silverstripe /
silverstripe-ldap
Duplicate code is one of the most pungent code smells. A rule that is often used is to re-structure code once it is duplicated in three or more places.
Common duplication problems, and corresponding solutions are:
| 1 | <?php |
||
| 22 | class LDAPMemberExtension extends DataExtension |
||
| 23 | { |
||
| 24 | /** |
||
| 25 | * @var array |
||
| 26 | */ |
||
| 27 | private static $db = [ |
||
|
|
|||
| 28 | // Unique user identifier |
||
| 29 | 'GUID' => 'Varchar(50)', |
||
| 30 | 'Username' => 'Varchar(64)', |
||
| 31 | 'IsExpired' => 'Boolean', |
||
| 32 | 'LastSynced' => 'DBDatetime', |
||
| 33 | ]; |
||
| 34 | |||
| 35 | /** |
||
| 36 | * These fields are used by {@link LDAPMemberSync} to map specific AD attributes |
||
| 37 | * to {@link Member} fields. |
||
| 38 | * |
||
| 39 | * @var array |
||
| 40 | * @config |
||
| 41 | */ |
||
| 42 | private static $ldap_field_mappings = [ |
||
| 43 | 'givenname' => 'FirstName', |
||
| 44 | 'samaccountname' => 'Username', |
||
| 45 | 'sn' => 'Surname', |
||
| 46 | 'mail' => 'Email', |
||
| 47 | ]; |
||
| 48 | |||
| 49 | /** |
||
| 50 | * The location (relative to /assets) where to save thumbnailphoto data. |
||
| 51 | * |
||
| 52 | * @var string |
||
| 53 | * @config |
||
| 54 | */ |
||
| 55 | private static $ldap_thumbnail_path = 'Uploads'; |
||
| 56 | |||
| 57 | /** |
||
| 58 | * When enabled, LDAP managed Member records (GUID flag) |
||
| 59 | * have their data written back to LDAP on write, and synchronise |
||
| 60 | * membership to groups mapped to LDAP. |
||
| 61 | * |
||
| 62 | * Keep in mind this will currently NOT trigger if there are no |
||
| 63 | * field changes due to onAfterWrite in framework not being called |
||
| 64 | * when there are no changes. |
||
| 65 | * |
||
| 66 | * This requires setting write permissions on the user configured in the LDAP |
||
| 67 | * credentials, which is why this is disabled by default. |
||
| 68 | * |
||
| 69 | * @var bool |
||
| 70 | * @config |
||
| 71 | */ |
||
| 72 | private static $update_ldap_from_local = false; |
||
| 73 | |||
| 74 | /** |
||
| 75 | * If enabled, Member records with a Username field have the user created in LDAP |
||
| 76 | * on write. |
||
| 77 | * |
||
| 78 | * This requires setting write permissions on the user configured in the LDAP |
||
| 79 | * credentials, which is why this is disabled by default. |
||
| 80 | * |
||
| 81 | * @var bool |
||
| 82 | * @config |
||
| 83 | */ |
||
| 84 | private static $create_users_in_ldap = false; |
||
| 85 | |||
| 86 | /** |
||
| 87 | * If enabled, deleting Member records mapped to LDAP deletes the LDAP user. |
||
| 88 | * |
||
| 89 | * This requires setting write permissions on the user configured in the LDAP |
||
| 90 | * credentials, which is why this is disabled by default. |
||
| 91 | * |
||
| 92 | * @var bool |
||
| 93 | * @config |
||
| 94 | */ |
||
| 95 | private static $delete_users_in_ldap = false; |
||
| 96 | |||
| 97 | /** |
||
| 98 | * @param FieldList $fields |
||
| 99 | */ |
||
| 100 | public function updateCMSFields(FieldList $fields) |
||
| 101 | { |
||
| 102 | // Redo LDAP metadata fields as read-only and move to LDAP tab. |
||
| 103 | $ldapMetadata = []; |
||
| 104 | $fields->replaceField('GUID', $ldapMetadata[] = ReadonlyField::create('GUID')); |
||
| 105 | $fields->replaceField( |
||
| 106 | 'IsExpired', |
||
| 107 | $ldapMetadata[] = ReadonlyField::create( |
||
| 108 | 'IsExpired', |
||
| 109 | _t(__CLASS__ . '.ISEXPIRED', 'Has user\'s LDAP/AD login expired?') |
||
| 110 | ) |
||
| 111 | ); |
||
| 112 | $fields->replaceField( |
||
| 113 | 'LastSynced', |
||
| 114 | $ldapMetadata[] = ReadonlyField::create( |
||
| 115 | 'LastSynced', |
||
| 116 | _t(__CLASS__ . '.LASTSYNCED', 'Last synced') |
||
| 117 | ) |
||
| 118 | ); |
||
| 119 | $fields->addFieldsToTab('Root.LDAP', $ldapMetadata); |
||
| 120 | |||
| 121 | $message = ''; |
||
| 122 | if ($this->owner->GUID && $this->owner->config()->update_ldap_from_local) { |
||
| 123 | $message = _t( |
||
| 124 | __CLASS__ . '.CHANGEFIELDSUPDATELDAP', |
||
| 125 | 'Changing fields here will update them in LDAP.' |
||
| 126 | ); |
||
| 127 | } elseif ($this->owner->GUID && !$this->owner->config()->update_ldap_from_local) { |
||
| 128 | // Transform the automatically mapped fields into read-only. This doesn't |
||
| 129 | // apply if updating LDAP from local is enabled, as changing data locally can be written back. |
||
| 130 | foreach ($this->owner->config()->ldap_field_mappings as $name) { |
||
| 131 | $field = $fields->dataFieldByName($name); |
||
| 132 | if (!empty($field)) { |
||
| 133 | // Set to readonly, but not disabled so that the data is still sent to the |
||
| 134 | // server and doesn't break Member_Validator |
||
| 135 | $field->setReadonly(true); |
||
| 136 | $field->setTitle($field->Title()._t(__CLASS__ . '.IMPORTEDFIELD', ' (imported)')); |
||
| 137 | } |
||
| 138 | } |
||
| 139 | $message = _t( |
||
| 140 | __CLASS__ . '.INFOIMPORTED', |
||
| 141 | 'This user is automatically imported from LDAP. '. |
||
| 142 | 'Manual changes to imported fields will be removed upon sync.' |
||
| 143 | ); |
||
| 144 | } |
||
| 145 | if ($message) { |
||
| 146 | $fields->addFieldToTab( |
||
| 147 | 'Root.Main', |
||
| 148 | LiteralField::create( |
||
| 149 | 'Info', |
||
| 150 | sprintf('<p class="message warning">%s</p>', $message) |
||
| 151 | ), |
||
| 152 | 'FirstName' |
||
| 153 | ); |
||
| 154 | } |
||
| 155 | } |
||
| 156 | |||
| 157 | /** |
||
| 158 | * @param ValidationResult |
||
| 159 | * @throws ValidationException |
||
| 160 | */ |
||
| 161 | public function validate(ValidationResult $validationResult) |
||
| 162 | { |
||
| 163 | // We allow empty Username for registration purposes, as we need to |
||
| 164 | // create Member records with empty Username temporarily. Forms should explicitly |
||
| 165 | // check for Username not being empty if they require it not to be. |
||
| 166 | if (empty($this->owner->Username) || !$this->owner->config()->create_users_in_ldap) { |
||
| 167 | return; |
||
| 168 | } |
||
| 169 | |||
| 170 | if (!preg_match('/^[a-z0-9\.]+$/', $this->owner->Username)) { |
||
| 171 | $validationResult->addError( |
||
| 172 | 'Username must only contain lowercase alphanumeric characters and dots.', |
||
| 173 | 'bad' |
||
| 174 | ); |
||
| 175 | throw new ValidationException($validationResult); |
||
| 176 | } |
||
| 177 | } |
||
| 178 | |||
| 179 | /** |
||
| 180 | * Create the user in LDAP, provided this configuration is enabled |
||
| 181 | * and a username was passed to a new Member record. |
||
| 182 | */ |
||
| 183 | View Code Duplication | public function onBeforeWrite() |
|
| 184 | { |
||
| 185 | if ($this->owner->LDAPMemberExtension_NoSync) { |
||
| 186 | return; |
||
| 187 | } |
||
| 188 | |||
| 189 | $service = Injector::inst()->get(LDAPService::class); |
||
| 190 | if (!$service->enabled() |
||
| 191 | || !$this->owner->config()->create_users_in_ldap |
||
| 192 | || !$this->owner->Username |
||
| 193 | || $this->owner->GUID |
||
| 194 | ) { |
||
| 195 | return; |
||
| 196 | } |
||
| 197 | |||
| 198 | $service->createLDAPUser($this->owner); |
||
| 199 | } |
||
| 200 | |||
| 201 | public function onAfterWrite() |
||
| 202 | { |
||
| 203 | if ($this->owner->LDAPMemberExtension_NoSync) { |
||
| 204 | return; |
||
| 205 | } |
||
| 206 | |||
| 207 | $service = Injector::inst()->get(LDAPService::class); |
||
| 208 | if (!$service->enabled() || |
||
| 209 | !$this->owner->config()->update_ldap_from_local || |
||
| 210 | !$this->owner->GUID |
||
| 211 | ) { |
||
| 212 | return; |
||
| 213 | } |
||
| 214 | $this->sync(); |
||
| 215 | } |
||
| 216 | |||
| 217 | View Code Duplication | public function onAfterDelete() |
|
| 232 | } |
||
| 233 | |||
| 234 | /** |
||
| 235 | * Write DataObject without triggering this extension's hooks. |
||
| 236 | * |
||
| 237 | * @throws Exception |
||
| 238 | */ |
||
| 239 | public function writeWithoutSync() |
||
| 246 | } |
||
| 247 | } |
||
| 248 | |||
| 249 | /** |
||
| 250 | * Update the local data with LDAP, and ensure local membership is also set in |
||
| 251 | * LDAP too. This writes into LDAP, provided that feature is enabled. |
||
| 252 | */ |
||
| 253 | public function sync() |
||
| 254 | { |
||
| 255 | $service = Injector::inst()->get(LDAPService::class); |
||
| 256 | if (!$service->enabled() || |
||
| 257 | !$this->owner->GUID |
||
| 258 | ) { |
||
| 259 | return; |
||
| 260 | } |
||
| 261 | $service->updateLDAPFromMember($this->owner); |
||
| 262 | $service->updateLDAPGroupsForMember($this->owner); |
||
| 263 | } |
||
| 264 | |||
| 265 | /** |
||
| 266 | * Triggered by {@link Member::logIn()} when successfully logged in, |
||
| 267 | * this will update the Member record from AD data. |
||
| 268 | */ |
||
| 269 | public function memberLoggedIn() |
||
| 275 | } |
||
| 276 | } |
||
| 277 | } |
||
| 278 |
Loading history...
This check marks private properties in classes that are never used. Those properties can be removed.