ilLDAPQuery Class Reference

Collaboration diagram for ilLDAPQuery:

Public Member Functions
	__construct (ilLDAPServer $a_server, $a_url='')
	Constructur. More...
	getServer ()
	Get server. More...
	getLogger ()
	Get logger. More...
	fetchUser ($a_name)
	Get one user by login name. More...
	fetchUsers ()
	Fetch all users. More...
	query ($a_search_base, $a_filter, $a_scope, $a_attributes)
	Perform a query. More...
	modAdd ($a_dn, $a_attribute)
	Add value to an existing attribute. More...
	modDelete ($a_dn, $a_attribute)
	Delete value from an existing attribute. More...
	checkGroupMembership ($a_ldap_user_name, $ldap_user_data)
	check group membership More...
	bind ($a_binding_type=IL_LDAP_BIND_DEFAULT, $a_user_dn='', $a_password='')
	Bind to LDAP server. More...
	__destruct ()
	Destructor unbind from ldap server. More...

Private Member Functions
	readAllUsers ()
	Fetch all users This function splits the query to filters like e.g (uid=a*) (uid=b*)... This avoids AD page_size_limit. More...
	fetchGroupMembers ($a_name='')
	Fetch group member ids. More...
	readUserData ($a_name, $a_check_dn=false, $a_try_group_user_filter=false)
	Read user data. More...
	parseAuthMode ()
	Parse authentication mode. More...
	queryByScope ($a_scope, $a_base_dn, $a_filter, $a_attributes)
	Query by scope IL_SCOPE_SUB => ldap_search IL_SCOPE_ONE => ldap_list. More...
	connect ()
	Connect to LDAP server. More...
	fetchUserProfileFields ()
	fetch required fields of user profile data More...
	unbind ()
	Unbind. More...

Private Attributes
	$ldap_server_url = null
	$settings = null
	$log = null
	$user_fields = array()

Detailed Description

Author

Stefan Meyer meyer.nosp@m.@lei.nosp@m.fos.c.nosp@m.om

Version

$Id$

@ilCtrl_Calls

Definition at line 42 of file class.ilLDAPQuery.php.

Constructor & Destructor Documentation

__construct()

ilLDAPQuery::__construct	(	ilLDAPServer	$a_server,
			$a_url = ''
	)

Constructur.

@access private

Parameters

object

ilLDAPServer or subclass

Exceptions

ilLDAPQueryException

Definition at line 62 of file class.ilLDAPQuery.php.

    {
        $this->settings = $a_server;
        
        if (strlen($a_url)) {
            $this->ldap_server_url = $a_url;
        } else {
            $this->ldap_server_url = $this->settings->getUrl();
        }
        
        $this->mapping = ilLDAPAttributeMapping::_getInstanceByServerId($this->settings->getServerId());
        $this->log = $GLOBALS['DIC']->logger()->auth();
        
        $this->fetchUserProfileFields();
        $this->connect();
    }

References $GLOBALS, ilLDAPAttributeMapping\_getInstanceByServerId(), connect(), fetchUserProfileFields(), and settings().

Here is the call graph for this function:

__destruct()

ilLDAPQuery::__destruct

(

)

Destructor unbind from ldap server.

@access private

Parameters

Definition at line 667 of file class.ilLDAPQuery.php.

    {
        if ($this->lh) {
            @ldap_unbind($this->lh);
        }
    }

Member Function Documentation

bind()

ilLDAPQuery::bind	(		$a_binding_type = IL_LDAP_BIND_DEFAULT,
			$a_user_dn = '',
			$a_password = ''
	)

Bind to LDAP server.

@access public

Parameters

int	binding_type IL_LDAP_BIND_DEFAULT || IL_LDAP_BIND_ADMIN

Exceptions

ilLDAPQueryException

on connection failure.

Definition at line 569 of file class.ilLDAPQuery.php.

    {
        switch ($a_binding_type) {
            case IL_LDAP_BIND_TEST:
                ldap_set_option($this->lh, LDAP_OPT_NETWORK_TIMEOUT, ilLDAPServer::DEFAULT_NETWORK_TIMEOUT);
                // fall through
                // no break
            case IL_LDAP_BIND_DEFAULT:
                // Now bind anonymously or as user
                if (
                    IL_LDAP_BIND_USER == $this->settings->getBindingType() &&
                    strlen($this->settings->getBindUser())
                ) {
                    $user = $this->settings->getBindUser();
                    $pass = $this->settings->getBindPassword();
 
                    define('IL_LDAP_REBIND_USER', $user);
                    define('IL_LDAP_REBIND_PASS', $pass);
                    $this->log->debug('Bind as ' . $user);
                } else {
                    $user = $pass = '';
                    $this->log->debug('Bind anonymous');
                }
                break;
                
            case IL_LDAP_BIND_ADMIN:
                $user = $this->settings->getRoleBindDN();
                $pass = $this->settings->getRoleBindPassword();
                
                if (!strlen($user) or !strlen($pass)) {
                    $user = $this->settings->getBindUser();
                    $pass = $this->settings->getBindPassword();
                }
 
                define('IL_LDAP_REBIND_USER', $user);
                define('IL_LDAP_REBIND_PASS', $pass);
                break;
                
            case IL_LDAP_BIND_AUTH:
                $this->log->debug('Trying to bind as: ' . $a_user_dn);
                $user = $a_user_dn;
                $pass = $a_password;
                break;
                
                
            default:
                throw new ilLDAPQueryException('LDAP: unknown binding type in: ' . __METHOD__);
        }
        
        if (!@ldap_bind($this->lh, $user, $pass)) {
            throw new ilLDAPQueryException('LDAP: Cannot bind as ' . $user . ' with message: ' . ldap_err2str(ldap_errno($this->lh)) . ' Trying fallback...', ldap_errno($this->lh));
        } else {
            $this->log->debug('Bind successful.');
        }
    }

References $pass, $user, ilLDAPServer\DEFAULT_NETWORK_TIMEOUT, IL_LDAP_BIND_ADMIN, IL_LDAP_BIND_AUTH, IL_LDAP_BIND_DEFAULT, IL_LDAP_BIND_TEST, IL_LDAP_BIND_USER, and settings().

Here is the call graph for this function:

checkGroupMembership()

ilLDAPQuery::checkGroupMembership	(		$a_ldap_user_name,
			$ldap_user_data
	)

check group membership

Parameters

string	login name
array	user data

Returns

bool

Definition at line 272 of file class.ilLDAPQuery.php.

    {
        $group_names = $this->getServer()->getGroupNames();
        
        if (!count($group_names)) {
            $this->getLogger()->debug('No LDAP group restrictions found');
            return true;
        }
        
        $group_dn = $this->getServer()->getGroupDN();
        if (
            $group_dn &&
            (substr($group_dn, -1) != ',')
        ) {
            $group_dn .= ',';
        }
        $group_dn .= $this->getServer()->getBaseDN();
        
        foreach ($group_names as $group) {
            $user = $a_ldap_user_name;
            if ($this->getServer()->enabledGroupMemberIsDN()) {
                if ($this->getServer()->enabledEscapeDN()) {
                    $user = ldap_escape($ldap_user_data['dn'], "", LDAP_ESCAPE_FILTER);
                } else {
                    $user = $ldap_user_data['dn'];
                }
            }
            
            $filter = sprintf(
                '(&(%s=%s)(%s=%s)%s)',
                $this->getServer()->getGroupAttribute(),
                $group,
                $this->getServer()->getGroupMember(),
                $user,
                $this->getServer()->getGroupFilter()
            );
            $this->getLogger()->debug('Current group search base: ' . $group_dn);
            $this->getLogger()->debug('Current group filter: ' . $filter);
            
            $res = $this->queryByScope(
                $this->getServer()->getGroupScope(),
                $group_dn,
                $filter,
                [$this->getServer()->getGroupMember()]
            );
            
            $this->getLogger()->dump($res);
            
            $tmp_result = new ilLDAPResult($this->lh, $res);
            $group_result = $tmp_result->getRows();
            
            $this->getLogger()->debug('Group query returned: ');
            $this->getLogger()->dump($group_result, ilLogLevel::DEBUG);
            
            if (count($group_result)) {
                return true;
            }
        }
        
        // group restrictions failed check optional membership
        if ($this->getServer()->isMembershipOptional()) {
            $this->getLogger()->debug('Group restrictions failed, checking user filter.');
            if ($this->readUserData($a_ldap_user_name, true, true)) {
                $this->getLogger()->debug('User filter matches.');
                return true;
            }
        }
        $this->getLogger()->debug('Group restrictions failed.');
        return false;
    }

References $res, $user, ilLogLevel\DEBUG, getLogger(), getServer(), queryByScope(), and readUserData().

Here is the call graph for this function:

connect()

ilLDAPQuery::connect ( )

private

Connect to LDAP server.

@access private

Exceptions

ilLDAPQueryException

Definition at line 531 of file class.ilLDAPQuery.php.

    {
        $this->lh = @ldap_connect($this->ldap_server_url);
        
        // LDAP Connect
        if (!$this->lh) {
            throw new ilLDAPQueryException("LDAP: Cannot connect to LDAP Server: " . $this->settings->getUrl());
        }
        // LDAP Version
        if (!ldap_set_option($this->lh, LDAP_OPT_PROTOCOL_VERSION, $this->settings->getVersion())) {
            throw new ilLDAPQueryException("LDAP: Cannot set version to: " . $this->settings->getVersion());
        }
        // Switch on referrals
        if ($this->settings->isActiveReferrer()) {
            if (!ldap_set_option($this->lh, LDAP_OPT_REFERRALS, true)) {
                throw new ilLDAPQueryException("LDAP: Cannot switch on LDAP referrals");
            }
            #@ldap_set_rebind_proc($this->lh,'referralRebind');
        } else {
            ldap_set_option($this->lh, LDAP_OPT_REFERRALS, false);
            $this->log->debug('Switching referrals to false.');
        }
        // Start TLS
        if ($this->settings->isActiveTLS()) {
            if (!ldap_start_tls($this->lh)) {
                throw new ilLDAPQueryException("LDAP: Cannot start LDAP TLS");
            }
        }
    }

References settings().

Referenced by __construct().

Here is the call graph for this function:

Here is the caller graph for this function:

fetchGroupMembers()

ilLDAPQuery::fetchGroupMembers (   $a_name = '' )

private

Fetch group member ids.

@access public

Definition at line 350 of file class.ilLDAPQuery.php.

    {
        $group_name = strlen($a_name) ? $a_name : $this->settings->getGroupName();
        
        // Build filter
        $filter = sprintf(
            '(&(%s=%s)%s)',
            $this->settings->getGroupAttribute(),
            $group_name,
            $this->settings->getGroupFilter()
        );
        
        
        // Build search base
        if (($gdn = $this->settings->getGroupDN()) && substr($gdn, -1) != ',') {
            $gdn .= ',';
        }
        $gdn .= $this->settings->getBaseDN();
        
        $this->log->debug('Using filter ' . $filter);
        $this->log->debug('Using DN ' . $gdn);
        $res = $this->queryByScope(
            $this->settings->getGroupScope(),
            $gdn,
            $filter,
            array($this->settings->getGroupMember())
        );
            
        $tmp_result = new ilLDAPResult($this->lh, $res);
        $group_data = $tmp_result->getRows();
        
        
        if (!$tmp_result->numRows()) {
            $this->log->info('No group found.');
            return false;
        }
                
        $attribute_name = strtolower($this->settings->getGroupMember());
        
        // All groups
        foreach ($group_data as $data) {
            if (is_array($data[$attribute_name])) {
                    $this->log->debug('Found ' . count($data[$attribute_name]) . ' group members for group ' . $data['dn']);
                foreach ($data[$attribute_name] as $name) {
                    $this->readUserData($name, true, true);
                }
            } else {
                $this->readUserData($data[$attribute_name], true, true);
            }
        }
        unset($tmp_result);
        return;
    }

References $data, $name, $res, queryByScope(), readUserData(), and settings().

Referenced by fetchUsers().

Here is the call graph for this function:

Here is the caller graph for this function:

fetchUser()

ilLDAPQuery::fetchUser

(

$a_name

)

Get one user by login name.

@access public

Parameters

string

login name

Returns

array of user data

Definition at line 105 of file class.ilLDAPQuery.php.

    {
        if (!$this->readUserData($a_name)) {
            return array();
        } else {
            return $this->users;
        }
    }

References $users, and readUserData().

Here is the call graph for this function:

fetchUserProfileFields()

ilLDAPQuery::fetchUserProfileFields ( )

private

fetch required fields of user profile data

@access private

Parameters

Definition at line 632 of file class.ilLDAPQuery.php.

    {
        include_once('Services/LDAP/classes/class.ilLDAPRoleAssignmentRules.php');
        
        $this->user_fields = array_merge(
            array($this->settings->getUserAttribute()),
            array('dn'),
            $this->mapping->getFields(),
            ilLDAPRoleAssignmentRules::getAttributeNames($this->getServer()->getServerId())
        );
    }

References ilLDAPRoleAssignmentRules\getAttributeNames(), and settings().

Referenced by __construct().

Here is the call graph for this function:

Here is the caller graph for this function:

fetchUsers()

ilLDAPQuery::fetchUsers

(

)

Fetch all users.

@access public

Returns

array array of user data

Definition at line 121 of file class.ilLDAPQuery.php.

    {
        // First of all check if a group restriction is enabled
        // YES: => fetch all group members
        // No:  => fetch all users
        if (strlen($this->settings->getGroupName())) {
            $this->log->debug('Searching for group members.');
 
            $groups = $this->settings->getGroupNames();
            if (count($groups) <= 1) {
                $this->fetchGroupMembers();
            } else {
                foreach ($groups as $group) {
                    $this->fetchGroupMembers($group);
                }
            }
        }
        if (!strlen($this->settings->getGroupName()) or $this->settings->isMembershipOptional()) {
            $this->log->info('Start reading all users...');
            $this->readAllUsers();
            #throw new ilLDAPQueryException('LDAP: Called import of users without specifying group restrictions. NOT IMPLEMENTED YET!');
        }
        return $this->users ? $this->users : array();
    }

References fetchGroupMembers(), readAllUsers(), and settings().

Here is the call graph for this function:

getLogger()

ilLDAPQuery::getLogger

(

)

Get logger.

Returns

ilLogger

Definition at line 93 of file class.ilLDAPQuery.php.

    {
        return $this->log;
    }

References $log.

Referenced by checkGroupMembership(), and queryByScope().

Here is the caller graph for this function:

getServer()

ilLDAPQuery::getServer

(

)

Get server.

Returns

ilLDAPServer

Definition at line 84 of file class.ilLDAPQuery.php.

    {
        return $this->settings;
    }

References $settings.

Referenced by checkGroupMembership().

Here is the caller graph for this function:

modAdd()

ilLDAPQuery::modAdd	(		$a_dn,
			$a_attribute
	)

Add value to an existing attribute.

@access public

Exceptions

ilLDAPQueryException

Definition at line 178 of file class.ilLDAPQuery.php.

    {
        if (@ldap_mod_add($this->lh, $a_dn, $a_attribute)) {
            return true;
        }
        throw new ilLDAPQueryException(__METHOD__ . ' ' . ldap_error($this->lh));
    }

modDelete()

ilLDAPQuery::modDelete	(		$a_dn,
			$a_attribute
	)

Delete value from an existing attribute.

@access public

Exceptions

ilLDAPQueryException

Definition at line 192 of file class.ilLDAPQuery.php.

    {
        if (@ldap_mod_del($this->lh, $a_dn, $a_attribute)) {
            return true;
        }
        throw new ilLDAPQueryException(__METHOD__ . ' ' . ldap_error($this->lh));
    }

parseAuthMode()

ilLDAPQuery::parseAuthMode ( )

private

Parse authentication mode.

Returns

string auth mode

Definition at line 478 of file class.ilLDAPQuery.php.

    {
        return $this->settings->getAuthenticationMappingKey();
    }

References settings().

Here is the call graph for this function:

query()

ilLDAPQuery::query	(		$a_search_base,
			$a_filter,
			$a_scope,
			$a_attributes
	)

Perform a query.

@access public

Parameters

string	search base
string	filter
int	scope
array	attributes

Returns

object ilLDAPResult

Exceptions

ilLDAPQueryException

Definition at line 157 of file class.ilLDAPQuery.php.

    {
        $res = $this->queryByScope($a_scope, $a_search_base, $a_filter, $a_attributes);
        if ($res === false) {
            throw new ilLDAPQueryException(__METHOD__ . ' ' . ldap_error($this->lh) . ' ' .
                sprintf(
                    'DN: %s, Filter: %s, Scope: %s',
                    $a_search_base,
                    $a_filter,
                    $a_scope
                ));
        }
        return new ilLDAPResult($this->lh, $res);
    }

References $res, and queryByScope().

Here is the call graph for this function:

queryByScope()

ilLDAPQuery::queryByScope (   $a_scope,   $a_base_dn,   $a_filter,   $a_attributes  )

private

Query by scope IL_SCOPE_SUB => ldap_search IL_SCOPE_ONE => ldap_list.

@access private

Parameters

Definition at line 492 of file class.ilLDAPQuery.php.

    {
        $a_filter = $a_filter ? $a_filter : "(objectclass=*)";
 
        switch ($a_scope) {
            case IL_LDAP_SCOPE_SUB:
                $res = @ldap_search($this->lh, $a_base_dn, $a_filter, $a_attributes);
                break;
                
            case IL_LDAP_SCOPE_ONE:
                $res = @ldap_list($this->lh, $a_base_dn, $a_filter, $a_attributes);
                break;
            
            case IL_LDAP_SCOPE_BASE:
 
                $res = @ldap_read($this->lh, $a_base_dn, $a_filter, $a_attributes);
                break;
 
            default:
                $this->log->warning("LDAP: LDAPQuery: Unknown search scope");
        }
        
        $error = ldap_error($this->lh);
        if (strcmp('Success', $error) !== 0) {
            $this->getLogger()->warning($error);
            $this->getLogger()->warning('Base DN:' . $a_base_dn);
            $this->getLogger()->warning('Filter: ' . $a_filter);
        }
        
        return $res;
    }

References $res, getLogger(), IL_LDAP_SCOPE_BASE, IL_LDAP_SCOPE_ONE, and IL_LDAP_SCOPE_SUB.

Referenced by checkGroupMembership(), fetchGroupMembers(), query(), readAllUsers(), and readUserData().

Here is the call graph for this function:

Here is the caller graph for this function:

readAllUsers()

ilLDAPQuery::readAllUsers ( )

private

Fetch all users This function splits the query to filters like e.g (uid=a*) (uid=b*)... This avoids AD page_size_limit.

@access public

Definition at line 208 of file class.ilLDAPQuery.php.

    {
        // Build search base
        if (($dn = $this->settings->getSearchBase()) && substr($dn, -1) != ',') {
            $dn .= ',';
        }
        $dn .= $this->settings->getBaseDN();
        
        // page results
        $filter = $this->settings->getFilter();
        $page_filter = array('a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z','-');
        $chars = array('a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z');
        
        foreach ($page_filter as $letter) {
            $new_filter = '(&';
            $new_filter .= $filter;
            
            switch ($letter) {
                case '-':
                    $new_filter .= ('(!(|');
                    foreach ($chars as $char) {
                        $new_filter .= ('(' . $this->settings->getUserAttribute() . '=' . $char . '*)');
                    }
                    $new_filter .= ')))';
                    break;
 
                default:
                    $new_filter .= ('(' . $this->settings->getUserAttribute() . '=' . $letter . '*))');
                    break;
            }
 
            $this->log->info('Searching with ldap search and filter ' . $new_filter . ' in ' . $dn);
            $res = $this->queryByScope(
                $this->settings->getUserScope(),
                $dn,
                $new_filter,
                array($this->settings->getUserAttribute())
            );
 
            $tmp_result = new ilLDAPResult($this->lh, $res);
            if (!$tmp_result->numRows()) {
                $this->log->notice('No users found. Aborting.');
                continue;
            }
            $this->log->info('Found ' . $tmp_result->numRows() . ' users.');
            $attribute = strtolower($this->settings->getUserAttribute());
            foreach ($tmp_result->getRows() as $data) {
                if (isset($data[$attribute])) {
                    $this->readUserData($data[$attribute], false, false);
                } else {
                    $this->log->warning('Unknown error. No user attribute found.');
                }
            }
            unset($tmp_result);
        }
        return true;
    }

References $data, $res, queryByScope(), readUserData(), and settings().

Referenced by fetchUsers().

Here is the call graph for this function:

Here is the caller graph for this function:

readUserData()

ilLDAPQuery::readUserData (   $a_name,   $a_check_dn = false,   $a_try_group_user_filter = false  )

private

Read user data.

Parameters

bool	check dn
bool	use group filter @access private

Definition at line 410 of file class.ilLDAPQuery.php.

    {
        $filter = $this->settings->getFilter();
        if ($a_try_group_user_filter) {
            if ($this->settings->isMembershipOptional()) {
                $filter = $this->settings->getGroupUserFilter();
            }
        }
        
        // Build filter
        if ($this->settings->enabledGroupMemberIsDN() and $a_check_dn) {
            $dn = $a_name;
            #$res = $this->queryByScope(IL_LDAP_SCOPE_BASE,$dn,$filter,$this->user_fields);
 
            $fields = array_merge($this->user_fields, array('useraccountcontrol'));
            $res = $this->queryByScope(IL_LDAP_SCOPE_BASE, strtolower($dn), $filter, $fields);
        } else {
            $filter = sprintf(
                '(&(%s=%s)%s)',
                $this->settings->getUserAttribute(),
                $a_name,
                $filter
            );
 
            // Build search base
            if (($dn = $this->settings->getSearchBase()) && substr($dn, -1) != ',') {
                $dn .= ',';
            }
            $dn .= $this->settings->getBaseDN();
            $fields = array_merge($this->user_fields, array('useraccountcontrol'));
            $res = $this->queryByScope($this->settings->getUserScope(), strtolower($dn), $filter, $fields);
        }
        
        
        $tmp_result = new ilLDAPResult($this->lh, $res);
        if (!$tmp_result->numRows()) {
            $this->log->info('LDAP: No user data found for: ' . $a_name);
            unset($tmp_result);
            return false;
        }
        
        if ($user_data = $tmp_result->get()) {
            if (isset($user_data['useraccountcontrol'])) {
                if (($user_data['useraccountcontrol'] & 0x02)) {
                    $this->log->notice('LDAP: ' . $a_name . ' account disabled.');
                    return;
                }
            }
            
            $account = $user_data[strtolower($this->settings->getUserAttribute())];
            if (is_array($account)) {
                $user_ext = strtolower(array_shift($account));
            } else {
                $user_ext = strtolower($account);
            }
            
            // auth mode depends on ldap server settings
            $auth_mode = $this->settings->getAuthenticationMappingKey();
            $user_data['ilInternalAccount'] = ilObjUser::_checkExternalAuthAccount($auth_mode, $user_ext);
            $this->users[$user_ext] = $user_data;
        }
        return true;
    }

References $res, ilObjUser\_checkExternalAuthAccount(), IL_LDAP_SCOPE_BASE, queryByScope(), and settings().

Referenced by checkGroupMembership(), fetchGroupMembers(), fetchUser(), and readAllUsers().

Here is the call graph for this function:

Here is the caller graph for this function:

unbind()

ilLDAPQuery::unbind ( )

private

Unbind.

@access private

Parameters

Definition at line 652 of file class.ilLDAPQuery.php.

    {
        if ($this->lh) {
            @ldap_unbind($this->lh);
        }
    }

Field Documentation

$ldap_server_url

ilLDAPQuery::$ldap_server_url = null

private

Definition at line 44 of file class.ilLDAPQuery.php.

$log

ilLDAPQuery::$log = null

private

Definition at line 50 of file class.ilLDAPQuery.php.

Referenced by getLogger().

$settings

ilLDAPQuery::$settings = null

private

Definition at line 45 of file class.ilLDAPQuery.php.

Referenced by getServer().

$user_fields

ilLDAPQuery::$user_fields = array()

private

Definition at line 52 of file class.ilLDAPQuery.php.

---

The documentation for this class was generated from the following file:

• Services/LDAP/classes/class.ilLDAPQuery.php