->fetchOne();
$res->closeCursor();
return (int)$count;
}
+
+ public function countInvalidated(): int {
+ $query = $this->dbc->getQueryBuilder();
+ $query->select($query->func()->count('ldap_dn_hash'))
+ ->from($this->getTableName())
+ ->where($query->expr()->like('directory_uuid', $query->createNamedParameter('invalidated_%')));
+ $res = $query->execute();
+ $count = $res->fetchOne();
+ $res->closeCursor();
+ return (int)$count;
+ }
}
projects / nextcloud-server.git / commitdiff