LDAP authentication support (#815)

src/Security/AclDecisionManager.php

@@ -20,7 +20,6 @@ class AclDecisionManager
     protected $decisionManager;
 
     /**
-     * AbstractVoter constructor.
      * @param AccessDecisionManagerInterface $decisionManager
      */
     public function __construct(AccessDecisionManagerInterface $decisionManager)
@@ -40,22 +39,4 @@ class AclDecisionManager
 
         return false;
     }
-
-    /**
-     * @param TokenInterface $token
-     * @param string|array $roles
-     * @return bool
-     */
-    public function hasRole(TokenInterface $token, $roles)
-    {
-        if (!is_array($roles)) {
-            $roles = [$roles];
-        }
-
-        if ($this->decisionManager->decide($token, $roles)) {
-            return true;
-        }
-
-        return false;
-    }
 }

src/Security/RolePermissionManager.php

@@ -49,11 +49,6 @@ class RolePermissionManager
         return array_keys($this->permissions);
     }
 
-    public function roleHasPermission(string $role): bool
-    {
-        return isset($this->permissions[$role]);
-    }
-
     public function getPermissions(): array
     {
         return $this->knownPermissions;

src/Security/RoleService.php

@@ -0,0 +1,38 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Security;
+
+class RoleService
+{
+    /**
+     * @var array
+     */
+    protected $roles;
+
+    public function __construct(array $roles)
+    {
+        $this->roles = $roles;
+    }
+
+    public function getAvailableNames(): array
+    {
+        $roles = [];
+        foreach ($this->roles as $key => $value) {
+            $roles[] = $key;
+            if (is_array($value)) {
+                foreach ($value as $name) {
+                    $roles[] = $name;
+                }
+            }
+        }
+
+        return array_values(array_unique($roles));
+    }
+}

src/Security/UserChecker.php

@@ -11,7 +11,7 @@ namespace App\Security;
 
 use App\Entity\User;
 use Symfony\Component\Security\Core\Exception\AccountStatusException;
-use Symfony\Component\Security\Core\Exception\LockedException;
+use Symfony\Component\Security\Core\Exception\DisabledException;
 use Symfony\Component\Security\Core\User\UserCheckerInterface;
 use Symfony\Component\Security\Core\User\UserInterface;
 
@@ -26,6 +26,15 @@ class UserChecker implements UserCheckerInterface
      */
     public function checkPreAuth(UserInterface $user)
     {
+        if (!($user instanceof User)) {
+            return;
+        }
+
+        if (!$user->isEnabled()) {
+            $ex = new DisabledException('User account is disabled.');
+            $ex->setUser($user);
+            throw $ex;
+        }
     }
 
     /**
@@ -34,13 +43,14 @@ class UserChecker implements UserCheckerInterface
      */
     public function checkPostAuth(UserInterface $user)
     {
-        if (!$user instanceof User) {
+        if (!($user instanceof User)) {
             return;
         }
 
-        // user account is not enabled, the user may be notified
         if (!$user->isEnabled()) {
-            throw new LockedException();
+            $ex = new DisabledException('User account is disabled.');
+            $ex->setUser($user);
+            throw $ex;
         }
     }
 }