aboutsummaryrefslogtreecommitdiffstats
path: root/apps/user_ldap/lib/Connection.php
diff options
context:
space:
mode:
Diffstat (limited to 'apps/user_ldap/lib/Connection.php')
-rw-r--r--apps/user_ldap/lib/Connection.php681
1 files changed, 411 insertions, 270 deletions
diff --git a/apps/user_ldap/lib/Connection.php b/apps/user_ldap/lib/Connection.php
index c73a35e6bf1..336179ac341 100644
--- a/apps/user_ldap/lib/Connection.php
+++ b/apps/user_ldap/lib/Connection.php
@@ -1,70 +1,106 @@
<?php
+
/**
- * @copyright Copyright (c) 2016, ownCloud, Inc.
- *
- * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
- * @author Bart Visscher <bartv@thisnet.nl>
- * @author Brent Bloxam <brent.bloxam@gmail.com>
- * @author Jarkko Lehtoranta <devel@jlranta.com>
- * @author Joas Schilling <coding@schilljs.com>
- * @author Jörn Friedrich Dreyer <jfd@butonic.de>
- * @author Lukas Reschke <lukas@statuscode.ch>
- * @author Lyonel Vincent <lyonel@ezix.org>
- * @author Morris Jobke <hey@morrisjobke.de>
- * @author Robin Appelman <robin@icewind.nl>
- * @author Robin McCorkell <robin@mccorkell.me.uk>
- * @author Roeland Jago Douma <roeland@famdouma.nl>
- * @author root <root@localhost.localdomain>
- * @author Victor Dubiniuk <dubiniuk@owncloud.com>
- * @author Xuanwo <xuanwo@yunify.com>
- *
- * @license AGPL-3.0
- *
- * This code is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License, version 3,
- * as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License, version 3,
- * along with this program. If not, see <http://www.gnu.org/licenses/>
- *
+ * SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-FileCopyrightText: 2016 ownCloud, Inc.
+ * SPDX-License-Identifier: AGPL-3.0-only
*/
-
namespace OCA\User_LDAP;
use OC\ServerNotAvailableException;
+use OCA\User_LDAP\Exceptions\ConfigurationIssueException;
+use OCP\ICache;
+use OCP\ICacheFactory;
+use OCP\IL10N;
+use OCP\Server;
+use OCP\Util;
+use Psr\Log\LoggerInterface;
/**
- * magic properties (incomplete)
+ * magic properties
* responsible for LDAP connections in context with the provided configuration
*
- * @property string ldapHost
- * @property string ldapPort holds the port number
- * @property string ldapUserFilter
- * @property string ldapUserDisplayName
- * @property string ldapUserDisplayName2
- * @property boolean turnOnPasswordChange
- * @property boolean hasPagedResultSupport
- * @property string[] ldapBaseUsers
- * @property int|null ldapPagingSize holds an integer
- * @property bool|mixed|void ldapGroupMemberAssocAttr
- * @property string ldapUuidUserAttribute
- * @property string ldapUuidGroupAttribute
- * @property string ldapExpertUUIDUserAttr
- * @property string ldapExpertUUIDGroupAttr
+ * @property string $ldapHost
+ * @property string $ldapPort
+ * @property string $ldapBackupHost
+ * @property string $ldapBackupPort
+ * @property string $ldapBackgroundHost
+ * @property string $ldapBackgroundPort
+ * @property array|'' $ldapBase
+ * @property array|'' $ldapBaseUsers
+ * @property array|'' $ldapBaseGroups
+ * @property string $ldapAgentName
+ * @property string $ldapAgentPassword
+ * @property string $ldapTLS
+ * @property string $turnOffCertCheck
+ * @property string $ldapIgnoreNamingRules
+ * @property string $ldapUserDisplayName
+ * @property string $ldapUserDisplayName2
+ * @property string $ldapUserAvatarRule
+ * @property string $ldapGidNumber
+ * @property array|'' $ldapUserFilterObjectclass
+ * @property array|'' $ldapUserFilterGroups
+ * @property string $ldapUserFilter
+ * @property string $ldapUserFilterMode
+ * @property string $ldapGroupFilter
+ * @property string $ldapGroupFilterMode
+ * @property array|'' $ldapGroupFilterObjectclass
+ * @property array|'' $ldapGroupFilterGroups
+ * @property string $ldapGroupDisplayName
+ * @property string $ldapGroupMemberAssocAttr
+ * @property string $ldapLoginFilter
+ * @property string $ldapLoginFilterMode
+ * @property string $ldapLoginFilterEmail
+ * @property string $ldapLoginFilterUsername
+ * @property array|'' $ldapLoginFilterAttributes
+ * @property string $ldapQuotaAttribute
+ * @property string $ldapQuotaDefault
+ * @property string $ldapEmailAttribute
+ * @property string $ldapCacheTTL
+ * @property string $ldapUuidUserAttribute
+ * @property string $ldapUuidGroupAttribute
+ * @property string $ldapOverrideMainServer
+ * @property string $ldapConfigurationActive
+ * @property array|'' $ldapAttributesForUserSearch
+ * @property array|'' $ldapAttributesForGroupSearch
+ * @property string $ldapExperiencedAdmin
+ * @property string $homeFolderNamingRule
+ * @property string $hasMemberOfFilterSupport
+ * @property string $useMemberOfToDetectMembership
+ * @property string $ldapExpertUsernameAttr
+ * @property string $ldapExpertUUIDUserAttr
+ * @property string $ldapExpertUUIDGroupAttr
+ * @property string $markRemnantsAsDisabled
+ * @property string $lastJpegPhotoLookup
+ * @property string $ldapNestedGroups
+ * @property string $ldapPagingSize
+ * @property string $turnOnPasswordChange
+ * @property string $ldapDynamicGroupMemberURL
+ * @property string $ldapDefaultPPolicyDN
+ * @property string $ldapExtStorageHomeAttribute
+ * @property string $ldapMatchingRuleInChainState
+ * @property string $ldapConnectionTimeout
+ * @property string $ldapAttributePhone
+ * @property string $ldapAttributeWebsite
+ * @property string $ldapAttributeAddress
+ * @property string $ldapAttributeTwitter
+ * @property string $ldapAttributeFediverse
+ * @property string $ldapAttributeOrganisation
+ * @property string $ldapAttributeRole
+ * @property string $ldapAttributeHeadline
+ * @property string $ldapAttributeBiography
+ * @property string $ldapAdminGroup
+ * @property string $ldapAttributeBirthDate
+ * @property string $ldapAttributePronouns
*/
class Connection extends LDAPUtility {
- private $ldapConnectionRes = null;
- private $configPrefix;
- private $configID;
- private $configured = false;
- private $hasPagedResultSupport = true;
- //whether connection should be kept on __destruct
- private $dontDestruct = false;
+ private ?\LDAP\Connection $ldapConnectionRes = null;
+ private bool $configured = false;
+
+ /**
+ * @var bool whether connection should be kept on __destruct
+ */
+ private bool $dontDestruct = false;
/**
* @var bool runtime flag that indicates whether supported primary groups are available
@@ -76,44 +112,60 @@ class Connection extends LDAPUtility {
*/
public $hasGidNumber = true;
- //cache handler
- protected $cache;
+ /**
+ * @var ICache|null
+ */
+ protected $cache = null;
- /** @var Configuration settings handler **/
+ /** @var Configuration settings handler * */
protected $configuration;
+ /**
+ * @var bool
+ */
protected $doNotValidate = false;
+ /**
+ * @var bool
+ */
protected $ignoreValidation = false;
/**
+ * @var array{sum?: string, result?: bool}
+ */
+ protected $bindResult = [];
+
+ protected LoggerInterface $logger;
+ private IL10N $l10n;
+
+ /**
* Constructor
- * @param ILDAPWrapper $ldap
* @param string $configPrefix a string with the prefix for the configkey column (appconfig table)
* @param string|null $configID a string with the value for the appid column (appconfig table) or null for on-the-fly connections
*/
- public function __construct(ILDAPWrapper $ldap, $configPrefix = '', $configID = 'user_ldap') {
+ public function __construct(
+ ILDAPWrapper $ldap,
+ private string $configPrefix = '',
+ private ?string $configID = 'user_ldap',
+ ) {
parent::__construct($ldap);
- $this->configPrefix = $configPrefix;
- $this->configID = $configID;
- $this->configuration = new Configuration($configPrefix,
- !is_null($configID));
- $memcache = \OC::$server->getMemCacheFactory();
- if($memcache->isAvailable()) {
+ $this->configuration = new Configuration($this->configPrefix, !is_null($this->configID));
+ $memcache = Server::get(ICacheFactory::class);
+ if ($memcache->isAvailable()) {
$this->cache = $memcache->createDistributed();
}
- $helper = new Helper(\OC::$server->getConfig());
+ $helper = Server::get(Helper::class);
$this->doNotValidate = !in_array($this->configPrefix,
$helper->getServerConfigurationPrefixes());
- $this->hasPagedResultSupport =
- intval($this->configuration->ldapPagingSize) !== 0
- || $this->ldap->hasPagedResultSupport();
+ $this->logger = Server::get(LoggerInterface::class);
+ $this->l10n = Util::getL10N('user_ldap');
}
public function __destruct() {
- if(!$this->dontDestruct && $this->ldap->isResource($this->ldapConnectionRes)) {
+ if (!$this->dontDestruct && $this->ldap->isResource($this->ldapConnectionRes)) {
@$this->ldap->unbind($this->ldapConnectionRes);
- };
+ $this->bindResult = [];
+ }
}
/**
@@ -121,24 +173,19 @@ class Connection extends LDAPUtility {
*/
public function __clone() {
$this->configuration = new Configuration($this->configPrefix,
- !is_null($this->configID));
+ !is_null($this->configID));
+ if (count($this->bindResult) !== 0 && $this->bindResult['result'] === true) {
+ $this->bindResult = [];
+ }
$this->ldapConnectionRes = null;
$this->dontDestruct = true;
}
- /**
- * @param string $name
- * @return bool|mixed
- */
- public function __get($name) {
- if(!$this->configured) {
+ public function __get(string $name) {
+ if (!$this->configured) {
$this->readConfiguration();
}
- if($name === 'hasPagedResultSupport') {
- return $this->hasPagedResultSupport;
- }
-
return $this->configuration->$name;
}
@@ -151,7 +198,7 @@ class Connection extends LDAPUtility {
$before = $this->configuration->$name;
$this->configuration->$name = $value;
$after = $this->configuration->$name;
- if($before !== $after) {
+ if ($before !== $after) {
if ($this->configID !== '' && $this->configID !== null) {
$this->configuration->saveConfiguration();
}
@@ -160,6 +207,15 @@ class Connection extends LDAPUtility {
}
/**
+ * @param string $rule
+ * @return array
+ * @throws \RuntimeException
+ */
+ public function resolveRule($rule) {
+ return $this->configuration->resolveRule($rule);
+ }
+
+ /**
* sets whether the result of the configuration validation shall
* be ignored when establishing the connection. Used by the Wizard
* in early configuration state.
@@ -179,17 +235,17 @@ class Connection extends LDAPUtility {
}
/**
- * Returns the LDAP handler
+ * @return \LDAP\Connection The LDAP resource
*/
- public function getConnectionResource() {
- if(!$this->ldapConnectionRes) {
+ public function getConnectionResource(): \LDAP\Connection {
+ if (!$this->ldapConnectionRes) {
$this->init();
- } else if(!$this->ldap->isResource($this->ldapConnectionRes)) {
- $this->ldapConnectionRes = null;
- $this->establishConnection();
}
- if(is_null($this->ldapConnectionRes)) {
- \OCP\Util::writeLog('user_ldap', 'No LDAP Connection to server ' . $this->configuration->ldapHost, \OCP\Util::ERROR);
+ if (is_null($this->ldapConnectionRes)) {
+ $this->logger->error(
+ 'No LDAP Connection to server ' . $this->configuration->ldapHost,
+ ['app' => 'user_ldap']
+ );
throw new ServerNotAvailableException('Connection to LDAP server could not be established');
}
return $this->ldapConnectionRes;
@@ -198,23 +254,23 @@ class Connection extends LDAPUtility {
/**
* resets the connection resource
*/
- public function resetConnectionResource() {
- if(!is_null($this->ldapConnectionRes)) {
+ public function resetConnectionResource(): void {
+ if (!is_null($this->ldapConnectionRes)) {
@$this->ldap->unbind($this->ldapConnectionRes);
$this->ldapConnectionRes = null;
+ $this->bindResult = [];
}
}
/**
* @param string|null $key
- * @return string
*/
- private function getCacheKey($key) {
- $prefix = 'LDAP-'.$this->configID.'-'.$this->configPrefix.'-';
- if(is_null($key)) {
+ private function getCacheKey($key): string {
+ $prefix = 'LDAP-' . $this->configID . '-' . $this->configPrefix . '-';
+ if (is_null($key)) {
return $prefix;
}
- return $prefix.md5($key);
+ return $prefix . hash('sha256', $key);
}
/**
@@ -222,39 +278,42 @@ class Connection extends LDAPUtility {
* @return mixed|null
*/
public function getFromCache($key) {
- if(!$this->configured) {
+ if (!$this->configured) {
$this->readConfiguration();
}
- if(is_null($this->cache) || !$this->configuration->ldapCacheTTL) {
+ if (is_null($this->cache) || !$this->configuration->ldapCacheTTL) {
return null;
}
$key = $this->getCacheKey($key);
- return json_decode(base64_decode($this->cache->get($key)), true);
+ return json_decode(base64_decode($this->cache->get($key) ?? ''), true);
+ }
+
+ public function getConfigPrefix(): string {
+ return $this->configPrefix;
}
/**
* @param string $key
* @param mixed $value
- *
- * @return string
*/
- public function writeToCache($key, $value) {
- if(!$this->configured) {
+ public function writeToCache($key, $value, ?int $ttlOverride = null): void {
+ if (!$this->configured) {
$this->readConfiguration();
}
- if(is_null($this->cache)
+ if (is_null($this->cache)
|| !$this->configuration->ldapCacheTTL
|| !$this->configuration->ldapConfigurationActive) {
- return null;
+ return;
}
- $key = $this->getCacheKey($key);
+ $key = $this->getCacheKey($key);
$value = base64_encode(json_encode($value));
- $this->cache->set($key, $value, $this->configuration->ldapCacheTTL);
+ $ttl = $ttlOverride ?? $this->configuration->ldapCacheTTL;
+ $this->cache->set($key, $value, $ttl);
}
public function clearCache() {
- if(!is_null($this->cache)) {
+ if (!is_null($this->cache)) {
$this->cache->clear($this->getCacheKey(null));
}
}
@@ -262,11 +321,10 @@ class Connection extends LDAPUtility {
/**
* Caches the general LDAP configuration.
* @param bool $force optional. true, if the re-read should be forced. defaults
- * to false.
- * @return null
+ * to false.
*/
- private function readConfiguration($force = false) {
- if((!$this->configured || $force) && !is_null($this->configID)) {
+ private function readConfiguration(bool $force = false): void {
+ if ((!$this->configured || $force) && !is_null($this->configID)) {
$this->configuration->readConfiguration();
$this->configured = $this->validateConfiguration();
}
@@ -276,16 +334,17 @@ class Connection extends LDAPUtility {
* set LDAP configuration with values delivered by an array, not read from configuration
* @param array $config array that holds the config parameters in an associated array
* @param array &$setParameters optional; array where the set fields will be given to
- * @return boolean true if config validates, false otherwise. Check with $setParameters for detailed success on single parameters
+ * @param bool $throw if true, throw ConfigurationIssueException with details instead of returning false
+ * @return bool true if config validates, false otherwise. Check with $setParameters for detailed success on single parameters
*/
- public function setConfiguration($config, &$setParameters = null) {
- if(is_null($setParameters)) {
- $setParameters = array();
+ public function setConfiguration(array $config, ?array &$setParameters = null, bool $throw = false): bool {
+ if (is_null($setParameters)) {
+ $setParameters = [];
}
$this->doNotValidate = false;
$this->configuration->setConfiguration($config, $setParameters);
- if(count($setParameters) > 0) {
- $this->configured = $this->validateConfiguration();
+ if (count($setParameters) > 0) {
+ $this->configured = $this->validateConfiguration($throw);
}
@@ -310,11 +369,11 @@ class Connection extends LDAPUtility {
$this->readConfiguration();
$config = $this->configuration->getConfiguration();
$cta = $this->configuration->getConfigTranslationArray();
- $result = array();
- foreach($cta as $dbkey => $configkey) {
- switch($configkey) {
+ $result = [];
+ foreach ($cta as $dbkey => $configkey) {
+ switch ($configkey) {
case 'homeFolderNamingRule':
- if(strpos($config[$configkey], 'attr:') === 0) {
+ if (str_starts_with($config[$configkey], 'attr:')) {
$result[$dbkey] = substr($config[$configkey], 5);
} else {
$result[$dbkey] = '';
@@ -325,10 +384,11 @@ class Connection extends LDAPUtility {
case 'ldapBaseGroups':
case 'ldapAttributesForUserSearch':
case 'ldapAttributesForGroupSearch':
- if(is_array($config[$configkey])) {
+ if (is_array($config[$configkey])) {
$result[$dbkey] = implode("\n", $config[$configkey]);
break;
} //else follows default
+ // no break
default:
$result[$dbkey] = $config[$configkey];
}
@@ -336,78 +396,77 @@ class Connection extends LDAPUtility {
return $result;
}
- private function doSoftValidation() {
+ private function doSoftValidation(): void {
//if User or Group Base are not set, take over Base DN setting
- foreach(array('ldapBaseUsers', 'ldapBaseGroups') as $keyBase) {
+ foreach (['ldapBaseUsers', 'ldapBaseGroups'] as $keyBase) {
$val = $this->configuration->$keyBase;
- if(empty($val)) {
+ if (empty($val)) {
$this->configuration->$keyBase = $this->configuration->ldapBase;
}
}
- foreach(array('ldapExpertUUIDUserAttr' => 'ldapUuidUserAttribute',
- 'ldapExpertUUIDGroupAttr' => 'ldapUuidGroupAttribute')
- as $expertSetting => $effectiveSetting) {
+ foreach (['ldapExpertUUIDUserAttr' => 'ldapUuidUserAttribute',
+ 'ldapExpertUUIDGroupAttr' => 'ldapUuidGroupAttribute'] as $expertSetting => $effectiveSetting) {
$uuidOverride = $this->configuration->$expertSetting;
- if(!empty($uuidOverride)) {
+ if (!empty($uuidOverride)) {
$this->configuration->$effectiveSetting = $uuidOverride;
} else {
$uuidAttributes = Access::UUID_ATTRIBUTES;
array_unshift($uuidAttributes, 'auto');
- if(!in_array($this->configuration->$effectiveSetting,
- $uuidAttributes)
- && (!is_null($this->configID))) {
+ if (!in_array($this->configuration->$effectiveSetting, $uuidAttributes)
+ && !is_null($this->configID)) {
$this->configuration->$effectiveSetting = 'auto';
$this->configuration->saveConfiguration();
- \OCP\Util::writeLog('user_ldap',
- 'Illegal value for the '.
- $effectiveSetting.', '.'reset to '.
- 'autodetect.', \OCP\Util::INFO);
+ $this->logger->info(
+ 'Illegal value for the ' . $effectiveSetting . ', reset to autodetect.',
+ ['app' => 'user_ldap']
+ );
}
-
}
}
- $backupPort = intval($this->configuration->ldapBackupPort);
+ $backupPort = (int)$this->configuration->ldapBackupPort;
if ($backupPort <= 0) {
- $this->configuration->backupPort = $this->configuration->ldapPort;
+ $this->configuration->ldapBackupPort = $this->configuration->ldapPort;
}
//make sure empty search attributes are saved as simple, empty array
- $saKeys = array('ldapAttributesForUserSearch',
- 'ldapAttributesForGroupSearch');
- foreach($saKeys as $key) {
+ $saKeys = ['ldapAttributesForUserSearch',
+ 'ldapAttributesForGroupSearch'];
+ foreach ($saKeys as $key) {
$val = $this->configuration->$key;
- if(is_array($val) && count($val) === 1 && empty($val[0])) {
- $this->configuration->$key = array();
+ if (is_array($val) && count($val) === 1 && empty($val[0])) {
+ $this->configuration->$key = [];
}
}
- if((stripos($this->configuration->ldapHost, 'ldaps://') === 0)
+ if ((stripos((string)$this->configuration->ldapHost, 'ldaps://') === 0)
&& $this->configuration->ldapTLS) {
- $this->configuration->ldapTLS = false;
- \OCP\Util::writeLog('user_ldap',
- 'LDAPS (already using secure connection) and '.
- 'TLS do not work together. Switched off TLS.',
- \OCP\Util::INFO);
+ $this->configuration->ldapTLS = (string)false;
+ $this->logger->info(
+ 'LDAPS (already using secure connection) and TLS do not work together. Switched off TLS.',
+ ['app' => 'user_ldap']
+ );
}
}
/**
- * @return bool
+ * @throws ConfigurationIssueException
*/
- private function doCriticalValidation() {
- $configurationOK = true;
- $errorStr = 'Configuration Error (prefix '.
- strval($this->configPrefix).'): ';
-
+ private function doCriticalValidation(): void {
//options that shall not be empty
- $options = array('ldapHost', 'ldapPort', 'ldapUserDisplayName',
- 'ldapGroupDisplayName', 'ldapLoginFilter');
- foreach($options as $key) {
+ $options = ['ldapHost', 'ldapUserDisplayName',
+ 'ldapGroupDisplayName', 'ldapLoginFilter'];
+
+ //ldapPort should not be empty either unless ldapHost is pointing to a socket
+ if (!$this->configuration->usesLdapi()) {
+ $options[] = 'ldapPort';
+ }
+
+ foreach ($options as $key) {
$val = $this->configuration->$key;
- if(empty($val)) {
- switch($key) {
+ if (empty($val)) {
+ switch ($key) {
case 'ldapHost':
$subj = 'LDAP Host';
break;
@@ -427,58 +486,87 @@ class Connection extends LDAPUtility {
$subj = $key;
break;
}
- $configurationOK = false;
- \OCP\Util::writeLog('user_ldap',
- $errorStr.'No '.$subj.' given!',
- \OCP\Util::WARN);
+ throw new ConfigurationIssueException(
+ 'No ' . $subj . ' given!',
+ $this->l10n->t('Mandatory field "%s" left empty', $subj),
+ );
}
}
//combinations
$agent = $this->configuration->ldapAgentName;
$pwd = $this->configuration->ldapAgentPassword;
- if (
- ($agent === '' && $pwd !== '')
- || ($agent !== '' && $pwd === '')
- ) {
- \OCP\Util::writeLog('user_ldap',
- $errorStr.'either no password is given for the '.
- 'user agent or a password is given, but not an '.
- 'LDAP agent.',
- \OCP\Util::WARN);
- $configurationOK = false;
+ if ($agent === '' && $pwd !== '') {
+ throw new ConfigurationIssueException(
+ 'A password is given, but not an LDAP agent',
+ $this->l10n->t('A password is given, but not an LDAP agent'),
+ );
+ }
+ if ($agent !== '' && $pwd === '') {
+ throw new ConfigurationIssueException(
+ 'No password is given for the user agent',
+ $this->l10n->t('No password is given for the user agent'),
+ );
}
$base = $this->configuration->ldapBase;
$baseUsers = $this->configuration->ldapBaseUsers;
$baseGroups = $this->configuration->ldapBaseGroups;
- if(empty($base) && empty($baseUsers) && empty($baseGroups)) {
- \OCP\Util::writeLog('user_ldap',
- $errorStr.'Not a single Base DN given.',
- \OCP\Util::WARN);
- $configurationOK = false;
+ if (empty($base)) {
+ throw new ConfigurationIssueException(
+ 'Not a single Base DN given',
+ $this->l10n->t('No LDAP base DN was given'),
+ );
+ }
+
+ if (!empty($baseUsers) && !$this->checkBasesAreValid($baseUsers, $base)) {
+ throw new ConfigurationIssueException(
+ 'User base is not in root base',
+ $this->l10n->t('User base DN is not a subnode of global base DN'),
+ );
}
- if(mb_strpos($this->configuration->ldapLoginFilter, '%uid', 0, 'UTF-8')
- === false) {
- \OCP\Util::writeLog('user_ldap',
- $errorStr.'login filter does not contain %uid '.
- 'place holder.',
- \OCP\Util::WARN);
- $configurationOK = false;
+ if (!empty($baseGroups) && !$this->checkBasesAreValid($baseGroups, $base)) {
+ throw new ConfigurationIssueException(
+ 'Group base is not in root base',
+ $this->l10n->t('Group base DN is not a subnode of global base DN'),
+ );
}
- return $configurationOK;
+ if (mb_strpos((string)$this->configuration->ldapLoginFilter, '%uid', 0, 'UTF-8') === false) {
+ throw new ConfigurationIssueException(
+ 'Login filter does not contain %uid placeholder.',
+ $this->l10n->t('Login filter does not contain %s placeholder.', ['%uid']),
+ );
+ }
+ }
+
+ /**
+ * Checks that all bases are subnodes of one of the root bases
+ */
+ private function checkBasesAreValid(array $bases, array $rootBases): bool {
+ foreach ($bases as $base) {
+ $ok = false;
+ foreach ($rootBases as $rootBase) {
+ if (str_ends_with($base, $rootBase)) {
+ $ok = true;
+ break;
+ }
+ }
+ if (!$ok) {
+ return false;
+ }
+ }
+ return true;
}
/**
* Validates the user specified configuration
* @return bool true if configuration seems OK, false otherwise
*/
- private function validateConfiguration() {
-
- if($this->doNotValidate) {
+ private function validateConfiguration(bool $throw = false): bool {
+ if ($this->doNotValidate) {
//don't do a validation if it is a new configuration with pure
//default values. Will be allowed on changes via __set or
//setConfiguration
@@ -491,83 +579,94 @@ class Connection extends LDAPUtility {
//second step: critical checks. If left empty or filled wrong, mark as
//not configured and give a warning.
- return $this->doCriticalValidation();
+ try {
+ $this->doCriticalValidation();
+ return true;
+ } catch (ConfigurationIssueException $e) {
+ if ($throw) {
+ throw $e;
+ }
+ $this->logger->warning(
+ 'Configuration Error (prefix ' . $this->configPrefix . '): ' . $e->getMessage(),
+ ['exception' => $e]
+ );
+ return false;
+ }
}
/**
* Connects and Binds to LDAP
+ *
+ * @throws ServerNotAvailableException
*/
- private function establishConnection() {
- if(!$this->configuration->ldapConfigurationActive) {
+ private function establishConnection(): ?bool {
+ if (!$this->configuration->ldapConfigurationActive) {
return null;
}
static $phpLDAPinstalled = true;
- if(!$phpLDAPinstalled) {
+ if (!$phpLDAPinstalled) {
return false;
}
- if(!$this->ignoreValidation && !$this->configured) {
- \OCP\Util::writeLog('user_ldap',
- 'Configuration is invalid, cannot connect',
- \OCP\Util::WARN);
+ if (!$this->ignoreValidation && !$this->configured) {
+ $this->logger->warning(
+ 'Configuration is invalid, cannot connect',
+ ['app' => 'user_ldap']
+ );
return false;
}
- if(!$this->ldapConnectionRes) {
- if(!$this->ldap->areLDAPFunctionsAvailable()) {
+ if (!$this->ldapConnectionRes) {
+ if (!$this->ldap->areLDAPFunctionsAvailable()) {
$phpLDAPinstalled = false;
- \OCP\Util::writeLog('user_ldap',
- 'function ldap_connect is not available. Make '.
- 'sure that the PHP ldap module is installed.',
- \OCP\Util::ERROR);
+ $this->logger->error(
+ 'function ldap_connect is not available. Make sure that the PHP ldap module is installed.',
+ ['app' => 'user_ldap']
+ );
return false;
}
- if($this->configuration->turnOffCertCheck) {
- if(putenv('LDAPTLS_REQCERT=never')) {
- \OCP\Util::writeLog('user_ldap',
- 'Turned off SSL certificate validation successfully.',
- \OCP\Util::DEBUG);
- } else {
- \OCP\Util::writeLog('user_ldap',
- 'Could not turn off SSL certificate validation.',
- \OCP\Util::WARN);
- }
- }
- $isOverrideMainServer = ($this->configuration->ldapOverrideMainServer
- || $this->getFromCache('overrideMainServer'));
- $isBackupHost = (trim($this->configuration->ldapBackupHost) !== "");
+ $hasBackupHost = (trim($this->configuration->ldapBackupHost ?? '') !== '');
+ $hasBackgroundHost = (trim($this->configuration->ldapBackgroundHost ?? '') !== '');
+ $useBackgroundHost = (\OC::$CLI && $hasBackgroundHost);
+ $overrideCacheKey = ($useBackgroundHost ? 'overrideBackgroundServer' : 'overrideMainServer');
+ $forceBackupHost = ($this->configuration->ldapOverrideMainServer || $this->getFromCache($overrideCacheKey));
$bindStatus = false;
- $error = -1;
- try {
- if (!$isOverrideMainServer) {
- $this->doConnect($this->configuration->ldapHost,
- $this->configuration->ldapPort);
- $bindStatus = $this->bind();
- $error = $this->ldap->isResource($this->ldapConnectionRes) ?
- $this->ldap->errno($this->ldapConnectionRes) : -1;
- }
- if($bindStatus === true) {
- return $bindStatus;
- }
- } catch (ServerNotAvailableException $e) {
- if(!$isBackupHost) {
- throw $e;
+ if (!$forceBackupHost) {
+ try {
+ $host = $this->configuration->ldapHost ?? '';
+ $port = $this->configuration->ldapPort ?? '';
+ if ($useBackgroundHost) {
+ $host = $this->configuration->ldapBackgroundHost ?? '';
+ $port = $this->configuration->ldapBackgroundPort ?? '';
+ }
+ $this->doConnect($host, $port);
+ return $this->bind();
+ } catch (ServerNotAvailableException $e) {
+ if (!$hasBackupHost) {
+ throw $e;
+ }
}
+ $this->logger->warning(
+ 'Main LDAP not reachable, connecting to backup: {msg}',
+ [
+ 'app' => 'user_ldap',
+ 'msg' => $e->getMessage(),
+ 'exception' => $e,
+ ]
+ );
}
- //if LDAP server is not reachable, try the Backup (Replica!) Server
- if($isBackupHost && ($error !== 0 || $isOverrideMainServer)) {
- $this->doConnect($this->configuration->ldapBackupHost,
- $this->configuration->ldapBackupPort);
- $bindStatus = $this->bind();
- $error = $this->ldap->isResource($this->ldapConnectionRes) ?
- $this->ldap->errno($this->ldapConnectionRes) : -1;
- if($bindStatus && $error === 0 && !$this->getFromCache('overrideMainServer')) {
- //when bind to backup server succeeded and failed to main server,
- //skip contacting him until next cache refresh
- $this->writeToCache('overrideMainServer', true);
- }
+ // if LDAP server is not reachable, try the Backup (Replica!) Server
+ $this->doConnect($this->configuration->ldapBackupHost ?? '', $this->configuration->ldapBackupPort ?? '');
+ $this->bindResult = [];
+ $bindStatus = $this->bind();
+ $error = $this->ldap->isResource($this->ldapConnectionRes)
+ ? $this->ldap->errno($this->ldapConnectionRes) : -1;
+ if ($bindStatus && $error === 0 && !$forceBackupHost) {
+ //when bind to backup server succeeded and failed to main server,
+ //skip contacting it for 15min
+ $this->writeToCache($overrideCacheKey, true, 60 * 15);
}
return $bindStatus;
@@ -578,26 +677,47 @@ class Connection extends LDAPUtility {
/**
* @param string $host
* @param string $port
- * @return bool
* @throws \OC\ServerNotAvailableException
*/
- private function doConnect($host, $port) {
+ private function doConnect($host, $port): bool {
if ($host === '') {
return false;
}
- $this->ldapConnectionRes = $this->ldap->connect($host, $port);
+ $this->ldapConnectionRes = $this->ldap->connect($host, $port) ?: null;
+
+ if ($this->ldapConnectionRes === null) {
+ throw new ServerNotAvailableException('Connection failed');
+ }
- if(!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_PROTOCOL_VERSION, 3)) {
+ if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_PROTOCOL_VERSION, 3)) {
throw new ServerNotAvailableException('Could not set required LDAP Protocol version.');
}
- if(!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_REFERRALS, 0)) {
+ if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_REFERRALS, 0)) {
throw new ServerNotAvailableException('Could not disable LDAP referrals.');
}
- if($this->configuration->ldapTLS) {
- if(!$this->ldap->startTls($this->ldapConnectionRes)) {
+ if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_NETWORK_TIMEOUT, $this->configuration->ldapConnectionTimeout)) {
+ throw new ServerNotAvailableException('Could not set network timeout');
+ }
+
+ if ($this->configuration->ldapTLS) {
+ if ($this->configuration->turnOffCertCheck) {
+ if ($this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER)) {
+ $this->logger->debug(
+ 'Turned off SSL certificate validation successfully.',
+ ['app' => 'user_ldap']
+ );
+ } else {
+ $this->logger->warning(
+ 'Could not turn off SSL certificate validation.',
+ ['app' => 'user_ldap']
+ );
+ }
+ }
+
+ if (!$this->ldap->startTls($this->ldapConnectionRes)) {
throw new ServerNotAvailableException('Start TLS failed, when connecting to LDAP host ' . $host . '.');
}
}
@@ -609,25 +729,47 @@ class Connection extends LDAPUtility {
* Binds to LDAP
*/
public function bind() {
- if(!$this->configuration->ldapConfigurationActive) {
+ if (!$this->configuration->ldapConfigurationActive) {
return false;
}
- $cr = $this->getConnectionResource();
- if(!$this->ldap->isResource($cr)) {
- return false;
+ $cr = $this->ldapConnectionRes;
+ if (!$this->ldap->isResource($cr)) {
+ $cr = $this->getConnectionResource();
+ }
+
+ if (
+ count($this->bindResult) !== 0
+ && $this->bindResult['sum'] === md5($this->configuration->ldapAgentName . $this->configPrefix . $this->configuration->ldapAgentPassword)
+ ) {
+ // don't attempt to bind again with the same data as before
+ // bind might have been invoked via getConnectionResource(),
+ // but we need results specifically for e.g. user login
+ return $this->bindResult['result'];
}
+
$ldapLogin = @$this->ldap->bind($cr,
- $this->configuration->ldapAgentName,
- $this->configuration->ldapAgentPassword);
- if(!$ldapLogin) {
+ $this->configuration->ldapAgentName,
+ $this->configuration->ldapAgentPassword);
+
+ $this->bindResult = [
+ 'sum' => md5($this->configuration->ldapAgentName . $this->configPrefix . $this->configuration->ldapAgentPassword),
+ 'result' => $ldapLogin,
+ ];
+
+ if (!$ldapLogin) {
$errno = $this->ldap->errno($cr);
- \OCP\Util::writeLog('user_ldap',
+ $this->logger->warning(
'Bind failed: ' . $errno . ': ' . $this->ldap->error($cr),
- \OCP\Util::WARN);
-
- // Set to failure mode, if LDAP error code is not LDAP_SUCCESS or LDAP_INVALID_CREDENTIALS
- if($errno !== 0x00 && $errno !== 0x31) {
+ ['app' => 'user_ldap']
+ );
+
+ // Set to failure mode, if LDAP error code is not one of
+ // - LDAP_SUCCESS (0)
+ // - LDAP_INVALID_CREDENTIALS (49)
+ // - LDAP_INSUFFICIENT_ACCESS (50, spotted Apple Open Directory)
+ // - LDAP_UNWILLING_TO_PERFORM (53, spotted eDirectory)
+ if (!in_array($errno, [0, 49, 50, 53], true)) {
$this->ldapConnectionRes = null;
}
@@ -635,5 +777,4 @@ class Connection extends LDAPUtility {
}
return true;
}
-
}
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-16 02:59:49 +0000