From ea7c291daac77fefcfe1fffb8955ed6994bf25da Mon Sep 17 00:00:00 2001 From: Roland Gruber Date: Sat, 29 Dec 2007 11:02:00 +0000 Subject: [PATCH] added schema check --- lam/HISTORY | 1 + lam/templates/tests/index.php | 9 +- lam/templates/tests/schemaTest.php | 155 +++++++++++++++++++++++++++++ 3 files changed, 163 insertions(+), 2 deletions(-) create mode 100644 lam/templates/tests/schemaTest.php diff --git a/lam/HISTORY b/lam/HISTORY index bb8c15a1..07893fc7 100644 --- a/lam/HISTORY +++ b/lam/HISTORY @@ -12,6 +12,7 @@ - Unix: allow to generate random passwords for users - Samba 3 groups: Samba part is now optional - Personal: add object classes person and organizationalPerson for new accounts (RFE 1830033) + - new LDAP schema check on tests page - LAM Pro: added possibility for deskside support to reset passwords at account list page diff --git a/lam/templates/tests/index.php b/lam/templates/tests/index.php index a160ec80..a2500042 100644 --- a/lam/templates/tests/index.php +++ b/lam/templates/tests/index.php @@ -52,11 +52,16 @@ echo "

" . _("LAM tests") . "

\n"; echo "\n"; -echo ""; -echo ""; +echo ""; +echo ""; + +echo ""; +echo ""; echo "
" . _("Lamdaemon test") . "  " . _("Check if quotas and homedirectories can be managed.") . "
" . _("Lamdaemon test") . "  " . _("Check if quotas and homedirectories can be managed.") . "
" . _("Schema test") . "  " . _("Check if the LDAP schema fits the requirements of the selected account modules.") . "
\n"; + + echo "\n"; echo "\n"; diff --git a/lam/templates/tests/schemaTest.php b/lam/templates/tests/schemaTest.php new file mode 100644 index 00000000..13a42637 --- /dev/null +++ b/lam/templates/tests/schemaTest.php @@ -0,0 +1,155 @@ +\n"; +echo "\n"; +$types = $_SESSION['config']->get_ActiveTypes(); +for ($t = 0; $t < sizeof($types); $t++) { + echo "\n"; +} +echo ""; + +echo "\n"; + +echo "

" . _("Schema test") . "

\n"; + +get_schema_objectclasses(); +$classes = get_cached_schema('objectclasses'); + +if (!is_array($classes)) { + StatusMessage('ERROR', _('Unable to retrieve schema!'), _('You do not have the required access rights or the LDAP schema is not published by your server.')); + echo "\n"; + die(); +} + +// loop for active account types +for ($t = 0; $t < sizeof($types); $t++) { + $modules = $_SESSION['config']->get_AccountModules($types[$t]); + echo "

" . getTypeAlias($types[$t]) . "

\n"; + echo "\n"; + + for ($m = 0; $m < sizeof($modules); $m++) { + $error = checkSchemaForModule($modules[$m], $types[$t]); + $message = _("No problems found."); + $icon = '../../graphics/pass.png'; + if ($error != null) { + $icon = '../../graphics/fail.png'; + $message = $error; + } + // module name + echo "\n"; + echo "\n"; + // icon + echo "\n"; + // text + echo "\n"; + echo "\n"; + } + + echo "
" . getModuleAlias($modules[$m], $types[$t]) . "\"\"" . $message . "
\n
"; +} + +echo "\n"; +echo "\n"; + +/** + * Checks if the object classes and attributes for this module are available. + * + * @param String $name module name + * @param String $type type (user, group, ...) + * @return String error message or null + */ +function checkSchemaForModule($name, $type) { + $module = new $name($type); + $classes = $module->getManagedObjectClasses(); + $attrs = $module->getManagedAttributes(); + $aliases = array_flip($module->getLDAPAliases()); + if (sizeof($classes) == 0) { + return null; + } + $schemaClasses = get_cached_schema('objectclasses'); + $schemaAttrs = array(); + // check if object classes are supported + for ($o = 0; $o < sizeof($classes); $o++) { + if (!isset($schemaClasses[strtolower($classes[$o])])) { + return sprintf(_("The object class %s is not supported by your LDAP server."), $classes[$o]); + } + // get attribute names + $schemaAttrs = array_merge($schemaAttrs, getRecursiveAttributesFromObjectClass($schemaClasses[strtolower($classes[$o])])); + } + // check if attributes are supported + for ($a = 0; $a < sizeof($attrs); $a++) { + if (!in_array_ignore_case($attrs[$a], $schemaAttrs)) { + if (isset($aliases[$attrs[$a]]) && in_array_ignore_case($aliases[$attrs[$a]], $schemaAttrs)) { + continue; + } + return sprintf(_("The attribute %s is not supported for the object class(es) %s by your LDAP server."), $attrs[$a], implode(", ", $classes)); + } + } + return null; +} + +/** + * Returns the names of all attributes which are managed by the given object class and its parents. + * + * @param ObjectClass $oClass object class + * @return array list of attribute names + */ +function getRecursiveAttributesFromObjectClass($oClass) { + $attrs = array(); + $attrs = array_merge($attrs, $oClass->getMustAttrNames()); + $attrs = array_merge($attrs, $oClass->getMayAttrNames()); + $subClassNames = $oClass->getSupClasses(); + for ($i = 0; $i < sizeof($subClassNames); $i++) { + $schemaClasses = get_cached_schema('objectclasses'); + $subClass = $schemaClasses[strtolower($subClassNames[$i])]; + $attrs = array_merge($attrs, getRecursiveAttributesFromObjectClass($subClass)); + } + return $attrs; +} + +?>