Total Complexity | 86 |
Total Lines | 582 |
Duplicated Lines | 0 % |
Changes | 0 |
Complex classes like User_LDAP often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use User_LDAP, and based on these observations, apply Extract Interface, too.
1 | <?php |
||
54 | class User_LDAP extends BackendUtility implements \OCP\IUserBackend, \OCP\UserInterface, IUserLDAP { |
||
55 | /** @var \OCP\IConfig */ |
||
56 | protected $ocConfig; |
||
57 | |||
58 | /** @var INotificationManager */ |
||
59 | protected $notificationManager; |
||
60 | |||
61 | /** @var UserPluginManager */ |
||
62 | protected $userPluginManager; |
||
63 | |||
64 | /** |
||
65 | * @param Access $access |
||
66 | * @param \OCP\IConfig $ocConfig |
||
67 | * @param \OCP\Notification\IManager $notificationManager |
||
68 | * @param IUserSession $userSession |
||
69 | */ |
||
70 | public function __construct(Access $access, IConfig $ocConfig, INotificationManager $notificationManager, IUserSession $userSession, UserPluginManager $userPluginManager) { |
||
71 | parent::__construct($access); |
||
72 | $this->ocConfig = $ocConfig; |
||
73 | $this->notificationManager = $notificationManager; |
||
74 | $this->userPluginManager = $userPluginManager; |
||
75 | } |
||
76 | |||
77 | /** |
||
78 | * checks whether the user is allowed to change his avatar in Nextcloud |
||
79 | * |
||
80 | * @param string $uid the Nextcloud user name |
||
81 | * @return boolean either the user can or cannot |
||
82 | * @throws \Exception |
||
83 | */ |
||
84 | public function canChangeAvatar($uid) { |
||
85 | if ($this->userPluginManager->implementsActions(Backend::PROVIDE_AVATAR)) { |
||
86 | return $this->userPluginManager->canChangeAvatar($uid); |
||
87 | } |
||
88 | |||
89 | if(!$this->implementsActions(Backend::PROVIDE_AVATAR)) { |
||
90 | return true; |
||
91 | } |
||
92 | |||
93 | $user = $this->access->userManager->get($uid); |
||
94 | if(!$user instanceof User) { |
||
95 | return false; |
||
96 | } |
||
97 | $imageData = $user->getAvatarImage(); |
||
98 | if($imageData === false) { |
||
|
|||
99 | return true; |
||
100 | } |
||
101 | return !$user->updateAvatar(true); |
||
102 | } |
||
103 | |||
104 | /** |
||
105 | * Return the username for the given login name, if available |
||
106 | * |
||
107 | * @param string $loginName |
||
108 | * @return string|false |
||
109 | * @throws \Exception |
||
110 | */ |
||
111 | public function loginName2UserName($loginName) { |
||
112 | $cacheKey = 'loginName2UserName-' . $loginName; |
||
113 | $username = $this->access->connection->getFromCache($cacheKey); |
||
114 | |||
115 | if ($username !== null) { |
||
116 | return $username; |
||
117 | } |
||
118 | |||
119 | try { |
||
120 | $ldapRecord = $this->getLDAPUserByLoginName($loginName); |
||
121 | $user = $this->access->userManager->get($ldapRecord['dn'][0]); |
||
122 | if ($user === null || $user instanceof OfflineUser) { |
||
123 | // this path is not really possible, however get() is documented |
||
124 | // to return User, OfflineUser or null so we are very defensive here. |
||
125 | $this->access->connection->writeToCache($cacheKey, false); |
||
126 | return false; |
||
127 | } |
||
128 | $username = $user->getUsername(); |
||
129 | $this->access->connection->writeToCache($cacheKey, $username); |
||
130 | return $username; |
||
131 | } catch (NotOnLDAP $e) { |
||
132 | $this->access->connection->writeToCache($cacheKey, false); |
||
133 | return false; |
||
134 | } |
||
135 | } |
||
136 | |||
137 | /** |
||
138 | * returns the username for the given LDAP DN, if available |
||
139 | * |
||
140 | * @param string $dn |
||
141 | * @return string|false with the username |
||
142 | */ |
||
143 | public function dn2UserName($dn) { |
||
144 | return $this->access->dn2username($dn); |
||
145 | } |
||
146 | |||
147 | /** |
||
148 | * returns an LDAP record based on a given login name |
||
149 | * |
||
150 | * @param string $loginName |
||
151 | * @return array |
||
152 | * @throws NotOnLDAP |
||
153 | */ |
||
154 | public function getLDAPUserByLoginName($loginName) { |
||
155 | //find out dn of the user name |
||
156 | $attrs = $this->access->userManager->getAttributes(); |
||
157 | $users = $this->access->fetchUsersByLoginName($loginName, $attrs); |
||
158 | if(count($users) < 1) { |
||
159 | throw new NotOnLDAP('No user available for the given login name on ' . |
||
160 | $this->access->connection->ldapHost . ':' . $this->access->connection->ldapPort); |
||
161 | } |
||
162 | return $users[0]; |
||
163 | } |
||
164 | |||
165 | /** |
||
166 | * Check if the password is correct without logging in the user |
||
167 | * |
||
168 | * @param string $uid The username |
||
169 | * @param string $password The password |
||
170 | * @return false|string |
||
171 | */ |
||
172 | public function checkPassword($uid, $password) { |
||
173 | try { |
||
174 | $ldapRecord = $this->getLDAPUserByLoginName($uid); |
||
175 | } catch(NotOnLDAP $e) { |
||
176 | \OC::$server->getLogger()->logException($e, ['app' => 'user_ldap', 'level' => ILogger::DEBUG]); |
||
177 | return false; |
||
178 | } |
||
179 | $dn = $ldapRecord['dn'][0]; |
||
180 | $user = $this->access->userManager->get($dn); |
||
181 | |||
182 | if(!$user instanceof User) { |
||
183 | Util::writeLog('user_ldap', |
||
184 | 'LDAP Login: Could not get user object for DN ' . $dn . |
||
185 | '. Maybe the LDAP entry has no set display name attribute?', |
||
186 | ILogger::WARN); |
||
187 | return false; |
||
188 | } |
||
189 | if($user->getUsername() !== false) { |
||
190 | //are the credentials OK? |
||
191 | if(!$this->access->areCredentialsValid($dn, $password)) { |
||
192 | return false; |
||
193 | } |
||
194 | |||
195 | $this->access->cacheUserExists($user->getUsername()); |
||
196 | $user->processAttributes($ldapRecord); |
||
197 | $user->markLogin(); |
||
198 | |||
199 | return $user->getUsername(); |
||
200 | } |
||
201 | |||
202 | return false; |
||
203 | } |
||
204 | |||
205 | /** |
||
206 | * Set password |
||
207 | * @param string $uid The username |
||
208 | * @param string $password The new password |
||
209 | * @return bool |
||
210 | */ |
||
211 | public function setPassword($uid, $password) { |
||
212 | if ($this->userPluginManager->implementsActions(Backend::SET_PASSWORD)) { |
||
213 | return $this->userPluginManager->setPassword($uid, $password); |
||
214 | } |
||
215 | |||
216 | $user = $this->access->userManager->get($uid); |
||
217 | |||
218 | if(!$user instanceof User) { |
||
219 | throw new \Exception('LDAP setPassword: Could not get user object for uid ' . $uid . |
||
220 | '. Maybe the LDAP entry has no set display name attribute?'); |
||
221 | } |
||
222 | if($user->getUsername() !== false && $this->access->setPassword($user->getDN(), $password)) { |
||
223 | $ldapDefaultPPolicyDN = $this->access->connection->ldapDefaultPPolicyDN; |
||
224 | $turnOnPasswordChange = $this->access->connection->turnOnPasswordChange; |
||
225 | if (!empty($ldapDefaultPPolicyDN) && ((int)$turnOnPasswordChange === 1)) { |
||
226 | //remove last password expiry warning if any |
||
227 | $notification = $this->notificationManager->createNotification(); |
||
228 | $notification->setApp('user_ldap') |
||
229 | ->setUser($uid) |
||
230 | ->setObject('pwd_exp_warn', $uid) |
||
231 | ; |
||
232 | $this->notificationManager->markProcessed($notification); |
||
233 | } |
||
234 | return true; |
||
235 | } |
||
236 | |||
237 | return false; |
||
238 | } |
||
239 | |||
240 | /** |
||
241 | * Get a list of all users |
||
242 | * |
||
243 | * @param string $search |
||
244 | * @param integer $limit |
||
245 | * @param integer $offset |
||
246 | * @return string[] an array of all uids |
||
247 | */ |
||
248 | public function getUsers($search = '', $limit = 10, $offset = 0) { |
||
249 | $search = $this->access->escapeFilterPart($search, true); |
||
250 | $cachekey = 'getUsers-'.$search.'-'.$limit.'-'.$offset; |
||
251 | |||
252 | //check if users are cached, if so return |
||
253 | $ldap_users = $this->access->connection->getFromCache($cachekey); |
||
254 | if(!is_null($ldap_users)) { |
||
255 | return $ldap_users; |
||
256 | } |
||
257 | |||
258 | // if we'd pass -1 to LDAP search, we'd end up in a Protocol |
||
259 | // error. With a limit of 0, we get 0 results. So we pass null. |
||
260 | if($limit <= 0) { |
||
261 | $limit = null; |
||
262 | } |
||
263 | $filter = $this->access->combineFilterWithAnd(array( |
||
264 | $this->access->connection->ldapUserFilter, |
||
265 | $this->access->connection->ldapUserDisplayName . '=*', |
||
266 | $this->access->getFilterPartForUserSearch($search) |
||
267 | )); |
||
268 | |||
269 | Util::writeLog('user_ldap', |
||
270 | 'getUsers: Options: search '.$search.' limit '.$limit.' offset '.$offset.' Filter: '.$filter, |
||
271 | ILogger::DEBUG); |
||
272 | //do the search and translate results to Nextcloud names |
||
273 | $ldap_users = $this->access->fetchListOfUsers( |
||
274 | $filter, |
||
275 | $this->access->userManager->getAttributes(true), |
||
276 | $limit, $offset); |
||
277 | $ldap_users = $this->access->nextcloudUserNames($ldap_users); |
||
278 | Util::writeLog('user_ldap', 'getUsers: '.count($ldap_users). ' Users found', ILogger::DEBUG); |
||
279 | |||
280 | $this->access->connection->writeToCache($cachekey, $ldap_users); |
||
281 | return $ldap_users; |
||
282 | } |
||
283 | |||
284 | /** |
||
285 | * checks whether a user is still available on LDAP |
||
286 | * |
||
287 | * @param string|\OCA\User_LDAP\User\User $user either the Nextcloud user |
||
288 | * name or an instance of that user |
||
289 | * @return bool |
||
290 | * @throws \Exception |
||
291 | * @throws \OC\ServerNotAvailableException |
||
292 | */ |
||
293 | public function userExistsOnLDAP($user) { |
||
294 | if(is_string($user)) { |
||
295 | $user = $this->access->userManager->get($user); |
||
296 | } |
||
297 | if(is_null($user)) { |
||
298 | return false; |
||
299 | } |
||
300 | $uid = $user instanceof User ? $user->getUsername() : $user->getOCName(); |
||
301 | $cacheKey = 'userExistsOnLDAP' . $uid; |
||
302 | $userExists = $this->access->connection->getFromCache($cacheKey); |
||
303 | if(!is_null($userExists)) { |
||
304 | return (bool)$userExists; |
||
305 | } |
||
306 | |||
307 | $dn = $user->getDN(); |
||
308 | //check if user really still exists by reading its entry |
||
309 | if(!is_array($this->access->readAttribute($dn, '', $this->access->connection->ldapUserFilter))) { |
||
310 | try { |
||
311 | $uuid = $this->access->getUserMapper()->getUUIDByDN($dn); |
||
312 | if (!$uuid) { |
||
313 | $this->access->connection->writeToCache($cacheKey, false); |
||
314 | return false; |
||
315 | } |
||
316 | $newDn = $this->access->getUserDnByUuid($uuid); |
||
317 | //check if renamed user is still valid by reapplying the ldap filter |
||
318 | if ($newDn === $dn || !is_array($this->access->readAttribute($newDn, '', $this->access->connection->ldapUserFilter))) { |
||
319 | $this->access->connection->writeToCache($cacheKey, false); |
||
320 | return false; |
||
321 | } |
||
322 | $this->access->getUserMapper()->setDNbyUUID($newDn, $uuid); |
||
323 | $this->access->connection->writeToCache($cacheKey, true); |
||
324 | return true; |
||
325 | } catch (ServerNotAvailableException $e) { |
||
326 | throw $e; |
||
327 | } catch (\Exception $e) { |
||
328 | $this->access->connection->writeToCache($cacheKey, false); |
||
329 | return false; |
||
330 | } |
||
331 | } |
||
332 | |||
333 | if($user instanceof OfflineUser) { |
||
334 | $user->unmark(); |
||
335 | } |
||
336 | |||
337 | $this->access->connection->writeToCache($cacheKey, true); |
||
338 | return true; |
||
339 | } |
||
340 | |||
341 | /** |
||
342 | * check if a user exists |
||
343 | * @param string $uid the username |
||
344 | * @return boolean |
||
345 | * @throws \Exception when connection could not be established |
||
346 | */ |
||
347 | public function userExists($uid) { |
||
348 | $userExists = $this->access->connection->getFromCache('userExists'.$uid); |
||
349 | if(!is_null($userExists)) { |
||
350 | return (bool)$userExists; |
||
351 | } |
||
352 | //getting dn, if false the user does not exist. If dn, he may be mapped only, requires more checking. |
||
353 | $user = $this->access->userManager->get($uid); |
||
354 | |||
355 | if(is_null($user)) { |
||
356 | Util::writeLog('user_ldap', 'No DN found for '.$uid.' on '. |
||
357 | $this->access->connection->ldapHost, ILogger::DEBUG); |
||
358 | $this->access->connection->writeToCache('userExists'.$uid, false); |
||
359 | return false; |
||
360 | } |
||
361 | |||
362 | $this->access->connection->writeToCache('userExists'.$uid, true); |
||
363 | return true; |
||
364 | } |
||
365 | |||
366 | /** |
||
367 | * returns whether a user was deleted in LDAP |
||
368 | * |
||
369 | * @param string $uid The username of the user to delete |
||
370 | * @return bool |
||
371 | */ |
||
372 | public function deleteUser($uid) { |
||
373 | if ($this->userPluginManager->canDeleteUser()) { |
||
374 | $status = $this->userPluginManager->deleteUser($uid); |
||
375 | if($status === false) { |
||
376 | return false; |
||
377 | } |
||
378 | } |
||
379 | |||
380 | $marked = $this->ocConfig->getUserValue($uid, 'user_ldap', 'isDeleted', 0); |
||
381 | if((int)$marked === 0) { |
||
382 | \OC::$server->getLogger()->notice( |
||
383 | 'User '.$uid . ' is not marked as deleted, not cleaning up.', |
||
384 | ['app' => 'user_ldap']); |
||
385 | return false; |
||
386 | } |
||
387 | \OC::$server->getLogger()->info('Cleaning up after user ' . $uid, |
||
388 | ['app' => 'user_ldap']); |
||
389 | |||
390 | $this->access->getUserMapper()->unmap($uid); // we don't emit unassign signals here, since it is implicit to delete signals fired from core |
||
391 | $this->access->userManager->invalidate($uid); |
||
392 | return true; |
||
393 | } |
||
394 | |||
395 | /** |
||
396 | * get the user's home directory |
||
397 | * |
||
398 | * @param string $uid the username |
||
399 | * @return bool|string |
||
400 | * @throws NoUserException |
||
401 | * @throws \Exception |
||
402 | */ |
||
403 | public function getHome($uid) { |
||
404 | // user Exists check required as it is not done in user proxy! |
||
405 | if(!$this->userExists($uid)) { |
||
406 | return false; |
||
407 | } |
||
408 | |||
409 | if ($this->userPluginManager->implementsActions(Backend::GET_HOME)) { |
||
410 | return $this->userPluginManager->getHome($uid); |
||
411 | } |
||
412 | |||
413 | $cacheKey = 'getHome'.$uid; |
||
414 | $path = $this->access->connection->getFromCache($cacheKey); |
||
415 | if(!is_null($path)) { |
||
416 | return $path; |
||
417 | } |
||
418 | |||
419 | // early return path if it is a deleted user |
||
420 | $user = $this->access->userManager->get($uid); |
||
421 | if($user instanceof User || $user instanceof OfflineUser) { |
||
422 | $path = $user->getHomePath() ?: false; |
||
423 | } else { |
||
424 | throw new NoUserException($uid . ' is not a valid user anymore'); |
||
425 | } |
||
426 | |||
427 | $this->access->cacheUserHome($uid, $path); |
||
428 | return $path; |
||
429 | } |
||
430 | |||
431 | /** |
||
432 | * get display name of the user |
||
433 | * @param string $uid user ID of the user |
||
434 | * @return string|false display name |
||
435 | */ |
||
436 | public function getDisplayName($uid) { |
||
437 | if ($this->userPluginManager->implementsActions(Backend::GET_DISPLAYNAME)) { |
||
438 | return $this->userPluginManager->getDisplayName($uid); |
||
439 | } |
||
440 | |||
441 | if(!$this->userExists($uid)) { |
||
442 | return false; |
||
443 | } |
||
444 | |||
445 | $cacheKey = 'getDisplayName'.$uid; |
||
446 | if(!is_null($displayName = $this->access->connection->getFromCache($cacheKey))) { |
||
447 | return $displayName; |
||
448 | } |
||
449 | |||
450 | //Check whether the display name is configured to have a 2nd feature |
||
451 | $additionalAttribute = $this->access->connection->ldapUserDisplayName2; |
||
452 | $displayName2 = ''; |
||
453 | if ($additionalAttribute !== '') { |
||
454 | $displayName2 = $this->access->readAttribute( |
||
455 | $this->access->username2dn($uid), |
||
456 | $additionalAttribute); |
||
457 | } |
||
458 | |||
459 | $displayName = $this->access->readAttribute( |
||
460 | $this->access->username2dn($uid), |
||
461 | $this->access->connection->ldapUserDisplayName); |
||
462 | |||
463 | if($displayName && (count($displayName) > 0)) { |
||
464 | $displayName = $displayName[0]; |
||
465 | |||
466 | if (is_array($displayName2)){ |
||
467 | $displayName2 = count($displayName2) > 0 ? $displayName2[0] : ''; |
||
468 | } |
||
469 | |||
470 | $user = $this->access->userManager->get($uid); |
||
471 | if ($user instanceof User) { |
||
472 | $displayName = $user->composeAndStoreDisplayName($displayName, $displayName2); |
||
473 | $this->access->connection->writeToCache($cacheKey, $displayName); |
||
474 | } |
||
475 | if ($user instanceof OfflineUser) { |
||
476 | /** @var OfflineUser $user*/ |
||
477 | $displayName = $user->getDisplayName(); |
||
478 | } |
||
479 | return $displayName; |
||
480 | } |
||
481 | |||
482 | return null; |
||
483 | } |
||
484 | |||
485 | /** |
||
486 | * set display name of the user |
||
487 | * @param string $uid user ID of the user |
||
488 | * @param string $displayName new display name of the user |
||
489 | * @return string|false display name |
||
490 | */ |
||
491 | public function setDisplayName($uid, $displayName) { |
||
492 | if ($this->userPluginManager->implementsActions(Backend::SET_DISPLAYNAME)) { |
||
493 | $this->userPluginManager->setDisplayName($uid, $displayName); |
||
494 | $this->access->cacheUserDisplayName($uid, $displayName); |
||
495 | return $displayName; |
||
496 | } |
||
497 | return false; |
||
498 | } |
||
499 | |||
500 | /** |
||
501 | * Get a list of all display names |
||
502 | * |
||
503 | * @param string $search |
||
504 | * @param string|null $limit |
||
505 | * @param string|null $offset |
||
506 | * @return array an array of all displayNames (value) and the corresponding uids (key) |
||
507 | */ |
||
508 | public function getDisplayNames($search = '', $limit = null, $offset = null) { |
||
521 | } |
||
522 | |||
523 | /** |
||
524 | * Check if backend implements actions |
||
525 | * @param int $actions bitwise-or'ed actions |
||
526 | * @return boolean |
||
527 | * |
||
528 | * Returns the supported actions as int to be |
||
529 | * compared with \OC\User\Backend::CREATE_USER etc. |
||
530 | */ |
||
531 | public function implementsActions($actions) { |
||
532 | return (bool)((Backend::CHECK_PASSWORD |
||
533 | | Backend::GET_HOME |
||
534 | | Backend::GET_DISPLAYNAME |
||
535 | | (($this->access->connection->ldapUserAvatarRule !== 'none') ? Backend::PROVIDE_AVATAR : 0) |
||
536 | | Backend::COUNT_USERS |
||
537 | | (((int)$this->access->connection->turnOnPasswordChange === 1)? Backend::SET_PASSWORD :0) |
||
538 | | $this->userPluginManager->getImplementedActions()) |
||
539 | & $actions); |
||
540 | } |
||
541 | |||
542 | /** |
||
543 | * @return bool |
||
544 | */ |
||
545 | public function hasUserListings() { |
||
546 | return true; |
||
547 | } |
||
548 | |||
549 | /** |
||
550 | * counts the users in LDAP |
||
551 | * |
||
552 | * @return int|bool |
||
553 | */ |
||
554 | public function countUsers() { |
||
555 | if ($this->userPluginManager->implementsActions(Backend::COUNT_USERS)) { |
||
556 | return $this->userPluginManager->countUsers(); |
||
557 | } |
||
558 | |||
559 | $filter = $this->access->getFilterForUserCount(); |
||
560 | $cacheKey = 'countUsers-'.$filter; |
||
561 | if(!is_null($entries = $this->access->connection->getFromCache($cacheKey))) { |
||
562 | return $entries; |
||
563 | } |
||
564 | $entries = $this->access->countUsers($filter); |
||
565 | $this->access->connection->writeToCache($cacheKey, $entries); |
||
566 | return $entries; |
||
567 | } |
||
568 | |||
569 | /** |
||
570 | * Backend name to be shown in user management |
||
571 | * @return string the name of the backend to be shown |
||
572 | */ |
||
573 | public function getBackendName(){ |
||
574 | return 'LDAP'; |
||
575 | } |
||
576 | |||
577 | /** |
||
578 | * Return access for LDAP interaction. |
||
579 | * @param string $uid |
||
580 | * @return Access instance of Access for LDAP interaction |
||
581 | */ |
||
582 | public function getLDAPAccess($uid) { |
||
584 | } |
||
585 | |||
586 | /** |
||
587 | * Return LDAP connection resource from a cloned connection. |
||
588 | * The cloned connection needs to be closed manually. |
||
589 | * of the current access. |
||
590 | * @param string $uid |
||
591 | * @return resource of the LDAP connection |
||
592 | */ |
||
593 | public function getNewLDAPConnection($uid) { |
||
596 | } |
||
597 | |||
598 | /** |
||
599 | * create new user |
||
600 | * @param string $username username of the new user |
||
601 | * @param string $password password of the new user |
||
602 | * @throws \UnexpectedValueException |
||
603 | * @return bool |
||
604 | */ |
||
605 | public function createUser($username, $password) { |
||
636 | } |
||
637 | |||
638 | } |
||
639 |