Collaboration diagram for ilLDAPRoleGroupMapping:

Public Member Functions
	getInfoStrings ($a_obj_id, $a_check_type=false)
	Get info string for object If check info type is enabled this function will check if the info string is visible in the repository. More...

	assign ($a_role_id, $a_usr_id)
	This method is typically called from class RbacAdmin::assignUser() It checks if there is a role mapping and if the user has auth mode LDAP After these checks the user is assigned to the LDAP group. More...

	deleteRole ($a_role_id)
	Delete role. More...

	deassign ($a_role_id, $a_usr_id)
	This method is typically called from class RbacAdmin::deassignUser() It checks if there is a role mapping and if the user has auth mode LDAP After these checks the user is deassigned from the LDAP group. More...

	deleteUser ($a_usr_id)
	Delete user => deassign from all ldap groups. More...

Static Public Member Functions
static	_getInstance ()
	Get singleton instance of this class. More...

Private Member Functions
	__construct ()
	Singleton contructor. More...

	initServers ()
	Check if there is any active server with. More...

	isHandledRole ($a_role_id)
	Check if a role is handled or not. More...

	isHandledUser ($a_usr_id)
	Check if user is ldap user. More...

	assignToGroup ($a_role_id, $a_usr_id)
	Assign user to group. More...

	deassignFromGroup ($a_role_id, $a_usr_id)
	Deassign user from group. More...

	checkOtherMembership ($a_usr_id, $a_role_id, $a_data)
	Check other membership. More...

	storeMembers ($a_mapping_id, $a_data)
	Store Members. More...

	readDN ($a_usr_id, $a_server_id)
	Read DN of user. More...

	getLDAPQueryInstance ($a_server_id, $a_url)
	Get LDAPQueryInstance. More...

Private Attributes
	$log = null

	$servers = null

	$mappings = array()

	$mapping_members = array()

	$query = array()

	$active_servers = false

	$users = []

Static Private Attributes
static	$instance = null

Detailed Description

Author: Stefan Meyer meyer.nosp@m.@lei.nosp@m.fos.c.nosp@m.om

Version: $Id$

Definition at line 34 of file class.ilLDAPRoleGroupMapping.php.

Constructor & Destructor Documentation

◆ __construct()

ilLDAPRoleGroupMapping::__construct ( )

private

Singleton contructor.

@access private

Definition at line 58 of file class.ilLDAPRoleGroupMapping.php.

    {
        global $DIC;
 
        $this->log = $DIC->logger()->auth();
        
        $this->initServers();
    }

References $DIC, and initServers().

Here is the call graph for this function:

Member Function Documentation

◆ _getInstance()

static ilLDAPRoleGroupMapping::_getInstance ( )

static

Get singleton instance of this class.

@access public

Definition at line 73 of file class.ilLDAPRoleGroupMapping.php.

    {
        if (is_object(self::$instance)) {
            return self::$instance;
        }
        return self::$instance = new ilLDAPRoleGroupMapping();
    }

References $instance.

Referenced by ilObjectListGUI\__construct(), ilRbacAdmin\assignUser(), ilRbacAdmin\assignUserLimited(), ilRbacAdmin\deassignUser(), ilObjUser\delete(), ilRbacAdmin\deleteRole(), and ilInfoScreenGUI\showLDAPRoleGroupMappingInfo().

Here is the caller graph for this function:

◆ assign()

ilLDAPRoleGroupMapping::assign	(	$a_role_id,
		$a_usr_id
	)

This method is typically called from class RbacAdmin::assignUser() It checks if there is a role mapping and if the user has auth mode LDAP After these checks the user is assigned to the LDAP group.

@access public

Parameters

Definition at line 117 of file class.ilLDAPRoleGroupMapping.php.

    {
        // return if there nothing to do
        if (!$this->active_servers) {
            return false;
        }
        
        if (!$this->isHandledRole($a_role_id)) {
            return false;
        }
        if (!$this->isHandledUser($a_usr_id)) {
            $this->log->info('LDAP assign: User ID: ' . $a_usr_id . ' has no LDAP account');
            return false;
        }
        $this->log->info('LDAP assigned: User ID: ' . $a_usr_id . ' Role Id: ' . $a_role_id);
        $this->assignToGroup($a_role_id, $a_usr_id);
 
        return true;
    }

References assignToGroup(), isHandledRole(), and isHandledUser().

Here is the call graph for this function:

◆ assignToGroup()

ilLDAPRoleGroupMapping::assignToGroup	(	$a_role_id,
		$a_usr_id
	)

private

Assign user to group.

@access private

Parameters

int	role_id
int	user_id

Definition at line 290 of file class.ilLDAPRoleGroupMapping.php.

    {
        foreach ($this->mappings[$a_role_id] as $data) {
            try {
                if ($data['isdn']) {
                    $external_account = $this->readDN($a_usr_id, $data['server_id']);
                } else {
                    $external_account = $this->users[$data['server_id']][$a_usr_id];
                }
                // Forcing modAdd since Active directory is too slow and i cannot check if a user is member or not.
                $query_obj = $this->getLDAPQueryInstance($data['server_id'], $data['url']);
                $query_obj->modAdd($data['dn'], array($data['member'] => $external_account));
                $this->log->info('LDAP assign: Assigned ' . $external_account . ' to group ' . $data['dn']);
            } catch (ilLDAPQueryException $exc) {
                $this->log->warning($exc->getMessage());
                // try next mapping
                continue;
            }
        }
    }

References $data, getLDAPQueryInstance(), and readDN().

Referenced by assign().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ checkOtherMembership()

ilLDAPRoleGroupMapping::checkOtherMembership	(	$a_usr_id,
		$a_role_id,
		$a_data
	)

private

Check other membership.

@access private

Returns: string role name

Definition at line 362 of file class.ilLDAPRoleGroupMapping.php.

    {
        global $DIC;
 
        $rbacreview = $DIC['rbacreview'];
        $ilObjDataCache = $DIC['ilObjDataCache'];
        
        foreach ($this->mappings as $role_id => $tmp_data) {
            foreach ($tmp_data as $data) {
                if ($role_id == $a_role_id) {
                    continue;
                }
                if ($data['server_id'] != $a_data['server_id']) {
                    continue;
                }
                if ($data['dn'] != $a_data['dn']) {
                    continue;
                }
                if ($rbacreview->isAssigned($a_usr_id, $role_id)) {
                    return $ilObjDataCache->lookupTitle($role_id);
                }
            }
        }
        return false;
    }

References $data, and $DIC.

Referenced by deassignFromGroup().

Here is the caller graph for this function:

◆ deassign()

ilLDAPRoleGroupMapping::deassign	(	$a_role_id,
		$a_usr_id
	)

This method is typically called from class RbacAdmin::deassignUser() It checks if there is a role mapping and if the user has auth mode LDAP After these checks the user is deassigned from the LDAP group.

@access public

Parameters

Definition at line 177 of file class.ilLDAPRoleGroupMapping.php.

    {
        // return if there notzing to do
        if (!$this->active_servers) {
            return false;
        }
        if (!$this->isHandledRole($a_role_id)) {
            return false;
        }
        if (!$this->isHandledUser($a_usr_id)) {
            return false;
        }
        $this->log->info('LDAP deassigned: User ID: ' . $a_usr_id . ' Role Id: ' . $a_role_id);
        $this->deassignFromGroup($a_role_id, $a_usr_id);
        
        return true;
    }

References deassignFromGroup(), isHandledRole(), and isHandledUser().

Referenced by deleteRole(), and deleteUser().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ deassignFromGroup()

ilLDAPRoleGroupMapping::deassignFromGroup	(	$a_role_id,
		$a_usr_id
	)

private

Deassign user from group.

@access private

Parameters

int	role_id
int	user_id

Definition at line 319 of file class.ilLDAPRoleGroupMapping.php.

    {
        foreach ($this->mappings[$a_role_id] as $data) {
            try {
                if ($data['isdn']) {
                    $external_account = $this->readDN($a_usr_id, $data['server_id']);
                } else {
                    $external_account = $this->users[$data['server_id']][$a_usr_id];
                }
                
                // Check for other role membership
                if ($role_id = $this->checkOtherMembership($a_usr_id, $a_role_id, $data)) {
                    $this->log->info('LDAP deassign: User is still assigned to role "' . $role_id . '".');
                    continue;
                }
                // Deassign user
                $query_obj = $this->getLDAPQueryInstance($data['server_id'], $data['url']);
                $query_obj->modDelete($data['dn'], array($data['member'] => $external_account));
                $this->log->info('LDAP deassign: Deassigned ' . $external_account . ' from group ' . $data['dn']);
                
                // Delete from cache
                if (is_array($this->mapping_members[$data['mapping_id']])) {
                    $key = array_search($external_account, $this->mapping_members[$data['mapping_id']]);
                    if ($key or $key === 0) {
                        unset($this->mapping_members[$data['mapping_id']]);
                    }
                }
            } catch (ilLDAPQueryException $exc) {
                $this->log->warning($exc->getMessage());
                // try next mapping
                continue;
            }
        }
    }

References $data, checkOtherMembership(), getLDAPQueryInstance(), and readDN().

Referenced by deassign().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ deleteRole()

ilLDAPRoleGroupMapping::deleteRole ( $a_role_id )

Delete role.

This function triggered from ilRbacAdmin::deleteRole It deassigns all user from the mapped ldap group.

@access public

Parameters

int role id

Definition at line 146 of file class.ilLDAPRoleGroupMapping.php.

    {
        global $DIC;
 
        $rbacreview = $DIC['rbacreview'];
        
        // return if there nothing to do
        if (!$this->active_servers) {
            return false;
        }
        
        if (!$this->isHandledRole($a_role_id)) {
            return false;
        }
        
        foreach ($rbacreview->assignedUsers($a_role_id) as $usr_id) {
            $this->deassign($a_role_id, $usr_id);
        }
        return true;
    }

References $DIC, deassign(), and isHandledRole().

Here is the call graph for this function:

◆ deleteUser()

ilLDAPRoleGroupMapping::deleteUser ( $a_usr_id )

Delete user => deassign from all ldap groups.

@access public

Parameters

int user id

Definition at line 201 of file class.ilLDAPRoleGroupMapping.php.

    {
        foreach ($this->mappings as $role_id => $data) {
            $this->deassign($role_id, $a_usr_id);
        }
        return true;
    }

References $data, and deassign().

Here is the call graph for this function:

◆ getInfoStrings()

ilLDAPRoleGroupMapping::getInfoStrings	(	$a_obj_id,
		$a_check_type = `false`
	)

Get info string for object If check info type is enabled this function will check if the info string is visible in the repository.

@access public

Parameters

int	object id
bool	check info type

Definition at line 90 of file class.ilLDAPRoleGroupMapping.php.

    {
        if (!$this->active_servers) {
            return false;
        }
        if ($a_check_type) {
            if (isset($this->mapping_info_strict[$a_obj_id]) and is_array($this->mapping_info_strict[$a_obj_id])) {
                return $this->mapping_info_strict[$a_obj_id];
            }
        } else {
            if (isset($this->mapping_info[$a_obj_id]) and is_array($this->mapping_info[$a_obj_id])) {
                return $this->mapping_info[$a_obj_id];
            }
        }
        return false;
    }

◆ getLDAPQueryInstance()

ilLDAPRoleGroupMapping::getLDAPQueryInstance	(	$a_server_id,
		$a_url
	)

private

Get LDAPQueryInstance.

@access private

Parameters

throws ilLDAPQueryException

Definition at line 477 of file class.ilLDAPRoleGroupMapping.php.

    {
        include_once 'Services/LDAP/classes/class.ilLDAPQuery.php';
 
        if (array_key_exists($a_server_id, $this->query) and
            array_key_exists($a_url, $this->query[$a_server_id]) and
            is_object($this->query[$a_server_id][$a_url])) {
            return $this->query[$a_server_id][$a_url];
        }
        try {
            $tmp_query = new ilLDAPQuery($this->servers[$a_server_id], $a_url);
            $tmp_query->bind(IL_LDAP_BIND_ADMIN);
        } catch (ilLDAPQueryException $exc) {
            throw $exc;
        }
        return $this->query[$a_server_id][$a_url] = $tmp_query;
    }

References IL_LDAP_BIND_ADMIN.

Referenced by assignToGroup(), deassignFromGroup(), and readDN().

Here is the caller graph for this function:

◆ initServers()

ilLDAPRoleGroupMapping::initServers ( )

private

Check if there is any active server with.

@access private

Parameters

Definition at line 217 of file class.ilLDAPRoleGroupMapping.php.

    {
        $server_ids = ilLDAPServer::_getRoleSyncServerIds();
        
        if (!count($server_ids)) {
            return false;
        }
        
        // Init servers
        include_once('Services/LDAP/classes/class.ilLDAPRoleGroupMappingSettings.php');
        
        $this->active_servers = true;
        $this->mappings = array();
        $this->users = [];
        foreach ($server_ids as $server_id) {
            $this->servers[$server_id] = new ilLDAPServer($server_id);
            $this->mappings = ilLDAPRoleGroupMappingSettings::_getAllActiveMappings();
            $this->users[$server_id] = ilObjUser::_getExternalAccountsByAuthMode(
                'ldap_' . $server_id,
                true
            );
        }
        $this->mapping_info = array();
        $this->mapping_info_strict = array();
        foreach ($this->mappings as $mapping) {
            foreach ($mapping as $key => $data) {
                if (strlen($data['info']) and $data['object_id']) {
                    $this->mapping_info[$data['object_id']][] = $data['info'];
                }
                if (strlen($data['info']) && ($data['info_type'] == ilLDAPRoleGroupMappingSettings::MAPPING_INFO_ALL)) {
                    $this->mapping_info_strict[$data['object_id']][] = $data['info'];
                }
            }
        }
        return true;
    }

References $data, ilLDAPRoleGroupMappingSettings\_getAllActiveMappings(), ilObjUser\_getExternalAccountsByAuthMode(), ilLDAPServer\_getRoleSyncServerIds(), and ilLDAPRoleGroupMappingSettings\MAPPING_INFO_ALL.

Referenced by __construct().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ isHandledRole()

ilLDAPRoleGroupMapping::isHandledRole ( $a_role_id )

private

Check if a role is handled or not.

@access private

Parameters

int role_id

Returns: int server id or 0 if mapping exists

Definition at line 262 of file class.ilLDAPRoleGroupMapping.php.

    {
        return array_key_exists($a_role_id, $this->mappings);
    }

Referenced by assign(), deassign(), and deleteRole().

Here is the caller graph for this function:

◆ isHandledUser()

ilLDAPRoleGroupMapping::isHandledUser ( $a_usr_id )

private

Check if user is ldap user.

@access private

Definition at line 272 of file class.ilLDAPRoleGroupMapping.php.

    {
        foreach ($this->users as $server_id => $users) {
            if (array_key_exists($a_usr_id, $users)) {
                return true;
            }
        }
        return false;
    }

References $users.

Referenced by assign(), and deassign().

Here is the caller graph for this function:

◆ readDN()

ilLDAPRoleGroupMapping::readDN	(	$a_usr_id,
		$a_server_id
	)

private

Read DN of user.

@access private

Parameters

int	user id
int	server id

Exceptions

ilLDAPQueryException

Definition at line 421 of file class.ilLDAPRoleGroupMapping.php.

    {
        if (isset($this->user_dns[$a_usr_id])) {
            return $this->user_dns[$a_usr_id];
        }
        
        $external_account = $this->users[$a_server_id][$a_usr_id];
        
        try {
            $server = $this->servers[$a_server_id];
            $query_obj = $this->getLDAPQueryInstance($a_server_id, $server->getUrl());
                        
            if ($search_base = $server->getSearchBase()) {
                $search_base .= ',';
            }
            $search_base .= $server->getBaseDN();
            
            // try optional group user filter first
            if ($server->isMembershipOptional() and $server->getGroupUserFilter()) {
                $userFilter = $server->getGroupUserFilter();
            } else {
                $userFilter = $server->getFilter();
            }
 
            $filter = sprintf(
                '(&(%s=%s)%s)',
                $server->getUserAttribute(),
                $external_account,
                $userFilter
            );
 
            $res = $query_obj->query($search_base, $filter, $server->getUserScope(), array('dn'));
            
            if (!$res->numRows()) {
                include_once('Services/LDAP/classes/class.ilLDAPQueryException.php');
                throw new ilLDAPQueryException(__METHOD__ . ' cannot find dn for user ' . $external_account);
            }
            if ($res->numRows() > 1) {
                include_once('Services/LDAP/classes/class.ilLDAPQueryException.php');
                throw new ilLDAPQueryException(__METHOD__ . ' found multiple distinguished name for: ' . $external_account);
            }
            
            $data = $res->get();
            return $this->user_dns[$a_usr_id] = $data['dn'];
        } catch (ilLDAPQueryException $exc) {
            throw $exc;
        }
    }

References $data, $res, $server, and getLDAPQueryInstance().

Referenced by assignToGroup(), and deassignFromGroup().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ storeMembers()

ilLDAPRoleGroupMapping::storeMembers	(	$a_mapping_id,
		$a_data
	)

private

Store Members.

@access private

Definition at line 394 of file class.ilLDAPRoleGroupMapping.php.

    {
        $this->mapping_members[$a_mapping_id] = array();
        foreach ($a_data as $field => $value) {
            if (strtolower($field) == 'dn') {
                continue;
            }
            
            if (!is_array($value)) {
                $this->mapping_members[$a_mapping_id][] = $value;
                continue;
            }
            foreach ($value as $external_account) {
                $this->mapping_members[$a_mapping_id][] = $external_account;
            }
        }
        return true;
    }

Field Documentation

◆ $active_servers

ilLDAPRoleGroupMapping::$active_servers = false

private

Definition at line 45 of file class.ilLDAPRoleGroupMapping.php.

◆ $instance

ilLDAPRoleGroupMapping::$instance = null

staticprivate

Definition at line 40 of file class.ilLDAPRoleGroupMapping.php.

Referenced by _getInstance().

◆ $log

ilLDAPRoleGroupMapping::$log = null

private

Definition at line 39 of file class.ilLDAPRoleGroupMapping.php.

◆ $mapping_members

ilLDAPRoleGroupMapping::$mapping_members = array()

private

Definition at line 43 of file class.ilLDAPRoleGroupMapping.php.

◆ $mappings

ilLDAPRoleGroupMapping::$mappings = array()

private

Definition at line 42 of file class.ilLDAPRoleGroupMapping.php.

◆ $query

ilLDAPRoleGroupMapping::$query = array()

private

Definition at line 44 of file class.ilLDAPRoleGroupMapping.php.

◆ $servers

ilLDAPRoleGroupMapping::$servers = null

private

Definition at line 41 of file class.ilLDAPRoleGroupMapping.php.

◆ $users

ilLDAPRoleGroupMapping::$users = []

private

Definition at line 50 of file class.ilLDAPRoleGroupMapping.php.

Referenced by isHandledUser().

The documentation for this class was generated from the following file:

Services/LDAP/classes/class.ilLDAPRoleGroupMapping.php

Public Member Functions

Static Public Member Functions

Private Member Functions

Private Attributes

Static Private Attributes

Detailed Description

Constructor & Destructor Documentation

◆ __construct()

Member Function Documentation

◆ _getInstance()

◆ assign()

◆ assignToGroup()

◆ checkOtherMembership()

◆ deassign()

◆ deassignFromGroup()

◆ deleteRole()

◆ deleteUser()

◆ getInfoStrings()

◆ getLDAPQueryInstance()

◆ initServers()

◆ isHandledRole()

◆ isHandledUser()

◆ readDN()

◆ storeMembers()

Field Documentation

◆ $active_servers

◆ $instance

◆ $log

◆ $mapping_members

◆ $mappings

◆ $query

◆ $servers

◆ $users