summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--apps/user_ldap/lib/Configuration.php7
-rw-r--r--apps/user_ldap/lib/Connection.php1
-rw-r--r--apps/user_ldap/lib/Group_LDAP.php38
-rw-r--r--apps/user_ldap/tests/Group_LDAPTest.php24
4 files changed, 68 insertions, 2 deletions
diff --git a/apps/user_ldap/lib/Configuration.php b/apps/user_ldap/lib/Configuration.php
index 81e33e6244f..5a7c732ab7b 100644
--- a/apps/user_ldap/lib/Configuration.php
+++ b/apps/user_ldap/lib/Configuration.php
@@ -45,6 +45,10 @@ class Configuration {
public const AVATAR_PREFIX_NONE = 'none';
public const AVATAR_PREFIX_DATA_ATTRIBUTE = 'data:';
+ public const LDAP_SERVER_FEATURE_UNKNOWN = 'unknown';
+ public const LDAP_SERVER_FEATURE_AVAILABLE = 'available';
+ public const LDAP_SERVER_FEATURE_UNAVAILABLE = 'unavailable';
+
protected $configPrefix = null;
protected $configRead = false;
/**
@@ -110,6 +114,7 @@ class Configuration {
'ldapDynamicGroupMemberURL' => null,
'ldapDefaultPPolicyDN' => null,
'ldapExtStorageHomeAttribute' => null,
+ 'ldapMatchingRuleInChainState' => self::LDAP_SERVER_FEATURE_UNKNOWN,
];
/**
@@ -482,6 +487,7 @@ class Configuration {
'ldap_default_ppolicy_dn' => '',
'ldap_user_avatar_rule' => 'default',
'ldap_ext_storage_home_attribute' => '',
+ 'ldap_matching_rule_in_chain_state' => self::LDAP_SERVER_FEATURE_UNKNOWN,
];
}
@@ -543,6 +549,7 @@ class Configuration {
'ldap_dynamic_group_member_url' => 'ldapDynamicGroupMemberURL',
'ldap_default_ppolicy_dn' => 'ldapDefaultPPolicyDN',
'ldap_ext_storage_home_attribute' => 'ldapExtStorageHomeAttribute',
+ 'ldap_matching_rule_in_chain_state' => 'ldapMatchingRuleInChainState',
'ldapIgnoreNamingRules' => 'ldapIgnoreNamingRules', // sysconfig
];
return $array;
diff --git a/apps/user_ldap/lib/Connection.php b/apps/user_ldap/lib/Connection.php
index 079429027c5..b7556bf236e 100644
--- a/apps/user_ldap/lib/Connection.php
+++ b/apps/user_ldap/lib/Connection.php
@@ -72,6 +72,7 @@ use OCP\ILogger;
* @property string ldapGidNumber
* @property int hasMemberOfFilterSupport
* @property int useMemberOfToDetectMembership
+ * @property string ldapMatchingRuleInChainState
*/
class Connection extends LDAPUtility {
private $ldapConnectionRes = null;
diff --git a/apps/user_ldap/lib/Group_LDAP.php b/apps/user_ldap/lib/Group_LDAP.php
index 6bf1bd31ba0..3532188d9f0 100644
--- a/apps/user_ldap/lib/Group_LDAP.php
+++ b/apps/user_ldap/lib/Group_LDAP.php
@@ -246,6 +246,37 @@ class Group_LDAP extends BackendUtility implements GroupInterface, IGroupLDAP, I
if ($groupMembers !== null) {
return $groupMembers;
}
+
+ if ($this->access->connection->ldapNestedGroups
+ && $this->access->connection->useMemberOfToDetectMembership
+ && $this->access->connection->hasMemberOfFilterSupport
+ && $this->access->connection->ldapMatchingRuleInChainState !== Configuration::LDAP_SERVER_FEATURE_UNAVAILABLE
+ ) {
+ $attemptedLdapMatchingRuleInChain = true;
+ // compatibility hack with servers supporting :1.2.840.113556.1.4.1941:, and others)
+ $filter = $this->access->combineFilterWithAnd([
+ $this->access->connection->ldapUserFilter,
+ $this->access->connection->ldapUserDisplayName . '=*',
+ 'memberof:1.2.840.113556.1.4.1941:=' . $dnGroup
+ ]);
+ $memberRecords = $this->access->fetchListOfUsers(
+ $filter,
+ $this->access->userManager->getAttributes(true)
+ );
+ $result = array_reduce($memberRecords, function ($carry, $record) {
+ $carry[] = $record['dn'][0];
+ return $carry;
+ }, []);
+ if ($this->access->connection->ldapMatchingRuleInChainState === Configuration::LDAP_SERVER_FEATURE_AVAILABLE) {
+ return $result;
+ } elseif (!empty($memberRecords)) {
+ $this->access->connection->ldapMatchingRuleInChainState = Configuration::LDAP_SERVER_FEATURE_AVAILABLE;
+ $this->access->connection->saveConfiguration();
+ return $result;
+ }
+ // when feature availability is unknown, and the result is empty, continue and test with original approach
+ }
+
$seen[$dnGroup] = 1;
$members = $this->access->readAttribute($dnGroup, $this->access->connection->ldapGroupMemberAssocAttr);
if (is_array($members)) {
@@ -258,6 +289,13 @@ class Group_LDAP extends BackendUtility implements GroupInterface, IGroupLDAP, I
$allMembers += $this->getDynamicGroupMembers($dnGroup);
$this->access->connection->writeToCache($cacheKey, $allMembers);
+ if (isset($attemptedLdapMatchingRuleInChain)
+ && $this->access->connection->ldapMatchingRuleInChainState === Configuration::LDAP_SERVER_FEATURE_UNKNOWN
+ && !empty($allMembers)
+ ) {
+ $this->access->connection->ldapMatchingRuleInChainState = Configuration::LDAP_SERVER_FEATURE_UNAVAILABLE;
+ $this->access->connection->saveConfiguration();
+ }
return $allMembers;
}
diff --git a/apps/user_ldap/tests/Group_LDAPTest.php b/apps/user_ldap/tests/Group_LDAPTest.php
index f8dd5af167f..4ddf9f5247c 100644
--- a/apps/user_ldap/tests/Group_LDAPTest.php
+++ b/apps/user_ldap/tests/Group_LDAPTest.php
@@ -73,6 +73,8 @@ class Group_LDAPTest extends TestCase {
->method('getConnection')
->willReturn($connector);
+ $access->userManager = $this->createMock(Manager::class);
+
return $access;
}
@@ -127,6 +129,10 @@ class Group_LDAPTest extends TestCase {
->method('countUsers')
->willReturn(2);
+ $access->userManager->expects($this->any())
+ ->method('getAttributes')
+ ->willReturn(['displayName', 'mail']);
+
$groupBackend = new GroupLDAP($access, $pluginManager);
$users = $groupBackend->countUsersInGroup('group');
@@ -170,6 +176,10 @@ class Group_LDAPTest extends TestCase {
->method('escapeFilterPart')
->willReturnArgument(0);
+ $access->userManager->expects($this->any())
+ ->method('getAttributes')
+ ->willReturn(['displayName', 'mail']);
+
$groupBackend = new GroupLDAP($access, $pluginManager);
$users = $groupBackend->countUsersInGroup('group', '3');
@@ -544,7 +554,10 @@ class Group_LDAPTest extends TestCase {
$access->expects($this->any())
->method('combineFilterWithAnd')
->willReturn('pseudo=filter');
- $access->userManager = $this->createMock(Manager::class);
+
+ $access->userManager->expects($this->any())
+ ->method('getAttributes')
+ ->willReturn(['displayName', 'mail']);
$groupBackend = new GroupLDAP($access, $pluginManager);
$users = $groupBackend->usersInGroup('foobar');
@@ -585,7 +598,10 @@ class Group_LDAPTest extends TestCase {
$access->expects($this->any())
->method('combineFilterWithAnd')
->willReturn('pseudo=filter');
- $access->userManager = $this->createMock(Manager::class);
+
+ $access->userManager->expects($this->any())
+ ->method('getAttributes')
+ ->willReturn(['displayName', 'mail']);
$groupBackend = new GroupLDAP($access, $pluginManager);
$users = $groupBackend->usersInGroup('foobar');
@@ -625,6 +641,10 @@ class Group_LDAPTest extends TestCase {
->method('isDNPartOfBase')
->willReturn(true);
+ $access->userManager->expects($this->any())
+ ->method('getAttributes')
+ ->willReturn(['displayName', 'mail']);
+
$groupBackend = new GroupLDAP($access, $pluginManager);
$users = $groupBackend->countUsersInGroup('foobar');
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-28 07:05:27 +0000