SilverStripe\ActiveDirectory\Authenticators\LDAPAuthenticator

Complexity

Total Complexity

17

Size/Duplication

Total Lines	159
Duplicated Lines	17.61 %

Coupling/Cohesion

Components	0
Dependencies	10

Importance

Changes

0

4 Methods

Rating	Name	Duplication	Size	Complexity
A	get_name()	0	4	1
A	get_login_form()	0	4	1
C	authenticate()	28	76	14
A	fallback_authenticate()	0	14	1

<?php

namespace SilverStripe\ActiveDirectory\Authenticators;

use SilverStripe\Control\Controller;
use SilverStripe\Control\Email\Email;
use SilverStripe\Control\Session;
use SilverStripe\Core\Config\Config;
use SilverStripe\Core\Injector\Injector;
use SilverStripe\Forms\Form;
use SilverStripe\Security\Authenticator;
use SilverStripe\Security\Member;

/**
 * Class LDAPAuthenticator
 *
 * Authenticate a user against LDAP, without the single sign-on component.
 *
 * See SAMLAuthenticator for further information.
 *
 * @package activedirectory
 */
class LDAPAuthenticator extends Authenticator
{
    /**
     * @var string
     */
    private $name = 'LDAP';

The property $name is not used and could be removed.

    /**
     * Set to 'yes' to indicate if this module should look up usernames in LDAP by matching the email addresses.
     *
     * CAVEAT #1: only set to 'yes' for systems that enforce email uniqueness.
     * Otherwise only the first LDAP user with matching email will be accessible.
     *
     * CAVEAT #2: this is untested for systems that use LDAP with principal style usernames (i.e. foo@bar.com).
     * The system will misunderstand emails for usernames with uncertain outcome.
     *
     * @var string 'no' or 'yes'
     */
    private static $allow_email_login = 'no';

The property $allow_email_login is not used and could be removed.

    /**
     * Set to 'yes' to fallback login attempts to {@link $fallback_authenticator}.
     * This will occur if LDAP fails to authenticate the user.
     *
     * @var string 'no' or 'yes'
     */
    private static $fallback_authenticator = 'no';

The property $fallback_authenticator is not used and could be removed.

    /**
     * The class of {@link Authenticator} to use as the fallback authenticator.
     *
     * @var string
     */
    private static $fallback_authenticator_class = 'SilverStripe\\Security\\MemberAuthenticator';

The property $fallback_authenticator_class is not used and could be removed.

    /**
     * @return string
     */
    public static function get_name()
    {
        return Config::inst()->get('SilverStripe\\ActiveDirectory\\Authenticators\\LDAPAuthenticator', 'name');
    }

    /**
     * @param Controller $controller
     * @return LDAPLoginForm
     */
    public static function get_login_form(Controller $controller)
    {
        return new LDAPLoginForm($controller, 'LoginForm');

$controller is of type object<SilverStripe\Control\Controller>, but the function expects a object<SilverStripe\ActiveDirectory\Authenticators\Controller>.

    }

    /**
     * Performs the login, but will also create and sync the Member record on-the-fly, if not found.
     *
     * @param array $data
     * @param Form $form
     * @return bool|Member|void
     * @throws HTTPResponse_Exception
     */
    public static function authenticate($data, Form $form = null)
    {
        $service = Injector::inst()->get('SilverStripe\\ActiveDirectory\\Services\\LDAPService');
        $login = trim($data['Login']);
        if (Email::is_valid_address($login)) {
            if (Config::inst()->get('SilverStripe\\ActiveDirectory\\Authenticators\\LDAPAuthenticator', 'allow_email_login') != 'yes') {
                $form->sessionMessage(

It seems like $form is not always an object, but can also be of type null. Maybe add an additional type check?

                    _t(
                        'LDAPAuthenticator.PLEASEUSEUSERNAME',
                        'Please enter your username instead of your email to log in.'
                    ),
                    'bad'
                );
                return;
            }

            $username = $service->getUsernameByEmail($login);

            // No user found with this email.
            if (!$username) {

This code seems to be duplicated across your project.

                if (Config::inst()->get('SilverStripe\\ActiveDirectory\\Authenticators\\LDAPAuthenticator', 'fallback_authenticator') === 'yes') {
                    $fallbackMember = self::fallback_authenticate($data, $form);
                    if ($fallbackMember) {
                        return $fallbackMember;
                    }
                }

                $form->sessionMessage(_t('LDAPAuthenticator.INVALIDCREDENTIALS', 'Invalid credentials'), 'bad');
                return;
            }
        } else {
            $username = $login;
        }

        $result = $service->authenticate($username, $data['Password']);
        $success = $result['success'] === true;
        if (!$success) {

This code seems to be duplicated across your project.

            if (Config::inst()->get('SilverStripe\\ActiveDirectory\\Authenticators\\LDAPAuthenticator', 'fallback_authenticator') === 'yes') {
                $fallbackMember = self::fallback_authenticate($data, $form);
                if ($fallbackMember) {
                    return $fallbackMember;
                }
            }

            if ($form) {
                $form->sessionMessage($result['message'], 'bad');
            }
            return;
        }

        $data = $service->getUserByUsername($result['identity']);
        if (!$data) {
            if ($form) {
                $form->sessionMessage(
                    _t('LDAPAuthenticator.PROBLEMFINDINGDATA', 'There was a problem retrieving your user data'),
                    'bad'
                );
            }
            return;
        }

        // LDAPMemberExtension::memberLoggedIn() will update any other AD attributes mapped to Member fields
        $member = Member::get()->filter('GUID', $data['objectguid'])->limit(1)->first();
        if (!($member && $member->exists())) {

This code seems to be duplicated across your project.

            $member = new Member();
            $member->GUID = $data['objectguid'];
        }

        // Update the users from LDAP so we are sure that the email is correct.
        // This will also write the Member record.
        $service->updateMemberFromLDAP($member);

        Session::clear('BackURL');

        return $member;
    }

    /**
     * Try to authenticate using the fallback authenticator.
     *
     * @param array $data
     * @param null|Form $form
     * @return null|Member
     */
    protected static function fallback_authenticate($data, Form $form = null)
    {
        return call_user_func(
            [
                Config::inst()->get(
                    'SilverStripe\\ActiveDirectory\\Authenticators\\LDAPAuthenticator',
                    'fallback_authenticator_class'
                ),
                'authenticate'
            ],
            array_merge($data, ['Email' => $data['Login']]),
            $form
        );
    }
}