SilverStripe\ActiveDirectory\Services\LDAPService::updateMemberFromLDAP()

Complexity

Conditions	33
Paths	579

Size

Total Lines	171
Code Lines	96

Duplication

Lines	18
Ratio	10.53 %

Importance

Changes

0

<?php
    public function updateMemberFromLDAP(Member $member, $data = null)
    {
        if (!$this->enabled()) {
            return false;
        }

        if (!$member->GUID) {
            $this->getLogger()->warn(sprintf('Cannot update Member ID %s, GUID not set', $member->ID));
            return false;
        }

        if (!$data) {
            $data = $this->getUserByGUID($member->GUID);
            if (!$data) {

The expression $data of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using empty($expr) instead to make it clear that you intend to check for an array without elements.

                $this->getLogger()->warn(sprintf('Could not retrieve data for user. GUID: %s', $member->GUID));
                return false;
            }
        }

        $member->IsExpired = ($data['useraccountcontrol'] & 2) == 2;
        $member->LastSynced = (string)DBDatetime::now();

        foreach ($member->config()->ldap_field_mappings as $attribute => $field) {
            if (!isset($data[$attribute])) {
                $this->getLogger()->notice(
                    sprintf(
                        'Attribute %s configured in Member.ldap_field_mappings, but no available attribute in AD data (GUID: %s, Member ID: %s)',
                        $attribute,
                        $data['objectguid'],
                        $member->ID
                    )
                );

                continue;
            }

            if ($attribute == 'thumbnailphoto') {
                $imageClass = $member->getRelationClass($field);
                if ($imageClass !== 'SilverStripe\\Assets\\Image'
                    && !is_subclass_of($imageClass, 'SilverStripe\\Assets\\Image')
                ) {
                    $this->getLogger()->warn(
                        sprintf(
                            'Member field %s configured for thumbnailphoto AD attribute, but it isn\'t a valid relation to an Image class',
                            $field
                        )
                    );

                    continue;
                }

                $filename = sprintf('thumbnailphoto-%s.jpg', $data['samaccountname']);
                $path = ASSETS_DIR . '/' . $member->config()->ldap_thumbnail_path;
                $absPath = BASE_PATH . '/' . $path;
                if (!file_exists($absPath)) {
                    Filesystem::makeFolder($absPath);
                }

                // remove existing record if it exists
                $existingObj = $member->getComponent($field);
                if ($existingObj && $existingObj->exists()) {
                    $existingObj->delete();
                }

                // The image data is provided in raw binary.
                file_put_contents($absPath . '/' . $filename, $data[$attribute]);
                $record = new $imageClass();
                $record->Name = $filename;
                $record->Filename = $path . '/' . $filename;
                $record->write();

                $relationField = $field . 'ID';
                $member->{$relationField} = $record->ID;
            } else {
                $member->$field = $data[$attribute];
            }
        }

        // if a default group was configured, ensure the user is in that group
        if ($this->config()->default_group) {
            $group = Group::get()->filter('Code', $this->config()->default_group)->limit(1)->first();
            if (!($group && $group->exists())) {
                $this->getLogger()->warn(
                    sprintf(
                        'LDAPService.default_group misconfiguration! There is no such group with Code = \'%s\'',
                        $this->config()->default_group
                    )
                );
            } else {
                $group->Members()->add($member, [
                    'IsImportedFromLDAP' => '1'
                ]);
            }
        }

        // this is to keep track of which groups the user gets mapped to
        // and we'll use that later to remove them from any groups that they're no longer mapped to
        $mappedGroupIDs = [];

        // ensure the user is in any mapped groups
        if (isset($data['memberof'])) {
            $ldapGroups = is_array($data['memberof']) ? $data['memberof'] : [$data['memberof']];
            foreach ($ldapGroups as $groupDN) {
                foreach (LDAPGroupMapping::get() as $mapping) {
                    if (!$mapping->DN) {
                        $this->getLogger()->warn(
                            sprintf(
                                'LDAPGroupMapping ID %s is missing DN field. Skipping',
                                $mapping->ID
                            )
                        );
                        continue;
                    }

                    // the user is a direct member of group with a mapping, add them to the SS group.
                    if ($mapping->DN == $groupDN) {

This code seems to be duplicated across your project.

                        $group = $mapping->Group();
                        if ($group && $group->exists()) {
                            $group->Members()->add($member, [
                                'IsImportedFromLDAP' => '1'
                            ]);
                            $mappedGroupIDs[] = $mapping->GroupID;
                        }
                    }

                    // the user *might* be a member of a nested group provided the scope of the mapping
                    // is to include the entire subtree. Check all those mappings and find the LDAP child groups
                    // to see if they are a member of one of those. If they are, add them to the SS group
                    if ($mapping->Scope == 'Subtree') {
                        $childGroups = $this->getNestedGroups($mapping->DN, ['dn']);
                        if (!$childGroups) {

The expression $childGroups of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using empty($expr) instead to make it clear that you intend to check for an array without elements.

                            continue;
                        }

                        foreach ($childGroups as $childGroupDN => $childGroupRecord) {
                            if ($childGroupDN == $groupDN) {

This code seems to be duplicated across your project.

                                $group = $mapping->Group();
                                if ($group && $group->exists()) {
                                    $group->Members()->add($member, [
                                        'IsImportedFromLDAP' => '1'
                                    ]);
                                    $mappedGroupIDs[] = $mapping->GroupID;
                                }
                            }
                        }
                    }
                }
            }
        }

        // remove the user from any previously mapped groups, where the mapping has since been removed
        $groupRecords = DB::query(
            sprintf(
                'SELECT "GroupID" FROM "Group_Members" WHERE "IsImportedFromLDAP" = 1 AND "MemberID" = %s',
                $member->ID
            )
        );

        foreach ($groupRecords as $groupRecord) {
            if (!in_array($groupRecord['GroupID'], $mappedGroupIDs)) {
                $group = Group::get()->byId($groupRecord['GroupID']);
                // Some groups may no longer exist. SilverStripe does not clean up join tables.
                if ($group) {
                    $group->Members()->remove($member);
                }
            }
        }
        // This will throw an exception if there are two distinct GUIDs with the same email address.
        // We are happy with a raw 500 here at this stage.
        $member->write();
    }