diff options
Diffstat (limited to 'apps/user_ldap/lib/Access.php')
| -rw-r--r-- | apps/user_ldap/lib/Access.php | 1676 |
1 files changed, 882 insertions, 794 deletions
diff --git a/apps/user_ldap/lib/Access.php b/apps/user_ldap/lib/Access.php index 43feeb4c1f0..9fe0aa64268 100644 --- a/apps/user_ldap/lib/Access.php +++ b/apps/user_ldap/lib/Access.php @@ -1,131 +1,82 @@ <?php + /** - * @copyright Copyright (c) 2016, ownCloud, Inc. - * - * @author Aaron Wood <aaronjwood@gmail.com> - * @author Alexander Bergolth <leo@strike.wu.ac.at> - * @author Andreas Fischer <bantu@owncloud.com> - * @author Arthur Schiwon <blizzz@arthur-schiwon.de> - * @author Bart Visscher <bartv@thisnet.nl> - * @author Benjamin Diele <benjamin@diele.be> - * @author bline <scottbeck@gmail.com> - * @author Christopher Schäpers <kondou@ts.unde.re> - * @author Joas Schilling <coding@schilljs.com> - * @author Juan Pablo Villafáñez <jvillafanez@solidgear.es> - * @author Jörn Friedrich Dreyer <jfd@butonic.de> - * @author Lorenzo M. Catucci <lorenzo@sancho.ccd.uniroma2.it> - * @author Lukas Reschke <lukas@statuscode.ch> - * @author Lyonel Vincent <lyonel@ezix.org> - * @author Mario Kolling <mario.kolling@serpro.gov.br> - * @author Morris Jobke <hey@morrisjobke.de> - * @author Nicolas Grekas <nicolas.grekas@gmail.com> - * @author Ralph Krimmel <rkrimme1@gwdg.de> - * @author Robin McCorkell <robin@mccorkell.me.uk> - * @author Roger Szabo <roger.szabo@web.de> - * @author root <root@localhost.localdomain> - * @author Victor Dubiniuk <dubiniuk@owncloud.com> - * - * @license AGPL-3.0 - * - * This code is free software: you can redistribute it and/or modify - * it under the terms of the GNU Affero General Public License, version 3, - * as published by the Free Software Foundation. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Affero General Public License for more details. - * - * You should have received a copy of the GNU Affero General Public License, version 3, - * along with this program. If not, see <http://www.gnu.org/licenses/> - * + * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors + * SPDX-FileCopyrightText: 2016 ownCloud, Inc. + * SPDX-License-Identifier: AGPL-3.0-only */ - namespace OCA\User_LDAP; -use OC\HintException; +use DomainException; +use OC\Hooks\PublicEmitter; +use OC\ServerNotAvailableException; use OCA\User_LDAP\Exceptions\ConstraintViolationException; -use OCA\User_LDAP\User\IUserTools; +use OCA\User_LDAP\Exceptions\NoMoreResults; +use OCA\User_LDAP\Mapping\AbstractMapping; use OCA\User_LDAP\User\Manager; use OCA\User_LDAP\User\OfflineUser; -use OCA\User_LDAP\Mapping\AbstractMapping; - -use OC\ServerNotAvailableException; +use OCP\EventDispatcher\IEventDispatcher; +use OCP\HintException; +use OCP\IAppConfig; use OCP\IConfig; +use OCP\IGroupManager; +use OCP\IUserManager; +use OCP\Server; +use OCP\User\Events\UserIdAssignedEvent; use OCP\Util; +use Psr\Log\LoggerInterface; +use function strlen; +use function substr; /** * Class Access + * * @package OCA\User_LDAP */ -class Access extends LDAPUtility implements IUserTools { - const UUID_ATTRIBUTES = ['entryuuid', 'nsuniqueid', 'objectguid', 'guid', 'ipauniqueid']; - - /** @var \OCA\User_LDAP\Connection */ - public $connection; - /** @var Manager */ - public $userManager; - //never ever check this var directly, always use getPagedSearchResultState - protected $pagedSearchedSuccessful; - - /** - * @var string[] $cookies an array of returned Paged Result cookies - */ - protected $cookies = array(); +class Access extends LDAPUtility { + public const UUID_ATTRIBUTES = ['entryuuid', 'nsuniqueid', 'objectguid', 'guid', 'ipauniqueid']; /** - * @var string $lastCookie the last cookie returned from a Paged Results - * operation, defaults to an empty string + * never ever check this var directly, always use getPagedSearchResultState + * @var ?bool */ - protected $lastCookie = ''; + protected $pagedSearchedSuccessful; - /** - * @var AbstractMapping $userMapper - */ + /** @var ?AbstractMapping */ protected $userMapper; - /** - * @var AbstractMapping $userMapper - */ + /** @var ?AbstractMapping */ protected $groupMapper; - /** - * @var \OCA\User_LDAP\Helper - */ - private $helper; - /** @var IConfig */ - private $config; + private string $lastCookie = ''; public function __construct( - Connection $connection, ILDAPWrapper $ldap, - Manager $userManager, - Helper $helper, - IConfig $config + public Connection $connection, + public Manager $userManager, + private Helper $helper, + private IConfig $config, + private IUserManager $ncUserManager, + private LoggerInterface $logger, + private IAppConfig $appConfig, + private IEventDispatcher $dispatcher, ) { parent::__construct($ldap); - $this->connection = $connection; - $this->userManager = $userManager; $this->userManager->setLdapAccess($this); - $this->helper = $helper; - $this->config = $config; } /** * sets the User Mapper - * @param AbstractMapping $mapper */ - public function setUserMapper(AbstractMapping $mapper) { + public function setUserMapper(AbstractMapping $mapper): void { $this->userMapper = $mapper; } /** - * returns the User Mapper * @throws \Exception - * @return AbstractMapping */ - public function getUserMapper() { - if(is_null($this->userMapper)) { + public function getUserMapper(): AbstractMapping { + if (is_null($this->userMapper)) { throw new \Exception('UserMapper was not assigned to this Access instance.'); } return $this->userMapper; @@ -133,19 +84,18 @@ class Access extends LDAPUtility implements IUserTools { /** * sets the Group Mapper - * @param AbstractMapping $mapper */ - public function setGroupMapper(AbstractMapping $mapper) { + public function setGroupMapper(AbstractMapping $mapper): void { $this->groupMapper = $mapper; } /** * returns the Group Mapper + * * @throws \Exception - * @return AbstractMapping */ - public function getGroupMapper() { - if(is_null($this->groupMapper)) { + public function getGroupMapper(): AbstractMapping { + if (is_null($this->groupMapper)) { throw new \Exception('GroupMapper was not assigned to this Access instance.'); } return $this->groupMapper; @@ -160,6 +110,7 @@ class Access extends LDAPUtility implements IUserTools { /** * returns the Connection instance + * * @return \OCA\User_LDAP\Connection */ public function getConnection() { @@ -167,36 +118,75 @@ class Access extends LDAPUtility implements IUserTools { } /** - * reads a given attribute for an LDAP record identified by a DN + * Reads several attributes for an LDAP record identified by a DN and a filter + * No support for ranged attributes. + * * @param string $dn the record in question - * @param string $attr the attribute that shall be retrieved - * if empty, just check the record's existence + * @param array $attrs the attributes that shall be retrieved + * if empty, just check the record's existence * @param string $filter * @return array|false an array of values on success or an empty - * array if $attr is empty, false otherwise + * array if $attr is empty, false otherwise + * @throws ServerNotAvailableException */ - public function readAttribute($dn, $attr, $filter = 'objectClass=*') { - if(!$this->checkConnection()) { - \OCP\Util::writeLog('user_ldap', + public function readAttributes(string $dn, array $attrs, string $filter = 'objectClass=*'): array|false { + if (!$this->checkConnection()) { + $this->logger->warning( 'No LDAP Connector assigned, access impossible for readAttribute.', - \OCP\Util::WARN); + ['app' => 'user_ldap'] + ); return false; } $cr = $this->connection->getConnectionResource(); - if(!$this->ldap->isResource($cr)) { - //LDAP not available - \OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', \OCP\Util::DEBUG); + $attrs = array_map( + fn (string $attr): string => mb_strtolower($attr, 'UTF-8'), + $attrs, + ); + + $values = []; + $record = $this->executeRead($dn, $attrs, $filter); + if (is_bool($record)) { + // when an exists request was run and it was successful, an empty + // array must be returned + return $record ? [] : false; + } + + $result = []; + foreach ($attrs as $attr) { + $values = $this->extractAttributeValuesFromResult($record, $attr); + if (!empty($values)) { + $result[$attr] = $values; + } + } + + if (!empty($result)) { + return $result; + } + + $this->logger->debug('Requested attributes {attrs} not found for ' . $dn, ['app' => 'user_ldap', 'attrs' => $attrs]); + return false; + } + + /** + * reads a given attribute for an LDAP record identified by a DN + * + * @param string $dn the record in question + * @param string $attr the attribute that shall be retrieved + * if empty, just check the record's existence + * @param string $filter + * @return array|false an array of values on success or an empty + * array if $attr is empty, false otherwise + * @throws ServerNotAvailableException + */ + public function readAttribute(string $dn, string $attr, string $filter = 'objectClass=*') { + if (!$this->checkConnection()) { + $this->logger->warning( + 'No LDAP Connector assigned, access impossible for readAttribute.', + ['app' => 'user_ldap'] + ); return false; } - //Cancel possibly running Paged Results operation, otherwise we run in - //LDAP protocol errors - $this->abandonPagedSearch(); - // openLDAP requires that we init a new Paged Search. Not needed by AD, - // but does not hurt either. - $pagingSize = intval($this->connection->ldapPagingSize); - // 0 won't result in replies, small numbers may leave out groups - // (cf. #12306), 500 is default for paging and should work everywhere. - $maxResults = $pagingSize > 20 ? $pagingSize : 500; + $cr = $this->connection->getConnectionResource(); $attr = mb_strtolower($attr, 'UTF-8'); // the actual read attribute later may contain parameters on a ranged // request, e.g. member;range=99-199. Depends on server reply. @@ -205,8 +195,8 @@ class Access extends LDAPUtility implements IUserTools { $values = []; $isRangeRequest = false; do { - $result = $this->executeRead($cr, $dn, $attrToRead, $filter, $maxResults); - if(is_bool($result)) { + $result = $this->executeRead($dn, $attrToRead, $filter); + if (is_bool($result)) { // when an exists request was run and it was successful, an empty // array must be returned return $result ? [] : false; @@ -223,63 +213,58 @@ class Access extends LDAPUtility implements IUserTools { $result = $this->extractRangeData($result, $attr); if (!empty($result)) { $normalizedResult = $this->extractAttributeValuesFromResult( - [ $attr => $result['values'] ], + [$attr => $result['values']], $attr ); $values = array_merge($values, $normalizedResult); - if($result['rangeHigh'] === '*') { + if ($result['rangeHigh'] === '*') { // when server replies with * as high range value, there are // no more results left return $values; } else { - $low = $result['rangeHigh'] + 1; + $low = $result['rangeHigh'] + 1; $attrToRead = $result['attributeName'] . ';range=' . $low . '-*'; $isRangeRequest = true; } } - } while($isRangeRequest); + } while ($isRangeRequest); - \OCP\Util::writeLog('user_ldap', 'Requested attribute '.$attr.' not found for '.$dn, \OCP\Util::DEBUG); + $this->logger->debug('Requested attribute ' . $attr . ' not found for ' . $dn, ['app' => 'user_ldap']); return false; } /** * Runs an read operation against LDAP * - * @param resource $cr the LDAP connection - * @param string $dn - * @param string $attribute - * @param string $filter - * @param int $maxResults * @return array|bool false if there was any error, true if an exists check * was performed and the requested DN found, array with the * returned data on a successful usual operation + * @throws ServerNotAvailableException */ - public function executeRead($cr, $dn, $attribute, $filter, $maxResults) { - $this->initPagedSearch($filter, array($dn), array($attribute), $maxResults, 0); + public function executeRead(string $dn, string|array $attribute, string $filter) { $dn = $this->helper->DNasBaseParameter($dn); - $rr = @$this->invokeLDAPMethod('read', $cr, $dn, $filter, array($attribute)); + $rr = @$this->invokeLDAPMethod('read', $dn, $filter, (is_string($attribute) ? [$attribute] : $attribute)); if (!$this->ldap->isResource($rr)) { if ($attribute !== '') { //do not throw this message on userExists check, irritates - \OCP\Util::writeLog('user_ldap', 'readAttribute failed for DN ' . $dn, \OCP\Util::DEBUG); + $this->logger->debug('readAttribute failed for DN ' . $dn, ['app' => 'user_ldap']); } //in case an error occurs , e.g. object does not exist return false; } - if ($attribute === '' && ($filter === 'objectclass=*' || $this->invokeLDAPMethod('countEntries', $cr, $rr) === 1)) { - \OCP\Util::writeLog('user_ldap', 'readAttribute: ' . $dn . ' found', \OCP\Util::DEBUG); + if ($attribute === '' && ($filter === 'objectclass=*' || $this->invokeLDAPMethod('countEntries', $rr) === 1)) { + $this->logger->debug('readAttribute: ' . $dn . ' found', ['app' => 'user_ldap']); return true; } - $er = $this->invokeLDAPMethod('firstEntry', $cr, $rr); + $er = $this->invokeLDAPMethod('firstEntry', $rr); if (!$this->ldap->isResource($er)) { //did not match the filter, return false return false; } //LDAP attributes are not case sensitive - $result = \OCP\Util::mb_array_change_key_case( - $this->invokeLDAPMethod('getAttributes', $cr, $er), MB_CASE_LOWER, 'UTF-8'); + $result = Util::mb_array_change_key_case( + $this->invokeLDAPMethod('getAttributes', $er), MB_CASE_LOWER, 'UTF-8'); return $result; } @@ -288,18 +273,20 @@ class Access extends LDAPUtility implements IUserTools { * Normalizes a result grom getAttributes(), i.e. handles DNs and binary * data if present. * + * DN values are escaped as per RFC 2253 + * * @param array $result from ILDAPWrapper::getAttributes() * @param string $attribute the attribute name that was read * @return string[] */ public function extractAttributeValuesFromResult($result, $attribute) { $values = []; - if(isset($result[$attribute]) && $result[$attribute]['count'] > 0) { + if (isset($result[$attribute]) && $result[$attribute]['count'] > 0) { $lowercaseAttribute = strtolower($attribute); - for($i=0;$i<$result[$attribute]['count'];$i++) { - if($this->resemblesDN($attribute)) { + for ($i = 0; $i < $result[$attribute]['count']; $i++) { + if ($this->resemblesDN($attribute)) { $values[] = $this->helper->sanitizeDN($result[$attribute][$i]); - } elseif($lowercaseAttribute === 'objectguid' || $lowercaseAttribute === 'guid') { + } elseif ($lowercaseAttribute === 'objectguid' || $lowercaseAttribute === 'guid') { $values[] = $this->convertObjectGUID2Str($result[$attribute][$i]); } else { $values[] = $result[$attribute][$i]; @@ -319,26 +306,25 @@ class Access extends LDAPUtility implements IUserTools { * @return array If a range was detected with keys 'values', 'attributeName', * 'attributeFull' and 'rangeHigh', otherwise empty. */ - public function extractRangeData($result, $attribute) { + public function extractRangeData(array $result, string $attribute): array { $keys = array_keys($result); - foreach($keys as $key) { - if($key !== $attribute && strpos($key, $attribute) === 0) { - $queryData = explode(';', $key); - if(strpos($queryData[1], 'range=') === 0) { + foreach ($keys as $key) { + if ($key !== $attribute && str_starts_with((string)$key, $attribute)) { + $queryData = explode(';', (string)$key); + if (isset($queryData[1]) && str_starts_with($queryData[1], 'range=')) { $high = substr($queryData[1], 1 + strpos($queryData[1], '-')); - $data = [ + return [ 'values' => $result[$key], 'attributeName' => $queryData[0], 'attributeFull' => $key, 'rangeHigh' => $high, ]; - return $data; } } } return []; } - + /** * Set password for an LDAP user identified by a DN * @@ -349,40 +335,39 @@ class Access extends LDAPUtility implements IUserTools { * @throws \Exception */ public function setPassword($userDN, $password) { - if(intval($this->connection->turnOnPasswordChange) !== 1) { + if ((int)$this->connection->turnOnPasswordChange !== 1) { throw new \Exception('LDAP password changes are disabled.'); } $cr = $this->connection->getConnectionResource(); - if(!$this->ldap->isResource($cr)) { - //LDAP not available - \OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', \OCP\Util::DEBUG); - return false; - } try { - return @$this->invokeLDAPMethod('modReplace', $cr, $userDN, $password); - } catch(ConstraintViolationException $e) { - throw new HintException('Password change rejected.', \OC::$server->getL10N('user_ldap')->t('Password change rejected. Hint: ').$e->getMessage(), $e->getCode()); + // try PASSWD extended operation first + return @$this->invokeLDAPMethod('exopPasswd', $userDN, '', $password) + || @$this->invokeLDAPMethod('modReplace', $userDN, $password); + } catch (ConstraintViolationException $e) { + throw new HintException('Password change rejected.', Util::getL10N('user_ldap')->t('Password change rejected. Hint: %s', $e->getMessage()), (int)$e->getCode()); } } /** * checks whether the given attributes value is probably a DN + * * @param string $attr the attribute in question * @return boolean if so true, otherwise false */ private function resemblesDN($attr) { - $resemblingAttributes = array( + $resemblingAttributes = [ 'dn', 'uniquemember', 'member', // memberOf is an "operational" attribute, without a definition in any RFC 'memberof' - ); + ]; return in_array($attr, $resemblingAttributes); } /** * checks whether the given string is probably a DN + * * @param string $string * @return boolean */ @@ -397,49 +382,51 @@ class Access extends LDAPUtility implements IUserTools { * returns a DN-string that is cleaned from not domain parts, e.g. * cn=foo,cn=bar,dc=foobar,dc=server,dc=org * becomes dc=foobar,dc=server,dc=org + * * @param string $dn * @return string */ public function getDomainDNFromDN($dn) { $allParts = $this->ldap->explodeDN($dn, 0); - if($allParts === false) { + if ($allParts === false) { //not a valid DN return ''; } - $domainParts = array(); + $domainParts = []; $dcFound = false; - foreach($allParts as $part) { - if(!$dcFound && strpos($part, 'dc=') === 0) { + foreach ($allParts as $part) { + if (!$dcFound && str_starts_with($part, 'dc=')) { $dcFound = true; } - if($dcFound) { + if ($dcFound) { $domainParts[] = $part; } } - $domainDN = implode(',', $domainParts); - return $domainDN; + return implode(',', $domainParts); } /** * returns the LDAP DN for the given internal Nextcloud name of the group + * * @param string $name the Nextcloud name in question * @return string|false LDAP DN on success, otherwise false */ public function groupname2dn($name) { - return $this->groupMapper->getDNByName($name); + return $this->getGroupMapper()->getDNByName($name); } /** * returns the LDAP DN for the given internal Nextcloud name of the user + * * @param string $name the Nextcloud name in question * @return string|false with the LDAP DN on success, otherwise false */ public function username2dn($name) { - $fdn = $this->userMapper->getDNByName($name); + $fdn = $this->getUserMapper()->getDNByName($name); //Check whether the DN belongs to the Base, to avoid issues on multi- //server setups - if(is_string($fdn) && $this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) { + if (is_string($fdn) && $this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) { return $fdn; } @@ -448,75 +435,41 @@ class Access extends LDAPUtility implements IUserTools { /** * returns the internal Nextcloud name for the given LDAP DN of the group, false on DN outside of search DN or failure + * * @param string $fdn the dn of the group object * @param string $ldapName optional, the display name of the object + * @param bool $autoMapping Should the group be mapped if not yet mapped * @return string|false with the name to use in Nextcloud, false on DN outside of search DN + * @throws \Exception */ - public function dn2groupname($fdn, $ldapName = null) { + public function dn2groupname($fdn, $ldapName = null, bool $autoMapping = true) { //To avoid bypassing the base DN settings under certain circumstances //with the group support, check whether the provided DN matches one of //the given Bases - if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseGroups)) { + if (!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseGroups)) { return false; } - return $this->dn2ocname($fdn, $ldapName, false); - } - - /** - * accepts an array of group DNs and tests whether they match the user - * filter by doing read operations against the group entries. Returns an - * array of DNs that match the filter. - * - * @param string[] $groupDNs - * @return string[] - */ - public function groupsMatchFilter($groupDNs) { - $validGroupDNs = []; - foreach($groupDNs as $dn) { - $cacheKey = 'groupsMatchFilter-'.$dn; - $groupMatchFilter = $this->connection->getFromCache($cacheKey); - if(!is_null($groupMatchFilter)) { - if($groupMatchFilter) { - $validGroupDNs[] = $dn; - } - continue; - } - - // Check the base DN first. If this is not met already, we don't - // need to ask the server at all. - if(!$this->isDNPartOfBase($dn, $this->connection->ldapBaseGroups)) { - $this->connection->writeToCache($cacheKey, false); - continue; - } - - $result = $this->readAttribute($dn, 'cn', $this->connection->ldapGroupFilter); - if(is_array($result)) { - $this->connection->writeToCache($cacheKey, true); - $validGroupDNs[] = $dn; - } else { - $this->connection->writeToCache($cacheKey, false); - } - - } - return $validGroupDNs; + return $this->dn2ocname($fdn, $ldapName, false, autoMapping:$autoMapping); } /** * returns the internal Nextcloud name for the given LDAP DN of the user, false on DN outside of search DN or failure - * @param string $dn the dn of the user object + * + * @param string $fdn the dn of the user object * @param string $ldapName optional, the display name of the object * @return string|false with with the name to use in Nextcloud + * @throws \Exception */ - public function dn2username($fdn, $ldapName = null) { + public function dn2username($fdn) { //To avoid bypassing the base DN settings under certain circumstances //with the group support, check whether the provided DN matches one of //the given Bases - if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) { + if (!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) { return false; } - return $this->dn2ocname($fdn, $ldapName, true); + return $this->dn2ocname($fdn, null, true); } /** @@ -527,59 +480,112 @@ class Access extends LDAPUtility implements IUserTools { * @param bool $isUser optional, whether it is a user object (otherwise group assumed) * @param bool|null $newlyMapped * @param array|null $record + * @param bool $autoMapping Should the group be mapped if not yet mapped * @return false|string with with the name to use in Nextcloud * @throws \Exception */ - public function dn2ocname($fdn, $ldapName = null, $isUser = true, &$newlyMapped = null, array $record = null) { + public function dn2ocname($fdn, $ldapName = null, $isUser = true, &$newlyMapped = null, ?array $record = null, bool $autoMapping = true) { + static $intermediates = []; + if (isset($intermediates[($isUser ? 'user-' : 'group-') . $fdn])) { + return false; // is a known intermediate + } + $newlyMapped = false; - if($isUser) { + if ($isUser) { $mapper = $this->getUserMapper(); - $nameAttribute = $this->connection->ldapUserDisplayName; } else { $mapper = $this->getGroupMapper(); - $nameAttribute = $this->connection->ldapGroupDisplayName; } //let's try to retrieve the Nextcloud name from the mappings table $ncName = $mapper->getNameByDN($fdn); - if(is_string($ncName)) { + if (is_string($ncName)) { return $ncName; } + if (!$autoMapping) { + /* If no auto mapping, stop there */ + return false; + } + + if ($isUser) { + $nameAttribute = strtolower($this->connection->ldapUserDisplayName); + $filter = $this->connection->ldapUserFilter; + $uuidAttr = 'ldapUuidUserAttribute'; + $uuidOverride = $this->connection->ldapExpertUUIDUserAttr; + $usernameAttribute = strtolower($this->connection->ldapExpertUsernameAttr); + $attributesToRead = [$nameAttribute,$usernameAttribute]; + // TODO fetch also display name attributes and cache them if the user is mapped + } else { + $nameAttribute = strtolower($this->connection->ldapGroupDisplayName); + $filter = $this->connection->ldapGroupFilter; + $uuidAttr = 'ldapUuidGroupAttribute'; + $uuidOverride = $this->connection->ldapExpertUUIDGroupAttr; + $attributesToRead = [$nameAttribute]; + } + + if ($this->detectUuidAttribute($fdn, $isUser, false, $record)) { + $attributesToRead[] = $this->connection->$uuidAttr; + } + + if ($record === null) { + /* No record was passed, fetch it */ + $record = $this->readAttributes($fdn, $attributesToRead, $filter); + if ($record === false) { + $this->logger->debug('Cannot read attributes for ' . $fdn . '. Skipping.', ['filter' => $filter]); + $intermediates[($isUser ? 'user-' : 'group-') . $fdn] = true; + return false; + } + } + //second try: get the UUID and check if it is known. Then, update the DN and return the name. $uuid = $this->getUUID($fdn, $isUser, $record); - if(is_string($uuid)) { + if (is_string($uuid)) { $ncName = $mapper->getNameByUUID($uuid); - if(is_string($ncName)) { + if (is_string($ncName)) { $mapper->setDNbyUUID($fdn, $uuid); return $ncName; } } else { //If the UUID can't be detected something is foul. - \OCP\Util::writeLog('user_ldap', 'Cannot determine UUID for '.$fdn.'. Skipping.', \OCP\Util::INFO); + $this->logger->debug('Cannot determine UUID for ' . $fdn . '. Skipping.', ['app' => 'user_ldap']); return false; } - if(is_null($ldapName)) { - $ldapName = $this->readAttribute($fdn, $nameAttribute); - if(!isset($ldapName[0]) && empty($ldapName[0])) { - \OCP\Util::writeLog('user_ldap', 'No or empty name for '.$fdn.'.', \OCP\Util::INFO); - return false; - } - $ldapName = $ldapName[0]; - } - - if($isUser) { - $usernameAttribute = strval($this->connection->ldapExpertUsernameAttr); + if ($isUser) { if ($usernameAttribute !== '') { - $username = $this->readAttribute($fdn, $usernameAttribute); + $username = $record[$usernameAttribute]; + if (!isset($username[0]) || empty($username[0])) { + $this->logger->debug('No or empty username (' . $usernameAttribute . ') for ' . $fdn . '.', ['app' => 'user_ldap']); + return false; + } $username = $username[0]; } else { $username = $uuid; } - $intName = $this->sanitizeUsername($username); + try { + $intName = $this->sanitizeUsername($username); + } catch (\InvalidArgumentException $e) { + $this->logger->warning('Error sanitizing username: ' . $e->getMessage(), [ + 'exception' => $e, + ]); + // we don't attempt to set a username here. We can go for + // for an alternative 4 digit random number as we would append + // otherwise, however it's likely not enough space in bigger + // setups, and most importantly: this is not intended. + return false; + } } else { - $intName = $ldapName; + if (is_null($ldapName)) { + $ldapName = $record[$nameAttribute]; + if (!isset($ldapName[0]) || empty($ldapName[0])) { + $this->logger->debug('No or empty name for ' . $fdn . ' with filter ' . $filter . '.', ['app' => 'user_ldap']); + $intermediates['group-' . $fdn] = true; + return false; + } + $ldapName = $ldapName[0]; + } + $intName = $this->sanitizeGroupIDCandidate($ldapName); } //a new user/group! Add it only if it doesn't conflict with other backend's users or existing groups @@ -587,34 +593,72 @@ class Access extends LDAPUtility implements IUserTools { //NOTE: mind, disabling cache affects only this instance! Using it // outside of core user management will still cache the user as non-existing. $originalTTL = $this->connection->ldapCacheTTL; - $this->connection->setConfiguration(array('ldapCacheTTL' => 0)); - if(($isUser && $intName !== '' && !\OC::$server->getUserManager()->userExists($intName)) - || (!$isUser && !\OC::$server->getGroupManager()->groupExists($intName))) { - if($mapper->map($fdn, $intName, $uuid)) { - $this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL)); - $newlyMapped = true; + $this->connection->setConfiguration(['ldapCacheTTL' => 0]); + if ($intName !== '' + && (($isUser && !$this->ncUserManager->userExists($intName)) + || (!$isUser && !Server::get(IGroupManager::class)->groupExists($intName)) + ) + ) { + $this->connection->setConfiguration(['ldapCacheTTL' => $originalTTL]); + $newlyMapped = $this->mapAndAnnounceIfApplicable($mapper, $fdn, $intName, $uuid, $isUser); + if ($newlyMapped) { + $this->logger->debug('Mapped {fdn} as {name}', ['fdn' => $fdn,'name' => $intName]); return $intName; } } - $this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL)); + $this->connection->setConfiguration(['ldapCacheTTL' => $originalTTL]); $altName = $this->createAltInternalOwnCloudName($intName, $isUser); - if(is_string($altName) && $mapper->map($fdn, $altName, $uuid)) { - $newlyMapped = true; - return $altName; + if (is_string($altName)) { + if ($this->mapAndAnnounceIfApplicable($mapper, $fdn, $altName, $uuid, $isUser)) { + $this->logger->warning( + 'Mapped {fdn} as {altName} because of a name collision on {intName}.', + [ + 'fdn' => $fdn, + 'altName' => $altName, + 'intName' => $intName, + ] + ); + $newlyMapped = true; + return $altName; + } } //if everything else did not help.. - \OCP\Util::writeLog('user_ldap', 'Could not create unique name for '.$fdn.'.', \OCP\Util::INFO); + $this->logger->info('Could not create unique name for ' . $fdn . '.', ['app' => 'user_ldap']); + return false; + } + + public function mapAndAnnounceIfApplicable( + AbstractMapping $mapper, + string $fdn, + string $name, + string $uuid, + bool $isUser, + ): bool { + if ($mapper->map($fdn, $name, $uuid)) { + if ($isUser) { + $this->cacheUserExists($name); + $this->dispatcher->dispatchTyped(new UserIdAssignedEvent($name)); + if ($this->ncUserManager instanceof PublicEmitter) { + $this->ncUserManager->emit('\OC\User', 'assignedUserId', [$name]); + } + } else { + $this->cacheGroupExists($name); + } + return true; + } return false; } /** * gives back the user names as they are used ownClod internally + * * @param array $ldapUsers as returned by fetchList() - * @return array an array with the user names to use in Nextcloud + * @return array<int,string> an array with the user names to use in Nextcloud * * gives back the user names as they are used ownClod internally + * @throws \Exception */ public function nextcloudUserNames($ldapUsers) { return $this->ldap2NextcloudNames($ldapUsers, true); @@ -622,51 +666,49 @@ class Access extends LDAPUtility implements IUserTools { /** * gives back the group names as they are used ownClod internally + * * @param array $ldapGroups as returned by fetchList() - * @return array an array with the group names to use in Nextcloud + * @return array<int,string> an array with the group names to use in Nextcloud * * gives back the group names as they are used ownClod internally + * @throws \Exception */ public function nextcloudGroupNames($ldapGroups) { return $this->ldap2NextcloudNames($ldapGroups, false); } /** - * @param array $ldapObjects as returned by fetchList() - * @param bool $isUsers - * @return array + * @param array[] $ldapObjects as returned by fetchList() + * @return array<int,string> + * @throws \Exception */ - private function ldap2NextcloudNames($ldapObjects, $isUsers) { - if($isUsers) { + private function ldap2NextcloudNames(array $ldapObjects, bool $isUsers): array { + if ($isUsers) { $nameAttribute = $this->connection->ldapUserDisplayName; - $sndAttribute = $this->connection->ldapUserDisplayName2; + $sndAttribute = $this->connection->ldapUserDisplayName2; } else { $nameAttribute = $this->connection->ldapGroupDisplayName; + $sndAttribute = null; } - $nextcloudNames = array(); + $nextcloudNames = []; - foreach($ldapObjects as $ldapObject) { - $nameByLDAP = null; - if( isset($ldapObject[$nameAttribute]) - && is_array($ldapObject[$nameAttribute]) - && isset($ldapObject[$nameAttribute][0]) - ) { - // might be set, but not necessarily. if so, we use it. - $nameByLDAP = $ldapObject[$nameAttribute][0]; - } + foreach ($ldapObjects as $ldapObject) { + $nameByLDAP = $ldapObject[$nameAttribute][0] ?? null; $ncName = $this->dn2ocname($ldapObject['dn'][0], $nameByLDAP, $isUsers); - if($ncName) { + if ($ncName) { $nextcloudNames[] = $ncName; - if($isUsers) { + if ($isUsers) { + $this->updateUserState($ncName); //cache the user names so it does not need to be retrieved //again later (e.g. sharing dialogue). - if(is_null($nameByLDAP)) { + if (is_null($nameByLDAP)) { continue; } - $sndName = isset($ldapObject[$sndAttribute][0]) - ? $ldapObject[$sndAttribute][0] : ''; + $sndName = $ldapObject[$sndAttribute][0] ?? ''; $this->cacheUserDisplayName($ncName, $nameByLDAP, $sndName); + } elseif ($nameByLDAP !== null) { + $this->cacheGroupDisplayName($ncName, $nameByLDAP); } } } @@ -674,54 +716,83 @@ class Access extends LDAPUtility implements IUserTools { } /** + * removes the deleted-flag of a user if it was set + * + * @param string $ncname + * @throws \Exception + */ + public function updateUserState($ncname): void { + $user = $this->userManager->get($ncname); + if ($user instanceof OfflineUser) { + $user->unmark(); + } + } + + /** * caches the user display name + * * @param string $ocName the internal Nextcloud username * @param string|false $home the home directory path */ - public function cacheUserHome($ocName, $home) { - $cacheKey = 'getHome'.$ocName; + public function cacheUserHome(string $ocName, $home): void { + $cacheKey = 'getHome' . $ocName; $this->connection->writeToCache($cacheKey, $home); } /** * caches a user as existing - * @param string $ocName the internal Nextcloud username */ - public function cacheUserExists($ocName) { - $this->connection->writeToCache('userExists'.$ocName, true); + public function cacheUserExists(string $ocName): void { + $this->connection->writeToCache('userExists' . $ocName, true); + $this->connection->writeToCache('userExistsOnLDAP' . $ocName, true); + } + + /** + * caches a group as existing + */ + public function cacheGroupExists(string $gid): void { + $this->connection->writeToCache('groupExists' . $gid, true); } /** * caches the user display name + * * @param string $ocName the internal Nextcloud username * @param string $displayName the display name * @param string $displayName2 the second display name + * @throws \Exception */ - public function cacheUserDisplayName($ocName, $displayName, $displayName2 = '') { + public function cacheUserDisplayName(string $ocName, string $displayName, string $displayName2 = ''): void { $user = $this->userManager->get($ocName); - if($user === null) { + if ($user === null) { return; } $displayName = $user->composeAndStoreDisplayName($displayName, $displayName2); $cacheKeyTrunk = 'getDisplayName'; - $this->connection->writeToCache($cacheKeyTrunk.$ocName, $displayName); + $this->connection->writeToCache($cacheKeyTrunk . $ocName, $displayName); + } + + public function cacheGroupDisplayName(string $ncName, string $displayName): void { + $cacheKey = 'group_getDisplayName' . $ncName; + $this->connection->writeToCache($cacheKey, $displayName); } /** * creates a unique name for internal Nextcloud use for users. Don't call it directly. + * * @param string $name the display name of the object * @return string|false with with the name to use in Nextcloud or false if unsuccessful * * Instead of using this method directly, call * createAltInternalOwnCloudName($name, true) */ - private function _createAltInternalOwnCloudNameForUsers($name) { + private function _createAltInternalOwnCloudNameForUsers(string $name) { $attempts = 0; //while loop is just a precaution. If a name is not generated within //20 attempts, something else is very wrong. Avoids infinite loop. - while($attempts < 20){ - $altName = $name . '_' . rand(1000,9999); - if(!\OC::$server->getUserManager()->userExists($altName)) { + while ($attempts < 20) { + $altName = $name . '_' . rand(1000, 9999); + if (!$this->ncUserManager->userExists($altName)) { return $altName; } $attempts++; @@ -731,6 +802,7 @@ class Access extends LDAPUtility implements IUserTools { /** * creates a unique name for internal Nextcloud use for groups. Don't call it directly. + * * @param string $name the display name of the object * @return string|false with with the name to use in Nextcloud or false if unsuccessful. * @@ -741,24 +813,24 @@ class Access extends LDAPUtility implements IUserTools { * numbering, e.g. Developers_42 when there are 41 other groups called * "Developers" */ - private function _createAltInternalOwnCloudNameForGroups($name) { - $usedNames = $this->groupMapper->getNamesBySearch($name, "", '_%'); - if(!($usedNames) || count($usedNames) === 0) { + private function _createAltInternalOwnCloudNameForGroups(string $name) { + $usedNames = $this->getGroupMapper()->getNamesBySearch($name, '', '_%'); + if (count($usedNames) === 0) { $lastNo = 1; //will become name_2 } else { natsort($usedNames); $lastName = array_pop($usedNames); - $lastNo = intval(substr($lastName, strrpos($lastName, '_') + 1)); + $lastNo = (int)substr($lastName, strrpos($lastName, '_') + 1); } - $altName = $name.'_'.strval($lastNo+1); + $altName = $name . '_' . (string)($lastNo + 1); unset($usedNames); $attempts = 1; - while($attempts < 21){ + while ($attempts < 21) { // Check to be really sure it is unique // while loop is just a precaution. If a name is not generated within // 20 attempts, something else is very wrong. Avoids infinite loop. - if(!\OC::$server->getGroupManager()->groupExists($altName)) { + if (!Server::get(IGroupManager::class)->groupExists($altName)) { return $altName; } $altName = $name . '_' . ($lastNo + $attempts); @@ -769,19 +841,25 @@ class Access extends LDAPUtility implements IUserTools { /** * creates a unique name for internal Nextcloud use. + * * @param string $name the display name of the object - * @param boolean $isUser whether name should be created for a user (true) or a group (false) + * @param bool $isUser whether name should be created for a user (true) or a group (false) * @return string|false with with the name to use in Nextcloud or false if unsuccessful */ - private function createAltInternalOwnCloudName($name, $isUser) { + private function createAltInternalOwnCloudName(string $name, bool $isUser) { + // ensure there is space for the "_1234" suffix + if (strlen($name) > 59) { + $name = substr($name, 0, 59); + } + $originalTTL = $this->connection->ldapCacheTTL; - $this->connection->setConfiguration(array('ldapCacheTTL' => 0)); - if($isUser) { + $this->connection->setConfiguration(['ldapCacheTTL' => 0]); + if ($isUser) { $altName = $this->_createAltInternalOwnCloudNameForUsers($name); } else { $altName = $this->_createAltInternalOwnCloudNameForGroups($name); } - $this->connection->setConfiguration(array('ldapCacheTTL' => $originalTTL)); + $this->connection->setConfiguration(['ldapCacheTTL' => $originalTTL]); return $altName; } @@ -789,16 +867,11 @@ class Access extends LDAPUtility implements IUserTools { /** * fetches a list of users according to a provided loginName and utilizing * the login filter. - * - * @param string $loginName - * @param array $attributes optional, list of attributes to read - * @return array */ - public function fetchUsersByLoginName($loginName, $attributes = array('dn')) { + public function fetchUsersByLoginName(string $loginName, array $attributes = ['dn']): array { $loginName = $this->escapeFilterPart($loginName); $filter = str_replace('%uid', $loginName, $this->connection->ldapLoginFilter); - $users = $this->fetchListOfUsers($filter, $attributes); - return $users; + return $this->fetchListOfUsers($filter, $attributes); } /** @@ -806,197 +879,198 @@ class Access extends LDAPUtility implements IUserTools { * utilizing the login filter. * * @param string $loginName - * @return int + * @return false|int */ public function countUsersByLoginName($loginName) { $loginName = $this->escapeFilterPart($loginName); $filter = str_replace('%uid', $loginName, $this->connection->ldapLoginFilter); - $users = $this->countUsers($filter); - return $users; + return $this->countUsers($filter); } /** - * @param string $filter - * @param string|string[] $attr - * @param int $limit - * @param int $offset - * @param bool $forceApplyAttributes - * @return array + * @throws \Exception */ - public function fetchListOfUsers($filter, $attr, $limit = null, $offset = null, $forceApplyAttributes = false) { + public function fetchListOfUsers(string $filter, array $attr, ?int $limit = null, ?int $offset = null, bool $forceApplyAttributes = false): array { $ldapRecords = $this->searchUsers($filter, $attr, $limit, $offset); $recordsToUpdate = $ldapRecords; - if(!$forceApplyAttributes) { - $isBackgroundJobModeAjax = $this->config - ->getAppValue('core', 'backgroundjobs_mode', 'ajax') === 'ajax'; - $recordsToUpdate = array_filter($ldapRecords, function($record) use ($isBackgroundJobModeAjax) { + if (!$forceApplyAttributes) { + $isBackgroundJobModeAjax = $this->appConfig->getValueString('core', 'backgroundjobs_mode', 'ajax') === 'ajax'; + $listOfDNs = array_reduce($ldapRecords, function ($listOfDNs, $entry) { + $listOfDNs[] = $entry['dn'][0]; + return $listOfDNs; + }, []); + $idsByDn = $this->getUserMapper()->getListOfIdsByDn($listOfDNs); + $recordsToUpdate = array_filter($ldapRecords, function ($record) use ($isBackgroundJobModeAjax, $idsByDn) { $newlyMapped = false; - $uid = $this->dn2ocname($record['dn'][0], null, true, $newlyMapped, $record); - if(is_string($uid)) { + $uid = $idsByDn[$record['dn'][0]] ?? null; + if ($uid === null) { + $uid = $this->dn2ocname($record['dn'][0], null, true, $newlyMapped, $record); + } + if (is_string($uid)) { $this->cacheUserExists($uid); } return ($uid !== false) && ($newlyMapped || $isBackgroundJobModeAjax); }); } $this->batchApplyUserAttributes($recordsToUpdate); - return $this->fetchList($ldapRecords, (count($attr) > 1)); + return $this->fetchList($ldapRecords, $this->manyAttributes($attr)); } /** * provided with an array of LDAP user records the method will fetch the * user object and requests it to process the freshly fetched attributes and * and their values - * @param array $ldapRecords + * + * @throws \Exception */ - public function batchApplyUserAttributes(array $ldapRecords){ - $displayNameAttribute = strtolower($this->connection->ldapUserDisplayName); - foreach($ldapRecords as $userRecord) { - if(!isset($userRecord[$displayNameAttribute])) { + public function batchApplyUserAttributes(array $ldapRecords): void { + $displayNameAttribute = strtolower((string)$this->connection->ldapUserDisplayName); + foreach ($ldapRecords as $userRecord) { + if (!isset($userRecord[$displayNameAttribute])) { // displayName is obligatory continue; } - $ocName = $this->dn2ocname($userRecord['dn'][0], null, true); - if($ocName === false) { + $ocName = $this->dn2ocname($userRecord['dn'][0], null, true); + if ($ocName === false) { continue; } + $this->updateUserState($ocName); $user = $this->userManager->get($ocName); - if($user instanceof OfflineUser) { - $user->unmark(); - $user = $this->userManager->get($ocName); - } if ($user !== null) { $user->processAttributes($userRecord); } else { - \OC::$server->getLogger()->debug( + $this->logger->debug( "The ldap user manager returned null for $ocName", - ['app'=>'user_ldap'] + ['app' => 'user_ldap'] ); } } } /** - * @param string $filter - * @param string|string[] $attr - * @param int $limit - * @param int $offset - * @return array + * @return array[] */ - public function fetchListOfGroups($filter, $attr, $limit = null, $offset = null) { - return $this->fetchList($this->searchGroups($filter, $attr, $limit, $offset), (count($attr) > 1)); + public function fetchListOfGroups(string $filter, array $attr, ?int $limit = null, ?int $offset = null): array { + $cacheKey = 'fetchListOfGroups_' . $filter . '_' . implode('-', $attr) . '_' . (string)$limit . '_' . (string)$offset; + $listOfGroups = $this->connection->getFromCache($cacheKey); + if (!is_null($listOfGroups)) { + return $listOfGroups; + } + $groupRecords = $this->searchGroups($filter, $attr, $limit, $offset); + + $listOfGroups = $this->fetchList($groupRecords, $this->manyAttributes($attr)); + $this->connection->writeToCache($cacheKey, $listOfGroups); + return $listOfGroups; } - /** - * @param array $list - * @param bool $manyAttributes - * @return array - */ - private function fetchList($list, $manyAttributes) { - if(is_array($list)) { - if($manyAttributes) { - return $list; - } else { - $list = array_reduce($list, function($carry, $item) { - $attribute = array_keys($item)[0]; - $carry[] = $item[$attribute][0]; - return $carry; - }, array()); - return array_unique($list, SORT_LOCALE_STRING); - } + private function fetchList(array $list, bool $manyAttributes): array { + if ($manyAttributes) { + return $list; + } else { + $list = array_reduce($list, function ($carry, $item) { + $attribute = array_keys($item)[0]; + $carry[] = $item[$attribute][0]; + return $carry; + }, []); + return array_unique($list, SORT_LOCALE_STRING); } - - //error cause actually, maybe throw an exception in future. - return array(); } /** - * executes an LDAP search, optimized for Users - * @param string $filter the LDAP filter for the search - * @param string|string[] $attr optional, when a certain attribute shall be filtered out - * @param integer $limit - * @param integer $offset - * @return array with the search result - * - * Executes an LDAP search + * @throws ServerNotAvailableException */ - public function searchUsers($filter, $attr = null, $limit = null, $offset = null) { - return $this->search($filter, $this->connection->ldapBaseUsers, $attr, $limit, $offset); + public function searchUsers(string $filter, ?array $attr = null, ?int $limit = null, ?int $offset = null): array { + $result = []; + foreach ($this->connection->ldapBaseUsers as $base) { + $result = array_merge($result, $this->search($filter, $base, $attr, $limit, $offset)); + } + return $result; } /** - * @param string $filter - * @param string|string[] $attr - * @param int $limit - * @param int $offset + * @param string[] $attr * @return false|int + * @throws ServerNotAvailableException */ - public function countUsers($filter, $attr = array('dn'), $limit = null, $offset = null) { - return $this->count($filter, $this->connection->ldapBaseUsers, $attr, $limit, $offset); + public function countUsers(string $filter, array $attr = ['dn'], ?int $limit = null, ?int $offset = null) { + $result = false; + foreach ($this->connection->ldapBaseUsers as $base) { + $count = $this->count($filter, [$base], $attr, $limit ?? 0, $offset ?? 0); + $result = is_int($count) ? (int)$result + $count : $result; + } + return $result; } /** * executes an LDAP search, optimized for Groups - * @param string $filter the LDAP filter for the search - * @param string|string[] $attr optional, when a certain attribute shall be filtered out - * @param integer $limit - * @param integer $offset - * @return array with the search result + * + * @param ?string[] $attr optional, when certain attributes shall be filtered out * * Executes an LDAP search + * @throws ServerNotAvailableException */ - public function searchGroups($filter, $attr = null, $limit = null, $offset = null) { - return $this->search($filter, $this->connection->ldapBaseGroups, $attr, $limit, $offset); + public function searchGroups(string $filter, ?array $attr = null, ?int $limit = null, ?int $offset = null): array { + $result = []; + foreach ($this->connection->ldapBaseGroups as $base) { + $result = array_merge($result, $this->search($filter, $base, $attr, $limit, $offset)); + } + return $result; } /** * returns the number of available groups - * @param string $filter the LDAP search filter - * @param string[] $attr optional - * @param int|null $limit - * @param int|null $offset + * * @return int|bool + * @throws ServerNotAvailableException */ - public function countGroups($filter, $attr = array('dn'), $limit = null, $offset = null) { - return $this->count($filter, $this->connection->ldapBaseGroups, $attr, $limit, $offset); + public function countGroups(string $filter, array $attr = ['dn'], ?int $limit = null, ?int $offset = null) { + $result = false; + foreach ($this->connection->ldapBaseGroups as $base) { + $count = $this->count($filter, [$base], $attr, $limit ?? 0, $offset ?? 0); + $result = is_int($count) ? (int)$result + $count : $result; + } + return $result; } /** * returns the number of available objects on the base DN * - * @param int|null $limit - * @param int|null $offset * @return int|bool + * @throws ServerNotAvailableException */ - public function countObjects($limit = null, $offset = null) { - return $this->count('objectclass=*', $this->connection->ldapBase, array('dn'), $limit, $offset); + public function countObjects(?int $limit = null, ?int $offset = null) { + $result = false; + foreach ($this->connection->ldapBase as $base) { + $count = $this->count('objectclass=*', [$base], ['dn'], $limit ?? 0, $offset ?? 0); + $result = is_int($count) ? (int)$result + $count : $result; + } + return $result; } /** * Returns the LDAP handler + * * @throws \OC\ServerNotAvailableException */ /** + * @param mixed[] $arguments * @return mixed * @throws \OC\ServerNotAvailableException */ - private function invokeLDAPMethod() { - $arguments = func_get_args(); - $command = array_shift($arguments); - $cr = array_shift($arguments); + private function invokeLDAPMethod(string $command, ...$arguments) { + if ($command == 'controlPagedResultResponse') { + // php no longer supports call-time pass-by-reference + // thus cannot support controlPagedResultResponse as the third argument + // is a reference + throw new \InvalidArgumentException('Invoker does not support controlPagedResultResponse, call LDAP Wrapper directly instead.'); + } if (!method_exists($this->ldap, $command)) { return null; } - array_unshift($arguments, $cr); - // php no longer supports call-time pass-by-reference - // thus cannot support controlPagedResultResponse as the third argument - // is a reference + array_unshift($arguments, $this->connection->getConnectionResource()); $doMethod = function () use ($command, &$arguments) { - if ($command == 'controlPagedResultResponse') { - throw new \InvalidArgumentException('Invoker does not support controlPagedResultResponse, call LDAP Wrapper directly instead.'); - } else { - return call_user_func_array(array($this->ldap, $command), $arguments); - } + return call_user_func_array([$this->ldap, $command], $arguments); }; try { $ret = $doMethod(); @@ -1005,17 +1079,17 @@ class Access extends LDAPUtility implements IUserTools { * Maybe implement exponential backoff? * This was enough to get solr indexer working which has large delays between LDAP fetches. */ - \OCP\Util::writeLog('user_ldap', "Connection lost on $command, attempting to reestablish.", \OCP\Util::DEBUG); + $this->logger->debug("Connection lost on $command, attempting to reestablish.", ['app' => 'user_ldap']); $this->connection->resetConnectionResource(); $cr = $this->connection->getConnectionResource(); - if(!$this->ldap->isResource($cr)) { + if (!$this->ldap->isResource($cr)) { // Seems like we didn't find any resource. - \OCP\Util::writeLog('user_ldap', "Could not $command, because resource is missing.", \OCP\Util::DEBUG); + $this->logger->debug("Could not $command, because resource is missing.", ['app' => 'user_ldap']); throw $e; } - $arguments[0] = array_pad([], count($arguments[0]), $cr); + $arguments[0] = $cr; $ret = $doMethod(); } return $ret; @@ -1024,82 +1098,84 @@ class Access extends LDAPUtility implements IUserTools { /** * retrieved. Results will according to the order in the array. * - * @param $filter - * @param $base - * @param string[]|string|null $attr - * @param int $limit optional, maximum results to be counted - * @param int $offset optional, a starting point + * @param string $filter + * @param string $base + * @param string[] $attr + * @param int|null $limit optional, maximum results to be counted + * @param int|null $offset optional, a starting point * @return array|false array with the search result as first value and pagedSearchOK as - * second | false if not successful + * second | false if not successful * @throws ServerNotAvailableException */ - private function executeSearch($filter, $base, &$attr = null, $limit = null, $offset = null) { - if(!is_null($attr) && !is_array($attr)) { - $attr = array(mb_strtolower($attr, 'UTF-8')); - } - + private function executeSearch( + string $filter, + string $base, + ?array &$attr, + ?int $pageSize, + ?int $offset, + ) { // See if we have a resource, in case not cancel with message $cr = $this->connection->getConnectionResource(); - if(!$this->ldap->isResource($cr)) { - // Seems like we didn't find any resource. - // Return an empty array just like before. - \OCP\Util::writeLog('user_ldap', 'Could not search, because resource is missing.', \OCP\Util::DEBUG); - return false; - } //check whether paged search should be attempted - $pagedSearchOK = $this->initPagedSearch($filter, $base, $attr, intval($limit), $offset); + try { + [$pagedSearchOK, $pageSize, $cookie] = $this->initPagedSearch($filter, $base, $attr, (int)$pageSize, (int)$offset); + } catch (NoMoreResults $e) { + // beyond last results page + return false; + } - $linkResources = array_pad(array(), count($base), $cr); - $sr = $this->invokeLDAPMethod('search', $linkResources, $base, $filter, $attr); - // cannot use $cr anymore, might have changed in the previous call! + $sr = $this->invokeLDAPMethod('search', $base, $filter, $attr, 0, 0, $pageSize, $cookie); $error = $this->ldap->errno($this->connection->getConnectionResource()); - if(!is_array($sr) || $error !== 0) { - \OCP\Util::writeLog('user_ldap', 'Attempt for Paging? '.print_r($pagedSearchOK, true), \OCP\Util::ERROR); + if (!$this->ldap->isResource($sr) || $error !== 0) { + $this->logger->error('Attempt for Paging? ' . print_r($pagedSearchOK, true), ['app' => 'user_ldap']); return false; } - return array($sr, $pagedSearchOK); + return [$sr, $pagedSearchOK]; } /** * processes an LDAP paged search operation - * @param array $sr the array containing the LDAP search resources - * @param string $filter the LDAP filter for the search - * @param array $base an array containing the LDAP subtree(s) that shall be searched - * @param int $iFoundItems number of results in the single search operation + * + * @param \LDAP\Result|\LDAP\Result[] $sr the array containing the LDAP search resources + * @param int $foundItems number of results in the single search operation * @param int $limit maximum results to be counted - * @param int $offset a starting point * @param bool $pagedSearchOK whether a paged search has been executed * @param bool $skipHandling required for paged search when cookies to - * prior results need to be gained + * prior results need to be gained * @return bool cookie validity, true if we have more pages, false otherwise. + * @throws ServerNotAvailableException */ - private function processPagedSearchStatus($sr, $filter, $base, $iFoundItems, $limit, $offset, $pagedSearchOK, $skipHandling) { - $cookie = null; - if($pagedSearchOK) { + private function processPagedSearchStatus( + $sr, + int $foundItems, + int $limit, + bool $pagedSearchOK, + bool $skipHandling, + ): bool { + $cookie = ''; + if ($pagedSearchOK) { $cr = $this->connection->getConnectionResource(); - foreach($sr as $key => $res) { - if($this->ldap->controlPagedResultResponse($cr, $res, $cookie)) { - $this->setPagedResultCookie($base[$key], $filter, $limit, $offset, $cookie); - } + if ($this->ldap->controlPagedResultResponse($cr, $sr, $cookie)) { + $this->lastCookie = $cookie; } //browsing through prior pages to get the cookie for the new one - if($skipHandling) { + if ($skipHandling) { return false; } // if count is bigger, then the server does not support - // paged search. Instead, he did a normal search. We set a + // paged search. Instead, they did a normal search. We set a // flag here, so the callee knows how to deal with it. - if($iFoundItems <= $limit) { + if ($foundItems <= $limit) { $this->pagedSearchedSuccessful = true; } } else { - if(!is_null($limit) && intval($this->connection->ldapPagingSize) !== 0) { - \OC::$server->getLogger()->debug( + if ((int)$this->connection->ldapPagingSize !== 0) { + $this->logger->debug( 'Paged search was not available', - [ 'app' => 'user_ldap' ] + ['app' => 'user_ldap'] ); } } @@ -1115,21 +1191,31 @@ class Access extends LDAPUtility implements IUserTools { * executes an LDAP search, but counts the results only * * @param string $filter the LDAP filter for the search - * @param array $base an array containing the LDAP subtree(s) that shall be searched - * @param string|string[] $attr optional, array, one or more attributes that shall be - * retrieved. Results will according to the order in the array. - * @param int $limit optional, maximum results to be counted - * @param int $offset optional, a starting point + * @param array $bases an array containing the LDAP subtree(s) that shall be searched + * @param ?string[] $attr optional, array, one or more attributes that shall be + * retrieved. Results will according to the order in the array. + * @param int $limit maximum results to be counted, 0 means no limit + * @param int $offset a starting point, defaults to 0 * @param bool $skipHandling indicates whether the pages search operation is - * completed + * completed * @return int|false Integer or false if the search could not be initialized * @throws ServerNotAvailableException */ - private function count($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) { - \OCP\Util::writeLog('user_ldap', 'Count filter: '.print_r($filter, true), \OCP\Util::DEBUG); + private function count( + string $filter, + array $bases, + ?array $attr = null, + int $limit = 0, + int $offset = 0, + bool $skipHandling = false, + ) { + $this->logger->debug('Count filter: {filter}', [ + 'app' => 'user_ldap', + 'filter' => $filter + ]); - $limitPerPage = intval($this->connection->ldapPagingSize); - if(!is_null($limit) && $limit < $limitPerPage && $limit > 0) { + $limitPerPage = (int)$this->connection->ldapPagingSize; + if ($limit < $limitPerPage && $limit > 0) { $limitPerPage = $limit; } @@ -1137,62 +1223,59 @@ class Access extends LDAPUtility implements IUserTools { $count = null; $this->connection->getConnectionResource(); - do { - $search = $this->executeSearch($filter, $base, $attr, $limitPerPage, $offset); - if($search === false) { - return $counter > 0 ? $counter : false; - } - list($sr, $pagedSearchOK) = $search; + foreach ($bases as $base) { + do { + $search = $this->executeSearch($filter, $base, $attr, $limitPerPage, $offset); + if ($search === false) { + return $counter > 0 ? $counter : false; + } + [$sr, $pagedSearchOK] = $search; - /* ++ Fixing RHDS searches with pages with zero results ++ - * countEntriesInSearchResults() method signature changed - * by removing $limit and &$hasHitLimit parameters - */ - $count = $this->countEntriesInSearchResults($sr); - $counter += $count; + /* ++ Fixing RHDS searches with pages with zero results ++ + * countEntriesInSearchResults() method signature changed + * by removing $limit and &$hasHitLimit parameters + */ + $count = $this->countEntriesInSearchResults($sr); + $counter += $count; - $hasMorePages = $this->processPagedSearchStatus($sr, $filter, $base, $count, $limitPerPage, - $offset, $pagedSearchOK, $skipHandling); - $offset += $limitPerPage; - /* ++ Fixing RHDS searches with pages with zero results ++ - * Continue now depends on $hasMorePages value - */ - $continue = $pagedSearchOK && $hasMorePages; - } while($continue && (is_null($limit) || $limit <= 0 || $limit > $counter)); + $hasMorePages = $this->processPagedSearchStatus($sr, $count, $limitPerPage, $pagedSearchOK, $skipHandling); + $offset += $limitPerPage; + /* ++ Fixing RHDS searches with pages with zero results ++ + * Continue now depends on $hasMorePages value + */ + $continue = $pagedSearchOK && $hasMorePages; + } while ($continue && ($limit <= 0 || $limit > $counter)); + } return $counter; } /** - * @param array $searchResults + * @param \LDAP\Result|\LDAP\Result[] $sr * @return int + * @throws ServerNotAvailableException */ - private function countEntriesInSearchResults($searchResults) { - $counter = 0; - - foreach($searchResults as $res) { - $count = intval($this->invokeLDAPMethod('countEntries', $this->connection->getConnectionResource(), $res)); - $counter += $count; - } - - return $counter; + private function countEntriesInSearchResults($sr): int { + return (int)$this->invokeLDAPMethod('countEntries', $sr); } /** * Executes an LDAP search * - * @param string $filter the LDAP filter for the search - * @param array $base an array containing the LDAP subtree(s) that shall be searched - * @param string|string[] $attr optional, array, one or more attributes that shall be - * @param int $limit - * @param int $offset - * @param bool $skipHandling - * @return array with the search result + * DN values in the result set are escaped as per RFC 2253 + * * @throws ServerNotAvailableException */ - public function search($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) { - $limitPerPage = intval($this->connection->ldapPagingSize); - if(!is_null($limit) && $limit < $limitPerPage && $limit > 0) { + public function search( + string $filter, + string $base, + ?array $attr = null, + ?int $limit = null, + ?int $offset = null, + bool $skipHandling = false, + ): array { + $limitPerPage = (int)$this->connection->ldapPagingSize; + if (!is_null($limit) && $limit < $limitPerPage && $limit > 0) { $limitPerPage = $limit; } @@ -1203,63 +1286,53 @@ class Access extends LDAPUtility implements IUserTools { * $findings['count'] < $limit */ $findings = []; + $offset = $offset ?? 0; $savedoffset = $offset; + $iFoundItems = 0; + do { $search = $this->executeSearch($filter, $base, $attr, $limitPerPage, $offset); - if($search === false) { + if ($search === false) { return []; } - list($sr, $pagedSearchOK) = $search; - $cr = $this->connection->getConnectionResource(); + [$sr, $pagedSearchOK] = $search; - if($skipHandling) { + if ($skipHandling) { //i.e. result do not need to be fetched, we just need the cookie //thus pass 1 or any other value as $iFoundItems because it is not //used - $this->processPagedSearchStatus($sr, $filter, $base, 1, $limitPerPage, - $offset, $pagedSearchOK, - $skipHandling); - return array(); + $this->processPagedSearchStatus($sr, 1, $limitPerPage, $pagedSearchOK, $skipHandling); + return []; } - $iFoundItems = 0; - foreach($sr as $res) { - $findings = array_merge($findings, $this->invokeLDAPMethod('getEntries', $cr, $res)); - $iFoundItems = max($iFoundItems, $findings['count']); - unset($findings['count']); - } + $findings = array_merge($findings, $this->invokeLDAPMethod('getEntries', $sr)); + $iFoundItems = max($iFoundItems, $findings['count']); + unset($findings['count']); - $continue = $this->processPagedSearchStatus($sr, $filter, $base, $iFoundItems, - $limitPerPage, $offset, $pagedSearchOK, - $skipHandling); + $continue = $this->processPagedSearchStatus($sr, $iFoundItems, $limitPerPage, $pagedSearchOK, $skipHandling); $offset += $limitPerPage; } while ($continue && $pagedSearchOK && ($limit === null || count($findings) < $limit)); - // reseting offset - $offset = $savedoffset; - // if we're here, probably no connection resource is returned. - // to make Nextcloud behave nicely, we simply give back an empty array. - if(is_null($findings)) { - return array(); - } + // resetting offset + $offset = $savedoffset; - if(!is_null($attr)) { + if (!is_null($attr)) { $selection = []; $i = 0; - foreach($findings as $item) { - if(!is_array($item)) { + foreach ($findings as $item) { + if (!is_array($item)) { continue; } - $item = \OCP\Util::mb_array_change_key_case($item, MB_CASE_LOWER, 'UTF-8'); - foreach($attr as $key) { - if(isset($item[$key])) { - if(is_array($item[$key]) && isset($item[$key]['count'])) { + $item = Util::mb_array_change_key_case($item, MB_CASE_LOWER, 'UTF-8'); + foreach ($attr as $key) { + if (isset($item[$key])) { + if (is_array($item[$key]) && isset($item[$key]['count'])) { unset($item[$key]['count']); } - if($key !== 'dn') { - if($this->resemblesDN($key)) { + if ($key !== 'dn') { + if ($this->resemblesDN($key)) { $selection[$i][$key] = $this->helper->sanitizeDN($item[$key]); - } else if($key === 'objectguid' || $key === 'guid') { + } elseif ($key === 'objectguid' || $key === 'guid') { $selection[$i][$key] = [$this->convertObjectGUID2Str($item[$key][0])]; } else { $selection[$i][$key] = $item[$key]; @@ -1268,7 +1341,6 @@ class Access extends LDAPUtility implements IUserTools { $selection[$i][$key] = [$this->helper->sanitizeDN($item[$key])]; } } - } $i++; } @@ -1277,30 +1349,39 @@ class Access extends LDAPUtility implements IUserTools { //we slice the findings, when //a) paged search unsuccessful, though attempted //b) no paged search, but limit set - if((!$this->getPagedSearchResultState() - && $pagedSearchOK) + if ((!$this->getPagedSearchResultState() + && $pagedSearchOK) || ( !$pagedSearchOK && !is_null($limit) ) ) { - $findings = array_slice($findings, intval($offset), $limit); + $findings = array_slice($findings, $offset, $limit); } return $findings; } /** * @param string $name - * @return bool|mixed|string + * @return string + * @throws \InvalidArgumentException */ public function sanitizeUsername($name) { - if($this->connection->ldapIgnoreNamingRules) { - return trim($name); + $name = trim($name); + + if ($this->connection->ldapIgnoreNamingRules) { + return $name; } - // Transliteration - // latin characters to ASCII - $name = iconv('UTF-8', 'ASCII//TRANSLIT', $name); + // Use htmlentities to get rid of accents + $name = htmlentities($name, ENT_NOQUOTES, 'UTF-8'); + + // Remove accents + $name = preg_replace('#&([A-Za-z])(?:acute|cedil|caron|circ|grave|orn|ring|slash|th|tilde|uml);#', '\1', $name); + // Remove ligatures + $name = preg_replace('#&([A-Za-z]{2})(?:lig);#', '\1', $name); + // Remove unknown leftover entities + $name = preg_replace('#&[^;]+;#', '', $name); // Replacements $name = str_replace(' ', '_', $name); @@ -1308,40 +1389,61 @@ class Access extends LDAPUtility implements IUserTools { // Every remaining disallowed characters will be removed $name = preg_replace('/[^a-zA-Z0-9_.@-]/u', '', $name); + if (strlen($name) > 64) { + $name = hash('sha256', $name, false); + } + + if ($name === '') { + throw new \InvalidArgumentException('provided name template for username does not contain any allowed characters'); + } + return $name; } + public function sanitizeGroupIDCandidate(string $candidate): string { + $candidate = trim($candidate); + if (strlen($candidate) > 64) { + $candidate = hash('sha256', $candidate, false); + } + if ($candidate === '') { + throw new \InvalidArgumentException('provided name template for username does not contain any allowed characters'); + } + + return $candidate; + } + /** - * escapes (user provided) parts for LDAP filter - * @param string $input, the provided value - * @param bool $allowAsterisk whether in * at the beginning should be preserved - * @return string the escaped string - */ - public function escapeFilterPart($input, $allowAsterisk = false) { + * escapes (user provided) parts for LDAP filter + * + * @param string $input , the provided value + * @param bool $allowAsterisk whether in * at the beginning should be preserved + * @return string the escaped string + */ + public function escapeFilterPart($input, $allowAsterisk = false): string { $asterisk = ''; - if($allowAsterisk && strlen($input) > 0 && $input[0] === '*') { + if ($allowAsterisk && strlen($input) > 0 && $input[0] === '*') { $asterisk = '*'; $input = mb_substr($input, 1, null, 'UTF-8'); } - $search = array('*', '\\', '(', ')'); - $replace = array('\\*', '\\\\', '\\(', '\\)'); - return $asterisk . str_replace($search, $replace, $input); + return $asterisk . ldap_escape($input, '', LDAP_ESCAPE_FILTER); } /** * combines the input filters with AND + * * @param string[] $filters the filters to connect * @return string the combined filter */ - public function combineFilterWithAnd($filters) { + public function combineFilterWithAnd($filters): string { return $this->combineFilter($filters, '&'); } /** * combines the input filters with OR + * * @param string[] $filters the filters to connect * @return string the combined filter - * Combines Filter arguments with OR + * Combines Filter arguments with OR */ public function combineFilterWithOr($filters) { return $this->combineFilter($filters, '|'); @@ -1349,28 +1451,30 @@ class Access extends LDAPUtility implements IUserTools { /** * combines the input filters with given operator + * * @param string[] $filters the filters to connect * @param string $operator either & or | * @return string the combined filter */ - private function combineFilter($filters, $operator) { - $combinedFilter = '('.$operator; - foreach($filters as $filter) { + private function combineFilter(array $filters, string $operator): string { + $combinedFilter = '(' . $operator; + foreach ($filters as $filter) { if ($filter !== '' && $filter[0] !== '(') { - $filter = '('.$filter.')'; + $filter = '(' . $filter . ')'; } - $combinedFilter.=$filter; + $combinedFilter .= $filter; } - $combinedFilter.=')'; + $combinedFilter .= ')'; return $combinedFilter; } /** * creates a filter part for to perform search for users + * * @param string $search the search term * @return string the final filter part to use in LDAP searches */ - public function getFilterPartForUserSearch($search) { + public function getFilterPartForUserSearch($search): string { return $this->getFilterPartForSearch($search, $this->connection->ldapAttributesForUserSearch, $this->connection->ldapUserDisplayName); @@ -1378,10 +1482,11 @@ class Access extends LDAPUtility implements IUserTools { /** * creates a filter part for to perform search for groups + * * @param string $search the search term * @return string the final filter part to use in LDAP searches */ - public function getFilterPartForGroupSearch($search) { + public function getFilterPartForGroupSearch($search): string { return $this->getFilterPartForSearch($search, $this->connection->ldapAttributesForGroupSearch, $this->connection->ldapGroupDisplayName); @@ -1390,23 +1495,24 @@ class Access extends LDAPUtility implements IUserTools { /** * creates a filter part for searches by splitting up the given search * string into single words + * * @param string $search the search term - * @param string[] $searchAttributes needs to have at least two attributes, - * otherwise it does not make sense :) + * @param string[]|null|'' $searchAttributes needs to have at least two attributes, + * otherwise it does not make sense :) * @return string the final filter part to use in LDAP searches - * @throws \Exception + * @throws DomainException */ - private function getAdvancedFilterPartForSearch($search, $searchAttributes) { - if(!is_array($searchAttributes) || count($searchAttributes) < 2) { - throw new \Exception('searchAttributes must be an array with at least two string'); + private function getAdvancedFilterPartForSearch(string $search, $searchAttributes): string { + if (!is_array($searchAttributes) || count($searchAttributes) < 2) { + throw new DomainException('searchAttributes must be an array with at least two string'); } $searchWords = explode(' ', trim($search)); - $wordFilters = array(); - foreach($searchWords as $word) { + $wordFilters = []; + foreach ($searchWords as $word) { $word = $this->prepareSearchTerm($word); //every word needs to appear at least once - $wordMatchOneAttrFilters = array(); - foreach($searchAttributes as $attr) { + $wordMatchOneAttrFilters = []; + foreach ($searchAttributes as $attr) { $wordMatchOneAttrFilters[] = $attr . '=' . $word; } $wordFilters[] = $this->combineFilterWithOr($wordMatchOneAttrFilters); @@ -1416,40 +1522,46 @@ class Access extends LDAPUtility implements IUserTools { /** * creates a filter part for searches + * * @param string $search the search term - * @param string[]|null $searchAttributes + * @param string[]|null|'' $searchAttributes * @param string $fallbackAttribute a fallback attribute in case the user - * did not define search attributes. Typically the display name attribute. + * did not define search attributes. Typically the display name attribute. * @return string the final filter part to use in LDAP searches */ - private function getFilterPartForSearch($search, $searchAttributes, $fallbackAttribute) { - $filter = array(); + private function getFilterPartForSearch(string $search, $searchAttributes, string $fallbackAttribute): string { + $filter = []; $haveMultiSearchAttributes = (is_array($searchAttributes) && count($searchAttributes) > 0); - if($haveMultiSearchAttributes && strpos(trim($search), ' ') !== false) { + if ($haveMultiSearchAttributes && str_contains(trim($search), ' ')) { try { return $this->getAdvancedFilterPartForSearch($search, $searchAttributes); - } catch(\Exception $e) { - \OCP\Util::writeLog( - 'user_ldap', - 'Creating advanced filter for search failed, falling back to simple method.', - \OCP\Util::INFO - ); + } catch (DomainException $e) { + // Creating advanced filter for search failed, falling back to simple method. Edge case, but valid. } } + $originalSearch = $search; $search = $this->prepareSearchTerm($search); - if(!is_array($searchAttributes) || count($searchAttributes) === 0) { + if (!is_array($searchAttributes) || count($searchAttributes) === 0) { if ($fallbackAttribute === '') { return ''; } + // wildcards don't work with some attributes + if ($originalSearch !== '') { + $filter[] = $fallbackAttribute . '=' . $originalSearch; + } $filter[] = $fallbackAttribute . '=' . $search; } else { - foreach($searchAttributes as $attribute) { + foreach ($searchAttributes as $attribute) { + // wildcards don't work with some attributes + if ($originalSearch !== '') { + $filter[] = $attribute . '=' . $originalSearch; + } $filter[] = $attribute . '=' . $search; } } - if(count($filter) === 1) { - return '('.$filter[0].')'; + if (count($filter) === 1) { + return '(' . $filter[0] . ')'; } return $this->combineFilterWithOr($filter); } @@ -1458,17 +1570,16 @@ class Access extends LDAPUtility implements IUserTools { * returns the search term depending on whether we are allowed * list users found by ldap with the current input appended by * a * - * @return string */ - private function prepareSearchTerm($term) { - $config = \OC::$server->getConfig(); + private function prepareSearchTerm(string $term): string { + $config = Server::get(IConfig::class); $allowEnum = $config->getAppValue('core', 'shareapi_allow_share_dialog_user_enumeration', 'yes'); $result = $term; if ($term === '') { $result = '*'; - } else if ($allowEnum !== 'no') { + } elseif ($allowEnum !== 'no') { $result = $term . '*'; } return $result; @@ -1476,30 +1587,27 @@ class Access extends LDAPUtility implements IUserTools { /** * returns the filter used for counting users - * @return string */ - public function getFilterForUserCount() { - $filter = $this->combineFilterWithAnd(array( + public function getFilterForUserCount(): string { + $filter = $this->combineFilterWithAnd([ $this->connection->ldapUserFilter, $this->connection->ldapUserDisplayName . '=*' - )); + ]); return $filter; } - /** - * @param string $name - * @param string $password - * @return bool - */ - public function areCredentialsValid($name, $password) { + public function areCredentialsValid(string $name, string $password): bool { + if ($name === '' || $password === '') { + return false; + } $name = $this->helper->DNasBaseParameter($name); $testConnection = clone $this->connection; - $credentials = array( + $credentials = [ 'ldapAgentName' => $name, - 'ldapAgentPassword' => $password - ); - if(!$testConnection->setConfiguration($credentials)) { + 'ldapAgentPassword' => $password, + ]; + if (!$testConnection->setConfiguration($credentials)) { return false; } return $testConnection->bind(); @@ -1514,37 +1622,42 @@ class Access extends LDAPUtility implements IUserTools { */ public function getUserDnByUuid($uuid) { $uuidOverride = $this->connection->ldapExpertUUIDUserAttr; - $filter = $this->connection->ldapUserFilter; - $base = $this->connection->ldapBaseUsers; + $filter = $this->connection->ldapUserFilter; + $bases = $this->connection->ldapBaseUsers; if ($this->connection->ldapUuidUserAttribute === 'auto' && $uuidOverride === '') { // Sacrebleu! The UUID attribute is unknown :( We need first an // existing DN to be able to reliably detect it. - $result = $this->search($filter, $base, ['dn'], 1); - if(!isset($result[0]) || !isset($result[0]['dn'])) { - throw new \Exception('Cannot determine UUID attribute'); + foreach ($bases as $base) { + $result = $this->search($filter, $base, ['dn'], 1); + if (!isset($result[0]) || !isset($result[0]['dn'])) { + continue; + } + $dn = $result[0]['dn'][0]; + if ($hasFound = $this->detectUuidAttribute($dn, true)) { + break; + } } - $dn = $result[0]['dn'][0]; - if(!$this->detectUuidAttribute($dn, true)) { + if (!isset($hasFound) || !$hasFound) { throw new \Exception('Cannot determine UUID attribute'); } } else { // The UUID attribute is either known or an override is given. // By calling this method we ensure that $this->connection->$uuidAttr // is definitely set - if(!$this->detectUuidAttribute('', true)) { + if (!$this->detectUuidAttribute('', true)) { throw new \Exception('Cannot determine UUID attribute'); } } $uuidAttr = $this->connection->ldapUuidUserAttribute; - if($uuidAttr === 'guid' || $uuidAttr === 'objectguid') { + if ($uuidAttr === 'guid' || $uuidAttr === 'objectguid') { $uuid = $this->formatGuid2ForFilterUser($uuid); } $filter = $uuidAttr . '=' . $uuid; $result = $this->searchUsers($filter, ['dn'], 2); - if(is_array($result) && isset($result[0]) && isset($result[0]['dn']) && count($result) === 1) { + if (isset($result[0]['dn']) && count($result) === 1) { // we put the count into account to make sure that this is // really unique return $result[0]['dn'][0]; @@ -1561,80 +1674,87 @@ class Access extends LDAPUtility implements IUserTools { * @param bool $force the detection should be run, even if it is not set to auto * @param array|null $ldapRecord * @return bool true on success, false otherwise + * @throws ServerNotAvailableException */ - private function detectUuidAttribute($dn, $isUser = true, $force = false, array $ldapRecord = null) { - if($isUser) { - $uuidAttr = 'ldapUuidUserAttribute'; + private function detectUuidAttribute(string $dn, bool $isUser = true, bool $force = false, ?array $ldapRecord = null): bool { + if ($isUser) { + $uuidAttr = 'ldapUuidUserAttribute'; $uuidOverride = $this->connection->ldapExpertUUIDUserAttr; } else { - $uuidAttr = 'ldapUuidGroupAttribute'; + $uuidAttr = 'ldapUuidGroupAttribute'; $uuidOverride = $this->connection->ldapExpertUUIDGroupAttr; } - if(($this->connection->$uuidAttr !== 'auto') && !$force) { - return true; - } + if (!$force) { + if ($this->connection->$uuidAttr !== 'auto') { + return true; + } elseif (is_string($uuidOverride) && trim($uuidOverride) !== '') { + $this->connection->$uuidAttr = $uuidOverride; + return true; + } - if (is_string($uuidOverride) && trim($uuidOverride) !== '' && !$force) { - $this->connection->$uuidAttr = $uuidOverride; - return true; + $attribute = $this->connection->getFromCache($uuidAttr); + if ($attribute !== null) { + $this->connection->$uuidAttr = $attribute; + return true; + } } - foreach(self::UUID_ATTRIBUTES as $attribute) { - if($ldapRecord !== null) { + foreach (self::UUID_ATTRIBUTES as $attribute) { + if ($ldapRecord !== null) { // we have the info from LDAP already, we don't need to talk to the server again - if(isset($ldapRecord[$attribute])) { + if (isset($ldapRecord[$attribute])) { $this->connection->$uuidAttr = $attribute; return true; - } else { - continue; } } $value = $this->readAttribute($dn, $attribute); - if(is_array($value) && isset($value[0]) && !empty($value[0])) { - \OCP\Util::writeLog('user_ldap', - 'Setting '.$attribute.' as '.$uuidAttr, - \OCP\Util::DEBUG); + if (is_array($value) && isset($value[0]) && !empty($value[0])) { + $this->logger->debug( + 'Setting {attribute} as {subject}', + [ + 'app' => 'user_ldap', + 'attribute' => $attribute, + 'subject' => $uuidAttr + ] + ); $this->connection->$uuidAttr = $attribute; + $this->connection->writeToCache($uuidAttr, $attribute); return true; } } - \OCP\Util::writeLog('user_ldap', - 'Could not autodetect the UUID attribute', - \OCP\Util::ERROR); + $this->logger->debug('Could not autodetect the UUID attribute', ['app' => 'user_ldap']); return false; } /** - * @param string $dn - * @param bool $isUser - * @param null $ldapRecord - * @return bool|string + * @param array|null $ldapRecord + * @return false|string + * @throws ServerNotAvailableException */ - public function getUUID($dn, $isUser = true, $ldapRecord = null) { - if($isUser) { - $uuidAttr = 'ldapUuidUserAttribute'; + public function getUUID(string $dn, bool $isUser = true, ?array $ldapRecord = null) { + if ($isUser) { + $uuidAttr = 'ldapUuidUserAttribute'; $uuidOverride = $this->connection->ldapExpertUUIDUserAttr; } else { - $uuidAttr = 'ldapUuidGroupAttribute'; + $uuidAttr = 'ldapUuidGroupAttribute'; $uuidOverride = $this->connection->ldapExpertUUIDGroupAttr; } $uuid = false; - if($this->detectUuidAttribute($dn, $isUser, false, $ldapRecord)) { + if ($this->detectUuidAttribute($dn, $isUser, false, $ldapRecord)) { $attr = $this->connection->$uuidAttr; - $uuid = isset($ldapRecord[$attr]) ? $ldapRecord[$attr] : $this->readAttribute($dn, $attr); - if( !is_array($uuid) + $uuid = $ldapRecord[$attr] ?? $this->readAttribute($dn, $attr); + if (!is_array($uuid) && $uuidOverride !== '' - && $this->detectUuidAttribute($dn, $isUser, true, $ldapRecord)) - { + && $this->detectUuidAttribute($dn, $isUser, true, $ldapRecord)) { $uuid = isset($ldapRecord[$this->connection->$uuidAttr]) ? $ldapRecord[$this->connection->$uuidAttr] : $this->readAttribute($dn, $this->connection->$uuidAttr); } - if(is_array($uuid) && isset($uuid[0]) && !empty($uuid[0])) { + if (is_array($uuid) && !empty($uuid[0])) { $uuid = $uuid[0]; } } @@ -1644,22 +1764,22 @@ class Access extends LDAPUtility implements IUserTools { /** * converts a binary ObjectGUID into a string representation - * @param string $oguid the ObjectGUID in it's binary form as retrieved from AD - * @return string - * @link http://www.php.net/manual/en/function.ldap-get-values-len.php#73198 + * + * @param string $oguid the ObjectGUID in its binary form as retrieved from AD + * @link https://www.php.net/manual/en/function.ldap-get-values-len.php#73198 */ - private function convertObjectGUID2Str($oguid) { + private function convertObjectGUID2Str(string $oguid): string { $hex_guid = bin2hex($oguid); $hex_guid_to_guid_str = ''; - for($k = 1; $k <= 4; ++$k) { + for ($k = 1; $k <= 4; ++$k) { $hex_guid_to_guid_str .= substr($hex_guid, 8 - 2 * $k, 2); } $hex_guid_to_guid_str .= '-'; - for($k = 1; $k <= 2; ++$k) { + for ($k = 1; $k <= 2; ++$k) { $hex_guid_to_guid_str .= substr($hex_guid, 12 - 2 * $k, 2); } $hex_guid_to_guid_str .= '-'; - for($k = 1; $k <= 2; ++$k) { + for ($k = 1; $k <= 2; ++$k) { $hex_guid_to_guid_str .= substr($hex_guid, 16 - 2 * $k, 2); } $hex_guid_to_guid_str .= '-' . substr($hex_guid, 16, 4); @@ -1671,20 +1791,14 @@ class Access extends LDAPUtility implements IUserTools { /** * the first three blocks of the string-converted GUID happen to be in * reverse order. In order to use it in a filter, this needs to be - * corrected. Furthermore the dashes need to be replaced and \\ preprended - * to every two hax figures. + * corrected. Furthermore the dashes need to be replaced and \\ prepended + * to every two hex figures. * * If an invalid string is passed, it will be returned without change. - * - * @param string $guid - * @return string */ - public function formatGuid2ForFilterUser($guid) { - if(!is_string($guid)) { - throw new \InvalidArgumentException('String expected'); - } + public function formatGuid2ForFilterUser(string $guid): string { $blocks = explode('-', $guid); - if(count($blocks) !== 5) { + if (count($blocks) !== 5) { /* * Why not throw an Exception instead? This method is a utility * called only when trying to figure out whether a "missing" known @@ -1696,19 +1810,19 @@ class Access extends LDAPUtility implements IUserTools { * an exception here would kill the experience for a valid, acting * user. Instead we write a log message. */ - \OC::$server->getLogger()->info( - 'Passed string does not resemble a valid GUID. Known UUID ' . - '({uuid}) probably does not match UUID configuration.', - [ 'app' => 'user_ldap', 'uuid' => $guid ] + $this->logger->info( + 'Passed string does not resemble a valid GUID. Known UUID ' + . '({uuid}) probably does not match UUID configuration.', + ['app' => 'user_ldap', 'uuid' => $guid] ); return $guid; } - for($i=0; $i < 3; $i++) { + for ($i = 0; $i < 3; $i++) { $pairs = str_split($blocks[$i], 2); $pairs = array_reverse($pairs); $blocks[$i] = implode('', $pairs); } - for($i=0; $i < 5; $i++) { + for ($i = 0; $i < 5; $i++) { $pairs = str_split($blocks[$i], 2); $blocks[$i] = '\\' . implode('\\', $pairs); } @@ -1717,19 +1831,21 @@ class Access extends LDAPUtility implements IUserTools { /** * gets a SID of the domain of the given dn + * * @param string $dn * @return string|bool + * @throws ServerNotAvailableException */ public function getSID($dn) { $domainDN = $this->getDomainDNFromDN($dn); - $cacheKey = 'getSID-'.$domainDN; + $cacheKey = 'getSID-' . $domainDN; $sid = $this->connection->getFromCache($cacheKey); - if(!is_null($sid)) { + if (!is_null($sid)) { return $sid; } $objectSid = $this->readAttribute($domainDN, 'objectsid'); - if(!is_array($objectSid) || empty($objectSid)) { + if (!is_array($objectSid) || empty($objectSid)) { $this->connection->writeToCache($cacheKey, false); return false; } @@ -1741,6 +1857,7 @@ class Access extends LDAPUtility implements IUserTools { /** * converts a binary SID into a string representation + * * @param string $sid * @return string */ @@ -1767,7 +1884,7 @@ class Access extends LDAPUtility implements IUserTools { // precision (see https://gist.github.com/bantu/886ac680b0aef5812f71) $iav = number_format(hexdec(bin2hex(substr($sid, 2, 6))), 0, '', ''); - $subIDs = array(); + $subIDs = []; for ($i = 0; $i < $numberSubID; $i++) { $subID = unpack('V', substr($sid, $subIdStart + $subIdLength * $i, $subIdLength)); $subIDs[] = sprintf('%u', $subID[1]); @@ -1779,20 +1896,19 @@ class Access extends LDAPUtility implements IUserTools { /** * checks if the given DN is part of the given base DN(s) - * @param string $dn the DN + * * @param string[] $bases array containing the allowed base DN or DNs - * @return bool */ - public function isDNPartOfBase($dn, $bases) { + public function isDNPartOfBase(string $dn, array $bases): bool { $belongsToBase = false; $bases = $this->helper->sanitizeDN($bases); - foreach($bases as $base) { + foreach ($bases as $base) { $belongsToBase = true; - if(mb_strripos($dn, $base, 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8')-mb_strlen($base, 'UTF-8'))) { + if (mb_strripos($dn, $base, 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8') - mb_strlen($base, 'UTF-8'))) { $belongsToBase = false; } - if($belongsToBase) { + if ($belongsToBase) { break; } } @@ -1801,40 +1917,15 @@ class Access extends LDAPUtility implements IUserTools { /** * resets a running Paged Search operation + * + * @throws ServerNotAvailableException */ - private function abandonPagedSearch() { - if($this->connection->hasPagedResultSupport) { - $cr = $this->connection->getConnectionResource(); - $this->invokeLDAPMethod('controlPagedResult', $cr, 0, false, $this->lastCookie); - $this->getPagedSearchResultState(); - $this->lastCookie = ''; - $this->cookies = array(); - } - } - - /** - * get a cookie for the next LDAP paged search - * @param string $base a string with the base DN for the search - * @param string $filter the search filter to identify the correct search - * @param int $limit the limit (or 'pageSize'), to identify the correct search well - * @param int $offset the offset for the new search to identify the correct search really good - * @return string containing the key or empty if none is cached - */ - private function getPagedResultCookie($base, $filter, $limit, $offset) { - if($offset === 0) { - return ''; - } - $offset -= $limit; - //we work with cache here - $cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' . intval($limit) . '-' . intval($offset); - $cookie = ''; - if(isset($this->cookies[$cacheKey])) { - $cookie = $this->cookies[$cacheKey]; - if(is_null($cookie)) { - $cookie = ''; - } + private function abandonPagedSearch(): void { + if ($this->lastCookie === '') { + return; } - return $cookie; + $this->getPagedSearchResultState(); + $this->lastCookie = ''; } /** @@ -1845,14 +1936,11 @@ class Access extends LDAPUtility implements IUserTools { * be reset by other operations. Best, call it immediately after a search(), * searchUsers() or searchGroups() call. count-methods are probably safe as * well. Don't rely on it with any fetchList-method. + * * @return bool */ public function hasMoreResults() { - if(!$this->connection->hasPagedResultSupport) { - return false; - } - - if(empty($this->lastCookie) && $this->lastCookie !== '0') { + if ($this->lastCookie === '') { // as in RFC 2696, when all results are returned, the cookie will // be empty. return false; @@ -1862,25 +1950,8 @@ class Access extends LDAPUtility implements IUserTools { } /** - * set a cookie for LDAP paged search run - * @param string $base a string with the base DN for the search - * @param string $filter the search filter to identify the correct search - * @param int $limit the limit (or 'pageSize'), to identify the correct search well - * @param int $offset the offset for the run search to identify the correct search really good - * @param string $cookie string containing the cookie returned by ldap_control_paged_result_response - * @return void - */ - private function setPagedResultCookie($base, $filter, $limit, $offset, $cookie) { - // allow '0' for 389ds - if(!empty($cookie) || $cookie === '0') { - $cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' .intval($limit) . '-' . intval($offset); - $this->cookies[$cacheKey] = $cookie; - $this->lastCookie = $cookie; - } - } - - /** * Check whether the most recent paged search was successful. It flushed the state var. Use it always after a possible paged search. + * * @return boolean|null true on success, null or false otherwise */ public function getPagedSearchResultState() { @@ -1891,75 +1962,92 @@ class Access extends LDAPUtility implements IUserTools { /** * Prepares a paged search, if possible + * * @param string $filter the LDAP filter for the search - * @param string[] $bases an array containing the LDAP subtree(s) that shall be searched + * @param string $base the LDAP subtree that shall be searched * @param string[] $attr optional, when a certain attribute shall be filtered outside * @param int $limit * @param int $offset - * @return bool|true - */ - private function initPagedSearch($filter, $bases, $attr, $limit, $offset) { + * @return array{bool, int, string} + * @throws ServerNotAvailableException + * @throws NoMoreResults + */ + private function initPagedSearch( + string $filter, + string $base, + ?array $attr, + int $pageSize, + int $offset, + ): array { $pagedSearchOK = false; - if($this->connection->hasPagedResultSupport && ($limit !== 0)) { - $offset = intval($offset); //can be null - \OCP\Util::writeLog('user_ldap', - 'initializing paged search for Filter '.$filter.' base '.print_r($bases, true) - .' attr '.print_r($attr, true). ' limit ' .$limit.' offset '.$offset, - \OCP\Util::DEBUG); - //get the cookie from the search for the previous search, required by LDAP - foreach($bases as $base) { - - $cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset); - if(empty($cookie) && $cookie !== "0" && ($offset > 0)) { - // no cookie known from a potential previous search. We need - // to start from 0 to come to the desired page. cookie value - // of '0' is valid, because 389ds - $reOffset = ($offset - $limit) < 0 ? 0 : $offset - $limit; - $this->search($filter, array($base), $attr, $limit, $reOffset, true); - $cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset); - //still no cookie? obviously, the server does not like us. Let's skip paging efforts. - // '0' is valid, because 389ds - //TODO: remember this, probably does not change in the next request... - if(empty($cookie) && $cookie !== '0') { - $cookie = null; - } - } - if(!is_null($cookie)) { - //since offset = 0, this is a new search. We abandon other searches that might be ongoing. - $this->abandonPagedSearch(); - $pagedSearchOK = $this->invokeLDAPMethod('controlPagedResult', - $this->connection->getConnectionResource(), $limit, - false, $cookie); - if(!$pagedSearchOK) { - return false; - } - \OCP\Util::writeLog('user_ldap', 'Ready for a paged search', \OCP\Util::DEBUG); + if ($pageSize !== 0) { + $this->logger->debug( + 'initializing paged search for filter {filter}, base {base}, attr {attr}, pageSize {pageSize}, offset {offset}', + [ + 'app' => 'user_ldap', + 'filter' => $filter, + 'base' => $base, + 'attr' => $attr, + 'pageSize' => $pageSize, + 'offset' => $offset + ] + ); + // Get the cookie from the search for the previous search, required by LDAP + if (($this->lastCookie === '') && ($offset > 0)) { + // no cookie known from a potential previous search. We need + // to start from 0 to come to the desired page. cookie value + // of '0' is valid, because 389ds + $defaultPageSize = (int)$this->connection->ldapPagingSize; + if ($offset < $defaultPageSize) { + /* Make a search with offset as page size and dismiss the result, to init the cookie */ + $this->search($filter, $base, $attr, $offset, 0, true); } else { - $e = new \Exception('No paged search possible, Limit '.$limit.' Offset '.$offset); - \OC::$server->getLogger()->logException($e, ['level' => Util::DEBUG]); + /* Make a search for previous page and dismiss the result, to init the cookie */ + $reOffset = $offset - $defaultPageSize; + $this->search($filter, $base, $attr, $defaultPageSize, $reOffset, true); + } + if (!$this->hasMoreResults()) { + // when the cookie is reset with != 0 offset, there are no further + // results, so stop. + throw new NoMoreResults(); } - } - /* ++ Fixing RHDS searches with pages with zero results ++ - * We coudn't get paged searches working with our RHDS for login ($limit = 0), - * due to pages with zero results. - * So we added "&& !empty($this->lastCookie)" to this test to ignore pagination - * if we don't have a previous paged search. - */ - } else if($this->connection->hasPagedResultSupport && $limit === 0 && !empty($this->lastCookie)) { + if ($this->lastCookie !== '' && $offset === 0) { + //since offset = 0, this is a new search. We abandon other searches that might be ongoing. + $this->abandonPagedSearch(); + } + $this->logger->debug('Ready for a paged search', ['app' => 'user_ldap']); + return [true, $pageSize, $this->lastCookie]; + /* ++ Fixing RHDS searches with pages with zero results ++ + * We couldn't get paged searches working with our RHDS for login ($limit = 0), + * due to pages with zero results. + * So we added "&& !empty($this->lastCookie)" to this test to ignore pagination + * if we don't have a previous paged search. + */ + } elseif ($this->lastCookie !== '') { // a search without limit was requested. However, if we do use // Paged Search once, we always must do it. This requires us to // initialize it with the configured page size. $this->abandonPagedSearch(); // in case someone set it to 0 … use 500, otherwise no results will // be returned. - $pageSize = intval($this->connection->ldapPagingSize) > 0 ? intval($this->connection->ldapPagingSize) : 500; - $pagedSearchOK = $this->invokeLDAPMethod('controlPagedResult', - $this->connection->getConnectionResource(), - $pageSize, false, ''); + $pageSize = (int)$this->connection->ldapPagingSize > 0 ? (int)$this->connection->ldapPagingSize : 500; + return [true, $pageSize, $this->lastCookie]; } - return $pagedSearchOK; + return [false, $pageSize, '']; } + /** + * Is more than one $attr used for search? + * + * @param string|string[]|null $attr + * @return bool + */ + private function manyAttributes($attr): bool { + if (\is_array($attr)) { + return \count($attr) > 1; + } + return false; + } } |