1
0

Version1130Date20211102154716.php 8.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright Copyright (c) 2020 Joas Schilling <coding@schilljs.com>
  5. *
  6. * @author Côme Chilliet <come.chilliet@nextcloud.com>
  7. *
  8. * @license GNU AGPL version 3 or any later version
  9. *
  10. * This program is free software: you can redistribute it and/or modify
  11. * it under the terms of the GNU Affero General Public License as
  12. * published by the Free Software Foundation, either version 3 of the
  13. * License, or (at your option) any later version.
  14. *
  15. * This program is distributed in the hope that it will be useful,
  16. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  17. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  18. * GNU Affero General Public License for more details.
  19. *
  20. * You should have received a copy of the GNU Affero General Public License
  21. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  22. *
  23. */
  24. namespace OCA\User_LDAP\Migration;
  25. use Closure;
  26. use Generator;
  27. use OCP\DB\Exception;
  28. use OCP\DB\ISchemaWrapper;
  29. use OCP\DB\QueryBuilder\IQueryBuilder;
  30. use OCP\DB\Types;
  31. use OCP\IDBConnection;
  32. use OCP\Migration\IOutput;
  33. use OCP\Migration\SimpleMigrationStep;
  34. use Psr\Log\LoggerInterface;
  35. class Version1130Date20211102154716 extends SimpleMigrationStep {
  36. /** @var IDBConnection */
  37. private $dbc;
  38. /** @var LoggerInterface */
  39. private $logger;
  40. /** @var string[] */
  41. private $hashColumnAddedToTables = [];
  42. public function __construct(IDBConnection $dbc, LoggerInterface $logger) {
  43. $this->dbc = $dbc;
  44. $this->logger = $logger;
  45. }
  46. public function getName() {
  47. return 'Adjust LDAP user and group ldap_dn column lengths and add ldap_dn_hash columns';
  48. }
  49. public function preSchemaChange(IOutput $output, \Closure $schemaClosure, array $options) {
  50. foreach (['ldap_user_mapping', 'ldap_group_mapping'] as $tableName) {
  51. $this->processDuplicateUUIDs($tableName);
  52. }
  53. /** @var ISchemaWrapper $schema */
  54. $schema = $schemaClosure();
  55. if ($schema->hasTable('ldap_group_mapping_backup')) {
  56. // Previous upgrades of a broken release might have left an incomplete
  57. // ldap_group_mapping_backup table. No need to recreate, but it
  58. // should be empty.
  59. // TRUNCATE is not available from Query Builder, but faster than DELETE FROM.
  60. $sql = $this->dbc->getDatabasePlatform()->getTruncateTableSQL('`*PREFIX*ldap_group_mapping_backup`', false);
  61. $this->dbc->executeStatement($sql);
  62. }
  63. }
  64. /**
  65. * @param IOutput $output
  66. * @param Closure $schemaClosure The `\Closure` returns a `ISchemaWrapper`
  67. * @param array $options
  68. * @return null|ISchemaWrapper
  69. */
  70. public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
  71. /** @var ISchemaWrapper $schema */
  72. $schema = $schemaClosure();
  73. $changeSchema = false;
  74. foreach (['ldap_user_mapping', 'ldap_group_mapping'] as $tableName) {
  75. $table = $schema->getTable($tableName);
  76. if (!$table->hasColumn('ldap_dn_hash')) {
  77. $table->addColumn('ldap_dn_hash', Types::STRING, [
  78. 'notnull' => false,
  79. 'length' => 64,
  80. ]);
  81. $changeSchema = true;
  82. $this->hashColumnAddedToTables[] = $tableName;
  83. }
  84. $column = $table->getColumn('ldap_dn');
  85. if ($tableName === 'ldap_user_mapping') {
  86. if ($column->getLength() < 4000) {
  87. $column->setLength(4000);
  88. $changeSchema = true;
  89. }
  90. if ($table->hasIndex('ldap_dn_users')) {
  91. $table->dropIndex('ldap_dn_users');
  92. $changeSchema = true;
  93. }
  94. if (!$table->hasIndex('ldap_user_dn_hashes')) {
  95. $table->addUniqueIndex(['ldap_dn_hash'], 'ldap_user_dn_hashes');
  96. $changeSchema = true;
  97. }
  98. if (!$table->hasIndex('ldap_user_directory_uuid')) {
  99. $table->addUniqueIndex(['directory_uuid'], 'ldap_user_directory_uuid');
  100. $changeSchema = true;
  101. }
  102. } elseif (!$schema->hasTable('ldap_group_mapping_backup')) {
  103. // We need to copy the table twice to be able to change primary key, prepare the backup table
  104. $table2 = $schema->createTable('ldap_group_mapping_backup');
  105. $table2->addColumn('ldap_dn', Types::STRING, [
  106. 'notnull' => true,
  107. 'length' => 4000,
  108. 'default' => '',
  109. ]);
  110. $table2->addColumn('owncloud_name', Types::STRING, [
  111. 'notnull' => true,
  112. 'length' => 64,
  113. 'default' => '',
  114. ]);
  115. $table2->addColumn('directory_uuid', Types::STRING, [
  116. 'notnull' => true,
  117. 'length' => 255,
  118. 'default' => '',
  119. ]);
  120. $table2->addColumn('ldap_dn_hash', Types::STRING, [
  121. 'notnull' => false,
  122. 'length' => 64,
  123. ]);
  124. $table2->setPrimaryKey(['owncloud_name'], 'lgm_backup_primary');
  125. $changeSchema = true;
  126. }
  127. }
  128. return $changeSchema ? $schema : null;
  129. }
  130. /**
  131. * @param IOutput $output
  132. * @param Closure $schemaClosure The `\Closure` returns a `ISchemaWrapper`
  133. * @param array $options
  134. */
  135. public function postSchemaChange(IOutput $output, Closure $schemaClosure, array $options) {
  136. $this->handleDNHashes('ldap_group_mapping');
  137. $this->handleDNHashes('ldap_user_mapping');
  138. }
  139. protected function handleDNHashes(string $table): void {
  140. $select = $this->getSelectQuery($table);
  141. $update = $this->getUpdateQuery($table);
  142. $result = $select->executeQuery();
  143. while ($row = $result->fetch()) {
  144. $dnHash = hash('sha256', $row['ldap_dn'], false);
  145. $update->setParameter('name', $row['owncloud_name']);
  146. $update->setParameter('dn_hash', $dnHash);
  147. try {
  148. $update->executeStatement();
  149. } catch (Exception $e) {
  150. $this->logger->error('Failed to add hash "{dnHash}" ("{name}" of {table})',
  151. [
  152. 'app' => 'user_ldap',
  153. 'name' => $row['owncloud_name'],
  154. 'dnHash' => $dnHash,
  155. 'table' => $table,
  156. 'exception' => $e,
  157. ]
  158. );
  159. }
  160. }
  161. $result->closeCursor();
  162. }
  163. protected function getSelectQuery(string $table): IQueryBuilder {
  164. $qb = $this->dbc->getQueryBuilder();
  165. $qb->select('owncloud_name', 'ldap_dn')
  166. ->from($table);
  167. // when added we may run into risk that it's read from a DB node
  168. // where the column is not present. Then the where clause is also
  169. // not necessary since all rows qualify.
  170. if (!in_array($table, $this->hashColumnAddedToTables, true)) {
  171. $qb->where($qb->expr()->isNull('ldap_dn_hash'));
  172. }
  173. return $qb;
  174. }
  175. protected function getUpdateQuery(string $table): IQueryBuilder {
  176. $qb = $this->dbc->getQueryBuilder();
  177. $qb->update($table)
  178. ->set('ldap_dn_hash', $qb->createParameter('dn_hash'))
  179. ->where($qb->expr()->eq('owncloud_name', $qb->createParameter('name')));
  180. return $qb;
  181. }
  182. /**
  183. * @throws Exception
  184. */
  185. protected function processDuplicateUUIDs(string $table): void {
  186. $uuids = $this->getDuplicatedUuids($table);
  187. $idsWithUuidToInvalidate = [];
  188. foreach ($uuids as $uuid) {
  189. array_push($idsWithUuidToInvalidate, ...$this->getNextcloudIdsByUuid($table, $uuid));
  190. }
  191. $this->invalidateUuids($table, $idsWithUuidToInvalidate);
  192. }
  193. /**
  194. * @throws Exception
  195. */
  196. protected function invalidateUuids(string $table, array $idList): void {
  197. $update = $this->dbc->getQueryBuilder();
  198. $update->update($table)
  199. ->set('directory_uuid', $update->createParameter('invalidatedUuid'))
  200. ->where($update->expr()->eq('owncloud_name', $update->createParameter('nextcloudId')));
  201. while ($nextcloudId = array_shift($idList)) {
  202. $update->setParameter('nextcloudId', $nextcloudId);
  203. $update->setParameter('invalidatedUuid', 'invalidated_' . \bin2hex(\random_bytes(6)));
  204. try {
  205. $update->executeStatement();
  206. $this->logger->warning(
  207. 'LDAP user or group with ID {nid} has a duplicated UUID value which therefore was invalidated. You may double-check your LDAP configuration and trigger an update of the UUID.',
  208. [
  209. 'app' => 'user_ldap',
  210. 'nid' => $nextcloudId,
  211. ]
  212. );
  213. } catch (Exception $e) {
  214. // Catch possible, but unlikely duplications if new invalidated errors.
  215. // There is the theoretical chance of an infinity loop is, when
  216. // the constraint violation has a different background. I cannot
  217. // think of one at the moment.
  218. if ($e->getReason() !== Exception::REASON_CONSTRAINT_VIOLATION) {
  219. throw $e;
  220. }
  221. $idList[] = $nextcloudId;
  222. }
  223. }
  224. }
  225. /**
  226. * @throws \OCP\DB\Exception
  227. * @return array<string>
  228. */
  229. protected function getNextcloudIdsByUuid(string $table, string $uuid): array {
  230. $select = $this->dbc->getQueryBuilder();
  231. $select->select('owncloud_name')
  232. ->from($table)
  233. ->where($select->expr()->eq('directory_uuid', $select->createNamedParameter($uuid)));
  234. $result = $select->executeQuery();
  235. $idList = [];
  236. while (($id = $result->fetchOne()) !== false) {
  237. $idList[] = $id;
  238. }
  239. $result->closeCursor();
  240. return $idList;
  241. }
  242. /**
  243. * @return Generator<string>
  244. * @throws \OCP\DB\Exception
  245. */
  246. protected function getDuplicatedUuids(string $table): Generator {
  247. $select = $this->dbc->getQueryBuilder();
  248. $select->select('directory_uuid')
  249. ->from($table)
  250. ->groupBy('directory_uuid')
  251. ->having($select->expr()->gt($select->func()->count('owncloud_name'), $select->createNamedParameter(1)));
  252. $result = $select->executeQuery();
  253. while (($uuid = $result->fetchOne()) !== false) {
  254. yield $uuid;
  255. }
  256. $result->closeCursor();
  257. }
  258. }