LDAPMemberExtension

Complexity

Total Complexity

60

Size/Duplication

Total Lines	438
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	10

Importance

Changes	9
Bugs	0	Features	0

10 Methods

Rating	Name	Duplication	Size	Complexity
A	updateSummaryFields()	0	4	1
B	onAfterWrite()	0	22	5
A	memberLoggedIn()	0	6	2
B	updateCMSFields()	0	48	5
A	validate()	0	21	4
B	getLDAPGroupMembers()	0	18	5
B	onBeforeWrite()	0	20	6
B	createLDAPUser()	0	36	4
C	syncLDAP()	0	45	8
F	syncLDAPGroups()	0	88	20

<?php
/**
 * Class LDAPMemberExtension.
 *
 * Adds mappings from AD attributes to SilverStripe {@link Member} fields.
 */
class LDAPMemberExtension extends DataExtension

PSR1 recommends that each class must be in a namespace of at least one level to avoid collisions.

{
    /**
     * @var array
     */
    private static $db = array(

The property $db is not used and could be removed.

        // Unique user identifier, same field is used by SAMLMemberExtension
        'GUID' => 'Varchar(50)',
        'Username' => 'Varchar(64)',
        'IsImportedFromLDAP' => 'Boolean',
        'IsExpired' => 'Boolean',
        'LastSynced' => 'SS_Datetime',
    );

    /**
     * These fields are used by {@link LDAPMemberSync} to map specific AD attributes
     * to {@link Member} fields.
     *
     * @var array
     * @config
     */
    private static $ldap_field_mappings = array(

The property $ldap_field_mappings is not used and could be removed.

        'givenname' => 'FirstName',
        'samaccountname' => 'Username',
        'sn' => 'Surname',
        'mail' => 'Email',
    );

    /**
     * The location (relative to /assets) where to save thumbnailphoto data.
     *
     * @var string
     * @config
     */
    private static $ldap_thumbnail_path = 'Uploads';

The property $ldap_thumbnail_path is not used and could be removed.

    /**
     * When enabled, LDAP managed users have their data written back to LDAP.
     * This is a push to LDAP, rather than {@link LDAPMemberSyncTask}
     * which pulls from LDAP instead.
     *
     * This requires setting write permissions on the user who talks to LDAP,
     * which is why it's disabled by default.
     *
     * Note that some constants must be configured in your environment file
     * for this to work:
     *
     * LDAP_DOMAIN - the base DN of the directory. e.g. "DN=mydomain,DC=com"
     * LDAP_NEW_USERS_OBJECT_CATEGORY - the type of object. e.g. "CN=Person,CN=Schema,DC=mydomain,DC=com"
     * LDAP_NEW_USERS_DN - where to place users in the directory. e.g. "OU=Users,DC=mydomain,DC=com"
     *
     * @var bool
     * @config
     */
    private static $reverse_sync_ldap = false;

The property $reverse_sync_ldap is not used and could be removed.

    /**
     * If enabled, new users written are also created in LDAP.
     *
     * This requires setting write permissions on the user who talks to LDAP,
     * which is why it's disabled by default.
     *
     * Please see {@link $reverse_sync_ldap} for constants that must be configured in
     * your environment file for this to work.
     *
     * @var bool
     * @config
     */
    private static $create_new_users_in_ldap = false;

The property $create_new_users_in_ldap is not used and could be removed.

    /**
     * @var array
     */
    private static $dependencies = array(

The property $dependencies is not used and could be removed.

        'ldapService' => '%$LDAPService',
    );

    public function updateSummaryFields(&$fields)
    {
        $fields = array('Username' => 'Username') + $fields;
    }

    /**
     * @param FieldList $fields
     */
    public function updateCMSFields(FieldList $fields)
    {
        // Redo LDAP metadata fields as read-only and move to LDAP tab.
        $ldapMetadata = array();
        $fields->replaceField('IsImportedFromLDAP', $ldapMetadata[] = new ReadonlyField(
            'IsImportedFromLDAP',
            _t('LDAPMemberExtension.ISIMPORTEDFROMLDAP', 'Is user imported from LDAP/AD?')
        ));
        $fields->replaceField('GUID', $ldapMetadata[] = new ReadonlyField('GUID'));
        $fields->replaceField('IsExpired', $ldapMetadata[] = new ReadonlyField(
            'IsExpired',
            _t('LDAPMemberExtension.ISEXPIRED', 'Has user\'s LDAP/AD login expired?'))
        );
        $fields->replaceField('LastSynced', $ldapMetadata[] = new ReadonlyField(
            'LastSynced',
            _t('LDAPMemberExtension.LASTSYNCED', 'Last synced'))
        );
        $fields->addFieldsToTab('Root.LDAP', $ldapMetadata);

        if ($this->owner->IsImportedFromLDAP && !$this->config()->reverse_sync_ldap) {

The method config() does not exist on LDAPMemberExtension. Did you maybe mean get_extra_config()?

            // Transform the automatically mapped fields into read-only. This doesn't
            // apply if reverse sync is enabled, as changing data locally can be written back.
            foreach ($this->owner->config()->ldap_field_mappings as $name) {
                $field = $fields->dataFieldByName($name);
                if (!empty($field)) {
                    // Set to readonly, but not disabled so that the data is still sent to the
                    // server and doesn't break Member_Validator
                    $field->setReadonly(true);
                    $field->setTitle($field->Title()._t('LDAPMemberExtension.IMPORTEDFIELD', ' (imported)'));
                }
            }

            // Display alert message at the top. This is not applicable if reverse sync is
            $message = _t(
                'LDAPMemberExtension.INFOIMPORTED',
                'This user is automatically imported from LDAP. '.
                    'Manual changes to imported fields will be removed upon sync.'
            );
            $fields->addFieldToTab(
                'Root.Main',
                new LiteralField(
                    'Info',
                    sprintf('<p class="message warning">%s</p>', $message)
                ),
                'FirstName'
            );
        }
    }

    /**
     * Creates a new LDAP user given the current Member details.
     */
    public function createLDAPUser()
    {
        $service = $this->ldapService;

The property ldapService does not exist. Did you maybe forget to declare it?

        if (!$service->enabled()) {
            return;
        }

        // Create user in LDAP using available information.
        $dn = sprintf('CN=%s,%s', $this->owner->Username, LDAP_NEW_USERS_DN);

        try {
            $service->add($dn, [
                'objectclass' => 'user',
                'cn' => $this->owner->Username,
                'instancetype' => '4',
                'codepage' => '0',
                'countrycode' => '0',
                'accountexpires' => '9223372036854775807',
                'userprincipalname' => sprintf('%s@%s', $this->owner->Username, LDAP_DOMAIN),
                'objectcategory' => LDAP_NEW_USERS_OBJECT_CATEGORY,
                'useraccountcontrol' => '66048',
                'distinguishedname' => $dn,
            ]);
        } catch (\Exception $e) {
            throw new ValidationException('LDAP synchronisation failure: '.$e->getMessage());
        }

        $user = $service->getUserByUsername($this->owner->Username);
        if (empty($user['objectguid'])) {
            throw new ValidationException('LDAP synchronisation failure: user missing GUID');
        }

        // Creation was successful, mark the user as synced with LDAP.
        $this->owner->GUID = $user['objectguid'];
        $this->owner->IsImportedFromLDAP = 1;
    }

    /**
     * Sync the Member data back to the corresponding LDAP user object.
     * @throws ValidationException
     */
    public function syncLDAP()
    {
        $service = $this->ldapService;
        if (!$service->enabled()) {
            return;
        }
        if (!$this->owner->IsImportedFromLDAP) {
            return;
        }

        $data = $service->getUserByGUID($this->owner->GUID);
        if (empty($data['objectguid'])) {
            throw new ValidationException('LDAP synchronisation failure: user missing GUID');
        }

        $dn = $data['distinguishedname'];

        try {
            // If the common name (cn) has changed, we need to ensure they've been moved
            // to the new DN, to avoid any clashes between user objects.
            if ($data['cn'] != $this->owner->Username) {
                $newDn = sprintf('CN=%s,%s', $this->owner->Username, preg_replace('/^CN=(.+?),/', '', $dn));
                $service->move($dn, $newDn);
                $dn = $newDn;
            }

            $attributes = array(
                'displayname' => sprintf('%s %s', $this->owner->FirstName, $this->owner->Surname),
                'name' => sprintf('%s %s', $this->owner->FirstName, $this->owner->Surname),
                'userprincipalname' => sprintf('%s@%s', $this->owner->Username, LDAP_DOMAIN),
            );
            foreach ($this->owner->config()->ldap_field_mappings as $attribute => $field) {
                $relationClass = $this->owner->getRelationClass($field);
                if ($relationClass) {

This if statement is empty and can be removed.

                    // todo no support for writing back relations yet.
                } else {
                    $attributes[$attribute] = $this->owner->$field;
                }
            }

            $service->update($dn, $attributes);
        } catch (\Exception $e) {
            throw new ValidationException('LDAP synchronisation failure: '.$e->getMessage());
        }
    }

    public function validate(ValidationResult $validationResult)
    {
        if (!$this->owner->config()->create_new_users_in_ldap) {
            return;
        }

        // We allow empty Username for registration purposes, as we need to
        // create Member records with empty Username temporarily. Forms should explicitly
        // check for Username not being empty if they require it not to be.
        if (empty($this->owner->Username)) {
            return;
        }

        if (!preg_match('/^[a-z0-9\.]+$/', $this->owner->Username)) {
            $validationResult->error(
                'Username must only contain lowercase alphanumeric characters and dots.',
                'bad'
            );
            throw new ValidationException($validationResult);
        }
    }

    /**
     * Ensure the user belongs to the correct groups in LDAP, making the
     * assumption that the assigned groups are correct.
     * This is considered a reverse sync back to LDAP.
     *
     * This also removes them from LDAP groups if they've been taken out of one.
     * It will not affect group membership of non-mapped groups, so it will
     * not touch such internal AD groups like "Domain Users".
     */
    public function syncLDAPGroups()
    {
        $service = $this->ldapService;
        if (!$service->enabled()) {
            return;
        }
        if (!$this->owner->IsImportedFromLDAP) {
            return;
        }

        $addGroups = array();
        $removeGroups = array();

        $user = $service->getUserByGUID($this->owner->GUID);
        if (empty($user['objectguid'])) {
            throw new ValidationException('LDAP synchronisation failure: user missing GUID');
        }

        // If a user belongs to a single group, this comes through as a string.
        // Normalise to a array so it's consistent.
        $existingGroups = !empty($user['memberof']) ? $user['memberof'] : array();
        if ($existingGroups && is_string($existingGroups)) {
            $existingGroups = array($existingGroups);
        }

        foreach ($this->owner->Groups() as $group) {
            if (!$group->IsImportedFromLDAP) {
                continue;
            }

            // mark this group as something we need to ensure the user belongs to in LDAP.
            $addGroups[] = $group->DN;
        }

        // Which existing LDAP groups are not in the add groups? We'll check these groups to
        // see if the user should be removed from any of them.
        $remainingGroups = array_diff($existingGroups, $addGroups);

        foreach ($remainingGroups as $groupDn) {
            // We only want to be removing groups we have a local Group mapped to. Removing
            // membership for anything else would be bad!
            $group = Group::get()->filter('DN', $groupDn)->first();
            if (!$group || !$group->exists()) {
                continue;
            }

            // this group should be removed from the user's memberof attribute, as it's been removed.
            $removeGroups[] = $groupDn;
        }

        // go through the groups we want the user to be in and ensure they're in them.
        foreach ($addGroups as $groupDn) {
            $members = $this->getLDAPGroupMembers($groupDn);

            // this user is already in the group, no need to do anything.
            if (in_array($user['distinguishedname'], $members)) {
                continue;
            }

            $members[] = $user['distinguishedname'];

            try {
                $service->update($groupDn, array('member' => $members));
            } catch (\Exception $e) {
                throw new ValidationException('LDAP group membership add failure: '.$e->getMessage());
            }
        }

        // go through the groups we _don't_ want the user to be in and ensure they're taken out of them.
        foreach ($removeGroups as $groupDn) {
            $members = $this->getLDAPGroupMembers($groupDn);

            // remove the user from the members data.
            if (in_array($user['distinguishedname'], $members)) {
                foreach ($members as $i => $dn) {
                    if ($dn == $user['distinguishedname']) {
                        unset($members[$i]);
                    }
                }
            }

            try {
                $service->update($groupDn, array('member' => $members));
            } catch (\Exception $e) {
                throw new ValidationException('LDAP group membership remove failure: '.$e->getMessage());
            }
        }
    }

    /**
     * Given a group DN, look up the group membership data in LDAP.
     *
     * @param string $groupDn
     *
     * @return array
     */
    protected function getLDAPGroupMembers($groupDn)
    {
        $service = $this->ldapService;
        if (!$service->enabled()) {
            return;
        }

        $groupObj = Group::get()->filter('DN', $groupDn)->first();
        $groupData = $service->getGroupByGUID($groupObj->GUID);
        $members = !empty($groupData['member']) ? $groupData['member'] : array();
        // If a user belongs to a single group, this comes through as a string.
        // Normalise to a array so it's consistent.
        if ($members && is_string($members)) {
            $members = array($members);
        }

        return $members;
    }

    /**
     * Create the user in LDAP and mark as synced, provided that
     * reverse sync is enabled.
     *
     * Set a flag "Creating" so other extensions using on*() events can
     * detect whether it's in a state of being created, such as for
     * synchronising with other services when a user is being created
     * in LDAP for the first time.
     */
    public function onBeforeWrite()
    {
        if (!$this->owner->config()->create_new_users_in_ldap) {
            return;
        }
        $service = $this->ldapService;
        if (!$service->enabled()) {
            return;
        }

        if ($this->owner->Username) {
            $this->owner->Username = strtolower($this->owner->Username);
        }

        // Ensure the user exists LDAP.
        if ($this->owner->Username && !$this->owner->IsImportedFromLDAP) {
            $this->createLDAPUser();
            $this->owner->Creating = true;
        }
    }

    /**
     * Sync the local data with LDAP, and ensure local membership is also set in
     * LDAP too. This writes into LDAP, provided reverse sync is enabled.
     */
    public function onAfterWrite()
    {
        if (!$this->owner->config()->reverse_sync_ldap) {
            return;
        }
        if ($this->owner->IsImportedFromLDAP) {
            $this->syncLDAP();
            $this->syncLDAPGroups();
        }

        if (
            !$this->owner->Creating ||
            !$this->owner->IsImportedFromLDAP
        ) {
            return;
        }

        // muzdowski: Creation is entering the last phase. I have seen framework trying to ->write
        // twice in a row, resulting in an irrelevant error second time around. Mark creation
        // explicitly as done to prevent that.
        $this->owner->Creating = false;
    }

    /**
     * Triggered by {@link Member::logIn()} when successfully logged in,
     * this will update the Member record from AD data.
     */
    public function memberLoggedIn()
    {
        if ($this->owner->GUID) {
            $this->ldapService->updateMemberFromLDAP($this->owner);
        }
    }
}