nextcloud / server

apps/user_ldap/lib/Command/Search.php

Indentation +85 added lines, -85 removed lines

@@ -21,95 +21,95 @@
 use Symfony\Component\Console\Output\OutputInterface;
 
 class Search extends Command {
-	public function __construct(
-		protected IConfig $ocConfig,
-		private User_Proxy $userProxy,
-		private Group_Proxy $groupProxy,
-	) {
-		parent::__construct();
-	}
+    public function __construct(
+        protected IConfig $ocConfig,
+        private User_Proxy $userProxy,
+        private Group_Proxy $groupProxy,
+    ) {
+        parent::__construct();
+    }
 
-	protected function configure(): void {
-		$this
-			->setName('ldap:search')
-			->setDescription('executes a user or group search')
-			->addArgument(
-				'search',
-				InputArgument::REQUIRED,
-				'the search string (can be empty)'
-			)
-			->addOption(
-				'group',
-				null,
-				InputOption::VALUE_NONE,
-				'searches groups instead of users'
-			)
-			->addOption(
-				'offset',
-				null,
-				InputOption::VALUE_REQUIRED,
-				'The offset of the result set. Needs to be a multiple of limit. defaults to 0.',
-				'0'
-			)
-			->addOption(
-				'limit',
-				null,
-				InputOption::VALUE_REQUIRED,
-				'limit the results. 0 means no limit, defaults to 15',
-				'15'
-			)
-		;
-	}
+    protected function configure(): void {
+        $this
+            ->setName('ldap:search')
+            ->setDescription('executes a user or group search')
+            ->addArgument(
+                'search',
+                InputArgument::REQUIRED,
+                'the search string (can be empty)'
+            )
+            ->addOption(
+                'group',
+                null,
+                InputOption::VALUE_NONE,
+                'searches groups instead of users'
+            )
+            ->addOption(
+                'offset',
+                null,
+                InputOption::VALUE_REQUIRED,
+                'The offset of the result set. Needs to be a multiple of limit. defaults to 0.',
+                '0'
+            )
+            ->addOption(
+                'limit',
+                null,
+                InputOption::VALUE_REQUIRED,
+                'limit the results. 0 means no limit, defaults to 15',
+                '15'
+            )
+        ;
+    }
 
-	/**
-	 * Tests whether the offset and limit options are valid
-	 *
-	 * @throws \InvalidArgumentException
-	 */
-	protected function validateOffsetAndLimit(int $offset, int $limit): void {
-		if ($limit < 0) {
-			throw new \InvalidArgumentException('limit must be  0 or greater');
-		}
-		if ($offset < 0) {
-			throw new \InvalidArgumentException('offset must be 0 or greater');
-		}
-		if ($limit === 0 && $offset !== 0) {
-			throw new \InvalidArgumentException('offset must be 0 if limit is also set to 0');
-		}
-		if ($offset > 0 && ($offset % $limit !== 0)) {
-			throw new \InvalidArgumentException('offset must be a multiple of limit');
-		}
-	}
+    /**
+     * Tests whether the offset and limit options are valid
+     *
+     * @throws \InvalidArgumentException
+     */
+    protected function validateOffsetAndLimit(int $offset, int $limit): void {
+        if ($limit < 0) {
+            throw new \InvalidArgumentException('limit must be  0 or greater');
+        }
+        if ($offset < 0) {
+            throw new \InvalidArgumentException('offset must be 0 or greater');
+        }
+        if ($limit === 0 && $offset !== 0) {
+            throw new \InvalidArgumentException('offset must be 0 if limit is also set to 0');
+        }
+        if ($offset > 0 && ($offset % $limit !== 0)) {
+            throw new \InvalidArgumentException('offset must be a multiple of limit');
+        }
+    }
 
-	protected function execute(InputInterface $input, OutputInterface $output): int {
-		$helper = Server::get(Helper::class);
-		$configPrefixes = $helper->getServerConfigurationPrefixes(true);
-		$ldapWrapper = new LDAP();
+    protected function execute(InputInterface $input, OutputInterface $output): int {
+        $helper = Server::get(Helper::class);
+        $configPrefixes = $helper->getServerConfigurationPrefixes(true);
+        $ldapWrapper = new LDAP();
 
-		$offset = (int)$input->getOption('offset');
-		$limit = (int)$input->getOption('limit');
-		$this->validateOffsetAndLimit($offset, $limit);
+        $offset = (int)$input->getOption('offset');
+        $limit = (int)$input->getOption('limit');
+        $this->validateOffsetAndLimit($offset, $limit);
 
-		if ($input->getOption('group')) {
-			$proxy = $this->groupProxy;
-			$getMethod = 'getGroups';
-			$printID = false;
-			// convert the limit of groups to null. This will show all the groups available instead of
-			// nothing, and will match the same behaviour the search for users has.
-			if ($limit === 0) {
-				$limit = null;
-			}
-		} else {
-			$proxy = $this->userProxy;
-			$getMethod = 'getDisplayNames';
-			$printID = true;
-		}
+        if ($input->getOption('group')) {
+            $proxy = $this->groupProxy;
+            $getMethod = 'getGroups';
+            $printID = false;
+            // convert the limit of groups to null. This will show all the groups available instead of
+            // nothing, and will match the same behaviour the search for users has.
+            if ($limit === 0) {
+                $limit = null;
+            }
+        } else {
+            $proxy = $this->userProxy;
+            $getMethod = 'getDisplayNames';
+            $printID = true;
+        }
 
-		$result = $proxy->$getMethod($input->getArgument('search'), $limit, $offset);
-		foreach ($result as $id => $name) {
-			$line = $name . ($printID ? ' (' . $id . ')' : '');
-			$output->writeln($line);
-		}
-		return self::SUCCESS;
-	}
+        $result = $proxy->$getMethod($input->getArgument('search'), $limit, $offset);
+        foreach ($result as $id => $name) {
+            $line = $name . ($printID ? ' (' . $id . ')' : '');
+            $output->writeln($line);
+        }
+        return self::SUCCESS;
+    }
 }

apps/user_ldap/lib/Command/SetConfig.php

Indentation +46 added lines, -46 removed lines

@@ -18,54 +18,54 @@
 use Symfony\Component\Console\Output\OutputInterface;
 
 class SetConfig extends Command {
-	protected function configure(): void {
-		$this
-			->setName('ldap:set-config')
-			->setDescription('modifies an LDAP configuration')
-			->addArgument(
-				'configID',
-				InputArgument::REQUIRED,
-				'the configuration ID'
-			)
-			->addArgument(
-				'configKey',
-				InputArgument::REQUIRED,
-				'the configuration key'
-			)
-			->addArgument(
-				'configValue',
-				InputArgument::REQUIRED,
-				'the new configuration value'
-			)
-		;
-	}
+    protected function configure(): void {
+        $this
+            ->setName('ldap:set-config')
+            ->setDescription('modifies an LDAP configuration')
+            ->addArgument(
+                'configID',
+                InputArgument::REQUIRED,
+                'the configuration ID'
+            )
+            ->addArgument(
+                'configKey',
+                InputArgument::REQUIRED,
+                'the configuration key'
+            )
+            ->addArgument(
+                'configValue',
+                InputArgument::REQUIRED,
+                'the new configuration value'
+            )
+        ;
+    }
 
-	protected function execute(InputInterface $input, OutputInterface $output): int {
-		$helper = Server::get(Helper::class);
-		$availableConfigs = $helper->getServerConfigurationPrefixes();
-		$configID = $input->getArgument('configID');
-		if (!in_array($configID, $availableConfigs)) {
-			$output->writeln('Invalid configID');
-			return self::FAILURE;
-		}
+    protected function execute(InputInterface $input, OutputInterface $output): int {
+        $helper = Server::get(Helper::class);
+        $availableConfigs = $helper->getServerConfigurationPrefixes();
+        $configID = $input->getArgument('configID');
+        if (!in_array($configID, $availableConfigs)) {
+            $output->writeln('Invalid configID');
+            return self::FAILURE;
+        }
 
-		$this->setValue(
-			$configID,
-			$input->getArgument('configKey'),
-			$input->getArgument('configValue')
-		);
-		return self::SUCCESS;
-	}
+        $this->setValue(
+            $configID,
+            $input->getArgument('configKey'),
+            $input->getArgument('configValue')
+        );
+        return self::SUCCESS;
+    }
 
-	/**
-	 * save the configuration value as provided
-	 */
-	protected function setValue(string $configID, string $key, string $value): void {
-		$configHolder = new Configuration($configID);
-		$configHolder->$key = $value;
-		$configHolder->saveConfiguration();
+    /**
+     * save the configuration value as provided
+     */
+    protected function setValue(string $configID, string $key, string $value): void {
+        $configHolder = new Configuration($configID);
+        $configHolder->$key = $value;
+        $configHolder->saveConfiguration();
 
-		$connectionFactory = new ConnectionFactory(new LDAP());
-		$connectionFactory->get($configID)->clearCache();
-	}
+        $connectionFactory = new ConnectionFactory(new LDAP());
+        $connectionFactory->get($configID)->clearCache();
+    }
 }

apps/user_ldap/lib/Settings/Admin.php

Indentation +60 added lines, -60 removed lines

@@ -14,74 +14,74 @@
 use OCP\Template\ITemplateManager;
 
 class Admin implements IDelegatedSettings {
-	public function __construct(
-		private IL10N $l,
-		private ITemplateManager $templateManager,
-	) {
-	}
+    public function __construct(
+        private IL10N $l,
+        private ITemplateManager $templateManager,
+    ) {
+    }
 
-	/**
-	 * @return TemplateResponse
-	 */
-	public function getForm() {
-		$helper = Server::get(Helper::class);
-		$prefixes = $helper->getServerConfigurationPrefixes();
-		if (count($prefixes) === 0) {
-			$newPrefix = $helper->getNextServerConfigurationPrefix();
-			$config = new Configuration($newPrefix, false);
-			$config->setConfiguration($config->getDefaults());
-			$config->saveConfiguration();
-			$prefixes[] = $newPrefix;
-		}
+    /**
+     * @return TemplateResponse
+     */
+    public function getForm() {
+        $helper = Server::get(Helper::class);
+        $prefixes = $helper->getServerConfigurationPrefixes();
+        if (count($prefixes) === 0) {
+            $newPrefix = $helper->getNextServerConfigurationPrefix();
+            $config = new Configuration($newPrefix, false);
+            $config->setConfiguration($config->getDefaults());
+            $config->saveConfiguration();
+            $prefixes[] = $newPrefix;
+        }
 
-		$hosts = $helper->getServerConfigurationHosts();
+        $hosts = $helper->getServerConfigurationHosts();
 
-		$wControls = $this->templateManager->getTemplate('user_ldap', 'part.wizardcontrols');
-		$wControls = $wControls->fetchPage();
-		$sControls = $this->templateManager->getTemplate('user_ldap', 'part.settingcontrols');
-		$sControls = $sControls->fetchPage();
+        $wControls = $this->templateManager->getTemplate('user_ldap', 'part.wizardcontrols');
+        $wControls = $wControls->fetchPage();
+        $sControls = $this->templateManager->getTemplate('user_ldap', 'part.settingcontrols');
+        $sControls = $sControls->fetchPage();
 
-		$parameters = [];
-		$parameters['serverConfigurationPrefixes'] = $prefixes;
-		$parameters['serverConfigurationHosts'] = $hosts;
-		$parameters['settingControls'] = $sControls;
-		$parameters['wizardControls'] = $wControls;
+        $parameters = [];
+        $parameters['serverConfigurationPrefixes'] = $prefixes;
+        $parameters['serverConfigurationHosts'] = $hosts;
+        $parameters['settingControls'] = $sControls;
+        $parameters['wizardControls'] = $wControls;
 
-		// assign default values
-		if (!isset($config)) {
-			$config = new Configuration('', false);
-		}
-		$defaults = $config->getDefaults();
-		foreach ($defaults as $key => $default) {
-			$parameters[$key . '_default'] = $default;
-		}
+        // assign default values
+        if (!isset($config)) {
+            $config = new Configuration('', false);
+        }
+        $defaults = $config->getDefaults();
+        foreach ($defaults as $key => $default) {
+            $parameters[$key . '_default'] = $default;
+        }
 
-		return new TemplateResponse('user_ldap', 'settings', $parameters);
-	}
+        return new TemplateResponse('user_ldap', 'settings', $parameters);
+    }
 
-	/**
-	 * @return string the section ID, e.g. 'sharing'
-	 */
-	public function getSection() {
-		return 'ldap';
-	}
+    /**
+     * @return string the section ID, e.g. 'sharing'
+     */
+    public function getSection() {
+        return 'ldap';
+    }
 
-	/**
-	 * @return int whether the form should be rather on the top or bottom of
-	 *             the admin section. The forms are arranged in ascending order of the
-	 *             priority values. It is required to return a value between 0 and 100.
-	 *
-	 * E.g.: 70
-	 */
-	public function getPriority() {
-		return 5;
-	}
+    /**
+     * @return int whether the form should be rather on the top or bottom of
+     *             the admin section. The forms are arranged in ascending order of the
+     *             priority values. It is required to return a value between 0 and 100.
+     *
+     * E.g.: 70
+     */
+    public function getPriority() {
+        return 5;
+    }
 
-	public function getName(): ?string {
-		return null; // Only one setting in this section
-	}
+    public function getName(): ?string {
+        return null; // Only one setting in this section
+    }
 
-	public function getAuthorizedAppConfig(): array {
-		return []; // Custom controller
-	}
+    public function getAuthorizedAppConfig(): array {
+        return []; // Custom controller
+    }
 }

apps/user_ldap/lib/Helper.php

Indentation +286 added lines, -286 removed lines

@@ -14,290 +14,290 @@
 use OCP\Server;
 
 class Helper {
-	/** @var CappedMemoryCache<string> */
-	protected CappedMemoryCache $sanitizeDnCache;
-
-	public function __construct(
-		private IAppConfig $appConfig,
-		private IDBConnection $connection,
-	) {
-		$this->sanitizeDnCache = new CappedMemoryCache(10000);
-	}
-
-	/**
-	 * returns prefixes for each saved LDAP/AD server configuration.
-	 *
-	 * @param bool $activeConfigurations optional, whether only active configuration shall be
-	 *                                   retrieved, defaults to false
-	 * @return array with a list of the available prefixes
-	 *
-	 * Configuration prefixes are used to set up configurations for n LDAP or
-	 * AD servers. Since configuration is stored in the database, table
-	 * appconfig under appid user_ldap, the common identifiers in column
-	 * 'configkey' have a prefix. The prefix for the very first server
-	 * configuration is empty.
-	 * Configkey Examples:
-	 * Server 1: ldap_login_filter
-	 * Server 2: s1_ldap_login_filter
-	 * Server 3: s2_ldap_login_filter
-	 *
-	 * The prefix needs to be passed to the constructor of Connection class,
-	 * except the default (first) server shall be connected to.
-	 *
-	 */
-	public function getServerConfigurationPrefixes(bool $activeConfigurations = false): array {
-		$all = $this->getAllServerConfigurationPrefixes();
-		if (!$activeConfigurations) {
-			return $all;
-		}
-		return array_values(array_filter(
-			$all,
-			fn (string $prefix): bool => ($this->appConfig->getValueString('user_ldap', $prefix . 'ldap_configuration_active') === '1')
-		));
-	}
-
-	protected function getAllServerConfigurationPrefixes(): array {
-		$unfilled = ['UNFILLED'];
-		$prefixes = $this->appConfig->getValueArray('user_ldap', 'configuration_prefixes', $unfilled);
-		if ($prefixes !== $unfilled) {
-			return $prefixes;
-		}
-
-		/* Fallback to browsing key for migration from Nextcloud<32 */
-		$referenceConfigkey = 'ldap_configuration_active';
-
-		$keys = $this->getServersConfig($referenceConfigkey);
-
-		$prefixes = [];
-		foreach ($keys as $key) {
-			$len = strlen($key) - strlen($referenceConfigkey);
-			$prefixes[] = substr($key, 0, $len);
-		}
-		sort($prefixes);
-
-		$this->appConfig->setValueArray('user_ldap', 'configuration_prefixes', $prefixes);
-
-		return $prefixes;
-	}
-
-	/**
-	 *
-	 * determines the host for every configured connection
-	 *
-	 * @return array<string,string> an array with configprefix as keys
-	 *
-	 */
-	public function getServerConfigurationHosts(): array {
-		$prefixes = $this->getServerConfigurationPrefixes();
-
-		$referenceConfigkey = 'ldap_host';
-		$result = [];
-		foreach ($prefixes as $prefix) {
-			$result[$prefix] = $this->appConfig->getValueString('user_ldap', $prefix . $referenceConfigkey);
-		}
-
-		return $result;
-	}
-
-	/**
-	 * return the next available configuration prefix and register it as used
-	 */
-	public function getNextServerConfigurationPrefix(): string {
-		$prefixes = $this->getServerConfigurationPrefixes();
-
-		if (count($prefixes) === 0) {
-			$prefix = 's01';
-		} else {
-			sort($prefixes);
-			$lastKey = array_pop($prefixes);
-			$lastNumber = (int)str_replace('s', '', $lastKey);
-			$prefix = 's' . str_pad((string)($lastNumber + 1), 2, '0', STR_PAD_LEFT);
-		}
-
-		$prefixes[] = $prefix;
-		$this->appConfig->setValueArray('user_ldap', 'configuration_prefixes', $prefixes);
-		return $prefix;
-	}
-
-	private function getServersConfig(string $value): array {
-		$regex = '/' . $value . '$/S';
-
-		$keys = $this->appConfig->getKeys('user_ldap');
-		$result = [];
-		foreach ($keys as $key) {
-			if (preg_match($regex, $key) === 1) {
-				$result[] = $key;
-			}
-		}
-
-		return $result;
-	}
-
-	/**
-	 * deletes a given saved LDAP/AD server configuration.
-	 *
-	 * @param string $prefix the configuration prefix of the config to delete
-	 * @return bool true on success, false otherwise
-	 */
-	public function deleteServerConfiguration($prefix) {
-		$prefixes = $this->getServerConfigurationPrefixes();
-		$index = array_search($prefix, $prefixes);
-		if ($index === false) {
-			return false;
-		}
-
-		$query = $this->connection->getQueryBuilder();
-		$query->delete('appconfig')
-			->where($query->expr()->eq('appid', $query->createNamedParameter('user_ldap')))
-			->andWhere($query->expr()->like('configkey', $query->createNamedParameter((string)$prefix . '%')))
-			->andWhere($query->expr()->notIn('configkey', $query->createNamedParameter([
-				'enabled',
-				'installed_version',
-				'types',
-				'bgjUpdateGroupsLastRun',
-			], IQueryBuilder::PARAM_STR_ARRAY)));
-
-		if (empty($prefix)) {
-			$query->andWhere($query->expr()->notLike('configkey', $query->createNamedParameter('s%')));
-		}
-
-		$deletedRows = $query->executeStatement();
-
-		unset($prefixes[$index]);
-		$this->appConfig->setValueArray('user_ldap', 'configuration_prefixes', array_values($prefixes));
-
-		return $deletedRows !== 0;
-	}
-
-	/**
-	 * checks whether there is one or more disabled LDAP configurations
-	 */
-	public function haveDisabledConfigurations(): bool {
-		$all = $this->getServerConfigurationPrefixes();
-		foreach ($all as $prefix) {
-			if ($this->appConfig->getValueString('user_ldap', $prefix . 'ldap_configuration_active') !== '1') {
-				return true;
-			}
-		}
-		return false;
-	}
-
-	/**
-	 * extracts the domain from a given URL
-	 *
-	 * @param string $url the URL
-	 * @return string|false domain as string on success, false otherwise
-	 */
-	public function getDomainFromURL($url) {
-		$uinfo = parse_url($url);
-		if (!is_array($uinfo)) {
-			return false;
-		}
-
-		$domain = false;
-		if (isset($uinfo['host'])) {
-			$domain = $uinfo['host'];
-		} elseif (isset($uinfo['path'])) {
-			$domain = $uinfo['path'];
-		}
-
-		return $domain;
-	}
-
-	/**
-	 * sanitizes a DN received from the LDAP server
-	 *
-	 * This is used and done to have a stable format of DNs that can be compared
-	 * and identified again. The input DN value is modified as following:
-	 *
-	 * 1) whitespaces after commas are removed
-	 * 2) the DN is turned to lower-case
-	 * 3) the DN is escaped according to RFC 2253
-	 *
-	 * When a future DN is supposed to be used as a base parameter, it has to be
-	 * run through DNasBaseParameter() first, to recode \5c into a backslash
-	 * again, otherwise the search or read operation will fail with LDAP error
-	 * 32, NO_SUCH_OBJECT. Regular usage in LDAP filters requires the backslash
-	 * being escaped, however.
-	 *
-	 * Internally, DNs are stored in their sanitized form.
-	 *
-	 * @param array|string $dn the DN in question
-	 * @return array|string the sanitized DN
-	 */
-	public function sanitizeDN($dn) {
-		//treating multiple base DNs
-		if (is_array($dn)) {
-			$result = [];
-			foreach ($dn as $singleDN) {
-				$result[] = $this->sanitizeDN($singleDN);
-			}
-			return $result;
-		}
-
-		if (!is_string($dn)) {
-			throw new \LogicException('String expected ' . \gettype($dn) . ' given');
-		}
-
-		if (($sanitizedDn = $this->sanitizeDnCache->get($dn)) !== null) {
-			return $sanitizedDn;
-		}
-
-		//OID sometimes gives back DNs with whitespace after the comma
-		// a la "uid=foo, cn=bar, dn=..." We need to tackle this!
-		$sanitizedDn = preg_replace('/([^\\\]),(\s+)/u', '\1,', $dn);
-
-		//make comparisons and everything work
-		$sanitizedDn = mb_strtolower($sanitizedDn, 'UTF-8');
-
-		//escape DN values according to RFC 2253 – this is already done by ldap_explode_dn
-		//to use the DN in search filters, \ needs to be escaped to \5c additionally
-		//to use them in bases, we convert them back to simple backslashes in readAttribute()
-		$replacements = [
-			'\,' => '\5c2C',
-			'\=' => '\5c3D',
-			'\+' => '\5c2B',
-			'\<' => '\5c3C',
-			'\>' => '\5c3E',
-			'\;' => '\5c3B',
-			'\"' => '\5c22',
-			'\#' => '\5c23',
-			'(' => '\28',
-			')' => '\29',
-			'*' => '\2A',
-		];
-		$sanitizedDn = str_replace(array_keys($replacements), array_values($replacements), $sanitizedDn);
-		$this->sanitizeDnCache->set($dn, $sanitizedDn);
-
-		return $sanitizedDn;
-	}
-
-	/**
-	 * converts a stored DN so it can be used as base parameter for LDAP queries, internally we store them for usage in LDAP filters
-	 *
-	 * @param string $dn the DN
-	 * @return string
-	 */
-	public function DNasBaseParameter($dn) {
-		return str_ireplace('\\5c', '\\', $dn);
-	}
-
-	/**
-	 * listens to a hook thrown by server2server sharing and replaces the given
-	 * login name by a username, if it matches an LDAP user.
-	 *
-	 * @param array $param contains a reference to a $uid var under 'uid' key
-	 * @throws \Exception
-	 */
-	public static function loginName2UserName($param): void {
-		if (!isset($param['uid'])) {
-			throw new \Exception('key uid is expected to be set in $param');
-		}
-
-		$userBackend = Server::get(User_Proxy::class);
-		$uid = $userBackend->loginName2UserName($param['uid']);
-		if ($uid !== false) {
-			$param['uid'] = $uid;
-		}
-	}
+    /** @var CappedMemoryCache<string> */
+    protected CappedMemoryCache $sanitizeDnCache;
+
+    public function __construct(
+        private IAppConfig $appConfig,
+        private IDBConnection $connection,
+    ) {
+        $this->sanitizeDnCache = new CappedMemoryCache(10000);
+    }
+
+    /**
+     * returns prefixes for each saved LDAP/AD server configuration.
+     *
+     * @param bool $activeConfigurations optional, whether only active configuration shall be
+     *                                   retrieved, defaults to false
+     * @return array with a list of the available prefixes
+     *
+     * Configuration prefixes are used to set up configurations for n LDAP or
+     * AD servers. Since configuration is stored in the database, table
+     * appconfig under appid user_ldap, the common identifiers in column
+     * 'configkey' have a prefix. The prefix for the very first server
+     * configuration is empty.
+     * Configkey Examples:
+     * Server 1: ldap_login_filter
+     * Server 2: s1_ldap_login_filter
+     * Server 3: s2_ldap_login_filter
+     *
+     * The prefix needs to be passed to the constructor of Connection class,
+     * except the default (first) server shall be connected to.
+     *
+     */
+    public function getServerConfigurationPrefixes(bool $activeConfigurations = false): array {
+        $all = $this->getAllServerConfigurationPrefixes();
+        if (!$activeConfigurations) {
+            return $all;
+        }
+        return array_values(array_filter(
+            $all,
+            fn (string $prefix): bool => ($this->appConfig->getValueString('user_ldap', $prefix . 'ldap_configuration_active') === '1')
+        ));
+    }
+
+    protected function getAllServerConfigurationPrefixes(): array {
+        $unfilled = ['UNFILLED'];
+        $prefixes = $this->appConfig->getValueArray('user_ldap', 'configuration_prefixes', $unfilled);
+        if ($prefixes !== $unfilled) {
+            return $prefixes;
+        }
+
+        /* Fallback to browsing key for migration from Nextcloud<32 */
+        $referenceConfigkey = 'ldap_configuration_active';
+
+        $keys = $this->getServersConfig($referenceConfigkey);
+
+        $prefixes = [];
+        foreach ($keys as $key) {
+            $len = strlen($key) - strlen($referenceConfigkey);
+            $prefixes[] = substr($key, 0, $len);
+        }
+        sort($prefixes);
+
+        $this->appConfig->setValueArray('user_ldap', 'configuration_prefixes', $prefixes);
+
+        return $prefixes;
+    }
+
+    /**
+     *
+     * determines the host for every configured connection
+     *
+     * @return array<string,string> an array with configprefix as keys
+     *
+     */
+    public function getServerConfigurationHosts(): array {
+        $prefixes = $this->getServerConfigurationPrefixes();
+
+        $referenceConfigkey = 'ldap_host';
+        $result = [];
+        foreach ($prefixes as $prefix) {
+            $result[$prefix] = $this->appConfig->getValueString('user_ldap', $prefix . $referenceConfigkey);
+        }
+
+        return $result;
+    }
+
+    /**
+     * return the next available configuration prefix and register it as used
+     */
+    public function getNextServerConfigurationPrefix(): string {
+        $prefixes = $this->getServerConfigurationPrefixes();
+
+        if (count($prefixes) === 0) {
+            $prefix = 's01';
+        } else {
+            sort($prefixes);
+            $lastKey = array_pop($prefixes);
+            $lastNumber = (int)str_replace('s', '', $lastKey);
+            $prefix = 's' . str_pad((string)($lastNumber + 1), 2, '0', STR_PAD_LEFT);
+        }
+
+        $prefixes[] = $prefix;
+        $this->appConfig->setValueArray('user_ldap', 'configuration_prefixes', $prefixes);
+        return $prefix;
+    }
+
+    private function getServersConfig(string $value): array {
+        $regex = '/' . $value . '$/S';
+
+        $keys = $this->appConfig->getKeys('user_ldap');
+        $result = [];
+        foreach ($keys as $key) {
+            if (preg_match($regex, $key) === 1) {
+                $result[] = $key;
+            }
+        }
+
+        return $result;
+    }
+
+    /**
+     * deletes a given saved LDAP/AD server configuration.
+     *
+     * @param string $prefix the configuration prefix of the config to delete
+     * @return bool true on success, false otherwise
+     */
+    public function deleteServerConfiguration($prefix) {
+        $prefixes = $this->getServerConfigurationPrefixes();
+        $index = array_search($prefix, $prefixes);
+        if ($index === false) {
+            return false;
+        }
+
+        $query = $this->connection->getQueryBuilder();
+        $query->delete('appconfig')
+            ->where($query->expr()->eq('appid', $query->createNamedParameter('user_ldap')))
+            ->andWhere($query->expr()->like('configkey', $query->createNamedParameter((string)$prefix . '%')))
+            ->andWhere($query->expr()->notIn('configkey', $query->createNamedParameter([
+                'enabled',
+                'installed_version',
+                'types',
+                'bgjUpdateGroupsLastRun',
+            ], IQueryBuilder::PARAM_STR_ARRAY)));
+
+        if (empty($prefix)) {
+            $query->andWhere($query->expr()->notLike('configkey', $query->createNamedParameter('s%')));
+        }
+
+        $deletedRows = $query->executeStatement();
+
+        unset($prefixes[$index]);
+        $this->appConfig->setValueArray('user_ldap', 'configuration_prefixes', array_values($prefixes));
+
+        return $deletedRows !== 0;
+    }
+
+    /**
+     * checks whether there is one or more disabled LDAP configurations
+     */
+    public function haveDisabledConfigurations(): bool {
+        $all = $this->getServerConfigurationPrefixes();
+        foreach ($all as $prefix) {
+            if ($this->appConfig->getValueString('user_ldap', $prefix . 'ldap_configuration_active') !== '1') {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * extracts the domain from a given URL
+     *
+     * @param string $url the URL
+     * @return string|false domain as string on success, false otherwise
+     */
+    public function getDomainFromURL($url) {
+        $uinfo = parse_url($url);
+        if (!is_array($uinfo)) {
+            return false;
+        }
+
+        $domain = false;
+        if (isset($uinfo['host'])) {
+            $domain = $uinfo['host'];
+        } elseif (isset($uinfo['path'])) {
+            $domain = $uinfo['path'];
+        }
+
+        return $domain;
+    }
+
+    /**
+     * sanitizes a DN received from the LDAP server
+     *
+     * This is used and done to have a stable format of DNs that can be compared
+     * and identified again. The input DN value is modified as following:
+     *
+     * 1) whitespaces after commas are removed
+     * 2) the DN is turned to lower-case
+     * 3) the DN is escaped according to RFC 2253
+     *
+     * When a future DN is supposed to be used as a base parameter, it has to be
+     * run through DNasBaseParameter() first, to recode \5c into a backslash
+     * again, otherwise the search or read operation will fail with LDAP error
+     * 32, NO_SUCH_OBJECT. Regular usage in LDAP filters requires the backslash
+     * being escaped, however.
+     *
+     * Internally, DNs are stored in their sanitized form.
+     *
+     * @param array|string $dn the DN in question
+     * @return array|string the sanitized DN
+     */
+    public function sanitizeDN($dn) {
+        //treating multiple base DNs
+        if (is_array($dn)) {
+            $result = [];
+            foreach ($dn as $singleDN) {
+                $result[] = $this->sanitizeDN($singleDN);
+            }
+            return $result;
+        }
+
+        if (!is_string($dn)) {
+            throw new \LogicException('String expected ' . \gettype($dn) . ' given');
+        }
+
+        if (($sanitizedDn = $this->sanitizeDnCache->get($dn)) !== null) {
+            return $sanitizedDn;
+        }
+
+        //OID sometimes gives back DNs with whitespace after the comma
+        // a la "uid=foo, cn=bar, dn=..." We need to tackle this!
+        $sanitizedDn = preg_replace('/([^\\\]),(\s+)/u', '\1,', $dn);
+
+        //make comparisons and everything work
+        $sanitizedDn = mb_strtolower($sanitizedDn, 'UTF-8');
+
+        //escape DN values according to RFC 2253 – this is already done by ldap_explode_dn
+        //to use the DN in search filters, \ needs to be escaped to \5c additionally
+        //to use them in bases, we convert them back to simple backslashes in readAttribute()
+        $replacements = [
+            '\,' => '\5c2C',
+            '\=' => '\5c3D',
+            '\+' => '\5c2B',
+            '\<' => '\5c3C',
+            '\>' => '\5c3E',
+            '\;' => '\5c3B',
+            '\"' => '\5c22',
+            '\#' => '\5c23',
+            '(' => '\28',
+            ')' => '\29',
+            '*' => '\2A',
+        ];
+        $sanitizedDn = str_replace(array_keys($replacements), array_values($replacements), $sanitizedDn);
+        $this->sanitizeDnCache->set($dn, $sanitizedDn);
+
+        return $sanitizedDn;
+    }
+
+    /**
+     * converts a stored DN so it can be used as base parameter for LDAP queries, internally we store them for usage in LDAP filters
+     *
+     * @param string $dn the DN
+     * @return string
+     */
+    public function DNasBaseParameter($dn) {
+        return str_ireplace('\\5c', '\\', $dn);
+    }
+
+    /**
+     * listens to a hook thrown by server2server sharing and replaces the given
+     * login name by a username, if it matches an LDAP user.
+     *
+     * @param array $param contains a reference to a $uid var under 'uid' key
+     * @throws \Exception
+     */
+    public static function loginName2UserName($param): void {
+        if (!isset($param['uid'])) {
+            throw new \Exception('key uid is expected to be set in $param');
+        }
+
+        $userBackend = Server::get(User_Proxy::class);
+        $uid = $userBackend->loginName2UserName($param['uid']);
+        if ($uid !== false) {
+            $param['uid'] = $uid;
+        }
+    }
 }

Spacing +8 added lines, -8 removed lines

@@ -52,7 +52,7 @@ 
 		}
 		return array_values(array_filter(
 			$all,
-			fn (string $prefix): bool => ($this->appConfig->getValueString('user_ldap', $prefix . 'ldap_configuration_active') === '1')
+			fn (string $prefix): bool => ($this->appConfig->getValueString('user_ldap', $prefix.'ldap_configuration_active') === '1')
 		));
 	}
 
@@ -93,7 +93,7 @@ 
 		$referenceConfigkey = 'ldap_host';
 		$result = [];
 		foreach ($prefixes as $prefix) {
-			$result[$prefix] = $this->appConfig->getValueString('user_ldap', $prefix . $referenceConfigkey);
+			$result[$prefix] = $this->appConfig->getValueString('user_ldap', $prefix.$referenceConfigkey);
 		}
 
 		return $result;
@@ -110,8 +110,8 @@ 
 		} else {
 			sort($prefixes);
 			$lastKey = array_pop($prefixes);
-			$lastNumber = (int)str_replace('s', '', $lastKey);
-			$prefix = 's' . str_pad((string)($lastNumber + 1), 2, '0', STR_PAD_LEFT);
+			$lastNumber = (int) str_replace('s', '', $lastKey);
+			$prefix = 's'.str_pad((string) ($lastNumber + 1), 2, '0', STR_PAD_LEFT);
 		}
 
 		$prefixes[] = $prefix;
@@ -120,7 +120,7 @@ 
 	}
 
 	private function getServersConfig(string $value): array {
-		$regex = '/' . $value . '$/S';
+		$regex = '/'.$value.'$/S';
 
 		$keys = $this->appConfig->getKeys('user_ldap');
 		$result = [];
@@ -149,7 +149,7 @@ 
 		$query = $this->connection->getQueryBuilder();
 		$query->delete('appconfig')
 			->where($query->expr()->eq('appid', $query->createNamedParameter('user_ldap')))
-			->andWhere($query->expr()->like('configkey', $query->createNamedParameter((string)$prefix . '%')))
+			->andWhere($query->expr()->like('configkey', $query->createNamedParameter((string) $prefix.'%')))
 			->andWhere($query->expr()->notIn('configkey', $query->createNamedParameter([
 				'enabled',
 				'installed_version',
@@ -175,7 +175,7 @@ 
 	public function haveDisabledConfigurations(): bool {
 		$all = $this->getServerConfigurationPrefixes();
 		foreach ($all as $prefix) {
-			if ($this->appConfig->getValueString('user_ldap', $prefix . 'ldap_configuration_active') !== '1') {
+			if ($this->appConfig->getValueString('user_ldap', $prefix.'ldap_configuration_active') !== '1') {
 				return true;
 			}
 		}
@@ -236,7 +236,7 @@ 
 		}
 
 		if (!is_string($dn)) {
-			throw new \LogicException('String expected ' . \gettype($dn) . ' given');
+			throw new \LogicException('String expected '.\gettype($dn).' given');
 		}
 
 		if (($sanitizedDn = $this->sanitizeDnCache->get($dn)) !== null) {

apps/user_ldap/lib/Connection.php

Indentation +683 added lines, -683 removed lines

@@ -94,687 +94,687 @@
  * @property string $ldapAttributePronouns
  */
 class Connection extends LDAPUtility {
-	private ?\LDAP\Connection $ldapConnectionRes = null;
-	private bool $configured = false;
-
-	/**
-	 * @var bool whether connection should be kept on __destruct
-	 */
-	private bool $dontDestruct = false;
-
-	/**
-	 * @var bool runtime flag that indicates whether supported primary groups are available
-	 */
-	public $hasPrimaryGroups = true;
-
-	/**
-	 * @var bool runtime flag that indicates whether supported POSIX gidNumber are available
-	 */
-	public $hasGidNumber = true;
-
-	/**
-	 * @var ICache|null
-	 */
-	protected $cache = null;
-
-	/** @var Configuration settings handler * */
-	protected $configuration;
-
-	/**
-	 * @var bool
-	 */
-	protected $doNotValidate = false;
-
-	/**
-	 * @var bool
-	 */
-	protected $ignoreValidation = false;
-
-	/**
-	 * @var array{sum?: string, result?: bool}
-	 */
-	protected $bindResult = [];
-
-	protected LoggerInterface $logger;
-	private IL10N $l10n;
-
-	/**
-	 * Constructor
-	 * @param string $configPrefix a string with the prefix for the configkey column (appconfig table)
-	 * @param string|null $configID a string with the value for the appid column (appconfig table) or null for on-the-fly connections
-	 */
-	public function __construct(
-		ILDAPWrapper $ldap,
-		private string $configPrefix = '',
-		private ?string $configID = 'user_ldap',
-	) {
-		parent::__construct($ldap);
-		$this->configuration = new Configuration($this->configPrefix, !is_null($this->configID));
-		$memcache = Server::get(ICacheFactory::class);
-		if ($memcache->isAvailable()) {
-			$this->cache = $memcache->createDistributed();
-		}
-		$helper = Server::get(Helper::class);
-		$this->doNotValidate = !in_array($this->configPrefix,
-			$helper->getServerConfigurationPrefixes());
-		$this->logger = Server::get(LoggerInterface::class);
-		$this->l10n = Util::getL10N('user_ldap');
-	}
-
-	public function __destruct() {
-		if (!$this->dontDestruct && $this->ldap->isResource($this->ldapConnectionRes)) {
-			@$this->ldap->unbind($this->ldapConnectionRes);
-			$this->bindResult = [];
-		}
-	}
-
-	/**
-	 * defines behaviour when the instance is cloned
-	 */
-	public function __clone() {
-		$this->configuration = new Configuration($this->configPrefix,
-			!is_null($this->configID));
-		if (count($this->bindResult) !== 0 && $this->bindResult['result'] === true) {
-			$this->bindResult = [];
-		}
-		$this->ldapConnectionRes = null;
-		$this->dontDestruct = true;
-	}
-
-	public function __get(string $name) {
-		if (!$this->configured) {
-			$this->readConfiguration();
-		}
-
-		return $this->configuration->$name;
-	}
-
-	/**
-	 * @param string $name
-	 * @param mixed $value
-	 */
-	public function __set($name, $value) {
-		$this->doNotValidate = false;
-		$before = $this->configuration->$name;
-		$this->configuration->$name = $value;
-		$after = $this->configuration->$name;
-		if ($before !== $after) {
-			if ($this->configID !== '' && $this->configID !== null) {
-				$this->configuration->saveConfiguration();
-			}
-			$this->validateConfiguration();
-		}
-	}
-
-	/**
-	 * @param string $rule
-	 * @return array
-	 * @throws \RuntimeException
-	 */
-	public function resolveRule($rule) {
-		return $this->configuration->resolveRule($rule);
-	}
-
-	/**
-	 * sets whether the result of the configuration validation shall
-	 * be ignored when establishing the connection. Used by the Wizard
-	 * in early configuration state.
-	 * @param bool $state
-	 */
-	public function setIgnoreValidation($state) {
-		$this->ignoreValidation = (bool)$state;
-	}
-
-	/**
-	 * initializes the LDAP backend
-	 * @param bool $force read the config settings no matter what
-	 */
-	public function init($force = false) {
-		$this->readConfiguration($force);
-		$this->establishConnection();
-	}
-
-	/**
-	 * @return \LDAP\Connection The LDAP resource
-	 */
-	public function getConnectionResource(): \LDAP\Connection {
-		if (!$this->ldapConnectionRes) {
-			$this->init();
-		}
-		if (is_null($this->ldapConnectionRes)) {
-			$this->logger->error(
-				'No LDAP Connection to server ' . $this->configuration->ldapHost,
-				['app' => 'user_ldap']
-			);
-			throw new ServerNotAvailableException('Connection to LDAP server could not be established');
-		}
-		return $this->ldapConnectionRes;
-	}
-
-	/**
-	 * resets the connection resource
-	 */
-	public function resetConnectionResource(): void {
-		if (!is_null($this->ldapConnectionRes)) {
-			@$this->ldap->unbind($this->ldapConnectionRes);
-			$this->ldapConnectionRes = null;
-			$this->bindResult = [];
-		}
-	}
-
-	/**
-	 * @param string|null $key
-	 */
-	private function getCacheKey($key): string {
-		$prefix = 'LDAP-' . $this->configID . '-' . $this->configPrefix . '-';
-		if (is_null($key)) {
-			return $prefix;
-		}
-		return $prefix . hash('sha256', $key);
-	}
-
-	/**
-	 * @param string $key
-	 * @return mixed|null
-	 */
-	public function getFromCache($key) {
-		if (!$this->configured) {
-			$this->readConfiguration();
-		}
-		if (is_null($this->cache) || !$this->configuration->ldapCacheTTL) {
-			return null;
-		}
-		$key = $this->getCacheKey($key);
-
-		return json_decode(base64_decode($this->cache->get($key) ?? ''), true);
-	}
-
-	public function getConfigPrefix(): string {
-		return $this->configPrefix;
-	}
-
-	/**
-	 * @param string $key
-	 * @param mixed $value
-	 */
-	public function writeToCache($key, $value, ?int $ttlOverride = null): void {
-		if (!$this->configured) {
-			$this->readConfiguration();
-		}
-		if (is_null($this->cache)
-			|| !$this->configuration->ldapCacheTTL
-			|| !$this->configuration->ldapConfigurationActive) {
-			return;
-		}
-		$key = $this->getCacheKey($key);
-		$value = base64_encode(json_encode($value));
-		$ttl = $ttlOverride ?? $this->configuration->ldapCacheTTL;
-		$this->cache->set($key, $value, $ttl);
-	}
-
-	public function clearCache() {
-		if (!is_null($this->cache)) {
-			$this->cache->clear($this->getCacheKey(null));
-		}
-	}
-
-	/**
-	 * Caches the general LDAP configuration.
-	 * @param bool $force optional. true, if the re-read should be forced. defaults
-	 *                    to false.
-	 */
-	private function readConfiguration(bool $force = false): void {
-		if ((!$this->configured || $force) && !is_null($this->configID)) {
-			$this->configuration->readConfiguration();
-			$this->configured = $this->validateConfiguration();
-		}
-	}
-
-	/**
-	 * set LDAP configuration with values delivered by an array, not read from configuration
-	 * @param array $config array that holds the config parameters in an associated array
-	 * @param array &$setParameters optional; array where the set fields will be given to
-	 * @param bool $throw if true, throw ConfigurationIssueException with details instead of returning false
-	 * @return bool true if config validates, false otherwise. Check with $setParameters for detailed success on single parameters
-	 */
-	public function setConfiguration(array $config, ?array &$setParameters = null, bool $throw = false): bool {
-		if (is_null($setParameters)) {
-			$setParameters = [];
-		}
-		$this->doNotValidate = false;
-		$this->configuration->setConfiguration($config, $setParameters);
-		if (count($setParameters) > 0) {
-			$this->configured = $this->validateConfiguration($throw);
-		}
-
-
-		return $this->configured;
-	}
-
-	/**
-	 * saves the current Configuration in the database and empties the
-	 * cache
-	 * @return null
-	 */
-	public function saveConfiguration() {
-		$this->configuration->saveConfiguration();
-		$this->clearCache();
-	}
-
-	/**
-	 * get the current LDAP configuration
-	 * @return array
-	 */
-	public function getConfiguration() {
-		$this->readConfiguration();
-		$config = $this->configuration->getConfiguration();
-		$cta = $this->configuration->getConfigTranslationArray();
-		$result = [];
-		foreach ($cta as $dbkey => $configkey) {
-			switch ($configkey) {
-				case 'homeFolderNamingRule':
-					if (str_starts_with($config[$configkey], 'attr:')) {
-						$result[$dbkey] = substr($config[$configkey], 5);
-					} else {
-						$result[$dbkey] = '';
-					}
-					break;
-				case 'ldapBase':
-				case 'ldapBaseUsers':
-				case 'ldapBaseGroups':
-				case 'ldapAttributesForUserSearch':
-				case 'ldapAttributesForGroupSearch':
-					if (is_array($config[$configkey])) {
-						$result[$dbkey] = implode("\n", $config[$configkey]);
-						break;
-					} //else follows default
-					// no break
-				default:
-					$result[$dbkey] = $config[$configkey];
-			}
-		}
-		return $result;
-	}
-
-	private function doSoftValidation(): void {
-		//if User or Group Base are not set, take over Base DN setting
-		foreach (['ldapBaseUsers', 'ldapBaseGroups'] as $keyBase) {
-			$val = $this->configuration->$keyBase;
-			if (empty($val)) {
-				$this->configuration->$keyBase = $this->configuration->ldapBase;
-			}
-		}
-
-		foreach (['ldapExpertUUIDUserAttr' => 'ldapUuidUserAttribute',
-			'ldapExpertUUIDGroupAttr' => 'ldapUuidGroupAttribute'] as $expertSetting => $effectiveSetting) {
-			$uuidOverride = $this->configuration->$expertSetting;
-			if (!empty($uuidOverride)) {
-				$this->configuration->$effectiveSetting = $uuidOverride;
-			} else {
-				$uuidAttributes = Access::UUID_ATTRIBUTES;
-				array_unshift($uuidAttributes, 'auto');
-				if (!in_array($this->configuration->$effectiveSetting, $uuidAttributes)
-					&& !is_null($this->configID)) {
-					$this->configuration->$effectiveSetting = 'auto';
-					$this->configuration->saveConfiguration();
-					$this->logger->info(
-						'Illegal value for the ' . $effectiveSetting . ', reset to autodetect.',
-						['app' => 'user_ldap']
-					);
-				}
-			}
-		}
-
-		$backupPort = (int)$this->configuration->ldapBackupPort;
-		if ($backupPort <= 0) {
-			$this->configuration->ldapBackupPort = $this->configuration->ldapPort;
-		}
-
-		//make sure empty search attributes are saved as simple, empty array
-		$saKeys = ['ldapAttributesForUserSearch',
-			'ldapAttributesForGroupSearch'];
-		foreach ($saKeys as $key) {
-			$val = $this->configuration->$key;
-			if (is_array($val) && count($val) === 1 && empty($val[0])) {
-				$this->configuration->$key = [];
-			}
-		}
-
-		if ((stripos((string)$this->configuration->ldapHost, 'ldaps://') === 0)
-			&& $this->configuration->ldapTLS) {
-			$this->configuration->ldapTLS = (string)false;
-			$this->logger->info(
-				'LDAPS (already using secure connection) and TLS do not work together. Switched off TLS.',
-				['app' => 'user_ldap']
-			);
-		}
-	}
-
-	/**
-	 * @throws ConfigurationIssueException
-	 */
-	private function doCriticalValidation(): void {
-		//options that shall not be empty
-		$options = ['ldapHost', 'ldapUserDisplayName',
-			'ldapGroupDisplayName', 'ldapLoginFilter'];
-
-		//ldapPort should not be empty either unless ldapHost is pointing to a socket
-		if (!$this->configuration->usesLdapi()) {
-			$options[] = 'ldapPort';
-		}
-
-		foreach ($options as $key) {
-			$val = $this->configuration->$key;
-			if (empty($val)) {
-				switch ($key) {
-					case 'ldapHost':
-						$subj = 'LDAP Host';
-						break;
-					case 'ldapPort':
-						$subj = 'LDAP Port';
-						break;
-					case 'ldapUserDisplayName':
-						$subj = 'LDAP User Display Name';
-						break;
-					case 'ldapGroupDisplayName':
-						$subj = 'LDAP Group Display Name';
-						break;
-					case 'ldapLoginFilter':
-						$subj = 'LDAP Login Filter';
-						break;
-					default:
-						$subj = $key;
-						break;
-				}
-				throw new ConfigurationIssueException(
-					'No ' . $subj . ' given!',
-					$this->l10n->t('Mandatory field "%s" left empty', $subj),
-				);
-			}
-		}
-
-		//combinations
-		$agent = $this->configuration->ldapAgentName;
-		$pwd = $this->configuration->ldapAgentPassword;
-		if ($agent === '' && $pwd !== '') {
-			throw new ConfigurationIssueException(
-				'A password is given, but not an LDAP agent',
-				$this->l10n->t('A password is given, but not an LDAP agent'),
-			);
-		}
-		if ($agent !== '' && $pwd === '') {
-			throw new ConfigurationIssueException(
-				'No password is given for the user agent',
-				$this->l10n->t('No password is given for the user agent'),
-			);
-		}
-
-		$base = $this->configuration->ldapBase;
-		$baseUsers = $this->configuration->ldapBaseUsers;
-		$baseGroups = $this->configuration->ldapBaseGroups;
-
-		if (empty($base)) {
-			throw new ConfigurationIssueException(
-				'Not a single Base DN given',
-				$this->l10n->t('No LDAP base DN was given'),
-			);
-		}
-
-		if (!empty($baseUsers) && !$this->checkBasesAreValid($baseUsers, $base)) {
-			throw new ConfigurationIssueException(
-				'User base is not in root base',
-				$this->l10n->t('User base DN is not a subnode of global base DN'),
-			);
-		}
-
-		if (!empty($baseGroups) && !$this->checkBasesAreValid($baseGroups, $base)) {
-			throw new ConfigurationIssueException(
-				'Group base is not in root base',
-				$this->l10n->t('Group base DN is not a subnode of global base DN'),
-			);
-		}
-
-		if (mb_strpos((string)$this->configuration->ldapLoginFilter, '%uid', 0, 'UTF-8') === false) {
-			throw new ConfigurationIssueException(
-				'Login filter does not contain %uid placeholder.',
-				$this->l10n->t('Login filter does not contain %s placeholder.', ['%uid']),
-			);
-		}
-	}
-
-	/**
-	 * Checks that all bases are subnodes of one of the root bases
-	 */
-	private function checkBasesAreValid(array $bases, array $rootBases): bool {
-		foreach ($bases as $base) {
-			$ok = false;
-			foreach ($rootBases as $rootBase) {
-				if (str_ends_with($base, $rootBase)) {
-					$ok = true;
-					break;
-				}
-			}
-			if (!$ok) {
-				return false;
-			}
-		}
-		return true;
-	}
-
-	/**
-	 * Validates the user specified configuration
-	 * @return bool true if configuration seems OK, false otherwise
-	 */
-	private function validateConfiguration(bool $throw = false): bool {
-		if ($this->doNotValidate) {
-			//don't do a validation if it is a new configuration with pure
-			//default values. Will be allowed on changes via __set or
-			//setConfiguration
-			return false;
-		}
-
-		// first step: "soft" checks: settings that are not really
-		// necessary, but advisable. If left empty, give an info message
-		$this->doSoftValidation();
-
-		//second step: critical checks. If left empty or filled wrong, mark as
-		//not configured and give a warning.
-		try {
-			$this->doCriticalValidation();
-			return true;
-		} catch (ConfigurationIssueException $e) {
-			if ($throw) {
-				throw $e;
-			}
-			$this->logger->warning(
-				'Configuration Error (prefix ' . $this->configPrefix . '): ' . $e->getMessage(),
-				['exception' => $e]
-			);
-			return false;
-		}
-	}
-
-
-	/**
-	 * Connects and Binds to LDAP
-	 *
-	 * @throws ServerNotAvailableException
-	 */
-	private function establishConnection(): ?bool {
-		if (!$this->configuration->ldapConfigurationActive) {
-			return null;
-		}
-		static $phpLDAPinstalled = true;
-		if (!$phpLDAPinstalled) {
-			return false;
-		}
-		if (!$this->ignoreValidation && !$this->configured) {
-			$this->logger->warning(
-				'Configuration is invalid, cannot connect',
-				['app' => 'user_ldap']
-			);
-			return false;
-		}
-		if (!$this->ldapConnectionRes) {
-			if (!$this->ldap->areLDAPFunctionsAvailable()) {
-				$phpLDAPinstalled = false;
-				$this->logger->error(
-					'function ldap_connect is not available. Make sure that the PHP ldap module is installed.',
-					['app' => 'user_ldap']
-				);
-
-				return false;
-			}
-
-			$hasBackupHost = (trim($this->configuration->ldapBackupHost ?? '') !== '');
-			$hasBackgroundHost = (trim($this->configuration->ldapBackgroundHost ?? '') !== '');
-			$useBackgroundHost = (\OC::$CLI && $hasBackgroundHost);
-			$overrideCacheKey = ($useBackgroundHost ? 'overrideBackgroundServer' : 'overrideMainServer');
-			$forceBackupHost = ($this->configuration->ldapOverrideMainServer || $this->getFromCache($overrideCacheKey));
-			$bindStatus = false;
-			if (!$forceBackupHost) {
-				try {
-					$host = $this->configuration->ldapHost ?? '';
-					$port = $this->configuration->ldapPort ?? '';
-					if ($useBackgroundHost) {
-						$host = $this->configuration->ldapBackgroundHost ?? '';
-						$port = $this->configuration->ldapBackgroundPort ?? '';
-					}
-					$this->doConnect($host, $port);
-					return $this->bind();
-				} catch (ServerNotAvailableException $e) {
-					if (!$hasBackupHost) {
-						throw $e;
-					}
-				}
-				$this->logger->warning(
-					'Main LDAP not reachable, connecting to backup: {msg}',
-					[
-						'app' => 'user_ldap',
-						'msg' => $e->getMessage(),
-						'exception' => $e,
-					]
-				);
-			}
-
-			// if LDAP server is not reachable, try the Backup (Replica!) Server
-			$this->doConnect($this->configuration->ldapBackupHost ?? '', $this->configuration->ldapBackupPort ?? '');
-			$this->bindResult = [];
-			$bindStatus = $this->bind();
-			$error = $this->ldap->isResource($this->ldapConnectionRes) ?
-				$this->ldap->errno($this->ldapConnectionRes) : -1;
-			if ($bindStatus && $error === 0 && !$forceBackupHost) {
-				//when bind to backup server succeeded and failed to main server,
-				//skip contacting it for 15min
-				$this->writeToCache($overrideCacheKey, true, 60 * 15);
-			}
-
-			return $bindStatus;
-		}
-		return null;
-	}
-
-	/**
-	 * @param string $host
-	 * @param string $port
-	 * @throws \OC\ServerNotAvailableException
-	 */
-	private function doConnect($host, $port): bool {
-		if ($host === '') {
-			return false;
-		}
-
-		$this->ldapConnectionRes = $this->ldap->connect($host, $port) ?: null;
-
-		if ($this->ldapConnectionRes === null) {
-			throw new ServerNotAvailableException('Connection failed');
-		}
-
-		if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_PROTOCOL_VERSION, 3)) {
-			throw new ServerNotAvailableException('Could not set required LDAP Protocol version.');
-		}
-
-		if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_REFERRALS, 0)) {
-			throw new ServerNotAvailableException('Could not disable LDAP referrals.');
-		}
-
-		if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_NETWORK_TIMEOUT, $this->configuration->ldapConnectionTimeout)) {
-			throw new ServerNotAvailableException('Could not set network timeout');
-		}
-
-		if ($this->configuration->ldapTLS) {
-			if ($this->configuration->turnOffCertCheck) {
-				if ($this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER)) {
-					$this->logger->debug(
-						'Turned off SSL certificate validation successfully.',
-						['app' => 'user_ldap']
-					);
-				} else {
-					$this->logger->warning(
-						'Could not turn off SSL certificate validation.',
-						['app' => 'user_ldap']
-					);
-				}
-			}
-
-			if (!$this->ldap->startTls($this->ldapConnectionRes)) {
-				throw new ServerNotAvailableException('Start TLS failed, when connecting to LDAP host ' . $host . '.');
-			}
-		}
-
-		return true;
-	}
-
-	/**
-	 * Binds to LDAP
-	 */
-	public function bind() {
-		if (!$this->configuration->ldapConfigurationActive) {
-			return false;
-		}
-		$cr = $this->ldapConnectionRes;
-		if (!$this->ldap->isResource($cr)) {
-			$cr = $this->getConnectionResource();
-		}
-
-		if (
-			count($this->bindResult) !== 0
-			&& $this->bindResult['sum'] === md5($this->configuration->ldapAgentName . $this->configPrefix . $this->configuration->ldapAgentPassword)
-		) {
-			// don't attempt to bind again with the same data as before
-			// bind might have been invoked via getConnectionResource(),
-			// but we need results specifically for e.g. user login
-			return $this->bindResult['result'];
-		}
-
-		$ldapLogin = @$this->ldap->bind($cr,
-			$this->configuration->ldapAgentName,
-			$this->configuration->ldapAgentPassword);
-
-		$this->bindResult = [
-			'sum' => md5($this->configuration->ldapAgentName . $this->configPrefix . $this->configuration->ldapAgentPassword),
-			'result' => $ldapLogin,
-		];
-
-		if (!$ldapLogin) {
-			$errno = $this->ldap->errno($cr);
-
-			$this->logger->warning(
-				'Bind failed: ' . $errno . ': ' . $this->ldap->error($cr),
-				['app' => 'user_ldap']
-			);
-
-			// Set to failure mode, if LDAP error code is not one of
-			// - LDAP_SUCCESS (0)
-			// - LDAP_INVALID_CREDENTIALS (49)
-			// - LDAP_INSUFFICIENT_ACCESS (50, spotted Apple Open Directory)
-			// - LDAP_UNWILLING_TO_PERFORM (53, spotted eDirectory)
-			if (!in_array($errno, [0, 49, 50, 53], true)) {
-				$this->ldapConnectionRes = null;
-			}
-
-			return false;
-		}
-		return true;
-	}
+    private ?\LDAP\Connection $ldapConnectionRes = null;
+    private bool $configured = false;
+
+    /**
+     * @var bool whether connection should be kept on __destruct
+     */
+    private bool $dontDestruct = false;
+
+    /**
+     * @var bool runtime flag that indicates whether supported primary groups are available
+     */
+    public $hasPrimaryGroups = true;
+
+    /**
+     * @var bool runtime flag that indicates whether supported POSIX gidNumber are available
+     */
+    public $hasGidNumber = true;
+
+    /**
+     * @var ICache|null
+     */
+    protected $cache = null;
+
+    /** @var Configuration settings handler * */
+    protected $configuration;
+
+    /**
+     * @var bool
+     */
+    protected $doNotValidate = false;
+
+    /**
+     * @var bool
+     */
+    protected $ignoreValidation = false;
+
+    /**
+     * @var array{sum?: string, result?: bool}
+     */
+    protected $bindResult = [];
+
+    protected LoggerInterface $logger;
+    private IL10N $l10n;
+
+    /**
+     * Constructor
+     * @param string $configPrefix a string with the prefix for the configkey column (appconfig table)
+     * @param string|null $configID a string with the value for the appid column (appconfig table) or null for on-the-fly connections
+     */
+    public function __construct(
+        ILDAPWrapper $ldap,
+        private string $configPrefix = '',
+        private ?string $configID = 'user_ldap',
+    ) {
+        parent::__construct($ldap);
+        $this->configuration = new Configuration($this->configPrefix, !is_null($this->configID));
+        $memcache = Server::get(ICacheFactory::class);
+        if ($memcache->isAvailable()) {
+            $this->cache = $memcache->createDistributed();
+        }
+        $helper = Server::get(Helper::class);
+        $this->doNotValidate = !in_array($this->configPrefix,
+            $helper->getServerConfigurationPrefixes());
+        $this->logger = Server::get(LoggerInterface::class);
+        $this->l10n = Util::getL10N('user_ldap');
+    }
+
+    public function __destruct() {
+        if (!$this->dontDestruct && $this->ldap->isResource($this->ldapConnectionRes)) {
+            @$this->ldap->unbind($this->ldapConnectionRes);
+            $this->bindResult = [];
+        }
+    }
+
+    /**
+     * defines behaviour when the instance is cloned
+     */
+    public function __clone() {
+        $this->configuration = new Configuration($this->configPrefix,
+            !is_null($this->configID));
+        if (count($this->bindResult) !== 0 && $this->bindResult['result'] === true) {
+            $this->bindResult = [];
+        }
+        $this->ldapConnectionRes = null;
+        $this->dontDestruct = true;
+    }
+
+    public function __get(string $name) {
+        if (!$this->configured) {
+            $this->readConfiguration();
+        }
+
+        return $this->configuration->$name;
+    }
+
+    /**
+     * @param string $name
+     * @param mixed $value
+     */
+    public function __set($name, $value) {
+        $this->doNotValidate = false;
+        $before = $this->configuration->$name;
+        $this->configuration->$name = $value;
+        $after = $this->configuration->$name;
+        if ($before !== $after) {
+            if ($this->configID !== '' && $this->configID !== null) {
+                $this->configuration->saveConfiguration();
+            }
+            $this->validateConfiguration();
+        }
+    }
+
+    /**
+     * @param string $rule
+     * @return array
+     * @throws \RuntimeException
+     */
+    public function resolveRule($rule) {
+        return $this->configuration->resolveRule($rule);
+    }
+
+    /**
+     * sets whether the result of the configuration validation shall
+     * be ignored when establishing the connection. Used by the Wizard
+     * in early configuration state.
+     * @param bool $state
+     */
+    public function setIgnoreValidation($state) {
+        $this->ignoreValidation = (bool)$state;
+    }
+
+    /**
+     * initializes the LDAP backend
+     * @param bool $force read the config settings no matter what
+     */
+    public function init($force = false) {
+        $this->readConfiguration($force);
+        $this->establishConnection();
+    }
+
+    /**
+     * @return \LDAP\Connection The LDAP resource
+     */
+    public function getConnectionResource(): \LDAP\Connection {
+        if (!$this->ldapConnectionRes) {
+            $this->init();
+        }
+        if (is_null($this->ldapConnectionRes)) {
+            $this->logger->error(
+                'No LDAP Connection to server ' . $this->configuration->ldapHost,
+                ['app' => 'user_ldap']
+            );
+            throw new ServerNotAvailableException('Connection to LDAP server could not be established');
+        }
+        return $this->ldapConnectionRes;
+    }
+
+    /**
+     * resets the connection resource
+     */
+    public function resetConnectionResource(): void {
+        if (!is_null($this->ldapConnectionRes)) {
+            @$this->ldap->unbind($this->ldapConnectionRes);
+            $this->ldapConnectionRes = null;
+            $this->bindResult = [];
+        }
+    }
+
+    /**
+     * @param string|null $key
+     */
+    private function getCacheKey($key): string {
+        $prefix = 'LDAP-' . $this->configID . '-' . $this->configPrefix . '-';
+        if (is_null($key)) {
+            return $prefix;
+        }
+        return $prefix . hash('sha256', $key);
+    }
+
+    /**
+     * @param string $key
+     * @return mixed|null
+     */
+    public function getFromCache($key) {
+        if (!$this->configured) {
+            $this->readConfiguration();
+        }
+        if (is_null($this->cache) || !$this->configuration->ldapCacheTTL) {
+            return null;
+        }
+        $key = $this->getCacheKey($key);
+
+        return json_decode(base64_decode($this->cache->get($key) ?? ''), true);
+    }
+
+    public function getConfigPrefix(): string {
+        return $this->configPrefix;
+    }
+
+    /**
+     * @param string $key
+     * @param mixed $value
+     */
+    public function writeToCache($key, $value, ?int $ttlOverride = null): void {
+        if (!$this->configured) {
+            $this->readConfiguration();
+        }
+        if (is_null($this->cache)
+            || !$this->configuration->ldapCacheTTL
+            || !$this->configuration->ldapConfigurationActive) {
+            return;
+        }
+        $key = $this->getCacheKey($key);
+        $value = base64_encode(json_encode($value));
+        $ttl = $ttlOverride ?? $this->configuration->ldapCacheTTL;
+        $this->cache->set($key, $value, $ttl);
+    }
+
+    public function clearCache() {
+        if (!is_null($this->cache)) {
+            $this->cache->clear($this->getCacheKey(null));
+        }
+    }
+
+    /**
+     * Caches the general LDAP configuration.
+     * @param bool $force optional. true, if the re-read should be forced. defaults
+     *                    to false.
+     */
+    private function readConfiguration(bool $force = false): void {
+        if ((!$this->configured || $force) && !is_null($this->configID)) {
+            $this->configuration->readConfiguration();
+            $this->configured = $this->validateConfiguration();
+        }
+    }
+
+    /**
+     * set LDAP configuration with values delivered by an array, not read from configuration
+     * @param array $config array that holds the config parameters in an associated array
+     * @param array &$setParameters optional; array where the set fields will be given to
+     * @param bool $throw if true, throw ConfigurationIssueException with details instead of returning false
+     * @return bool true if config validates, false otherwise. Check with $setParameters for detailed success on single parameters
+     */
+    public function setConfiguration(array $config, ?array &$setParameters = null, bool $throw = false): bool {
+        if (is_null($setParameters)) {
+            $setParameters = [];
+        }
+        $this->doNotValidate = false;
+        $this->configuration->setConfiguration($config, $setParameters);
+        if (count($setParameters) > 0) {
+            $this->configured = $this->validateConfiguration($throw);
+        }
+
+
+        return $this->configured;
+    }
+
+    /**
+     * saves the current Configuration in the database and empties the
+     * cache
+     * @return null
+     */
+    public function saveConfiguration() {
+        $this->configuration->saveConfiguration();
+        $this->clearCache();
+    }
+
+    /**
+     * get the current LDAP configuration
+     * @return array
+     */
+    public function getConfiguration() {
+        $this->readConfiguration();
+        $config = $this->configuration->getConfiguration();
+        $cta = $this->configuration->getConfigTranslationArray();
+        $result = [];
+        foreach ($cta as $dbkey => $configkey) {
+            switch ($configkey) {
+                case 'homeFolderNamingRule':
+                    if (str_starts_with($config[$configkey], 'attr:')) {
+                        $result[$dbkey] = substr($config[$configkey], 5);
+                    } else {
+                        $result[$dbkey] = '';
+                    }
+                    break;
+                case 'ldapBase':
+                case 'ldapBaseUsers':
+                case 'ldapBaseGroups':
+                case 'ldapAttributesForUserSearch':
+                case 'ldapAttributesForGroupSearch':
+                    if (is_array($config[$configkey])) {
+                        $result[$dbkey] = implode("\n", $config[$configkey]);
+                        break;
+                    } //else follows default
+                    // no break
+                default:
+                    $result[$dbkey] = $config[$configkey];
+            }
+        }
+        return $result;
+    }
+
+    private function doSoftValidation(): void {
+        //if User or Group Base are not set, take over Base DN setting
+        foreach (['ldapBaseUsers', 'ldapBaseGroups'] as $keyBase) {
+            $val = $this->configuration->$keyBase;
+            if (empty($val)) {
+                $this->configuration->$keyBase = $this->configuration->ldapBase;
+            }
+        }
+
+        foreach (['ldapExpertUUIDUserAttr' => 'ldapUuidUserAttribute',
+            'ldapExpertUUIDGroupAttr' => 'ldapUuidGroupAttribute'] as $expertSetting => $effectiveSetting) {
+            $uuidOverride = $this->configuration->$expertSetting;
+            if (!empty($uuidOverride)) {
+                $this->configuration->$effectiveSetting = $uuidOverride;
+            } else {
+                $uuidAttributes = Access::UUID_ATTRIBUTES;
+                array_unshift($uuidAttributes, 'auto');
+                if (!in_array($this->configuration->$effectiveSetting, $uuidAttributes)
+                    && !is_null($this->configID)) {
+                    $this->configuration->$effectiveSetting = 'auto';
+                    $this->configuration->saveConfiguration();
+                    $this->logger->info(
+                        'Illegal value for the ' . $effectiveSetting . ', reset to autodetect.',
+                        ['app' => 'user_ldap']
+                    );
+                }
+            }
+        }
+
+        $backupPort = (int)$this->configuration->ldapBackupPort;
+        if ($backupPort <= 0) {
+            $this->configuration->ldapBackupPort = $this->configuration->ldapPort;
+        }
+
+        //make sure empty search attributes are saved as simple, empty array
+        $saKeys = ['ldapAttributesForUserSearch',
+            'ldapAttributesForGroupSearch'];
+        foreach ($saKeys as $key) {
+            $val = $this->configuration->$key;
+            if (is_array($val) && count($val) === 1 && empty($val[0])) {
+                $this->configuration->$key = [];
+            }
+        }
+
+        if ((stripos((string)$this->configuration->ldapHost, 'ldaps://') === 0)
+            && $this->configuration->ldapTLS) {
+            $this->configuration->ldapTLS = (string)false;
+            $this->logger->info(
+                'LDAPS (already using secure connection) and TLS do not work together. Switched off TLS.',
+                ['app' => 'user_ldap']
+            );
+        }
+    }
+
+    /**
+     * @throws ConfigurationIssueException
+     */
+    private function doCriticalValidation(): void {
+        //options that shall not be empty
+        $options = ['ldapHost', 'ldapUserDisplayName',
+            'ldapGroupDisplayName', 'ldapLoginFilter'];
+
+        //ldapPort should not be empty either unless ldapHost is pointing to a socket
+        if (!$this->configuration->usesLdapi()) {
+            $options[] = 'ldapPort';
+        }
+
+        foreach ($options as $key) {
+            $val = $this->configuration->$key;
+            if (empty($val)) {
+                switch ($key) {
+                    case 'ldapHost':
+                        $subj = 'LDAP Host';
+                        break;
+                    case 'ldapPort':
+                        $subj = 'LDAP Port';
+                        break;
+                    case 'ldapUserDisplayName':
+                        $subj = 'LDAP User Display Name';
+                        break;
+                    case 'ldapGroupDisplayName':
+                        $subj = 'LDAP Group Display Name';
+                        break;
+                    case 'ldapLoginFilter':
+                        $subj = 'LDAP Login Filter';
+                        break;
+                    default:
+                        $subj = $key;
+                        break;
+                }
+                throw new ConfigurationIssueException(
+                    'No ' . $subj . ' given!',
+                    $this->l10n->t('Mandatory field "%s" left empty', $subj),
+                );
+            }
+        }
+
+        //combinations
+        $agent = $this->configuration->ldapAgentName;
+        $pwd = $this->configuration->ldapAgentPassword;
+        if ($agent === '' && $pwd !== '') {
+            throw new ConfigurationIssueException(
+                'A password is given, but not an LDAP agent',
+                $this->l10n->t('A password is given, but not an LDAP agent'),
+            );
+        }
+        if ($agent !== '' && $pwd === '') {
+            throw new ConfigurationIssueException(
+                'No password is given for the user agent',
+                $this->l10n->t('No password is given for the user agent'),
+            );
+        }
+
+        $base = $this->configuration->ldapBase;
+        $baseUsers = $this->configuration->ldapBaseUsers;
+        $baseGroups = $this->configuration->ldapBaseGroups;
+
+        if (empty($base)) {
+            throw new ConfigurationIssueException(
+                'Not a single Base DN given',
+                $this->l10n->t('No LDAP base DN was given'),
+            );
+        }
+
+        if (!empty($baseUsers) && !$this->checkBasesAreValid($baseUsers, $base)) {
+            throw new ConfigurationIssueException(
+                'User base is not in root base',
+                $this->l10n->t('User base DN is not a subnode of global base DN'),
+            );
+        }
+
+        if (!empty($baseGroups) && !$this->checkBasesAreValid($baseGroups, $base)) {
+            throw new ConfigurationIssueException(
+                'Group base is not in root base',
+                $this->l10n->t('Group base DN is not a subnode of global base DN'),
+            );
+        }
+
+        if (mb_strpos((string)$this->configuration->ldapLoginFilter, '%uid', 0, 'UTF-8') === false) {
+            throw new ConfigurationIssueException(
+                'Login filter does not contain %uid placeholder.',
+                $this->l10n->t('Login filter does not contain %s placeholder.', ['%uid']),
+            );
+        }
+    }
+
+    /**
+     * Checks that all bases are subnodes of one of the root bases
+     */
+    private function checkBasesAreValid(array $bases, array $rootBases): bool {
+        foreach ($bases as $base) {
+            $ok = false;
+            foreach ($rootBases as $rootBase) {
+                if (str_ends_with($base, $rootBase)) {
+                    $ok = true;
+                    break;
+                }
+            }
+            if (!$ok) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * Validates the user specified configuration
+     * @return bool true if configuration seems OK, false otherwise
+     */
+    private function validateConfiguration(bool $throw = false): bool {
+        if ($this->doNotValidate) {
+            //don't do a validation if it is a new configuration with pure
+            //default values. Will be allowed on changes via __set or
+            //setConfiguration
+            return false;
+        }
+
+        // first step: "soft" checks: settings that are not really
+        // necessary, but advisable. If left empty, give an info message
+        $this->doSoftValidation();
+
+        //second step: critical checks. If left empty or filled wrong, mark as
+        //not configured and give a warning.
+        try {
+            $this->doCriticalValidation();
+            return true;
+        } catch (ConfigurationIssueException $e) {
+            if ($throw) {
+                throw $e;
+            }
+            $this->logger->warning(
+                'Configuration Error (prefix ' . $this->configPrefix . '): ' . $e->getMessage(),
+                ['exception' => $e]
+            );
+            return false;
+        }
+    }
+
+
+    /**
+     * Connects and Binds to LDAP
+     *
+     * @throws ServerNotAvailableException
+     */
+    private function establishConnection(): ?bool {
+        if (!$this->configuration->ldapConfigurationActive) {
+            return null;
+        }
+        static $phpLDAPinstalled = true;
+        if (!$phpLDAPinstalled) {
+            return false;
+        }
+        if (!$this->ignoreValidation && !$this->configured) {
+            $this->logger->warning(
+                'Configuration is invalid, cannot connect',
+                ['app' => 'user_ldap']
+            );
+            return false;
+        }
+        if (!$this->ldapConnectionRes) {
+            if (!$this->ldap->areLDAPFunctionsAvailable()) {
+                $phpLDAPinstalled = false;
+                $this->logger->error(
+                    'function ldap_connect is not available. Make sure that the PHP ldap module is installed.',
+                    ['app' => 'user_ldap']
+                );
+
+                return false;
+            }
+
+            $hasBackupHost = (trim($this->configuration->ldapBackupHost ?? '') !== '');
+            $hasBackgroundHost = (trim($this->configuration->ldapBackgroundHost ?? '') !== '');
+            $useBackgroundHost = (\OC::$CLI && $hasBackgroundHost);
+            $overrideCacheKey = ($useBackgroundHost ? 'overrideBackgroundServer' : 'overrideMainServer');
+            $forceBackupHost = ($this->configuration->ldapOverrideMainServer || $this->getFromCache($overrideCacheKey));
+            $bindStatus = false;
+            if (!$forceBackupHost) {
+                try {
+                    $host = $this->configuration->ldapHost ?? '';
+                    $port = $this->configuration->ldapPort ?? '';
+                    if ($useBackgroundHost) {
+                        $host = $this->configuration->ldapBackgroundHost ?? '';
+                        $port = $this->configuration->ldapBackgroundPort ?? '';
+                    }
+                    $this->doConnect($host, $port);
+                    return $this->bind();
+                } catch (ServerNotAvailableException $e) {
+                    if (!$hasBackupHost) {
+                        throw $e;
+                    }
+                }
+                $this->logger->warning(
+                    'Main LDAP not reachable, connecting to backup: {msg}',
+                    [
+                        'app' => 'user_ldap',
+                        'msg' => $e->getMessage(),
+                        'exception' => $e,
+                    ]
+                );
+            }
+
+            // if LDAP server is not reachable, try the Backup (Replica!) Server
+            $this->doConnect($this->configuration->ldapBackupHost ?? '', $this->configuration->ldapBackupPort ?? '');
+            $this->bindResult = [];
+            $bindStatus = $this->bind();
+            $error = $this->ldap->isResource($this->ldapConnectionRes) ?
+                $this->ldap->errno($this->ldapConnectionRes) : -1;
+            if ($bindStatus && $error === 0 && !$forceBackupHost) {
+                //when bind to backup server succeeded and failed to main server,
+                //skip contacting it for 15min
+                $this->writeToCache($overrideCacheKey, true, 60 * 15);
+            }
+
+            return $bindStatus;
+        }
+        return null;
+    }
+
+    /**
+     * @param string $host
+     * @param string $port
+     * @throws \OC\ServerNotAvailableException
+     */
+    private function doConnect($host, $port): bool {
+        if ($host === '') {
+            return false;
+        }
+
+        $this->ldapConnectionRes = $this->ldap->connect($host, $port) ?: null;
+
+        if ($this->ldapConnectionRes === null) {
+            throw new ServerNotAvailableException('Connection failed');
+        }
+
+        if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_PROTOCOL_VERSION, 3)) {
+            throw new ServerNotAvailableException('Could not set required LDAP Protocol version.');
+        }
+
+        if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_REFERRALS, 0)) {
+            throw new ServerNotAvailableException('Could not disable LDAP referrals.');
+        }
+
+        if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_NETWORK_TIMEOUT, $this->configuration->ldapConnectionTimeout)) {
+            throw new ServerNotAvailableException('Could not set network timeout');
+        }
+
+        if ($this->configuration->ldapTLS) {
+            if ($this->configuration->turnOffCertCheck) {
+                if ($this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER)) {
+                    $this->logger->debug(
+                        'Turned off SSL certificate validation successfully.',
+                        ['app' => 'user_ldap']
+                    );
+                } else {
+                    $this->logger->warning(
+                        'Could not turn off SSL certificate validation.',
+                        ['app' => 'user_ldap']
+                    );
+                }
+            }
+
+            if (!$this->ldap->startTls($this->ldapConnectionRes)) {
+                throw new ServerNotAvailableException('Start TLS failed, when connecting to LDAP host ' . $host . '.');
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * Binds to LDAP
+     */
+    public function bind() {
+        if (!$this->configuration->ldapConfigurationActive) {
+            return false;
+        }
+        $cr = $this->ldapConnectionRes;
+        if (!$this->ldap->isResource($cr)) {
+            $cr = $this->getConnectionResource();
+        }
+
+        if (
+            count($this->bindResult) !== 0
+            && $this->bindResult['sum'] === md5($this->configuration->ldapAgentName . $this->configPrefix . $this->configuration->ldapAgentPassword)
+        ) {
+            // don't attempt to bind again with the same data as before
+            // bind might have been invoked via getConnectionResource(),
+            // but we need results specifically for e.g. user login
+            return $this->bindResult['result'];
+        }
+
+        $ldapLogin = @$this->ldap->bind($cr,
+            $this->configuration->ldapAgentName,
+            $this->configuration->ldapAgentPassword);
+
+        $this->bindResult = [
+            'sum' => md5($this->configuration->ldapAgentName . $this->configPrefix . $this->configuration->ldapAgentPassword),
+            'result' => $ldapLogin,
+        ];
+
+        if (!$ldapLogin) {
+            $errno = $this->ldap->errno($cr);
+
+            $this->logger->warning(
+                'Bind failed: ' . $errno . ': ' . $this->ldap->error($cr),
+                ['app' => 'user_ldap']
+            );
+
+            // Set to failure mode, if LDAP error code is not one of
+            // - LDAP_SUCCESS (0)
+            // - LDAP_INVALID_CREDENTIALS (49)
+            // - LDAP_INSUFFICIENT_ACCESS (50, spotted Apple Open Directory)
+            // - LDAP_UNWILLING_TO_PERFORM (53, spotted eDirectory)
+            if (!in_array($errno, [0, 49, 50, 53], true)) {
+                $this->ldapConnectionRes = null;
+            }
+
+            return false;
+        }
+        return true;
+    }
 }

apps/user_ldap/lib/Jobs/CleanUp.php

Indentation +168 added lines, -168 removed lines

@@ -25,172 +25,172 @@
  * @package OCA\User_LDAP\Jobs;
  */
 class CleanUp extends TimedJob {
-	/** @var ?int $limit amount of users that should be checked per run */
-	protected $limit;
-
-	/** @var int $defaultIntervalMin default interval in minutes */
-	protected $defaultIntervalMin = 60;
-
-	/** @var IConfig $ocConfig */
-	protected $ocConfig;
-
-	/** @var IDBConnection $db */
-	protected $db;
-
-	/** @var Helper $ldapHelper */
-	protected $ldapHelper;
-
-	/** @var UserMapping */
-	protected $mapping;
-
-	public function __construct(
-		ITimeFactory $timeFactory,
-		protected User_Proxy $userBackend,
-		protected DeletedUsersIndex $dui,
-	) {
-		parent::__construct($timeFactory);
-		$minutes = Server::get(IConfig::class)->getSystemValue(
-			'ldapUserCleanupInterval', (string)$this->defaultIntervalMin);
-		$this->setInterval((int)$minutes * 60);
-	}
-
-	/**
-	 * assigns the instances passed to run() to the class properties
-	 * @param array $arguments
-	 */
-	public function setArguments($arguments): void {
-		//Dependency Injection is not possible, because the constructor will
-		//only get values that are serialized to JSON. I.e. whatever we would
-		//pass in app.php we do add here, except something else is passed e.g.
-		//in tests.
-
-		if (isset($arguments['helper'])) {
-			$this->ldapHelper = $arguments['helper'];
-		} else {
-			$this->ldapHelper = Server::get(Helper::class);
-		}
-
-		if (isset($arguments['ocConfig'])) {
-			$this->ocConfig = $arguments['ocConfig'];
-		} else {
-			$this->ocConfig = Server::get(IConfig::class);
-		}
-
-		if (isset($arguments['userBackend'])) {
-			$this->userBackend = $arguments['userBackend'];
-		}
-
-		if (isset($arguments['db'])) {
-			$this->db = $arguments['db'];
-		} else {
-			$this->db = Server::get(IDBConnection::class);
-		}
-
-		if (isset($arguments['mapping'])) {
-			$this->mapping = $arguments['mapping'];
-		} else {
-			$this->mapping = Server::get(UserMapping::class);
-		}
-
-		if (isset($arguments['deletedUsersIndex'])) {
-			$this->dui = $arguments['deletedUsersIndex'];
-		}
-	}
-
-	/**
-	 * makes the background job do its work
-	 * @param array $argument
-	 */
-	public function run($argument): void {
-		$this->setArguments($argument);
-
-		if (!$this->isCleanUpAllowed()) {
-			return;
-		}
-		$users = $this->mapping->getList($this->getOffset(), $this->getChunkSize());
-		$resetOffset = $this->isOffsetResetNecessary(count($users));
-		$this->checkUsers($users);
-		$this->setOffset($resetOffset);
-	}
-
-	/**
-	 * checks whether next run should start at 0 again
-	 */
-	public function isOffsetResetNecessary(int $resultCount): bool {
-		return $resultCount < $this->getChunkSize();
-	}
-
-	/**
-	 * checks whether cleaning up LDAP users is allowed
-	 */
-	public function isCleanUpAllowed(): bool {
-		try {
-			if ($this->ldapHelper->haveDisabledConfigurations()) {
-				return false;
-			}
-		} catch (\Exception $e) {
-			return false;
-		}
-
-		return $this->isCleanUpEnabled();
-	}
-
-	/**
-	 * checks whether clean up is enabled by configuration
-	 */
-	private function isCleanUpEnabled(): bool {
-		return (bool)$this->ocConfig->getSystemValue(
-			'ldapUserCleanupInterval', (string)$this->defaultIntervalMin);
-	}
-
-	/**
-	 * checks users whether they are still existing
-	 * @param array $users result from getMappedUsers()
-	 */
-	private function checkUsers(array $users): void {
-		foreach ($users as $user) {
-			$this->checkUser($user);
-		}
-	}
-
-	/**
-	 * checks whether a user is still existing in LDAP
-	 * @param string[] $user
-	 */
-	private function checkUser(array $user): void {
-		if ($this->userBackend->userExistsOnLDAP($user['name'])) {
-			//still available, all good
-
-			return;
-		}
-
-		$this->dui->markUser($user['name']);
-	}
-
-	/**
-	 * gets the offset to fetch users from the mappings table
-	 */
-	private function getOffset(): int {
-		return (int)$this->ocConfig->getAppValue('user_ldap', 'cleanUpJobOffset', '0');
-	}
-
-	/**
-	 * sets the new offset for the next run
-	 * @param bool $reset whether the offset should be set to 0
-	 */
-	public function setOffset(bool $reset = false): void {
-		$newOffset = $reset ? 0 :
-			$this->getOffset() + $this->getChunkSize();
-		$this->ocConfig->setAppValue('user_ldap', 'cleanUpJobOffset', (string)$newOffset);
-	}
-
-	/**
-	 * returns the chunk size (limit in DB speak)
-	 */
-	public function getChunkSize(): int {
-		if ($this->limit === null) {
-			$this->limit = (int)$this->ocConfig->getAppValue('user_ldap', 'cleanUpJobChunkSize', '50');
-		}
-		return $this->limit;
-	}
+    /** @var ?int $limit amount of users that should be checked per run */
+    protected $limit;
+
+    /** @var int $defaultIntervalMin default interval in minutes */
+    protected $defaultIntervalMin = 60;
+
+    /** @var IConfig $ocConfig */
+    protected $ocConfig;
+
+    /** @var IDBConnection $db */
+    protected $db;
+
+    /** @var Helper $ldapHelper */
+    protected $ldapHelper;
+
+    /** @var UserMapping */
+    protected $mapping;
+
+    public function __construct(
+        ITimeFactory $timeFactory,
+        protected User_Proxy $userBackend,
+        protected DeletedUsersIndex $dui,
+    ) {
+        parent::__construct($timeFactory);
+        $minutes = Server::get(IConfig::class)->getSystemValue(
+            'ldapUserCleanupInterval', (string)$this->defaultIntervalMin);
+        $this->setInterval((int)$minutes * 60);
+    }
+
+    /**
+     * assigns the instances passed to run() to the class properties
+     * @param array $arguments
+     */
+    public function setArguments($arguments): void {
+        //Dependency Injection is not possible, because the constructor will
+        //only get values that are serialized to JSON. I.e. whatever we would
+        //pass in app.php we do add here, except something else is passed e.g.
+        //in tests.
+
+        if (isset($arguments['helper'])) {
+            $this->ldapHelper = $arguments['helper'];
+        } else {
+            $this->ldapHelper = Server::get(Helper::class);
+        }
+
+        if (isset($arguments['ocConfig'])) {
+            $this->ocConfig = $arguments['ocConfig'];
+        } else {
+            $this->ocConfig = Server::get(IConfig::class);
+        }
+
+        if (isset($arguments['userBackend'])) {
+            $this->userBackend = $arguments['userBackend'];
+        }
+
+        if (isset($arguments['db'])) {
+            $this->db = $arguments['db'];
+        } else {
+            $this->db = Server::get(IDBConnection::class);
+        }
+
+        if (isset($arguments['mapping'])) {
+            $this->mapping = $arguments['mapping'];
+        } else {
+            $this->mapping = Server::get(UserMapping::class);
+        }
+
+        if (isset($arguments['deletedUsersIndex'])) {
+            $this->dui = $arguments['deletedUsersIndex'];
+        }
+    }
+
+    /**
+     * makes the background job do its work
+     * @param array $argument
+     */
+    public function run($argument): void {
+        $this->setArguments($argument);
+
+        if (!$this->isCleanUpAllowed()) {
+            return;
+        }
+        $users = $this->mapping->getList($this->getOffset(), $this->getChunkSize());
+        $resetOffset = $this->isOffsetResetNecessary(count($users));
+        $this->checkUsers($users);
+        $this->setOffset($resetOffset);
+    }
+
+    /**
+     * checks whether next run should start at 0 again
+     */
+    public function isOffsetResetNecessary(int $resultCount): bool {
+        return $resultCount < $this->getChunkSize();
+    }
+
+    /**
+     * checks whether cleaning up LDAP users is allowed
+     */
+    public function isCleanUpAllowed(): bool {
+        try {
+            if ($this->ldapHelper->haveDisabledConfigurations()) {
+                return false;
+            }
+        } catch (\Exception $e) {
+            return false;
+        }
+
+        return $this->isCleanUpEnabled();
+    }
+
+    /**
+     * checks whether clean up is enabled by configuration
+     */
+    private function isCleanUpEnabled(): bool {
+        return (bool)$this->ocConfig->getSystemValue(
+            'ldapUserCleanupInterval', (string)$this->defaultIntervalMin);
+    }
+
+    /**
+     * checks users whether they are still existing
+     * @param array $users result from getMappedUsers()
+     */
+    private function checkUsers(array $users): void {
+        foreach ($users as $user) {
+            $this->checkUser($user);
+        }
+    }
+
+    /**
+     * checks whether a user is still existing in LDAP
+     * @param string[] $user
+     */
+    private function checkUser(array $user): void {
+        if ($this->userBackend->userExistsOnLDAP($user['name'])) {
+            //still available, all good
+
+            return;
+        }
+
+        $this->dui->markUser($user['name']);
+    }
+
+    /**
+     * gets the offset to fetch users from the mappings table
+     */
+    private function getOffset(): int {
+        return (int)$this->ocConfig->getAppValue('user_ldap', 'cleanUpJobOffset', '0');
+    }
+
+    /**
+     * sets the new offset for the next run
+     * @param bool $reset whether the offset should be set to 0
+     */
+    public function setOffset(bool $reset = false): void {
+        $newOffset = $reset ? 0 :
+            $this->getOffset() + $this->getChunkSize();
+        $this->ocConfig->setAppValue('user_ldap', 'cleanUpJobOffset', (string)$newOffset);
+    }
+
+    /**
+     * returns the chunk size (limit in DB speak)
+     */
+    public function getChunkSize(): int {
+        if ($this->limit === null) {
+            $this->limit = (int)$this->ocConfig->getAppValue('user_ldap', 'cleanUpJobChunkSize', '50');
+        }
+        return $this->limit;
+    }
 }

apps/user_ldap/ajax/deleteConfiguration.php

Indentation +3 added lines, -3 removed lines

@@ -17,8 +17,8 @@
 $prefix = (string)$_POST['ldap_serverconfig_chooser'];
 $helper = Server::get(Helper::class);
 if ($helper->deleteServerConfiguration($prefix)) {
-	\OC_JSON::success();
+    \OC_JSON::success();
 } else {
-	$l = Util::getL10N('user_ldap');
-	\OC_JSON::error(['message' => $l->t('Failed to delete the server configuration')]);
+    $l = Util::getL10N('user_ldap');
+    \OC_JSON::error(['message' => $l->t('Failed to delete the server configuration')]);
 }

Spacing +1 added lines, -1 removed lines

@@ -14,7 +14,7 @@
 \OC_JSON::checkAppEnabled('user_ldap');
 \OC_JSON::callCheck();
 
-$prefix = (string)$_POST['ldap_serverconfig_chooser'];
+$prefix = (string) $_POST['ldap_serverconfig_chooser'];
 $helper = Server::get(Helper::class);
 if ($helper->deleteServerConfiguration($prefix)) {
 	\OC_JSON::success();

apps/user_ldap/tests/Integration/AbstractIntegrationTest.php

Indentation +142 added lines, -142 removed lines

@@ -23,146 +23,146 @@
 use Psr\Log\LoggerInterface;
 
 abstract class AbstractIntegrationTest {
-	/** @var LDAP */
-	protected $ldap;
-
-	/** @var Connection */
-	protected $connection;
-
-	/** @var Access */
-	protected $access;
-
-	/** @var Manager */
-	protected $userManager;
-
-	/** @var Helper */
-	protected $helper;
-
-	/** @var string[] */
-	protected $server;
-
-	/**
-	 * @param string $base
-	 */
-	public function __construct(
-		$host,
-		$port,
-		$bind,
-		$pwd,
-		protected $base,
-	) {
-		$this->server = [
-			'host' => $host,
-			'port' => $port,
-			'dn' => $bind,
-			'pwd' => $pwd
-		];
-	}
-
-	/**
-	 * prepares the LDAP environment and sets up a test configuration for
-	 * the LDAP backend.
-	 */
-	public function init() {
-		\OC::$server->registerService(UserPluginManager::class, function () {
-			return new UserPluginManager();
-		});
-		\OC::$server->registerService(GroupPluginManager::class, function () {
-			return new GroupPluginManager();
-		});
-
-		$this->initLDAPWrapper();
-		$this->initConnection();
-		$this->initUserManager();
-		$this->initHelper();
-		$this->initAccess();
-	}
-
-	/**
-	 * initializes the test LDAP wrapper
-	 */
-	protected function initLDAPWrapper() {
-		$this->ldap = new LDAP();
-	}
-
-	/**
-	 * sets up the LDAP configuration to be used for the test
-	 */
-	protected function initConnection() {
-		$this->connection = new Connection($this->ldap, '', null);
-		$this->connection->setConfiguration([
-			'ldapHost' => $this->server['host'],
-			'ldapPort' => $this->server['port'],
-			'ldapBase' => $this->base,
-			'ldapAgentName' => $this->server['dn'],
-			'ldapAgentPassword' => $this->server['pwd'],
-			'ldapUserFilter' => 'objectclass=inetOrgPerson',
-			'ldapUserDisplayName' => 'cn',
-			'ldapGroupDisplayName' => 'cn',
-			'ldapLoginFilter' => '(|(uid=%uid)(samaccountname=%uid))',
-			'ldapCacheTTL' => 0,
-			'ldapConfigurationActive' => 1,
-		]);
-	}
-
-	/**
-	 * initializes an LDAP user manager instance
-	 */
-	protected function initUserManager() {
-		$this->userManager = new Manager(
-			Server::get(IConfig::class),
-			Server::get(LoggerInterface::class),
-			Server::get(IAvatarManager::class),
-			new Image(),
-			Server::get(IUserManager::class),
-			Server::get(\OCP\Notification\IManager::class),
-			Server::get(IManager::class)
-		);
-	}
-
-	/**
-	 * initializes the test Helper
-	 */
-	protected function initHelper() {
-		$this->helper = Server::get(Helper::class);
-	}
-
-	/**
-	 * initializes the Access test instance
-	 */
-	protected function initAccess() {
-		$this->access = new Access($this->connection, $this->ldap, $this->userManager, $this->helper, Server::get(IConfig::class), Server::get(LoggerInterface::class));
-	}
-
-	/**
-	 * runs the test cases while outputting progress and result information
-	 *
-	 * If a test failed, the script is exited with return code 1.
-	 */
-	public function run() {
-		$methods = get_class_methods($this);
-		$atLeastOneCaseRan = false;
-		foreach ($methods as $method) {
-			if (str_starts_with($method, 'case')) {
-				print("running $method " . PHP_EOL);
-				try {
-					if (!$this->$method()) {
-						print(PHP_EOL . '>>> !!! Test ' . $method . ' FAILED !!! <<<' . PHP_EOL . PHP_EOL);
-						exit(1);
-					}
-					$atLeastOneCaseRan = true;
-				} catch (\Exception $e) {
-					print(PHP_EOL . '>>> !!! Test ' . $method . ' RAISED AN EXCEPTION !!! <<<' . PHP_EOL);
-					print($e->getMessage() . PHP_EOL . PHP_EOL);
-					exit(1);
-				}
-			}
-		}
-		if ($atLeastOneCaseRan) {
-			print('Tests succeeded' . PHP_EOL);
-		} else {
-			print('No Test was available.' . PHP_EOL);
-			exit(1);
-		}
-	}
+    /** @var LDAP */
+    protected $ldap;
+
+    /** @var Connection */
+    protected $connection;
+
+    /** @var Access */
+    protected $access;
+
+    /** @var Manager */
+    protected $userManager;
+
+    /** @var Helper */
+    protected $helper;
+
+    /** @var string[] */
+    protected $server;
+
+    /**
+     * @param string $base
+     */
+    public function __construct(
+        $host,
+        $port,
+        $bind,
+        $pwd,
+        protected $base,
+    ) {
+        $this->server = [
+            'host' => $host,
+            'port' => $port,
+            'dn' => $bind,
+            'pwd' => $pwd
+        ];
+    }
+
+    /**
+     * prepares the LDAP environment and sets up a test configuration for
+     * the LDAP backend.
+     */
+    public function init() {
+        \OC::$server->registerService(UserPluginManager::class, function () {
+            return new UserPluginManager();
+        });
+        \OC::$server->registerService(GroupPluginManager::class, function () {
+            return new GroupPluginManager();
+        });
+
+        $this->initLDAPWrapper();
+        $this->initConnection();
+        $this->initUserManager();
+        $this->initHelper();
+        $this->initAccess();
+    }
+
+    /**
+     * initializes the test LDAP wrapper
+     */
+    protected function initLDAPWrapper() {
+        $this->ldap = new LDAP();
+    }
+
+    /**
+     * sets up the LDAP configuration to be used for the test
+     */
+    protected function initConnection() {
+        $this->connection = new Connection($this->ldap, '', null);
+        $this->connection->setConfiguration([
+            'ldapHost' => $this->server['host'],
+            'ldapPort' => $this->server['port'],
+            'ldapBase' => $this->base,
+            'ldapAgentName' => $this->server['dn'],
+            'ldapAgentPassword' => $this->server['pwd'],
+            'ldapUserFilter' => 'objectclass=inetOrgPerson',
+            'ldapUserDisplayName' => 'cn',
+            'ldapGroupDisplayName' => 'cn',
+            'ldapLoginFilter' => '(|(uid=%uid)(samaccountname=%uid))',
+            'ldapCacheTTL' => 0,
+            'ldapConfigurationActive' => 1,
+        ]);
+    }
+
+    /**
+     * initializes an LDAP user manager instance
+     */
+    protected function initUserManager() {
+        $this->userManager = new Manager(
+            Server::get(IConfig::class),
+            Server::get(LoggerInterface::class),
+            Server::get(IAvatarManager::class),
+            new Image(),
+            Server::get(IUserManager::class),
+            Server::get(\OCP\Notification\IManager::class),
+            Server::get(IManager::class)
+        );
+    }
+
+    /**
+     * initializes the test Helper
+     */
+    protected function initHelper() {
+        $this->helper = Server::get(Helper::class);
+    }
+
+    /**
+     * initializes the Access test instance
+     */
+    protected function initAccess() {
+        $this->access = new Access($this->connection, $this->ldap, $this->userManager, $this->helper, Server::get(IConfig::class), Server::get(LoggerInterface::class));
+    }
+
+    /**
+     * runs the test cases while outputting progress and result information
+     *
+     * If a test failed, the script is exited with return code 1.
+     */
+    public function run() {
+        $methods = get_class_methods($this);
+        $atLeastOneCaseRan = false;
+        foreach ($methods as $method) {
+            if (str_starts_with($method, 'case')) {
+                print("running $method " . PHP_EOL);
+                try {
+                    if (!$this->$method()) {
+                        print(PHP_EOL . '>>> !!! Test ' . $method . ' FAILED !!! <<<' . PHP_EOL . PHP_EOL);
+                        exit(1);
+                    }
+                    $atLeastOneCaseRan = true;
+                } catch (\Exception $e) {
+                    print(PHP_EOL . '>>> !!! Test ' . $method . ' RAISED AN EXCEPTION !!! <<<' . PHP_EOL);
+                    print($e->getMessage() . PHP_EOL . PHP_EOL);
+                    exit(1);
+                }
+            }
+        }
+        if ($atLeastOneCaseRan) {
+            print('Tests succeeded' . PHP_EOL);
+        } else {
+            print('No Test was available.' . PHP_EOL);
+            exit(1);
+        }
+    }
 }

apps/user_ldap/tests/AccessTest.php

Indentation +710 added lines, -710 removed lines

@@ -42,714 +42,714 @@
  * @package OCA\User_LDAP\Tests
  */
 class AccessTest extends TestCase {
-	protected UserMapping&MockObject $userMapper;
-	protected IManager&MockObject $shareManager;
-	protected GroupMapping&MockObject $groupMapper;
-	private Connection&MockObject $connection;
-	private LDAP&MockObject $ldap;
-	private Manager&MockObject $userManager;
-	private Helper&MockObject $helper;
-	private IConfig&MockObject $config;
-	private IUserManager&MockObject $ncUserManager;
-	private LoggerInterface&MockObject $logger;
-	private IAppConfig&MockObject $appConfig;
-	private IEventDispatcher&MockObject $dispatcher;
-	private Access $access;
-
-	protected function setUp(): void {
-		$this->ldap = $this->createMock(LDAP::class);
-		$this->connection = $this->getMockBuilder(Connection::class)
-			->setConstructorArgs([$this->ldap])
-			->getMock();
-		$this->userManager = $this->createMock(Manager::class);
-		$this->helper = $this->createMock(Helper::class);
-		$this->config = $this->createMock(IConfig::class);
-		$this->userMapper = $this->createMock(UserMapping::class);
-		$this->groupMapper = $this->createMock(GroupMapping::class);
-		$this->ncUserManager = $this->createMock(IUserManager::class);
-		$this->shareManager = $this->createMock(IManager::class);
-		$this->logger = $this->createMock(LoggerInterface::class);
-		$this->appConfig = $this->createMock(IAppConfig::class);
-		$this->dispatcher = $this->createMock(IEventDispatcher::class);
-
-		$this->access = new Access(
-			$this->ldap,
-			$this->connection,
-			$this->userManager,
-			$this->helper,
-			$this->config,
-			$this->ncUserManager,
-			$this->logger,
-			$this->appConfig,
-			$this->dispatcher,
-		);
-		$this->dispatcher->expects($this->any())->method('dispatchTyped');
-		$this->access->setUserMapper($this->userMapper);
-		$this->access->setGroupMapper($this->groupMapper);
-	}
-
-	private function getConnectorAndLdapMock() {
-		/** @var ILDAPWrapper&MockObject */
-		$lw = $this->createMock(ILDAPWrapper::class);
-		/** @var Connection&MockObject */
-		$connector = $this->getMockBuilder(Connection::class)
-			->setConstructorArgs([$lw, '', null])
-			->getMock();
-		$connector->expects($this->any())
-			->method('getConnectionResource')
-			->willReturn(ldap_connect('ldap://example.com'));
-		/** @var Manager&MockObject */
-		$um = $this->getMockBuilder(Manager::class)
-			->setConstructorArgs([
-				$this->createMock(IConfig::class),
-				$this->createMock(LoggerInterface::class),
-				$this->createMock(IAvatarManager::class),
-				$this->createMock(Image::class),
-				$this->createMock(IUserManager::class),
-				$this->createMock(INotificationManager::class),
-				$this->shareManager])
-			->getMock();
-		$helper = Server::get(Helper::class);
-
-		return [$lw, $connector, $um, $helper];
-	}
-
-	public function testEscapeFilterPartValidChars(): void {
-		$input = 'okay';
-		$this->assertSame($input, $this->access->escapeFilterPart($input));
-	}
-
-	public function testEscapeFilterPartEscapeWildcard(): void {
-		$input = '*';
-		$expected = '\\2a';
-		$this->assertSame($expected, $this->access->escapeFilterPart($input));
-	}
-
-	public function testEscapeFilterPartEscapeWildcard2(): void {
-		$input = 'foo*bar';
-		$expected = 'foo\\2abar';
-		$this->assertSame($expected, $this->access->escapeFilterPart($input));
-	}
-
-	/**
-	 * @dataProvider convertSID2StrSuccessData
-	 * @param array $sidArray
-	 * @param $sidExpected
-	 */
-	public function testConvertSID2StrSuccess(array $sidArray, $sidExpected): void {
-		$sidBinary = implode('', $sidArray);
-		$this->assertSame($sidExpected, $this->access->convertSID2Str($sidBinary));
-	}
-
-	public static function convertSID2StrSuccessData(): array {
-		return [
-			[
-				[
-					"\x01",
-					"\x04",
-					"\x00\x00\x00\x00\x00\x05",
-					"\x15\x00\x00\x00",
-					"\xa6\x81\xe5\x0e",
-					"\x4d\x6c\x6c\x2b",
-					"\xca\x32\x05\x5f",
-				],
-				'S-1-5-21-249921958-728525901-1594176202',
-			],
-			[
-				[
-					"\x01",
-					"\x02",
-					"\xFF\xFF\xFF\xFF\xFF\xFF",
-					"\xFF\xFF\xFF\xFF",
-					"\xFF\xFF\xFF\xFF",
-				],
-				'S-1-281474976710655-4294967295-4294967295',
-			],
-		];
-	}
-
-	public function testConvertSID2StrInputError(): void {
-		$sidIllegal = 'foobar';
-		$sidExpected = '';
-
-		$this->assertSame($sidExpected, $this->access->convertSID2Str($sidIllegal));
-	}
-
-	public function testGetDomainDNFromDNSuccess(): void {
-		$inputDN = 'uid=zaphod,cn=foobar,dc=my,dc=server,dc=com';
-		$domainDN = 'dc=my,dc=server,dc=com';
-
-		$this->ldap->expects($this->once())
-			->method('explodeDN')
-			->with($inputDN, 0)
-			->willReturn(explode(',', $inputDN));
-
-		$this->assertSame($domainDN, $this->access->getDomainDNFromDN($inputDN));
-	}
-
-	public function testGetDomainDNFromDNError(): void {
-		$inputDN = 'foobar';
-		$expected = '';
-
-		$this->ldap->expects($this->once())
-			->method('explodeDN')
-			->with($inputDN, 0)
-			->willReturn(false);
-
-		$this->assertSame($expected, $this->access->getDomainDNFromDN($inputDN));
-	}
-
-	public static function dnInputDataProvider(): array {
-		return [
-			[
-				'foo=bar,bar=foo,dc=foobar',
-				[
-					'count' => 3,
-					0 => 'foo=bar',
-					1 => 'bar=foo',
-					2 => 'dc=foobar'
-				],
-				true
-			],
-			[
-				'foobarbarfoodcfoobar',
-				false,
-				false
-			]
-		];
-	}
-
-	/**
-	 * @dataProvider dnInputDataProvider
-	 */
-	public function testStringResemblesDN(string $input, array|bool $interResult, bool $expectedResult): void {
-		[$lw, $con, $um, $helper] = $this->getConnectorAndLdapMock();
-		/** @var IConfig&MockObject $config */
-		$config = $this->createMock(IConfig::class);
-		$access = new Access($lw, $con, $um, $helper, $config, $this->ncUserManager, $this->logger, $this->appConfig, $this->dispatcher);
-
-		$lw->expects($this->exactly(1))
-			->method('explodeDN')
-			->willReturnCallback(function ($dn) use ($input, $interResult) {
-				if ($dn === $input) {
-					return $interResult;
-				}
-				return null;
-			});
-
-		$this->assertSame($expectedResult, $access->stringResemblesDN($input));
-	}
-
-	/**
-	 * @dataProvider dnInputDataProvider
-	 */
-	public function testStringResemblesDNLDAPmod(string $input, array|bool $interResult, bool $expectedResult): void {
-		[, $con, $um, $helper] = $this->getConnectorAndLdapMock();
-		/** @var IConfig&MockObject $config */
-		$config = $this->createMock(IConfig::class);
-		$lw = new LDAP();
-		$access = new Access($lw, $con, $um, $helper, $config, $this->ncUserManager, $this->logger, $this->appConfig, $this->dispatcher);
-
-		if (!function_exists('ldap_explode_dn')) {
-			$this->markTestSkipped('LDAP Module not available');
-		}
-
-		$this->assertSame($expectedResult, $access->stringResemblesDN($input));
-	}
-
-	public function testCacheUserHome(): void {
-		$this->connection->expects($this->once())
-			->method('writeToCache');
-
-		$this->access->cacheUserHome('foobar', '/foobars/path');
-	}
-
-	public function testBatchApplyUserAttributes(): void {
-		$this->ldap->expects($this->any())
-			->method('isResource')
-			->willReturn(true);
-
-		$this->connection
-			->expects($this->any())
-			->method('getConnectionResource')
-			->willReturn(ldap_connect('ldap://example.com'));
-
-		$this->ldap->expects($this->any())
-			->method('getAttributes')
-			->willReturn(['displayname' => ['bar', 'count' => 1]]);
-
-		/** @var UserMapping&MockObject $mapperMock */
-		$mapperMock = $this->createMock(UserMapping::class);
-		$mapperMock->expects($this->any())
-			->method('getNameByDN')
-			->willReturn(false);
-		$mapperMock->expects($this->any())
-			->method('map')
-			->willReturn(true);
-
-		$userMock = $this->createMock(User::class);
-
-		// also returns for userUuidAttribute
-		$this->access->connection->expects($this->any())
-			->method('__get')
-			->willReturn('displayName');
-
-		$this->access->setUserMapper($mapperMock);
-
-		$displayNameAttribute = strtolower($this->access->connection->ldapUserDisplayName);
-		$data = [
-			[
-				'dn' => ['foobar'],
-				$displayNameAttribute => 'barfoo'
-			],
-			[
-				'dn' => ['foo'],
-				$displayNameAttribute => 'bar'
-			],
-			[
-				'dn' => ['raboof'],
-				$displayNameAttribute => 'oofrab'
-			]
-		];
-
-		$userMock->expects($this->exactly(count($data)))
-			->method('processAttributes');
-
-		$this->userManager->expects($this->exactly(count($data) * 2))
-			->method('get')
-			->willReturn($userMock);
-
-		$this->access->batchApplyUserAttributes($data);
-	}
-
-	public function testBatchApplyUserAttributesSkipped(): void {
-		/** @var UserMapping&MockObject $mapperMock */
-		$mapperMock = $this->createMock(UserMapping::class);
-		$mapperMock->expects($this->any())
-			->method('getNameByDN')
-			->willReturn('a_username');
-
-		$userMock = $this->createMock(User::class);
-
-		$this->access->connection->expects($this->any())
-			->method('__get')
-			->willReturn('displayName');
-
-		$this->access->setUserMapper($mapperMock);
-
-		$displayNameAttribute = strtolower($this->access->connection->ldapUserDisplayName);
-		$data = [
-			[
-				'dn' => ['foobar'],
-				$displayNameAttribute => 'barfoo'
-			],
-			[
-				'dn' => ['foo'],
-				$displayNameAttribute => 'bar'
-			],
-			[
-				'dn' => ['raboof'],
-				$displayNameAttribute => 'oofrab'
-			]
-		];
-
-		$userMock->expects($this->never())
-			->method('processAttributes');
-
-		$this->userManager->expects($this->any())
-			->method('get')
-			->willReturn($this->createMock(User::class));
-
-		$this->access->batchApplyUserAttributes($data);
-	}
-
-	public function testBatchApplyUserAttributesDontSkip(): void {
-		/** @var UserMapping&MockObject $mapperMock */
-		$mapperMock = $this->createMock(UserMapping::class);
-		$mapperMock->expects($this->any())
-			->method('getNameByDN')
-			->willReturn('a_username');
-
-		$userMock = $this->createMock(User::class);
-
-		$this->access->connection->expects($this->any())
-			->method('__get')
-			->willReturn('displayName');
-
-		$this->access->setUserMapper($mapperMock);
-
-		$displayNameAttribute = strtolower($this->access->connection->ldapUserDisplayName);
-		$data = [
-			[
-				'dn' => ['foobar'],
-				$displayNameAttribute => 'barfoo'
-			],
-			[
-				'dn' => ['foo'],
-				$displayNameAttribute => 'bar'
-			],
-			[
-				'dn' => ['raboof'],
-				$displayNameAttribute => 'oofrab'
-			]
-		];
-
-		$userMock->expects($this->exactly(count($data)))
-			->method('processAttributes');
-
-		$this->userManager->expects($this->exactly(count($data) * 2))
-			->method('get')
-			->willReturn($userMock);
-
-		$this->access->batchApplyUserAttributes($data);
-	}
-
-	public static function dNAttributeProvider(): array {
-		// corresponds to Access::resemblesDN()
-		return [
-			'dn' => ['dn'],
-			'uniqueMember' => ['uniquemember'],
-			'member' => ['member'],
-			'memberOf' => ['memberof']
-		];
-	}
-
-	/**
-	 * @dataProvider dNAttributeProvider
-	 */
-	public function testSanitizeDN(string $attribute): void {
-		[$lw, $con, $um, $helper] = $this->getConnectorAndLdapMock();
-		/** @var IConfig&MockObject $config */
-		$config = $this->createMock(IConfig::class);
-
-		$dnFromServer = 'cn=Mixed Cases,ou=Are Sufficient To,ou=Test,dc=example,dc=org';
-
-		$lw->expects($this->any())
-			->method('isResource')
-			->willReturn(true);
-		$lw->expects($this->any())
-			->method('getAttributes')
-			->willReturn([
-				$attribute => ['count' => 1, $dnFromServer]
-			]);
-
-		$access = new Access($lw, $con, $um, $helper, $config, $this->ncUserManager, $this->logger, $this->appConfig, $this->dispatcher);
-		$values = $access->readAttribute('uid=whoever,dc=example,dc=org', $attribute);
-		$this->assertSame($values[0], strtolower($dnFromServer));
-	}
-
-
-	public function testSetPasswordWithDisabledChanges(): void {
-		$this->expectException(\Exception::class);
-		$this->expectExceptionMessage('LDAP password changes are disabled');
-
-		$this->connection
-			->method('__get')
-			->willReturn(false);
-
-		/** @noinspection PhpUnhandledExceptionInspection */
-		$this->access->setPassword('CN=foo', 'MyPassword');
-	}
-
-	public function testSetPasswordWithLdapNotAvailable(): void {
-		$this->connection
-			->method('__get')
-			->willReturn(true);
-		$connection = ldap_connect('ldap://example.com');
-		$this->connection
-			->expects($this->once())
-			->method('getConnectionResource')
-			->willThrowException(new ServerNotAvailableException('Connection to LDAP server could not be established'));
-		$this->ldap
-			->expects($this->never())
-			->method('isResource');
-
-		$this->expectException(ServerNotAvailableException::class);
-		$this->expectExceptionMessage('Connection to LDAP server could not be established');
-		$this->access->setPassword('CN=foo', 'MyPassword');
-	}
-
-
-	public function testSetPasswordWithRejectedChange(): void {
-		$this->expectException(HintException::class);
-		$this->expectExceptionMessage('Password change rejected.');
-
-		$this->connection
-			->method('__get')
-			->willReturn(true);
-		$connection = ldap_connect('ldap://example.com');
-		$this->connection
-			->expects($this->any())
-			->method('getConnectionResource')
-			->willReturn($connection);
-		$this->ldap
-			->expects($this->once())
-			->method('modReplace')
-			->with($connection, 'CN=foo', 'MyPassword')
-			->willThrowException(new ConstraintViolationException());
-
-		/** @noinspection PhpUnhandledExceptionInspection */
-		$this->access->setPassword('CN=foo', 'MyPassword');
-	}
-
-	public function testSetPassword(): void {
-		$this->connection
-			->method('__get')
-			->willReturn(true);
-		$connection = ldap_connect('ldap://example.com');
-		$this->connection
-			->expects($this->any())
-			->method('getConnectionResource')
-			->willReturn($connection);
-		$this->ldap
-			->expects($this->once())
-			->method('modReplace')
-			->with($connection, 'CN=foo', 'MyPassword')
-			->willReturn(true);
-
-		/** @noinspection PhpUnhandledExceptionInspection */
-		$this->assertTrue($this->access->setPassword('CN=foo', 'MyPassword'));
-	}
-
-	protected function prepareMocksForSearchTests(
-		$base,
-		$fakeConnection,
-		$fakeSearchResultResource,
-		$fakeLdapEntries,
-	) {
-		$this->connection
-			->expects($this->any())
-			->method('getConnectionResource')
-			->willReturn($fakeConnection);
-		$this->connection->expects($this->any())
-			->method('__get')
-			->willReturnCallback(function ($key) use ($base) {
-				if (stripos($key, 'base') !== false) {
-					return [$base];
-				}
-				return null;
-			});
-
-		$this->ldap
-			->expects($this->any())
-			->method('isResource')
-			->willReturnCallback(function ($resource) {
-				return is_object($resource);
-			});
-		$this->ldap
-			->expects($this->any())
-			->method('errno')
-			->willReturn(0);
-		$this->ldap
-			->expects($this->once())
-			->method('search')
-			->willReturn($fakeSearchResultResource);
-		$this->ldap
-			->expects($this->exactly(1))
-			->method('getEntries')
-			->willReturn($fakeLdapEntries);
-
-		$this->helper->expects($this->any())
-			->method('sanitizeDN')
-			->willReturnArgument(0);
-	}
-
-	public function testSearchNoPagedSearch(): void {
-		// scenario: no pages search, 1 search base
-		$filter = 'objectClass=nextcloudUser';
-		$base = 'ou=zombies,dc=foobar,dc=nextcloud,dc=com';
-
-		$fakeConnection = ldap_connect();
-		$fakeSearchResultResource = ldap_connect();
-		$fakeLdapEntries = [
-			'count' => 2,
-			[
-				'dn' => 'uid=sgarth,' . $base,
-			],
-			[
-				'dn' => 'uid=wwilson,' . $base,
-			]
-		];
-
-		$expected = $fakeLdapEntries;
-		unset($expected['count']);
-
-		$this->prepareMocksForSearchTests($base, $fakeConnection, $fakeSearchResultResource, $fakeLdapEntries);
-
-		/** @noinspection PhpUnhandledExceptionInspection */
-		$result = $this->access->search($filter, $base);
-		$this->assertSame($expected, $result);
-	}
-
-	public function testFetchListOfUsers(): void {
-		$filter = 'objectClass=nextcloudUser';
-		$base = 'ou=zombies,dc=foobar,dc=nextcloud,dc=com';
-		$attrs = ['dn', 'uid'];
-
-		$fakeConnection = ldap_connect();
-		$fakeSearchResultResource = ldap_connect();
-		$fakeLdapEntries = [
-			'count' => 2,
-			[
-				'dn' => 'uid=sgarth,' . $base,
-				'uid' => [ 'sgarth' ],
-			],
-			[
-				'dn' => 'uid=wwilson,' . $base,
-				'uid' => [ 'wwilson' ],
-			]
-		];
-		$expected = $fakeLdapEntries;
-		unset($expected['count']);
-		array_walk($expected, function (&$v): void {
-			$v['dn'] = [$v['dn']];	// dn is translated into an array internally for consistency
-		});
-
-		$this->prepareMocksForSearchTests($base, $fakeConnection, $fakeSearchResultResource, $fakeLdapEntries);
-
-		// Called twice per user, for userExists and userExistsOnLdap
-		$this->connection->expects($this->exactly(2 * $fakeLdapEntries['count']))
-			->method('writeToCache')
-			->with($this->stringStartsWith('userExists'), true);
-
-		$this->userMapper->expects($this->exactly($fakeLdapEntries['count']))
-			->method('getNameByDN')
-			->willReturnCallback(function ($fdn) {
-				$parts = ldap_explode_dn($fdn, 0);
-				return $parts[0];
-			});
-
-		/** @noinspection PhpUnhandledExceptionInspection */
-		$list = $this->access->fetchListOfUsers($filter, $attrs);
-		$this->assertSame($expected, $list);
-	}
-
-	public function testFetchListOfGroupsKnown(): void {
-		$filter = 'objectClass=nextcloudGroup';
-		$attributes = ['cn', 'gidNumber', 'dn'];
-		$base = 'ou=SomeGroups,dc=my,dc=directory';
-
-		$fakeConnection = ldap_connect();
-		$fakeSearchResultResource = ldap_connect();
-		$fakeLdapEntries = [
-			'count' => 2,
-			[
-				'dn' => 'cn=Good Team,' . $base,
-				'cn' => ['Good Team'],
-			],
-			[
-				'dn' => 'cn=Another Good Team,' . $base,
-				'cn' => ['Another Good Team'],
-			]
-		];
-
-		$this->prepareMocksForSearchTests($base, $fakeConnection, $fakeSearchResultResource, $fakeLdapEntries);
-
-		$this->groupMapper->expects($this->any())
-			->method('getListOfIdsByDn')
-			->willReturn([
-				'cn=Good Team,' . $base => 'Good_Team',
-				'cn=Another Good Team,' . $base => 'Another_Good_Team',
-			]);
-		$this->groupMapper->expects($this->never())
-			->method('getNameByDN');
-
-		$this->connection->expects($this->exactly(1))
-			->method('writeToCache');
-
-		$groups = $this->access->fetchListOfGroups($filter, $attributes);
-		$this->assertSame(2, count($groups));
-		$this->assertSame('Good Team', $groups[0]['cn'][0]);
-		$this->assertSame('Another Good Team', $groups[1]['cn'][0]);
-	}
-
-	public static function intUsernameProvider(): array {
-		return [
-			['alice', 'alice'],
-			['b/ob', 'bob'],
-			['charly