LDAPAccountManager/lam/lib/modules/sambaGroupMapping.inc

532 lines
18 KiB
PHP
Raw Normal View History

<?php
/*
$Id$
2009-10-27 18:47:12 +00:00
This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
2006-03-03 17:30:35 +00:00
Copyright (C) 2003 - 2006 Tilo Lutz
2008-12-18 14:58:05 +00:00
2007 - 2008 Roland Gruber
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
2005-07-21 10:33:02 +00:00
/**
* Manages Samba 3 accounts for groups.
*
* @package modules
*
* @author Tilo Lutz
* @author Roland Gruber
* @author Michael Duergner
*/
/**
* Manages the object class "sambaGroupMapping" for groups.
*
* @package modules
*/
class sambaGroupMapping extends baseModule {
2004-06-13 19:58:58 +00:00
// Variables
/** Array of well known RIDs */
2007-10-13 17:28:37 +00:00
private $rids;
2004-10-09 14:15:56 +00:00
/** Array of sambaGroupTypes */
2007-10-13 17:28:37 +00:00
private $sambaGroupTypes;
2006-08-14 17:24:27 +00:00
2004-09-25 10:13:32 +00:00
/**
* Creates a new module for Samba 3 groups.
*
* @param string $scope account type
*/
2007-12-28 16:08:56 +00:00
function __construct($scope) {
2004-09-25 10:13:32 +00:00
// load error messages
2004-09-26 11:18:05 +00:00
$this->rids = array(
2006-10-22 07:45:58 +00:00
_('Domain admins') => 512,
_('Domain users') => 513,
_('Domain guests') => 514,
_('Domain computers') => 515,
_('Domain controllers') => 516,
_('Domain certificate admins') => 517,
_('Domain schema admins') => 518,
_('Domain enterprise admins') => 519,
_('Domain policy admins') => 520);
2004-09-26 11:18:05 +00:00
2004-10-09 14:15:56 +00:00
$this->sambaGroupTypes = array (
_('User') => 1,
2006-10-22 07:45:58 +00:00
_('Domain group') => 2,
2004-10-09 14:15:56 +00:00
_('Domain') => 3,
2006-10-22 07:45:58 +00:00
_('Local group') => 4,
_('Builtin group') => 5,
_('Deleted account') => 6,
_('Invalid account') => 7
2004-10-09 14:15:56 +00:00
);
2004-09-25 10:13:32 +00:00
// call parent constructor
2007-12-28 16:08:56 +00:00
parent::__construct($scope);
2007-11-18 11:16:03 +00:00
$this->autoAddObjectClasses = false;
2004-09-25 10:13:32 +00:00
}
/**
* Initializes the module after it became part of an accountContainer
*
* @param string $base the name of the accountContainer object ($_SESSION[$base])
*/
function init($base) {
// call parent init
parent::init($base);
2006-01-01 16:30:05 +00:00
$sambaDomains = search_domains();
if (sizeof($sambaDomains) == 0) {
StatusMessage("ERROR", _('No Samba 3 domains found in LDAP! Please create one first.'), '');
return;
}
}
2008-12-18 12:21:07 +00:00
/**
* Gets the GID number from the Unix group module.
*
* @return String GID number
*/
private function getGID() {
$modules = array('posixGroup', 'rfc2307bisPosixGroup');
for ($i = 0; $i < sizeof($modules); $i++) {
if ($this->getAccountContainer()->getAccountModule($modules[$i]) != null) {
$attrs = $this->getAccountContainer()->getAccountModule($modules[$i])->getAttributes();
if (isset($attrs['gidNumber'][0])) {
return $attrs['gidNumber'][0];
}
}
}
return null;
}
/**
* Gets the cn from the Unix group module.
*
* @return String cn attribute
*/
private function getCn() {
$modules = array('posixGroup', 'groupOfNames', 'groupOfUniqueNames');
for ($i = 0; $i < sizeof($modules); $i++) {
if ($this->getAccountContainer()->getAccountModule($modules[$i]) != null) {
$attrs = $this->getAccountContainer()->getAccountModule($modules[$i])->getAttributes();
if (isset($attrs['cn'][0])) {
return $attrs['cn'][0];
}
}
}
return null;
}
/**
* In this function the LDAP account is built up.
*
* @param array $rawAccounts list of hash arrays (name => value) from user input
* @param array $partialAccounts list of hash arrays (name => value) which are later added to LDAP
* @param array $ids list of IDs for column position (e.g. "posixAccount_uid" => 5)
* @return array list of error messages if any
*/
function build_uploadAccounts($rawAccounts, $ids, &$partialAccounts) {
// search existing Samba 3 domains
2006-01-01 16:30:05 +00:00
$domains = search_domains();
$nameToSID = array();
// get domain SIDs
for ($i = 0; $i < sizeof($domains); $i++) {
$nameToSID[$domains[$i]->name] = $domains[$i]->SID;
}
// get domain RID bases
$nameToRIDBase = array();
for ($i = 0; $i < sizeof($domains); $i++) {
$nameToRIDBase[$domains[$i]->name] = $domains[$i]->RIDbase;
}
2006-05-17 18:32:10 +00:00
$errors = array();
for ($i = 0; $i < sizeof($rawAccounts); $i++) {
2004-10-10 17:59:41 +00:00
// group type
if ($rawAccounts[$i][$ids['sambaGroupMapping_groupType']] != "") {
if (in_array($rawAccounts[$i][$ids['sambaGroupMapping_groupType']], $this->sambaGroupTypes)) { // number given
$partialAccounts[$i]['sambaGroupType'] = $rawAccounts[$i][$ids['sambaGroupMapping_groupType']];
}
elseif (in_array($rawAccounts[$i][$ids['sambaGroupMapping_groupType']], array_keys($this->sambaGroupTypes))) { // description given
$partialAccounts[$i]['sambaGroupType'] = $this->sambaGroupTypes[$rawAccounts[$i][$ids['sambaGroupMapping_groupType']]];
}
else { // invalid type
$errMsg = $this->messages['groupType'][0];
array_push($errMsg, array($i, implode(", ", array_keys($this->sambaGroupTypes) + $this->sambaGroupTypes)));
2006-05-17 18:32:10 +00:00
$errors[] = $errMsg;
2004-10-10 17:59:41 +00:00
}
}
else {
$partialAccounts[$i]['sambaGroupType'] = "2"; // 2 is the default (domain group)
}
if (!in_array("sambaGroupMapping", $partialAccounts[$i]['objectClass'])) $partialAccounts[$i]['objectClass'][] = "sambaGroupMapping";
// SID
$domSID = $nameToSID[$rawAccounts[$i][$ids['sambaGroupMapping_domain']]];
if (!isset($domSID)) {
2004-10-03 18:06:57 +00:00
$errMsg = $this->messages['sambaSID'][1];
array_push($errMsg, $rawAccounts[$i][$ids['sambaGroupMapping_domain']]);
array_push($errMsg, $i);
2006-05-17 18:32:10 +00:00
$errors[] = $errMsg;
}
else {
// RID
$rid = $rawAccounts[$i][$ids['sambaGroupMapping_rid']];
if (isset($this->rids[$rid])) $rid = $this->rids[$rid];
// check if RID has to be calculated
if (($rid == "") || (!isset($rid))) {
$ridBase = $nameToRIDBase[$rawAccounts[$i][$ids['sambaGroupMapping_domain']]];
$partialAccounts[$i]['sambaSID'] = $domSID . "-" . (($partialAccounts[$i]['gidNumber'] * 2) + $ridBase + 1);
}
elseif (get_preg($rid, 'digit')) {
$partialAccounts[$i]['sambaSID'] = $domSID . "-" . $rid;
}
}
// display name (UTF-8, no regex check needed)
if ($rawAccounts[$i][$ids['sambaGroupMapping_name']] == "") {
$partialAccounts[$i]['displayName'] = $partialAccounts[$i]['cn'];
}
else {
$partialAccounts[$i]['displayName'] = $rawAccounts[$i][$ids['sambaGroupMapping_name']];
}
}
2006-05-17 18:32:10 +00:00
return $errors;
}
2007-11-03 14:17:19 +00:00
/**
* Returns the HTML meta data for the main account page.
*
* @return array HTML meta data
*/
2006-08-14 17:24:27 +00:00
function display_html_attributes() {
2007-11-18 11:16:03 +00:00
if (isset($_POST['form_subpage_sambaGroupMapping_attributes_addObjectClass'])) {
$this->attributes['objectClass'][] = 'sambaGroupMapping';
}
2007-11-18 11:16:03 +00:00
$return = array();
if (in_array('sambaGroupMapping', $this->attributes['objectClass'])) {
$sambaDomains = search_domains();
if (sizeof($sambaDomains) == 0) {
StatusMessage("ERROR", _('No Samba 3 domains found in LDAP! Please create one first.'), '');
return array();
}
2007-11-18 11:16:03 +00:00
// Get Domain-SID from group SID
if (isset($this->attributes['sambaSID'][0])) {
$domainSID = substr($this->attributes['sambaSID'][0], 0, strrpos($this->attributes['sambaSID'][0], "-"));
}
2007-11-18 11:16:03 +00:00
for ($i=0; $i<count($sambaDomains); $i++ ) {
// List with all valid domains
$sambaDomainNames[] = $sambaDomains[$i]->name;
if (isset($domainSID) && ($domainSID==$sambaDomains[$i]->SID)) {
$SID = $sambaDomains[$i]->SID;
$sel_domain = $sambaDomains[$i]->name;
}
}
$displayName = '';
if (isset($this->attributes['displayName'][0])) $displayName = $this->attributes['displayName'][0];
2008-12-18 12:21:07 +00:00
$return[] = array (
array('kind' => 'text', 'text' => _('Display name') ),
array('kind' => 'input', 'name' => 'displayName', 'type' => 'text', 'size' => '30', 'maxlength' => '50', 'value' => $displayName),
array('kind' => 'help', 'value' => 'displayName' ));
2007-11-18 11:16:03 +00:00
$names = array_keys($this->rids);
$wrid=false;
for ($i=0; $i<count($names); $i++) {
if (isset($this->attributes['sambaSID'][0]) && ($this->attributes['sambaSID'][0]==$SID."-".$this->rids[$names[$i]])) {
$selected[] = $names[$i];
$wrid=true;
}
else $options[] = $names[$i];
}
if ($wrid) {
2008-12-18 12:21:07 +00:00
$options[] = $this->getCn();
2007-11-18 11:16:03 +00:00
}
else {
2008-12-18 12:21:07 +00:00
$selected[] = $this->getCn();
2007-11-18 11:16:03 +00:00
}
2008-12-18 12:21:07 +00:00
$return[] = array(
array('kind' => 'text', 'text' => _('Windows group') ),
array('kind' => 'select', 'name' => 'sambaSID', 'options' => $options, 'options_selected' => $selected),
array('kind' => 'help', 'value' => 'sambaSID' ));
2007-11-18 11:16:03 +00:00
$names = array_keys($this->sambaGroupTypes);
$selected = array( _('Domain group') );
for ($i=0; $i<count($names); $i++) {
if (!isset($this->attributes['sambaGroupType'][0])) break;
if ($this->attributes['sambaGroupType'][0]==$this->sambaGroupTypes[$names[$i]]) $selected = array( $names[$i] );
}
2008-12-18 12:21:07 +00:00
$return[] = array(
array('kind' => 'text', 'text' => _('Group type') ),
array('kind' => 'select', 'name' => 'sambaGroupType', 'options' => $names , 'options_selected' => $selected ),
array('kind' => 'help', 'value' => 'type' ));
2007-11-18 11:16:03 +00:00
$selectedDomain = array();
if (isset($sel_domain)) $selectedDomain = array($sel_domain);
2008-12-18 12:21:07 +00:00
$return[] = array(
array('kind' => 'text', 'text' => _('Domain') ),
array('kind' => 'select', 'name' => 'sambaDomainName', 'options' => $sambaDomainNames, 'options_selected' => $selectedDomain),
array('kind' => 'help', 'value' => 'sambaDomainName' ));
2007-10-10 19:04:39 +00:00
}
else {
2007-11-18 11:16:03 +00:00
$return[] = array(
array('kind' => 'text', 'text' => '&nbsp;'),
array('kind' => 'input', 'type' => 'submit', 'name' => 'form_subpage_sambaGroupMapping_attributes_addObjectClass', 'value' => _('Add Samba 3 account'))
);
2006-05-13 08:55:31 +00:00
}
return $return;
2008-12-18 12:21:07 +00:00
}
2004-06-13 19:58:58 +00:00
/**
* Returns meta data that is interpreted by parent class
*
* @return array array with meta data
2008-02-03 14:28:28 +00:00
*
* @see baseModule::get_metaData()
2004-06-13 19:58:58 +00:00
*/
function get_metaData() {
$return = array();
2007-11-19 18:42:03 +00:00
// icon
$return['icon'] = 'samba.png';
2004-06-13 19:58:58 +00:00
// manages group accounts
$return["account_types"] = array("group");
2004-06-14 16:05:36 +00:00
// alias name
$return["alias"] = _('Samba 3');
2004-06-20 17:32:02 +00:00
// module dependencies
2008-12-18 12:21:07 +00:00
$return['dependencies'] = array('depends' => array(array('posixGroup', 'rfc2307bisPosixGroup')), 'conflicts' => array());
// managed object classes
$return['objectClasses'] = array('sambaGroupMapping');
2006-05-13 08:55:31 +00:00
// managed attributes
$return['attributes'] = array('gidNumber', 'sambaSID', 'sambaGroupType', 'displayName', 'sambaSIDList', 'description');
// available PDF fields
2004-10-30 16:46:06 +00:00
$return['PDF_fields'] = array(
'gidNumber',
'sambaSID',
'displayName',
'sambaGroupType',
'description'
);
2004-08-28 11:53:40 +00:00
// upload fields
2004-10-12 13:13:04 +00:00
// search existing Samba 3 domains
2008-05-15 17:32:59 +00:00
if (isset($_SESSION['loggedIn']) && ($_SESSION['loggedIn'] === true)) {
2006-01-01 16:30:05 +00:00
$domains = search_domains();
2005-02-24 20:50:48 +00:00
$domainNames = array();
for ($i = 0; $i < sizeof($domains); $i++) $domainNames[] = $domains[$i]->name;
$return['upload_columns'] = array(
array(
'name' => 'sambaGroupMapping_domain',
'description' => _('Samba domain name'),
'help' => 'sambaDomainName',
'example' => $domainNames[0],
'values' => implode(", ", $domainNames),
'required' => true
),
array(
'name' => 'sambaGroupMapping_name',
'description' => _('Samba display name'),
'help' => 'displayName',
'example' => _('Domain administrators')
),
array(
'name' => 'sambaGroupMapping_rid',
'description' => _('Samba RID number'),
'help' => 'rid',
2006-10-22 07:53:33 +00:00
'example' => _('Domain admins')
2005-02-24 20:50:48 +00:00
),
array(
'name' => 'sambaGroupMapping_groupType',
'description' => _('Samba group type'),
'help' => 'type',
'values' => implode(", ", array_keys($this->sambaGroupTypes) + $this->sambaGroupTypes),
'example' => '2'
)
);
2008-12-18 12:21:07 +00:00
$return['upload_preDepends'] = array('posixGroup', 'rfc2307bisPosixGroup');
2005-02-24 20:50:48 +00:00
}
// help Entries
2004-09-26 11:18:05 +00:00
$return['help'] = array(
'displayName' => array(
"Headline" => _("Display name"),
2004-10-30 16:46:06 +00:00
"Text" => _("This is the group name which will be shown in Windows.")
),
2004-09-26 11:18:05 +00:00
'sambaSID' => array(
2005-06-18 16:12:01 +00:00
"Headline" => _("Windows group name"),
2004-10-30 16:46:06 +00:00
"Text" => _("If you want to use a well known RID you can selcet a well known group.")
),
2004-09-26 11:18:05 +00:00
'rid' => array(
"Headline" => _("Samba RID number"),
2004-10-30 16:46:06 +00:00
"Text" => _("This is the relative ID (similar to UID on Unix) for Windows accounts. If you leave this empty LAM will calculate the RID from the UID. This can be either a number or the name of a special group:") . ' ' . implode(", ", array_keys($this->rids))
),
2004-09-26 11:18:05 +00:00
'sambaDomainName' => array(
"Headline" => _("Domain"),
2004-10-30 16:46:06 +00:00
"Text" => _("Windows-Domain name of group."). ' '. _("Can be left empty.")
),
2004-10-10 17:59:41 +00:00
'type' => array(
"Headline" => _("Samba group type"),
2004-10-30 16:46:06 +00:00
"Text" => _("Windows group type.")
)
);
2006-08-14 17:24:27 +00:00
2004-06-13 19:58:58 +00:00
return $return;
}
/**
* Returns the PDF entries for this module.
2006-08-14 17:24:27 +00:00
*
* @return array list of possible PDF entries
*/
function get_pdfEntries() {
return array( 'sambaGroupMapping_gidNumber' => array('<block><key>' . _('GID number') . '</key><value>' . $this->attributes['gidNumber'][0] . '</value></block>'),
'sambaGroupMapping_sambaSID' => array('<block><key>' . _('Windows group') . '</key><value>' . $this->attributes['sambaSID'][0] . '</value></block>'),
'sambaGroupMapping_displayName' => array('<block><key>' . _('Display name') . '</key><value>' . $this->attributes['displayName'][0] . '</value></block>'),
'sambaGroupMapping_sambaGroupType' => array('<block><key>' . _('Samba group type') . '</key><value>' . $this->attributes['sambaGroupType'][0] . '</value></block>'),
'sambaGroupMapping_description' => array('<block><key>' . _('Description') . '</key><value>' . $this->attributes['description'][0] . '</value></block>'));
}
/**
* Returns a list of elements for the account profiles.
*
* @return profile elements
*/
function get_profileOptions() {
$return = array();
// get list of domains
2006-01-01 16:30:05 +00:00
$sambaDomains = search_domains();
$sambaDomainNames = array();
for ($i = 0; $i < count($sambaDomains); $i++ ) {
// extract names
$sambaDomainNames[] = $sambaDomains[$i]->name;
}
// domain
$return[] = array (
2008-12-18 12:21:07 +00:00
array('kind' => 'text', 'text' => _('Domain')),
array('kind' => 'select', 'name' => 'sambaGroupMapping_sambaDomainName', 'options' => $sambaDomainNames, 'options_selected' => array ()),
array('kind' => 'help', 'value' => 'sambaDomainName' ));
return $return;
2004-09-21 10:43:29 +00:00
}
2005-01-23 12:15:03 +00:00
/**
* Loads the values of an account profile into internal variables.
*
* @param array $profile hash array with profile values (identifier => value)
*/
function load_profile($profile) {
if (isset($profile['sambaGroupMapping_sambaDomainName'][0])) {
// get list of domains
2006-01-01 16:30:05 +00:00
$sambaDomains = search_domains();
2005-01-23 12:15:03 +00:00
for ($i = 0; $i < sizeof($sambaDomains); $i++) {
if ($sambaDomains[$i]->name == $profile['sambaGroupMapping_sambaDomainName'][0]) {
$this->attributes['sambaSID'][0] = $sambaDomains[$i]->SID . "-0";
break;
}
}
}
}
/** this functin fills the error message array with messages
**/
function load_Messages() {
2005-03-03 20:26:54 +00:00
$this->messages['sambaSID'][0] = array('ERROR', _('There can be only one group of this type.')); // third parameter must be set dynamically
2004-10-23 12:11:38 +00:00
$this->messages['sambaSID'][1] = array('ERROR', _("Account %s:") . " (sambaGroupMapping_domain): " . _("LAM was unable to find a Samba 3 domain with this name!")); // third parameter must be set dynamically
$this->messages['groupType'][0] = array('ERROR', _("Account %s:") . " (sambaGroupMapping_type): " . _("This is not a valid Samba 3 group type!"), _("Possible values") . ": %s");
}
2007-11-03 14:17:19 +00:00
/**
* This function is used to check if this module page can be displayed.
* It returns false if a module depends on data from other modules which was not yet entered.
*
* @return boolean true, if page can be displayed
*/
function module_ready() {
2008-12-18 12:21:07 +00:00
if (($this->getGID() == null) || ($this->getGID() == '')) {
return false;
}
return true;
}
/**
* Processes user input of the primary module page.
* It checks if all input values are correct and updates the associated LDAP attributes.
*
* @return array list of info/error messages
*/
2006-08-14 17:24:27 +00:00
function process_attributes() {
2007-11-18 11:16:03 +00:00
if (!in_array('sambaGroupMapping', $this->attributes['objectClass'])) {
return array();
}
2006-05-17 18:32:10 +00:00
$errors = array();
2006-01-01 16:30:05 +00:00
$sambaDomains = search_domains();
if (sizeof($sambaDomains) == 0) {
return array(array(array("ERROR", _('No Samba 3 domains found in LDAP! Please create one first.'))));
}
2004-10-09 14:15:56 +00:00
// Save attributes
2006-08-14 17:24:27 +00:00
$this->attributes['displayName'][0] = $_POST['displayName'];
$this->attributes['sambaGroupType'][0] = $this->sambaGroupTypes[$_POST['sambaGroupType']];
2003-12-30 15:36:30 +00:00
// Get Domain SID from name
2006-05-13 08:55:31 +00:00
for ($i=0; $i<count($sambaDomains); $i++ ) {
2006-08-14 17:24:27 +00:00
if (!isset($_POST['sambaDomainName'])) break;
if ($_POST['sambaDomainName'] == $sambaDomains[$i]->name) {
$SID = $sambaDomains[$i]->SID;
2006-05-13 08:55:31 +00:00
$RIDbase = $sambaDomains[$i]->RIDbase;
}
}
// Load attributes
2006-08-14 17:24:27 +00:00
$this->attributes['displayName'][0] = $_POST['displayName'];
$rids = array_keys($this->rids);
$wrid = false;
for ($i=0; $i<count($rids); $i++) {
2006-08-14 17:24:27 +00:00
if ($_POST['sambaSID'] == $rids[$i]) {
$wrid = true;
// Get Domain SID
$this->attributes['sambaSID'][0] = $SID."-".$this->rids[$rids[$i]];
2005-03-03 20:26:54 +00:00
// Do a check if special group is unique
2007-10-03 18:02:10 +00:00
if ($this->getAccountContainer()->isNewAccount) {
2005-12-17 12:11:51 +00:00
if ($_SESSION['cache']->in_cache($SID."-".$this->rids[$rids[$i]], 'sambaSID', 'group')) {
$message = $this->messages['sambaSID'][0];
$message[] = $rids[$i];
2006-08-16 17:42:35 +00:00
$errors[] = $message;
2005-12-17 12:11:51 +00:00
}
2003-12-30 15:36:30 +00:00
}
}
2005-03-03 20:26:54 +00:00
}
2007-10-10 19:04:39 +00:00
if (!$wrid) {
2008-12-18 12:21:07 +00:00
$this->attributes['sambaSID'][0] = $SID . "-" . ($this->getGID()*2+$RIDbase+1);
2007-10-10 19:04:39 +00:00
}
2003-12-30 15:36:30 +00:00
// Return error-messages
2006-05-17 18:32:10 +00:00
return $errors;
}
2007-11-03 14:17:19 +00:00
/**
* Returns a list of modifications which have to be made to the LDAP account.
*
* @return array list of modifications
* <br>This function returns an array with 3 entries:
* <br>array( DN1 ('add' => array($attr), 'remove' => array($attr), 'modify' => array($attr)), DN2 .... )
* <br>DN is the DN to change. It may be possible to change several DNs (e.g. create a new user and add him to some groups via attribute memberUid)
* <br>"add" are attributes which have to be added to LDAP entry
* <br>"remove" are attributes which have to be removed from LDAP entry
* <br>"modify" are attributes which have to been modified in LDAP entry
*/
function save_attributes() {
2007-11-18 11:16:03 +00:00
if (!in_array('sambaGroupMapping', $this->attributes['objectClass'])) {
return array();
}
2007-11-18 11:16:03 +00:00
return $this->getAccountContainer()->save_module_attributes($this->attributes, $this->orig);
}
}
?>