Skip to content

Commit 91095dd

Browse files
author
Robin Kluth
committed
* Updated searchGroup parameters
* fix: Check single-valued attributes case insensitive
1 parent 9cf61a4 commit 91095dd

File tree

2 files changed

+35
-20
lines changed

2 files changed

+35
-20
lines changed

‎README.md

+9-2
Original file line numberDiff line numberDiff line change
@@ -66,8 +66,9 @@ There are 5 basic functions:
6666
default).
6767
* `$fetchUserDN` determines the user DN, in case you want a bind via a users DN instead of username@hostname
6868
* `fetchUserData($attributes)`
69-
* Queries the LDAP for the logged in user and gets some attributes (adjustable list of attributes)
70-
* `searchUser($searchFor, $attributes, $searchFilter, $domainKey, $onlyActiveAccounts, $allDomainsHaveToBeReachable)`
69+
* Queries the LDAP for the logged-in user and gets some attributes (adjustable list of attributes)
70+
*
71+
`searchUser($searchFor, $attributes, $searchFilter, $domainKey, $onlyActiveAccounts, $allDomainsHaveToBeReachable, $baseDN)`
7172
* Searches for a user in the LDAP-Directory. This requires a search-user which is configured in the component options.
7273
* The options let you define what attributes you want back and in which you are searching (defaults to lastname,
7374
firstname, username and class=person).
@@ -77,6 +78,12 @@ There are 5 basic functions:
7778
false!
7879
* `$allDomainsHaveToBeReachable` True: All configured domains need to be reachable in order to get a result. If one is
7980
not reachable, false will be returned
81+
* `$baseDN` Overrides the default (domain) basedn.
82+
*
83+
`searchGroup($searchFor, $groupAttributes, $userAttributes, $returnMembers, $domainKey, $onlyActiveAccounts, $allDomainsHaveToBeReachable)`
84+
* `$searchFor` specifies the groupname (text, partial text (*) or sid)
85+
* `$userAttributes` and `$groupAttributes` specify the attributes for the result
86+
* Any other parameter has are being passed to `searchUser`, so check the docs there
8087
* `updateAttributes` lets you update the user attributes
8188
* `$attributes` The attribute (array keys are the attribute names, the array values are the attribute values)
8289
* `$dn` The DN which should be updated - if not provided, the eventually previous examined one will be used.

‎src/LdapAuth.php

+26-18
Original file line numberDiff line numberDiff line change
@@ -309,9 +309,9 @@ public function login($username, $password, $domainKey = false, $fetchUserDN = f
309309
continue;
310310
}
311311

312-
$this->_l = $l;
313-
$this->_ldapBaseDn = $domainData['baseDn'];
314-
$this->_username = $username;
312+
$this->_l = $l;
313+
$this->_ldapBaseDn = $domainData['baseDn'];
314+
$this->_username = $username;
315315
$this->_curDomainHostname = $domainData['hostname'];
316316
$this->_curDomainKey = $domainKey;
317317

@@ -463,8 +463,8 @@ public function searchUser(?string $searchFor, ?array $attributes = [], ?string
463463

464464
Yii::debug('Search-Filter: ' . $searchFilter . " | BaseDN: " . $baseDN, __METHOD__);
465465

466-
$result = ldap_read($this->_l, '', '(objectClass=*)', ['supportedControl']);
467-
$supControls = ldap_get_entries($this->_l, $result);
466+
$result = ldap_read($this->_l, '', '(objectClass=*)', ['supportedControl']);
467+
$supControls = ldap_get_entries($this->_l, $result);
468468

469469
if (empty($this->_singleValuedAttrs) || !isset($this->_singleValuedAttrs[$domain['hostname']])) {
470470
$this->_singleValuedAttrs[$domain['hostname']] = [];
@@ -486,7 +486,7 @@ public function searchUser(?string $searchFor, ?array $attributes = [], ?string
486486
if (stripos($definition, 'SINGLE-VALUE') !== false) {
487487
$match = preg_match("/NAME ['\"](.*?)['\"]/", $definition, $matches);
488488
if ($match && isset($matches[1])) {
489-
$this->_singleValuedAttrs[$domain['hostname']][] = $matches[1];
489+
$this->_singleValuedAttrs[$domain['hostname']][] = strtolower($matches[1]);
490490
}
491491
}
492492
}
@@ -502,8 +502,6 @@ public function searchUser(?string $searchFor, ?array $attributes = [], ?string
502502
}
503503

504504

505-
506-
507505
$cookie = '';
508506
$requestControls = [];
509507
if (($domain['pagedResultsSize'] ?? 0) > 0) {
@@ -621,18 +619,31 @@ public function searchUser(?string $searchFor, ?array $attributes = [], ?string
621619

622620
/**
623621
* Searches directly for groups and optionally return its members
624-
* @param string|null $searchFor The raw (!) LDAP-Filter. Like (&(objectCategory=group) (|(objectSid=%searchFor%)(cn=*%searchFor%*)))
625-
* @param array|null $attributes
622+
* @param string|null $searchFor The search value (like in searchUser). Like (&(objectCategory=group) (|(objectSid=%searchFor%)(cn=*%searchFor%*)))
623+
* @param array|null $userAttributes
624+
* @param array $groupAttributes
625+
* @param string|null $searchFilter The LDAP-Filter
626626
* @param bool $returnMembers Should the function fetch the group members?
627627
* @param int|null $domainKey
628628
* @param bool $onlyActiveAccounts
629629
* @param bool $allDomainsHaveToBeReachable
630630
* @return array|false
631631
* @throws ErrorException
632632
*/
633-
public function searchGroup(?string $searchFor, ?array $attributes = ['dn', 'member'], bool $returnMembers = false, ?int $domainKey = null, bool $onlyActiveAccounts = false, bool $allDomainsHaveToBeReachable = false)
633+
public function searchGroup(?string $searchFor, array $groupAttributes = ['dn', 'member'], ?array $userAttributes = ['dn', 'samaccountname', 'mail'], bool $returnMembers = false, ?string $searchFilter = "", ?int $domainKey = null, bool $onlyActiveAccounts = false, bool $allDomainsHaveToBeReachable = false)
634634
{
635-
$groups = $this->searchUser(null, $attributes, $searchFor, $domainKey, $onlyActiveAccounts, $allDomainsHaveToBeReachable);
635+
if (!in_array('dn', $groupAttributes)) {
636+
$groupAttributes[] = 'dn';
637+
}
638+
if (!in_array('member', $groupAttributes)) {
639+
$groupAttributes[] = 'member';
640+
}
641+
642+
if (empty($searchFilter)) {
643+
$searchFilter = "(&(objectCategory=group) (|(objectSid=%searchFor%)(cn=%searchFor%)))";
644+
}
645+
646+
$groups = $this->searchUser($searchFor, $groupAttributes, $searchFilter, $domainKey, $onlyActiveAccounts, $allDomainsHaveToBeReachable);
636647

637648
if (!$returnMembers) {
638649
return $groups;
@@ -642,7 +653,7 @@ public function searchGroup(?string $searchFor, ?array $attributes = ['dn', 'mem
642653
if (!isset($group['member'])) {
643654
continue;
644655
}
645-
$groups[$gkey]['users'] = $this->searchUser(null, ['dn'], '(&(objectCategory=person)(memberof=' . $group['dn'] . '))', $group['domainKey']);
656+
$groups[$gkey]['users'] = $this->searchUser(null, $userAttributes, '(&(objectCategory=person)(memberof=' . $group['dn'] . '))', $group['domainKey']);
646657
}
647658

648659
return $groups;
@@ -730,16 +741,13 @@ private function handleEntry($entry)
730741
{
731742
$newEntry = [];
732743
foreach ($entry as $attr => $value) {
733-
// Yii::debug('Processing attribute ' . $attr, __FUNCTION__);
734744

735745
if (is_int($attr) || $attr == 'objectsid' || $attr == 'sidhistory' || !isset($value['count'])) {
736-
// Yii::debug('Skipping...', __FUNCTION__);
737746
continue;
738747
}
739-
$count = $value['count'];
740-
// Yii::debug('Count: ' . $count, __FUNCTION__);
748+
$count = $value['count'];
741749

742-
if ($count > 1 || !in_array($attr, $this->_singleValuedAttrs[$this->_curDomainHostname] ?? [])) {
750+
if ($count > 1 || !in_array(strtolower($attr), $this->_singleValuedAttrs[$this->_curDomainHostname] ?? [])) {
743751
unset($value['count']);
744752
$newEntry[$attr] = $value; // Return value as is, because it contains multiple entries
745753
} else {

0 commit comments

Comments
 (0)