jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix LDAP issues and allow to migrate from local to LDAP account (#4445)

Browse Source
This commit is contained in:
Kevin Papst
2023-11-17 14:37:00 +01:00
committed by GitHub
parent 2fb9ea9239
commit 92c6922afb
8 changed files with 33 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/Ldap/LdapCredentialsSubscriber.php
View File

@@ -62,9 +62,10 @@ final class LdapCredentialsSubscriber implements EventSubscriberInterface
throw new BadCredentialsException('The presented user needs to be a Kimai user.');
}
if (!$user->isLdapUser()) {
return;
}
// removing this code allows to upgrade from local to LDAP users
// if (!$user->isLdapUser()) {
// return;
// }
if (!$this->ldapManager->bind($user->getUserIdentifier(), $presentedPassword)) {
throw new BadCredentialsException('The presented password is invalid.');

32
src/Ldap/LdapManager.php
View File

@@ -77,23 +77,16 @@ class LdapManager
* - syncing user attributes
* - syncing roles
*
* @param User $user
* @throws LdapDriverException
*/
public function updateUser(User $user)
public function updateUser(User $user): void
{
$baseDn = $user->getPreferenceValue('ldap.dn');
if (null === $baseDn) {
throw new LdapDriverException('This account is not a registered LDAP user');
}
// always look up the users current DN first, as the cached DN might have been renamed in LDAP
// always look up the users current DN first, as the current user might be upgraded from local to LDAP
$userFresh = $this->findUserByUsername($user->getUserIdentifier());
if (null === $userFresh || null === ($baseDn = $userFresh->getPreferenceValue('ldap.dn'))) {
if (null === $userFresh || null === ($baseDn = $userFresh->getPreferenceValue('ldap_dn'))) {
throw new LdapDriverException(sprintf('Failed fetching user DN for %s', $user->getUserIdentifier()));
}
$user->setPreferenceValue('ldap.dn', $baseDn);
$user->setPreferenceValue('ldap_dn', $baseDn);
$params = $this->config->getUserParameters();
$entries = $this->driver->search($baseDn, $params['attributesFilter']);
@@ -142,23 +135,16 @@ class LdapManager
// ===================================================================
private function createUser(): User
public function hydrate(array $ldapEntry): User
{
$user = new User();
$user->setEnabled(true);
return $user;
}
public function hydrate(array $ldapEntry): User
{
$user = $this->createUser();
$this->hydrateUser($user, $ldapEntry);
return $user;
}
public function hydrateUser(User $user, array $ldapEntry)
public function hydrateUser(User $user, array $ldapEntry): void
{
$userParams = $this->config->getUserParameters();
$attributeMap = [];
@@ -185,14 +171,14 @@ class LdapManager
$user->setPassword('');
}
$user->setAuth(User::AUTH_LDAP);
$user->setPreferenceValue('ldap.dn', $ldapEntry['dn']);
$user->setPreferenceValue('ldap_dn', $ldapEntry['dn']);
}
/**
* @param User $user
* @param array $entries
*/
public function hydrateRoles(User $user, array $entries)
public function hydrateRoles(User $user, array $entries): void
{
$roleParams = $this->config->getRoleParameters();
$allowedRoles = $this->roles->getAvailableNames();
@@ -236,7 +222,7 @@ class LdapManager
return $role;
}
private function hydrateUserWithAttributesMap(UserInterface $user, array $ldapUserAttributes, array $attributeMap)
private function hydrateUserWithAttributesMap(UserInterface $user, array $ldapUserAttributes, array $attributeMap): void
{
$sawUsername = false;
/** @var array $attr */

7
src/Ldap/LdapUserProvider.php
View File

@@ -53,17 +53,12 @@ final class LdapUserProvider implements UserProviderInterface
throw new UnsupportedUserException(sprintf('Instances of "%s" are not supported.', \get_class($user)));
}
if (!$user->isLdapUser() && null === $user->getPreferenceValue('ldap.dn')) {
if (!$user->isLdapUser()) {
throw new UnsupportedUserException(sprintf('Account "%s" is not a registered LDAP user.', $user->getUserIdentifier()));
}
try {
$this->ldapManager->updateUser($user);
// updating old LDAP accounts
if (!$user->isLdapUser() && null !== $user->getPreferenceValue('ldap.dn')) {
$user->setAuth(User::AUTH_LDAP);
}
} catch (LdapDriverException $ex) {
throw new UnsupportedUserException(sprintf('Failed to refresh user "%s", probably DN is expired.', $user->getUserIdentifier()));
}