Configuration.php 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562
  1. <?php
  2. /**
  3. * @copyright Copyright (c) 2016, ownCloud, Inc.
  4. *
  5. * @author Alexander Bergolth <leo@strike.wu.ac.at>
  6. * @author Alex Weirig <alex.weirig@technolink.lu>
  7. * @author Arthur Schiwon <blizzz@arthur-schiwon.de>
  8. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  9. * @author Joas Schilling <coding@schilljs.com>
  10. * @author Jörn Friedrich Dreyer <jfd@butonic.de>
  11. * @author Lennart Rosam <hello@takuto.de>
  12. * @author Lukas Reschke <lukas@statuscode.ch>
  13. * @author Morris Jobke <hey@morrisjobke.de>
  14. * @author Robin McCorkell <robin@mccorkell.me.uk>
  15. * @author Roeland Jago Douma <roeland@famdouma.nl>
  16. * @author Roger Szabo <roger.szabo@web.de>
  17. * @author Victor Dubiniuk <dubiniuk@owncloud.com>
  18. * @author Xuanwo <xuanwo@yunify.com>
  19. *
  20. * @license AGPL-3.0
  21. *
  22. * This code is free software: you can redistribute it and/or modify
  23. * it under the terms of the GNU Affero General Public License, version 3,
  24. * as published by the Free Software Foundation.
  25. *
  26. * This program is distributed in the hope that it will be useful,
  27. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  28. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  29. * GNU Affero General Public License for more details.
  30. *
  31. * You should have received a copy of the GNU Affero General Public License, version 3,
  32. * along with this program. If not, see <http://www.gnu.org/licenses/>
  33. *
  34. */
  35. namespace OCA\User_LDAP;
  36. /**
  37. * @property int ldapPagingSize holds an integer
  38. * @property string ldapUserAvatarRule
  39. */
  40. class Configuration {
  41. public const AVATAR_PREFIX_DEFAULT = 'default';
  42. public const AVATAR_PREFIX_NONE = 'none';
  43. public const AVATAR_PREFIX_DATA_ATTRIBUTE = 'data:';
  44. public const LDAP_SERVER_FEATURE_UNKNOWN = 'unknown';
  45. public const LDAP_SERVER_FEATURE_AVAILABLE = 'available';
  46. public const LDAP_SERVER_FEATURE_UNAVAILABLE = 'unavailable';
  47. /**
  48. * @var string
  49. */
  50. protected $configPrefix;
  51. /**
  52. * @var bool
  53. */
  54. protected $configRead = false;
  55. /**
  56. * @var string[]
  57. */
  58. protected array $unsavedChanges = [];
  59. /**
  60. * @var array<string, mixed> settings
  61. */
  62. protected $config = [
  63. 'ldapHost' => null,
  64. 'ldapPort' => null,
  65. 'ldapBackupHost' => null,
  66. 'ldapBackupPort' => null,
  67. 'ldapBase' => null,
  68. 'ldapBaseUsers' => null,
  69. 'ldapBaseGroups' => null,
  70. 'ldapAgentName' => null,
  71. 'ldapAgentPassword' => null,
  72. 'ldapTLS' => null,
  73. 'turnOffCertCheck' => null,
  74. 'ldapIgnoreNamingRules' => null,
  75. 'ldapUserDisplayName' => null,
  76. 'ldapUserDisplayName2' => null,
  77. 'ldapUserAvatarRule' => null,
  78. 'ldapGidNumber' => null,
  79. 'ldapUserFilterObjectclass' => null,
  80. 'ldapUserFilterGroups' => null,
  81. 'ldapUserFilter' => null,
  82. 'ldapUserFilterMode' => null,
  83. 'ldapGroupFilter' => null,
  84. 'ldapGroupFilterMode' => null,
  85. 'ldapGroupFilterObjectclass' => null,
  86. 'ldapGroupFilterGroups' => null,
  87. 'ldapGroupDisplayName' => null,
  88. 'ldapGroupMemberAssocAttr' => null,
  89. 'ldapLoginFilter' => null,
  90. 'ldapLoginFilterMode' => null,
  91. 'ldapLoginFilterEmail' => null,
  92. 'ldapLoginFilterUsername' => null,
  93. 'ldapLoginFilterAttributes' => null,
  94. 'ldapQuotaAttribute' => null,
  95. 'ldapQuotaDefault' => null,
  96. 'ldapEmailAttribute' => null,
  97. 'ldapCacheTTL' => null,
  98. 'ldapUuidUserAttribute' => 'auto',
  99. 'ldapUuidGroupAttribute' => 'auto',
  100. 'ldapOverrideMainServer' => false,
  101. 'ldapConfigurationActive' => false,
  102. 'ldapAttributesForUserSearch' => null,
  103. 'ldapAttributesForGroupSearch' => null,
  104. 'ldapExperiencedAdmin' => false,
  105. 'homeFolderNamingRule' => null,
  106. 'hasMemberOfFilterSupport' => false,
  107. 'useMemberOfToDetectMembership' => true,
  108. 'ldapExpertUsernameAttr' => null,
  109. 'ldapExpertUUIDUserAttr' => null,
  110. 'ldapExpertUUIDGroupAttr' => null,
  111. 'lastJpegPhotoLookup' => null,
  112. 'ldapNestedGroups' => false,
  113. 'ldapPagingSize' => null,
  114. 'turnOnPasswordChange' => false,
  115. 'ldapDynamicGroupMemberURL' => null,
  116. 'ldapDefaultPPolicyDN' => null,
  117. 'ldapExtStorageHomeAttribute' => null,
  118. 'ldapMatchingRuleInChainState' => self::LDAP_SERVER_FEATURE_UNKNOWN,
  119. ];
  120. public function __construct(string $configPrefix, bool $autoRead = true) {
  121. $this->configPrefix = $configPrefix;
  122. if ($autoRead) {
  123. $this->readConfiguration();
  124. }
  125. }
  126. /**
  127. * @param string $name
  128. * @return mixed|null
  129. */
  130. public function __get($name) {
  131. if (isset($this->config[$name])) {
  132. return $this->config[$name];
  133. }
  134. return null;
  135. }
  136. /**
  137. * @param string $name
  138. * @param mixed $value
  139. */
  140. public function __set($name, $value) {
  141. $this->setConfiguration([$name => $value]);
  142. }
  143. public function getConfiguration(): array {
  144. return $this->config;
  145. }
  146. /**
  147. * set LDAP configuration with values delivered by an array, not read
  148. * from configuration. It does not save the configuration! To do so, you
  149. * must call saveConfiguration afterwards.
  150. * @param array $config array that holds the config parameters in an associated
  151. * array
  152. * @param array &$applied optional; array where the set fields will be given to
  153. */
  154. public function setConfiguration(array $config, array &$applied = null): void {
  155. $cta = $this->getConfigTranslationArray();
  156. foreach ($config as $inputKey => $val) {
  157. if (strpos($inputKey, '_') !== false && array_key_exists($inputKey, $cta)) {
  158. $key = $cta[$inputKey];
  159. } elseif (array_key_exists($inputKey, $this->config)) {
  160. $key = $inputKey;
  161. } else {
  162. continue;
  163. }
  164. $setMethod = 'setValue';
  165. switch ($key) {
  166. case 'ldapAgentPassword':
  167. $setMethod = 'setRawValue';
  168. break;
  169. case 'homeFolderNamingRule':
  170. $trimmedVal = trim($val);
  171. if ($trimmedVal !== '' && strpos($val, 'attr:') === false) {
  172. $val = 'attr:'.$trimmedVal;
  173. }
  174. break;
  175. case 'ldapBase':
  176. case 'ldapBaseUsers':
  177. case 'ldapBaseGroups':
  178. case 'ldapAttributesForUserSearch':
  179. case 'ldapAttributesForGroupSearch':
  180. case 'ldapUserFilterObjectclass':
  181. case 'ldapUserFilterGroups':
  182. case 'ldapGroupFilterObjectclass':
  183. case 'ldapGroupFilterGroups':
  184. case 'ldapLoginFilterAttributes':
  185. $setMethod = 'setMultiLine';
  186. break;
  187. }
  188. $this->$setMethod($key, $val);
  189. if (is_array($applied)) {
  190. $applied[] = $inputKey;
  191. // storing key as index avoids duplication, and as value for simplicity
  192. }
  193. $this->unsavedChanges[$key] = $key;
  194. }
  195. }
  196. public function readConfiguration(): void {
  197. if (!$this->configRead) {
  198. $cta = array_flip($this->getConfigTranslationArray());
  199. foreach ($this->config as $key => $val) {
  200. if (!isset($cta[$key])) {
  201. //some are determined
  202. continue;
  203. }
  204. $dbKey = $cta[$key];
  205. switch ($key) {
  206. case 'ldapBase':
  207. case 'ldapBaseUsers':
  208. case 'ldapBaseGroups':
  209. case 'ldapAttributesForUserSearch':
  210. case 'ldapAttributesForGroupSearch':
  211. case 'ldapUserFilterObjectclass':
  212. case 'ldapUserFilterGroups':
  213. case 'ldapGroupFilterObjectclass':
  214. case 'ldapGroupFilterGroups':
  215. case 'ldapLoginFilterAttributes':
  216. $readMethod = 'getMultiLine';
  217. break;
  218. case 'ldapIgnoreNamingRules':
  219. $readMethod = 'getSystemValue';
  220. $dbKey = $key;
  221. break;
  222. case 'ldapAgentPassword':
  223. $readMethod = 'getPwd';
  224. break;
  225. case 'ldapUserDisplayName2':
  226. case 'ldapGroupDisplayName':
  227. $readMethod = 'getLcValue';
  228. break;
  229. case 'ldapUserDisplayName':
  230. default:
  231. // user display name does not lower case because
  232. // we rely on an upper case N as indicator whether to
  233. // auto-detect it or not. FIXME
  234. $readMethod = 'getValue';
  235. break;
  236. }
  237. $this->config[$key] = $this->$readMethod($dbKey);
  238. }
  239. $this->configRead = true;
  240. }
  241. }
  242. /**
  243. * saves the current config changes in the database
  244. */
  245. public function saveConfiguration(): void {
  246. $cta = array_flip($this->getConfigTranslationArray());
  247. $changed = false;
  248. foreach ($this->unsavedChanges as $key) {
  249. $value = $this->config[$key];
  250. switch ($key) {
  251. case 'ldapAgentPassword':
  252. $value = base64_encode($value);
  253. break;
  254. case 'ldapBase':
  255. case 'ldapBaseUsers':
  256. case 'ldapBaseGroups':
  257. case 'ldapAttributesForUserSearch':
  258. case 'ldapAttributesForGroupSearch':
  259. case 'ldapUserFilterObjectclass':
  260. case 'ldapUserFilterGroups':
  261. case 'ldapGroupFilterObjectclass':
  262. case 'ldapGroupFilterGroups':
  263. case 'ldapLoginFilterAttributes':
  264. if (is_array($value)) {
  265. $value = implode("\n", $value);
  266. }
  267. break;
  268. //following options are not stored but detected, skip them
  269. case 'ldapIgnoreNamingRules':
  270. case 'ldapUuidUserAttribute':
  271. case 'ldapUuidGroupAttribute':
  272. continue 2;
  273. }
  274. if (is_null($value)) {
  275. $value = '';
  276. }
  277. $changed = true;
  278. $this->saveValue($cta[$key], $value);
  279. }
  280. if ($changed) {
  281. $this->saveValue('_lastChange', (string)time());
  282. }
  283. $this->unsavedChanges = [];
  284. }
  285. /**
  286. * @param string $varName
  287. * @return array|string
  288. */
  289. protected function getMultiLine($varName) {
  290. $value = $this->getValue($varName);
  291. if (empty($value)) {
  292. $value = '';
  293. } else {
  294. $value = preg_split('/\r\n|\r|\n/', $value);
  295. }
  296. return $value;
  297. }
  298. /**
  299. * Sets multi-line values as arrays
  300. *
  301. * @param string $varName name of config-key
  302. * @param array|string $value to set
  303. */
  304. protected function setMultiLine(string $varName, $value): void {
  305. if (empty($value)) {
  306. $value = '';
  307. } elseif (!is_array($value)) {
  308. $value = preg_split('/\r\n|\r|\n|;/', $value);
  309. if ($value === false) {
  310. $value = '';
  311. }
  312. }
  313. if (!is_array($value)) {
  314. $finalValue = trim($value);
  315. } else {
  316. $finalValue = [];
  317. foreach ($value as $key => $val) {
  318. if (is_string($val)) {
  319. $val = trim($val);
  320. if ($val !== '') {
  321. //accidental line breaks are not wanted and can cause
  322. // odd behaviour. Thus, away with them.
  323. $finalValue[] = $val;
  324. }
  325. } else {
  326. $finalValue[] = $val;
  327. }
  328. }
  329. }
  330. $this->setRawValue($varName, $finalValue);
  331. }
  332. protected function getPwd(string $varName): string {
  333. return base64_decode($this->getValue($varName));
  334. }
  335. protected function getLcValue(string $varName): string {
  336. return mb_strtolower($this->getValue($varName), 'UTF-8');
  337. }
  338. protected function getSystemValue(string $varName): string {
  339. //FIXME: if another system value is added, softcode the default value
  340. return \OC::$server->getConfig()->getSystemValue($varName, false);
  341. }
  342. protected function getValue(string $varName): string {
  343. static $defaults;
  344. if (is_null($defaults)) {
  345. $defaults = $this->getDefaults();
  346. }
  347. return \OC::$server->getConfig()->getAppValue('user_ldap',
  348. $this->configPrefix.$varName,
  349. $defaults[$varName]);
  350. }
  351. /**
  352. * Sets a scalar value.
  353. *
  354. * @param string $varName name of config key
  355. * @param mixed $value to set
  356. */
  357. protected function setValue(string $varName, $value): void {
  358. if (is_string($value)) {
  359. $value = trim($value);
  360. }
  361. $this->config[$varName] = $value;
  362. }
  363. /**
  364. * Sets a scalar value without trimming.
  365. *
  366. * @param string $varName name of config key
  367. * @param mixed $value to set
  368. */
  369. protected function setRawValue(string $varName, $value): void {
  370. $this->config[$varName] = $value;
  371. }
  372. protected function saveValue(string $varName, string $value): bool {
  373. \OC::$server->getConfig()->setAppValue(
  374. 'user_ldap',
  375. $this->configPrefix.$varName,
  376. $value
  377. );
  378. return true;
  379. }
  380. /**
  381. * @return array an associative array with the default values. Keys are correspond
  382. * to config-value entries in the database table
  383. */
  384. public function getDefaults(): array {
  385. return [
  386. 'ldap_host' => '',
  387. 'ldap_port' => '',
  388. 'ldap_backup_host' => '',
  389. 'ldap_backup_port' => '',
  390. 'ldap_override_main_server' => '',
  391. 'ldap_dn' => '',
  392. 'ldap_agent_password' => '',
  393. 'ldap_base' => '',
  394. 'ldap_base_users' => '',
  395. 'ldap_base_groups' => '',
  396. 'ldap_userlist_filter' => '',
  397. 'ldap_user_filter_mode' => 0,
  398. 'ldap_userfilter_objectclass' => '',
  399. 'ldap_userfilter_groups' => '',
  400. 'ldap_login_filter' => '',
  401. 'ldap_login_filter_mode' => 0,
  402. 'ldap_loginfilter_email' => 0,
  403. 'ldap_loginfilter_username' => 1,
  404. 'ldap_loginfilter_attributes' => '',
  405. 'ldap_group_filter' => '',
  406. 'ldap_group_filter_mode' => 0,
  407. 'ldap_groupfilter_objectclass' => '',
  408. 'ldap_groupfilter_groups' => '',
  409. 'ldap_gid_number' => 'gidNumber',
  410. 'ldap_display_name' => 'displayName',
  411. 'ldap_user_display_name_2' => '',
  412. 'ldap_group_display_name' => 'cn',
  413. 'ldap_tls' => 0,
  414. 'ldap_quota_def' => '',
  415. 'ldap_quota_attr' => '',
  416. 'ldap_email_attr' => '',
  417. 'ldap_group_member_assoc_attribute' => '',
  418. 'ldap_cache_ttl' => 600,
  419. 'ldap_uuid_user_attribute' => 'auto',
  420. 'ldap_uuid_group_attribute' => 'auto',
  421. 'home_folder_naming_rule' => '',
  422. 'ldap_turn_off_cert_check' => 0,
  423. 'ldap_configuration_active' => 0,
  424. 'ldap_attributes_for_user_search' => '',
  425. 'ldap_attributes_for_group_search' => '',
  426. 'ldap_expert_username_attr' => '',
  427. 'ldap_expert_uuid_user_attr' => '',
  428. 'ldap_expert_uuid_group_attr' => '',
  429. 'has_memberof_filter_support' => 0,
  430. 'use_memberof_to_detect_membership' => 1,
  431. 'last_jpegPhoto_lookup' => 0,
  432. 'ldap_nested_groups' => 0,
  433. 'ldap_paging_size' => 500,
  434. 'ldap_turn_on_pwd_change' => 0,
  435. 'ldap_experienced_admin' => 0,
  436. 'ldap_dynamic_group_member_url' => '',
  437. 'ldap_default_ppolicy_dn' => '',
  438. 'ldap_user_avatar_rule' => 'default',
  439. 'ldap_ext_storage_home_attribute' => '',
  440. 'ldap_matching_rule_in_chain_state' => self::LDAP_SERVER_FEATURE_UNKNOWN,
  441. ];
  442. }
  443. /**
  444. * @return array that maps internal variable names to database fields
  445. */
  446. public function getConfigTranslationArray(): array {
  447. //TODO: merge them into one representation
  448. static $array = [
  449. 'ldap_host' => 'ldapHost',
  450. 'ldap_port' => 'ldapPort',
  451. 'ldap_backup_host' => 'ldapBackupHost',
  452. 'ldap_backup_port' => 'ldapBackupPort',
  453. 'ldap_override_main_server' => 'ldapOverrideMainServer',
  454. 'ldap_dn' => 'ldapAgentName',
  455. 'ldap_agent_password' => 'ldapAgentPassword',
  456. 'ldap_base' => 'ldapBase',
  457. 'ldap_base_users' => 'ldapBaseUsers',
  458. 'ldap_base_groups' => 'ldapBaseGroups',
  459. 'ldap_userfilter_objectclass' => 'ldapUserFilterObjectclass',
  460. 'ldap_userfilter_groups' => 'ldapUserFilterGroups',
  461. 'ldap_userlist_filter' => 'ldapUserFilter',
  462. 'ldap_user_filter_mode' => 'ldapUserFilterMode',
  463. 'ldap_user_avatar_rule' => 'ldapUserAvatarRule',
  464. 'ldap_login_filter' => 'ldapLoginFilter',
  465. 'ldap_login_filter_mode' => 'ldapLoginFilterMode',
  466. 'ldap_loginfilter_email' => 'ldapLoginFilterEmail',
  467. 'ldap_loginfilter_username' => 'ldapLoginFilterUsername',
  468. 'ldap_loginfilter_attributes' => 'ldapLoginFilterAttributes',
  469. 'ldap_group_filter' => 'ldapGroupFilter',
  470. 'ldap_group_filter_mode' => 'ldapGroupFilterMode',
  471. 'ldap_groupfilter_objectclass' => 'ldapGroupFilterObjectclass',
  472. 'ldap_groupfilter_groups' => 'ldapGroupFilterGroups',
  473. 'ldap_gid_number' => 'ldapGidNumber',
  474. 'ldap_display_name' => 'ldapUserDisplayName',
  475. 'ldap_user_display_name_2' => 'ldapUserDisplayName2',
  476. 'ldap_group_display_name' => 'ldapGroupDisplayName',
  477. 'ldap_tls' => 'ldapTLS',
  478. 'ldap_quota_def' => 'ldapQuotaDefault',
  479. 'ldap_quota_attr' => 'ldapQuotaAttribute',
  480. 'ldap_email_attr' => 'ldapEmailAttribute',
  481. 'ldap_group_member_assoc_attribute' => 'ldapGroupMemberAssocAttr',
  482. 'ldap_cache_ttl' => 'ldapCacheTTL',
  483. 'home_folder_naming_rule' => 'homeFolderNamingRule',
  484. 'ldap_turn_off_cert_check' => 'turnOffCertCheck',
  485. 'ldap_configuration_active' => 'ldapConfigurationActive',
  486. 'ldap_attributes_for_user_search' => 'ldapAttributesForUserSearch',
  487. 'ldap_attributes_for_group_search' => 'ldapAttributesForGroupSearch',
  488. 'ldap_expert_username_attr' => 'ldapExpertUsernameAttr',
  489. 'ldap_expert_uuid_user_attr' => 'ldapExpertUUIDUserAttr',
  490. 'ldap_expert_uuid_group_attr' => 'ldapExpertUUIDGroupAttr',
  491. 'has_memberof_filter_support' => 'hasMemberOfFilterSupport',
  492. 'use_memberof_to_detect_membership' => 'useMemberOfToDetectMembership',
  493. 'last_jpegPhoto_lookup' => 'lastJpegPhotoLookup',
  494. 'ldap_nested_groups' => 'ldapNestedGroups',
  495. 'ldap_paging_size' => 'ldapPagingSize',
  496. 'ldap_turn_on_pwd_change' => 'turnOnPasswordChange',
  497. 'ldap_experienced_admin' => 'ldapExperiencedAdmin',
  498. 'ldap_dynamic_group_member_url' => 'ldapDynamicGroupMemberURL',
  499. 'ldap_default_ppolicy_dn' => 'ldapDefaultPPolicyDN',
  500. 'ldap_ext_storage_home_attribute' => 'ldapExtStorageHomeAttribute',
  501. 'ldap_matching_rule_in_chain_state' => 'ldapMatchingRuleInChainState',
  502. 'ldapIgnoreNamingRules' => 'ldapIgnoreNamingRules', // sysconfig
  503. ];
  504. return $array;
  505. }
  506. /**
  507. * @throws \RuntimeException
  508. */
  509. public function resolveRule(string $rule): array {
  510. if ($rule === 'avatar') {
  511. return $this->getAvatarAttributes();
  512. }
  513. throw new \RuntimeException('Invalid rule');
  514. }
  515. public function getAvatarAttributes(): array {
  516. $value = $this->ldapUserAvatarRule ?: self::AVATAR_PREFIX_DEFAULT;
  517. $defaultAttributes = ['jpegphoto', 'thumbnailphoto'];
  518. if ($value === self::AVATAR_PREFIX_NONE) {
  519. return [];
  520. }
  521. if (strpos($value, self::AVATAR_PREFIX_DATA_ATTRIBUTE) === 0) {
  522. $attribute = trim(substr($value, strlen(self::AVATAR_PREFIX_DATA_ATTRIBUTE)));
  523. if ($attribute === '') {
  524. return $defaultAttributes;
  525. }
  526. return [strtolower($attribute)];
  527. }
  528. if ($value !== self::AVATAR_PREFIX_DEFAULT) {
  529. \OC::$server->getLogger()->warning('Invalid config value to ldapUserAvatarRule; falling back to default.');
  530. }
  531. return $defaultAttributes;
  532. }
  533. }