ilLDAPQuery Class Reference

Collaboration diagram for ilLDAPQuery:

Public Member Functions
	__construct (ilLDAPServer $a_server, $a_url='')
	Constructur. More...
	getServer ()
	Get server. More...
	getLogger ()
	Get logger. More...
	fetchUser ($a_name)
	Get one user by login name. More...
	fetchUsers ()
	Fetch all users. More...
	query ($a_search_base, $a_filter, $a_scope, $a_attributes)
	Perform a query. More...
	modAdd ($a_dn, $a_attribute)
	Add value to an existing attribute. More...
	modDelete ($a_dn, $a_attribute)
	Delete value from an existing attribute. More...
	checkGroupMembership ($a_ldap_user_name, $ldap_user_data)
	check group membership More...
	bind ($a_binding_type=IL_LDAP_BIND_DEFAULT, $a_user_dn='', $a_password='')
	Bind to LDAP server. More...
	__destruct ()
	Destructor unbind from ldap server. More...

Private Member Functions
	readAllUsers ()
	Fetch all users This function splits the query to filters like e.g (uid=a*) (uid=b*)... More...
	fetchGroupMembers ($a_name='')
	Fetch group member ids. More...
	readUserData ($a_name, $a_check_dn=false, $a_try_group_user_filter=false)
	Read user data. More...
	parseAuthMode ()
	Parse authentication mode. More...
	queryByScope ($a_scope, $a_base_dn, $a_filter, $a_attributes)
	Query by scope IL_SCOPE_SUB => ldap_search IL_SCOPE_ONE => ldap_list. More...
	connect ()
	Connect to LDAP server. More...
	fetchUserProfileFields ()
	fetch required fields of user profile data More...
	unbind ()
	Unbind. More...

Private Attributes
	$ldap_server_url = null
	$settings = null
	$log = null
	$user_fields = array()

Detailed Description

Author

Stefan Meyer meyer.nosp@m.@lei.nosp@m.fos.c.nosp@m.om

Version

$Id$

Definition at line 42 of file class.ilLDAPQuery.php.

Constructor & Destructor Documentation

__construct()

ilLDAPQuery::__construct	(	ilLDAPServer	$a_server,
			$a_url = ''
	)

Constructur.

private

Parameters

object

ilLDAPServer or subclass

Exceptions

ilLDAPQueryException

Definition at line 62 of file class.ilLDAPQuery.php.

References $GLOBALS, ilLDAPAttributeMapping\_getInstanceByServerId(), connect(), fetchUserProfileFields(), and settings().

        {
                $this->settings = $a_server;
                
                if(strlen($a_url))
                {
                        $this->ldap_server_url = $a_url;
                }
                else
                {
                        $this->ldap_server_url = $this->settings->getUrl();
                }
                
                $this->mapping = ilLDAPAttributeMapping::_getInstanceByServerId($this->settings->getServerId());
                $this->log = $GLOBALS['DIC']->logger()->auth();
                
                $this->fetchUserProfileFields();
                $this->connect();
        }

Here is the call graph for this function:

__destruct()

ilLDAPQuery::__destruct

(

)

Destructor unbind from ldap server.

private

Parameters

Definition at line 723 of file class.ilLDAPQuery.php.

        {
                if($this->lh)
                {
                        @ldap_unbind($this->lh);
                }
        }

Member Function Documentation

bind()

ilLDAPQuery::bind	(		$a_binding_type = IL_LDAP_BIND_DEFAULT,
			$a_user_dn = '',
			$a_password = ''
	)

Bind to LDAP server.

public

Parameters

int	binding_type IL_LDAP_BIND_DEFAULT || IL_LDAP_BIND_ADMIN

Exceptions

ilLDAPQueryException

on connection failure.

Definition at line 617 of file class.ilLDAPQuery.php.

References $pass, ilLDAPServer\DEFAULT_NETWORK_TIMEOUT, IL_LDAP_BIND_ADMIN, IL_LDAP_BIND_AUTH, IL_LDAP_BIND_DEFAULT, IL_LDAP_BIND_TEST, IL_LDAP_BIND_USER, and settings().

        {
                switch($a_binding_type)
                {
                        case IL_LDAP_BIND_TEST:
                                ldap_set_option($this->lh, LDAP_OPT_NETWORK_TIMEOUT, ilLDAPServer::DEFAULT_NETWORK_TIMEOUT);
                                // fall through
                        case IL_LDAP_BIND_DEFAULT:
                                // Now bind anonymously or as user
                                if(
                                        IL_LDAP_BIND_USER == $this->settings->getBindingType() &&
                                        strlen($this->settings->getBindUser())
                                )
                                {
                                        $user = $this->settings->getBindUser();
                                        $pass = $this->settings->getBindPassword();

                                        define('IL_LDAP_REBIND_USER',$user);
                                        define('IL_LDAP_REBIND_PASS',$pass);
                                        $this->log->debug('Bind as '.$user);
                                }
                                else
                                {
                                        $user = $pass = '';
                                        $this->log->debug('Bind anonymous');
                                }
                                break;
                                
                        case IL_LDAP_BIND_ADMIN:
                                $user = $this->settings->getRoleBindDN();
                                $pass = $this->settings->getRoleBindPassword();
                                
                                if(!strlen($user) or !strlen($pass))
                                {
                                        $user = $this->settings->getBindUser();
                                        $pass = $this->settings->getBindPassword();
                                }

                                define('IL_LDAP_REBIND_USER',$user);
                                define('IL_LDAP_REBIND_PASS',$pass);
                                break;
                                
                        case IL_LDAP_BIND_AUTH:
                                $this->log->debug('Trying to bind as: ' . $a_user_dn);
                                $user = $a_user_dn;
                                $pass = $a_password;
                                break;
                                
                                
                        default:
                                throw new ilLDAPQueryException('LDAP: unknown binding type in: '.__METHOD__);
                }
                
                if(!@ldap_bind($this->lh,$user,$pass))
                {
                        throw new ilLDAPQueryException('LDAP: Cannot bind as '.$user.' with message: '. ldap_err2str(ldap_errno($this->lh)).' Trying fallback...', ldap_errno($this->lh));
                }
                else
                {
                        $this->log->debug('Bind successful.');
                }
        }

Here is the call graph for this function:

checkGroupMembership()

ilLDAPQuery::checkGroupMembership	(		$a_ldap_user_name,
			$ldap_user_data
	)

check group membership

Parameters

string	login name
array	user data

Returns

bool

Definition at line 293 of file class.ilLDAPQuery.php.

References $res, ilLogLevel\DEBUG, getLogger(), getServer(), queryByScope(), and readUserData().

        {
                $group_names = $this->getServer()->getGroupNames();
                
                if(!count($group_names))
                {
                        $this->getLogger()->debug('No LDAP group restrictions found');
                        return true;
                }
                
                $group_dn = $this->getServer()->getGroupDN();
                if(
                        $group_dn && 
                        (substr($group_dn, -1) != ',')
                )
                {
                        $group_dn .= ',';
                }
                $group_dn .= $this->getServer()->getBaseDN();
                
                foreach($group_names as $group)
                {
                        $user = $a_ldap_user_name;
                        if($this->getServer()->enabledGroupMemberIsDN())
                        {
                                $user = $ldap_user_data['dn'];
                        }
                        
                        $filter = sprintf('(&(%s=%s)(%s=%s)%s)',
                                $this->getServer()->getGroupAttribute(),
                                $group,
                                $this->getServer()->getGroupMember(),
                                $user,
                                $this->getServer()->getGroupFilter()
                        );
                        $this->getLogger()->debug('Current group search base: ' . $group_dn);
                        $this->getLogger()->debug('Current group filter: ' . $filter);
                        
                        $res = $this->queryByScope(
                                $this->getServer()->getGroupScope(),
                                $group_dn,
                                $filter,
                                [$this->getServer()->getGroupMember()]
                        );
                        
                        $this->getLogger()->dump($res);
                        
                        $tmp_result = new ilLDAPResult($this->lh,$res);
                        $group_result = $tmp_result->getRows();
                        
                        $this->getLogger()->debug('Group query returned: ');
                        $this->getLogger()->dump($group_result, ilLogLevel::DEBUG);
                        
                        if(count($group_result))
                        {
                                return true;
                        }
                }
                
                // group restrictions failed check optional membership
                if($this->getServer()->isMembershipOptional())
                {
                        $this->getLogger()->debug('Group restrictions failed, checking user filter.');
                        if($this->readUserData($a_ldap_user_name, true, true))
                        {
                                $this->getLogger()->debug('User filter matches.');
                                return true;
                        }
                }
                $this->getLogger()->debug('Group restrictions failed.');
                return false;
        }

Here is the call graph for this function:

connect()

ilLDAPQuery::connect ( )

private

Connect to LDAP server.

private

Exceptions

ilLDAPQueryException

Definition at line 571 of file class.ilLDAPQuery.php.

References settings().

Referenced by __construct().

        {
                $this->lh = @ldap_connect($this->ldap_server_url);
                
                // LDAP Connect
                if(!$this->lh)
                {
                        throw new ilLDAPQueryException("LDAP: Cannot connect to LDAP Server: ".$this->settings->getUrl());
                }
                // LDAP Version
                if(!ldap_set_option($this->lh,LDAP_OPT_PROTOCOL_VERSION,$this->settings->getVersion()))
                {
                        throw new ilLDAPQueryException("LDAP: Cannot set version to: ".$this->settings->getVersion());
                }
                // Switch on referrals
                if($this->settings->isActiveReferrer())
                {
                        if(!ldap_set_option($this->lh,LDAP_OPT_REFERRALS,true))
                        {
                                throw new ilLDAPQueryException("LDAP: Cannot switch on LDAP referrals");
                        }
                        #@ldap_set_rebind_proc($this->lh,'referralRebind');
                }
                else
                {
                        ldap_set_option($this->lh,LDAP_OPT_REFERRALS,false);
                        $this->log->debug('Switching referrals to false.');
                }
                // Start TLS
                if($this->settings->isActiveTLS())
                {
                        if(!ldap_start_tls($this->lh))
                        {
                                throw new ilLDAPQueryException("LDAP: Cannot start LDAP TLS");
                        }
                }
        }

Here is the call graph for this function:

Here is the caller graph for this function:

fetchGroupMembers()

ilLDAPQuery::fetchGroupMembers (   $a_name = '' )

private

Fetch group member ids.

public

Definition at line 373 of file class.ilLDAPQuery.php.

References $data, $res, array, queryByScope(), readUserData(), and settings().

Referenced by fetchUsers().

        {
                $group_name = strlen($a_name) ? $a_name : $this->settings->getGroupName();
                
                // Build filter
                $filter = sprintf('(&(%s=%s)%s)',
                        $this->settings->getGroupAttribute(),
                        $group_name,
                        $this->settings->getGroupFilter());
                
                
                // Build search base
                if(($gdn = $this->settings->getGroupDN()) && substr($gdn,-1) != ',')
                {
                        $gdn .= ',';
                }
                $gdn .= $this->settings->getBaseDN();
                
                $this->log->debug('Using filter '.$filter);
                $this->log->debug('Using DN '.$gdn);
                $res = $this->queryByScope($this->settings->getGroupScope(),
                        $gdn,
                        $filter,
                        array($this->settings->getGroupMember()));
                        
                $tmp_result = new ilLDAPResult($this->lh,$res);
                $group_data = $tmp_result->getRows();
                
                
                if(!$tmp_result->numRows())
                {
                        $this->log->info('No group found.');
                        return false;
                }
                                
                $attribute_name = strtolower($this->settings->getGroupMember());
                
                // All groups
                foreach($group_data as $data)
                {
                        $this->log->debug('Found '.count($data[$attribute_name]).' group members for group '.$data['dn']);
                        if(is_array($data[$attribute_name]))
                        {
                                foreach($data[$attribute_name] as $name)
                                {
                                        $this->readUserData($name,true,true);
                                }
                        }
                        else
                        {
                                $this->readUserData($data[$attribute_name],true,true);
                        }
                }
                unset($tmp_result);
                return;
        }

Here is the call graph for this function:

Here is the caller graph for this function:

fetchUser()

ilLDAPQuery::fetchUser

(

$a_name

)

Get one user by login name.

public

Parameters

string

login name

Returns

array of user data

Definition at line 108 of file class.ilLDAPQuery.php.

References array, and readUserData().

        {
                if(!$this->readUserData($a_name))
                {
                        return array();
                }
                else
                {
                        return $this->users;
                }
        }

Here is the call graph for this function:

fetchUserProfileFields()

ilLDAPQuery::fetchUserProfileFields ( )

private

fetch required fields of user profile data

private

Parameters

Definition at line 687 of file class.ilLDAPQuery.php.

References array, ilLDAPRoleAssignmentRules\getAttributeNames(), getServer(), and settings().

Referenced by __construct().

        {
                include_once('Services/LDAP/classes/class.ilLDAPRoleAssignmentRules.php');
                
                $this->user_fields = array_merge(
                        array($this->settings->getUserAttribute()),
                        array('dn'),
                        $this->mapping->getFields(),
                        ilLDAPRoleAssignmentRules::getAttributeNames($this->getServer()->getServerId())
                );
        }

Here is the call graph for this function:

Here is the caller graph for this function:

fetchUsers()

ilLDAPQuery::fetchUsers

(

)

Fetch all users.

public

Returns

array array of user data

Definition at line 127 of file class.ilLDAPQuery.php.

References array, fetchGroupMembers(), readAllUsers(), and settings().

        {
                // First of all check if a group restriction is enabled
                // YES: => fetch all group members
                // No:  => fetch all users
                if(strlen($this->settings->getGroupName()))
                {
                        $this->log->debug('Searching for group members.');

                        $groups = $this->settings->getGroupNames();
                        if(count($groups) <= 1)
                        {
                                $this->fetchGroupMembers();
                        }                       
                        else
                        {
                                foreach($groups as $group)
                                {
                                        $this->fetchGroupMembers($group);
                                }
                        }                       
                        
                }
                if(!strlen($this->settings->getGroupName()) or $this->settings->isMembershipOptional())
                {
                        $this->log->info('Start reading all users...');
                        $this->readAllUsers();
                        #throw new ilLDAPQueryException('LDAP: Called import of users without specifying group restrictions. NOT IMPLEMENTED YET!');
                }
                return $this->users ? $this->users : array();
        }

Here is the call graph for this function:

getLogger()

ilLDAPQuery::getLogger

(

)

Get logger.

Returns

ilLogger

Definition at line 96 of file class.ilLDAPQuery.php.

References $log.

Referenced by checkGroupMembership(), and queryByScope().

        {
                return $this->log;
        }

Here is the caller graph for this function:

getServer()

ilLDAPQuery::getServer

(

)

Get server.

Returns

ilLDAPServer

Definition at line 87 of file class.ilLDAPQuery.php.

References $settings.

Referenced by checkGroupMembership(), and fetchUserProfileFields().

        {
                return $this->settings;
        }

Here is the caller graph for this function:

modAdd()

ilLDAPQuery::modAdd	(		$a_dn,
			$a_attribute
	)

Add value to an existing attribute.

public

Exceptions

ilLDAPQueryException

Definition at line 190 of file class.ilLDAPQuery.php.

        {
                if(@ldap_mod_add($this->lh,$a_dn,$a_attribute))
                {
                        return true;
                }
                throw new ilLDAPQueryException(__METHOD__.' '.ldap_error($this->lh));
        }

modDelete()

ilLDAPQuery::modDelete	(		$a_dn,
			$a_attribute
	)

Delete value from an existing attribute.

public

Exceptions

ilLDAPQueryException

Definition at line 205 of file class.ilLDAPQuery.php.

        {
                if(@ldap_mod_del($this->lh,$a_dn,$a_attribute))
                {
                        return true;
                }
                throw new ilLDAPQueryException(__METHOD__.' '.ldap_error($this->lh));
        }

parseAuthMode()

ilLDAPQuery::parseAuthMode ( )

private

Parse authentication mode.

Returns

string auth mode

Definition at line 515 of file class.ilLDAPQuery.php.

References settings().

        {
                return $this->settings->getAuthenticationMappingKey();
        }

Here is the call graph for this function:

query()

ilLDAPQuery::query	(		$a_search_base,
			$a_filter,
			$a_scope,
			$a_attributes
	)

Perform a query.

public

Parameters

string	search base
string	filter
int	scope
array	attributes

Returns

object ilLDAPResult

Exceptions

ilLDAPQueryException

Definition at line 170 of file class.ilLDAPQuery.php.

References $res, and queryByScope().

        {
                $res = $this->queryByScope($a_scope,$a_search_base,$a_filter,$a_attributes);
                if($res === false)
                {
                        throw new ilLDAPQueryException(__METHOD__.' '.ldap_error($this->lh).' '.
                                sprintf('DN: %s, Filter: %s, Scope: %s',
                                        $a_search_base,
                                        $a_filter,
                                        $a_scope));
                }
                return new ilLDAPResult($this->lh,$res);
        }

Here is the call graph for this function:

queryByScope()

ilLDAPQuery::queryByScope (   $a_scope,   $a_base_dn,   $a_filter,   $a_attributes  )

private

Query by scope IL_SCOPE_SUB => ldap_search IL_SCOPE_ONE => ldap_list.

private

Parameters

Definition at line 529 of file class.ilLDAPQuery.php.

References $error, $res, getLogger(), IL_LDAP_SCOPE_BASE, IL_LDAP_SCOPE_ONE, and IL_LDAP_SCOPE_SUB.

Referenced by checkGroupMembership(), fetchGroupMembers(), query(), readAllUsers(), and readUserData().

        {
                $a_filter = $a_filter ? $a_filter : "(objectclass=*)";

                switch($a_scope)
                {
                        case IL_LDAP_SCOPE_SUB:
                                $res = @ldap_search($this->lh,$a_base_dn,$a_filter,$a_attributes);
                                break;
                                
                        case IL_LDAP_SCOPE_ONE:
                                $res = @ldap_list($this->lh,$a_base_dn,$a_filter,$a_attributes);
                                break;
                        
                        case IL_LDAP_SCOPE_BASE:

                                $res = @ldap_read($this->lh,$a_base_dn,$a_filter,$a_attributes);
                                break;

                        default:
                                $this->log->warning("LDAP: LDAPQuery: Unknown search scope");
                }
                
                $error = ldap_error($this->lh);
                if(strcmp('Success', $error) !== 0)
                {
                        $this->getLogger()->warning($error);
                        $this->getLogger()->warning('Base DN:' . $a_base_dn);
                        $this->getLogger()->warning('Filter: ' . $a_filter);
                }
                
                return $res;
        
        }

Here is the call graph for this function:

Here is the caller graph for this function:

readAllUsers()

ilLDAPQuery::readAllUsers ( )

private

Fetch all users This function splits the query to filters like e.g (uid=a*) (uid=b*)...

This avoids AD page_size_limit

public

Definition at line 222 of file class.ilLDAPQuery.php.

References $data, $res, array, queryByScope(), readUserData(), and settings().

Referenced by fetchUsers().

        {
                // Build search base
                if(($dn = $this->settings->getSearchBase()) && substr($dn,-1) != ',')
                {
                        $dn .= ',';
                }
                $dn .=  $this->settings->getBaseDN();
                
                // page results
                $filter = $this->settings->getFilter();
                $page_filter = array('a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z','-');
                $chars = array('a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z');
                
                foreach($page_filter as $letter)
                {
                        $new_filter = '(&';
                        $new_filter .= $filter;
                        
                        switch($letter)
                        {
                                case '-':
                                        $new_filter .= ('(!(|');
                                        foreach($chars as $char)
                                        {
                                                $new_filter .= ('('.$this->settings->getUserAttribute().'='.$char.'*)');
                                        }
                                        $new_filter .= ')))';
                                        break;

                                default:
                                        $new_filter .= ('('.$this->settings->getUserAttribute().'='.$letter.'*))');
                                        break;
                        }

                        $this->log->info('Searching with ldap search and filter '.$new_filter.' in '.$dn);
                        $res = $this->queryByScope($this->settings->getUserScope(),
                                $dn,
                                $new_filter,
                                array($this->settings->getUserAttribute()));

                        $tmp_result = new ilLDAPResult($this->lh,$res);
                        if(!$tmp_result->numRows())
                        {
                                $this->log->notice('No users found. Aborting.');
                                continue;
                        }
                        $this->log->info('Found '.$tmp_result->numRows().' users.');
                        $attribute = strtolower($this->settings->getUserAttribute());
                        foreach($tmp_result->getRows() as $data)
                        {
                                if(isset($data[$attribute]))
                                {
                                        $this->readUserData($data[$attribute],false,false);
                                }
                                else
                                {
                                        $this->log->warning('Unknown error. No user attribute found.');
                                }
                        }
                        unset($tmp_result);
                }
                return true;
        }

Here is the call graph for this function:

Here is the caller graph for this function:

readUserData()

ilLDAPQuery::readUserData (   $a_name,   $a_check_dn = false,   $a_try_group_user_filter = false  )

private

Read user data.

Parameters

bool	check dn
bool	use group filter private

Definition at line 436 of file class.ilLDAPQuery.php.

References $res, ilObjUser\_checkExternalAuthAccount(), array, IL_LDAP_SCOPE_BASE, queryByScope(), and settings().

Referenced by checkGroupMembership(), fetchGroupMembers(), fetchUser(), and readAllUsers().

        {
                $filter = $this->settings->getFilter();
                if($a_try_group_user_filter)
                {
                        if($this->settings->isMembershipOptional())
                        {
                                $filter = $this->settings->getGroupUserFilter();
                        }
                }
                
                // Build filter
                if($this->settings->enabledGroupMemberIsDN() and $a_check_dn)
                {
                        $dn = $a_name;
                        #$res = $this->queryByScope(IL_LDAP_SCOPE_BASE,$dn,$filter,$this->user_fields);

                        $fields = array_merge($this->user_fields,array('useraccountcontrol'));
                        $res = $this->queryByScope(IL_LDAP_SCOPE_BASE,strtolower($dn),$filter,$fields);
                }
                else
                {
                        $filter = sprintf('(&(%s=%s)%s)',
                                $this->settings->getUserAttribute(),
                                $a_name,
                                $filter);

                        // Build search base
                        if(($dn = $this->settings->getSearchBase()) && substr($dn,-1) != ',')
                        {
                                $dn .= ',';
                        }
                        $dn .=  $this->settings->getBaseDN();
                        $fields = array_merge($this->user_fields,array('useraccountcontrol'));
                        $res = $this->queryByScope($this->settings->getUserScope(),strtolower($dn),$filter,$fields);
                }
                
                
                $tmp_result = new ilLDAPResult($this->lh,$res);
                if(!$tmp_result->numRows())
                {
                        $this->log->info('LDAP: No user data found for: '.$a_name);
                        unset($tmp_result);
                        return false;
                }
                
                if($user_data = $tmp_result->get())
                {
                        if(isset($user_data['useraccountcontrol']))
                        {
                                if(($user_data['useraccountcontrol'] & 0x02))
                                {
                                        $this->log->notice('LDAP: '.$a_name.' account disabled.');
                                        return;
                                }
                        }
                        
                        $account = $user_data[strtolower($this->settings->getUserAttribute())];
                        if(is_array($account))
                        {
                                $user_ext = strtolower(array_shift($account));
                        }
                        else
                        {
                                $user_ext = strtolower($account);
                        }
                        
                        // auth mode depends on ldap server settings
                        $auth_mode = $this->settings->getAuthenticationMappingKey();
                        $user_data['ilInternalAccount'] = ilObjUser::_checkExternalAuthAccount($auth_mode,$user_ext);
                        $this->users[$user_ext] = $user_data;
                }
                return true;
        }

Here is the call graph for this function:

Here is the caller graph for this function:

unbind()

ilLDAPQuery::unbind ( )

private

Unbind.

private

Parameters

Definition at line 707 of file class.ilLDAPQuery.php.

        {
                if($this->lh)
                {
                        @ldap_unbind($this->lh);
                }
        }

Field Documentation

$ldap_server_url

ilLDAPQuery::$ldap_server_url = null

private

Definition at line 44 of file class.ilLDAPQuery.php.

$log

ilLDAPQuery::$log = null

private

Definition at line 50 of file class.ilLDAPQuery.php.

Referenced by getLogger().

$settings

ilLDAPQuery::$settings = null

private

Definition at line 45 of file class.ilLDAPQuery.php.

Referenced by getServer().

$user_fields

ilLDAPQuery::$user_fields = array()

private

Definition at line 52 of file class.ilLDAPQuery.php.

---

The documentation for this class was generated from the following file:

• Services/LDAP/classes/class.ilLDAPQuery.php