silverstripe /
silverstripe-activedirectory
Duplicate code is one of the most pungent code smells. A rule that is often used is to re-structure code once it is duplicated in three or more places.
Common duplication problems, and corresponding solutions are:
Complex classes like LDAPService often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes. You can also have a look at the cohesion graph to spot any un-connected, or weakly-connected components.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use LDAPService, and based on these observations, apply Extract Interface, too.
| 1 | <?php |
||
| 15 | class LDAPService extends Object implements Flushable |
||
|
|
|||
| 16 | { |
||
| 17 | /** |
||
| 18 | * @var array |
||
| 19 | */ |
||
| 20 | private static $dependencies = array( |
||
| 21 | 'gateway' => '%$LDAPGateway' |
||
| 22 | ); |
||
| 23 | |||
| 24 | /** |
||
| 25 | * If configured, only user objects within these locations will be exposed to this service. |
||
| 26 | * |
||
| 27 | * @var array |
||
| 28 | * @config |
||
| 29 | */ |
||
| 30 | private static $users_search_locations = array(); |
||
| 31 | |||
| 32 | /** |
||
| 33 | * If configured, only group objects within these locations will be exposed to this service. |
||
| 34 | * @var array |
||
| 35 | * |
||
| 36 | * @config |
||
| 37 | */ |
||
| 38 | private static $groups_search_locations = array(); |
||
| 39 | |||
| 40 | /** |
||
| 41 | * Location to create new users in (distinguished name). |
||
| 42 | * @var string |
||
| 43 | * |
||
| 44 | * @config |
||
| 45 | */ |
||
| 46 | private static $new_users_dn; |
||
| 47 | |||
| 48 | /** |
||
| 49 | * @var array |
||
| 50 | */ |
||
| 51 | private static $_cache_nested_groups = array(); |
||
| 52 | |||
| 53 | /** |
||
| 54 | * If this is configured to a "Code" value of a {@link Group} in SilverStripe, the user will always |
||
| 55 | * be added to this group's membership when imported, regardless of any sort of group mappings. |
||
| 56 | * |
||
| 57 | * @var string |
||
| 58 | * @config |
||
| 59 | */ |
||
| 60 | private static $default_group; |
||
| 61 | |||
| 62 | /** |
||
| 63 | * Get the cache objecgt used for LDAP results. Note that the default lifetime set here |
||
| 64 | * is 8 hours, but you can change that by calling SS_Cache::set_lifetime('ldap', <lifetime in seconds>) |
||
| 65 | * |
||
| 66 | * @return Zend_Cache_Frontend |
||
| 67 | */ |
||
| 68 | public static function get_cache() |
||
| 75 | |||
| 76 | /** |
||
| 77 | * Flushes out the LDAP results cache when flush=1 is called. |
||
| 78 | */ |
||
| 79 | public static function flush() |
||
| 84 | |||
| 85 | /** |
||
| 86 | * @var LDAPGateway |
||
| 87 | */ |
||
| 88 | public $gateway; |
||
| 89 | |||
| 90 | /** |
||
| 91 | * Setter for gateway. Useful for overriding the gateway with a fake for testing. |
||
| 92 | * @var LDAPGateway |
||
| 93 | */ |
||
| 94 | public function setGateway($gateway) |
||
| 98 | |||
| 99 | /** |
||
| 100 | * Checkes whether or not the service is enabled. |
||
| 101 | * |
||
| 102 | * @return bool |
||
| 103 | */ |
||
| 104 | public function enabled() |
||
| 109 | |||
| 110 | /** |
||
| 111 | * Authenticate the given username and password with LDAP. |
||
| 112 | * |
||
| 113 | * @param string $username |
||
| 114 | * @param string $password |
||
| 115 | * |
||
| 116 | * @return array |
||
| 117 | */ |
||
| 118 | public function authenticate($username, $password) |
||
| 137 | |||
| 138 | /** |
||
| 139 | * Return all nodes (organizational units, containers, and domains) within the current base DN. |
||
| 140 | * |
||
| 141 | * @param boolean $cached Cache the results from AD, so that subsequent calls are faster. Enabled by default. |
||
| 142 | * @param array $attributes List of specific AD attributes to return. Empty array means return everything. |
||
| 143 | * @return array |
||
| 144 | */ |
||
| 145 | public function getNodes($cached = true, $attributes = array()) |
||
| 162 | |||
| 163 | /** |
||
| 164 | * Return all AD groups in configured search locations, including all nested groups. |
||
| 165 | * Uses groups_search_locations if defined, otherwise falls back to NULL, which tells LDAPGateway |
||
| 166 | * to use the default baseDn defined in the connection. |
||
| 167 | * |
||
| 168 | * @param boolean $cached Cache the results from AD, so that subsequent calls are faster. Enabled by default. |
||
| 169 | * @param array $attributes List of specific AD attributes to return. Empty array means return everything. |
||
| 170 | * @param string $indexBy Attribute to use as an index. |
||
| 171 | * @return array |
||
| 172 | */ |
||
| 173 | public function getGroups($cached = true, $attributes = array(), $indexBy = 'dn') |
||
| 197 | |||
| 198 | /** |
||
| 199 | * Return all member groups (and members of those, recursively) underneath a specific group DN. |
||
| 200 | * Note that these get cached in-memory per-request for performance to avoid re-querying for the same results. |
||
| 201 | * |
||
| 202 | * @param string $dn |
||
| 203 | * @param array $attributes List of specific AD attributes to return. Empty array means return everything. |
||
| 204 | * @return array |
||
| 205 | */ |
||
| 206 | public function getNestedGroups($dn, $attributes = array()) |
||
| 224 | |||
| 225 | /** |
||
| 226 | * Get a particular AD group's data given a GUID. |
||
| 227 | * |
||
| 228 | * @param string $guid |
||
| 229 | * @param array $attributes List of specific AD attributes to return. Empty array means return everything. |
||
| 230 | * @return array |
||
| 231 | */ |
||
| 232 | View Code Duplication | public function getGroupByGUID($guid, $attributes = array()) |
|
| 242 | |||
| 243 | /** |
||
| 244 | * Get a particular AD group's data given a DN. |
||
| 245 | * |
||
| 246 | * @param string $dn |
||
| 247 | * @param array $attributes List of specific AD attributes to return. Empty array means return everything. |
||
| 248 | * @return array |
||
| 249 | */ |
||
| 250 | View Code Duplication | public function getGroupByDN($dn, $attributes = array()) |
|
| 260 | |||
| 261 | /** |
||
| 262 | * Return all AD users in configured search locations, including all users in nested groups. |
||
| 263 | * Uses users_search_locations if defined, otherwise falls back to NULL, which tells LDAPGateway |
||
| 264 | * to use the default baseDn defined in the connection. |
||
| 265 | * |
||
| 266 | * @param array $attributes List of specific AD attributes to return. Empty array means return everything. |
||
| 267 | * @return array |
||
| 268 | */ |
||
| 269 | public function getUsers($attributes = array()) |
||
| 287 | |||
| 288 | /** |
||
| 289 | * Get a specific AD user's data given a GUID. |
||
| 290 | * |
||
| 291 | * @param string $guid |
||
| 292 | * @param array $attributes List of specific AD attributes to return. Empty array means return everything. |
||
| 293 | * @return array |
||
| 294 | */ |
||
| 295 | View Code Duplication | public function getUserByGUID($guid, $attributes = array()) |
|
| 305 | |||
| 306 | /** |
||
| 307 | * Get a specific AD user's data given a DN. |
||
| 308 | * |
||
| 309 | * @param string $dn |
||
| 310 | * @param array $attributes List of specific AD attributes to return. Empty array means return everything. |
||
| 311 | * |
||
| 312 | * @return array |
||
| 313 | */ |
||
| 314 | View Code Duplication | public function getUserByDN($dn, $attributes = array()) |
|
| 324 | |||
| 325 | /** |
||
| 326 | * Get a specific user's data given an email. |
||
| 327 | * |
||
| 328 | * @param string $email |
||
| 329 | * @param array $attributes List of specific AD attributes to return. Empty array means return everything. |
||
| 330 | * @return array |
||
| 331 | */ |
||
| 332 | View Code Duplication | public function getUserByEmail($email, $attributes = array()) |
|
| 342 | |||
| 343 | /** |
||
| 344 | * Get a specific user's data given a username. |
||
| 345 | * |
||
| 346 | * @param string $username |
||
| 347 | * @param array $attributes List of specific AD attributes to return. Empty array means return everything. |
||
| 348 | * @return array |
||
| 349 | */ |
||
| 350 | View Code Duplication | public function getUserByUsername($username, $attributes = array()) |
|
| 360 | |||
| 361 | /** |
||
| 362 | * Get a username for an email. |
||
| 363 | * |
||
| 364 | * @param string $email |
||
| 365 | * @return string|null |
||
| 366 | */ |
||
| 367 | public function getUsernameByEmail($email) |
||
| 376 | |||
| 377 | /** |
||
| 378 | * Given a group DN, get the group membership data in LDAP. |
||
| 379 | * |
||
| 380 | * @param string $dn |
||
| 381 | * @return array |
||
| 382 | */ |
||
| 383 | public function getLDAPGroupMembers($dn) |
||
| 396 | |||
| 397 | /** |
||
| 398 | * Update the current Member record with data from LDAP. |
||
| 399 | * |
||
| 400 | * Constraints: |
||
| 401 | * - Member *must* be in the database before calling this as it will need the ID to be mapped to a {@link Group}. |
||
| 402 | * - GUID of the member must have already been set, for integrity reasons we don't allow it to change here. |
||
| 403 | * |
||
| 404 | * @param Member |
||
| 405 | * @param array|null $data If passed, this is pre-existing AD attribute data to update the Member with. |
||
| 406 | * If not given, the data will be looked up by the user's GUID. |
||
| 407 | * @return bool |
||
| 408 | */ |
||
| 409 | public function updateMemberFromLDAP(Member $member, $data = null) |
||
| 570 | |||
| 571 | /** |
||
| 572 | * Sync a specific Group by updating it with LDAP data. |
||
| 573 | * |
||
| 574 | * @param Group $group An existing Group or a new Group object |
||
| 575 | * @param array $data LDAP group object data |
||
| 576 | * |
||
| 577 | * @return bool |
||
| 578 | */ |
||
| 579 | public function updateGroupFromLDAP(Group $group, $data) |
||
| 619 | |||
| 620 | /** |
||
| 621 | * Creates a new LDAP user from the passed Member record. |
||
| 622 | * Note that the Member record must have a non-empty Username field for this to work. |
||
| 623 | * |
||
| 624 | * @param Member $member |
||
| 625 | */ |
||
| 626 | public function createLDAPUser(Member $member) |
||
| 668 | |||
| 669 | /** |
||
| 670 | * Update the Member data back to the corresponding LDAP user object. |
||
| 671 | * |
||
| 672 | * @param Member $member |
||
| 673 | * @throws ValidationException |
||
| 674 | */ |
||
| 675 | public function updateLDAPFromMember(Member $member) |
||
| 676 | { |
||
| 677 | if (!$this->enabled()) { |
||
| 678 | return; |
||
| 679 | } |
||
| 680 | if (!$member->GUID) { |
||
| 681 | throw new ValidationException('Member missing GUID. Cannot update LDAP user'); |
||
| 682 | } |
||
| 683 | |||
| 684 | $data = $this->getUserByGUID($member->GUID); |
||
| 685 | if (empty($data['objectguid'])) { |
||
| 686 | throw new ValidationException('LDAP synchronisation failure: user missing GUID'); |
||
| 687 | } |
||
| 688 | |||
| 689 | if (empty($member->Username)) { |
||
| 690 | throw new ValidationException('Member missing Username. Cannot update LDAP user'); |
||
| 691 | } |
||
| 692 | |||
| 693 | $dn = $data['distinguishedname']; |
||
| 694 | |||
| 695 | // Normalise username to lowercase to ensure we don't have duplicates of different cases |
||
| 696 | $member->Username = strtolower($member->Username); |
||
| 697 | |||
| 698 | try { |
||
| 699 | // If the common name (cn) has changed, we need to ensure they've been moved |
||
| 700 | // to the new DN, to avoid any clashes between user objects. |
||
| 701 | if ($data['cn'] != $member->Username) { |
||
| 702 | $newDn = sprintf('CN=%s,%s', $member->Username, preg_replace('/^CN=(.+?),/', '', $dn)); |
||
| 703 | $this->move($dn, $newDn); |
||
| 704 | $dn = $newDn; |
||
| 705 | } |
||
| 706 | } catch (\Exception $e) { |
||
| 707 | throw new ValidationException('LDAP move failure: '.$e->getMessage()); |
||
| 708 | } |
||
| 709 | |||
| 710 | try { |
||
| 711 | $attributes = array( |
||
| 712 | 'displayname' => sprintf('%s %s', $member->FirstName, $member->Surname), |
||
| 713 | 'name' => sprintf('%s %s', $member->FirstName, $member->Surname), |
||
| 714 | 'userprincipalname' => sprintf( |
||
| 715 | '%s@%s', |
||
| 716 | $member->Username, |
||
| 717 | $this->gateway->config()->options['accountDomainName'] |
||
| 718 | ), |
||
| 719 | ); |
||
| 720 | foreach ($member->config()->ldap_field_mappings as $attribute => $field) { |
||
| 721 | $relationClass = $member->getRelationClass($field); |
||
| 722 | if ($relationClass) { |
||
| 723 | // todo no support for writing back relations yet. |
||
| 724 | } else { |
||
| 725 | $attributes[$attribute] = $member->$field; |
||
| 726 | } |
||
| 727 | } |
||
| 728 | |||
| 729 | $this->update($dn, $attributes); |
||
| 730 | } catch (\Exception $e) { |
||
| 731 | throw new ValidationException('LDAP synchronisation failure: '.$e->getMessage()); |
||
| 732 | } |
||
| 733 | } |
||
| 734 | |||
| 735 | /** |
||
| 736 | * Ensure the user belongs to the correct groups in LDAP from their membership |
||
| 737 | * to local LDAP mapped SilverStripe groups. |
||
| 738 | * |
||
| 739 | * This also removes them from LDAP groups if they've been taken out of one. |
||
| 740 | * It will not affect group membership of non-mapped groups, so it will |
||
| 741 | * not touch such internal AD groups like "Domain Users". |
||
| 742 | * |
||
| 743 | * @param Member $member |
||
| 744 | */ |
||
| 745 | public function updateLDAPGroupsForMember(Member $member) |
||
| 832 | |||
| 833 | /** |
||
| 834 | * Change a members password on the AD. Works with ActiveDirectory compatible services that saves the |
||
| 835 | * password in the `unicodePwd` attribute. |
||
| 836 | * |
||
| 837 | * @todo Use the Zend\Ldap\Attribute::setPassword functionality to create a password in |
||
| 838 | * an abstract way, so it works on other LDAP directories, not just Active Directory. |
||
| 839 | * |
||
| 840 | * Ensure that the LDAP bind:ed user can change passwords and that the connection is secure. |
||
| 841 | * |
||
| 842 | * @param Member $member |
||
| 843 | * @param string $password |
||
| 844 | * @return ValidationResult |
||
| 845 | * @throws Exception |
||
| 846 | */ |
||
| 847 | public function setPassword(Member $member, $password) |
||
| 881 | |||
| 882 | /** |
||
| 883 | * Delete an LDAP user mapped to the Member record |
||
| 884 | * @param Member $member |
||
| 885 | */ |
||
| 886 | public function deleteLDAPMember(Member $member) { |
||
| 904 | |||
| 905 | /** |
||
| 906 | * A simple proxy to LDAP update operation. |
||
| 907 | * |
||
| 908 | * @param string $dn Location to add the entry at. |
||
| 909 | * @param array $attributes A simple associative array of attributes. |
||
| 910 | */ |
||
| 911 | public function update($dn, array $attributes) |
||
| 915 | |||
| 916 | /** |
||
| 917 | * A simple proxy to LDAP delete operation. |
||
| 918 | * |
||
| 919 | * @param string $dn Location of object to delete |
||
| 920 | * @param bool $recursively Recursively delete nested objects? |
||
| 921 | */ |
||
| 922 | public function delete($dn, $recursively = false) |
||
| 926 | |||
| 927 | /** |
||
| 928 | * A simple proxy to LDAP copy/delete operation. |
||
| 929 | * |
||
| 930 | * @param string $fromDn |
||
| 931 | * @param string $toDn |
||
| 932 | * @param bool $recursively Recursively move nested objects? |
||
| 933 | */ |
||
| 934 | public function move($fromDn, $toDn, $recursively = false) |
||
| 938 | |||
| 939 | /** |
||
| 940 | * A simple proxy to LDAP add operation. |
||
| 941 | * |
||
| 942 | * @param string $dn Location to add the entry at. |
||
| 943 | * @param array $attributes A simple associative array of attributes. |
||
| 944 | */ |
||
| 945 | public function add($dn, array $attributes) |
||
| 949 | } |
||
| 950 |
Loading history...
You can fix this by adding a namespace to your class:
When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries.