nextcloud / server

apps/user_ldap/ajax/wizard.php

Indentation +85 added lines, -85 removed lines

@@ -37,13 +37,13 @@ 
 $l = \OC::$server->getL10N('user_ldap');
 
 if (!isset($_POST['action'])) {
-	\OC_JSON::error(['message' => $l->t('No action specified')]);
+    \OC_JSON::error(['message' => $l->t('No action specified')]);
 }
 $action = (string)$_POST['action'];
 
 
 if (!isset($_POST['ldap_serverconfig_chooser'])) {
-	\OC_JSON::error(['message' => $l->t('No configuration specified')]);
+    \OC_JSON::error(['message' => $l->t('No configuration specified')]);
 }
 $prefix = (string)$_POST['ldap_serverconfig_chooser'];
 
@@ -56,97 +56,97 @@ 
 $con->setIgnoreValidation(true);
 
 $userManager = new \OCA\User_LDAP\User\Manager(
-	\OC::$server->getConfig(),
-	new \OCA\User_LDAP\FilesystemHelper(),
-	new \OCA\User_LDAP\LogWrapper(),
-	\OC::$server->getAvatarManager(),
-	new \OCP\Image(),
-	\OC::$server->getUserManager(),
-	\OC::$server->getNotificationManager(),
-	\OC::$server->get(\OCP\Share\IManager::class)
+    \OC::$server->getConfig(),
+    new \OCA\User_LDAP\FilesystemHelper(),
+    new \OCA\User_LDAP\LogWrapper(),
+    \OC::$server->getAvatarManager(),
+    new \OCP\Image(),
+    \OC::$server->getUserManager(),
+    \OC::$server->getNotificationManager(),
+    \OC::$server->get(\OCP\Share\IManager::class)
 );
 
 $access = new \OCA\User_LDAP\Access(
-	$con,
-	$ldapWrapper,
-	$userManager,
-	new \OCA\User_LDAP\Helper(\OC::$server->getConfig(), \OC::$server->getDatabaseConnection()),
-	\OC::$server->getConfig(),
-	\OC::$server->getUserManager()
+    $con,
+    $ldapWrapper,
+    $userManager,
+    new \OCA\User_LDAP\Helper(\OC::$server->getConfig(), \OC::$server->getDatabaseConnection()),
+    \OC::$server->getConfig(),
+    \OC::$server->getUserManager()
 );
 
 $wizard = new \OCA\User_LDAP\Wizard($configuration, $ldapWrapper, $access);
 
 switch ($action) {
-	case 'guessPortAndTLS':
-	case 'guessBaseDN':
-	case 'detectEmailAttribute':
-	case 'detectUserDisplayNameAttribute':
-	case 'determineGroupMemberAssoc':
-	case 'determineUserObjectClasses':
-	case 'determineGroupObjectClasses':
-	case 'determineGroupsForUsers':
-	case 'determineGroupsForGroups':
-	case 'determineAttributes':
-	case 'getUserListFilter':
-	case 'getUserLoginFilter':
-	case 'getGroupFilter':
-	case 'countUsers':
-	case 'countGroups':
-	case 'countInBaseDN':
-		try {
-			$result = $wizard->$action();
-			if ($result !== false) {
-				\OC_JSON::success($result->getResultArray());
-				exit;
-			}
-		} catch (\Exception $e) {
-			\OC_JSON::error(['message' => $e->getMessage(), 'code' => $e->getCode()]);
-			exit;
-		}
-		\OC_JSON::error();
-		exit;
-		break;
+    case 'guessPortAndTLS':
+    case 'guessBaseDN':
+    case 'detectEmailAttribute':
+    case 'detectUserDisplayNameAttribute':
+    case 'determineGroupMemberAssoc':
+    case 'determineUserObjectClasses':
+    case 'determineGroupObjectClasses':
+    case 'determineGroupsForUsers':
+    case 'determineGroupsForGroups':
+    case 'determineAttributes':
+    case 'getUserListFilter':
+    case 'getUserLoginFilter':
+    case 'getGroupFilter':
+    case 'countUsers':
+    case 'countGroups':
+    case 'countInBaseDN':
+        try {
+            $result = $wizard->$action();
+            if ($result !== false) {
+                \OC_JSON::success($result->getResultArray());
+                exit;
+            }
+        } catch (\Exception $e) {
+            \OC_JSON::error(['message' => $e->getMessage(), 'code' => $e->getCode()]);
+            exit;
+        }
+        \OC_JSON::error();
+        exit;
+        break;
 
-	case 'testLoginName': {
-		try {
-			$loginName = $_POST['ldap_test_loginname'];
-			$result = $wizard->$action($loginName);
-			if ($result !== false) {
-				\OC_JSON::success($result->getResultArray());
-				exit;
-			}
-		} catch (\Exception $e) {
-			\OC_JSON::error(['message' => $e->getMessage()]);
-			exit;
-		}
-		\OC_JSON::error();
-		exit;
-		break;
-	}
+    case 'testLoginName': {
+        try {
+            $loginName = $_POST['ldap_test_loginname'];
+            $result = $wizard->$action($loginName);
+            if ($result !== false) {
+                \OC_JSON::success($result->getResultArray());
+                exit;
+            }
+        } catch (\Exception $e) {
+            \OC_JSON::error(['message' => $e->getMessage()]);
+            exit;
+        }
+        \OC_JSON::error();
+        exit;
+        break;
+    }
 
-	case 'save':
-		$key = isset($_POST['cfgkey']) ? $_POST['cfgkey'] : false;
-		$val = isset($_POST['cfgval']) ? $_POST['cfgval'] : null;
-		if ($key === false || is_null($val)) {
-			\OC_JSON::error(['message' => $l->t('No data specified')]);
-			exit;
-		}
-		$cfg = [$key => $val];
-		$setParameters = [];
-		$configuration->setConfiguration($cfg, $setParameters);
-		if (!in_array($key, $setParameters)) {
-			\OC_JSON::error(['message' => $l->t($key.
-				' Could not set configuration %s', $setParameters[0])]);
-			exit;
-		}
-		$configuration->saveConfiguration();
-		//clear the cache on save
-		$connection = new \OCA\User_LDAP\Connection($ldapWrapper, $prefix);
-		$connection->clearCache();
-		\OC_JSON::success();
-		break;
-	default:
-		\OC_JSON::error(['message' => $l->t('Action does not exist')]);
-		break;
+    case 'save':
+        $key = isset($_POST['cfgkey']) ? $_POST['cfgkey'] : false;
+        $val = isset($_POST['cfgval']) ? $_POST['cfgval'] : null;
+        if ($key === false || is_null($val)) {
+            \OC_JSON::error(['message' => $l->t('No data specified')]);
+            exit;
+        }
+        $cfg = [$key => $val];
+        $setParameters = [];
+        $configuration->setConfiguration($cfg, $setParameters);
+        if (!in_array($key, $setParameters)) {
+            \OC_JSON::error(['message' => $l->t($key.
+                ' Could not set configuration %s', $setParameters[0])]);
+            exit;
+        }
+        $configuration->saveConfiguration();
+        //clear the cache on save
+        $connection = new \OCA\User_LDAP\Connection($ldapWrapper, $prefix);
+        $connection->clearCache();
+        \OC_JSON::success();
+        break;
+    default:
+        \OC_JSON::error(['message' => $l->t('Action does not exist')]);
+        break;
 }

apps/user_ldap/ajax/deleteConfiguration.php

Indentation +3 added lines, -3 removed lines

@@ -34,8 +34,8 @@
 $prefix = (string)$_POST['ldap_serverconfig_chooser'];
 $helper = new \OCA\User_LDAP\Helper(\OC::$server->getConfig(), \OC::$server->getDatabaseConnection());
 if ($helper->deleteServerConfiguration($prefix)) {
-	\OC_JSON::success();
+    \OC_JSON::success();
 } else {
-	$l = \OC::$server->getL10N('user_ldap');
-	\OC_JSON::error(['message' => $l->t('Failed to delete the server configuration')]);
+    $l = \OC::$server->getL10N('user_ldap');
+    \OC_JSON::error(['message' => $l->t('Failed to delete the server configuration')]);
 }

Spacing +1 added lines, -1 removed lines

@@ -31,7 +31,7 @@
 \OC_JSON::checkAppEnabled('user_ldap');
 \OC_JSON::callCheck();
 
-$prefix = (string)$_POST['ldap_serverconfig_chooser'];
+$prefix = (string) $_POST['ldap_serverconfig_chooser'];
 $helper = new \OCA\User_LDAP\Helper(\OC::$server->getConfig(), \OC::$server->getDatabaseConnection());
 if ($helper->deleteServerConfiguration($prefix)) {
 	\OC_JSON::success();

apps/user_ldap/appinfo/install.php

Indentation +1 added lines, -1 removed lines

@@ -26,7 +26,7 @@
 $config = \OC::$server->getConfig();
 $state = $config->getSystemValue('ldapIgnoreNamingRules', 'doSet');
 if ($state === 'doSet') {
-	\OC::$server->getConfig()->setSystemValue('ldapIgnoreNamingRules', false);
+    \OC::$server->getConfig()->setSystemValue('ldapIgnoreNamingRules', false);
 }
 
 $helper = new \OCA\User_LDAP\Helper($config, \OC::$server->getDatabaseConnection());

apps/user_ldap/lib/Settings/Admin.php

Indentation +56 added lines, -56 removed lines

@@ -34,69 +34,69 @@
 use OCP\Template;
 
 class Admin implements ISettings {
-	/** @var IL10N */
-	private $l;
+    /** @var IL10N */
+    private $l;
 
-	/**
-	 * @param IL10N $l
-	 */
-	public function __construct(IL10N $l) {
-		$this->l = $l;
-	}
+    /**
+     * @param IL10N $l
+     */
+    public function __construct(IL10N $l) {
+        $this->l = $l;
+    }
 
-	/**
-	 * @return TemplateResponse
-	 */
-	public function getForm() {
-		$helper = new Helper(\OC::$server->getConfig(), \OC::$server->getDatabaseConnection());
-		$prefixes = $helper->getServerConfigurationPrefixes();
-		if (count($prefixes) === 0) {
-			$newPrefix = $helper->getNextServerConfigurationPrefix();
-			$config = new Configuration($newPrefix, false);
-			$config->setConfiguration($config->getDefaults());
-			$config->saveConfiguration();
-			$prefixes[] = $newPrefix;
-		}
+    /**
+     * @return TemplateResponse
+     */
+    public function getForm() {
+        $helper = new Helper(\OC::$server->getConfig(), \OC::$server->getDatabaseConnection());
+        $prefixes = $helper->getServerConfigurationPrefixes();
+        if (count($prefixes) === 0) {
+            $newPrefix = $helper->getNextServerConfigurationPrefix();
+            $config = new Configuration($newPrefix, false);
+            $config->setConfiguration($config->getDefaults());
+            $config->saveConfiguration();
+            $prefixes[] = $newPrefix;
+        }
 
-		$hosts = $helper->getServerConfigurationHosts();
+        $hosts = $helper->getServerConfigurationHosts();
 
-		$wControls = new Template('user_ldap', 'part.wizardcontrols');
-		$wControls = $wControls->fetchPage();
-		$sControls = new Template('user_ldap', 'part.settingcontrols');
-		$sControls = $sControls->fetchPage();
+        $wControls = new Template('user_ldap', 'part.wizardcontrols');
+        $wControls = $wControls->fetchPage();
+        $sControls = new Template('user_ldap', 'part.settingcontrols');
+        $sControls = $sControls->fetchPage();
 
-		$parameters['serverConfigurationPrefixes'] = $prefixes;
-		$parameters['serverConfigurationHosts'] = $hosts;
-		$parameters['settingControls'] = $sControls;
-		$parameters['wizardControls'] = $wControls;
+        $parameters['serverConfigurationPrefixes'] = $prefixes;
+        $parameters['serverConfigurationHosts'] = $hosts;
+        $parameters['settingControls'] = $sControls;
+        $parameters['wizardControls'] = $wControls;
 
-		// assign default values
-		if (!isset($config)) {
-			$config = new Configuration('', false);
-		}
-		$defaults = $config->getDefaults();
-		foreach ($defaults as $key => $default) {
-			$parameters[$key.'_default'] = $default;
-		}
+        // assign default values
+        if (!isset($config)) {
+            $config = new Configuration('', false);
+        }
+        $defaults = $config->getDefaults();
+        foreach ($defaults as $key => $default) {
+            $parameters[$key.'_default'] = $default;
+        }
 
-		return new TemplateResponse('user_ldap', 'settings', $parameters);
-	}
+        return new TemplateResponse('user_ldap', 'settings', $parameters);
+    }
 
-	/**
-	 * @return string the section ID, e.g. 'sharing'
-	 */
-	public function getSection() {
-		return 'ldap';
-	}
+    /**
+     * @return string the section ID, e.g. 'sharing'
+     */
+    public function getSection() {
+        return 'ldap';
+    }
 
-	/**
-	 * @return int whether the form should be rather on the top or bottom of
-	 * the admin section. The forms are arranged in ascending order of the
-	 * priority values. It is required to return a value between 0 and 100.
-	 *
-	 * E.g.: 70
-	 */
-	public function getPriority() {
-		return 5;
-	}
+    /**
+     * @return int whether the form should be rather on the top or bottom of
+     * the admin section. The forms are arranged in ascending order of the
+     * priority values. It is required to return a value between 0 and 100.
+     *
+     * E.g.: 70
+     */
+    public function getPriority() {
+        return 5;
+    }
 }

apps/user_ldap/lib/Connection.php

Indentation +611 added lines, -611 removed lines

@@ -75,615 +75,615 @@
  * @property string ldapMatchingRuleInChainState
  */
 class Connection extends LDAPUtility {
-	private $ldapConnectionRes = null;
-	private $configPrefix;
-	private $configID;
-	private $configured = false;
-	//whether connection should be kept on __destruct
-	private $dontDestruct = false;
-
-	/**
-	 * @var bool runtime flag that indicates whether supported primary groups are available
-	 */
-	public $hasPrimaryGroups = true;
-
-	/**
-	 * @var bool runtime flag that indicates whether supported POSIX gidNumber are available
-	 */
-	public $hasGidNumber = true;
-
-	//cache handler
-	protected $cache;
-
-	/** @var Configuration settings handler **/
-	protected $configuration;
-
-	protected $doNotValidate = false;
-
-	protected $ignoreValidation = false;
-
-	protected $bindResult = [];
-
-	/**
-	 * Constructor
-	 * @param ILDAPWrapper $ldap
-	 * @param string $configPrefix a string with the prefix for the configkey column (appconfig table)
-	 * @param string|null $configID a string with the value for the appid column (appconfig table) or null for on-the-fly connections
-	 */
-	public function __construct(ILDAPWrapper $ldap, $configPrefix = '', $configID = 'user_ldap') {
-		parent::__construct($ldap);
-		$this->configPrefix = $configPrefix;
-		$this->configID = $configID;
-		$this->configuration = new Configuration($configPrefix,
-												 !is_null($configID));
-		$memcache = \OC::$server->getMemCacheFactory();
-		if ($memcache->isAvailable()) {
-			$this->cache = $memcache->createDistributed();
-		}
-		$helper = new Helper(\OC::$server->getConfig(), \OC::$server->getDatabaseConnection());
-		$this->doNotValidate = !in_array($this->configPrefix,
-			$helper->getServerConfigurationPrefixes());
-	}
-
-	public function __destruct() {
-		if (!$this->dontDestruct && $this->ldap->isResource($this->ldapConnectionRes)) {
-			@$this->ldap->unbind($this->ldapConnectionRes);
-			$this->bindResult = [];
-		}
-	}
-
-	/**
-	 * defines behaviour when the instance is cloned
-	 */
-	public function __clone() {
-		$this->configuration = new Configuration($this->configPrefix,
-												 !is_null($this->configID));
-		if (count($this->bindResult) !== 0 && $this->bindResult['result'] === true) {
-			$this->bindResult = [];
-		}
-		$this->ldapConnectionRes = null;
-		$this->dontDestruct = true;
-	}
-
-	public function __get(string $name) {
-		if (!$this->configured) {
-			$this->readConfiguration();
-		}
-
-		return $this->configuration->$name;
-	}
-
-	/**
-	 * @param string $name
-	 * @param mixed $value
-	 */
-	public function __set($name, $value) {
-		$this->doNotValidate = false;
-		$before = $this->configuration->$name;
-		$this->configuration->$name = $value;
-		$after = $this->configuration->$name;
-		if ($before !== $after) {
-			if ($this->configID !== '' && $this->configID !== null) {
-				$this->configuration->saveConfiguration();
-			}
-			$this->validateConfiguration();
-		}
-	}
-
-	/**
-	 * @param string $rule
-	 * @return array
-	 * @throws \RuntimeException
-	 */
-	public function resolveRule($rule) {
-		return $this->configuration->resolveRule($rule);
-	}
-
-	/**
-	 * sets whether the result of the configuration validation shall
-	 * be ignored when establishing the connection. Used by the Wizard
-	 * in early configuration state.
-	 * @param bool $state
-	 */
-	public function setIgnoreValidation($state) {
-		$this->ignoreValidation = (bool)$state;
-	}
-
-	/**
-	 * initializes the LDAP backend
-	 * @param bool $force read the config settings no matter what
-	 */
-	public function init($force = false) {
-		$this->readConfiguration($force);
-		$this->establishConnection();
-	}
-
-	/**
-	 * Returns the LDAP handler
-	 */
-	public function getConnectionResource() {
-		if (!$this->ldapConnectionRes) {
-			$this->init();
-		} elseif (!$this->ldap->isResource($this->ldapConnectionRes)) {
-			$this->ldapConnectionRes = null;
-			$this->establishConnection();
-		}
-		if (is_null($this->ldapConnectionRes)) {
-			\OCP\Util::writeLog('user_ldap', 'No LDAP Connection to server ' . $this->configuration->ldapHost, ILogger::ERROR);
-			throw new ServerNotAvailableException('Connection to LDAP server could not be established');
-		}
-		return $this->ldapConnectionRes;
-	}
-
-	/**
-	 * resets the connection resource
-	 */
-	public function resetConnectionResource() {
-		if (!is_null($this->ldapConnectionRes)) {
-			@$this->ldap->unbind($this->ldapConnectionRes);
-			$this->ldapConnectionRes = null;
-			$this->bindResult = [];
-		}
-	}
-
-	/**
-	 * @param string|null $key
-	 * @return string
-	 */
-	private function getCacheKey($key) {
-		$prefix = 'LDAP-'.$this->configID.'-'.$this->configPrefix.'-';
-		if (is_null($key)) {
-			return $prefix;
-		}
-		return $prefix.hash('sha256', $key);
-	}
-
-	/**
-	 * @param string $key
-	 * @return mixed|null
-	 */
-	public function getFromCache($key) {
-		if (!$this->configured) {
-			$this->readConfiguration();
-		}
-		if (is_null($this->cache) || !$this->configuration->ldapCacheTTL) {
-			return null;
-		}
-		$key = $this->getCacheKey($key);
-
-		return json_decode(base64_decode($this->cache->get($key)), true);
-	}
-
-	/**
-	 * @param string $key
-	 * @param mixed $value
-	 *
-	 * @return string
-	 */
-	public function writeToCache($key, $value) {
-		if (!$this->configured) {
-			$this->readConfiguration();
-		}
-		if (is_null($this->cache)
-			|| !$this->configuration->ldapCacheTTL
-			|| !$this->configuration->ldapConfigurationActive) {
-			return null;
-		}
-		$key = $this->getCacheKey($key);
-		$value = base64_encode(json_encode($value));
-		$this->cache->set($key, $value, $this->configuration->ldapCacheTTL);
-	}
-
-	public function clearCache() {
-		if (!is_null($this->cache)) {
-			$this->cache->clear($this->getCacheKey(null));
-		}
-	}
-
-	/**
-	 * Caches the general LDAP configuration.
-	 * @param bool $force optional. true, if the re-read should be forced. defaults
-	 * to false.
-	 * @return null
-	 */
-	private function readConfiguration($force = false) {
-		if ((!$this->configured || $force) && !is_null($this->configID)) {
-			$this->configuration->readConfiguration();
-			$this->configured = $this->validateConfiguration();
-		}
-	}
-
-	/**
-	 * set LDAP configuration with values delivered by an array, not read from configuration
-	 * @param array $config array that holds the config parameters in an associated array
-	 * @param array &$setParameters optional; array where the set fields will be given to
-	 * @return boolean true if config validates, false otherwise. Check with $setParameters for detailed success on single parameters
-	 */
-	public function setConfiguration($config, &$setParameters = null) {
-		if (is_null($setParameters)) {
-			$setParameters = [];
-		}
-		$this->doNotValidate = false;
-		$this->configuration->setConfiguration($config, $setParameters);
-		if (count($setParameters) > 0) {
-			$this->configured = $this->validateConfiguration();
-		}
-
-
-		return $this->configured;
-	}
-
-	/**
-	 * saves the current Configuration in the database and empties the
-	 * cache
-	 * @return null
-	 */
-	public function saveConfiguration() {
-		$this->configuration->saveConfiguration();
-		$this->clearCache();
-	}
-
-	/**
-	 * get the current LDAP configuration
-	 * @return array
-	 */
-	public function getConfiguration() {
-		$this->readConfiguration();
-		$config = $this->configuration->getConfiguration();
-		$cta = $this->configuration->getConfigTranslationArray();
-		$result = [];
-		foreach ($cta as $dbkey => $configkey) {
-			switch ($configkey) {
-				case 'homeFolderNamingRule':
-					if (strpos($config[$configkey], 'attr:') === 0) {
-						$result[$dbkey] = substr($config[$configkey], 5);
-					} else {
-						$result[$dbkey] = '';
-					}
-					break;
-				case 'ldapBase':
-				case 'ldapBaseUsers':
-				case 'ldapBaseGroups':
-				case 'ldapAttributesForUserSearch':
-				case 'ldapAttributesForGroupSearch':
-					if (is_array($config[$configkey])) {
-						$result[$dbkey] = implode("\n", $config[$configkey]);
-						break;
-					} //else follows default
-					// no break
-				default:
-					$result[$dbkey] = $config[$configkey];
-			}
-		}
-		return $result;
-	}
-
-	private function doSoftValidation() {
-		//if User or Group Base are not set, take over Base DN setting
-		foreach (['ldapBaseUsers', 'ldapBaseGroups'] as $keyBase) {
-			$val = $this->configuration->$keyBase;
-			if (empty($val)) {
-				$this->configuration->$keyBase = $this->configuration->ldapBase;
-			}
-		}
-
-		foreach (['ldapExpertUUIDUserAttr' => 'ldapUuidUserAttribute',
-			'ldapExpertUUIDGroupAttr' => 'ldapUuidGroupAttribute']
-				as $expertSetting => $effectiveSetting) {
-			$uuidOverride = $this->configuration->$expertSetting;
-			if (!empty($uuidOverride)) {
-				$this->configuration->$effectiveSetting = $uuidOverride;
-			} else {
-				$uuidAttributes = Access::UUID_ATTRIBUTES;
-				array_unshift($uuidAttributes, 'auto');
-				if (!in_array($this->configuration->$effectiveSetting,
-							$uuidAttributes)
-					&& (!is_null($this->configID))) {
-					$this->configuration->$effectiveSetting = 'auto';
-					$this->configuration->saveConfiguration();
-					\OCP\Util::writeLog('user_ldap',
-										'Illegal value for the '.
-										$effectiveSetting.', '.'reset to '.
-										'autodetect.', ILogger::INFO);
-				}
-			}
-		}
-
-		$backupPort = (int)$this->configuration->ldapBackupPort;
-		if ($backupPort <= 0) {
-			$this->configuration->backupPort = $this->configuration->ldapPort;
-		}
-
-		//make sure empty search attributes are saved as simple, empty array
-		$saKeys = ['ldapAttributesForUserSearch',
-			'ldapAttributesForGroupSearch'];
-		foreach ($saKeys as $key) {
-			$val = $this->configuration->$key;
-			if (is_array($val) && count($val) === 1 && empty($val[0])) {
-				$this->configuration->$key = [];
-			}
-		}
-
-		if ((stripos($this->configuration->ldapHost, 'ldaps://') === 0)
-			&& $this->configuration->ldapTLS) {
-			$this->configuration->ldapTLS = false;
-			\OCP\Util::writeLog(
-				'user_ldap',
-				'LDAPS (already using secure connection) and TLS do not work together. Switched off TLS.',
-				ILogger::INFO
-			);
-		}
-	}
-
-	/**
-	 * @return bool
-	 */
-	private function doCriticalValidation() {
-		$configurationOK = true;
-		$errorStr = 'Configuration Error (prefix '.
-			(string)$this->configPrefix .'): ';
-
-		//options that shall not be empty
-		$options = ['ldapHost', 'ldapPort', 'ldapUserDisplayName',
-			'ldapGroupDisplayName', 'ldapLoginFilter'];
-		foreach ($options as $key) {
-			$val = $this->configuration->$key;
-			if (empty($val)) {
-				switch ($key) {
-					case 'ldapHost':
-						$subj = 'LDAP Host';
-						break;
-					case 'ldapPort':
-						$subj = 'LDAP Port';
-						break;
-					case 'ldapUserDisplayName':
-						$subj = 'LDAP User Display Name';
-						break;
-					case 'ldapGroupDisplayName':
-						$subj = 'LDAP Group Display Name';
-						break;
-					case 'ldapLoginFilter':
-						$subj = 'LDAP Login Filter';
-						break;
-					default:
-						$subj = $key;
-						break;
-				}
-				$configurationOK = false;
-				\OCP\Util::writeLog(
-					'user_ldap',
-					$errorStr.'No '.$subj.' given!',
-					ILogger::WARN
-				);
-			}
-		}
-
-		//combinations
-		$agent = $this->configuration->ldapAgentName;
-		$pwd = $this->configuration->ldapAgentPassword;
-		if (
-			($agent === '' && $pwd !== '')
-			|| ($agent !== '' && $pwd === '')
-		) {
-			\OCP\Util::writeLog(
-				'user_ldap',
-				$errorStr.'either no password is given for the user ' .
-					'agent or a password is given, but not an LDAP agent.',
-				ILogger::WARN);
-			$configurationOK = false;
-		}
-
-		$base = $this->configuration->ldapBase;
-		$baseUsers = $this->configuration->ldapBaseUsers;
-		$baseGroups = $this->configuration->ldapBaseGroups;
-
-		if (empty($base) && empty($baseUsers) && empty($baseGroups)) {
-			\OCP\Util::writeLog(
-				'user_ldap',
-				$errorStr.'Not a single Base DN given.',
-				ILogger::WARN
-			);
-			$configurationOK = false;
-		}
-
-		if (mb_strpos($this->configuration->ldapLoginFilter, '%uid', 0, 'UTF-8')
-		   === false) {
-			\OCP\Util::writeLog(
-				'user_ldap',
-				$errorStr.'login filter does not contain %uid place holder.',
-				ILogger::WARN
-			);
-			$configurationOK = false;
-		}
-
-		return $configurationOK;
-	}
-
-	/**
-	 * Validates the user specified configuration
-	 * @return bool true if configuration seems OK, false otherwise
-	 */
-	private function validateConfiguration() {
-		if ($this->doNotValidate) {
-			//don't do a validation if it is a new configuration with pure
-			//default values. Will be allowed on changes via __set or
-			//setConfiguration
-			return false;
-		}
-
-		// first step: "soft" checks: settings that are not really
-		// necessary, but advisable. If left empty, give an info message
-		$this->doSoftValidation();
-
-		//second step: critical checks. If left empty or filled wrong, mark as
-		//not configured and give a warning.
-		return $this->doCriticalValidation();
-	}
-
-
-	/**
-	 * Connects and Binds to LDAP
-	 *
-	 * @throws ServerNotAvailableException
-	 */
-	private function establishConnection() {
-		if (!$this->configuration->ldapConfigurationActive) {
-			return null;
-		}
-		static $phpLDAPinstalled = true;
-		if (!$phpLDAPinstalled) {
-			return false;
-		}
-		if (!$this->ignoreValidation && !$this->configured) {
-			\OCP\Util::writeLog(
-				'user_ldap',
-				'Configuration is invalid, cannot connect',
-				ILogger::WARN
-			);
-			return false;
-		}
-		if (!$this->ldapConnectionRes) {
-			if (!$this->ldap->areLDAPFunctionsAvailable()) {
-				$phpLDAPinstalled = false;
-				\OCP\Util::writeLog(
-					'user_ldap',
-					'function ldap_connect is not available. Make sure that the PHP ldap module is installed.',
-					ILogger::ERROR
-				);
-
-				return false;
-			}
-			if ($this->configuration->turnOffCertCheck) {
-				if (putenv('LDAPTLS_REQCERT=never')) {
-					\OCP\Util::writeLog('user_ldap',
-						'Turned off SSL certificate validation successfully.',
-						ILogger::DEBUG);
-				} else {
-					\OCP\Util::writeLog(
-						'user_ldap',
-						'Could not turn off SSL certificate validation.',
-						ILogger::WARN
-					);
-				}
-			}
-
-			$isOverrideMainServer = ($this->configuration->ldapOverrideMainServer
-				|| $this->getFromCache('overrideMainServer'));
-			$isBackupHost = (trim($this->configuration->ldapBackupHost) !== "");
-			$bindStatus = false;
-			try {
-				if (!$isOverrideMainServer) {
-					$this->doConnect($this->configuration->ldapHost,
-						$this->configuration->ldapPort);
-					return $this->bind();
-				}
-			} catch (ServerNotAvailableException $e) {
-				if (!$isBackupHost) {
-					throw $e;
-				}
-			}
-
-			//if LDAP server is not reachable, try the Backup (Replica!) Server
-			if ($isBackupHost || $isOverrideMainServer) {
-				$this->doConnect($this->configuration->ldapBackupHost,
-								 $this->configuration->ldapBackupPort);
-				$this->bindResult = [];
-				$bindStatus = $this->bind();
-				$error = $this->ldap->isResource($this->ldapConnectionRes) ?
-					$this->ldap->errno($this->ldapConnectionRes) : -1;
-				if ($bindStatus && $error === 0 && !$this->getFromCache('overrideMainServer')) {
-					//when bind to backup server succeeded and failed to main server,
-					//skip contacting him until next cache refresh
-					$this->writeToCache('overrideMainServer', true);
-				}
-			}
-
-			return $bindStatus;
-		}
-		return null;
-	}
-
-	/**
-	 * @param string $host
-	 * @param string $port
-	 * @return bool
-	 * @throws \OC\ServerNotAvailableException
-	 */
-	private function doConnect($host, $port) {
-		if ($host === '') {
-			return false;
-		}
-
-		$this->ldapConnectionRes = $this->ldap->connect($host, $port);
-
-		if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_PROTOCOL_VERSION, 3)) {
-			throw new ServerNotAvailableException('Could not set required LDAP Protocol version.');
-		}
-
-		if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_REFERRALS, 0)) {
-			throw new ServerNotAvailableException('Could not disable LDAP referrals.');
-		}
-
-		if ($this->configuration->ldapTLS) {
-			if (!$this->ldap->startTls($this->ldapConnectionRes)) {
-				throw new ServerNotAvailableException('Start TLS failed, when connecting to LDAP host ' . $host . '.');
-			}
-		}
-
-		return true;
-	}
-
-	/**
-	 * Binds to LDAP
-	 */
-	public function bind() {
-		if (!$this->configuration->ldapConfigurationActive) {
-			return false;
-		}
-		$cr = $this->ldapConnectionRes;
-		if (!$this->ldap->isResource($cr)) {
-			$cr = $this->getConnectionResource();
-		}
-
-		if (
-			count($this->bindResult) !== 0
-			&& $this->bindResult['dn'] === $this->configuration->ldapAgentName
-			&& \OC::$server->getHasher()->verify(
-				$this->configPrefix . $this->configuration->ldapAgentPassword,
-				$this->bindResult['hash']
-			)
-		) {
-			// don't attempt to bind again with the same data as before
-			// bind might have been invoked via getConnectionResource(),
-			// but we need results specifically for e.g. user login
-			return $this->bindResult['result'];
-		}
-
-		$ldapLogin = @$this->ldap->bind($cr,
-										$this->configuration->ldapAgentName,
-										$this->configuration->ldapAgentPassword);
-
-		$this->bindResult = [
-			'dn' => $this->configuration->ldapAgentName,
-			'hash' => \OC::$server->getHasher()->hash($this->configPrefix . $this->configuration->ldapAgentPassword),
-			'result' => $ldapLogin,
-		];
-
-		if (!$ldapLogin) {
-			$errno = $this->ldap->errno($cr);
-
-			\OCP\Util::writeLog('user_ldap',
-				'Bind failed: ' . $errno . ': ' . $this->ldap->error($cr),
-				ILogger::WARN);
-
-			// Set to failure mode, if LDAP error code is not LDAP_SUCCESS or LDAP_INVALID_CREDENTIALS
-			// or (needed for Apple Open Directory:) LDAP_INSUFFICIENT_ACCESS
-			if ($errno !== 0 && $errno !== 49 && $errno !== 50) {
-				$this->ldapConnectionRes = null;
-			}
-
-			return false;
-		}
-		return true;
-	}
+    private $ldapConnectionRes = null;
+    private $configPrefix;
+    private $configID;
+    private $configured = false;
+    //whether connection should be kept on __destruct
+    private $dontDestruct = false;
+
+    /**
+     * @var bool runtime flag that indicates whether supported primary groups are available
+     */
+    public $hasPrimaryGroups = true;
+
+    /**
+     * @var bool runtime flag that indicates whether supported POSIX gidNumber are available
+     */
+    public $hasGidNumber = true;
+
+    //cache handler
+    protected $cache;
+
+    /** @var Configuration settings handler **/
+    protected $configuration;
+
+    protected $doNotValidate = false;
+
+    protected $ignoreValidation = false;
+
+    protected $bindResult = [];
+
+    /**
+     * Constructor
+     * @param ILDAPWrapper $ldap
+     * @param string $configPrefix a string with the prefix for the configkey column (appconfig table)
+     * @param string|null $configID a string with the value for the appid column (appconfig table) or null for on-the-fly connections
+     */
+    public function __construct(ILDAPWrapper $ldap, $configPrefix = '', $configID = 'user_ldap') {
+        parent::__construct($ldap);
+        $this->configPrefix = $configPrefix;
+        $this->configID = $configID;
+        $this->configuration = new Configuration($configPrefix,
+                                                    !is_null($configID));
+        $memcache = \OC::$server->getMemCacheFactory();
+        if ($memcache->isAvailable()) {
+            $this->cache = $memcache->createDistributed();
+        }
+        $helper = new Helper(\OC::$server->getConfig(), \OC::$server->getDatabaseConnection());
+        $this->doNotValidate = !in_array($this->configPrefix,
+            $helper->getServerConfigurationPrefixes());
+    }
+
+    public function __destruct() {
+        if (!$this->dontDestruct && $this->ldap->isResource($this->ldapConnectionRes)) {
+            @$this->ldap->unbind($this->ldapConnectionRes);
+            $this->bindResult = [];
+        }
+    }
+
+    /**
+     * defines behaviour when the instance is cloned
+     */
+    public function __clone() {
+        $this->configuration = new Configuration($this->configPrefix,
+                                                    !is_null($this->configID));
+        if (count($this->bindResult) !== 0 && $this->bindResult['result'] === true) {
+            $this->bindResult = [];
+        }
+        $this->ldapConnectionRes = null;
+        $this->dontDestruct = true;
+    }
+
+    public function __get(string $name) {
+        if (!$this->configured) {
+            $this->readConfiguration();
+        }
+
+        return $this->configuration->$name;
+    }
+
+    /**
+     * @param string $name
+     * @param mixed $value
+     */
+    public function __set($name, $value) {
+        $this->doNotValidate = false;
+        $before = $this->configuration->$name;
+        $this->configuration->$name = $value;
+        $after = $this->configuration->$name;
+        if ($before !== $after) {
+            if ($this->configID !== '' && $this->configID !== null) {
+                $this->configuration->saveConfiguration();
+            }
+            $this->validateConfiguration();
+        }
+    }
+
+    /**
+     * @param string $rule
+     * @return array
+     * @throws \RuntimeException
+     */
+    public function resolveRule($rule) {
+        return $this->configuration->resolveRule($rule);
+    }
+
+    /**
+     * sets whether the result of the configuration validation shall
+     * be ignored when establishing the connection. Used by the Wizard
+     * in early configuration state.
+     * @param bool $state
+     */
+    public function setIgnoreValidation($state) {
+        $this->ignoreValidation = (bool)$state;
+    }
+
+    /**
+     * initializes the LDAP backend
+     * @param bool $force read the config settings no matter what
+     */
+    public function init($force = false) {
+        $this->readConfiguration($force);
+        $this->establishConnection();
+    }
+
+    /**
+     * Returns the LDAP handler
+     */
+    public function getConnectionResource() {
+        if (!$this->ldapConnectionRes) {
+            $this->init();
+        } elseif (!$this->ldap->isResource($this->ldapConnectionRes)) {
+            $this->ldapConnectionRes = null;
+            $this->establishConnection();
+        }
+        if (is_null($this->ldapConnectionRes)) {
+            \OCP\Util::writeLog('user_ldap', 'No LDAP Connection to server ' . $this->configuration->ldapHost, ILogger::ERROR);
+            throw new ServerNotAvailableException('Connection to LDAP server could not be established');
+        }
+        return $this->ldapConnectionRes;
+    }
+
+    /**
+     * resets the connection resource
+     */
+    public function resetConnectionResource() {
+        if (!is_null($this->ldapConnectionRes)) {
+            @$this->ldap->unbind($this->ldapConnectionRes);
+            $this->ldapConnectionRes = null;
+            $this->bindResult = [];
+        }
+    }
+
+    /**
+     * @param string|null $key
+     * @return string
+     */
+    private function getCacheKey($key) {
+        $prefix = 'LDAP-'.$this->configID.'-'.$this->configPrefix.'-';
+        if (is_null($key)) {
+            return $prefix;
+        }
+        return $prefix.hash('sha256', $key);
+    }
+
+    /**
+     * @param string $key
+     * @return mixed|null
+     */
+    public function getFromCache($key) {
+        if (!$this->configured) {
+            $this->readConfiguration();
+        }
+        if (is_null($this->cache) || !$this->configuration->ldapCacheTTL) {
+            return null;
+        }
+        $key = $this->getCacheKey($key);
+
+        return json_decode(base64_decode($this->cache->get($key)), true);
+    }
+
+    /**
+     * @param string $key
+     * @param mixed $value
+     *
+     * @return string
+     */
+    public function writeToCache($key, $value) {
+        if (!$this->configured) {
+            $this->readConfiguration();
+        }
+        if (is_null($this->cache)
+            || !$this->configuration->ldapCacheTTL
+            || !$this->configuration->ldapConfigurationActive) {
+            return null;
+        }
+        $key = $this->getCacheKey($key);
+        $value = base64_encode(json_encode($value));
+        $this->cache->set($key, $value, $this->configuration->ldapCacheTTL);
+    }
+
+    public function clearCache() {
+        if (!is_null($this->cache)) {
+            $this->cache->clear($this->getCacheKey(null));
+        }
+    }
+
+    /**
+     * Caches the general LDAP configuration.
+     * @param bool $force optional. true, if the re-read should be forced. defaults
+     * to false.
+     * @return null
+     */
+    private function readConfiguration($force = false) {
+        if ((!$this->configured || $force) && !is_null($this->configID)) {
+            $this->configuration->readConfiguration();
+            $this->configured = $this->validateConfiguration();
+        }
+    }
+
+    /**
+     * set LDAP configuration with values delivered by an array, not read from configuration
+     * @param array $config array that holds the config parameters in an associated array
+     * @param array &$setParameters optional; array where the set fields will be given to
+     * @return boolean true if config validates, false otherwise. Check with $setParameters for detailed success on single parameters
+     */
+    public function setConfiguration($config, &$setParameters = null) {
+        if (is_null($setParameters)) {
+            $setParameters = [];
+        }
+        $this->doNotValidate = false;
+        $this->configuration->setConfiguration($config, $setParameters);
+        if (count($setParameters) > 0) {
+            $this->configured = $this->validateConfiguration();
+        }
+
+
+        return $this->configured;
+    }
+
+    /**
+     * saves the current Configuration in the database and empties the
+     * cache
+     * @return null
+     */
+    public function saveConfiguration() {
+        $this->configuration->saveConfiguration();
+        $this->clearCache();
+    }
+
+    /**
+     * get the current LDAP configuration
+     * @return array
+     */
+    public function getConfiguration() {
+        $this->readConfiguration();
+        $config = $this->configuration->getConfiguration();
+        $cta = $this->configuration->getConfigTranslationArray();
+        $result = [];
+        foreach ($cta as $dbkey => $configkey) {
+            switch ($configkey) {
+                case 'homeFolderNamingRule':
+                    if (strpos($config[$configkey], 'attr:') === 0) {
+                        $result[$dbkey] = substr($config[$configkey], 5);
+                    } else {
+                        $result[$dbkey] = '';
+                    }
+                    break;
+                case 'ldapBase':
+                case 'ldapBaseUsers':
+                case 'ldapBaseGroups':
+                case 'ldapAttributesForUserSearch':
+                case 'ldapAttributesForGroupSearch':
+                    if (is_array($config[$configkey])) {
+                        $result[$dbkey] = implode("\n", $config[$configkey]);
+                        break;
+                    } //else follows default
+                    // no break
+                default:
+                    $result[$dbkey] = $config[$configkey];
+            }
+        }
+        return $result;
+    }
+
+    private function doSoftValidation() {
+        //if User or Group Base are not set, take over Base DN setting
+        foreach (['ldapBaseUsers', 'ldapBaseGroups'] as $keyBase) {
+            $val = $this->configuration->$keyBase;
+            if (empty($val)) {
+                $this->configuration->$keyBase = $this->configuration->ldapBase;
+            }
+        }
+
+        foreach (['ldapExpertUUIDUserAttr' => 'ldapUuidUserAttribute',
+            'ldapExpertUUIDGroupAttr' => 'ldapUuidGroupAttribute']
+                as $expertSetting => $effectiveSetting) {
+            $uuidOverride = $this->configuration->$expertSetting;
+            if (!empty($uuidOverride)) {
+                $this->configuration->$effectiveSetting = $uuidOverride;
+            } else {
+                $uuidAttributes = Access::UUID_ATTRIBUTES;
+                array_unshift($uuidAttributes, 'auto');
+                if (!in_array($this->configuration->$effectiveSetting,
+                            $uuidAttributes)
+                    && (!is_null($this->configID))) {
+                    $this->configuration->$effectiveSetting = 'auto';
+                    $this->configuration->saveConfiguration();
+                    \OCP\Util::writeLog('user_ldap',
+                                        'Illegal value for the '.
+                                        $effectiveSetting.', '.'reset to '.
+                                        'autodetect.', ILogger::INFO);
+                }
+            }
+        }
+
+        $backupPort = (int)$this->configuration->ldapBackupPort;
+        if ($backupPort <= 0) {
+            $this->configuration->backupPort = $this->configuration->ldapPort;
+        }
+
+        //make sure empty search attributes are saved as simple, empty array
+        $saKeys = ['ldapAttributesForUserSearch',
+            'ldapAttributesForGroupSearch'];
+        foreach ($saKeys as $key) {
+            $val = $this->configuration->$key;
+            if (is_array($val) && count($val) === 1 && empty($val[0])) {
+                $this->configuration->$key = [];
+            }
+        }
+
+        if ((stripos($this->configuration->ldapHost, 'ldaps://') === 0)
+            && $this->configuration->ldapTLS) {
+            $this->configuration->ldapTLS = false;
+            \OCP\Util::writeLog(
+                'user_ldap',
+                'LDAPS (already using secure connection) and TLS do not work together. Switched off TLS.',
+                ILogger::INFO
+            );
+        }
+    }
+
+    /**
+     * @return bool
+     */
+    private function doCriticalValidation() {
+        $configurationOK = true;
+        $errorStr = 'Configuration Error (prefix '.
+            (string)$this->configPrefix .'): ';
+
+        //options that shall not be empty
+        $options = ['ldapHost', 'ldapPort', 'ldapUserDisplayName',
+            'ldapGroupDisplayName', 'ldapLoginFilter'];
+        foreach ($options as $key) {
+            $val = $this->configuration->$key;
+            if (empty($val)) {
+                switch ($key) {
+                    case 'ldapHost':
+                        $subj = 'LDAP Host';
+                        break;
+                    case 'ldapPort':
+                        $subj = 'LDAP Port';
+                        break;
+                    case 'ldapUserDisplayName':
+                        $subj = 'LDAP User Display Name';
+                        break;
+                    case 'ldapGroupDisplayName':
+                        $subj = 'LDAP Group Display Name';
+                        break;
+                    case 'ldapLoginFilter':
+                        $subj = 'LDAP Login Filter';
+                        break;
+                    default:
+                        $subj = $key;
+                        break;
+                }
+                $configurationOK = false;
+                \OCP\Util::writeLog(
+                    'user_ldap',
+                    $errorStr.'No '.$subj.' given!',
+                    ILogger::WARN
+                );
+            }
+        }
+
+        //combinations
+        $agent = $this->configuration->ldapAgentName;
+        $pwd = $this->configuration->ldapAgentPassword;
+        if (
+            ($agent === '' && $pwd !== '')
+            || ($agent !== '' && $pwd === '')
+        ) {
+            \OCP\Util::writeLog(
+                'user_ldap',
+                $errorStr.'either no password is given for the user ' .
+                    'agent or a password is given, but not an LDAP agent.',
+                ILogger::WARN);
+            $configurationOK = false;
+        }
+
+        $base = $this->configuration->ldapBase;
+        $baseUsers = $this->configuration->ldapBaseUsers;
+        $baseGroups = $this->configuration->ldapBaseGroups;
+
+        if (empty($base) && empty($baseUsers) && empty($baseGroups)) {
+            \OCP\Util::writeLog(
+                'user_ldap',
+                $errorStr.'Not a single Base DN given.',
+                ILogger::WARN
+            );
+            $configurationOK = false;
+        }
+
+        if (mb_strpos($this->configuration->ldapLoginFilter, '%uid', 0, 'UTF-8')
+            === false) {
+            \OCP\Util::writeLog(
+                'user_ldap',
+                $errorStr.'login filter does not contain %uid place holder.',
+                ILogger::WARN
+            );
+            $configurationOK = false;
+        }
+
+        return $configurationOK;
+    }
+
+    /**
+     * Validates the user specified configuration
+     * @return bool true if configuration seems OK, false otherwise
+     */
+    private function validateConfiguration() {
+        if ($this->doNotValidate) {
+            //don't do a validation if it is a new configuration with pure
+            //default values. Will be allowed on changes via __set or
+            //setConfiguration
+            return false;
+        }
+
+        // first step: "soft" checks: settings that are not really
+        // necessary, but advisable. If left empty, give an info message
+        $this->doSoftValidation();
+
+        //second step: critical checks. If left empty or filled wrong, mark as
+        //not configured and give a warning.
+        return $this->doCriticalValidation();
+    }
+
+
+    /**
+     * Connects and Binds to LDAP
+     *
+     * @throws ServerNotAvailableException
+     */
+    private function establishConnection() {
+        if (!$this->configuration->ldapConfigurationActive) {
+            return null;
+        }
+        static $phpLDAPinstalled = true;
+        if (!$phpLDAPinstalled) {
+            return false;
+        }
+        if (!$this->ignoreValidation && !$this->configured) {
+            \OCP\Util::writeLog(
+                'user_ldap',
+                'Configuration is invalid, cannot connect',
+                ILogger::WARN
+            );
+            return false;
+        }
+        if (!$this->ldapConnectionRes) {
+            if (!$this->ldap->areLDAPFunctionsAvailable()) {
+                $phpLDAPinstalled = false;
+                \OCP\Util::writeLog(
+                    'user_ldap',
+                    'function ldap_connect is not available. Make sure that the PHP ldap module is installed.',
+                    ILogger::ERROR
+                );
+
+                return false;
+            }
+            if ($this->configuration->turnOffCertCheck) {
+                if (putenv('LDAPTLS_REQCERT=never')) {
+                    \OCP\Util::writeLog('user_ldap',
+                        'Turned off SSL certificate validation successfully.',
+                        ILogger::DEBUG);
+                } else {
+                    \OCP\Util::writeLog(
+                        'user_ldap',
+                        'Could not turn off SSL certificate validation.',
+                        ILogger::WARN
+                    );
+                }
+            }
+
+            $isOverrideMainServer = ($this->configuration->ldapOverrideMainServer
+                || $this->getFromCache('overrideMainServer'));
+            $isBackupHost = (trim($this->configuration->ldapBackupHost) !== "");
+            $bindStatus = false;
+            try {
+                if (!$isOverrideMainServer) {
+                    $this->doConnect($this->configuration->ldapHost,
+                        $this->configuration->ldapPort);
+                    return $this->bind();
+                }
+            } catch (ServerNotAvailableException $e) {
+                if (!$isBackupHost) {
+                    throw $e;
+                }
+            }
+
+            //if LDAP server is not reachable, try the Backup (Replica!) Server
+            if ($isBackupHost || $isOverrideMainServer) {
+                $this->doConnect($this->configuration->ldapBackupHost,
+                                    $this->configuration->ldapBackupPort);
+                $this->bindResult = [];
+                $bindStatus = $this->bind();
+                $error = $this->ldap->isResource($this->ldapConnectionRes) ?
+                    $this->ldap->errno($this->ldapConnectionRes) : -1;
+                if ($bindStatus && $error === 0 && !$this->getFromCache('overrideMainServer')) {
+                    //when bind to backup server succeeded and failed to main server,
+                    //skip contacting him until next cache refresh
+                    $this->writeToCache('overrideMainServer', true);
+                }
+            }
+
+            return $bindStatus;
+        }
+        return null;
+    }
+
+    /**
+     * @param string $host
+     * @param string $port
+     * @return bool
+     * @throws \OC\ServerNotAvailableException
+     */
+    private function doConnect($host, $port) {
+        if ($host === '') {
+            return false;
+        }
+
+        $this->ldapConnectionRes = $this->ldap->connect($host, $port);
+
+        if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_PROTOCOL_VERSION, 3)) {
+            throw new ServerNotAvailableException('Could not set required LDAP Protocol version.');
+        }
+
+        if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_REFERRALS, 0)) {
+            throw new ServerNotAvailableException('Could not disable LDAP referrals.');
+        }
+
+        if ($this->configuration->ldapTLS) {
+            if (!$this->ldap->startTls($this->ldapConnectionRes)) {
+                throw new ServerNotAvailableException('Start TLS failed, when connecting to LDAP host ' . $host . '.');
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * Binds to LDAP
+     */
+    public function bind() {
+        if (!$this->configuration->ldapConfigurationActive) {
+            return false;
+        }
+        $cr = $this->ldapConnectionRes;
+        if (!$this->ldap->isResource($cr)) {
+            $cr = $this->getConnectionResource();
+        }
+
+        if (
+            count($this->bindResult) !== 0
+            && $this->bindResult['dn'] === $this->configuration->ldapAgentName
+            && \OC::$server->getHasher()->verify(
+                $this->configPrefix . $this->configuration->ldapAgentPassword,
+                $this->bindResult['hash']
+            )
+        ) {
+            // don't attempt to bind again with the same data as before
+            // bind might have been invoked via getConnectionResource(),
+            // but we need results specifically for e.g. user login
+            return $this->bindResult['result'];
+        }
+
+        $ldapLogin = @$this->ldap->bind($cr,
+                                        $this->configuration->ldapAgentName,
+                                        $this->configuration->ldapAgentPassword);
+
+        $this->bindResult = [
+            'dn' => $this->configuration->ldapAgentName,
+            'hash' => \OC::$server->getHasher()->hash($this->configPrefix . $this->configuration->ldapAgentPassword),
+            'result' => $ldapLogin,
+        ];
+
+        if (!$ldapLogin) {
+            $errno = $this->ldap->errno($cr);
+
+            \OCP\Util::writeLog('user_ldap',
+                'Bind failed: ' . $errno . ': ' . $this->ldap->error($cr),
+                ILogger::WARN);
+
+            // Set to failure mode, if LDAP error code is not LDAP_SUCCESS or LDAP_INVALID_CREDENTIALS
+            // or (needed for Apple Open Directory:) LDAP_INSUFFICIENT_ACCESS
+            if ($errno !== 0 && $errno !== 49 && $errno !== 50) {
+                $this->ldapConnectionRes = null;
+            }
+
+            return false;
+        }
+        return true;
+    }
 }

apps/user_ldap/lib/Jobs/UpdateGroups.php

Indentation +196 added lines, -196 removed lines

@@ -46,200 +46,200 @@
 use Psr\Log\LoggerInterface;
 
 class UpdateGroups extends TimedJob {
-	private $groupsFromDB;
-
-	/** @var Group_Proxy */
-	private $groupBackend;
-	/** @var IEventDispatcher */
-	private $dispatcher;
-	/** @var IGroupManager */
-	private $groupManager;
-	/** @var IUserManager */
-	private $userManager;
-	/** @var LoggerInterface */
-	private $logger;
-	/** @var IDBConnection */
-	private $dbc;
-
-	public function __construct(
-		Group_Proxy $groupBackend,
-		IEventDispatcher $dispatcher,
-		IGroupManager $groupManager,
-		IUserManager $userManager,
-		LoggerInterface $logger,
-		IDBConnection $dbc
-	) {
-		$this->interval = $this->getRefreshInterval();
-		$this->groupBackend = $groupBackend;
-		$this->dispatcher = $dispatcher;
-		$this->groupManager = $groupManager;
-		$this->userManager = $userManager;
-		$this->logger = $logger;
-		$this->dbc = $dbc;
-	}
-
-	/**
-	 * @return int
-	 */
-	private function getRefreshInterval() {
-		//defaults to every hour
-		return \OC::$server->getConfig()->getAppValue('user_ldap', 'bgjRefreshInterval', 3600);
-	}
-
-	/**
-	 * @param mixed $argument
-	 */
-	public function run($argument) {
-		$this->updateGroups();
-	}
-
-	public function updateGroups() {
-		\OCP\Util::writeLog('user_ldap', 'Run background job "updateGroups"', ILogger::DEBUG);
-
-		$knownGroups = array_keys($this->getKnownGroups());
-		$actualGroups = $this->groupBackend->getGroups();
-
-		if (empty($actualGroups) && empty($knownGroups)) {
-			\OCP\Util::writeLog('user_ldap',
-				'bgJ "updateGroups" – groups do not seem to be configured properly, aborting.',
-				ILogger::INFO);
-			return;
-		}
-
-		$this->handleKnownGroups(array_intersect($actualGroups, $knownGroups));
-		$this->handleCreatedGroups(array_diff($actualGroups, $knownGroups));
-		$this->handleRemovedGroups(array_diff($knownGroups, $actualGroups));
-
-		\OCP\Util::writeLog('user_ldap', 'bgJ "updateGroups" – Finished.', ILogger::DEBUG);
-	}
-
-	/**
-	 * @return array
-	 */
-	private function getKnownGroups() {
-		if (is_array($this->groupsFromDB)) {
-			$this->groupsFromDB;
-		}
-		$qb = $this->dbc->getQueryBuilder();
-		$qb->select(['owncloudname', 'owncloudusers'])
-			->from('ldap_group_members');
-		$result = $qb->execute()->fetchAll();
-
-		$this->groupsFromDB = [];
-		foreach ($result as $dataset) {
-			$this->groupsFromDB[$dataset['owncloudname']] = $dataset;
-		}
-
-		return $this->groupsFromDB;
-	}
-
-	private function handleKnownGroups(array $groups) {
-		$this->logger->debug(
-			'bgJ "updateGroups" – Dealing with known Groups.',
-			['app' => 'user_ldap']
-		);
-		$qb = $this->dbc->getQueryBuilder();
-		$qb->update('ldap_group_members')
-			->set('owncloudusers', $qb->createParameter('members'))
-			->where($qb->expr()->eq('owncloudname', $qb->createParameter('groupId')));
-
-		if (!is_array($this->groupsFromDB)) {
-			$this->getKnownGroups();
-		}
-		foreach ($groups as $group) {
-			$knownUsers = unserialize($this->groupsFromDB[$group]['owncloudusers']);
-			$actualUsers = $this->groupBackend->usersInGroup($group);
-			$hasChanged = false;
-
-			$groupObject = $this->groupManager->get($group);
-			foreach (array_diff($knownUsers, $actualUsers) as $removedUser) {
-				$userObject = $this->userManager->get($removedUser);
-				if ($userObject instanceof IUser) {
-					$this->dispatcher->dispatchTyped(new UserRemovedEvent($groupObject, $userObject));
-				}
-				$this->logger->info(
-					'bgJ "updateGroups" – {user} removed from {group}',
-					[
-						'app' => 'user_ldap',
-						'user' => $removedUser,
-						'group' => $group
-					]
-				);
-				$hasChanged = true;
-			}
-			foreach (array_diff($actualUsers, $knownUsers) as $addedUser) {
-				$userObject = $this->userManager->get($addedUser);
-				if ($userObject instanceof IUser) {
-					$this->dispatcher->dispatchTyped(new UserAddedEvent($groupObject, $userObject));
-				}
-				$this->logger->info(
-					'bgJ "updateGroups" – {user} added to {group}',
-					[
-						'app' => 'user_ldap',
-						'user' => $addedUser,
-						'group' => $group
-					]
-				);
-				$hasChanged = true;
-			}
-			if ($hasChanged) {
-				$qb->setParameters([
-					'members' => serialize($actualUsers),
-					'groupId' => $group
-				]);
-				$qb->execute();
-			}
-		}
-		$this->logger->debug(
-			'bgJ "updateGroups" – FINISHED dealing with known Groups.',
-			['app' => 'user_ldap']
-		);
-	}
-
-	/**
-	 * @param string[] $createdGroups
-	 */
-	private function handleCreatedGroups($createdGroups) {
-		\OCP\Util::writeLog('user_ldap', 'bgJ "updateGroups" – dealing with created Groups.', ILogger::DEBUG);
-
-		$query = $this->dbc->getQueryBuilder();
-		$query->insert('ldap_group_members')
-			->setValue('owncloudname', $query->createParameter('owncloudname'))
-			->setValue('owncloudusers', $query->createParameter('owncloudusers'));
-		foreach ($createdGroups as $createdGroup) {
-			\OCP\Util::writeLog('user_ldap',
-				'bgJ "updateGroups" – new group "' . $createdGroup . '" found.',
-				ILogger::INFO);
-			$users = serialize($this->groupBackend->usersInGroup($createdGroup));
-
-			$query->setParameter('owncloudname', $createdGroup)
-				->setParameter('owncloudusers', $users);
-			$query->execute();
-		}
-		\OCP\Util::writeLog('user_ldap',
-			'bgJ "updateGroups" – FINISHED dealing with created Groups.',
-			ILogger::DEBUG);
-	}
-
-	/**
-	 * @param string[] $removedGroups
-	 */
-	private function handleRemovedGroups($removedGroups) {
-		\OCP\Util::writeLog('user_ldap', 'bgJ "updateGroups" – dealing with removed groups.', ILogger::DEBUG);
-
-		$query = $this->dbc->getQueryBuilder();
-		$query->delete('ldap_group_members')
-			->where($query->expr()->eq('owncloudname', $query->createParameter('owncloudname')));
-
-		foreach ($removedGroups as $removedGroup) {
-			\OCP\Util::writeLog('user_ldap',
-				'bgJ "updateGroups" – group "' . $removedGroup . '" was removed.',
-				ILogger::INFO);
-			$query->setParameter('owncloudname', $removedGroup);
-			$query->execute();
-		}
-		\OCP\Util::writeLog('user_ldap',
-			'bgJ "updateGroups" – FINISHED dealing with removed groups.',
-			ILogger::DEBUG);
-	}
+    private $groupsFromDB;
+
+    /** @var Group_Proxy */
+    private $groupBackend;
+    /** @var IEventDispatcher */
+    private $dispatcher;
+    /** @var IGroupManager */
+    private $groupManager;
+    /** @var IUserManager */
+    private $userManager;
+    /** @var LoggerInterface */
+    private $logger;
+    /** @var IDBConnection */
+    private $dbc;
+
+    public function __construct(
+        Group_Proxy $groupBackend,
+        IEventDispatcher $dispatcher,
+        IGroupManager $groupManager,
+        IUserManager $userManager,
+        LoggerInterface $logger,
+        IDBConnection $dbc
+    ) {
+        $this->interval = $this->getRefreshInterval();
+        $this->groupBackend = $groupBackend;
+        $this->dispatcher = $dispatcher;
+        $this->groupManager = $groupManager;
+        $this->userManager = $userManager;
+        $this->logger = $logger;
+        $this->dbc = $dbc;
+    }
+
+    /**
+     * @return int
+     */
+    private function getRefreshInterval() {
+        //defaults to every hour
+        return \OC::$server->getConfig()->getAppValue('user_ldap', 'bgjRefreshInterval', 3600);
+    }
+
+    /**
+     * @param mixed $argument
+     */
+    public function run($argument) {
+        $this->updateGroups();
+    }
+
+    public function updateGroups() {
+        \OCP\Util::writeLog('user_ldap', 'Run background job "updateGroups"', ILogger::DEBUG);
+
+        $knownGroups = array_keys($this->getKnownGroups());
+        $actualGroups = $this->groupBackend->getGroups();
+
+        if (empty($actualGroups) && empty($knownGroups)) {
+            \OCP\Util::writeLog('user_ldap',
+                'bgJ "updateGroups" – groups do not seem to be configured properly, aborting.',
+                ILogger::INFO);
+            return;
+        }
+
+        $this->handleKnownGroups(array_intersect($actualGroups, $knownGroups));
+        $this->handleCreatedGroups(array_diff($actualGroups, $knownGroups));
+        $this->handleRemovedGroups(array_diff($knownGroups, $actualGroups));
+
+        \OCP\Util::writeLog('user_ldap', 'bgJ "updateGroups" – Finished.', ILogger::DEBUG);
+    }
+
+    /**
+     * @return array
+     */
+    private function getKnownGroups() {
+        if (is_array($this->groupsFromDB)) {
+            $this->groupsFromDB;
+        }
+        $qb = $this->dbc->getQueryBuilder();
+        $qb->select(['owncloudname', 'owncloudusers'])
+            ->from('ldap_group_members');
+        $result = $qb->execute()->fetchAll();
+
+        $this->groupsFromDB = [];
+        foreach ($result as $dataset) {
+            $this->groupsFromDB[$dataset['owncloudname']] = $dataset;
+        }
+
+        return $this->groupsFromDB;
+    }
+
+    private function handleKnownGroups(array $groups) {
+        $this->logger->debug(
+            'bgJ "updateGroups" – Dealing with known Groups.',
+            ['app' => 'user_ldap']
+        );
+        $qb = $this->dbc->getQueryBuilder();
+        $qb->update('ldap_group_members')
+            ->set('owncloudusers', $qb->createParameter('members'))
+            ->where($qb->expr()->eq('owncloudname', $qb->createParameter('groupId')));
+
+        if (!is_array($this->groupsFromDB)) {
+            $this->getKnownGroups();
+        }
+        foreach ($groups as $group) {
+            $knownUsers = unserialize($this->groupsFromDB[$group]['owncloudusers']);
+            $actualUsers = $this->groupBackend->usersInGroup($group);
+            $hasChanged = false;
+
+            $groupObject = $this->groupManager->get($group);
+            foreach (array_diff($knownUsers, $actualUsers) as $removedUser) {
+                $userObject = $this->userManager->get($removedUser);
+                if ($userObject instanceof IUser) {
+                    $this->dispatcher->dispatchTyped(new UserRemovedEvent($groupObject, $userObject));
+                }
+                $this->logger->info(
+                    'bgJ "updateGroups" – {user} removed from {group}',
+                    [
+                        'app' => 'user_ldap',
+                        'user' => $removedUser,
+                        'group' => $group
+                    ]
+                );
+                $hasChanged = true;
+            }
+            foreach (array_diff($actualUsers, $knownUsers) as $addedUser) {
+                $userObject = $this->userManager->get($addedUser);
+                if ($userObject instanceof IUser) {
+                    $this->dispatcher->dispatchTyped(new UserAddedEvent($groupObject, $userObject));
+                }
+                $this->logger->info(
+                    'bgJ "updateGroups" – {user} added to {group}',
+                    [
+                        'app' => 'user_ldap',
+                        'user' => $addedUser,
+                        'group' => $group
+                    ]
+                );
+                $hasChanged = true;
+            }
+            if ($hasChanged) {
+                $qb->setParameters([
+                    'members' => serialize($actualUsers),
+                    'groupId' => $group
+                ]);
+                $qb->execute();
+            }
+        }
+        $this->logger->debug(
+            'bgJ "updateGroups" – FINISHED dealing with known Groups.',
+            ['app' => 'user_ldap']
+        );
+    }
+
+    /**
+     * @param string[] $createdGroups
+     */
+    private function handleCreatedGroups($createdGroups) {
+        \OCP\Util::writeLog('user_ldap', 'bgJ "updateGroups" – dealing with created Groups.', ILogger::DEBUG);
+
+        $query = $this->dbc->getQueryBuilder();
+        $query->insert('ldap_group_members')
+            ->setValue('owncloudname', $query->createParameter('owncloudname'))
+            ->setValue('owncloudusers', $query->createParameter('owncloudusers'));
+        foreach ($createdGroups as $createdGroup) {
+            \OCP\Util::writeLog('user_ldap',
+                'bgJ "updateGroups" – new group "' . $createdGroup . '" found.',
+                ILogger::INFO);
+            $users = serialize($this->groupBackend->usersInGroup($createdGroup));
+
+            $query->setParameter('owncloudname', $createdGroup)
+                ->setParameter('owncloudusers', $users);
+            $query->execute();
+        }
+        \OCP\Util::writeLog('user_ldap',
+            'bgJ "updateGroups" – FINISHED dealing with created Groups.',
+            ILogger::DEBUG);
+    }
+
+    /**
+     * @param string[] $removedGroups
+     */
+    private function handleRemovedGroups($removedGroups) {
+        \OCP\Util::writeLog('user_ldap', 'bgJ "updateGroups" – dealing with removed groups.', ILogger::DEBUG);
+
+        $query = $this->dbc->getQueryBuilder();
+        $query->delete('ldap_group_members')
+            ->where($query->expr()->eq('owncloudname', $query->createParameter('owncloudname')));
+
+        foreach ($removedGroups as $removedGroup) {
+            \OCP\Util::writeLog('user_ldap',
+                'bgJ "updateGroups" – group "' . $removedGroup . '" was removed.',
+                ILogger::INFO);
+            $query->setParameter('owncloudname', $removedGroup);
+            $query->execute();
+        }
+        \OCP\Util::writeLog('user_ldap',
+            'bgJ "updateGroups" – FINISHED dealing with removed groups.',
+            ILogger::DEBUG);
+    }
 }

Spacing +2 added lines, -2 removed lines

@@ -208,7 +208,7 @@ 
 			->setValue('owncloudusers', $query->createParameter('owncloudusers'));
 		foreach ($createdGroups as $createdGroup) {
 			\OCP\Util::writeLog('user_ldap',
-				'bgJ "updateGroups" – new group "' . $createdGroup . '" found.',
+				'bgJ "updateGroups" – new group "'.$createdGroup.'" found.',
 				ILogger::INFO);
 			$users = serialize($this->groupBackend->usersInGroup($createdGroup));
 
@@ -233,7 +233,7 @@ 
 
 		foreach ($removedGroups as $removedGroup) {
 			\OCP\Util::writeLog('user_ldap',
-				'bgJ "updateGroups" – group "' . $removedGroup . '" was removed.',
+				'bgJ "updateGroups" – group "'.$removedGroup.'" was removed.',
 				ILogger::INFO);
 			$query->setParameter('owncloudname', $removedGroup);
 			$query->execute();

apps/user_ldap/lib/Jobs/CleanUp.php

Indentation +183 added lines, -183 removed lines

@@ -43,187 +43,187 @@
  * @package OCA\User_LDAP\Jobs;
  */
 class CleanUp extends TimedJob {
-	/** @var int $limit amount of users that should be checked per run */
-	protected $limit;
-
-	/** @var int $defaultIntervalMin default interval in minutes */
-	protected $defaultIntervalMin = 51;
-
-	/** @var User_LDAP|User_Proxy $userBackend */
-	protected $userBackend;
-
-	/** @var \OCP\IConfig $ocConfig */
-	protected $ocConfig;
-
-	/** @var \OCP\IDBConnection $db */
-	protected $db;
-
-	/** @var Helper $ldapHelper */
-	protected $ldapHelper;
-
-	/** @var UserMapping */
-	protected $mapping;
-
-	/** @var DeletedUsersIndex */
-	protected $dui;
-
-	public function __construct(User_Proxy $userBackend, DeletedUsersIndex $dui) {
-		$minutes = \OC::$server->getConfig()->getSystemValue(
-			'ldapUserCleanupInterval', (string)$this->defaultIntervalMin);
-		$this->setInterval((int)$minutes * 60);
-		$this->userBackend = $userBackend;
-		$this->dui = $dui;
-	}
-
-	/**
-	 * assigns the instances passed to run() to the class properties
-	 * @param array $arguments
-	 */
-	public function setArguments($arguments) {
-		//Dependency Injection is not possible, because the constructor will
-		//only get values that are serialized to JSON. I.e. whatever we would
-		//pass in app.php we do add here, except something else is passed e.g.
-		//in tests.
-
-		if (isset($arguments['helper'])) {
-			$this->ldapHelper = $arguments['helper'];
-		} else {
-			$this->ldapHelper = new Helper(\OC::$server->getConfig(), \OC::$server->getDatabaseConnection());
-		}
-
-		if (isset($arguments['ocConfig'])) {
-			$this->ocConfig = $arguments['ocConfig'];
-		} else {
-			$this->ocConfig = \OC::$server->getConfig();
-		}
-
-		if (isset($arguments['userBackend'])) {
-			$this->userBackend = $arguments['userBackend'];
-		}
-
-		if (isset($arguments['db'])) {
-			$this->db = $arguments['db'];
-		} else {
-			$this->db = \OC::$server->getDatabaseConnection();
-		}
-
-		if (isset($arguments['mapping'])) {
-			$this->mapping = $arguments['mapping'];
-		} else {
-			$this->mapping = new UserMapping($this->db);
-		}
-
-		if (isset($arguments['deletedUsersIndex'])) {
-			$this->dui = $arguments['deletedUsersIndex'];
-		}
-	}
-
-	/**
-	 * makes the background job do its work
-	 * @param array $argument
-	 */
-	public function run($argument) {
-		$this->setArguments($argument);
-
-		if (!$this->isCleanUpAllowed()) {
-			return;
-		}
-		$users = $this->mapping->getList($this->getOffset(), $this->getChunkSize());
-		if (!is_array($users)) {
-			//something wrong? Let's start from the beginning next time and
-			//abort
-			$this->setOffset(true);
-			return;
-		}
-		$resetOffset = $this->isOffsetResetNecessary(count($users));
-		$this->checkUsers($users);
-		$this->setOffset($resetOffset);
-	}
-
-	/**
-	 * checks whether next run should start at 0 again
-	 * @param int $resultCount
-	 * @return bool
-	 */
-	public function isOffsetResetNecessary($resultCount) {
-		return $resultCount < $this->getChunkSize();
-	}
-
-	/**
-	 * checks whether cleaning up LDAP users is allowed
-	 * @return bool
-	 */
-	public function isCleanUpAllowed() {
-		try {
-			if ($this->ldapHelper->haveDisabledConfigurations()) {
-				return false;
-			}
-		} catch (\Exception $e) {
-			return false;
-		}
-
-		return $this->isCleanUpEnabled();
-	}
-
-	/**
-	 * checks whether clean up is enabled by configuration
-	 * @return bool
-	 */
-	private function isCleanUpEnabled() {
-		return (bool)$this->ocConfig->getSystemValue(
-			'ldapUserCleanupInterval', (string)$this->defaultIntervalMin);
-	}
-
-	/**
-	 * checks users whether they are still existing
-	 * @param array $users result from getMappedUsers()
-	 */
-	private function checkUsers(array $users) {
-		foreach ($users as $user) {
-			$this->checkUser($user);
-		}
-	}
-
-	/**
-	 * checks whether a user is still existing in LDAP
-	 * @param string[] $user
-	 */
-	private function checkUser(array $user) {
-		if ($this->userBackend->userExistsOnLDAP($user['name'])) {
-			//still available, all good
-
-			return;
-		}
-
-		$this->dui->markUser($user['name']);
-	}
-
-	/**
-	 * gets the offset to fetch users from the mappings table
-	 * @return int
-	 */
-	private function getOffset() {
-		return (int)$this->ocConfig->getAppValue('user_ldap', 'cleanUpJobOffset', 0);
-	}
-
-	/**
-	 * sets the new offset for the next run
-	 * @param bool $reset whether the offset should be set to 0
-	 */
-	public function setOffset($reset = false) {
-		$newOffset = $reset ? 0 :
-			$this->getOffset() + $this->getChunkSize();
-		$this->ocConfig->setAppValue('user_ldap', 'cleanUpJobOffset', $newOffset);
-	}
-
-	/**
-	 * returns the chunk size (limit in DB speak)
-	 * @return int
-	 */
-	public function getChunkSize() {
-		if ($this->limit === null) {
-			$this->limit = (int)$this->ocConfig->getAppValue('user_ldap', 'cleanUpJobChunkSize', 50);
-		}
-		return $this->limit;
-	}
+    /** @var int $limit amount of users that should be checked per run */
+    protected $limit;
+
+    /** @var int $defaultIntervalMin default interval in minutes */
+    protected $defaultIntervalMin = 51;
+
+    /** @var User_LDAP|User_Proxy $userBackend */
+    protected $userBackend;
+
+    /** @var \OCP\IConfig $ocConfig */
+    protected $ocConfig;
+
+    /** @var \OCP\IDBConnection $db */
+    protected $db;
+
+    /** @var Helper $ldapHelper */
+    protected $ldapHelper;
+
+    /** @var UserMapping */
+    protected $mapping;
+
+    /** @var DeletedUsersIndex */
+    protected $dui;
+
+    public function __construct(User_Proxy $userBackend, DeletedUsersIndex $dui) {
+        $minutes = \OC::$server->getConfig()->getSystemValue(
+            'ldapUserCleanupInterval', (string)$this->defaultIntervalMin);
+        $this->setInterval((int)$minutes * 60);
+        $this->userBackend = $userBackend;
+        $this->dui = $dui;
+    }
+
+    /**
+     * assigns the instances passed to run() to the class properties
+     * @param array $arguments
+     */
+    public function setArguments($arguments) {
+        //Dependency Injection is not possible, because the constructor will
+        //only get values that are serialized to JSON. I.e. whatever we would
+        //pass in app.php we do add here, except something else is passed e.g.
+        //in tests.
+
+        if (isset($arguments['helper'])) {
+            $this->ldapHelper = $arguments['helper'];
+        } else {
+            $this->ldapHelper = new Helper(\OC::$server->getConfig(), \OC::$server->getDatabaseConnection());
+        }
+
+        if (isset($arguments['ocConfig'])) {
+            $this->ocConfig = $arguments['ocConfig'];
+        } else {
+            $this->ocConfig = \OC::$server->getConfig();
+        }
+
+        if (isset($arguments['userBackend'])) {
+            $this->userBackend = $arguments['userBackend'];
+        }
+
+        if (isset($arguments['db'])) {
+            $this->db = $arguments['db'];
+        } else {
+            $this->db = \OC::$server->getDatabaseConnection();
+        }
+
+        if (isset($arguments['mapping'])) {
+            $this->mapping = $arguments['mapping'];
+        } else {
+            $this->mapping = new UserMapping($this->db);
+        }
+
+        if (isset($arguments['deletedUsersIndex'])) {
+            $this->dui = $arguments['deletedUsersIndex'];
+        }
+    }
+
+    /**
+     * makes the background job do its work
+     * @param array $argument
+     */
+    public function run($argument) {
+        $this->setArguments($argument);
+
+        if (!$this->isCleanUpAllowed()) {
+            return;
+        }
+        $users = $this->mapping->getList($this->getOffset(), $this->getChunkSize());
+        if (!is_array($users)) {
+            //something wrong? Let's start from the beginning next time and
+            //abort
+            $this->setOffset(true);
+            return;
+        }
+        $resetOffset = $this->isOffsetResetNecessary(count($users));
+        $this->checkUsers($users);
+        $this->setOffset($resetOffset);
+    }
+
+    /**
+     * checks whether next run should start at 0 again
+     * @param int $resultCount
+     * @return bool
+     */
+    public function isOffsetResetNecessary($resultCount) {
+        return $resultCount < $this->getChunkSize();
+    }
+
+    /**
+     * checks whether cleaning up LDAP users is allowed
+     * @return bool
+     */
+    public function isCleanUpAllowed() {
+        try {
+            if ($this->ldapHelper->haveDisabledConfigurations()) {
+                return false;
+            }
+        } catch (\Exception $e) {
+            return false;
+        }
+
+        return $this->isCleanUpEnabled();
+    }
+
+    /**
+     * checks whether clean up is enabled by configuration
+     * @return bool
+     */
+    private function isCleanUpEnabled() {
+        return (bool)$this->ocConfig->getSystemValue(
+            'ldapUserCleanupInterval', (string)$this->defaultIntervalMin);
+    }
+
+    /**
+     * checks users whether they are still existing
+     * @param array $users result from getMappedUsers()
+     */
+    private function checkUsers(array $users) {
+        foreach ($users as $user) {
+            $this->checkUser($user);
+        }
+    }
+
+    /**
+     * checks whether a user is still existing in LDAP
+     * @param string[] $user
+     */
+    private function checkUser(array $user) {
+        if ($this->userBackend->userExistsOnLDAP($user['name'])) {
+            //still available, all good
+
+            return;
+        }
+
+        $this->dui->markUser($user['name']);
+    }
+
+    /**
+     * gets the offset to fetch users from the mappings table
+     * @return int
+     */
+    private function getOffset() {
+        return (int)$this->ocConfig->getAppValue('user_ldap', 'cleanUpJobOffset', 0);
+    }
+
+    /**
+     * sets the new offset for the next run
+     * @param bool $reset whether the offset should be set to 0
+     */
+    public function setOffset($reset = false) {
+        $newOffset = $reset ? 0 :
+            $this->getOffset() + $this->getChunkSize();
+        $this->ocConfig->setAppValue('user_ldap', 'cleanUpJobOffset', $newOffset);
+    }
+
+    /**
+     * returns the chunk size (limit in DB speak)
+     * @return int
+     */
+    public function getChunkSize() {
+        if ($this->limit === null) {
+            $this->limit = (int)$this->ocConfig->getAppValue('user_ldap', 'cleanUpJobChunkSize', 50);
+        }
+        return $this->limit;
+    }
 }

apps/user_ldap/lib/Jobs/Sync.php

Indentation +329 added lines, -329 removed lines

@@ -40,333 +40,333 @@
 use OCP\Notification\IManager;
 
 class Sync extends TimedJob {
-	public const MAX_INTERVAL = 12 * 60 * 60; // 12h
-	public const MIN_INTERVAL = 30 * 60; // 30min
-	/** @var  Helper */
-	protected $ldapHelper;
-	/** @var  LDAP */
-	protected $ldap;
-	/** @var  Manager */
-	protected $userManager;
-	/** @var UserMapping */
-	protected $mapper;
-	/** @var  IConfig */
-	protected $config;
-	/** @var  IAvatarManager */
-	protected $avatarManager;
-	/** @var  IDBConnection */
-	protected $dbc;
-	/** @var  IUserManager */
-	protected $ncUserManager;
-	/** @var  IManager */
-	protected $notificationManager;
-	/** @var ConnectionFactory */
-	protected $connectionFactory;
-	/** @var AccessFactory */
-	protected $accessFactory;
-
-	public function __construct(Manager  $userManager) {
-		$this->userManager = $userManager;
-		$this->setInterval(
-			\OC::$server->getConfig()->getAppValue(
-				'user_ldap',
-				'background_sync_interval',
-				self::MIN_INTERVAL
-			)
-		);
-	}
-
-	/**
-	 * updates the interval
-	 *
-	 * the idea is to adjust the interval depending on the amount of known users
-	 * and the attempt to update each user one day. At most it would run every
-	 * 30 minutes, and at least every 12 hours.
-	 */
-	public function updateInterval() {
-		$minPagingSize = $this->getMinPagingSize();
-		$mappedUsers = $this->mapper->count();
-
-		$runsPerDay = ($minPagingSize === 0 || $mappedUsers === 0) ? self::MAX_INTERVAL
-			: $mappedUsers / $minPagingSize;
-		$interval = floor(24 * 60 * 60 / $runsPerDay);
-		$interval = min(max($interval, self::MIN_INTERVAL), self::MAX_INTERVAL);
-
-		$this->config->setAppValue('user_ldap', 'background_sync_interval', $interval);
-	}
-
-	/**
-	 * returns the smallest configured paging size
-	 * @return int
-	 */
-	protected function getMinPagingSize() {
-		$configKeys = $this->config->getAppKeys('user_ldap');
-		$configKeys = array_filter($configKeys, function ($key) {
-			return strpos($key, 'ldap_paging_size') !== false;
-		});
-		$minPagingSize = null;
-		foreach ($configKeys as $configKey) {
-			$pagingSize = $this->config->getAppValue('user_ldap', $configKey, $minPagingSize);
-			$minPagingSize = $minPagingSize === null ? $pagingSize : min($minPagingSize, $pagingSize);
-		}
-		return (int)$minPagingSize;
-	}
-
-	/**
-	 * @param array $argument
-	 */
-	public function run($argument) {
-		$this->setArgument($argument);
-
-		$isBackgroundJobModeAjax = $this->config
-				->getAppValue('core', 'backgroundjobs_mode', 'ajax') === 'ajax';
-		if ($isBackgroundJobModeAjax) {
-			return;
-		}
-
-		$cycleData = $this->getCycle();
-		if ($cycleData === null) {
-			$cycleData = $this->determineNextCycle();
-			if ($cycleData === null) {
-				$this->updateInterval();
-				return;
-			}
-		}
-
-		if (!$this->qualifiesToRun($cycleData)) {
-			$this->updateInterval();
-			return;
-		}
-
-		try {
-			$expectMoreResults = $this->runCycle($cycleData);
-			if ($expectMoreResults) {
-				$this->increaseOffset($cycleData);
-			} else {
-				$this->determineNextCycle($cycleData);
-			}
-			$this->updateInterval();
-		} catch (ServerNotAvailableException $e) {
-			$this->determineNextCycle($cycleData);
-		}
-	}
-
-	/**
-	 * @param array $cycleData
-	 * @return bool whether more results are expected from the same configuration
-	 */
-	public function runCycle($cycleData) {
-		$connection = $this->connectionFactory->get($cycleData['prefix']);
-		$access = $this->accessFactory->get($connection);
-		$access->setUserMapper($this->mapper);
-
-		$filter = $access->combineFilterWithAnd([
-			$access->connection->ldapUserFilter,
-			$access->connection->ldapUserDisplayName . '=*',
-			$access->getFilterPartForUserSearch('')
-		]);
-		$results = $access->fetchListOfUsers(
-			$filter,
-			$access->userManager->getAttributes(),
-			$connection->ldapPagingSize,
-			$cycleData['offset'],
-			true
-		);
-
-		if ((int)$connection->ldapPagingSize === 0) {
-			return false;
-		}
-		return count($results) >= (int)$connection->ldapPagingSize;
-	}
-
-	/**
-	 * returns the info about the current cycle that should be run, if any,
-	 * otherwise null
-	 *
-	 * @return array|null
-	 */
-	public function getCycle() {
-		$prefixes = $this->ldapHelper->getServerConfigurationPrefixes(true);
-		if (count($prefixes) === 0) {
-			return null;
-		}
-
-		$cycleData = [
-			'prefix' => $this->config->getAppValue('user_ldap', 'background_sync_prefix', null),
-			'offset' => (int)$this->config->getAppValue('user_ldap', 'background_sync_offset', 0),
-		];
-
-		if (
-			$cycleData['prefix'] !== null
-			&& in_array($cycleData['prefix'], $prefixes)
-		) {
-			return $cycleData;
-		}
-
-		return null;
-	}
-
-	/**
-	 * Save the provided cycle information in the DB
-	 *
-	 * @param array $cycleData
-	 */
-	public function setCycle(array $cycleData) {
-		$this->config->setAppValue('user_ldap', 'background_sync_prefix', $cycleData['prefix']);
-		$this->config->setAppValue('user_ldap', 'background_sync_offset', $cycleData['offset']);
-	}
-
-	/**
-	 * returns data about the next cycle that should run, if any, otherwise
-	 * null. It also always goes for the next LDAP configuration!
-	 *
-	 * @param array|null $cycleData the old cycle
-	 * @return array|null
-	 */
-	public function determineNextCycle(array $cycleData = null) {
-		$prefixes = $this->ldapHelper->getServerConfigurationPrefixes(true);
-		if (count($prefixes) === 0) {
-			return null;
-		}
-
-		// get the next prefix in line and remember it
-		$oldPrefix = $cycleData === null ? null : $cycleData['prefix'];
-		$prefix = $this->getNextPrefix($oldPrefix);
-		if ($prefix === null) {
-			return null;
-		}
-		$cycleData['prefix'] = $prefix;
-		$cycleData['offset'] = 0;
-		$this->setCycle(['prefix' => $prefix, 'offset' => 0]);
-
-		return $cycleData;
-	}
-
-	/**
-	 * Checks whether the provided cycle should be run. Currently only the
-	 * last configuration change goes into account (at least one hour).
-	 *
-	 * @param $cycleData
-	 * @return bool
-	 */
-	public function qualifiesToRun($cycleData) {
-		$lastChange = $this->config->getAppValue('user_ldap', $cycleData['prefix'] . '_lastChange', 0);
-		if ((time() - $lastChange) > 60 * 30) {
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * increases the offset of the current cycle for the next run
-	 *
-	 * @param $cycleData
-	 */
-	protected function increaseOffset($cycleData) {
-		$ldapConfig = new Configuration($cycleData['prefix']);
-		$cycleData['offset'] += (int)$ldapConfig->ldapPagingSize;
-		$this->setCycle($cycleData);
-	}
-
-	/**
-	 * determines the next configuration prefix based on the last one (if any)
-	 *
-	 * @param string|null $lastPrefix
-	 * @return string|null
-	 */
-	protected function getNextPrefix($lastPrefix) {
-		$prefixes = $this->ldapHelper->getServerConfigurationPrefixes(true);
-		$noOfPrefixes = count($prefixes);
-		if ($noOfPrefixes === 0) {
-			return null;
-		}
-		$i = $lastPrefix === null ? false : array_search($lastPrefix, $prefixes, true);
-		if ($i === false) {
-			$i = -1;
-		} else {
-			$i++;
-		}
-
-		if (!isset($prefixes[$i])) {
-			$i = 0;
-		}
-		return $prefixes[$i];
-	}
-
-	/**
-	 * "fixes" DI
-	 *
-	 * @param array $argument
-	 */
-	public function setArgument($argument) {
-		if (isset($argument['config'])) {
-			$this->config = $argument['config'];
-		} else {
-			$this->config = \OC::$server->getConfig();
-		}
-
-		if (isset($argument['helper'])) {
-			$this->ldapHelper = $argument['helper'];
-		} else {
-			$this->ldapHelper = new Helper($this->config, \OC::$server->getDatabaseConnection());
-		}
-
-		if (isset($argument['ldapWrapper'])) {
-			$this->ldap = $argument['ldapWrapper'];
-		} else {
-			$this->ldap = new LDAP();
-		}
-
-		if (isset($argument['avatarManager'])) {
-			$this->avatarManager = $argument['avatarManager'];
-		} else {
-			$this->avatarManager = \OC::$server->getAvatarManager();
-		}
-
-		if (isset($argument['dbc'])) {
-			$this->dbc = $argument['dbc'];
-		} else {
-			$this->dbc = \OC::$server->getDatabaseConnection();
-		}
-
-		if (isset($argument['ncUserManager'])) {
-			$this->ncUserManager = $argument['ncUserManager'];
-		} else {
-			$this->ncUserManager = \OC::$server->getUserManager();
-		}
-
-		if (isset($argument['notificationManager'])) {
-			$this->notificationManager = $argument['notificationManager'];
-		} else {
-			$this->notificationManager = \OC::$server->getNotificationManager();
-		}
-
-		if (isset($argument['userManager'])) {
-			$this->userManager = $argument['userManager'];
-		}
-
-		if (isset($argument['mapper'])) {
-			$this->mapper = $argument['mapper'];
-		} else {
-			$this->mapper = new UserMapping($this->dbc);
-		}
-
-		if (isset($argument['connectionFactory'])) {
-			$this->connectionFactory = $argument['connectionFactory'];
-		} else {
-			$this->connectionFactory = new ConnectionFactory($this->ldap);
-		}
-
-		if (isset($argument['accessFactory'])) {
-			$this->accessFactory = $argument['accessFactory'];
-		} else {
-			$this->accessFactory = new AccessFactory(
-				$this->ldap,
-				$this->userManager,
-				$this->ldapHelper,
-				$this->config,
-				$this->ncUserManager
-			);
-		}
-	}
+    public const MAX_INTERVAL = 12 * 60 * 60; // 12h
+    public const MIN_INTERVAL = 30 * 60; // 30min
+    /** @var  Helper */
+    protected $ldapHelper;
+    /** @var  LDAP */
+    protected $ldap;
+    /** @var  Manager */
+    protected $userManager;
+    /** @var UserMapping */
+    protected $mapper;
+    /** @var  IConfig */
+    protected $config;
+    /** @var  IAvatarManager */
+    protected $avatarManager;
+    /** @var  IDBConnection */
+    protected $dbc;
+    /** @var  IUserManager */
+    protected $ncUserManager;
+    /** @var  IManager */
+    protected $notificationManager;
+    /** @var ConnectionFactory */
+    protected $connectionFactory;
+    /** @var AccessFactory */
+    protected $accessFactory;
+
+    public function __construct(Manager  $userManager) {
+        $this->userManager = $userManager;
+        $this->setInterval(
+            \OC::$server->getConfig()->getAppValue(
+                'user_ldap',
+                'background_sync_interval',
+                self::MIN_INTERVAL
+            )
+        );
+    }
+
+    /**
+     * updates the interval
+     *
+     * the idea is to adjust the interval depending on the amount of known users
+     * and the attempt to update each user one day. At most it would run every
+     * 30 minutes, and at least every 12 hours.
+     */
+    public function updateInterval() {
+        $minPagingSize = $this->getMinPagingSize();
+        $mappedUsers = $this->mapper->count();
+
+        $runsPerDay = ($minPagingSize === 0 || $mappedUsers === 0) ? self::MAX_INTERVAL
+            : $mappedUsers / $minPagingSize;
+        $interval = floor(24 * 60 * 60 / $runsPerDay);
+        $interval = min(max($interval, self::MIN_INTERVAL), self::MAX_INTERVAL);
+
+        $this->config->setAppValue('user_ldap', 'background_sync_interval', $interval);
+    }
+
+    /**
+     * returns the smallest configured paging size
+     * @return int
+     */
+    protected function getMinPagingSize() {
+        $configKeys = $this->config->getAppKeys('user_ldap');
+        $configKeys = array_filter($configKeys, function ($key) {
+            return strpos($key, 'ldap_paging_size') !== false;
+        });
+        $minPagingSize = null;
+        foreach ($configKeys as $configKey) {
+            $pagingSize = $this->config->getAppValue('user_ldap', $configKey, $minPagingSize);
+            $minPagingSize = $minPagingSize === null ? $pagingSize : min($minPagingSize, $pagingSize);
+        }
+        return (int)$minPagingSize;
+    }
+
+    /**
+     * @param array $argument
+     */
+    public function run($argument) {
+        $this->setArgument($argument);
+
+        $isBackgroundJobModeAjax = $this->config
+                ->getAppValue('core', 'backgroundjobs_mode', 'ajax') === 'ajax';
+        if ($isBackgroundJobModeAjax) {
+            return;
+        }
+
+        $cycleData = $this->getCycle();
+        if ($cycleData === null) {
+            $cycleData = $this->determineNextCycle();
+            if ($cycleData === null) {
+                $this->updateInterval();
+                return;
+            }
+        }
+
+        if (!$this->qualifiesToRun($cycleData)) {
+            $this->updateInterval();
+            return;
+        }
+
+        try {
+            $expectMoreResults = $this->runCycle($cycleData);
+            if ($expectMoreResults) {
+                $this->increaseOffset($cycleData);
+            } else {
+                $this->determineNextCycle($cycleData);
+            }
+            $this->updateInterval();
+        } catch (ServerNotAvailableException $e) {
+            $this->determineNextCycle($cycleData);
+        }
+    }
+
+    /**
+     * @param array $cycleData
+     * @return bool whether more results are expected from the same configuration
+     */
+    public function runCycle($cycleData) {
+        $connection = $this->connectionFactory->get($cycleData['prefix']);
+        $access = $this->accessFactory->get($connection);
+        $access->setUserMapper($this->mapper);
+
+        $filter = $access->combineFilterWithAnd([
+            $access->connection->ldapUserFilter,
+            $access->connection->ldapUserDisplayName . '=*',
+            $access->getFilterPartForUserSearch('')
+        ]);
+        $results = $access->fetchListOfUsers(
+            $filter,
+            $access->userManager->getAttributes(),
+            $connection->ldapPagingSize,
+            $cycleData['offset'],
+            true
+        );
+
+        if ((int)$connection->ldapPagingSize === 0) {
+            return false;
+        }
+        return count($results) >= (int)$connection->ldapPagingSize;
+    }
+
+    /**
+     * returns the info about the current cycle that should be run, if any,
+     * otherwise null
+     *
+     * @return array|null
+     */
+    public function getCycle() {
+        $prefixes = $this->ldapHelper->getServerConfigurationPrefixes(true);
+        if (count($prefixes) === 0) {
+            return null;
+        }
+
+        $cycleData = [
+            'prefix' => $this->config->getAppValue('user_ldap', 'background_sync_prefix', null),
+            'offset' => (int)$this->config->getAppValue('user_ldap', 'background_sync_offset', 0),
+        ];
+
+        if (
+            $cycleData['prefix'] !== null
+            && in_array($cycleData['prefix'], $prefixes)
+        ) {
+            return $cycleData;
+        }
+
+        return null;
+    }
+
+    /**
+     * Save the provided cycle information in the DB
+     *
+     * @param array $cycleData
+     */
+    public function setCycle(array $cycleData) {
+        $this->config->setAppValue('user_ldap', 'background_sync_prefix', $cycleData['prefix']);
+        $this->config->setAppValue('user_ldap', 'background_sync_offset', $cycleData['offset']);
+    }
+
+    /**
+     * returns data about the next cycle that should run, if any, otherwise
+     * null. It also always goes for the next LDAP configuration!
+     *
+     * @param array|null $cycleData the old cycle
+     * @return array|null
+     */
+    public function determineNextCycle(array $cycleData = null) {
+        $prefixes = $this->ldapHelper->getServerConfigurationPrefixes(true);
+        if (count($prefixes) === 0) {
+            return null;
+        }
+
+        // get the next prefix in line and remember it
+        $oldPrefix = $cycleData === null ? null : $cycleData['prefix'];
+        $prefix = $this->getNextPrefix($oldPrefix);
+        if ($prefix === null) {
+            return null;
+        }
+        $cycleData['prefix'] = $prefix;
+        $cycleData['offset'] = 0;
+        $this->setCycle(['prefix' => $prefix, 'offset' => 0]);
+
+        return $cycleData;
+    }
+
+    /**
+     * Checks whether the provided cycle should be run. Currently only the
+     * last configuration change goes into account (at least one hour).
+     *
+     * @param $cycleData
+     * @return bool
+     */
+    public function qualifiesToRun($cycleData) {
+        $lastChange = $this->config->getAppValue('user_ldap', $cycleData['prefix'] . '_lastChange', 0);
+        if ((time() - $lastChange) > 60 * 30) {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * increases the offset of the current cycle for the next run
+     *
+     * @param $cycleData
+     */
+    protected function increaseOffset($cycleData) {
+        $ldapConfig = new Configuration($cycleData['prefix']);
+        $cycleData['offset'] += (int)$ldapConfig->ldapPagingSize;
+        $this->setCycle($cycleData);
+    }
+
+    /**
+     * determines the next configuration prefix based on the last one (if any)
+     *
+     * @param string|null $lastPrefix
+     * @return string|null
+     */
+    protected function getNextPrefix($lastPrefix) {
+        $prefixes = $this->ldapHelper->getServerConfigurationPrefixes(true);
+        $noOfPrefixes = count($prefixes);
+        if ($noOfPrefixes === 0) {
+            return null;
+        }
+        $i = $lastPrefix === null ? false : array_search($lastPrefix, $prefixes, true);
+        if ($i === false) {
+            $i = -1;
+        } else {
+            $i++;
+        }
+
+        if (!isset($prefixes[$i])) {
+            $i = 0;
+        }
+        return $prefixes[$i];
+    }
+
+    /**
+     * "fixes" DI
+     *
+     * @param array $argument
+     */
+    public function setArgument($argument) {
+        if (isset($argument['config'])) {
+            $this->config = $argument['config'];
+        } else {
+            $this->config = \OC::$server->getConfig();
+        }
+
+        if (isset($argument['helper'])) {
+            $this->ldapHelper = $argument['helper'];
+        } else {
+            $this->ldapHelper = new Helper($this->config, \OC::$server->getDatabaseConnection());
+        }
+
+        if (isset($argument['ldapWrapper'])) {
+            $this->ldap = $argument['ldapWrapper'];
+        } else {
+            $this->ldap = new LDAP();
+        }
+
+        if (isset($argument['avatarManager'])) {
+            $this->avatarManager = $argument['avatarManager'];
+        } else {
+            $this->avatarManager = \OC::$server->getAvatarManager();
+        }
+
+        if (isset($argument['dbc'])) {
+            $this->dbc = $argument['dbc'];
+        } else {
+            $this->dbc = \OC::$server->getDatabaseConnection();
+        }
+
+        if (isset($argument['ncUserManager'])) {
+            $this->ncUserManager = $argument['ncUserManager'];
+        } else {
+            $this->ncUserManager = \OC::$server->getUserManager();
+        }
+
+        if (isset($argument['notificationManager'])) {
+            $this->notificationManager = $argument['notificationManager'];
+        } else {
+            $this->notificationManager = \OC::$server->getNotificationManager();
+        }
+
+        if (isset($argument['userManager'])) {
+            $this->userManager = $argument['userManager'];
+        }
+
+        if (isset($argument['mapper'])) {
+            $this->mapper = $argument['mapper'];
+        } else {
+            $this->mapper = new UserMapping($this->dbc);
+        }
+
+        if (isset($argument['connectionFactory'])) {
+            $this->connectionFactory = $argument['connectionFactory'];
+        } else {
+            $this->connectionFactory = new ConnectionFactory($this->ldap);
+        }
+
+        if (isset($argument['accessFactory'])) {
+            $this->accessFactory = $argument['accessFactory'];
+        } else {
+            $this->accessFactory = new AccessFactory(
+                $this->ldap,
+                $this->userManager,
+                $this->ldapHelper,
+                $this->config,
+                $this->ncUserManager
+            );
+        }
+    }
 }

apps/user_ldap/lib/Wizard.php

Indentation +1314 added lines, -1314 removed lines

@@ -43,1318 +43,1318 @@
 use OCP\ILogger;
 
 class Wizard extends LDAPUtility {
-	/** @var \OCP\IL10N */
-	protected static $l;
-	protected $access;
-	protected $cr;
-	protected $configuration;
-	protected $result;
-	protected $resultCache = [];
-
-	public const LRESULT_PROCESSED_OK = 2;
-	public const LRESULT_PROCESSED_INVALID = 3;
-	public const LRESULT_PROCESSED_SKIP = 4;
-
-	public const LFILTER_LOGIN = 2;
-	public const LFILTER_USER_LIST = 3;
-	public const LFILTER_GROUP_LIST = 4;
-
-	public const LFILTER_MODE_ASSISTED = 2;
-	public const LFILTER_MODE_RAW = 1;
-
-	public const LDAP_NW_TIMEOUT = 4;
-
-	/**
-	 * Constructor
-	 * @param Configuration $configuration an instance of Configuration
-	 * @param ILDAPWrapper $ldap an instance of ILDAPWrapper
-	 * @param Access $access
-	 */
-	public function __construct(Configuration $configuration, ILDAPWrapper $ldap, Access $access) {
-		parent::__construct($ldap);
-		$this->configuration = $configuration;
-		if (is_null(Wizard::$l)) {
-			Wizard::$l = \OC::$server->getL10N('user_ldap');
-		}
-		$this->access = $access;
-		$this->result = new WizardResult();
-	}
-
-	public function __destruct() {
-		if ($this->result->hasChanges()) {
-			$this->configuration->saveConfiguration();
-		}
-	}
-
-	/**
-	 * counts entries in the LDAP directory
-	 *
-	 * @param string $filter the LDAP search filter
-	 * @param string $type a string being either 'users' or 'groups';
-	 * @return int
-	 * @throws \Exception
-	 */
-	public function countEntries(string $filter, string $type): int {
-		$reqs = ['ldapHost', 'ldapPort', 'ldapBase'];
-		if ($type === 'users') {
-			$reqs[] = 'ldapUserFilter';
-		}
-		if (!$this->checkRequirements($reqs)) {
-			throw new \Exception('Requirements not met', 400);
-		}
-
-		$attr = ['dn']; // default
-		$limit = 1001;
-		if ($type === 'groups') {
-			$result = $this->access->countGroups($filter, $attr, $limit);
-		} elseif ($type === 'users') {
-			$result = $this->access->countUsers($filter, $attr, $limit);
-		} elseif ($type === 'objects') {
-			$result = $this->access->countObjects($limit);
-		} else {
-			throw new \Exception('Internal error: Invalid object type', 500);
-		}
-
-		return (int)$result;
-	}
-
-	/**
-	 * formats the return value of a count operation to the string to be
-	 * inserted.
-	 *
-	 * @param int $count
-	 * @return string
-	 */
-	private function formatCountResult(int $count): string {
-		if ($count > 1000) {
-			return '> 1000';
-		}
-		return (string)$count;
-	}
-
-	public function countGroups() {
-		$filter = $this->configuration->ldapGroupFilter;
-
-		if (empty($filter)) {
-			$output = self::$l->n('%s group found', '%s groups found', 0, [0]);
-			$this->result->addChange('ldap_group_count', $output);
-			return $this->result;
-		}
-
-		try {
-			$groupsTotal = $this->countEntries($filter, 'groups');
-		} catch (\Exception $e) {
-			//400 can be ignored, 500 is forwarded
-			if ($e->getCode() === 500) {
-				throw $e;
-			}
-			return false;
-		}
-		$output = self::$l->n(
-			'%s group found',
-			'%s groups found',
-			$groupsTotal,
-			[$this->formatCountResult($groupsTotal)]
-		);
-		$this->result->addChange('ldap_group_count', $output);
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function countUsers() {
-		$filter = $this->access->getFilterForUserCount();
-
-		$usersTotal = $this->countEntries($filter, 'users');
-		$output = self::$l->n(
-			'%s user found',
-			'%s users found',
-			$usersTotal,
-			[$this->formatCountResult($usersTotal)]
-		);
-		$this->result->addChange('ldap_user_count', $output);
-		return $this->result;
-	}
-
-	/**
-	 * counts any objects in the currently set base dn
-	 *
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function countInBaseDN() {
-		// we don't need to provide a filter in this case
-		$total = $this->countEntries('', 'objects');
-		if ($total === false) {
-			throw new \Exception('invalid results received');
-		}
-		$this->result->addChange('ldap_test_base', $total);
-		return $this->result;
-	}
-
-	/**
-	 * counts users with a specified attribute
-	 * @param string $attr
-	 * @param bool $existsCheck
-	 * @return int|bool
-	 */
-	public function countUsersWithAttribute($attr, $existsCheck = false) {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapUserFilter',
-		])) {
-			return  false;
-		}
-
-		$filter = $this->access->combineFilterWithAnd([
-			$this->configuration->ldapUserFilter,
-			$attr . '=*'
-		]);
-
-		$limit = ($existsCheck === false) ? null : 1;
-
-		return $this->access->countUsers($filter, ['dn'], $limit);
-	}
-
-	/**
-	 * detects the display name attribute. If a setting is already present that
-	 * returns at least one hit, the detection will be canceled.
-	 * @return WizardResult|bool
-	 * @throws \Exception
-	 */
-	public function detectUserDisplayNameAttribute() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapUserFilter',
-		])) {
-			return  false;
-		}
-
-		$attr = $this->configuration->ldapUserDisplayName;
-		if ($attr !== '' && $attr !== 'displayName') {
-			// most likely not the default value with upper case N,
-			// verify it still produces a result
-			$count = (int)$this->countUsersWithAttribute($attr, true);
-			if ($count > 0) {
-				//no change, but we sent it back to make sure the user interface
-				//is still correct, even if the ajax call was cancelled meanwhile
-				$this->result->addChange('ldap_display_name', $attr);
-				return $this->result;
-			}
-		}
-
-		// first attribute that has at least one result wins
-		$displayNameAttrs = ['displayname', 'cn'];
-		foreach ($displayNameAttrs as $attr) {
-			$count = (int)$this->countUsersWithAttribute($attr, true);
-
-			if ($count > 0) {
-				$this->applyFind('ldap_display_name', $attr);
-				return $this->result;
-			}
-		}
-
-		throw new \Exception(self::$l->t('Could not detect user display name attribute. Please specify it yourself in advanced LDAP settings.'));
-	}
-
-	/**
-	 * detects the most often used email attribute for users applying to the
-	 * user list filter. If a setting is already present that returns at least
-	 * one hit, the detection will be canceled.
-	 * @return WizardResult|bool
-	 */
-	public function detectEmailAttribute() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapUserFilter',
-		])) {
-			return  false;
-		}
-
-		$attr = $this->configuration->ldapEmailAttribute;
-		if ($attr !== '') {
-			$count = (int)$this->countUsersWithAttribute($attr, true);
-			if ($count > 0) {
-				return false;
-			}
-			$writeLog = true;
-		} else {
-			$writeLog = false;
-		}
-
-		$emailAttributes = ['mail', 'mailPrimaryAddress'];
-		$winner = '';
-		$maxUsers = 0;
-		foreach ($emailAttributes as $attr) {
-			$count = $this->countUsersWithAttribute($attr);
-			if ($count > $maxUsers) {
-				$maxUsers = $count;
-				$winner = $attr;
-			}
-		}
-
-		if ($winner !== '') {
-			$this->applyFind('ldap_email_attr', $winner);
-			if ($writeLog) {
-				\OCP\Util::writeLog('user_ldap', 'The mail attribute has ' .
-					'automatically been reset, because the original value ' .
-					'did not return any results.', ILogger::INFO);
-			}
-		}
-
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function determineAttributes() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapUserFilter',
-		])) {
-			return  false;
-		}
-
-		$attributes = $this->getUserAttributes();
-
-		natcasesort($attributes);
-		$attributes = array_values($attributes);
-
-		$this->result->addOptions('ldap_loginfilter_attributes', $attributes);
-
-		$selected = $this->configuration->ldapLoginFilterAttributes;
-		if (is_array($selected) && !empty($selected)) {
-			$this->result->addChange('ldap_loginfilter_attributes', $selected);
-		}
-
-		return $this->result;
-	}
-
-	/**
-	 * detects the available LDAP attributes
-	 * @return array|false The instance's WizardResult instance
-	 * @throws \Exception
-	 */
-	private function getUserAttributes() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapUserFilter',
-		])) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$base = $this->configuration->ldapBase[0];
-		$filter = $this->configuration->ldapUserFilter;
-		$rr = $this->ldap->search($cr, $base, $filter, [], 1, 1);
-		if (!$this->ldap->isResource($rr)) {
-			return false;
-		}
-		$er = $this->ldap->firstEntry($cr, $rr);
-		$attributes = $this->ldap->getAttributes($cr, $er);
-		$pureAttributes = [];
-		for ($i = 0; $i < $attributes['count']; $i++) {
-			$pureAttributes[] = $attributes[$i];
-		}
-
-		return $pureAttributes;
-	}
-
-	/**
-	 * detects the available LDAP groups
-	 * @return WizardResult|false the instance's WizardResult instance
-	 */
-	public function determineGroupsForGroups() {
-		return $this->determineGroups('ldap_groupfilter_groups',
-									  'ldapGroupFilterGroups',
-									  false);
-	}
-
-	/**
-	 * detects the available LDAP groups
-	 * @return WizardResult|false the instance's WizardResult instance
-	 */
-	public function determineGroupsForUsers() {
-		return $this->determineGroups('ldap_userfilter_groups',
-									  'ldapUserFilterGroups');
-	}
-
-	/**
-	 * detects the available LDAP groups
-	 * @param string $dbKey
-	 * @param string $confKey
-	 * @param bool $testMemberOf
-	 * @return WizardResult|false the instance's WizardResult instance
-	 * @throws \Exception
-	 */
-	private function determineGroups($dbKey, $confKey, $testMemberOf = true) {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-		])) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$this->fetchGroups($dbKey, $confKey);
-
-		if ($testMemberOf) {
-			$this->configuration->hasMemberOfFilterSupport = $this->testMemberOf();
-			$this->result->markChange();
-			if (!$this->configuration->hasMemberOfFilterSupport) {
-				throw new \Exception('memberOf is not supported by the server');
-			}
-		}
-
-		return $this->result;
-	}
-
-	/**
-	 * fetches all groups from LDAP and adds them to the result object
-	 *
-	 * @param string $dbKey
-	 * @param string $confKey
-	 * @return array $groupEntries
-	 * @throws \Exception
-	 */
-	public function fetchGroups($dbKey, $confKey) {
-		$obclasses = ['posixGroup', 'group', 'zimbraDistributionList', 'groupOfNames', 'groupOfUniqueNames'];
-
-		$filterParts = [];
-		foreach ($obclasses as $obclass) {
-			$filterParts[] = 'objectclass='.$obclass;
-		}
-		//we filter for everything
-		//- that looks like a group and
-		//- has the group display name set
-		$filter = $this->access->combineFilterWithOr($filterParts);
-		$filter = $this->access->combineFilterWithAnd([$filter, 'cn=*']);
-
-		$groupNames = [];
-		$groupEntries = [];
-		$limit = 400;
-		$offset = 0;
-		do {
-			// we need to request dn additionally here, otherwise memberOf
-			// detection will fail later
-			$result = $this->access->searchGroups($filter, ['cn', 'dn'], $limit, $offset);
-			foreach ($result as $item) {
-				if (!isset($item['cn']) && !is_array($item['cn']) && !isset($item['cn'][0])) {
-					// just in case - no issue known
-					continue;
-				}
-				$groupNames[] = $item['cn'][0];
-				$groupEntries[] = $item;
-			}
-			$offset += $limit;
-		} while ($this->access->hasMoreResults());
-
-		if (count($groupNames) > 0) {
-			natsort($groupNames);
-			$this->result->addOptions($dbKey, array_values($groupNames));
-		} else {
-			throw new \Exception(self::$l->t('Could not find the desired feature'));
-		}
-
-		$setFeatures = $this->configuration->$confKey;
-		if (is_array($setFeatures) && !empty($setFeatures)) {
-			//something is already configured? pre-select it.
-			$this->result->addChange($dbKey, $setFeatures);
-		}
-		return $groupEntries;
-	}
-
-	public function determineGroupMemberAssoc() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapGroupFilter',
-		])) {
-			return  false;
-		}
-		$attribute = $this->detectGroupMemberAssoc();
-		if ($attribute === false) {
-			return false;
-		}
-		$this->configuration->setConfiguration(['ldapGroupMemberAssocAttr' => $attribute]);
-		$this->result->addChange('ldap_group_member_assoc_attribute', $attribute);
-
-		return $this->result;
-	}
-
-	/**
-	 * Detects the available object classes
-	 * @return WizardResult|false the instance's WizardResult instance
-	 * @throws \Exception
-	 */
-	public function determineGroupObjectClasses() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-		])) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$obclasses = ['groupOfNames', 'groupOfUniqueNames', 'group', 'posixGroup', '*'];
-		$this->determineFeature($obclasses,
-								'objectclass',
-								'ldap_groupfilter_objectclass',
-								'ldapGroupFilterObjectclass',
-								false);
-
-		return $this->result;
-	}
-
-	/**
-	 * detects the available object classes
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function determineUserObjectClasses() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-		])) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$obclasses = ['inetOrgPerson', 'person', 'organizationalPerson',
-			'user', 'posixAccount', '*'];
-		$filter = $this->configuration->ldapUserFilter;
-		//if filter is empty, it is probably the first time the wizard is called
-		//then, apply suggestions.
-		$this->determineFeature($obclasses,
-								'objectclass',
-								'ldap_userfilter_objectclass',
-								'ldapUserFilterObjectclass',
-								empty($filter));
-
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult|false
-	 * @throws \Exception
-	 */
-	public function getGroupFilter() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-		])) {
-			return false;
-		}
-		//make sure the use display name is set
-		$displayName = $this->configuration->ldapGroupDisplayName;
-		if ($displayName === '') {
-			$d = $this->configuration->getDefaults();
-			$this->applyFind('ldap_group_display_name',
-							 $d['ldap_group_display_name']);
-		}
-		$filter = $this->composeLdapFilter(self::LFILTER_GROUP_LIST);
-
-		$this->applyFind('ldap_group_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult|false
-	 * @throws \Exception
-	 */
-	public function getUserListFilter() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-		])) {
-			return false;
-		}
-		//make sure the use display name is set
-		$displayName = $this->configuration->ldapUserDisplayName;
-		if ($displayName === '') {
-			$d = $this->configuration->getDefaults();
-			$this->applyFind('ldap_display_name', $d['ldap_display_name']);
-		}
-		$filter = $this->composeLdapFilter(self::LFILTER_USER_LIST);
-		if (!$filter) {
-			throw new \Exception('Cannot create filter');
-		}
-
-		$this->applyFind('ldap_userlist_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * @return bool|WizardResult
-	 * @throws \Exception
-	 */
-	public function getUserLoginFilter() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapUserFilter',
-		])) {
-			return false;
-		}
-
-		$filter = $this->composeLdapFilter(self::LFILTER_LOGIN);
-		if (!$filter) {
-			throw new \Exception('Cannot create filter');
-		}
-
-		$this->applyFind('ldap_login_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * @return bool|WizardResult
-	 * @param string $loginName
-	 * @throws \Exception
-	 */
-	public function testLoginName($loginName) {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapLoginFilter',
-		])) {
-			return false;
-		}
-
-		$cr = $this->access->connection->getConnectionResource();
-		if (!$this->ldap->isResource($cr)) {
-			throw new \Exception('connection error');
-		}
-
-		if (mb_strpos($this->access->connection->ldapLoginFilter, '%uid', 0, 'UTF-8')
-			=== false) {
-			throw new \Exception('missing placeholder');
-		}
-
-		$users = $this->access->countUsersByLoginName($loginName);
-		if ($this->ldap->errno($cr) !== 0) {
-			throw new \Exception($this->ldap->error($cr));
-		}
-		$filter = str_replace('%uid', $loginName, $this->access->connection->ldapLoginFilter);
-		$this->result->addChange('ldap_test_loginname', $users);
-		$this->result->addChange('ldap_test_effective_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * Tries to determine the port, requires given Host, User DN and Password
-	 * @return WizardResult|false WizardResult on success, false otherwise
-	 * @throws \Exception
-	 */
-	public function guessPortAndTLS() {
-		if (!$this->checkRequirements(['ldapHost',
-		])) {
-			return false;
-		}
-		$this->checkHost();
-		$portSettings = $this->getPortSettingsToTry();
-
-		if (!is_array($portSettings)) {
-			throw new \Exception(print_r($portSettings, true));
-		}
-
-		//proceed from the best configuration and return on first success
-		foreach ($portSettings as $setting) {
-			$p = $setting['port'];
-			$t = $setting['tls'];
-			\OCP\Util::writeLog('user_ldap', 'Wiz: trying port '. $p . ', TLS '. $t, ILogger::DEBUG);
-			//connectAndBind may throw Exception, it needs to be catched by the
-			//callee of this method
-
-			try {
-				$settingsFound = $this->connectAndBind($p, $t);
-			} catch (\Exception $e) {
-				// any reply other than -1 (= cannot connect) is already okay,
-				// because then we found the server
-				// unavailable startTLS returns -11
-				if ($e->getCode() > 0) {
-					$settingsFound = true;
-				} else {
-					throw $e;
-				}
-			}
-
-			if ($settingsFound === true) {
-				$config = [
-					'ldapPort' => $p,
-					'ldapTLS' => (int)$t
-				];
-				$this->configuration->setConfiguration($config);
-				\OCP\Util::writeLog('user_ldap', 'Wiz: detected Port ' . $p, ILogger::DEBUG);
-				$this->result->addChange('ldap_port', $p);
-				return $this->result;
-			}
-		}
-
-		//custom port, undetected (we do not brute force)
-		return false;
-	}
-
-	/**
-	 * tries to determine a base dn from User DN or LDAP Host
-	 * @return WizardResult|false WizardResult on success, false otherwise
-	 */
-	public function guessBaseDN() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-		])) {
-			return false;
-		}
-
-		//check whether a DN is given in the agent name (99.9% of all cases)
-		$base = null;
-		$i = stripos($this->configuration->ldapAgentName, 'dc=');
-		if ($i !== false) {
-			$base = substr($this->configuration->ldapAgentName, $i);
-			if ($this->testBaseDN($base)) {
-				$this->applyFind('ldap_base', $base);
-				return $this->result;
-			}
-		}
-
-		//this did not help :(
-		//Let's see whether we can parse the Host URL and convert the domain to
-		//a base DN
-		$helper = new Helper(\OC::$server->getConfig(), \OC::$server->getDatabaseConnection());
-		$domain = $helper->getDomainFromURL($this->configuration->ldapHost);
-		if (!$domain) {
-			return false;
-		}
-
-		$dparts = explode('.', $domain);
-		while (count($dparts) > 0) {
-			$base2 = 'dc=' . implode(',dc=', $dparts);
-			if ($base !== $base2 && $this->testBaseDN($base2)) {
-				$this->applyFind('ldap_base', $base2);
-				return $this->result;
-			}
-			array_shift($dparts);
-		}
-
-		return false;
-	}
-
-	/**
-	 * sets the found value for the configuration key in the WizardResult
-	 * as well as in the Configuration instance
-	 * @param string $key the configuration key
-	 * @param string $value the (detected) value
-	 *
-	 */
-	private function applyFind($key, $value) {
-		$this->result->addChange($key, $value);
-		$this->configuration->setConfiguration([$key => $value]);
-	}
-
-	/**
-	 * Checks, whether a port was entered in the Host configuration
-	 * field. In this case the port will be stripped off, but also stored as
-	 * setting.
-	 */
-	private function checkHost() {
-		$host = $this->configuration->ldapHost;
-		$hostInfo = parse_url($host);
-
-		//removes Port from Host
-		if (is_array($hostInfo) && isset($hostInfo['port'])) {
-			$port = $hostInfo['port'];
-			$host = str_replace(':'.$port, '', $host);
-			$this->applyFind('ldap_host', $host);
-			$this->applyFind('ldap_port', $port);
-		}
-	}
-
-	/**
-	 * tries to detect the group member association attribute which is
-	 * one of 'uniqueMember', 'memberUid', 'member', 'gidNumber'
-	 * @return string|false, string with the attribute name, false on error
-	 * @throws \Exception
-	 */
-	private function detectGroupMemberAssoc() {
-		$possibleAttrs = ['uniqueMember', 'memberUid', 'member', 'gidNumber', 'zimbraMailForwardingAddress'];
-		$filter = $this->configuration->ldapGroupFilter;
-		if (empty($filter)) {
-			return false;
-		}
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-		$base = $this->configuration->ldapBaseGroups[0] ?: $this->configuration->ldapBase[0];
-		$rr = $this->ldap->search($cr, $base, $filter, $possibleAttrs, 0, 1000);
-		if (!$this->ldap->isResource($rr)) {
-			return false;
-		}
-		$er = $this->ldap->firstEntry($cr, $rr);
-		while (is_resource($er)) {
-			$this->ldap->getDN($cr, $er);
-			$attrs = $this->ldap->getAttributes($cr, $er);
-			$result = [];
-			$possibleAttrsCount = count($possibleAttrs);
-			for ($i = 0; $i < $possibleAttrsCount; $i++) {
-				if (isset($attrs[$possibleAttrs[$i]])) {
-					$result[$possibleAttrs[$i]] = $attrs[$possibleAttrs[$i]]['count'];
-				}
-			}
-			if (!empty($result)) {
-				natsort($result);
-				return key($result);
-			}
-
-			$er = $this->ldap->nextEntry($cr, $er);
-		}
-
-		return false;
-	}
-
-	/**
-	 * Checks whether for a given BaseDN results will be returned
-	 * @param string $base the BaseDN to test
-	 * @return bool true on success, false otherwise
-	 * @throws \Exception
-	 */
-	private function testBaseDN($base) {
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		//base is there, let's validate it. If we search for anything, we should
-		//get a result set > 0 on a proper base
-		$rr = $this->ldap->search($cr, $base, 'objectClass=*', ['dn'], 0, 1);
-		if (!$this->ldap->isResource($rr)) {
-			$errorNo = $this->ldap->errno($cr);
-			$errorMsg = $this->ldap->error($cr);
-			\OCP\Util::writeLog('user_ldap', 'Wiz: Could not search base '.$base.
-							' Error '.$errorNo.': '.$errorMsg, ILogger::INFO);
-			return false;
-		}
-		$entries = $this->ldap->countEntries($cr, $rr);
-		return ($entries !== false) && ($entries > 0);
-	}
-
-	/**
-	 * Checks whether the server supports memberOf in LDAP Filter.
-	 * Note: at least in OpenLDAP, availability of memberOf is dependent on
-	 * a configured objectClass. I.e. not necessarily for all available groups
-	 * memberOf does work.
-	 *
-	 * @return bool true if it does, false otherwise
-	 * @throws \Exception
-	 */
-	private function testMemberOf() {
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-		$result = $this->access->countUsers('memberOf=*', ['memberOf'], 1);
-		if (is_int($result) && $result > 0) {
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * creates an LDAP Filter from given configuration
-	 * @param integer $filterType int, for which use case the filter shall be created
-	 * can be any of self::LFILTER_USER_LIST, self::LFILTER_LOGIN or
-	 * self::LFILTER_GROUP_LIST
-	 * @return string|false string with the filter on success, false otherwise
-	 * @throws \Exception
-	 */
-	private function composeLdapFilter($filterType) {
-		$filter = '';
-		$parts = 0;
-		switch ($filterType) {
-			case self::LFILTER_USER_LIST:
-				$objcs = $this->configuration->ldapUserFilterObjectclass;
-				//glue objectclasses
-				if (is_array($objcs) && count($objcs) > 0) {
-					$filter .= '(|';
-					foreach ($objcs as $objc) {
-						$filter .= '(objectclass=' . $objc . ')';
-					}
-					$filter .= ')';
-					$parts++;
-				}
-				//glue group memberships
-				if ($this->configuration->hasMemberOfFilterSupport) {
-					$cns = $this->configuration->ldapUserFilterGroups;
-					if (is_array($cns) && count($cns) > 0) {
-						$filter .= '(|';
-						$cr = $this->getConnection();
-						if (!$cr) {
-							throw new \Exception('Could not connect to LDAP');
-						}
-						$base = $this->configuration->ldapBase[0];
-						foreach ($cns as $cn) {
-							$rr = $this->ldap->search($cr, $base, 'cn=' . $cn, ['dn', 'primaryGroupToken']);
-							if (!$this->ldap->isResource($rr)) {
-								continue;
-							}
-							$er = $this->ldap->firstEntry($cr, $rr);
-							$attrs = $this->ldap->getAttributes($cr, $er);
-							$dn = $this->ldap->getDN($cr, $er);
-							if ($dn === false || $dn === '') {
-								continue;
-							}
-							$filterPart = '(memberof=' . $dn . ')';
-							if (isset($attrs['primaryGroupToken'])) {
-								$pgt = $attrs['primaryGroupToken'][0];
-								$primaryFilterPart = '(primaryGroupID=' . $pgt .')';
-								$filterPart = '(|' . $filterPart . $primaryFilterPart . ')';
-							}
-							$filter .= $filterPart;
-						}
-						$filter .= ')';
-					}
-					$parts++;
-				}
-				//wrap parts in AND condition
-				if ($parts > 1) {
-					$filter = '(&' . $filter . ')';
-				}
-				if ($filter === '') {
-					$filter = '(objectclass=*)';
-				}
-				break;
-
-			case self::LFILTER_GROUP_LIST:
-				$objcs = $this->configuration->ldapGroupFilterObjectclass;
-				//glue objectclasses
-				if (is_array($objcs) && count($objcs) > 0) {
-					$filter .= '(|';
-					foreach ($objcs as $objc) {
-						$filter .= '(objectclass=' . $objc . ')';
-					}
-					$filter .= ')';
-					$parts++;
-				}
-				//glue group memberships
-				$cns = $this->configuration->ldapGroupFilterGroups;
-				if (is_array($cns) && count($cns) > 0) {
-					$filter .= '(|';
-					foreach ($cns as $cn) {
-						$filter .= '(cn=' . $cn . ')';
-					}
-					$filter .= ')';
-				}
-				$parts++;
-				//wrap parts in AND condition
-				if ($parts > 1) {
-					$filter = '(&' . $filter . ')';
-				}
-				break;
-
-			case self::LFILTER_LOGIN:
-				$ulf = $this->configuration->ldapUserFilter;
-				$loginpart = '=%uid';
-				$filterUsername = '';
-				$userAttributes = $this->getUserAttributes();
-				$userAttributes = array_change_key_case(array_flip($userAttributes));
-				$parts = 0;
-
-				if ($this->configuration->ldapLoginFilterUsername === '1') {
-					$attr = '';
-					if (isset($userAttributes['uid'])) {
-						$attr = 'uid';
-					} elseif (isset($userAttributes['samaccountname'])) {
-						$attr = 'samaccountname';
-					} elseif (isset($userAttributes['cn'])) {
-						//fallback
-						$attr = 'cn';
-					}
-					if ($attr !== '') {
-						$filterUsername = '(' . $attr . $loginpart . ')';
-						$parts++;
-					}
-				}
-
-				$filterEmail = '';
-				if ($this->configuration->ldapLoginFilterEmail === '1') {
-					$filterEmail = '(|(mailPrimaryAddress=%uid)(mail=%uid))';
-					$parts++;
-				}
-
-				$filterAttributes = '';
-				$attrsToFilter = $this->configuration->ldapLoginFilterAttributes;
-				if (is_array($attrsToFilter) && count($attrsToFilter) > 0) {
-					$filterAttributes = '(|';
-					foreach ($attrsToFilter as $attribute) {
-						$filterAttributes .= '(' . $attribute . $loginpart . ')';
-					}
-					$filterAttributes .= ')';
-					$parts++;
-				}
-
-				$filterLogin = '';
-				if ($parts > 1) {
-					$filterLogin = '(|';
-				}
-				$filterLogin .= $filterUsername;
-				$filterLogin .= $filterEmail;
-				$filterLogin .= $filterAttributes;
-				if ($parts > 1) {
-					$filterLogin .= ')';
-				}
-
-				$filter = '(&'.$ulf.$filterLogin.')';
-				break;
-		}
-
-		\OCP\Util::writeLog('user_ldap', 'Wiz: Final filter '.$filter, ILogger::DEBUG);
-
-		return $filter;
-	}
-
-	/**
-	 * Connects and Binds to an LDAP Server
-	 *
-	 * @param int $port the port to connect with
-	 * @param bool $tls whether startTLS is to be used
-	 * @return bool
-	 * @throws \Exception
-	 */
-	private function connectAndBind($port, $tls) {
-		//connect, does not really trigger any server communication
-		$host = $this->configuration->ldapHost;
-		$hostInfo = parse_url($host);
-		if (!$hostInfo) {
-			throw new \Exception(self::$l->t('Invalid Host'));
-		}
-		\OCP\Util::writeLog('user_ldap', 'Wiz: Attempting to connect ', ILogger::DEBUG);
-		$cr = $this->ldap->connect($host, $port);
-		if (!is_resource($cr)) {
-			throw new \Exception(self::$l->t('Invalid Host'));
-		}
-
-		//set LDAP options
-		$this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
-		$this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
-		$this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
-
-		try {
-			if ($tls) {
-				$isTlsWorking = @$this->ldap->startTls($cr);
-				if (!$isTlsWorking) {
-					return false;
-				}
-			}
-
-			\OCP\Util::writeLog('user_ldap', 'Wiz: Attemping to Bind ', ILogger::DEBUG);
-			//interesting part: do the bind!
-			$login = $this->ldap->bind($cr,
-				$this->configuration->ldapAgentName,
-				$this->configuration->ldapAgentPassword
-			);
-			$errNo = $this->ldap->errno($cr);
-			$error = ldap_error($cr);
-			$this->ldap->unbind($cr);
-		} catch (ServerNotAvailableException $e) {
-			return false;
-		}
-
-		if ($login === true) {
-			$this->ldap->unbind($cr);
-			\OCP\Util::writeLog('user_ldap', 'Wiz: Bind successful to Port '. $port . ' TLS ' . (int)$tls, ILogger::DEBUG);
-			return true;
-		}
-
-		if ($errNo === -1) {
-			//host, port or TLS wrong
-			return false;
-		}
-		throw new \Exception($error, $errNo);
-	}
-
-	/**
-	 * checks whether a valid combination of agent and password has been
-	 * provided (either two values or nothing for anonymous connect)
-	 * @return bool, true if everything is fine, false otherwise
-	 */
-	private function checkAgentRequirements() {
-		$agent = $this->configuration->ldapAgentName;
-		$pwd = $this->configuration->ldapAgentPassword;
-
-		return
-			($agent !== '' && $pwd !== '')
-			|| ($agent === '' && $pwd === '')
-		;
-	}
-
-	/**
-	 * @param array $reqs
-	 * @return bool
-	 */
-	private function checkRequirements($reqs) {
-		$this->checkAgentRequirements();
-		foreach ($reqs as $option) {
-			$value = $this->configuration->$option;
-			if (empty($value)) {
-				return false;
-			}
-		}
-		return true;
-	}
-
-	/**
-	 * does a cumulativeSearch on LDAP to get different values of a
-	 * specified attribute
-	 * @param string[] $filters array, the filters that shall be used in the search
-	 * @param string $attr the attribute of which a list of values shall be returned
-	 * @param int $dnReadLimit the amount of how many DNs should be analyzed.
-	 * The lower, the faster
-	 * @param string $maxF string. if not null, this variable will have the filter that
-	 * yields most result entries
-	 * @return array|false an array with the values on success, false otherwise
-	 */
-	public function cumulativeSearchOnAttribute($filters, $attr, $dnReadLimit = 3, &$maxF = null) {
-		$dnRead = [];
-		$foundItems = [];
-		$maxEntries = 0;
-		if (!is_array($this->configuration->ldapBase)
-		   || !isset($this->configuration->ldapBase[0])) {
-			return false;
-		}
-		$base = $this->configuration->ldapBase[0];
-		$cr = $this->getConnection();
-		if (!$this->ldap->isResource($cr)) {
-			return false;
-		}
-		$lastFilter = null;
-		if (isset($filters[count($filters) - 1])) {
-			$lastFilter = $filters[count($filters) - 1];
-		}
-		foreach ($filters as $filter) {
-			if ($lastFilter === $filter && count($foundItems) > 0) {
-				//skip when the filter is a wildcard and results were found
-				continue;
-			}
-			// 20k limit for performance and reason
-			$rr = $this->ldap->search($cr, $base, $filter, [$attr], 0, 20000);
-			if (!$this->ldap->isResource($rr)) {
-				continue;
-			}
-			$entries = $this->ldap->countEntries($cr, $rr);
-			$getEntryFunc = 'firstEntry';
-			if (($entries !== false) && ($entries > 0)) {
-				if (!is_null($maxF) && $entries > $maxEntries) {
-					$maxEntries = $entries;
-					$maxF = $filter;
-				}
-				$dnReadCount = 0;
-				do {
-					$entry = $this->ldap->$getEntryFunc($cr, $rr);
-					$getEntryFunc = 'nextEntry';
-					if (!$this->ldap->isResource($entry)) {
-						continue 2;
-					}
-					$rr = $entry; //will be expected by nextEntry next round
-					$attributes = $this->ldap->getAttributes($cr, $entry);
-					$dn = $this->ldap->getDN($cr, $entry);
-					if ($dn === false || in_array($dn, $dnRead)) {
-						continue;
-					}
-					$newItems = [];
-					$state = $this->getAttributeValuesFromEntry($attributes,
-																$attr,
-																$newItems);
-					$dnReadCount++;
-					$foundItems = array_merge($foundItems, $newItems);
-					$this->resultCache[$dn][$attr] = $newItems;
-					$dnRead[] = $dn;
-				} while (($state === self::LRESULT_PROCESSED_SKIP
-						|| $this->ldap->isResource($entry))
-						&& ($dnReadLimit === 0 || $dnReadCount < $dnReadLimit));
-			}
-		}
-
-		return array_unique($foundItems);
-	}
-
-	/**
-	 * determines if and which $attr are available on the LDAP server
-	 * @param string[] $objectclasses the objectclasses to use as search filter
-	 * @param string $attr the attribute to look for
-	 * @param string $dbkey the dbkey of the setting the feature is connected to
-	 * @param string $confkey the confkey counterpart for the $dbkey as used in the
-	 * Configuration class
-	 * @param bool $po whether the objectClass with most result entries
-	 * shall be pre-selected via the result
-	 * @return array|false list of found items.
-	 * @throws \Exception
-	 */
-	private function determineFeature($objectclasses, $attr, $dbkey, $confkey, $po = false) {
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-		$p = 'objectclass=';
-		foreach ($objectclasses as $key => $value) {
-			$objectclasses[$key] = $p.$value;
-		}
-		$maxEntryObjC = '';
-
-		//how deep to dig?
-		//When looking for objectclasses, testing few entries is sufficient,
-		$dig = 3;
-
-		$availableFeatures =
-			$this->cumulativeSearchOnAttribute($objectclasses, $attr,
-											   $dig, $maxEntryObjC);
-		if (is_array($availableFeatures)
-		   && count($availableFeatures) > 0) {
-			natcasesort($availableFeatures);
-			//natcasesort keeps indices, but we must get rid of them for proper
-			//sorting in the web UI. Therefore: array_values
-			$this->result->addOptions($dbkey, array_values($availableFeatures));
-		} else {
-			throw new \Exception(self::$l->t('Could not find the desired feature'));
-		}
-
-		$setFeatures = $this->configuration->$confkey;
-		if (is_array($setFeatures) && !empty($setFeatures)) {
-			//something is already configured? pre-select it.
-			$this->result->addChange($dbkey, $setFeatures);
-		} elseif ($po && $maxEntryObjC !== '') {
-			//pre-select objectclass with most result entries
-			$maxEntryObjC = str_replace($p, '', $maxEntryObjC);
-			$this->applyFind($dbkey, $maxEntryObjC);
-			$this->result->addChange($dbkey, $maxEntryObjC);
-		}
-
-		return $availableFeatures;
-	}
-
-	/**
-	 * appends a list of values fr
-	 * @param resource $result the return value from ldap_get_attributes
-	 * @param string $attribute the attribute values to look for
-	 * @param array &$known new values will be appended here
-	 * @return int, state on of the class constants LRESULT_PROCESSED_OK,
-	 * LRESULT_PROCESSED_INVALID or LRESULT_PROCESSED_SKIP
-	 */
-	private function getAttributeValuesFromEntry($result, $attribute, &$known) {
-		if (!is_array($result)
-		   || !isset($result['count'])
-		   || !$result['count'] > 0) {
-			return self::LRESULT_PROCESSED_INVALID;
-		}
-
-		// strtolower on all keys for proper comparison
-		$result = \OCP\Util::mb_array_change_key_case($result);
-		$attribute = strtolower($attribute);
-		if (isset($result[$attribute])) {
-			foreach ($result[$attribute] as $key => $val) {
-				if ($key === 'count') {
-					continue;
-				}
-				if (!in_array($val, $known)) {
-					$known[] = $val;
-				}
-			}
-			return self::LRESULT_PROCESSED_OK;
-		} else {
-			return self::LRESULT_PROCESSED_SKIP;
-		}
-	}
-
-	/**
-	 * @return bool|mixed
-	 */
-	private function getConnection() {
-		if (!is_null($this->cr)) {
-			return $this->cr;
-		}
-
-		$cr = $this->ldap->connect(
-			$this->configuration->ldapHost,
-			$this->configuration->ldapPort
-		);
-
-		$this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
-		$this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
-		$this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
-		if ($this->configuration->ldapTLS === 1) {
-			$this->ldap->startTls($cr);
-		}
-
-		$lo = @$this->ldap->bind($cr,
-								 $this->configuration->ldapAgentName,
-								 $this->configuration->ldapAgentPassword);
-		if ($lo === true) {
-			$this->$cr = $cr;
-			return $cr;
-		}
-
-		return false;
-	}
-
-	/**
-	 * @return array
-	 */
-	private function getDefaultLdapPortSettings() {
-		static $settings = [
-			['port' => 7636, 'tls' => false],
-			['port' => 636, 'tls' => false],
-			['port' => 7389, 'tls' => true],
-			['port' => 389, 'tls' => true],
-			['port' => 7389, 'tls' => false],
-			['port' => 389, 'tls' => false],
-		];
-		return $settings;
-	}
-
-	/**
-	 * @return array
-	 */
-	private function getPortSettingsToTry() {
-		//389 ← LDAP / Unencrypted or StartTLS
-		//636 ← LDAPS / SSL
-		//7xxx ← UCS. need to be checked first, because both ports may be open
-		$host = $this->configuration->ldapHost;
-		$port = (int)$this->configuration->ldapPort;
-		$portSettings = [];
-
-		//In case the port is already provided, we will check this first
-		if ($port > 0) {
-			$hostInfo = parse_url($host);
-			if (!(is_array($hostInfo)
-				&& isset($hostInfo['scheme'])
-				&& stripos($hostInfo['scheme'], 'ldaps') !== false)) {
-				$portSettings[] = ['port' => $port, 'tls' => true];
-			}
-			$portSettings[] = ['port' => $port, 'tls' => false];
-		}
-
-		//default ports
-		$portSettings = array_merge($portSettings,
-									$this->getDefaultLdapPortSettings());
-
-		return $portSettings;
-	}
+    /** @var \OCP\IL10N */
+    protected static $l;
+    protected $access;
+    protected $cr;
+    protected $configuration;
+    protected $result;
+    protected $resultCache = [];
+
+    public const LRESULT_PROCESSED_OK = 2;
+    public const LRESULT_PROCESSED_INVALID = 3;
+    public const LRESULT_PROCESSED_SKIP = 4;
+
+    public const LFILTER_LOGIN = 2;
+    public const LFILTER_USER_LIST = 3;
+    public const LFILTER_GROUP_LIST = 4;
+
+    public const LFILTER_MODE_ASSISTED = 2;
+    public const LFILTER_MODE_RAW = 1;
+
+    public const LDAP_NW_TIMEOUT = 4;
+
+    /**
+     * Constructor
+     * @param Configuration $configuration an instance of Configuration
+     * @param ILDAPWrapper $ldap an instance of ILDAPWrapper
+     * @param Access $access
+     */
+    public function __construct(Configuration $configuration, ILDAPWrapper $ldap, Access $access) {
+        parent::__construct($ldap);
+        $this->configuration = $configuration;
+        if (is_null(Wizard::$l)) {
+            Wizard::$l = \OC::$server->getL10N('user_ldap');
+        }
+        $this->access = $access;
+        $this->result = new WizardResult();
+    }
+
+    public function __destruct() {
+        if ($this->result->hasChanges()) {
+            $this->configuration->saveConfiguration();
+        }
+    }
+
+    /**
+     * counts entries in the LDAP directory
+     *
+     * @param string $filter the LDAP search filter
+     * @param string $type a string being either 'users' or 'groups';
+     * @return int
+     * @throws \Exception
+     */
+    public function countEntries(string $filter, string $type): int {
+        $reqs = ['ldapHost', 'ldapPort', 'ldapBase'];
+        if ($type === 'users') {
+            $reqs[] = 'ldapUserFilter';
+        }
+        if (!$this->checkRequirements($reqs)) {
+            throw new \Exception('Requirements not met', 400);
+        }
+
+        $attr = ['dn']; // default
+        $limit = 1001;
+        if ($type === 'groups') {
+            $result = $this->access->countGroups($filter, $attr, $limit);
+        } elseif ($type === 'users') {
+            $result = $this->access->countUsers($filter, $attr, $limit);
+        } elseif ($type === 'objects') {
+            $result = $this->access->countObjects($limit);
+        } else {
+            throw new \Exception('Internal error: Invalid object type', 500);
+        }
+
+        return (int)$result;
+    }
+
+    /**
+     * formats the return value of a count operation to the string to be
+     * inserted.
+     *
+     * @param int $count
+     * @return string
+     */
+    private function formatCountResult(int $count): string {
+        if ($count > 1000) {
+            return '> 1000';
+        }
+        return (string)$count;
+    }
+
+    public function countGroups() {
+        $filter = $this->configuration->ldapGroupFilter;
+
+        if (empty($filter)) {
+            $output = self::$l->n('%s group found', '%s groups found', 0, [0]);
+            $this->result->addChange('ldap_group_count', $output);
+            return $this->result;
+        }
+
+        try {
+            $groupsTotal = $this->countEntries($filter, 'groups');
+        } catch (\Exception $e) {
+            //400 can be ignored, 500 is forwarded
+            if ($e->getCode() === 500) {
+                throw $e;
+            }
+            return false;
+        }
+        $output = self::$l->n(
+            '%s group found',
+            '%s groups found',
+            $groupsTotal,
+            [$this->formatCountResult($groupsTotal)]
+        );
+        $this->result->addChange('ldap_group_count', $output);
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function countUsers() {
+        $filter = $this->access->getFilterForUserCount();
+
+        $usersTotal = $this->countEntries($filter, 'users');
+        $output = self::$l->n(
+            '%s user found',
+            '%s users found',
+            $usersTotal,
+            [$this->formatCountResult($usersTotal)]
+        );
+        $this->result->addChange('ldap_user_count', $output);
+        return $this->result;
+    }
+
+    /**
+     * counts any objects in the currently set base dn
+     *
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function countInBaseDN() {
+        // we don't need to provide a filter in this case
+        $total = $this->countEntries('', 'objects');
+        if ($total === false) {
+            throw new \Exception('invalid results received');
+        }
+        $this->result->addChange('ldap_test_base', $total);
+        return $this->result;
+    }
+
+    /**
+     * counts users with a specified attribute
+     * @param string $attr
+     * @param bool $existsCheck
+     * @return int|bool
+     */
+    public function countUsersWithAttribute($attr, $existsCheck = false) {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapUserFilter',
+        ])) {
+            return  false;
+        }
+
+        $filter = $this->access->combineFilterWithAnd([
+            $this->configuration->ldapUserFilter,
+            $attr . '=*'
+        ]);
+
+        $limit = ($existsCheck === false) ? null : 1;
+
+        return $this->access->countUsers($filter, ['dn'], $limit);
+    }
+
+    /**
+     * detects the display name attribute. If a setting is already present that
+     * returns at least one hit, the detection will be canceled.
+     * @return WizardResult|bool
+     * @throws \Exception
+     */
+    public function detectUserDisplayNameAttribute() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapUserFilter',
+        ])) {
+            return  false;
+        }
+
+        $attr = $this->configuration->ldapUserDisplayName;
+        if ($attr !== '' && $attr !== 'displayName') {
+            // most likely not the default value with upper case N,
+            // verify it still produces a result
+            $count = (int)$this->countUsersWithAttribute($attr, true);
+            if ($count > 0) {
+                //no change, but we sent it back to make sure the user interface
+                //is still correct, even if the ajax call was cancelled meanwhile
+                $this->result->addChange('ldap_display_name', $attr);
+                return $this->result;
+            }
+        }
+
+        // first attribute that has at least one result wins
+        $displayNameAttrs = ['displayname', 'cn'];
+        foreach ($displayNameAttrs as $attr) {
+            $count = (int)$this->countUsersWithAttribute($attr, true);
+
+            if ($count > 0) {
+                $this->applyFind('ldap_display_name', $attr);
+                return $this->result;
+            }
+        }
+
+        throw new \Exception(self::$l->t('Could not detect user display name attribute. Please specify it yourself in advanced LDAP settings.'));
+    }
+
+    /**
+     * detects the most often used email attribute for users applying to the
+     * user list filter. If a setting is already present that returns at least
+     * one hit, the detection will be canceled.
+     * @return WizardResult|bool
+     */
+    public function detectEmailAttribute() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapUserFilter',
+        ])) {
+            return  false;
+        }
+
+        $attr = $this->configuration->ldapEmailAttribute;
+        if ($attr !== '') {
+            $count = (int)$this->countUsersWithAttribute($attr, true);
+            if ($count > 0) {
+                return false;
+            }
+            $writeLog = true;
+        } else {
+            $writeLog = false;
+        }
+
+        $emailAttributes = ['mail', 'mailPrimaryAddress'];
+        $winner = '';
+        $maxUsers = 0;
+        foreach ($emailAttributes as $attr) {
+            $count = $this->countUsersWithAttribute($attr);
+            if ($count > $maxUsers) {
+                $maxUsers = $count;
+                $winner = $attr;
+            }
+        }
+
+        if ($winner !== '') {
+            $this->applyFind('ldap_email_attr', $winner);
+            if ($writeLog) {
+                \OCP\Util::writeLog('user_ldap', 'The mail attribute has ' .
+                    'automatically been reset, because the original value ' .
+                    'did not return any results.', ILogger::INFO);
+            }
+        }
+
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function determineAttributes() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapUserFilter',
+        ])) {
+            return  false;
+        }
+
+        $attributes = $this->getUserAttributes();
+
+        natcasesort($attributes);
+        $attributes = array_values($attributes);
+
+        $this->result->addOptions('ldap_loginfilter_attributes', $attributes);
+
+        $selected = $this->configuration->ldapLoginFilterAttributes;
+        if (is_array($selected) && !empty($selected)) {
+            $this->result->addChange('ldap_loginfilter_attributes', $selected);
+        }
+
+        return $this->result;
+    }
+
+    /**
+     * detects the available LDAP attributes
+     * @return array|false The instance's WizardResult instance
+     * @throws \Exception
+     */
+    private function getUserAttributes() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapUserFilter',
+        ])) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $base = $this->configuration->ldapBase[0];
+        $filter = $this->configuration->ldapUserFilter;
+        $rr = $this->ldap->search($cr, $base, $filter, [], 1, 1);
+        if (!$this->ldap->isResource($rr)) {
+            return false;
+        }
+        $er = $this->ldap->firstEntry($cr, $rr);
+        $attributes = $this->ldap->getAttributes($cr, $er);
+        $pureAttributes = [];
+        for ($i = 0; $i < $attributes['count']; $i++) {
+            $pureAttributes[] = $attributes[$i];
+        }
+
+        return $pureAttributes;
+    }
+
+    /**
+     * detects the available LDAP groups
+     * @return WizardResult|false the instance's WizardResult instance
+     */
+    public function determineGroupsForGroups() {
+        return $this->determineGroups('ldap_groupfilter_groups',
+                                        'ldapGroupFilterGroups',
+                                        false);
+    }
+
+    /**
+     * detects the available LDAP groups
+     * @return WizardResult|false the instance's WizardResult instance
+     */
+    public function determineGroupsForUsers() {
+        return $this->determineGroups('ldap_userfilter_groups',
+                                        'ldapUserFilterGroups');
+    }
+
+    /**
+     * detects the available LDAP groups
+     * @param string $dbKey
+     * @param string $confKey
+     * @param bool $testMemberOf
+     * @return WizardResult|false the instance's WizardResult instance
+     * @throws \Exception
+     */
+    private function determineGroups($dbKey, $confKey, $testMemberOf = true) {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+        ])) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $this->fetchGroups($dbKey, $confKey);
+
+        if ($testMemberOf) {
+            $this->configuration->hasMemberOfFilterSupport = $this->testMemberOf();
+            $this->result->markChange();
+            if (!$this->configuration->hasMemberOfFilterSupport) {
+                throw new \Exception('memberOf is not supported by the server');
+            }
+        }
+
+        return $this->result;
+    }
+
+    /**
+     * fetches all groups from LDAP and adds them to the result object
+     *
+     * @param string $dbKey
+     * @param string $confKey
+     * @return array $groupEntries
+     * @throws \Exception
+     */
+    public function fetchGroups($dbKey, $confKey) {
+        $obclasses = ['posixGroup', 'group', 'zimbraDistributionList', 'groupOfNames', 'groupOfUniqueNames'];
+
+        $filterParts = [];
+        foreach ($obclasses as $obclass) {
+            $filterParts[] = 'objectclass='.$obclass;
+        }
+        //we filter for everything
+        //- that looks like a group and
+        //- has the group display name set
+        $filter = $this->access->combineFilterWithOr($filterParts);
+        $filter = $this->access->combineFilterWithAnd([$filter, 'cn=*']);
+
+        $groupNames = [];
+        $groupEntries = [];
+        $limit = 400;
+        $offset = 0;
+        do {
+            // we need to request dn additionally here, otherwise memberOf
+            // detection will fail later
+            $result = $this->access->searchGroups($filter, ['cn', 'dn'], $limit, $offset);
+            foreach ($result as $item) {
+                if (!isset($item['cn']) && !is_array($item['cn']) && !isset($item['cn'][0])) {
+                    // just in case - no issue known
+                    continue;
+                }
+                $groupNames[] = $item['cn'][0];
+                $groupEntries[] = $item;
+            }
+            $offset += $limit;
+        } while ($this->access->hasMoreResults());
+
+        if (count($groupNames) > 0) {
+            natsort($groupNames);
+            $this->result->addOptions($dbKey, array_values($groupNames));
+        } else {
+            throw new \Exception(self::$l->t('Could not find the desired feature'));
+        }
+
+        $setFeatures = $this->configuration->$confKey;
+        if (is_array($setFeatures) && !empty($setFeatures)) {
+            //something is already configured? pre-select it.
+            $this->result->addChange($dbKey, $setFeatures);
+        }
+        return $groupEntries;
+    }
+
+    public function determineGroupMemberAssoc() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapGroupFilter',
+        ])) {
+            return  false;
+        }
+        $attribute = $this->detectGroupMemberAssoc();
+        if ($attribute === false) {
+            return false;
+        }
+        $this->configuration->setConfiguration(['ldapGroupMemberAssocAttr' => $attribute]);
+        $this->result->addChange('ldap_group_member_assoc_attribute', $attribute);
+
+        return $this->result;
+    }
+
+    /**
+     * Detects the available object classes
+     * @return WizardResult|false the instance's WizardResult instance
+     * @throws \Exception
+     */
+    public function determineGroupObjectClasses() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+        ])) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $obclasses = ['groupOfNames', 'groupOfUniqueNames', 'group', 'posixGroup', '*'];
+        $this->determineFeature($obclasses,
+                                'objectclass',
+                                'ldap_groupfilter_objectclass',
+                                'ldapGroupFilterObjectclass',
+                                false);
+
+        return $this->result;
+    }
+
+    /**
+     * detects the available object classes
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function determineUserObjectClasses() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+        ])) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $obclasses = ['inetOrgPerson', 'person', 'organizationalPerson',
+            'user', 'posixAccount', '*'];
+        $filter = $this->configuration->ldapUserFilter;
+        //if filter is empty, it is probably the first time the wizard is called
+        //then, apply suggestions.
+        $this->determineFeature($obclasses,
+                                'objectclass',
+                                'ldap_userfilter_objectclass',
+                                'ldapUserFilterObjectclass',
+                                empty($filter));
+
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult|false
+     * @throws \Exception
+     */
+    public function getGroupFilter() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+        ])) {
+            return false;
+        }
+        //make sure the use display name is set
+        $displayName = $this->configuration->ldapGroupDisplayName;
+        if ($displayName === '') {
+            $d = $this->configuration->getDefaults();
+            $this->applyFind('ldap_group_display_name',
+                                $d['ldap_group_display_name']);
+        }
+        $filter = $this->composeLdapFilter(self::LFILTER_GROUP_LIST);
+
+        $this->applyFind('ldap_group_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult|false
+     * @throws \Exception
+     */
+    public function getUserListFilter() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+        ])) {
+            return false;
+        }
+        //make sure the use display name is set
+        $displayName = $this->configuration->ldapUserDisplayName;
+        if ($displayName === '') {
+            $d = $this->configuration->getDefaults();
+            $this->applyFind('ldap_display_name', $d['ldap_display_name']);
+        }
+        $filter = $this->composeLdapFilter(self::LFILTER_USER_LIST);
+        if (!$filter) {
+            throw new \Exception('Cannot create filter');
+        }
+
+        $this->applyFind('ldap_userlist_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * @return bool|WizardResult
+     * @throws \Exception
+     */
+    public function getUserLoginFilter() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapUserFilter',
+        ])) {
+            return false;
+        }
+
+        $filter = $this->composeLdapFilter(self::LFILTER_LOGIN);
+        if (!$filter) {
+            throw new \Exception('Cannot create filter');
+        }
+
+        $this->applyFind('ldap_login_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * @return bool|WizardResult
+     * @param string $loginName
+     * @throws \Exception
+     */
+    public function testLoginName($loginName) {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapLoginFilter',
+        ])) {
+            return false;
+        }
+
+        $cr = $this->access->connection->getConnectionResource();
+        if (!$this->ldap->isResource($cr)) {
+            throw new \Exception('connection error');
+        }
+
+        if (mb_strpos($this->access->connection->ldapLoginFilter, '%uid', 0, 'UTF-8')
+            === false) {
+            throw new \Exception('missing placeholder');
+        }
+
+        $users = $this->access->countUsersByLoginName($loginName);
+        if ($this->ldap->errno($cr) !== 0) {
+            throw new \Exception($this->ldap->error($cr));
+        }
+        $filter = str_replace('%uid', $loginName, $this->access->connection->ldapLoginFilter);
+        $this->result->addChange('ldap_test_loginname', $users);
+        $this->result->addChange('ldap_test_effective_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * Tries to determine the port, requires given Host, User DN and Password
+     * @return WizardResult|false WizardResult on success, false otherwise
+     * @throws \Exception
+     */
+    public function guessPortAndTLS() {
+        if (!$this->checkRequirements(['ldapHost',
+        ])) {
+            return false;
+        }
+        $this->checkHost();
+        $portSettings = $this->getPortSettingsToTry();
+
+        if (!is_array($portSettings)) {
+            throw new \Exception(print_r($portSettings, true));
+        }
+
+        //proceed from the best configuration and return on first success
+        foreach ($portSettings as $setting) {
+            $p = $setting['port'];
+            $t = $setting['tls'];
+            \OCP\Util::writeLog('user_ldap', 'Wiz: trying port '. $p . ', TLS '. $t, ILogger::DEBUG);
+            //connectAndBind may throw Exception, it needs to be catched by the
+            //callee of this method
+
+            try {
+                $settingsFound = $this->connectAndBind($p, $t);
+            } catch (\Exception $e) {
+                // any reply other than -1 (= cannot connect) is already okay,
+                // because then we found the server
+                // unavailable startTLS returns -11
+                if ($e->getCode() > 0) {
+                    $settingsFound = true;
+                } else {
+                    throw $e;
+                }
+            }
+
+            if ($settingsFound === true) {
+                $config = [
+                    'ldapPort' => $p,
+                    'ldapTLS' => (int)$t
+                ];
+                $this->configuration->setConfiguration($config);
+                \OCP\Util::writeLog('user_ldap', 'Wiz: detected Port ' . $p, ILogger::DEBUG);
+                $this->result->addChange('ldap_port', $p);
+                return $this->result;
+            }
+        }
+
+        //custom port, undetected (we do not brute force)
+        return false;
+    }
+
+    /**
+     * tries to determine a base dn from User DN or LDAP Host
+     * @return WizardResult|false WizardResult on success, false otherwise
+     */
+    public function guessBaseDN() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+        ])) {
+            return false;
+        }
+
+        //check whether a DN is given in the agent name (99.9% of all cases)
+        $base = null;
+        $i = stripos($this->configuration->ldapAgentName, 'dc=');
+        if ($i !== false) {
+            $base = substr($this->configuration->ldapAgentName, $i);
+            if ($this->testBaseDN($base)) {
+                $this->applyFind('ldap_base', $base);
+                return $this->result;
+            }
+        }
+
+        //this did not help :(
+        //Let's see whether we can parse the Host URL and convert the domain to
+        //a base DN
+        $helper = new Helper(\OC::$server->getConfig(), \OC::$server->getDatabaseConnection());
+        $domain = $helper->getDomainFromURL($this->configuration->ldapHost);
+        if (!$domain) {
+            return false;
+        }
+
+        $dparts = explode('.', $domain);
+        while (count($dparts) > 0) {
+            $base2 = 'dc=' . implode(',dc=', $dparts);
+            if ($base !== $base2 && $this->testBaseDN($base2)) {
+                $this->applyFind('ldap_base', $base2);
+                return $this->result;
+            }
+            array_shift($dparts);
+        }
+
+        return false;
+    }
+
+    /**
+     * sets the found value for the configuration key in the WizardResult
+     * as well as in the Configuration instance
+     * @param string $key the configuration key
+     * @param string $value the (detected) value
+     *
+     */
+    private function applyFind($key, $value) {
+        $this->result->addChange($key, $value);
+        $this->configuration->setConfiguration([$key => $value]);
+    }
+
+    /**
+     * Checks, whether a port was entered in the Host configuration
+     * field. In this case the port will be stripped off, but also stored as
+     * setting.
+     */
+    private function checkHost() {
+        $host = $this->configuration->ldapHost;
+        $hostInfo = parse_url($host);
+
+        //removes Port from Host
+        if (is_array($hostInfo) && isset($hostInfo['port'])) {
+            $port = $hostInfo['port'];
+            $host = str_replace(':'.$port, '', $host);
+            $this->applyFind('ldap_host', $host);
+            $this->applyFind('ldap_port', $port);
+        }
+    }
+
+    /**
+     * tries to detect the group member association attribute which is
+     * one of 'uniqueMember', 'memberUid', 'member', 'gidNumber'
+     * @return string|false, string with the attribute name, false on error
+     * @throws \Exception
+     */
+    private function detectGroupMemberAssoc() {
+        $possibleAttrs = ['uniqueMember', 'memberUid', 'member', 'gidNumber', 'zimbraMailForwardingAddress'];
+        $filter = $this->configuration->ldapGroupFilter;
+        if (empty($filter)) {
+            return false;
+        }
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+        $base = $this->configuration->ldapBaseGroups[0] ?: $this->configuration->ldapBase[0];
+        $rr = $this->ldap->search($cr, $base, $filter, $possibleAttrs, 0, 1000);
+        if (!$this->ldap->isResource($rr)) {
+            return false;
+        }
+        $er = $this->ldap->firstEntry($cr, $rr);
+        while (is_resource($er)) {
+            $this->ldap->getDN($cr, $er);
+            $attrs = $this->ldap->getAttributes($cr, $er);
+            $result = [];
+            $possibleAttrsCount = count($possibleAttrs);
+            for ($i = 0; $i < $possibleAttrsCount; $i++) {
+                if (isset($attrs[$possibleAttrs[$i]])) {
+                    $result[$possibleAttrs[$i]] = $attrs[$possibleAttrs[$i]]['count'];
+                }
+            }
+            if (!empty($result)) {
+                natsort($result);
+                return key($result);
+            }
+
+            $er = $this->ldap->nextEntry($cr, $er);
+        }
+
+        return false;
+    }
+
+    /**
+     * Checks whether for a given BaseDN results will be returned
+     * @param string $base the BaseDN to test
+     * @return bool true on success, false otherwise
+     * @throws \Exception
+     */
+    private function testBaseDN($base) {
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        //base is there, let's validate it. If we search for anything, we should
+        //get a result set > 0 on a proper base
+        $rr = $this->ldap->search($cr, $base, 'objectClass=*', ['dn'], 0, 1);
+        if (!$this->ldap->isResource($rr)) {
+            $errorNo = $this->ldap->errno($cr);
+            $errorMsg = $this->ldap->error($cr);
+            \OCP\Util::writeLog('user_ldap', 'Wiz: Could not search base '.$base.
+                            ' Error '.$errorNo.': '.$errorMsg, ILogger::INFO);
+            return false;
+        }
+        $entries = $this->ldap->countEntries($cr, $rr);
+        return ($entries !== false) && ($entries > 0);
+    }
+
+    /**
+     * Checks whether the server supports memberOf in LDAP Filter.
+     * Note: at least in OpenLDAP, availability of memberOf is dependent on
+     * a configured objectClass. I.e. not necessarily for all available groups
+     * memberOf does work.
+     *
+     * @return bool true if it does, false otherwise
+     * @throws \Exception
+     */
+    private function testMemberOf() {
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+        $result = $this->access->countUsers('memberOf=*', ['memberOf'], 1);
+        if (is_int($result) && $result > 0) {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * creates an LDAP Filter from given configuration
+     * @param integer $filterType int, for which use case the filter shall be created
+     * can be any of self::LFILTER_USER_LIST, self::LFILTER_LOGIN or
+     * self::LFILTER_GROUP_LIST
+     * @return string|false string with the filter on success, false otherwise
+     * @throws \Exception
+     */
+    private function composeLdapFilter($filterType) {
+        $filter = '';
+        $parts = 0;
+        switch ($filterType) {
+            case self::LFILTER_USER_LIST:
+                $objcs = $this->configuration->ldapUserFilterObjectclass;
+                //glue objectclasses
+                if (is_array($objcs) && count($objcs) > 0) {
+                    $filter .= '(|';
+                    foreach ($objcs as $objc) {
+                        $filter .= '(objectclass=' . $objc . ')';
+                    }
+                    $filter .= ')';
+                    $parts++;
+                }
+                //glue group memberships
+                if ($this->configuration->hasMemberOfFilterSupport) {
+                    $cns = $this->configuration->ldapUserFilterGroups;
+                    if (is_array($cns) && count($cns) > 0) {
+                        $filter .= '(|';
+                        $cr = $this->getConnection();
+                        if (!$cr) {
+                            throw new \Exception('Could not connect to LDAP');
+                        }
+                        $base = $this->configuration->ldapBase[0];
+                        foreach ($cns as $cn) {
+                            $rr = $this->ldap->search($cr, $base, 'cn=' . $cn, ['dn', 'primaryGroupToken']);
+                            if (!$this->ldap->isResource($rr)) {
+                                continue;
+                            }
+                            $er = $this->ldap->firstEntry($cr, $rr);
+                            $attrs = $this->ldap->getAttributes($cr, $er);
+                            $dn = $this->ldap->getDN($cr, $er);
+                            if ($dn === false || $dn === '') {
+                                continue;
+                            }
+                            $filterPart = '(memberof=' . $dn . ')';
+                            if (isset($attrs['primaryGroupToken'])) {
+                                $pgt = $attrs['primaryGroupToken'][0];
+                                $primaryFilterPart = '(primaryGroupID=' . $pgt .')';
+                                $filterPart = '(|' . $filterPart . $primaryFilterPart . ')';
+                            }
+                            $filter .= $filterPart;
+                        }
+                        $filter .= ')';
+                    }
+                    $parts++;
+                }
+                //wrap parts in AND condition
+                if ($parts > 1) {
+                    $filter = '(&' . $filter . ')';
+                }
+                if ($filter === '') {
+                    $filter = '(objectclass=*)';
+                }
+                break;
+
+            case self::LFILTER_GROUP_LIST:
+                $objcs = $this->configuration->ldapGroupFilterObjectclass;
+                //glue objectclasses
+                if (is_array($objcs) && count($objcs) > 0) {
+                    $filter .= '(|';
+                    foreach ($objcs as $objc) {
+                        $filter .= '(objectclass=' . $objc . ')';
+                    }
+                    $filter .= ')';
+                    $parts++;
+                }
+                //glue group memberships
+                $cns = $this->configuration->ldapGroupFilterGroups;
+                if (is_array($cns) && count($cns) > 0) {
+                    $filter .= '(|';
+                    foreach ($cns as $cn) {
+                        $filter .= '(cn=' . $cn . ')';
+                    }
+                    $filter .= ')';
+                }
+                $parts++;
+                //wrap parts in AND condition
+                if ($parts > 1) {
+                    $filter = '(&' . $filter . ')';
+                }
+                break;
+
+            case self::LFILTER_LOGIN:
+                $ulf = $this->configuration->ldapUserFilter;
+                $loginpart = '=%uid';
+                $filterUsername = '';
+                $userAttributes = $this->getUserAttributes();
+                $userAttributes = array_change_key_case(array_flip($userAttributes));
+                $parts = 0;
+
+                if ($this->configuration->ldapLoginFilterUsername === '1') {
+                    $attr = '';
+                    if (isset($userAttributes['uid'])) {
+                        $attr = 'uid';
+                    } elseif (isset($userAttributes['samaccountname'])) {
+                        $attr = 'samaccountname';
+                    } elseif (isset($userAttributes['cn'])) {
+                        //fallback
+                        $attr = 'cn';
+                    }
+                    if ($attr !== '') {
+                        $filterUsername = '(' . $attr . $loginpart . ')';
+                        $parts++;
+                    }
+                }
+
+                $filterEmail = '';
+                if ($this->configuration->ldapLoginFilterEmail === '1') {
+                    $filterEmail = '(|(mailPrimaryAddress=%uid)(mail=%uid))';
+                    $parts++;
+                }
+
+                $filterAttributes = '';
+                $attrsToFilter = $this->configuration->ldapLoginFilterAttributes;
+                if (is_array($attrsToFilter) && count($attrsToFilter) > 0) {
+                    $filterAttributes = '(|';
+                    foreach ($attrsToFilter as $attribute) {
+                        $filterAttributes .= '(' . $attribute . $loginpart . ')';
+                    }
+                    $filterAttributes .= ')';
+                    $parts++;
+                }
+
+                $filterLogin = '';
+                if ($parts > 1) {
+                    $filterLogin = '(|';
+                }
+                $filterLogin .= $filterUsername;
+                $filterLogin .= $filterEmail;
+                $filterLogin .= $filterAttributes;
+                if ($parts > 1) {
+                    $filterLogin .= ')';
+                }
+
+                $filter = '(&'.$ulf.$filterLogin.')';
+                break;
+        }
+
+        \OCP\Util::writeLog('user_ldap', 'Wiz: Final filter '.$filter, ILogger::DEBUG);
+
+        return $filter;
+    }
+
+    /**
+     * Connects and Binds to an LDAP Server
+     *
+     * @param int $port the port to connect with
+     * @param bool $tls whether startTLS is to be used
+     * @return bool
+     * @throws \Exception
+     */
+    private function connectAndBind($port, $tls) {
+        //connect, does not really trigger any server communication
+        $host = $this->configuration->ldapHost;
+        $hostInfo = parse_url($host);
+        if (!$hostInfo) {
+            throw new \Exception(self::$l->t('Invalid Host'));
+        }
+        \OCP\Util::writeLog('user_ldap', 'Wiz: Attempting to connect ', ILogger::DEBUG);
+        $cr = $this->ldap->connect($host, $port);
+        if (!is_resource($cr)) {
+            throw new \Exception(self::$l->t('Invalid Host'));
+        }
+
+        //set LDAP options
+        $this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
+        $this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
+        $this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
+
+        try {
+            if ($tls) {
+                $isTlsWorking = @$this->ldap->startTls($cr);
+                if (!$isTlsWorking) {
+                    return false;
+                }
+            }
+
+            \OCP\Util::writeLog('user_ldap', 'Wiz: Attemping to Bind ', ILogger::DEBUG);
+            //interesting part: do the bind!
+            $login = $this->ldap->bind($cr,
+                $this->configuration->ldapAgentName,
+                $this->configuration->ldapAgentPassword
+            );
+            $errNo = $this->ldap->errno($cr);
+            $error = ldap_error($cr);
+            $this->ldap->unbind($cr);
+        } catch (ServerNotAvailableException $e) {
+            return false;
+        }
+
+        if ($login === true) {
+            $this->ldap->unbind($cr);
+            \OCP\Util::writeLog('user_ldap', 'Wiz: Bind successful to Port '. $port . ' TLS ' . (int)$tls, ILogger::DEBUG);
+            return true;
+        }
+
+        if ($errNo === -1) {
+            //host, port or TLS wrong
+            return false;
+        }
+        throw new \Exception($error, $errNo);
+    }
+
+    /**
+     * checks whether a valid combination of agent and password has been
+     * provided (either two values or nothing for anonymous connect)
+     * @return bool, true if everything is fine, false otherwise
+     */
+    private function checkAgentRequirements() {
+        $agent = $this->configuration->ldapAgentName;
+        $pwd = $this->configuration->ldapAgentPassword;
+
+        return
+            ($agent !== '' && $pwd !== '')
+            || ($agent === '' && $pwd === '')
+        ;
+    }
+
+    /**
+     * @param array $reqs
+     * @return bool
+     */
+    private function checkRequirements($reqs) {
+        $this->checkAgentRequirements();
+        foreach ($reqs as $option) {
+            $value = $this->configuration->$option;
+            if (empty($value)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * does a cumulativeSearch on LDAP to get different values of a
+     * specified attribute
+     * @param string[] $filters array, the filters that shall be used in the search
+     * @param string $attr the attribute of which a list of values shall be returned
+     * @param int $dnReadLimit the amount of how many DNs should be analyzed.
+     * The lower, the faster
+     * @param string $maxF string. if not null, this variable will have the filter that
+     * yields most result entries
+     * @return array|false an array with the values on success, false otherwise
+     */
+    public function cumulativeSearchOnAttribute($filters, $attr, $dnReadLimit = 3, &$maxF = null) {
+        $dnRead = [];
+        $foundItems = [];
+        $maxEntries = 0;
+        if (!is_array($this->configuration->ldapBase)
+           || !isset($this->configuration->ldapBase[0])) {
+            return false;
+        }
+        $base = $this->configuration->ldapBase[0];
+        $cr = $this->getConnection();
+        if (!$this->ldap->isResource($cr)) {
+            return false;
+        }
+        $lastFilter = null;
+        if (isset($filters[count($filters) - 1])) {
+            $lastFilter = $filters[count($filters) - 1];
+        }
+        foreach ($filters as $filter) {
+            if ($lastFilter === $filter && count($foundItems) > 0) {
+                //skip when the filter is a wildcard and results were found
+                continue;
+            }
+            // 20k limit for performance and reason
+            $rr = $this->ldap->search($cr, $base, $filter, [$attr], 0, 20000);
+            if (!$this->ldap->isResource($rr)) {
+                continue;
+            }
+            $entries = $this->ldap->countEntries($cr, $rr);
+            $getEntryFunc = 'firstEntry';
+            if (($entries !== false) && ($entries > 0)) {
+                if (!is_null($maxF) && $entries > $maxEntries) {
+                    $maxEntries = $entries;
+                    $maxF = $filter;
+                }
+                $dnReadCount = 0;
+                do {
+                    $entry = $this->ldap->$getEntryFunc($cr, $rr);
+                    $getEntryFunc = 'nextEntry';
+                    if (!$this->ldap->isResource($entry)) {
+                        continue 2;
+                    }
+                    $rr = $entry; //will be expected by nextEntry next round
+                    $attributes = $this->ldap->getAttributes($cr, $entry);
+                    $dn = $this->ldap->getDN($cr, $entry);
+                    if ($dn === false || in_array($dn, $dnRead)) {
+                        continue;
+                    }
+                    $newItems = [];
+                    $state = $this->getAttributeValuesFromEntry($attributes,
+                                                                $attr,
+                                                                $newItems);
+                    $dnReadCount++;
+                    $foundItems = array_merge($foundItems, $newItems);
+                    $this->resultCache[$dn][$attr] = $newItems;
+                    $dnRead[] = $dn;
+                } while (($state === self::LRESULT_PROCESSED_SKIP
+                        || $this->ldap->isResource($entry))
+                        && ($dnReadLimit === 0 || $dnReadCount < $dnReadLimit));
+            }
+        }
+
+        return array_unique($foundItems);
+    }
+
+    /**
+     * determines if and which $attr are available on the LDAP server
+     * @param string[] $objectclasses the objectclasses to use as search filter
+     * @param string $attr the attribute to look for
+     * @param string $dbkey the dbkey of the setting the feature is connected to
+     * @param string $confkey the confkey counterpart for the $dbkey as used in the
+     * Configuration class
+     * @param bool $po whether the objectClass with most result entries
+     * shall be pre-selected via the result
+     * @return array|false list of found items.
+     * @throws \Exception
+     */
+    private function determineFeature($objectclasses, $attr, $dbkey, $confkey, $po = false) {
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+        $p = 'objectclass=';
+        foreach ($objectclasses as $key => $value) {
+            $objectclasses[$key] = $p.$value;
+        }
+        $maxEntryObjC = '';
+
+        //how deep to dig?
+        //When looking for objectclasses, testing few entries is sufficient,
+        $dig = 3;
+
+        $availableFeatures =
+            $this->cumulativeSearchOnAttribute($objectclasses, $attr,
+                                                $dig, $maxEntryObjC);
+        if (is_array($availableFeatures)
+           && count($availableFeatures) > 0) {
+            natcasesort($availableFeatures);
+            //natcasesort keeps indices, but we must get rid of them for proper
+            //sorting in the web UI. Therefore: array_values
+            $this->result->addOptions($dbkey, array_values($availableFeatures));
+        } else {
+            throw new \Exception(self::$l->t('Could not find the desired feature'));
+        }
+
+        $setFeatures = $this->configuration->$confkey;
+        if (is_array($setFeatures) && !empty($setFeatures)) {
+            //something is already configured? pre-select it.
+            $this->result->addChange($dbkey, $setFeatures);
+        } elseif ($po && $maxEntryObjC !== '') {
+            //pre-select objectclass with most result entries
+            $maxEntryObjC = str_replace($p, '', $maxEntryObjC);
+            $this->applyFind($dbkey, $maxEntryObjC);
+            $this->result->addChange($dbkey, $maxEntryObjC);
+        }
+
+        return $availableFeatures;
+    }
+
+    /**
+     * appends a list of values fr
+     * @param resource $result the return value from ldap_get_attributes
+     * @param string $attribute the attribute values to look for
+     * @param array &$known new values will be appended here
+     * @return int, state on of the class constants LRESULT_PROCESSED_OK,
+     * LRESULT_PROCESSED_INVALID or LRESULT_PROCESSED_SKIP
+     */
+    private function getAttributeValuesFromEntry($result, $attribute, &$known) {
+        if (!is_array($result)
+           || !isset($result['count'])
+           || !$result['count'] > 0) {
+            return self::LRESULT_PROCESSED_INVALID;
+        }
+
+        // strtolower on all keys for proper comparison
+        $result = \OCP\Util::mb_array_change_key_case($result);
+        $attribute = strtolower($attribute);
+        if (isset($result[$attribute])) {
+            foreach ($result[$attribute] as $key => $val) {
+                if ($key === 'count') {
+                    continue;
+                }
+                if (!in_array($val, $known)) {
+                    $known[] = $val;
+                }
+            }
+            return self::LRESULT_PROCESSED_OK;
+        } else {
+            return self::LRESULT_PROCESSED_SKIP;
+        }
+    }
+
+    /**
+     * @return bool|mixed
+     */
+    private function getConnection() {
+        if (!is_null($this->cr)) {
+            return $this->cr;
+        }
+
+        $cr = $this->ldap->connect(
+            $this->configuration->ldapHost,
+            $this->configuration->ldapPort
+        );
+
+        $this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
+        $this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
+        $this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
+        if ($this->configuration->ldapTLS === 1) {
+            $this->ldap->startTls($cr);
+        }
+
+        $lo = @$this->ldap->bind($cr,
+                                    $this->configuration->ldapAgentName,
+                                    $this->configuration->ldapAgentPassword);
+        if ($lo === true) {
+            $this->$cr = $cr;
+            return $cr;
+        }
+
+        return false;
+    }
+
+    /**
+     * @return array
+     */
+    private function getDefaultLdapPortSettings() {
+        static $settings = [
+            ['port' => 7636, 'tls' => false],
+            ['port' => 636, 'tls' => false],
+            ['port' => 7389, 'tls' => true],
+            ['port' => 389, 'tls' => true],
+            ['port' => 7389, 'tls' => false],
+            ['port' => 389, 'tls' => false],
+        ];
+        return $settings;
+    }
+
+    /**
+     * @return array
+     */
+    private function getPortSettingsToTry() {
+        //389 ← LDAP / Unencrypted or StartTLS
+        //636 ← LDAPS / SSL
+        //7xxx ← UCS. need to be checked first, because both ports may be open
+        $host = $this->configuration->ldapHost;
+        $port = (int)$this->configuration->ldapPort;
+        $portSettings = [];
+
+        //In case the port is already provided, we will check this first
+        if ($port > 0) {
+            $hostInfo = parse_url($host);
+            if (!(is_array($hostInfo)
+                && isset($hostInfo['scheme'])
+                && stripos($hostInfo['scheme'], 'ldaps') !== false)) {
+                $portSettings[] = ['port' => $port, 'tls' => true];
+            }
+            $portSettings[] = ['port' => $port, 'tls' => false];
+        }
+
+        //default ports
+        $portSettings = array_merge($portSettings,
+                                    $this->getDefaultLdapPortSettings());
+
+        return $portSettings;
+    }
 }