From 75ce9a4832425f6a0226815c5d3407108a36d1ba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=B4me=20Chilliet?= Date: Mon, 31 Jan 2022 14:44:59 +0100 Subject: [PATCH 1/4] Fix ldap:check-user method for newly created LDAP users MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Côme Chilliet --- apps/user_ldap/lib/Command/CheckUser.php | 26 ++++++++++-------------- 1 file changed, 11 insertions(+), 15 deletions(-) diff --git a/apps/user_ldap/lib/Command/CheckUser.php b/apps/user_ldap/lib/Command/CheckUser.php index e6b5a634a24a9..d05d341f6d9f2 100644 --- a/apps/user_ldap/lib/Command/CheckUser.php +++ b/apps/user_ldap/lib/Command/CheckUser.php @@ -90,7 +90,7 @@ protected function execute(InputInterface $input, OutputInterface $output): int try { $uid = $input->getArgument('ocName'); $this->isAllowed($input->getOption('force')); - $this->confirmUserIsMapped($uid); + $wasMapped = $this->userWasMapped($uid); $exists = $this->backend->userExistsOnLDAP($uid, true); if ($exists === true) { $output->writeln('The user is still available on LDAP.'); @@ -98,13 +98,15 @@ protected function execute(InputInterface $input, OutputInterface $output): int $this->updateUser($uid, $output); } return 0; + } elseif ($wasMapped) { + $this->dui->markUser($uid); + $output->writeln('The user does not exists on LDAP anymore.'); + $output->writeln('Clean up the user\'s remnants by: ./occ user:delete "' + . $uid . '"'); + return 0; + } else { + throw new \Exception('The given user is not a recognized LDAP user.'); } - - $this->dui->markUser($uid); - $output->writeln('The user does not exists on LDAP anymore.'); - $output->writeln('Clean up the user\'s remnants by: ./occ user:delete "' - . $uid . '"'); - return 0; } catch (\Exception $e) { $output->writeln('' . $e->getMessage(). ''); return 1; @@ -114,16 +116,10 @@ protected function execute(InputInterface $input, OutputInterface $output): int /** * checks whether a user is actually mapped * @param string $ocName the username as used in Nextcloud - * @throws \Exception - * @return true */ - protected function confirmUserIsMapped($ocName) { + protected function userWasMapped(string $ocName): bool { $dn = $this->mapping->getDNByName($ocName); - if ($dn === false) { - throw new \Exception('The given user is not a recognized LDAP user.'); - } - - return true; + return ($dn !== false); } /** From a4f96c18e913f503be4388073f481d3c609865e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=B4me=20Chilliet?= <91878298+come-nc@users.noreply.github.com> Date: Mon, 7 Feb 2022 09:47:40 +0100 Subject: [PATCH 2/4] Remove parenthesis around return in apps/user_ldap/lib/Command/CheckUser.php MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Carl Schwan Signed-off-by: Côme Chilliet --- apps/user_ldap/lib/Command/CheckUser.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/user_ldap/lib/Command/CheckUser.php b/apps/user_ldap/lib/Command/CheckUser.php index d05d341f6d9f2..c35557f67ed47 100644 --- a/apps/user_ldap/lib/Command/CheckUser.php +++ b/apps/user_ldap/lib/Command/CheckUser.php @@ -119,7 +119,7 @@ protected function execute(InputInterface $input, OutputInterface $output): int */ protected function userWasMapped(string $ocName): bool { $dn = $this->mapping->getDNByName($ocName); - return ($dn !== false); + return $dn !== false; } /** From a6ad06f940ce7d79a72262e67860cf237593bb09 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=B4me=20Chilliet?= Date: Mon, 7 Feb 2022 10:06:19 +0100 Subject: [PATCH 3/4] Improve typing in apps/user_ldap/lib/Command/CheckUser.php MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Côme Chilliet --- apps/user_ldap/lib/Command/CheckUser.php | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/apps/user_ldap/lib/Command/CheckUser.php b/apps/user_ldap/lib/Command/CheckUser.php index c35557f67ed47..7476afb1bfefc 100644 --- a/apps/user_ldap/lib/Command/CheckUser.php +++ b/apps/user_ldap/lib/Command/CheckUser.php @@ -4,6 +4,7 @@ * * @author Arthur Schiwon * @author Christoph Wurst + * @author Côme Chilliet * @author Joas Schilling * @author Morris Jobke * @author Roeland Jago Douma @@ -48,12 +49,6 @@ class CheckUser extends Command { /** @var UserMapping */ protected $mapping; - /** - * @param User_Proxy $uBackend - * @param Helper $helper - * @param DeletedUsersIndex $dui - * @param UserMapping $mapping - */ public function __construct(User_Proxy $uBackend, Helper $helper, DeletedUsersIndex $dui, UserMapping $mapping) { $this->backend = $uBackend; $this->helper = $helper; @@ -62,7 +57,7 @@ public function __construct(User_Proxy $uBackend, Helper $helper, DeletedUsersIn parent::__construct(); } - protected function configure() { + protected function configure(): void { $this ->setName('ldap:check-user') ->setDescription('checks whether a user exists on LDAP.') @@ -89,7 +84,7 @@ protected function configure() { protected function execute(InputInterface $input, OutputInterface $output): int { try { $uid = $input->getArgument('ocName'); - $this->isAllowed($input->getOption('force')); + $this->assertAllowed($input->getOption('force')); $wasMapped = $this->userWasMapped($uid); $exists = $this->backend->userExistsOnLDAP($uid, true); if ($exists === true) { @@ -125,9 +120,8 @@ protected function userWasMapped(string $ocName): bool { /** * checks whether the setup allows reliable checking of LDAP user existence * @throws \Exception - * @return true */ - protected function isAllowed($force) { + protected function assertAllowed(bool $force): void { if ($this->helper->haveDisabledConfigurations() && !$force) { throw new \Exception('Cannot check user existence, because ' . 'disabled LDAP configurations are present.'); @@ -136,8 +130,6 @@ protected function isAllowed($force) { // we don't check ldapUserCleanupInterval from config.php because this // action is triggered manually, while the setting only controls the // background job. - - return true; } private function updateUser(string $uid, OutputInterface $output): void { From 44680b5c3b5b441192a36cc5fada5e23fe7de571 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=B4me=20Chilliet?= Date: Mon, 7 Feb 2022 10:32:18 +0100 Subject: [PATCH 4/4] Make it explicit that a DN can be used for ldap:check-user MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Côme Chilliet --- apps/user_ldap/lib/Access.php | 4 ++-- apps/user_ldap/lib/Command/CheckUser.php | 10 ++++++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/apps/user_ldap/lib/Access.php b/apps/user_ldap/lib/Access.php index ed5e5bff9cef8..bda495bc9a852 100644 --- a/apps/user_ldap/lib/Access.php +++ b/apps/user_ldap/lib/Access.php @@ -488,7 +488,7 @@ public function dn2groupname($fdn, $ldapName = null) { /** * returns the internal Nextcloud name for the given LDAP DN of the user, false on DN outside of search DN or failure * - * @param string $dn the dn of the user object + * @param string $fdn the dn of the user object * @param string $ldapName optional, the display name of the object * @return string|false with with the name to use in Nextcloud * @throws \Exception @@ -1770,7 +1770,7 @@ private function detectUuidAttribute(string $dn, bool $isUser = true, bool $forc /** * @param string $dn * @param bool $isUser - * @param null $ldapRecord + * @param array|null $ldapRecord * @return false|string * @throws ServerNotAvailableException */ diff --git a/apps/user_ldap/lib/Command/CheckUser.php b/apps/user_ldap/lib/Command/CheckUser.php index 7476afb1bfefc..6ccfc9c19ea55 100644 --- a/apps/user_ldap/lib/Command/CheckUser.php +++ b/apps/user_ldap/lib/Command/CheckUser.php @@ -64,7 +64,7 @@ protected function configure(): void { ->addArgument( 'ocName', InputArgument::REQUIRED, - 'the user name as used in Nextcloud' + 'the user name as used in Nextcloud, or the LDAP DN' ) ->addOption( 'force', @@ -83,8 +83,14 @@ protected function configure(): void { protected function execute(InputInterface $input, OutputInterface $output): int { try { - $uid = $input->getArgument('ocName'); $this->assertAllowed($input->getOption('force')); + $uid = $input->getArgument('ocName'); + if ($this->backend->getLDAPAccess($uid)->stringResemblesDN($uid)) { + $username = $this->backend->dn2UserName($uid); + if ($username !== false) { + $uid = $username; + } + } $wasMapped = $this->userWasMapped($uid); $exists = $this->backend->userExistsOnLDAP($uid, true); if ($exists === true) {