3333use OCA \User_LDAP \LDAPProvider ;
3434use OCP \AppFramework \QueryException ;
3535use OCP \IGroupManager ;
36+ use OCP \IUserSession ;
3637use OCP \ILogger ;
3738use OCP \LDAP \ILDAPProvider ;
3839
@@ -41,6 +42,9 @@ class LDAPGroupManager implements ILDAPGroupPlugin {
4142 /** @var ILDAPProvider */
4243 private $ ldapProvider ;
4344
45+ /** @var IUserSession */
46+ private $ userSession ;
47+
4448 /** @var IGroupManager */
4549 private $ groupManager ;
4650
@@ -49,8 +53,9 @@ class LDAPGroupManager implements ILDAPGroupPlugin {
4953 /** @var ILogger */
5054 private $ logger ;
5155
52- public function __construct (IGroupManager $ groupManager , LDAPConnect $ ldapConnect , ILogger $ logger , ILDAPProvider $ ldapProvider ) {
56+ public function __construct (IGroupManager $ groupManager , IUserSession $ userSession , LDAPConnect $ ldapConnect , ILogger $ logger , ILDAPProvider $ ldapProvider ) {
5357 $ this ->groupManager = $ groupManager ;
58+ $ this ->userSession = $ userSession ;
5459 $ this ->ldapConnect = $ ldapConnect ;
5560 $ this ->logger = $ logger ;
5661 $ this ->ldapProvider = $ ldapProvider ;
@@ -84,15 +89,27 @@ public function respondToActions() {
8489 * @return string|null
8590 */
8691 public function createGroup ($ gid ) {
92+ $ adminUser = $ this ->userSession ->getUser ();
93+ $ requireActorFromLDAP = $ this ->configuration ->isLdapActorRequired ();
94+ if ($ requireActorFromLDAP && !$ adminUser instanceof IUser) {
95+ throw new Exception ('Acting user is not from LDAP ' );
96+ }
97+ try {
98+ $ connection = $ this ->ldapProvider ->getLDAPConnection ($ adminUser ->getUID ());
99+ // TODO: what about multiple bases?
100+ $ base = $ this ->ldapProvider ->getLDAPBaseGroups ($ adminUser ->getUID ());
101+ } catch (Exception $ e ) {
102+ if ($ requireActorFromLDAP ) {
103+ if ($ this ->configuration ->isPreventFallback ()) {
104+ throw new \Exception ('Acting admin is not from LDAP ' , 0 , $ e );
105+ }
106+ return false ;
107+ }
108+ $ connection = $ this ->ldapConnect ->getLDAPConnection ();
109+ $ base = $ this ->ldapConnect ->getLDAPBaseGroups ()[0 ];
110+ }
87111
88- /**
89- * FIXME could not create group using LDAPProvider, because its methods rely
90- * on passing an already inserted [ug]id, which we do not have at this point.
91- */
92-
93- $ newGroupEntry = $ this ->buildNewEntry ($ gid );
94- $ connection = $ this ->ldapConnect ->getLDAPConnection ();
95- $ newGroupDN = "cn= $ gid, " . $ this ->ldapConnect ->getLDAPBaseGroups ()[0 ];
112+ list ($ newGroupDN , $ newGroupEntry ) = $ this ->buildNewEntry ($ gid , $ base );
96113 $ newGroupDN = $ this ->ldapProvider ->sanitizeDN ([$ newGroupDN ])[0 ];
97114
98115 if ($ ret = ldap_add ($ connection , $ newGroupDN , $ newGroupEntry )) {
@@ -223,12 +240,30 @@ public function isLDAPGroup($gid) {
223240 }
224241 }
225242
226- private function buildNewEntry ($ gid ) {
227- return [
228- 'objectClass ' => ['groupOfNames ' , 'top ' ],
229- 'cn ' => $ gid ,
230- 'member ' => ['' ]
231- ];
243+ private function buildNewEntry ($ gid , $ base ) {
244+ $ ldif = $ this ->configuration ->getGroupTemplate ();
245+
246+ $ ldif = str_replace ('{GID} ' , $ gid , $ ldif );
247+ $ ldif = str_replace ('{BASE} ' , $ base , $ ldif );
248+
249+ $ entry = [];
250+ $ lines = explode (PHP_EOL , $ ldif );
251+ foreach ($ lines as $ line ) {
252+ $ split = explode (': ' , $ line , 2 );
253+ $ key = trim ($ split [0 ]);
254+ $ value = trim ($ split [1 ]);
255+ if (!isset ($ entry [$ key ])) {
256+ $ entry [$ key ] = $ value ;
257+ } else if (is_array ($ entry [$ key ])) {
258+ $ entry [$ key ][] = $ value ;
259+ } else {
260+ $ entry [$ key ] = [$ entry [$ key ], $ value ];
261+ }
262+ }
263+ $ dn = $ entry ['dn ' ];
264+ unset($ entry ['dn ' ]);
265+
266+ return [$ dn , $ entry ];
232267 }
233268
234269 public function makeLdapBackendFirst () {
0 commit comments